Electronic Business

A market in search of an identity

Fingerprint biometrics have yet to find a high-volume application

January 1, 2004
By Tam Harbert

With the emphasis on security since 9/11, with many nations launching national ID programs, and with the United States overhauling the way it tracks foreign visitors, you'd think that fingerprint biometrics would be booming.

You'd be wrong.

Despite all the hype, fingerprint biometrics is a fractured market with multiple personalities. There is the original government market, which consists of large, expensive machines that record and store the fingerprints of criminals for such agencies as the FBI. There is an emerging market that is trying to apply this same approach to national security and civil identification programs. And there is another emerging market in which vendors are trying to sell smaller, less-expensive finger scanners to secure either physical access (such as entry to a building) or logical access (such as logging onto a PC).

Biometrics is defined as technology that can identify a person by biological features unique to that individual. There are many types of biometrics: fingerprint, facial recognition, iris scanning, voice verification, hand geometry, keystroke dynamics and signature analysis. There is even a nascent category called gait recognition—identifying individuals by the unique way they walk.

But fingerprint biometrics is by far the largest chunk of the market. Of the total $928 million biometrics market in 2003, as measured by International Biometric Group, a market research firm, fingerprint biometrics represented $685 million. Of that amount, $422 million came from the Automated Fingerprint Identification System (AFIS), used by the FBI and other law enforcement agencies. Another $263 million came from finger scan technologies, which consist of other methods of finger identification. Frost & Sullivan, which also tracks the market, offers more-conservative numbers, estimating the AFIS market at only $246 million in 2001, growing to $453 million by 2006. For finger scan, Frost & Sullivan estimates revenues of $75 million in 2002, growing to $1.5 billion by 2009.

The problem with the biometrics market is that the forecasts and expectations always seem to exceed the actual results. In both the government and commercial sectors, various flavors of the technology still have critical performance limitations and high costs. The public sector has looked to biometrics since 9/11 as the possible savior of a world fraught with security problems. Although fingerprint biometrics is commonly used by law enforcement agencies, governments and biometric vendors have yet to identify a cost-effective and feasible way of using it on a large scale to ensure security. And although some vendors are pushing lower cost biometrics for commercial applications, that market remains limited by cost and performance barriers as well.

Within the finger scan segment, there are several methods of scanning—optical, ultrasound and silicon sensor are the main ones. And silicon sensor fragments further into several individual technologies: Atmel's chip measures temperature differences between the ridges and valleys of the finger. Infineon's chip measures the difference in capacitance between the ridges and valleys. STMicroelectronics' chip uses a different type of capacitive sensing technology.

One of the reasons biometrics has not yet taken off is that most biometrics companies have yet to figure out exactly what their target market is, says C. Maxine Most, principal of Acuity Marketing Intelligence and editor of a newsletter on the biometrics market. "In spite of the exaggerated claims of some prominent vendors, there are no market leaders in the biometrics industry," she says. "There simply has not been enough penetration in any single vertical market to claim leadership status." Many of the early, pioneering biometrics companies are small and have spent most of their time and effort on developing the technology, not identifying a market for it. "You have these $2 million to $5 million companies talking about going after the entire transportation market," says Most. "That's like going after the whole universe."

Even the large multinational electronics companies that play in the biometrics market, such as NEC, Infineon, STMicroelectronics and Fujitsu Microelectronics America, aren't adequately defining their market, she says. "The problem is not with the technology; it is with the people in the market," says Most. "It takes as much rigor to develop a market as it does to develop the technology. It's my opinion that these people aren't applying the rigor required." Rather than diligently identifying the market need their technology can meet, "most of these companies expect a million-dollar contract to drop on their head, and that's just not going to happen," she says.

Vendors recognize that their market is not well defined. "In this market, you are shooting from a moving target at a moving platform," says Gerry Schmidt, director of sales and marketing at Cogent Systems, which develops software algorithms used in biometric fingerprint systems. The technology is here, he says. "We're just trying to find the niches in the market to fill."

Fingering criminals

AFIS is the only part of the market that is well established and clearly defined. The FBI created the system more than 20 years ago, as a way to electronically scan and log the fingerprints of criminals. Companies in this market, such as NEC and Identix, sell large, expensive machines called live-scan systems—costing $10,000 to $40,000—that typically scan all 10 fingers completely, from nail edge to nail edge. These systems use sophisticated optical technology and complex software algorithms to scan the fingers, store the scans in a large database, and then search for a match between a single set of prints and the millions stored in the database. The AFIS market consists primarily of government contracts, not only with federal law enforcement agencies but also with thousands of state and local governments across the U.S. The FBI's database has about 30 million prints on record, says Phil Scarfo, senior vice president of the Identification Systems Division of NEC Solutions America. But NEC claims that its systems—36 of them in 21 states—host the largest database of prints, some 60 million.

The biometrics industry is rife with hyperbole. Press releases announce that a biometrics vendor is involved in a multimillion-dollar contract, but it is usually only supplying a small piece of technology to a large systems integrator. Identix recently won a five-year, $27 million contract to supply the Department of Homeland Security with biometrics systems—one of the largest single orders for biometrics on record, according to Most. And yet, a careful reading of the press release reveals that the contract is a blanket purchase agreement that carries no commitments or minimum purchase requirements. "Basically, the government has agreed that it can purchase this stuff from Identix," says Most. "Big deal."

The next-largest contracts that Identix has to date, according to Joseph Atick, president and CEO, are a $1 million contract with Saudi Aramco, the world's largest oil company, and a $1 million contract with the County Sheriffs of Colorado.

Indeed, the AFIS market is getting saturated, says Prianka Chopra, biometrics program leader at Frost & Sullivan. Further growth will come from an emerging market that she calls civil AFIS applications, such as immigration, border control and national ID programs. After the terrorist attacks of 9/11, several pieces of legislation were passed that seem destined to create whole new markets for biometrics. In May 2002, President George W. Bush signed the Enhanced Border Security and Visa Entry Reform Act, which requires every foreign visitor to carry a travel document containing biometric information. The Patriot Act requires financial institutions to put into place more-rigorous security safeguards that may require biometrics. Another project is the U.S. VISIT (Visitor and Immigrant Status Indicator Technology) program, which the Department of Homeland Security has said will use a minimum of two biometric identifiers. The first phase of the program—collecting fingerprints and photos of foreigners entering the country—was supposed to go into effect in selected airports and seaports by the end of 2003.

But these programs are far from wide-scale deployment. And even when they are deployed, they won't require high volumes of biometric devices. The UN body responsible for deciding standards for machine-readable travel documents, the International Civil Aviation Organization (ICAO), recently recommended that facial recognition should be the international standard biometric. It also recommended that a second biometric be used, which most people think will be fingerprints. But even if countries decide to follow the ICAO's recommendations, it will take years to replace citizens' passports, and even then, the new documents will simply contain a memory chip for storing the biometric information.

Acuity's Most contends that biometrics became a red herring after the terrorist attacks of 9/11. "People started looking at biometrics as an infallible system that was going to protect us," she says. That's not true: Biometrics are not 100 percent accurate, she notes. But more important, she says, the entire U.S. immigration system needs to be redesigned before the government throws technology at the problem. There is not even a formal exit program for leaving the United States, she says. "In most other countries, you have to go through immigration when you leave the country," she says. "Here, you just get on a plane. The VISIT program is a joke."

Even with finger scanning systems, comparing individual fingerprints of travelers with a database will not be instantaneous, she says. "This data matching takes time." AFIS-quality systems can take hours to scan a database, depending on the number of prints stored in the database. If the government wants the system to work quickly, it will have to limit the number of prints stored in the database, she notes.

Who goes there?

Meanwhile, some vendors are trying to sell lower cost biometrics into the commercial sector. AuthenTec and other silicon sensor vendors—including Atmel, Infineon, STMicroelectronics and Fujitsu Microelectronics America—are pushing their products as logical access devices for PCs and other devices. However, that has its limitations as well, but for technological rather than financial reasons.

Chip companies say that silicon sensors will lower the costs of fingerprint biometrics—so much so that fingerprint identification can be embedded in everyday products such as notebook computers and cell phones. AuthenTec claims to have the smallest and lowest-cost sensors on the market—its least-expensive chip is $6 in volume, says CEO Scott Moody. And there is no high infrastructure cost like that required by large national ID or law enforcement programs. The silicon sensor is suitable for one-to-one or one-to-a-few applications. It can check whether the finger being placed on the sensor matches any of the several sets of fingerprints stored in its memory and thus determine whether to give the owner of that finger access to a computer or a building. "That's sufficient to allow somebody to open a gate," says Jeff Katz, vice president of worldwide marketing at Atmel. "It's not enough to identify a terrorist."

Chip makers are hopeful that this user authentication application will take off in the corporate PC and networking market. Notebook OEMs can add a fingerprint reader to their products for around $100, says Mike Chaudoin, senior strategic marketing manager at Fujitsu Microelectronics America. "The total available market for the PC segment is huge," he notes. What's more, Intel recently released design guidelines for PC manufacturers that want to design finger scanners into their notebooks, which should encourage the market, says Alan Kramer, group vice president and director of the TouchChip business unit at STMicroelectronics.

The total silicon sensor fingerprint market was only $9.1 million worldwide in 2002, but Frost & Sullivan expects it to grow to more than $1 billion by 2009. The PC/network-security application is the largest segment of the market, comprising 66 percent of the units shipped in 2002, according to Frost & Sullivan's Chopra.

AuthenTec is the market leader, claiming 65 percent of the market. The company's sensor uses radio-frequency technology that Moody says gives a more accurate image of the fingerprint, even if the finger is dirty. Moody expected AuthenTec to have shipped 1.6 million chips by the end of 2003 and to have reached the two-million-unit mark by the end of this month. Moody thinks cell phones could become a big market for silicon sensor vendors. In July NTT DoCoMo introduced a cell phone with a fingerprint sensor from AuthenTec into the Japanese market. Cell phones enabled by finger sensors may come to be used just like a credit card for purchases, says Moody, and they will be more secure—your identity will be verified by your fingerprint rather than by a signature that can be forged.

Atmel sees "pretty good design activity in the computer space," for its chip, says Katz. The company is already shipping "a significant number of chips" to Hewlett-Packard, which has designed the chip into the high-end models of its iPaq PDA. Nevertheless, many iPaq users probably don't use the finger scanner to access the device, Katz admits.

STMicroelectronics' highest-volume application is in notebooks from Micron PC, a company that supplies computers to government and specialized markets that require secure access to data. Volume is approaching 100,000 this year, for a total volume of about 200,000 since the project began four years ago, says Kramer.

STMicroelectronics also participates in some other government programs. For example, its sensor is designed into a PDA-based scanner used in the national ID card program of Malaysia. Kramer estimates he's shipped as many as 10,000 sensors for that project. He claims that STMicro has 100 percent of the market for portable government finger scanning systems. The government projects aren't very high-volume, but "we do these more for the strategic value." The company is working with big AFIS suppliers such as Identix, which can extend their systems into portable applications, by using silicon sensors in handheld devices.

Some sensor suppliers are less enthusiastic about the PC/networking market. Infineon's fingerprint sensor has been designed into a Siemens-brand mouse and a Cherry keyboard, says Joerg Borchert, vice president of Secure Mobile Solutions for Infineon. Still, "the total industry hasn't gotten to the levels we expected," he says.

Why not? The bill of materials for silicon sensors is still high. Borchert says that sensor systems today carry an OEM cost of about $15, which translates to an additional $45 at the retail level. "Are consumers really willing to pay that?" he asks.

"The sensor is still the majority of the cost in our products," says Jason Schouw, vice president and general manager of the Americas for SCM Microsystems. The company builds finger scanners that connect to a PC. As silicon vendors start coming out with second- generation products, many of which use smaller pieces of silicon, he's hoping his costs will go down.

What's more, there's an Achilles' heel to the whole idea of using finger scanning to secure your notebook. Because the technology is not 100 percent accurate, PC vendors run the risk of users getting locked out of their own notebook because the scanner isn't performing correctly.

In fact, performance issues related to silicon sensors may end up doing the biometrics market more harm than good, contends John Schneider, president and chief technology officer of Ultra-Scan, which makes a finger scan device that uses ultrasound technology. "The industry is being flooded with these low-cost, commercial-grade sensors that fail to meet the needs of real-world applications," he says. Schneider, a biometrics pioneer who has run the privately held Ultra-Scan for 14 years, says many OEMs are being tempted by the apparent low cost of these devices. "They think, 'If I can get a fingerprint scanner for $100, maybe it's worth integrating into my product.'" But they fail to take into account other costs, such as reliability, maintenance and the cost of false reads. "In biometrics, performance is everything."

Performance is not necessarily what will make this market fly. What will make the market is "getting the right technology for the particular problem you are trying to solve," says Most. "The only company that is doing a good job at this is AuthenTec," she adds. CEO Moody understands that for the market he is targeting—embedding sensors into mobile devices such as PDAs and cell phones—"false accepts" are not a problem but "false rejects" are, she explains. For example, if the sensor mistakenly allows access to the device once out of every 10,000 finger scans, that's OK for a PDA. It's hard to imagine that someone would go around placing a finger on 10,000 different PDAs, trying to obtain illegal access. "That rate of failure is unacceptable for an access control system in a building, perhaps, but for PDAs that will work fine," she says. But for users to get locked out of their PDA by mistaken readings is disastrous for this market. Therefore, AuthenTec has optimized its technology to minimize false rejects, she says.

Neither 100 percent accuracy nor large government projects will make this market take off, contends Most. What will? Finding a compelling need in the commercial market, with its potential for high volume, and then fine-tuning the right biometric technology to solve that particular problem.