Biometrics for all
Time to take a reading of advanced ID technology
February 6, 2007
By Paul Jay
Fingerprint analysis has long been a staple of law enforcement, first as a means of placing a person at the scene of a crime, and later as an identification tool for keeping a database of criminals. But fingerprinting has a largely negative connotation, which would seem to make it an unlikely practice for personal or public use.
Yet biometrics — the use of a person's unique physical characteristics or traits to identify them — has moved from the pages of espionage thrillers to the mainstream. Fingerprint scanning and its futuristic cousins, iris scanning and facial recognition, are now widespread. The International Civil Aviation Organization is pushing for biometric data to be included in passports. Airports are testing a variety of biometric devices, from iris scans at Vancouver International Airport to voice-stress analyzers in Israel.
Perhaps more tellingly, biometric devices are becoming accessible to consumers, who are offered everything from facial recognition programs that let people search and sort photos to fingerprint readers on laptops to act as a security measure or a password manager.
For years we've been told to expect the arrival of this new wave of technology, and now that it's literally at our fingertips, what should we make of it? With biometrics appearing in the mainstream, will public resistance to identification tools commonly associated with criminal identification stiffen or waver?
Luc Dénommée, president of the biometric technology company SBG International in Drummondville, Que., thinks the public will embrace the technology once they understand it.
"What we need is to educate people, to show them that these tools will protect them first," said Dénommée. "For years people thought microwaves were dangerous, but now every house has them."
He points to his company's fingerprint scanner as an example of the latest in biometric security. The fingerprint ID system records data from 17 points on the print and constructs a template on the computer based on that data, meaning no actual image of the fingerprint is on the computer for a potential hacker to steal.
Current scanners also measure heart beat and temperature to prevent what biometric experts refer to as the "gummy finger," a technique for hacking fingerprint databases first demonstrated by Japanese researcher Tsutomu Matsumoto in 2002, in which a gelatin mould was used to make prints lifted from a glass.
Dénommée said businesses have already begun to see the value of the added level of security, and he thinks it's only a matter of time before consumers embrace the technology for use in the home.
"As an example, I am a father of two children and I have parental control, but my children are very smart, and they could figure a way to use my log-in," he said. "But I don't want my kids to open an e-mail and accidentally lose my accounts, so if I use a finger scanner I can keep them out."
Fingerprint technology is still primarily the purview of government, said Allan Brousseau, vice-president of business development of Comnetix, an Oakville, Ont.-based biometric information company with public and private sector clients.
But Brousseau expects the consumer market for the technology to grow dramatically in the next five to 10 years.
"Why have all of these passwords if you can just swipe your finger?" he asked. "Right now we put too much faith in security features that aren't secure. Credit cards, for example, rely on cashiers making $10 an hour to do signature comparisons. That's not very secure."
Concerns over reliability
Although personal use of biometric tools could have value, Andrew Clement, a professor at the University of Toronto's Faculty of Information Studies, has concerns about how secure these technologies are, pointing to the "gummy-finger" as an example of the race between security experts and hackers.
"I'd be concerned about putting all of my ID eggs in a single biometric basket," said Clement. "What happens if it doesn't recognize you anymore? It could be harder to correct."
Not all fingerprint scanners are intended for security applications, which could cause confusion among some consumers. Microsoft's Fingerprint Reader (which retails for $50), available since 2004 and recently upgraded to be used with Microsoft's new Vista operating system, is meant to tie all of the user's passwords to a fingerprint. But as the company has repeatedly said, the scanner is used for convenience and is not a security feature to replace passwords for accessing sensitive data.
Fingerprint scanners with added encryption technology cost over $100 at the low end of the price spectrum, with extra security software adding to the cost.
Clement also worries that as people become accustomed to biometric technology, they will become tolerant of more intrusive approaches.
"A concern is we will become habituated to giving out our biometric data," said Clement, a member of the Information Policy Research Program. "Fingerprinting has been overly stigmatized because of its criminal history. But when it becomes routine it might lull us into a false sense of security," he said.
Of particular concern for Clement is government adoption of the technologies in passports and border security. For example, some American airports are using a new security program modelled after Israeli airport screening techniques called SPOT, or Screening Passengers by Observation Techniques. An automated version of SPOT is also being tested using a device called Cogito that asks passengers to answer a series of questions on a touch screen while measuring biometric responses such as blood pressure.
The International Civil Aviation Organization has made recommendations to include at least one other piece of biometric identification into passports besides a facial portrait, though governments have not uniformly embraced the standards.
Biometric border identification
Canadian passport requirements have not been upgraded since 2002 and do not currently use biometric components. But the Canada Border Services Agency's NEXUS program, promoted as a way for low-risk travellers to cross the Canadian-U.S. border, does use the technologies.
Started in 2002, NEXUS now has more than 110,000 members in Canada and the U.S. who pay an $80 fee for a five-year membership the agency says allows them quicker access through border security. Most of these members use the NEXUS highway service, which requires applicants to undergo an electronic scan of their index fingers for comparison against a database of immigration violators at the U.S. Immigration and Naturalization Service.
One of the agency's pilot projects, NEXUS Air, also has 1,700 participants who provide iris scans when passing through Vancouver International Airport. The program could be rolled out into another city soon, said agency spokesman Derek Mellon.
Clement worries that reliance on increasingly sensitive biometric data could yield false positives and lead to longer delays at border crossings and consequently a reliance on other kinds of profiling.
While fingerprint and iris scanners and facial recognition programs remain the most common technologies in place today, other types are being tested, said Svetlana Yanushkevich, an associate professor and biometric researcher at the University of Calgary.
Lesser-known innovations in limited use or in the research stage include:
* Skin spectrum scans that read the subcutaneous layers of skin on the hand unique to each person.
* Infrared readers for measuring body temperature changes that might be an indicator of a disease such as SARS.
* Voice stress analysis similar to a polygraph, used in conjunction with measures of blood flow.
Dimitrios Hatzinakos, a professor who works with advanced biometrics, understands the public mistrust in the technology.
"It's very personal to give this information, like exposing yourself," said Hatzinakos, the Bell Canada Chair in Multimedia at the University of Toronto. "People feel naked in a way."
Hatzinakos points to the still-developing research in gait recognition, which analyzes and compares individuals by the way they walk, as an example of a biometric with a variety of applications. It could be used in conjunction with security cameras by the military to identify individuals whose identities are otherwise obscured. Or it could be put in a senior citizens home to watch for signs of degenerative diseases such as Parkinson's.
Hatzinakos thinks scientists working in the field should strive to develop the most reliable technology at the same time as they try to gain the public's trust in the technology. These two goals go hand-in-hand, he said.
"We need to do a better job of communicating the useful and potentially life-saving applications of these tools, and then work to create regulations and technologies in parallel with the technology," he said.
WHAT'S NEXT? YOU DECIDE HOW MUCH YOU'LL TAKE
No comments:
Post a Comment