The Baltimore Sun

Scanning for security

Biometrics: Fraud, terror attacks and privacy laws have many seeking more foolproof ways to identify people.

May 5, 2003
By Dennis O'Brien

Allen Tien needed secure computers. The elderly patients in his company's research program had to fill out confidential surveys, and he wanted to keep them confidential.

So the Towson medical software consultant turned to biometrics -- the science that identifies people by turning their physical characteristics into a unique set of numbers.

He hooked a set of fingerprint scanners to his office PCs, figuring they'd provide a foolproof way for each patient to sign on. And then he learned something -- a lot of senior citizens don't leave usable prints because their fingertips are worn down.

"For any technology you have to take into account who is going to use it, and how are people going to use it," Tien said.

So his elderly subjects went back to old-fashioned names and passwords. But backers of biometrics say such glitches don't diminish the technology's potential for business, government and health agencies in an uneasy post 9/11 era.

"Right now, people want the security that goes with biometrics, and eventually, they're going to demand it," said Rick Norton, executive director of International Biometric Industry Association, a Washington-based lobbying group.

Last week, Homeland Security Secretary Tom Ridge announced that the government will speed up deployment of biometric security at the nation's borders and airports. The first systems, to track visitors' identities, will be in place by the end of the year. So far, the government has issued $14 million in development contracts.

Elsewhere, fingerprint scanners are being designed to tighten access to business networks, hospital records, prisons and bank automated teller machines. Voice recognition systems are being developed to eliminate the need for giving out credit card numbers over the phone.

Connecticut has been using fingerprint scanners to curb welfare fraud since 1996, and iris scanners have been used for months for access to secure Pentagon offices. Microsoft has promised to build direct support for biometric devices into the Windows operating system.

"If it's able to provide some level of an increased ability to identify people, there could be a good use for it in some settings," said Trevor Prout, spokesman for the International Biometric Group, a consultant that is trying to find a biometric system that will prevent people from getting a driver's license in more than one state.

But backers of biometric systems face two hurdles: finding foolproof technology and convincing the public that it works.

At the Palm Beach International Airport in Florida, 15 employees repeatedly walked past security cameras last year to test a scanner designed to read their facial characteristics and pluck their photos from a database of 250 images.

But of the 958 times that the cameras caught the employees, they were matched with the correct photo only 47 percent of the time. Like other facial scanning systems, this one was thrown off by eyeglasses, lighting conditions and head movement.

Even when the technology works, there are concerns about privacy and cost.

While a few credit unions have installed fingerprint scanners at ATMs, most banks are reluctant because of the expense and worries about customer backlash, said Dennis Behrman, a bank analyst for Financial Insights.

"Consumers are very reluctant to put their fingers up to fingerprint readers and their eyes up to iris scans. As a culture, we're very privacy oriented," Behrman said.

Privacy advocates fear that police and government agencies will use biometrics to pry into people's lives.

"It will enable the government to track you and your actions, and you're going to be unable to have any control over that tracking," said Chris Hoofnagle, deputy counsel for the Electronic Privacy Information Center, a Washington-based public interest research center.

Tampa, Fla., police upset privacy advocates two years ago when they used a face recognition system at the Super Bowl to scan ticket-holders and run their pictures through a list of suspects. At this year's Super Bowl, San Diego police rejected the idea. "It doesn't work. The technology just isn't there yet," said William Mahew, San Diego's assistant police chief.

But privacy advocates say the fact that police even considered such technology is troubling.

"If you have enough pictures, you can do a virtual lineup without people even knowing about it," said Hoofnagle.

In the health care world, new federal privacy rules -- required by the Health Insurance Portability and Accountability Act -- are encouraging the use of biometrics. That is what sent Lynn Sims shopping for a system that would limit employee access to computerized patient records at eight Tallahasee-area clinics operated by North Florida Medical Centers.

Sims, the company's information systems manager, said he ran into a variety of problems with fingerprint scanners. Relatively cheap as biometric devices go, they were frequently thrown off by employees who had applied hand lotion or wore surgical gloves.

So he returned the fingerprint equipment and bought 35 iris scanners -- pencil-sized cameras mounted at each computer work station. They cost $450 each, but worked much better.

"You sit down, look into the camera for two seconds and bam, you're in," he said.

Biometric devices work in different ways, but they all start by trying to quantify a human characteristic -- a fingerprint, face, hand, voice or iris -- and turn it into a numeric code that can be compared against a database of known subjects.

Fingerprint scanners, the best known and most developed biometric tool, calculate distances between key points in the ridges of a fingerprint and come up with a unique set of numbers.

Facial recognition systems analyze the position and distance of facial features to generate a code that is matched against a database of digital photos.

Iris scanners are based on the theory that the colored part of the eye is unique. While fingerprint scanners generate 30 to 40 unique characteristics and facial recognition devices can pinpoint about 80, the iris has more than 260 rings, furrows, freckles and other identifiable marks. Even identical twins have four distinct irises, experts say.

Research into more exotic biometrics borders on the bizarre. For example, the Department of Defense plans to award a $3.2 million contract to try to identify people by their odor.

At Georgia Tech, computer vision scientist Aaron Bobick has spent two years on a government project to identify people by how they walk. The system would extract as many details as possible about the shape of the body in motion and the way the shape changes when someone walks. The changing shapes can be categorized into a pattern that can be reduced to a numeric record, he said.

"It's clear that we all walk a bit differently. But a large part of the work is determining what is it that one should measure, what constitutes the distinct signature of how a body moves," Bobick said.

But most of the federal research -- prompted by congressional mandates enacted after Sept. 11 -- focuses on ensuring safe travel and securing the nation's borders.

The Transportation Security Administration awarded a $3.8 million contract last month to a Reston, Va., company to test a biometric identity card for 12 million transportation workers at the nation's ports, airports, borders, trucking terminals and train stations. Tests are being conducted over the next six months at ports in Delaware and California.

Immigration officials are evaluating tests on a $10.6 million system of fingerprint scanners to verify the identity of immigrants at six of the nation's 300 border crossings, said Kimberly Weissman, a spokeswoman for Customs and Border Protection.

The Enhanced Border Security Act, enacted last spring, requires passports, visas and other travel documents to include biometric identifiers by October 2004, with equipment to read them due at all 300 ports of entry by 2005.

But experts warn that biometrics are not a panacea for border security problems.

James L. Wayman, a math professor and biometrics authority at San Jose State University, says he doubts biometrics can handle the workload at the nation's borders.

Every year, he noted, there are roughly 1 billion border crossings, which would require roughly six times the number of annual searches conducted on the FBI's fingerprint system -- by far the nation's largest existing biometric database.

Wayman said that funding such an enormous border security system remains a major issue. A Government Accounting Office report estimates the costs at $1.2 billion.

"There's nothing capable of handling such a large scale of activity," Wayman said.