Pentagon Endorses Biometrics To Enhance Computer Security.

As more military weapon systems get loaded with computers and software, Pentagon planners worry that, if those systems one day end up in enemy hands, the valuable data stored in those computers will become prized intelligence for U.S. foes. The Army's M-1 Abrams tank, for example, has three major computer systems. The security of these systems is a main concern of the Defense Department, said Phillip Loranger, director of the Pentagon's Biometrics Management Office (BMO), in Falls Church, Va.

"We want to make sure that if we ever have a platform that was taken out of commission simply by removing the crew, that the platform could not be turned against us," said Loranger. He said he believes the answer lies with biometrics.

Biometrics is the study of measurable biological characteristics, such as fingerprints and speech patterns. These physical features can be used in security for authentication purposes, in the same manner as passwords, but they are more accurate, say proponents.

The BMO was tasked to ensure that biometrics technology is developed for the Defense Department.

But Loranger also was told that the technologies should not be military-unique, but rather stem from the commercial marketplace. "Industry is better poised. Industry is a lot smarter than we are Industry is where we got to go to get baseline for standards, the base line for interoperability," he said during a conference on biometrics sponsored by AFCEA International. The BMO has set up partnerships with industry and academia for research, development and integration work.

Cost and training were the main concerns. "Some of the sensors today for fingerprints are down to $12 a piece," said Loranger. Another consideration for biometrics integration is to minimize the use of bandwidth. Some services platforms are still operating on only 9 bits, he said.

The Pentagon sponsored a "personal identification pilot study," said Steven King, who manages BMO's information systems. Biometrics in the form of iris imaging and face recognition was implemented at the Army Research Laboratory (ARL), in Adel phi, Md. "We were focused on personnel/visitor identification at the Defense Department's laboratories and technology centers," King said. ARL set up a visitor and personnel tracking system to monitor access to its facilities.

King stressed that several factors should be considered before an organization enforces a biometrics system:

* How it will affect the staff. "A thousand people go through a facility a day and you want to minimize the impact of the security on the personnel," King said.

* The biometrics system should remain in place for at least three to four years, for long-term stability.

* A Web-based approach improves the efficiency of security checking at the front gate.

* The technology should be as near commercial off-the-shelf as possible.

Iris imaging creates a high-resolution, infrared video image of the iris-- the colored part of the eye. King emphasized that it is not a laser. One of the problems many people had with earlier retinal scanners was the bright light of the laser. There is no light with iris imaging, and the infrared level is about the same as a television remote. "One of the features of iris imaging is that it is a robust biometric in terms of longevity. You retain the same iris image from infancy until you die. There are few diseases that really change your iris. You've got two of them, so you've got redundancy there," said King.

Face recognition is one possible biometric alternative to fingerprints, said King, it has a lower level of intrusiveness than iris imaging. However, the error rates are higher than with iris imaging, especially when the target is moving or uncooperative.

The iris-imaging system set up at ARL will run until July. Then, the security system will be changed over to face recognition. Employees volunteered to participate and the system is run by security personnel, not technicians, to give it a realistic environment.

The process consists of several steps. First, there is pre-enrollment on the Web. The iris image and face recognition are recorded, all of which takes about five minutes. The registration station con rains an iris scanner, a video screen to provide the user with instructions and an automatic badge printer. With 258 people enrolled, the percentage of successful matches is 93.4, said King.

Another project under way is BIDS or Biometric Identification Systems, a force-protection technology for the Defense Manpower Data Center (DMDC). The DMDC holds more than 21 million records. On an average day, 1.1 million transactions take place, a quarter of which are updates to the assignments of military personnel and their dependants, explained Ken Scheflen, of the DMDC. The agency plans to use BIDS to register people, issue identification cards, store fingerprints and pictures, register motor vehicles and privately owned weapons, track guests and their vehicles.

DMDC is in the process of incorporating so-called "smart cards" to identify each member of the U.S. military forces. A smart card is a credit-card sized plastic card with an embedded computer chip that stores all pertinent information about the individual. The program was scheduled to be kicked off worldwide this summer. "The smart card does not contain biometrics, but it uses biometrics as part of the identification process, comparing a fingerprint that is already in the database, if we have one, to the live person," said Scheflen.

The future of communications lies in a globally interconnected grid, which will require some use of biometrics to protect information, said Ben Acre, from GRC International Inc. "Biometrics is needed everywhere. It is needed not only on the system that has a lot of different components, but it's needed in the single entity. It is needed for weapons systems. ...We need it at different aspects of the battlefield," said Acre.

Standards for the deployment of biometrics technology are emerging, said Fernando L. Podio, co-chair of the Biometrics Consortium. These standards include a common biometric exchange file format, a biometric application programming interface, common data security architecture and other programs that would make interoperability easier.

Biometrics also has applications in the law-enforcement arena, said Don Prosnitz, a science advisor for the Justice Department. Forensics is one example. Currently, one of the largest Justice programs is integrating the fingerprint databases of the FBI and the Immigration and Naturalization Service.

Prosnita hopes that biometrics will help identify criminals when fingerprints or DNA techniques fail. "We often have latent prints or DNA that may be hard to identify. And maybe you can have a latent picture of somebody.... So we extend the concept of latency to biometrics," he said.

But Prosnitz raised concerns that expensive technologies that the Justice Department can afford may not be accessible to state and local agencies.

Biometrics security systems also could be expanded to control the flow of people across the borders. About 530 million travelers a year are checked at the borders. Biometrics could help with that process by making it faster, said Prosnitz. Even routine police traffic stops would be enhanced by biometrics. Prosnitz also pointed out that biometrics could make it difficult for a police impostor to go undetected.

The prison system could benefit from biometrics, he said. A prisoner-transportation system by the U.S. Marshals Service, commonly called Con Air, is one example. "The Marshals Service transports 1,000 prisoners a day all over this country.... The buses pull up from different local prisons. They all have to get on the airplane, and there are 250 on the plane that have to get on the proper bus, so we have to segregate the prisoners. The medical records travel with them."

The State Department also has plans for biometrics. The 290 U.S. Foreign Service posts currently are using conventional access credentials, explained Jack Applebaum, of the State Department. These are problematic, because the access cards or keys can be misplaced or stolen. Plus, Applebaum lamented, there are so many passwords and PIN numbers to remember, that many employees commit a security violation by carrying around a card with all of the passwords and numbers written on it. The State Department has tried hand recognition and retinal scan without much success, but the technology is moving toward iris scanning and face recognition, he said.

About a third of diplomatic posts overseas do not have 24-hour security services, said Applebaum, or any presence, for that matter, from Friday afternoon until Monday morning. If a U.S. diplomat arrived at an embassy when there is no security personnel on duty, he or she would not be able to enter the facility. Biometrics technology would help address that problem.

While many experts and industry representatives seem to be in agreement that biometrics is the way of the future, there are several obstacles to overcome. A big one is public acceptance. Both Prosnitz and Applebaum raised the question of privacy. Many people would strongly object to having their DNA, fingerprints or other features stored in a database. Then there is the question of simple sanitation. The idea of using a hand or finger plate, which is covered with prints from previous users can be repulsive to some people. "The counter argument to that, whether a hand plate or a finger, is then you use the doorknob don't you?" said Applebaum.

King also commented on the reality that some people just have trouble adapting to using the technology. "You might think that looking at a little blinking dot is a very easy thing to do, but for a certain percent age of people, biometrics poses a challenge. Even if you have to look at it for three seconds," he said.

One of the main goals, officials agreed, should be to speed up the process of identifying the users, especially when the system has to handle hundreds to thousands of people a day.