Biometrics.

Solving Cases of Mistaken Identity and More

Nearly a century ago, law enforcement agencies discovered the value of using fingerprints as a means of positive identification. [1] Today, law enforcement continues to use fingerprints to solve crimes, identify criminals, and keep criminal records. However, fingerprints represent merely one type of biometric, a physical characteristic that can distinguish one person from another. Others include the face, the eyes, the hands, and the voice.

Biometric technology creates new opportunities for law enforcement and crime prevention by accurately identifying people when they cash checks, collect welfare benefits, use automated teller machines (ATMs), cross borders into the United States, sign on to computer networks, or enter secure buildings. The promise of biometrics may become tarnished, however, if governments or businesses use it to monitor and gather information on a person's private activities.

In 1998, the Center for Applied Research and Policy Analysis at the Metropolitan State University in St. Paul, Minnesota, studied biometrics; its accuracy, applications, and costs; as well as the legal and privacy issues associated with these potential uses. The center concluded that biometric systems have enormous potential for public and private organizations alike.

BIOMETRIC SYSTEMS

Biometric systems serve two purposes: identification and authentication. For example, when the police make an arrest, they compare the suspect's fingerprints with fingerprints on file to determine if the person has a criminal record. Biometric systems also can identify criminals who refuse to disclose their names or who give aliases. Traditionally, highly trained specialists did this fingerprint work manually. Now, the typical biometric fingerprint system automatically reads a person's fingerprints with a video camera, converts the fingerprint images into computer data, and searches the fingerprint file for similar prints, which the system stores digitally as electronic data.

By comparison, authentication occurs when, for instance, a person uses an ATM card and must enter a personal identification number (PIN) to prove authenticity. Experience shows, however, that this type of security remains weak, and fraudulent use of cards, checks, and driver's licenses costs businesses millions of dollars each year. In contrast, with a biometric ATM system, the bank could put a person's fingerprint data or another biometric on the magnetic strip on the back of an ATM card when the person first applies for it. To use the card, the owner would place it in a cash machine and put a finger on the machine, which would read the print, convert it into numbers, and compare it with the fingerprint data on the card. If the numbers match, the machine would pay out. A small computer in the ATM machine would do the work. Alternately, a central computer could store the biometric and retrieve the information when customers present their identification cards or enter their passwords into the system. Finally, a "smart card" with a small computer chip memory could hold the biometric.

The number of comparisons the system makes to verify the person differentiates identification from authentication. For identification, the computer may have to compare many thousands of fingerprints; authentication requires only one comparison between the card and the person presenting it. A biometric system that makes thousands of comparisons must have a higher accuracy rate than a system designed for a single comparison. Thus, accuracy represents one concern for potential users because different systems vary in their degree of accuracy. Depending on their needs, agencies must select the right type of system.

Types of Systems

A profusion of vendors now produces a variety of biometric systems. The most common systems identify or authenticate users by their fingerprints, eyes, hands, faces, or voices.

Fingerprints

No two fingerprints are alike. For this reason, law enforcement and the courts recognize fingerprints as unique personal identifiers. Most biometric fingerprint systems work by finding the breaks and forks, also called minutiae, in the fingerprint ridges and converting information about their position into a series of numbers, like coordinates on a map. Some systems use other information about the ridges or pores of the skin.

Eyes

Two biometric systems use information about a person's eye; one looks at the pattern of veins in the retina, while the other uses the pattern of fibers, tissues, and rings in the iris. Experts believe that both of these biometrics are as unique as fingerprints, but their use in identification lacks the established history of fingerprints. [2]

The retinal system, the first system invented, requires shining a light into the eye at close range to illuminate the retinal pattern. As a result, it demands the cooperation of the person being checked. The retinal system's accuracy rate makes it appropriate for high-security facilities, such as nuclear power plants.

Users have begun to express a preference for the iris-based system. Although relatively new, it requires only that a person look toward a video camera operating several feet away. In addition, neither eye color nor corrective lenses (glasses or contacts) interfere with the biometric. Similarly, changes in the size of the iris in response to light do not affect the system. Actually, a biometric system can use the fact that the iris adapts to light to verify that the eye belongs to a person, not a photograph.

Although the theory requires additional research, some evidence suggests that patterns in the eye may change over time because of illness or injury. Therefore, eye identification systems may not work for blind people or individuals with eye damage.

Hands

Biometric systems can use the hand's distinct, three-dimensional characteristics, including the length, width, thickness, and contour of the fingers; veins; and other features. Hand-geometry systems most commonly control access to buildings. A person seeking admittance places a hand in a device that examines it with a video camera and converts the video image to numbers in a computer for comparison with the person's prerecorded hand geometry.

Changes in a person's fingers, for example, large rings or swollen fingers, may affect hand identification, and the system may not work for people with hand paralysis or tremors. Environmental problems, such as temperature or light shining at the camera, also may hamper the system.

Face

Facial biometric systems have seen rapid improvement. [3] A video camera scans the face and records the arrangement of features for comparison with previously recorded facial images. Facial-recognition systems can automatically scan people's faces as they appear on television or a closed-circuit camera monitoring a building or street. One new system uses the infrared heat pattern of the face as the biometric, which means the system works in the dark.

Individuals who change their appearances markedly, for example, by growing beards, or who make unusual facial expressions can confuse the system. The orientation of a person's face toward the camera also can influence accuracy. These systems may not be able to distinguish twins.

Voice

To a limited degree, voice or speech patterns can identify people. To use a voice-recognition system, a person must prerecord specific words on the system. Later, when the system needs to authenticate the person's identity, it prompts the person to say one of these words. A computer analyzes the speech pattern and tries to determine if the voice matches the prerecorded version. Voice recognition differs from speech recognition, in which a computer tries to understand what a person says.

Voice recognition suffers from a variety of problems. A person's voice may change because of illness or stress, and women prove more difficult to identify than men. A noisy background also can present a problem.

Other Biometrics

A few available, but rarely used, biometric systems use palm prints, and others use finger geometry. Some researchers are trying to develop biometric systems based on written signatures, personal odors, ears, sweat pores, the way a person types on a keyboard, and body motions.

APPLICATIONS

Biometric technology covers a wide range of applications, from identifying criminals to preventing welfare fraud. Because of their high security needs, correctional institutions have led the way in implementing biometric systems.

Corrections

In a number of federal prisons, visitors, staff, and inmates have their hand biometric put on a photo identification card, which they must carry with them. Card and hand readers installed throughout the prisons control access to various areas; the systems also record everyone's movements.

Similarly, the Minnesota Department of Corrections has hand-geometry systems in the state's three medium-security prisons. People leaving the institution swipe their identification cards into the system, while placing their hands on a reader. The system compares the biometric on the card with the person's hand before allowing them to leave. Staff members also have photos on their identification cards to supplement hand-geometry verification and make false identification a remote possibility.

The department installed the systems in 1997 and continues to refine them, with plans to put similar systems in other prisons. The system at one prison, which includes a computer network, terminals at three access points, and programming tailored to the system's specifications, cost $130,000.

In 1990, the Cook County, Illinois, Sheriffs Office began using a retinal identification system for prisoner identification and release. [4] At the time, the system cost about $500,000 for 23 scanners and other equipment to connect the system, but prices for the equipment have come down. The Lancaster County, Pennsylvania, prison's prisoner identification system uses iris-based technology. In 1997, the stand-alone system cost about $l0,000. [5]

New York City recently contracted for an electronic probation monitoring system, for a cost of $925,000. [6] The hand-geometry system uses kiosks with video touch-screens that allow probationers and parolees to check in electronically with probation officers on reporting dates. The city expects to use the system to monitor about 35,000 low-risk probationers, allowing probation officers to spend more time supervising high-risk probationers.

Voice-recognition systems also can monitor probationers. One system randomly pages a probationer, who must call a toll-free number. The system then verifies the caller by voice, [7] while Caller ID verifies the probationer's location.

Border Control

The federal Immigration and Naturalization Service (INS) has pioneered biometric systems in border control. A multitude of people cross into the United States daily--100,000 in El Paso, Texas, alone [8]--which makes prompt and accurate identification necessary. In 1993, INS began a trial of its Passenger Accelerated Service System (INSPASS), which uses either hand geometry or, at one location, fingerprints. [9] Business travelers who fly into the United States at least three times yearly can apply for a biometric identification card at an INSPASS enrollment center. Then, on arrival, the traveler puts the card into a kiosk and puts a hand on the designated spot. If the system verifies the person's identity, it opens a gate and records the process.

The U.S. Department of Justice evaluated the initial INSPASS system, which cost about $3 million. The audit found that INSPASS "has the potential to be a cost-effective means of reducing processing time for frequent travelers... without sacrificing security." [10] The $45,000 kiosk costs less than a border inspector's yearly salary, approximately $50,000.

INS has opened automated border crossing systems (Port Passenger Accelerated Service System, or PORTPASS) on the northern border in Montana and in Coronach, Canada. [11] In these remote locations where employees do not work around the clock, a voice-recognition system, which can withstand severe weather conditions, authenticates border crossers. On the Mexican border, illegal immigrants caught crossing the border have their fingerprints read into an electronic database for future identification and to check for those wanted by the police. [12]

Criminal Identification

In 1978, Minnesota became the first state to install an automated biometric fingerprint identification system. It identifies arrested criminals and permits searching of prints found at crime scenes. [13] Live scanning, in which video cameras and computers directly read digital fingerprints, allows agencies to transmit prints to other agencies, including the FBI. The FBI's newly implemented NCIC 2000 system can, among other services, match submitted fingerprints to subjects on the national list of wanted persons.

The sheriffs' offices of Hennepin and Ramsey counties, the St. Paul police, and a local company plan to test a portable fingerprint reader that law enforcement can use in or near their vehicles to learn on the spot whether a suspect is on the national wanted list. The devices cost about $2,500 to $4,000, with additional costs to upgrade police radio or telephone systems to accommodate the fingerprint readers; federal funds may help agencies pay for the equipment.

Criminal Background Checks

Many states require criminal background checks as a condition of employment or licensing for some individuals, including law enforcement officers, licensed daycare workers, foster-care providers, and individuals applying for liquor licenses. In 1998, California began submitting fingerprints electronically by live-scanning individuals who need background checks; sheriffs' offices throughout the state house the terminals, which cost about $55,000 each. [14] This service likely will cut the time it takes to do a background check to 72 hours or fewer for 95 percent of applicants, who pay a fee for the service.

Photo Identification

Automated systems that capture and digitize mugshots can incorporate facial recognition. In 1988, the Lakewood Division of the Los Angeles County Sheriffs Department installed a system that can take the composite drawing of a suspect or a video image of someone committing a crime and search it against its database of digitized mugshot photos. The department also intends to use the system to search for suspects on "Megan's Law CD," a photo database of registered sex offenders. [15]

British police plan to automatically monitor closed-circuit surveillance video cameras with facial-recognition software. Britain has more than 200,000 video cameras used for surveillance, many watching streets and shopping areas. In Newham, a borough of London, the local police have planned a 6-month trial of facial recognition at a cost of about $100,000 for a system that includes 140 street cameras and 11 mobile units. [16] A computer will monitor video cameras set to watch for known criminals. When the system recognizes someone, it will alert the police. This technology also can monitor public video cameras for missing children or scan for terrorists at airports.

Driver's Licenses

Because a driver's license has become a key form of personal identification, its authenticity remains critical. Driver's license fraud contributes to other types of crime, including identity theft, [17] credit card fraud, and the illegal purchase of alcohol and tobacco by underage minors. States are taking more precautions to control the issuance of a driver's license, and biometrics offers the best way to check a person's identity.

In 1998, West Virginia became the first state to apply facial-recognition technology to the driver's license application process. [18] When people apply for a new license, the system digitally stores their photographs. When they renew their licenses, or try to replace lost or stolen ones, the system captures their photo and automatically compares it with their previous photo. This system prevents people from getting a license under a false identity. West Virginians also can have their fingerprints stored on their driver's licenses for identification at stores and other locations.

Other Applications

For government benefit programs, a biometric system can offer both reduced opportunity for welfare fraud and increased security for recipients who get their benefits electronically. For credit card companies, biometrics may one day eliminate fraud. [19] Biometrics also can provide computer and Internet security by authenticating the person signing on to a computer or computer network, controlling access to sensitive data, and making Internet financial transactions more secure.

In addition, a recent breakthrough in technology will further reduce prices and extend the range of fingerprint verification. [20] Most fingerprint scanners have a small video camera to capture an image of the fingerprint. But soon a single computer chip will hold fingerprint scanners at an expected cost of $40 or less. Users will simply put their finger on the chip itself to scan the fingerprint into the computer. The chip is so small and thin, users can mount it virtually anywhere--on a computer keyboard, a doorknob, a car ignition, or a cell phone. With a fingerprint chip on the handle and a small computer inside, [21] the "smart gun" relies on this technology. The owner of the gun would touch the fingerprint sensor to activate the gun; no one else could use it.

CONSIDERATIONS

Biometric systems continue to prove their worth for a broad range of applications. However, their widespread use in government and commercial arenas depends on a number of factors. Short-term considerations include the cost and accuracy of various systems on the market. In the long run, and perhaps more important, agencies must study the legal issues, privacy concerns, and public attitudes associated with biometrics.

Accuracy

Biometric systems use two measures of accuracy, one for each type of mistake they make. For example, a biometric system that limits access to a building would make a mistake if it let in an unauthorized person. Other times, the system might fail to recognize a person who should gain access. Biometric system users must decide upon the degree of error they will permit, taking into account the type of biometric system needed, cost, security desired, and what happens if a mistake occurs. A nuclear plant, for instance, which requires a very high level of security, would need a biometric access system that made it virtually impossible to let in an unauthorized person.

Some biometric systems can adjust error rates, which involves a trade-off between the two types of errors. That means that a system that reduces the chance of a person's getting into a building by mistake increases the likelihood that legitimate users will be denied admittance. So agencies must balance security interests against the annoyance and problems that arise when legitimate users cannot gain access. For example, bank customers who cannot access their accounts through the ATM might switch banks.

Legality and Privacy

Federal and state governments have used fingerprints for years to identify people, both in criminal cases and for civil purposes. These applications have consistently withstood legal challenge. [22] Similarly, the government can require photographs for identification. Courts have not extended any constitutionally based privacy right to people who are required to prove their identity with a fingerprint, although the government may have to show that it has a reasonable public purpose for taking a fingerprint. The courts have not yet ruled on new biometrics, such as iris or hand geometry, but fingerprints may provide a precedent. When used with public or private survillance video, facial recognition raises unique privacy concerns because people can come under surveillance without their knowledge.

Privacy issues emerge when a government agency does something with a person's fingerprint that goes beyond the original purpose for its collection. The California Supreme Court approved taking fingerprints for driver's licenses but ruled that indiscriminate dissemination of fingerprint records by the state violated individual privacy rights. [23]

The provincial Information and Privacy Commissioner of Ontario, Canada, leads the way as governments around the world work on guidelines and laws for the privacy of biometric information. The office proposed a series of safeguards for fingerprint identification records of the Ontario government's social assistance programs. [24] Recommended safeguards include encrypting the biometric to make it impossible for anyone to use it without authorization; restricting use of the finger scan; preventing unauthorized access to the biometric database; and keeping most personal information separate. These elements became law in Ontario in 1997. [25]

CONCLUSION

Simply put, biometrics work well. Systems currently on the market can successfully identify and authenticate people with a high degree of accuracy. Fingerprints remain the best choice for applications involving large numbers of users. Iris-based systems may equal or exceed fingerprints in accuracy, but the limited number of vendors and lack of precedent for iris recognition make them less attractive. Hand-geometry systems have proven themselves in physical access control, particularly in prisons, which require high levels of accuracy and security. Voice recognition proves least accurate but might represent the best alternative to verify someone's identity over the phone.

Facial-recognition systems create opportunities to identify people unobtrusively and without their cooperation, as in video surveillance, and they can be added to digital photo systems used for mugshots or driver's licenses.

Biometric systems also have proven their cost-effectiveness in state welfare systems and border control, where the system costs less than hiring a person to do the same work. In criminal identification, biometric technology can save investigators many hours of work and solve crimes that might remain unsolved using traditional police practices.

Before selecting a vendor for a biometric system, agencies should consider the company's ability to provide long-term maintenance and keep pace with technology. Agencies should test biometric systems thoroughly prior to purchase or before expanding to larger systems. Buyers need to make their own assessment about the accuracy and reliability of biometric systems and not rely totally on claims of manufacturers.

Although they work well, biometric systems have little compatibility with one another. Agencies may find advantages in adopting compatible systems, but compatibility also makes it possible to share data on people across systems, which might infringe on people's privacy.

The public generally accepts the use of biometric systems as a necessary part of doing business in today's crime-ridden society. [26] With safeguards in place to protect the legal and privacy rights of citizens, organizations can use biometric systems with the cooperation of the public. Indeed, biometric technology can help agencies in both the public and private sector solve crimes, protect identities, secure entrances to buildings and borders, safeguard computer databases and networks, and deter fraud in the communities they serve.

Endnotes

(1.) See, e.g., "The History of Fingerprints," available from http://onin.com/fp/fphistory.html; accessed 10/5/99.

(2.) Richard Wildes, "Iris Recognition: An Emerging Biometric Technology," Proceedings of the IEEE 85 (September 1997), 1348-1363.

(3.) Juan Velasco, "Teaching the Computer to Recognize a Friendly Face," New York Times, October 15, 1998, D7.

(4.) General Accounting Office, Electronic Benefits Transfer: Use of Biometrics to Deter Fraud in the Nationwide EBT Program (Gaithersburg, MD: September 1995), 24, GAO/OSI-95-20.

(5.) Keith W. Strandberg, "Biometric ID," Corrections Forum, 1997; available from http://www.prisons.com/cforum/id.html; accessed 11/19/99.

(6.) "New York City Awards $925,000 Contract to Pacer Infotec for Electronic Probation Management Systems," press release, March 5, 1997; available from http://www.corrections.com/products/news/crad.htm#pacer; accessed 11/19/99.

(7.) "VoiceTrack," available from http://www.voicetrack.com/; accessed 11/19/99.

(8.) William R. Baron, U.S. Department of Transportation, "Volpe Engineers Use Biometrics to Help Ease Border Crush," Volpe Transportation Journal, spring 1997; available from http://www.volpe.dot.gov/pubs/journal/spring97/biomet.html; accessed 11/19/99.

(9.) Ibid.

(10.) U.S. Department of Justice, Office of the Inspector General, Audit Division, "Immigration and Naturalization Service Passenger Accelerated Service System Pilot Program," Audit Report 95-8, March 1995; available from http://www.usdoj.gov/oig/inspass1/inspass1.htm; accessed 11/19/99.

(11.) Supra note 8.

(12.) Verne G. Kopytoff, "A Silicon Wall Rises on the Border," New York Times, January 14, 1999, D1, D5.

(13.) Stephen Coleman, "Minnesota's Automated Latent Fingerprint Identification System," Proceedings of the Fourth International SEARCH Symposium, SEARCH Group, Inc. (Sacramento, CA: 1979), 223-227.

(14.) California Department of Justice, Bureau of Criminal Identification and Information, "Applicant Live Scan," available from http://www.caag.state.ca.us/app/livescan.htm; accessed 11/22/99.

(15.) "Los Angeles Sheriff's Department Installs Facial Recognition Software," Viisage Technology, Inc., press release, September 26, 1998; available from http://www.viisage.com/imagewar2.htm; accessed 11/19/99.

(16.) "Candid Camera for Criminals," BBC News, October 13, 1998; available from http://news2.thls.bbc.co.uk/hi/english/uk/newsid_191000/191692.stm; accessed 11/22/99; and Robert Matthews, "Security Camera Can Find a Face in Crowds," Electronic Telegraph, UK News, Sunday, July 6, 1997; available from http://www.telegraph.co.uk:80/; accessed 11/22/99.

(17.) Identity theft generally refers to stealing such items as credit cards, checks, and driver's licenses and using them to commit fraud, or obtaining a person's personal information, such as social security numbers or bank account numbers, and using that information, perhaps with a fake driver's license, to open new credit accounts in that person's name without the person's knowledge.

(18.) "West Virginia Becomes First State to Issue Driver's Licenses Using Facial Recognition Technology," press release, March 24, 1998; available from http://www.instantphoto.polaroid.com/polinfo/press-releases/march98/0 32598a.html [access via www.polaroid.com]; accessed 11/19/99.

(19.) "MasterCard Wins Another Round Against Fraud," MasterCard, press release, May 11, 1998; available from http://www.mastercard.com/about/press/980511a.html; accessed 11/19/99.

(20.) Miquel Helft, "Digital Fingerprints: A Key of the Future," Wired News, May 22, 1997; available from http://www.wired.com; accessed 11/19/99.

(21.) David Kocieniewski, "Trenton Debates Requiring Guns Only Owner Can Fire," New York Times, September 24, 1998, A27.

(22.) John D. Woodward, Biometric Scanning, Law & Policy: Identifying the Concerns--Drafting the Biometric Blueprint, 59 U. PITT. L. REV. 134 (Fall 1997). The U.S. Supreme Court also has ruled in United States v. Dionisio, 93 S. Ct. 764, that a grand jury witness can be compelled to furnish a voice exemplar because it does not violate the Fifth Amendment privilege against self-incrimination and, further, that the Fourth Amendment prohibition against unreasonable searches does not protect a voice exemplar because the voice is a physical characteristic constantly exposed to the public. In Whalen V. Roe, 97 S. Ct. 869, the Court ruled that a state could collect the identities of medical patients who obtained prescriptions for certain drugs. The Court said that the patient identification requirement represented the product of rational legislative action and a reasonable exercise of state police powers; it did not impair any privacy interest protected by the Constitution.

(23.) Perkey v. Department of Motor Vehicles, 42 Cal. 3d 185 (1986).

(24.) Ann Cavoukian, "Privacy and Biometrics: An Oxymoron or Time to Take a 2nd Look?" Office of the Information and Privacy Commissioner, Ontario, Canada; available from http://www.ipc.on.ca/web_site.eng/matters/sum_pap/papers/cfp98.htm; accessed 11/19/99.

(25.) Social Assistance Reform Act, 1997, Bill 142, ch. 25, S.O. 1997 (Can.).

(26.) Alan F. Westin, "Public Attitudes Toward the Use of Finger Imaging Technology for Personal Identification in Commercial and Government Programs," National Registry, Inc. (St. Petersburg, FL: August 1996).