British Passports Use Face Biometric

Direct.Gov.uk

The chip inside the passport contains information about the holder’s face – such as the distances between eyes, nose, mouth and ears. These details are taken from the passport photograph that you supply. They can then be used to identify the passport-holder. The chip also holds the information that is printed on the personal details page of your passport.

This scheme would be useful in preventing the falsification of UK passports even if there is no true biometric matching involved.

If the chip in the passport contained only a digital copy of the passport that the government issued, a forger would need to forge the document and the chip. A forger that "found" a "lost" passport would have to alter the passport with a picture of its new user and find a way to get that new photo onto the chip. 

The UK passport chip uses RFID technology.  Travelers might want one of these.

Press Release: AmberVision Unveils Program to Help Protect Oregon's Children

(Portland, Oregon) – An advanced technology tool is now available to Oregon police departments that will provide parents greater peace-of-mind for their children’s safety.

A nationally used database system called AmberVision, designed to help law enforcement officials in cases of missing children, is being introduced to school districts and parents in the state of Oregon.  Jim Isaacson, Oregon representative for AmberVision, says “AmberVision heightens the awareness of missing children through the community and media, and provides parents a proactive opportunity to enhance their child’s safety."

One of the most important tools law enforcement needs in missing children cases is immediate access to a high-quality photograph of the child in question.  AmberVision provides the ability for law enforcement agencies to access a child’s picture and description quickly.  It also provides them the ability to instantly distribute this critical information to other agencies, media, officers in the field, etc., all in an effort to save valuable time.

By registering online for AmberVision, parents have the ability to upload a current digital picture and description of their child to a secure database. Parents also have the ability to modify and update this information, as needed, via a username and password they create.  In cases of missing and abducted children, law enforcement officials, with read-only access, can view the data and within minutes, distribute it to the necessary parties.

The cost of enrollment for parents to utilize the database is $11.99 per year, per child.  “It’s an easy, user-friendly enrollment process (www.ambervision.org).  The overall goal of AmberVision (not for profit foundation) is to heighten child safety awareness to parents and communities, provide law enforcement another tool to aide in the safe recovery of a child, allow all children to participate regardless of their financial condition, and provide parents a proactive opportunity to participate in their child’s safety.

Through the AmberVision Foundation, free enrollment is offered to children who participate in the school lunch program”, Isaacson said.  

AmberVision has been implemented in communities throughout the country.  Isaacson said, “Some Oregon schools have already distributed information to parents, and we plan to share AmberVision with all communities throughout the State”.

The system, funded by a grant from the Department of Justice in 2005, was originally developed as a paper-based program called AmberView and tested in the state of West Virginia.  After deemed a success, the program was converted to an online service and offered nationally as AmberVision in late 2009.  SecurLinx, a leader in biometric identity management systems and technology partner to AmberView, has created the AmberVision Foundation in order to help keep our communities safe for children and their families.

To avoid ID, more are mutilating fingerprints

Boston.com

H/T @heidishey

Some think these systems don't work.

So desperate was one man to conceal his identity that he began biting his fingers and drawing blood while being booked.

Some have used eyedroppers filled with acid or pressed their fingers onto burning metal to blot their fingerprints. Others have spent thousands of dollars to hire shady doctors to surgically alter their fingertips, hoping to scar them beyond recognition.

I guess these guys disagree.

AmberVision: Helping West Virginia Authorities Find Missing Children

WSAZ.com (Huntington/Charleston, WV)

The Ambervision program will kick off this fall in all West Virginia public schools. Parents will have access to a database that will allow them to change or add pertinent information about their child's appearance.

In the video below, Lisa Cordiero of the WV Board of Education does an excellent job of describing how AmberVision will work in West Virginia as well as the history behind the AmberVision Foundation.

Biometrics: it's not about the technology

Info4Security.com
Thanks to @heidishey for bringing my attention back to this excellent article by Bruce Lyman, CEO at Argus Global.

Good technology underpins many processes, both inside and without the business and, as many end users will know, understanding how technology works is rarely integral to its usefulness.

Indeed, technological excellence can in some part be measured by how little we need to know about a product to be able to use it. Such is the case with biometric technology, where the biometric itself is only part of the story.

Our real interest concerns (a) how easy it is to use on a daily basis, and by staff of varying technical aptitude and (b) what are the possible outcomes of using this technology?

Mr. Lyman goes on to examine biometric deployments in terms of Return on Investment (ROI), a topic close to our heart.

• Security ROI: the cost of making a mistake
• Productivity ROI: improvements to the business
• Financial ROI: making the strongest case

Iris vs. Finger

The future of iris scanning - ZDNetAsia.com

UPDATE: This post gets a fair amount of traffic. The link above no longer seems to work. A cached version of the article linked above may be available here. The page takes a while to load.

Biometrics has received a lot of bad press during its short life. Fingerprint technologies have issues many businesses, and security professionals, would rather not deal with. And then there is the cost. So is there a technology that may provide security, involve low maintenance costs, minimize management headaches, and is acceptable to users?

Author Tom Olzak does a good job of comparing fingerprint authentication systems to systems that use the eye's iris and he makes excellent points about their strengths and weaknesses.

As we like to say, there is no "universal donor" in biometric identity management deployments. In some cases fingerprints are the best, in others, face recognition will be the way to go. Function dictates form. A successful deployment requires a deep understanding of the use model.

FBI National Academy Associates, Boston

SecurLinx and AmberVision will be in Boston for the exhibition associated with the FBINAA festivities this weekend, July 24 & 25.

The Law Enforcement Exhibition is scheduled for Saturday and Sunday in the Hynes Convention Center, Hall C.

Law enforcement officers from the Boston area not attending the conference may obtain a Law Enforcement Day Pass to tour the exposition Saturday or Sunday. Department-issued photo ID required.

If you're in the area, please come visit us:
Booth 212.

Missing biometrics create unique problems for UID project

TheEconomicTimes (India) [Warning: site tries to open 5 pop-ups!]
This has been getting a lot of attention in the Twitterverse and elsewhere.

Scores of people the Aadhaar project will help the most do not have the sharp, curving lines on their fingers as depicted in its logo. Millions of Indians working in agriculture, construction workers and other manual labourers have worn-out fingers due to a lifetime of hard labour, resulting in what is euphemistically referred to in technical literature as ‘low-quality’ fingerprints. This is precisely the demographic that UID aims to help — those that are outside government records and welfare schemes.

While the UIDAI uses two other metrics — an iris scan and a photograph — in issuing the unique identity number, fingerprinting will be the metric used in authentication. This means a passport applicant with worn-out fingers may present his newly-issued UID number as a conclusive proof of identity, but could find the application rejected. The authentication process using a fingerprint scanner could classify the applicant’s worn-out fingers as a so-called ‘false negative’.

The Indian UID project has captured the public's attention. People are becoming aware of the promises and challenges of large scale biometric identity management deployments. This is a good thing.

On the technical front, "worn out" fingerprints don't present an insurmountable challenge to the Indian project. An ID management system that increases efficiency in the vast majority of transactions while presenting no new obstacles in the rare cases is a valuable system.

The proper way to evaluate a proposed identity management system is to compare the system currently in use to the expected performance of the envisioned system while balancing the costs of the new system against the improvements upon the old way of doing things. Too often, those skeptical about biometric ID management deployments start from the position that anything less than automated perfection is failure*. This attitude can impede the adoption of cost-saving improvements in critical organizational processes.

In adopting a multi-modal approach -- the UIDAI seems to have allowed for the use of iris for backup authentication as well as providing a photograph and an ID number -- it does not appear that India is creating an ID management system that will be unable to serve those with "worn out" fingerprints or those with disabilities that would prevent them from using a fingerprint based system.

*Similar thoughts here.

Safran Said to Be in Talks to Purchase Most of L-1 Identity Solutions Inc.

In March, we drew attention to reports that Bob LaPenta was putting L-1 on the auction block. It appears that the process is picking up steam.

From Bloomberg.com:

Safran is among the bidders pursuing a deal to buy L-1’s businesses that help customers track biometric data, said the people, who declined to be identified because the talks are private. U.S.-based L-1 is likely to be split up, with another buyer acquiring a separate unit that sells consulting services to U.S. intelligence agencies, said one of the people. No deal is likely to be reached for several weeks, the person said.

More information about Safran is available:
Safran-Group.com
BusinessWeek.com

Interesting questions for the future:
Will L-1 be bought whole or will it be sold off piecemeal?
Does the answer to the question above offer a verdict on L-1's strategy of acquisition rather than organic growth?

High-Tech Corridor Susceptible to Shrinking Federal Appropriations

The State Journal (West Virginia)
Here's a little hometown analysis of the impact that our federal legislators have had on the economy of West Virginia and what the death of Sen. Byrd, the primary defeat of Rep. Mollohan, and the commensurate loss of federal funding could mean to the area.

“When Sen. Byrd moved the FBI fingerprint operation into Clarksburg, as much of a visionary he was, I’m not sure even he could have fathomed the growth that that created for the state,” said Rick Gill, CEO of the Washington, D.C.-headquartered National Biometric Security Project, which maintains an operation in Morgantown.

Both of the cities in the quote are in West Virginia's I-79 Hi-Tech Corridor.

Facial Profiling: Will face-recognition technology get an accused killer off the hook?

San Francisco Weekly

In what legal and scientific experts say is a groundbreaking case, a San Francisco Superior Court judge allowed biometric facial-identification technology, along with accompanying testimony from an expert witness, to be admitted as evidence in a high-profile criminal trial.

And in a curious turn, biometrics — the science popularized for its use in attempts to catch terrorists — was being used in San Francisco to try to exonerate an accused gang member and murderer.

As pointed out here, biometric identity management systems are tools that work both ways. The technology can be used by defendants as well as prosecutors.

This lengthy article, however, is pretty pessimistic about face-rec in general. To this point, I would draw attention to the fact that there is a huge difference between attended and unattended systems (a more complete resource for how to categorize different systems is here).

Several years ago, a surveillance experiment at a train station in Mainz, Germany, found that automated facial recognition had a success rate of only 60 percent during the day and as low as 10 percent at night, when poor lighting made identification more difficult.

The system described in Mainz, above is an unattended system used on non-cooperative, non-habituated individuals in a public, non-standard environment. 60% is nothing to sneeze at and the proper frame of reference is 0% (the number of people identified in the absence of a system) not 100%. So, Mainz went from 0% identifications to 60% in the daytime (possibly) without any spending on human resources and this is failure?

Poorly calibrated expectations are a real issue in the biometrics sphere. We in the industry need to make sure that we are setting reasonable expectations for our customers and helping them to craft systems that meet their needs. We have an obligation to deliver value and an incentive to educate our customers.

Quick Hits

‘India’s e-governance projects are relevant all over the world’
(FinancialExpress.com) - a brief interview with Ger Daly.

planetbiometrics.com, a New Biometrics web portal

L-1 Identity cuts Q2 revenue view; shares down (Reuters)

International Biometrics & Identification Association to Focus Efforts on the Growing Issue of Identity Management

Forbes.com

The International Biometrics & Identification Association (IBIA) today announced that it has expanded its mission to focus on the overall issue of determining identity. This new mandate, one which will see biometric and other technologies play an increasingly important role, has been deemed critical by the IBIA, given the rise of authentication issues facing data security, identity theft, immigration and homeland security.

This makes sense. Biometrics are a means to an end. Identity management is the goal.

Poway Tells Skaters to Give Them the Finger

msnbc.com

Park-goers will be required to have their fingerprints and photos on file with the city, the paper said.

This kind of usage can be confusing.

All fingerprint access control systems store a template generated from a person's fingerprint. It is not possible to "reverse engineer" a template into a complete image of the fingerprint that created it. In this limited use case it cannot be said that fingerprints are on file with the City.

Other fingerprint access control systems do store an image of the fingerprint as well as the template generated from it. In this use case, it is accurate to say that fingerprints are on file with the City.

The article implies that the system in place in Poway is of the latter sort.

Related thoughts about a different system can be found here.

Why face recognition isn't scary -- yet

CNN.com
For those interested in facial recognition, the article linked above provides insight in to the uses and limitations of the technology. It also provides information about a few places where people can gain firsthand experience with facial recognition applications using their family photos.

The epic marketing challenge for UID

LiveMint.com

On the technical side, biometric identity management is about the physical facts of a person in a given environment, communication, databases, sensors, permissions, etc. Once an organization works through these details, a successful biometric deployment becomes possible.

But there is a social component to almost all identity management deployments outside of prisons. ID management (biometric or not) only works if it isn't subverted by the users. If users are careless with keys, passwords and proximity cards; if doors are propped open or those with access allow others to "tailgate," the effectiveness of the ID management system is undermined.

India's UID project (once again) provides a useful window into how organizations manage the cultural side of a large-scale identity management deployment and the things that must be considered. The linked article provides insight into the India project's efforts at stakeholder marketing.

Combined, they have more than 150 years of marketing experience.

All were headhunted by Maruwada, who looked to bring the country’s most experienced minds in communications, marketing and advertising to tackle what is arguably the UIDAI’s most important challenge—marketing the idea of a universal government identity to citizens from every caste, region and religion.

As they say, read the whole thing.

Identity management is about people.

AmberVision State-Wide Rollout

Ambervision to help West Virginia authorities recover missing children (Herald Dispatch - Huntington, WV)

"The Department of Education is committed to keeping West Virginia's children free from harm," said state Superintendent of Schools Steve Paine. "Ambervision adds to our ability to keep every child safe and increases the chances of a good outcome in the unfortunate event of a missing child."

The AmberVision system will be adopted state-wide in West Virginia this fall.

Biometrics and Governance

CCTVs to monitor DC (Deputy Commissioner's) office employees: (The Times of India)

HUBLI: The ‘I don't care' attitude of the government employees who are accustomed to coming late, taking multiple breaks for tea, cigarettes and chatting during office hours will be a thing of past, at least in Dharwad.

The CCTV cameras and biometric machines which hitherto were only seen in corporate and other private offices have found its way into the deputy commissioner's office in Dharwad, making it probably the first DC office in the state to install it in a bid to discipline the government servants, who normally are blamed for taking their work lightly.

Many see the implementation of biometric identity management systems as enhancing government power over the people. As this article shows, they can also be implemented to increase the people's power over their government.

Farm of the Week: Producer clocks in with IT system to control costs

YorkshirePost.co.uk

"It might sound hard, but more accuracy means more fairness, for both staff and customers," says Mr Machin. "Thirty percent of our costs are labour. The more we pin costs down, the more choice we have about how to distribute rewards. And the better we get at pricing our produce, the more customers we bring in."

This article shows how new technologies, including biometric identity management technologies, are helping small businesses generate the data that help them operate with the same type of information large companies have been using for ages.

These identity management technologies combined with Enterprise Resource Planning (ERP) techniques are allowing small businesses to arrive at a precise calculation of costs, taking the guesswork out of pricing decisions. Moreover, the return on investment is significant.

"I would say our original investment in the time and management system has repaid already. The wages calculation, for example, used to take a couple of days. Now it is a matter of hours."

UPEK Terminates AuthenTec Proxy Contest and Merger Proposal after Grady's Resignation as Chairman of AuthenTec's Board of Directors

From ConsumerElectronicsNet.com

In his letter Grady explicitly says: 'My decision results from my increasing discomfort with the Company's de facto embrace of the status quo, and tolerance of management leadership's actions to resist value-creating transactions. I believe that the Board and management of AuthenTec should take decisive action to enhance shareholder value, but that view, supported in concept, is not reflected in actions. Enhancing shareholder value needs to be more than a talking point.'

The events described in this article concern two fingerprint sensor manufacturers, but you can expect to see many more articles of this nature over the next few years.

The biometric identity management sector will see rapid consolidation for several reasons:

• The most coveted customers for biometric identity management solutions are very large organizations, while the suppliers of goods and services tend to be very small companies. The big companies know that the little companies don't have the depth to support them. This doesn't mean that deals don't get done. The small tech. firms can and do partner up with large scale IT integrators to meet the needs of large customers, but this model presents its own challenges.
• Investors in early- and development-stage tech start-ups would like to see the beginnings of a possible exit strategy. It's not that they all want out; it's just that all investors are investors because they would like to earn a return. Without shareholder liquidity, an exit from an investment and the actualization of the commensurate gain or loss is difficult.
• The current investment and economic environment means that firms in the sector will fail and their assets will accrue to the remaining firms.
• The firms, themselves, and their boards will see growth opportunities and increased liquidity and heightened ability to support their customers without outside assistance as they grow larger through acquisition.
  

India Proposes Tighter Laws for National ID Project

CIO.com

The Indian agency assigned by the government to issue identity numbers has proposed stiff penalties, including imprisonment, for anybody found misusing personal biometric and other information that it collects.

We've had our eye on the Indian census for a couple of different reasons: the size, scope, ambition and audacity of the effort is unprecedented.

We have focused most of our attention on the technical aspects of the project. The article linked above deals with some of the cultural issues that must be addressed in any biometric identity management implementation, especially one on the scale of the India project.

At the end of the day, identity management is about people.

Biometric IDs to plug leaks in rural job scheme

livemint.com

The plan is to roll out a GPS-enabled system to address the issue of ghost workers and misuse of job cards.

Corruption can make it difficult to get help to the needy. Biometric identity management systems can help ensure that more of a government's social services spending reaches its intended recipients.

How safe are you in the 'identity ecosystem?'

Government Computer News (GCN.com)

The White House’s plan for an “identity ecosystem” seems to be built on good intentions – using trusted digital identities to allow secure online transactions without the need for passwords – but its designers will have to sell the details of the plan if they are to win over our readers.

Related:
From the Jerusalem Post
Knesset passes law regulating electronic signatures

Sen. Robert Byrd of West Virginia dead at 92

From the Charleston Gazette (WV)

In 1989, he was elected president pro tempore of the Senate -- a largely ceremonial post -- and named chairman of the Appropriations Committee. It was there that he began funneling federal projects and money to West Virginia in earnest. The first big salvo came in 1991, when FBI officials announced they would build their new fingerprint identification center just outside Clarksburg.

Sen. Byrd has been instrumental in making the I-79 development corridor a hotbed of biometrics-based entrepreneurship. He will be missed.

Voice – The Killer App

From WirelessWeek.com

The value of voice is rarely assessed and certainly, from a telephony perspective, voice is as commoditized as tapwater. However, the ability to use voice as a biometric signature may be coming of age, particularly as we are on the cusp of a whole host of mobile transaction services where authentication of the end user will be paramount.

To date, voice biometric deployments aren't very common. There are, however, many types of transactions in the health care and financial sectors where voice is the only biometric available.

India Census Update: Biometric process may need more time

Deccan Herald (Bangalore, India)
We've commented on the Indian Census here and here.

The process of collecting biometric data to provide national identity cards for residents of 183 coastal villages in the state took seven months. “Now we are talking about 30,000 villages, its a huge process”, Anil Kumar said.

Stillwater schools support plan to get data on kids to police in case of abductions

St. Paul Pioneer Press

Our own AmberVision child recovery system made the news this morning. AmberVision uses parent-supplied information, including a child's photo, in order to issue alerts over a wide area as soon as possible. Moreover, police in participating jurisdictions can use their blackberry or Windows CE enabled smart phone for facial recognition matches of missing persons.

"No matter what the circumstances are, every minute seems like hours. Every minute is critical," Stillwater police Chief John Gannaway said. "If you have that pertinent information at your fingertips, it's 100 percent beneficial."

Developed under grants from the U.S. Department of Justice, AmberVision was introduced nationally in August 2009. The AmberVision Foundation is a not-for-profit entity.

Local Hospital Uses Biometric Palm Scans to ID Patients

From SanDiego6.com

"PatientSecure is a nonintrusive and very precise method of identifying patients, ensuring they are matched to their own personal medical records and protecting them against medical fraud and identity theft," said Dan Gross, executive vice president of hospital operations for Sharp HealthCare.

The system described in the article seems to serve as an anti-fraud business solution rather than to increase patient safety as in this case, not that there's anything wrong with that.

Visa to drop signatures on credit card purchases by 2013

From Secure Computing (Australia)

Current technology is too "easy" to skim.

In the biometrics arena one often finds oneself in conversation with a biometrics skeptic. That biometrics skeptics exist is only natural and, of course, the burden of persuasion is and should be on those making arguments against the status quo.

Biometrics skeptics should have a proper grasp of the status quo in order to understand what they are defending.

Is signing a piece of paper every time you make a credit card purchase secure?

Is paying with a check secure? Checks display home addresses, signatures, bank account numbers, and frequently, even more information.

Is accessing your home with a funny-shaped piece of metal secure?

Are these things easier or harder to forge than biometrics?

These questions aren't necessarily technological questions and the answers are highly dependent on non-technical factors.

Visa seems to believe that signatures are not secure (see article) for credit card transactions.

You can write a check to a family member, put it in a greeting card and mail it with minimal risk (depending upon the family member).

Using checks for mail-order is probably a bad idea.

I hear stories of towns "where nobody locks their doors." For these folks, the funny-shaped piece of metal is more than adequate. Others might want something a little more robust.

So the question of whether or not such-and-such biometric identity management technology is "secure" makes little sense without the corresponding question: "Compared to what?"

Chinese woman slipped through biometric identification checks

A Chinese woman arrested on suspicion of robbery has been found to have entered Japan unlawfully after changing her fingerprints to slip through airport biometric identification checks, investigative sources said Thursday.

Identity management is a lot like an arms race.

A unique ID for the masses

Following up on this post about the Indian census...

UID–GOI’s technology leap

The UIDAI project is expected to touch every adult citizen. A voluminous database and the sheer magnitude of this task requires robust security with no room for vulnerabilities writes Subhankar Kundu.

Indian moon shot indeed. This isn't just the world's largest biometric database, it is by far the world's largest biometric database.

Landlord's plan to use biometric security system raises concern

CBC News
Biometric deployments must be managed from a technological and human perspective. Biometric ID management systems are new and there is a lot of misinformation and misunderstanding out there.

Ultimately, these technologies will succeed because they make people's lives better and save them money, but they must be adopted in a manner consistent with established social norms.

The landlord in this case has obviously made some missteps.

The adoption of Biometrics is about where eCommerce was in 1999. To be honest, at that time I was one of the one's saying "Who would put their credit card number into a web site!?" Now I can't imagine going to a shoe store or buying music in a bricks-and-mortar store.

eCommerce grew as the early adopters rarely became victims of fraud and they shared their experiences with others. This is as it should be.

Anyone who attempts to force their customers into a system like this, especially as it relates to access to their homes, should be very careful.

Secure Communities in the news

ICE's Secure Communities program is getting a lot of attention.

SW Idaho to use fingerprints to ID illegal aliens - KHQ - Spokane, WA (6/4/2010)
Arizona immigration debate heats up in D.C. area - WTOP - Washington, DC (6/3/2010)
Secure Communities to Start in SF on Tues - SFGate - San Francisco, CA (6/1/2010)
U.S. Immigration and Customs Enforcement Secure Communities fact sheet.

North American Biometrics Market Witnesses Growth Spurt, Finds Frost & Sullivan

redOrbit.com

New analysis from Frost & Sullivan, North American Biometrics Market, finds that the market earned revenues of $364.4 million in 2009 and estimates this to reach $1,588.6 million in 2016.

This is an excellent article summarizing findings from an excellent source for information about the biometrics market: Frost & Sullivan.

Mal-intent may be the future of security

The Sacramento Bee
This isn't related to identity management or biometrics but it is related to security.

Biometrics are used to establish a person's identity with a high degree of confidence so that the entity making the identification can accomplish further goals.

Identifying mal-intent does not seek to identify an individual but rather it seeks to predict undesired behavior through the detection of other behaviors.

Interestingly, both types of system represent attempts to predict the future.

One system -- the biometric one -- attempts to predict the future based on the identification of trusted or untrusted individuals. The assumption is that if I know who you are, I can make an educated prediction about what you will do.

The behavioral system, attempts to predict the future based upon what someone is doing now. If I know that people who do what you are doing tend to progress to other sorts of behavior, I can predict that you will also progress to that behavior. Or can I?

That's what the scientists are trying to figure out. Can you automate the judgments made by highly trained human observers of human behavior? Do people like Dr. Lightman from 'Lie to Me' exist? If so, can what they do be automated?

The Politics of Biometrics: A Shibboleth

Telegraph.co.uk - Children, 4, 'to be fingerprinted to borrow school books from library'

Anyone who terms the implementation of a fingerprint biometric system as described in this article as designed to help libraries serve their customers more efficiently "the fingerprinting of children" is either confused or or lacks respect for their audience.

"Fingerprinting" conjures up images of prison movies, the "rolled ten" and the loss of personal freedom. The fingerprinting process in the usage above is not undertaken in order to further the interests of the person providing the fingerprints. It is typically undertaken to help protect society from the person behind the fingers and carries with it a social stigma. Biometric alarmists intentionally and wrongly bring all of "fingerprinting's" social baggage and dump it onto fingerprint identity management systems.

Besides being misleading, the use of the term "fingerprinting" isn't technically accurate in this case, either. As with the fingerprints we all leave everywhere everyday, the only fingerprint that exists in the system described in the article will reside on the surface of the sensor and only until the next person uses it. According to Lesley Isherwood, the school headmaster, neither the fingerprint nor the image of the fingerprint is stored in a database.

What happens is this: A person places their finger on a sensor. The sensor reads the fingerprint and software turns the fingerprint into a unique number. For the software to work, the same finger has to be converted into the same number every time. It's the numbers that are stored, not images of the fingerprint.

This approach makes sense for a lot of reasons. First and foremost you can't lose data you don't have and no school administrator (risk averse lot that they rightfully are) wants to explain how they lost a bunch of kids' biometric information. Also, in a software environment, numbers are easier to work with than images. Moreover, most adults are rightfully protective of the innocence of children and are pretty conservative when making choices on their behalf.

Of course, an article with the headline: Children, 4, 'to be fingerprinted to borrow school books from library' is bound to have some choice quotes from a Biometric Alarmist:

“This is quite clearly appalling,” said Phil Booth, national coordinator of NO2ID, a privacy campaign group.

To be fair to NO2ID, judging by their web presence, Mr. Booth would appear to be one of the group's more committed members. The group itself seems to be pretty moderate in trying to raise issues of individual liberty and its relationship to the state in the context of digital identity management in a country (the UK) famous for its government surveillance systems. Nevertheless, the school library's system is far from self-evidently appalling. Thankfully, Mr. Booth provides some guidance for those who need some help becoming appalled.

“For such a trivial issue as taking out of library books the taking of fingerprints is way over the top and wrong.

If the taking out of library books is trivial, why not just close the library? And please don't take the child's fingerprints, she'll need those to get lunch.

“It conditions children to hand over sensitive personal information.”

No it doesn't; It conditions children that they must identify themselves to an organization in exchange for enjoying the services that organization offers. The fingerprint authentication is a substitute for a signature or an item with an attached bar code and it's not particularly sensitive.

A signature (which many 4-year-old's are unable to provide) is perhaps more sensitive than a number representing a fingerprint. Just think of the risks under the old signature-card-in-the-book-cover regime. Anyone who ever checked out a book after you could potentially forge your signature.

The use of ID cards with bar codes, an alternate identification method used by libraries, also poses a risk to the child's sensitive information in the event the cards become lost.

I do agree that children (adolescents and, alas, adults too) need quite a lot of guidance in keeping their privacy. See facebook, sexting, You Tube, etc. Something in the society is definitely conditioning young people to treat their privacy in ways that are shocking to some, but I don't think elementary school libraries are the culprit.

“The money for such a system could be spent on actual school resources. How about some more books for the library instead?"

A penny saved is a penny earned. Books are no different. One might hope that the identification system in use will prevent more books from being lost over time. It would then be up to the school to decide how to invest the savings. With the reduced risk of loss, perhaps they will buy more books. Rather than replacing lost volumes the library might even expand the number of titles they are able to offer.

“This needs to be rolled back or stopped. I would argue there is no justification for such a scheme.

There is obvious justification for such a scheme:

1. It gives the library the ability to more efficiently serve its stakeholders by reducing transactions costs.
2. It eliminates the necessity of a token (card). It is expensive to replace lost cards. Lost cards may be used by others. Those who have lost their cards will borrow others'. Children lose things.
3. Reduced loss of library books, leading to a better library.
   
4. It is a system that is so easy that, apparently, even 4-year-old's can use it.
   

Perhaps Mr. Booth means that the justifications are insufficient to overcome his objections. I would be very interested to hear his argument in more detail than is given in the article.

South Australian prisons to get biometrics systems

ComputerWorld.com.au

The systems will provide a method of registering and verifying all persons – staff, visitors and inmates - entering and leaving the facilities, and assist in the management of persons moving in and around the facilities.

You really don't want to release the wrong person or let visitors switch places with inmates. Systems like these help a lot.

Hefner Middle School students are using biometric technology to buy breakfast or lunch

The Oklahoman
This is really a wonderful article touching on a lot of the things we discuss here.

"This is impressive technology,” said Jennifer Strong, director of food services and child nutrition for the school district and a Sodexo employee. "And, it definitely has the cool factor kids like. Anything we can do to make school food cool, we consider a triumph.”

Dupree Millhouse, 12, agreed. "The scan thing is much cooler,” he said. "And right now we’re the only school that has it.”

There have been a lot of efficiency gains surrounding how meals are delivered to students.

Less than 1% of parents have opted out of the system.

[Australian] Police seek national database of driver's licence photos

Brisbane Times

THOUSANDS of Australians have their identity stolen every day, costing the public billions of dollars every year.

To combat the problem, police need better access to information, including access to photos from every drivers' licence in the country, argues the head of CrimTrac, Ben McDevitt.

Goodbye ID cards - is it time to say hello to identity banks?

From ComputerWeekly.com
Much of the recent news about biometrics has been coming from the UK, with the new government there having scrapped the planned biometric national ID card and other identity management functions. Much of the news is written, of course, from a political perspective. If the personal is political, what can be more political than one's identity?
Bryan Glick at ComputerWeekly.com understands that the rejection of a statist, top-down approach does not mean that identity management systems are unnecessary or that all proposed systems will be rejected by a free public.

But there is a growing recognition that an increasingly internet-enabled society will need some form of electronic identity verification system to tackle identity fraud and provide the confidence needed to transact securely online, especially as more public services are provided over the web.

Glick then draws attention to a 2008 report by Sir James Crosby, then at HM Treasury, entitled Challenges and Opportunities in Identity Assurance (.pdf). The 47-page report contains a breadth of information that makes it a great introduction for how to begin thinking about the challenges associated with large-scale biometric identity management deployments. It is very accessible and deserves to be read widely.

Google debates face recognition technology

FT.com

Mr Schmidt said: “Facial recognition is a good example . . . anything we did in that area would be highly, highly planned, discussed and reviewed. When you go through these things, you review your management procedures.”

Apart from Google's history with privacy issues, they do face a dilemma, as the article points out. There is no reason to limit search terms to text only. Some innovator will bring search into the visual arena and enable a picture to be used as the search term. Without new regulation, that means that at some indeterminate point in the future* someone could take a picture of a face with a cell phone and find out a lot about that person.

These tools are coming. They will bring huge productivity gains. They will be abused.

Those concerned about the effects of technologies like Google Goggles upon their family's privacy would be well advised to think about what information about them exists online and what they do now to manage who has access to it. Most of us have near-total control over what personal information ends up on the internet. If the only thing keeping online information about you "private" is the lack of better search engines, then it might be a good idea to reevaluate how much personal information you post/allow to be posted online.

It is possible, even likely, that the internet will become both more private and less private. More private as Google increasingly respects the interests of content owners (FT again). Less private as better search brings more of the internet to users attention.



*The technical challenges of using a picture of a person's face as the only search term for a search of the internet for facts about that person are extremely daunting. If you take a picture of an apple, presumably the search would return lots of pictures and information relating to apples. If you take a picture of a person, presumably the search would return lots of pictures and information relating to people. Converting an object recognition search that has yet to be deployed into an facial recognition search is a long way off.

Biometric scanners introduced at Bunbury nightclub

From the Bunbury Mail (Update Link expired)

NEW technology introduced at Exit Late Night Bar which scans fingerprints and driver’s licences has been praised as big leap forward for people’s safety while clubbing.

StrategyPage.com: Fingertips, Part 2

From StrategyPage.com

Japan has been having problems with people defeating its new biometric immigration control system.

Teachers sue Sausalito-Marin City district over thumb scans

From MercuryNews.com

The Union:

"Time clocks are regulated under the federal Fair Labor Standards Act which specifically excludes teachers," Hasson said. "Teachers are not hourly employees."

The Superintendent:

Bradley cited "safety reasons" for the policy, saying it would help the district know the employees' whereabouts during emergencies or evacuations.

"The time clocks will create a more accurate and efficient method of tracking the number of staff members present, and will ensure the safety of all," Bradley wrote in an Oct. 29 letter, a copy of which was included in the lawsuit.

Although a fingerprint clock-in system would be of use in an emergency, I think the teacher's union gets that this can be a real money saver for the school district. The data generated by such a system could perhaps be of real use to the school district in the next contract negotiation, assuming that the union doesn't want it for the same (unstated) reason that the superintendent does want it.

Expect to see a lot more articles like this as public sector unions attempt to defend their agreements against newly-frugal bureaucracies.

UK to Kill Off National ID Card Program

From CIO.com

The U.K.'s new coalition government plans to cancel the national ID card program, calling it part of a "substantial erosion of civil liberties" that took place under the former Labour government.

Polish bank claims Europe's first biometric cash point

From The Independent (UK)

Could it be? Are token-less ATM machines now in use in Europe?

From day one, cash machines have required a token and a PIN. The token, a plastic card, identifies you to the banking network and the PIN confirms that the card is being used by someone who knows the account holder's password.

When the card is introduced into the machine, the banking network already knows the correct PIN that goes with the card. The computer network has only to answer one simple question: Does the PIN that goes with the card match the PIN that was just entered into the machine? If the answer is yes, the transaction is executed and the ATM user gets her cash.

In the case of the token-less ATM's described in the article linked above, it is less clear what is going on. Unlike the magnetized plastic card, fingerprints and PIN's don't store any account information so their use can't lead directly to a simple yes/no question for the bank software to sort out. So what is happening?

It's probably not the case that the bank customer puts their finger on a sensor and the bank software identifies the proper account from the finger alone to be confirmed later by the PIN. This would require the bank software to answer a yes/no question as many times as it has finger vein-enabled accounts every time someone uses the machine. Example: Does this finger go with account 1? If no, does this finger go with account 2? If no...

I suspect that, in order to dispense with the plastic card, the machine's software designers ask the user to input their PIN first. That would reduce the number of yes/no questions the software must answer in order to confidently establish a user's identity by a factor of 10,000 by allowing the software to search only from among accounts that use the same PIN. Given that there probably aren't very many consumer checking accounts that are finger-vein accessible, the customers of BPS SA aren't likely to notice any increase in the machine's response time over earlier cash machine models.

A system, such as the one described in the article, however, is likely to experience considerable growing pains. First, in order to serve other bank's customers and to reap the considerable fees to be charged in so doing, the machine must still support the old fashioned card-and-PIN model, adding to the costs of the machine by adding an input device to the older model (sensor/card reader/key pad vs. card reader/key pad).

Then, as the number of the bank's customers which use the finger-based method to access their account increases, the number of yes/no questions the software must sort through increases as well, slowing response time.

When my local bank adopts a finger-based system, I can start using the BPS SA machines while in Poland, correct? Not necessarily. If my bank uses the same Hitachi software that BPS SA uses, then things might work out, but if it has chosen another finger-based biometric vendor then things are unlikely to go well unless the banks involve a middleware vendor such as SecurLinx.

Over time and with the giant leaps in computing power implied by Moore's Law, applications like the one described in the linked article will be brought to the market improving the efficiency of the banking industry and improving the lives of people worldwide. Those days, however, are still in the future. The BPS SA case is probably best seen as a proof-of-concept experiment, rather than a full commercial deployment.

The exact same critiques could have been and probably were voiced when John Shepherd Barron, the inventor of the cash machine, first pitched his idea to Barclays way back in 1967. Kudos to BPS SA for blazing the trail.

Australia: $4.3b to bolster national security

I recently became aware of the Australian reality series, Border Security: Australia's Front Line,
while traveling outside the U.S.

I must admit to being a bit perplexed at the time. Border security on an island didn't seem to make for a lot of excitement.

Then I read this from the Australian Broadcasting Corporation: $4.3b to bolster national security.

There will also be new high-tech measures, with $69 million to introduce biometric checks of international passengers before they embark for Australia, and $11.4 million for the Next Generation Border Security Initiative that identifies visa applicants who may pose a security risk.

In reading the article it becomes clear that oceans are no defense against modern threats and there are those who will use Australia's values of freedom and hospitality to asylum seekers against it.

Good on you, Australia, and keep up the good work.

Biometrics protecting minority rights

Private club aims to keep cigar smoking sociable - The Roanoke Times

An annual fee of $1,000 and a biometric lock that reads fingerprints offer entry into the not-for-profit club, which formally opened April 16. Cigar aficionados living outside a 50-mile radius pay $500.

"The club is something Renee and I have always wanted to do," David Meyer said. "We just always envisioned a nice place for people to come and enjoy a cigar."

Biometric Wallet Keeps Out Prying Eyes and Fingers

From Gearlog.
But is it RFID-blocking?

IDF buys computers to prevent further information theft

From The Jerusalem Post:

Some of the new computers... will come with specially-designed keyboards that can only be accessed by the insertion of a smart card into its side and the biometric identification of the designated user’s fingerprint.

Token: Something you have.
Password: Something you know.
Biometric: Something you are.

The system described above combines two of the three (and I'd be surprised if passwords aren't used as well) to increase the confidence that those who access the computers in question are who they say they are.

The smart card in this example is the token. Your house key is also a token. Tokens are issued to someone whose identity is known so that they might access a virtual or physical location. The vulnerability of (most) tokens is that they work, no matter who possesses them.

One major redeeming quality of tokens, however is that they are not easily duplicated and when someone loses one, they usually know it and then at least they don't still have it. If there is one key to your house and you lose it, you only have to worry about on key.

This is not true of passwords. Passwords are information and the thing that's great about information is that it's practically free to reproduce and disseminate. That does make for pretty weak security, though. If you lose control of the password to a computer network you might not know it and it can be shared without limit.

Stand-alone, unattended biometric tools are also imperfect solutions. The Mythbusters overcame a fingerprint sensor, for example. But by combining tokens, passwords and biometrics, the security of high value systems can be dramatically improved.

Self-service passport kiosks

From the Straits Times (Singapore)

I'd like to see more on this.

How unattended is the kiosk?

The kiosk itself reminds me of those amusement machines where prizes are grabbed with a crane, only the prize is your passport.

Hopefully they're on the lookout for Elvis.

Nigeria: Govt Uncovers 7,000 Ghost Workers

From ThisDayOnline.com

About 7,000 ghost workers have been uncovered in Delta State civil service.

A ghost worker is a worker that collects benefits and a salary, usually from a government entity, while doing no actual work.

From Wikipedia

Delta is an oil producing state of Nigeria situated in the region known as the Niger Delta, South-South Geo-political zone with a population of 4,098,291.

The population of Delta is a little higher than that of Los Angeles, California.

So, approximately one in six hundred residents of Delta is a government worker that does not do any work. They retire and collect pensions, kicking back a portion of their compensation to their boss. This is a nuts and bolts example of how corruption works and it is a terrible drag on economic growth.

Corruption is what holds much of the developing world back. In countries whose governments are committed to the well-being of their citizens, but face corrupt and entrenched interests, biometric identity management solutions offer unprecedented corruption-fighting tools.

Moreover, the ROI (Return on Investment) is fairly straightforward to calculate. In this case, if the ID Management system costs less than 7,000 times the total lifetime compensation of a low-level government worker, it will save the state money and help it to provide the conditions for an improved standard of living for its citizens.

CSI NJ: Cops Using High-Tech Tools To ID Victims

From WCBS-TV.com (New York, March 4)
The link leads to an article and video showing how the Jersey City Police Department uses their SecurLinx IdentiTrac system.

Expert picks out loopholes in US e-passports

From The Economic Times
Can you make an EMP-generating RFID killer for under $100? Someone can.

Wool's latest research centres on the new "e-voting" technology being implemented in Israel. "We show how the Israeli government's new system based on the RFID chip is a very risky approach for security reasons," explains Wool.

Well, you can always buy one of these.

United States and Germany Launch Partnership to Link Trusted Traveler Programs

From the Department of Homeland Security

Under this statement, the United States and Germany will develop processes for qualified citizens of either country to apply for both the United States’ Global Entry program and Germany’s Automated and Biometrics-Supported Border Controls (ABG) program, which each use biometrics to identify trusted travelers.

County staff will have to clock in, out (Biometrically)

From TimesLeader.com (Northeastern Pennsylvania)

Kronos, selected from five responses to a public proposal, will be paid an estimated $410,160 to implement the system and a $45,140 annual maintenance fee.

County officials have estimated the system will save an estimated $1.5 million annually, largely through the elimination of abuse.

Identity management systems buttressed by biometric technologies are a valuable tool in fighting corruption and fraud in the public sector.

Ghost workers and buddy punchers cost the public billions of dollars a year worldwide.

The biggest head count ever

From Businessday (Nigeria)
The author, Jay Shanker, provides a bit of perspective on the Indian census.

Three quick hits

Biometrics to go mainstream - Computerworld (New Zealand)
Vein Pattern Recognition: A Privacy-Enhancing Biometric - info4security.com
National Identity Card: Paving the Road to Tyranny - GOPUSA.com

Biometric identity management solutions are going to become ubiquitous.

Their value proposition is ultimately irresistible.

Biometric tools should be adopted in a consensual and transparent way, because as is the case with any new technology, abuse is not only possible, it is likely.

Dominican alien felon indicted for attempted entry in Puerto Rico

From DominicanToday.com

In secondary inspection Franco-Matos fingerprints were queried by CBP Officers to the FBI Criminal Justice Information database, and the comparison resulted in an identical match to an alien previously removed as an aggravated felon by the name of Julio Cesa-Soto.

In contrast to yesterday's post, this one shows the power biometrics can bring to an identity management system.

In modern times, a person's name has been the datum most commonly used to differentiate among individuals. This is evident in our use of language: keeping one's good name; name brand; household name; etc.*

Names recommend themselves in several ways. Names are used universally. Names are (approximately) unique. They can be represented with text, making for efficient transmission and search. Names are durable and their changes, as in the case of marriage or legal name changes, are governed by well-known social conventions.

Names have always been the cornerstone of identity management systems and those with an antisocial bent have always recognized the value of subverting the defenses a society erects in order to function smoothly. Enter the alias. If you wear out a decent name, simply get another and open up shop again.

Mr. Franco-Matos was simply following the well-worn trail blazed by his criminal forebears, only this time it led straight to jail. The newly minted Julio Cesa-Soto caused no harm. What happened?

It appears that US Customs Border Protection recognized a weakness in an identity management system that was otherwise performing quite well. In this case it appears that the weakness derived from a combination of aliasing and document forgery.

It turns out that biometric ID management solutions are a very good way of dealing with the alias problem.


*The concept of "face" would be an interesting digression here.

Security Fears Over 3,500 Passports Lost In the Post

From Express.co.uk

PERSONAL details of thousands of Britons have been put at risk after their passports were lost or stolen in the post, it emerged yesterday.

If an organization is doing everything it can and still faces identity management challenges, biometric tools are an excellent way to further reduce uncertainty about people's identity.

If, however, other weaknesses exist in the ID management chain, the addition of biometric tools may not improve security as much as the user expects.

Adding biometric tools to a flawed system can help create a false sense of security. After all, if you know your system is insecure you act a certain way to minimize risk. If you think your system is bulletproof and it is not, really bad things can happen.

Monterey County joins ICE program to identify illegal immigrant inmates

From The Californian

Identifying illegal immigrants at the Monterey County Jail just became easier for law enforcement officials.

U.S. Immigration and Customs Enforcement announced Tuesday it has implemented a biometric system at the jail allowing them to receive instant updates on the immigration status of new inmates.

U.S. Government Launches Official Agency to Manage Biometric Database

From Popular Science

The Biometrics Identity Management Agency (BIMA) has a responsibility that spans the entire U.S. Department of Defense (DoD), and would specifically support the DoD's "authoritative biometrics database" in the name of national security.

Alberta ponders biometric ID cards for homeless

From the Calgary Herald

Those who offer services to the homeless face many identity management challenges.

DEA clears biometrics for controlled drug e-Rx

From GovHealthIT.com

DEA currently bans the e-prescribing of controlled substances -- a restriction that covers some 10 percent of all prescriptions.

That prohibition compels physicians who e-prescribe to maintain a separate paper-and-fax system for controlled substances.

That appears to be changing.

Indian Govt. plans to go biometric with census

From The Times of India

This will be an incredible challenge and I'm curious to see how this plays out.
To my knowledge, there isn't a single country that has a comprehensive biometric database of its adult population: not Lichtenstein; not the UAE -- both rich countries with small populations.

Can India pull it off?
There are 804,043,947* Indians aged 15 years or older.
There are a certain number of non-citizen "usual residents."

For reasons both technological and logistical, this is the identity management equivalent of the moon shot.

*CIA World Factbook:

Population: 1,156,897,766 (July 2009 est.)

Age structure:
0-14 years: 30.5% (male 187,197,389/female 165,285,592)
15-64 years: 64.3% (male 384,131,994/female 359,795,835)
65 years and over: 5.2% (male 28,816,115/female 31,670,841) (2009 est.)

1,156,897,766 * (.643 + .052) = 804,043,947

At Bronx clinic, the eyes are windows to medical records

From CNN (March 15, 2010).

This article touches upon many important factors related to biometrics and identity management: Privacy, Accuracy, Cost-Benefit, and selecting the proper biometric modality.

It also has a nice dose of human interest:

"The acceptable error rate is zero, because we're talking about people's lives here. People can get hurt and die," said Evan Smith, Eye Controls' chief executive officer.

Prohibitive biometrics bill defeated in New Hampshire

From securityinfowatch.com

The New Hampshire state legislature has evidently determined that biometric applications are compatible with the state motto: Live Free or Die.

Good for Granite Staters.

L-1 for sale?

From SecurityDirectorNews.com

It would be difficult to overstate the importance of this development to the biometrics/identity management industry.

Is this a repudiation of L-1's entire strategy?
Is it driven by the more personal financial considerations of Mr. LaPenta?

Time will tell.

ID Card for Workers Is at Center of Immigration Plan

From the Wall Street Journal
Putting a fingerprint biometric on the Social Security card and using it as the citizenship test for employment is the idea being floated by Sens. Chuck Schumer (D., N.Y.) and Lindsey Graham (R., S.C.).

Are fake Social Security cards the fulcrum around which illegal immigration issues turn?

Biometric passports raise fears about what it will cost

From the Niagara Falls Review.

Cost should be considered not just in terms of how much the passport document itself costs to produce, but also in terms of the efficient operation of the customs service and the reduction in crime committed by those who would value false identification documents.

Which do you think costs more:

• (a) 100,000 biometric passports
• (b) one customs employee with training costs, a salary, benefits and a pension?

or

• (a) 11.5 million passports (approximately all of them).
• (b) Losses associated with less efficient international trade if the next 9/11-style terrorists enter the U.S. from Canada.

Scientist: Nose the future of biometrics

The headline overstates the case made in the article, but the article provides a very useful handle when grappling with the difference between the scientific and business communities where biometrics is concerned.

Essentially, any durable part of the human anatomy may be used as a biometric input provided the user can reliably and repeatedly present the same anatomical feature to a sensor.

Society, and ultimately the scientists interested in biometrics, will only be well served through the successful commercialization the biometric technologies that are already reliable.

Commercial innovation leading to the adoption of modern identity management techniques is something that can improve our lives in the short-to-medium term by lowering the societal cost of identity theft and/or mistaken identity.

Figuring out how to turn a nose into a number?

One day this guy's reign of terror will end, but not before face- and finger-based identity management tools are ubiquitous.

Frost & Sullivan Finds Vast Potential for Biometrics Industry in APAC

The article examines the biometric identity management industry in Asia. The analysis, however, applies across the developed world.

I suspect the developing nations aren't far behind, either.

State of the Art: What Face-Rec Can and Can't Do

Ecxellent discussion of current facial recognition system capabilities from Science Friday as heard on NPR.

To access the audio stream, click "Listen" at the top of the left-nav column.

Elvis Presley's Biometric Passport?

Dutch hackers expose security flaws at Schipol Airport (CNN).

The events are from September, 2008 but the story does a good job of identifying the problems that arise when government organizations can't or won't effectively share information.

FBINAA Conference 2009

SecurLinx is exhibiting at the the 45th Annual FBINAA National Training Conference in beautiful Louisville, KY. The event runs from July 25th - 29th, 2009 and provides FBI training to up-and-coming police officers from around the country.

We've enjoyed talking to some of the nation's most caring and dedicated law enforcement officials about how we can help them to protect and serve their communities using biometric technologies like AmberVision and FaceTrac. If you're in the neighborhood, come see us at the conference.

The conference's exhibits will be open tomorrow, July 26, 2009 from
10 am to 3 pm.

Barry Hodge and Jim Connors at the FBINAA Conference, July25, 2009.