BusinessWeek Online

Why Biometrics Is No Magic Bullet

This promising ID technology works best in controlled situations -- which are hardly the norm in the real world

July 22, 2003
By Alex Salkever

In Afghanistan, the U.N. uses an iris-scanning system to identify refugees returning from Pakistan to ensure that they don't double-dip on one-time aid grants. In Pinellas County, Fla., police use facial-recognition technology to record the newly arrested so they can be more easily identified if they're nabbed again. At Counterpane Internet Security in Mountain View, Calif., hand-geometry readers match the hands of people seeking to enter key areas with those on a list of Counterpane employees. All three are examples of relatively successful uses of biometric technologies.

At the same time, though, numerous biometric pilot projects around the country and the world have come up short. Many casinos have facial-recognition systems to spot known card counters but rarely use them due to the high number of false-positive identifications. Plans to use biometrics in national ID cards in the U.S. didn't even pass go before concerned lawmakers scrapped them. And while dozens of airports around the world have installed or are running trials with biometric systems to authenticate IDs for airline employees and even passengers, how many of these systems remain in use is an open question, according to Jim Wayman, an engineer and biometrics expert at San Jose State University in California.

Witness much-hyped trials of facial-recognition technology in January, 2002, at Palm Beach International Airport. The Palm Beach trial never made it to full installation after the airport decided it wasn't worth the cost. "There has been too much hype of the technologies, and there has been too much hype of the fear of the technologies," says Wayman.

LIMITED HOPE.  The glass half-empty or half-full is an apt metaphor for the current state of biometrics, an industry with $600 million sales in 2002, according to the International Biometrics Group (IBG) in New York. Nearly two years after the September 11 terrorist attacks on New York and Washington, biometrics is losing some of its magic-bullet appeal, even among security zealots. Instead, the science and practice of measuring physical characteristics that are unique in each human -- such as the sound of a voice, the shape of a hand, or the geography of a retina -- seem to offer limited but significant hope to those seeking more order in an out-of-control world.

Witness the prospects for facial-recognition technology. Suppliers initially promoted it as a means for spotting a terrorist's face in a crowd. The use of such systems to catch wanted criminals at the 2001 Super Bowl in Tampa, Fla., rightly stoked privacy fears.

Yet, identifying members of al Qaeda on the street has proven to be particularly tough. The National Institute for Technology & Standards has found in tests that facial-recognition systems perform well in controlled situations but that in uncontrolled settings, facial appearances can vary significantly depending on lighting, camera angle, and a number of intangibles. So today, most companies selling this technology emphasize its utility for identifying individuals during more confined activities such as check-cashing, the taking of drivers-license photos, and police bookings.

TROUBLING SIGNS.  "All facial-recognition technology does is create a template of a face so we can store it and find it later," says Bernard Bailey, CEO of facial-recognition company Viisage Technology (VISG). "That way, if I'm looking for someone with brown hair, brown eyes, and a wide nose, it will automatically narrow it down for me. I don't have to go through 20 million photos, maybe just 4 million. This is a technology for authentication and verification, not identification."

Still, civil libertarians fear that ubiquitous and unchecked use of biometrics could create an Orwellian society. They believe that employing facial-recognition systems to search for escaped criminals in public areas of Tampa, plus the growing use of video cameras and facial recognition by police forces in Britain, are troubling signs.

That's not to say opponents advocate eliminating all biometrics. The American Civil Liberties Union has gone on record as having no problem with using biometrics to secure airport areas or other sensitive facilities, for example. Rather, what bothers the ACLU and other groups is an apparent lack of legal forethought.

"The technology is being developed at the speed of light, but the law that governs its use is back in the Stone Ages," says Barry Steinhardt, director of the Technology & Liberty Project at the ACLU. "Supermarkets are free to use biometrics in the same way as an airport that needs to verify the identity of a pilot."

NOT "FOOLPROOF."  The ACLU and others also contend that biometrics has serious technological flaws. If a single false-positive shuts down an entire airport, then one false-positive per day is clearly too many. Yet biometric systems aren't capable of achieving the success rate necessary for those kinds of decisions. "No biometric is foolproof," says Anil Jain, a biometrics expert and researcher at Michigan State University, in an e-mail interview.

Jain estimates that as many as 4% of people can't be covered by fingerprint-ID biometrics systems because of the comparatively blurry quality of their prints. To get around this problem, the U.S. Immigration & Naturalization Service, among others, has begun recording more than one biometric measure -- fingerprints, plus hand geometry or facial recognition.

Despite biometrics' many weaknesses, sales could grow quickly, according to IBG, which predicts that global biometric sales will rise more than 500% from 2002 to 2007, reaching revenues of $4 billion. The biggest chunk will come from U.S. government programs that have finally made it through the homeland security pipeline. For example, in May the Defense Dept. launched a program to give so-called smart cards to all 4.5 million members of the military. Within a few years, Defense intends to use those cards as biometric tokens to better secure facilities and possibly to track movements.

"Most people's first exposure to [biometrics] will be in large-scale government deployments. That will help to drive awareness and the comfort level. Then we'll see it take off among corporations," says Trevor Prout, IBG's marketing director.

UNSECURED PCs.  Even so, the realization is now dawning that security concerns alone may not be a big enough reason to drive biometrics into every nook and cranny of everyone's lives. San Jose State's Wayman points out that banks have tried biometrics on automated-teller-machine networks and failed, partly because of technological difficulties but also because of the inability of ATM infrastructure to process all the extra data that are collected. And he believes that few people have chosen to secure their personal computers with fingerprint readers simply because they don't see the value in such protection.

"There are some specific applications that do make sense to me," he says. "But most of us aren't using biometric technologies in our daily lives."

That could remain the case for the foreseeable future. No doubt, biometrics will spread as more corporations use the technology to control access to key facilities and as government bodies such as the Federal Aviation Administration and the Pentagon do the same. But don't expect to see fingerprint readers on car doors or facial-recognition kiosks for admitting hospital patients anytime soon. For the most part, biometrics appears to be a technology whose time has not yet come.