Washington Technology

Great expectations: Biometrics

Dogged by 'Hollywood mystique,' biometrics struggles to fulfill promise

September 29, 2003
By Patience Wait

That's what John Woodward, then a senior policy analyst at Rand Corp., wrote in a book he authored eight years ago. For several years thereafter, as he updated the text, Woodward would repeat the phrase, firmly believing that the current year would finally see biometrics take off.

Woodward, who takes over Oct. 1 as director of the Defense Department's Biometrics Management Office, tells this story about himself to acknowledge that biometrics' payoff has yet to match its promise. Government interest in using biometric technologies to improve security rose dramatically following the Sept. 11, 2001, terrorist attacks, but many obstacles and problems have prevented the widespread deployment of biometrics that was originally envisioned.

Some technologies, such as facial recognition solutions, are still immature, and many photographic collections, such as police mug shots, have not been converted for use with new systems. Digital fingerprinting is much more mature, but agencies have not taken full advantage of this technology, because databases have been developed primarily for law enforcement, not authentication.

Using biometrics requires agencies to rethink security procedures and, in many cases, adapt their IT infrastructures to the new technologies. And proponents of biometrics are finding strong resistance to the new technologies from both citizens and government users.

Not surprisingly, the current market for biometrics technologies is not huge. Allied Business Intelligence Inc. of Oyster Bay, N.Y., last December estimated that the industry would generate only about $153 million in 2003. But the research firm forecast annual growth through 2007 at about 47 percent.

And while biometrics may be only a small part of the total government IT market, it plays a disproportionately important role in major infrastructure projects aimed at overhauling U.S. border controls, changing visa and passport systems and credentialing transportation industry workers.

Still, Carlton questions whether emerging biometric solutions can sustain a new industry and market, given the unmet expectations over the years.

"Now, I'm a lot more skeptical," he said. "Show me it's moved from the hands of the R&D people to the production people."

THE HOLLYWOOD CURSE

Biometrics is the science of identifying, recording and matching unique physical characteristics to individuals. There are five basic technologies: facial recognition, fingerprint, hand geometry, iris recognition and voice recognition. There also are many different vendors, and each has its own technological variations.

Biometrics offer the promise of improved security for both physical access and what the industry calls logical access, or entry into computer networks and applications.

"The space we're in fundamentally is not a shrink-wrapped space," said John Dorr, vice president of marketing for Viisage Technology Inc., a Littleton, Mass. company that provides facial recognition technology for identity verification. "We don't just build technology, ship it in a box and tell the customer to just add water and stir."

By combining a biometric such as an iris scan, to verify a person's identity with other security measures, such as an access card or a password, it becomes much more difficult for unauthorized people to gain entry to airport runways, for instance, or to break into computers. For state governments, it can make it much easier to identify people trying to set up multiple identities, whether their motive is fraud or terrorism.

Federal agencies have begun small-scale projects that incorporate biometrics for security purposes. The Office of Legislative Counsel in the House of Representatives uses an iris recognition system to protect confidential files and working documents, while the Pentagon's athletic club uses a facial recognition system to control access.

The General Accounting Office reported to Congress that the State Department has been running pilot programs using facial recognition systems at 23 overseas consular posts for several years. But agencies do not have any large-scale programs in place.

In many of the large applications the government is considering, such as the proposed U.S. Visitor and Immigration Status Indication Technology system to monitor the entry and exit of foreign nationals at the country's borders, biometrics is a key technology but only one part of a complete overhaul of the infrastructure and procedures for border control, Dorr said.

US Visit is valued at anywhere between $1.5 billion and $10 billion, depending on the scope and duration of the project. The Homeland Security Department is expected to release the request for proposal in November.

Another major biometrics initiative on the horizon is Homeland Security's Transportation Worker Identification Credential program. Under TWIC, the Transportation Security Administration is planning to create a smart card that incorporates a biometric feature and will be issued to as many as 15 million workers in the transportation industry nationwide from airports to seaports to railways.

Because many, if not most, of these workers are employed in the private sector, questions remain regarding who will bear the cost of implementing the new technology and how to enroll people, track their employment and then remove or change their records when they change jobs. Another problem to resolve is how to ensure the compatibility of the hardware and software that will be purchased by many different buyers.

"We're looking at biometrics as a secondary level of authentication and security," Brooks said. "We want to be able to have those capabilities, be able to turn it off and on when we go to levels of higher security."

But just as US Visit and TWIC are being readied for systems integrators, at least one biometrics technology has stumbled in public perception. High-visibility pilot projects, one in Tampa, Fla., the other at Boston Logan International Airport, were halted in large part because the facial recognition technology being tested did not accomplish what the project's designers had hoped.

At Logan, where 10 of the Sept. 11 terrorists boarded flights that were hijacked, facial recognition systems had a failure rate of 38.6 percent. According to press reports, the systems didn't detect volunteers playing potential terrorists.

In Tampa, the police department spent two years testing a facial recognition system. During that time, no arrests were made based on the system, and all the facial matches made were false positives -- that is, incorrect. Both programs received widespread media attention.

One industry expert cited the Tampa experiment as an example of the need for better integration of the component parts. That trial failed, he said, because the cameras didn't match the facial recognition technology.

Another problem is what many experts call "the Hollywood mystique." In television shows and movies, special effects make biometrics appear efficient and effortless, creating a perception that the technology is speedy, 100 percent accurate and comprehensive.

For instance, on the CBS show "CSI: Crime Scene Investigation," a crime lab receives the results of DNA test results in hours. The reality is more like weeks, experts said. Similarly on the show, fingerprints get matched automatically, seemingly within minutes, without human involvement. In reality, the FBI tries to honor law enforcement requests for fingerprint searches within two hours (24 hours for a civilian background check), and the results have to be evaluated by a trained technician.

"People think that ["CSI"] is a baseline for how forensic science works, and it's not like that," said Viisage's Dorr.

"The biometrics industry has suffered most from the hype over capabilities over the years, and Hollywood has made it worse," said Gordon Hannah, senior manager of the security access and identity management team at BearingPoint Inc. "We see those [unrealistic expectations] not just in this country, but around the world."

BIOMETRIC HURDLES

A key House panel on technology met earlier this month to examine why smart cards have not been widely adopted throughout the government, including the incorporation of biometrics for security and convenience.

"The University of Florida gave smart cards to 50,000 students 10 years ago that they could use as room keys, lab keys or to charge pizza and books at stores around town," said Rep. Adam Putnam, R-Fla., chairman of the House Government Reform subcommittee on technology, information policy, intergovernmental relations and the census, at the Sept. 9 hearing. "Why can't the federal government do what Florida universities have been doing for years?"

Several witnesses noted the widely differing priorities among all the federal agencies, which make it extremely difficult to set up a single departmentwide structure. An equally important though more subtle challenge is resistance among federal employees to using biometrics.

"Some people find biometric technologies difficult, if not impossible to use," said Keith Rhodes, GAO's chief technologist. "Others resist biometrics because they believe them to be intrusive, inherently offensive or just uncomfortable to use."

Ken Scheflen, director of the Defense Manpower Data Center, said security personnel have grown accustomed to using physical documents, things they can read, hold and compare to the person presenting them.

"We have to move people away from the idea that [visual] inspection of documents is sufficient," he said.

GAO officials also said agencies face a potentially high price tag for security systems using biometric technologies. In a November 2002 report on the prospective use of biometrics for border security, for instance, GAO estimated that implementing visas that incorporate biometrics would have an upfront cost of anywhere from $1.3 billion to $2.9 billion, with annual operating costs of from $700 million to $1.5 billion thereafter.

Lack of standardization also has hindered adoption of biometric technologies, experts said. The biometrics industry is highly fragmented, with hundreds of vendors. Competing vendors for biometrics systems, such as fingerprint technologies, use different algorithms to map points on the prints and set up unique databases to handle storage and retrieval. Federal agencies need technological standardization among competing suppliers so they can communicate and share information with other agencies.

The National Institute for Standards and Technology is working with other government agencies and industry to devise standards that will ensure interoperability. NIST already has released two drafts, the most recent one this summer. But agencies that purchased technology that met the first draft now are left wondering whether the new draft standard is backward-compatible with their equipment.

The Defense Department's Common Access Card program, which ultimately will issue smart cards to more than 4.4 million users, does not yet include a biometric identifier such as a fingerprint template, in part because the standards are not yet finalized, and because it would require more investment in issuer and reader equipment.

In his new Pentagon job, Woodward will direct the group charged with helping private industry and NIST establish standards to allow interoperability and integrate biometric technologies into the military's Common Access Card program.

Woodward said the NIST effort to devise industry standards complements his office's responsibility for trying to unify and standardize biometrics throughout the Pentagon. As part of that mission, the BMO will be one of the first organizations at the Pentagon to implement a new, streamlined acquisition process that is intended to stress interoperability and joint functionality between defense organizations.

WORTH THE TROUBLE

Despite the uncertainties facing the biometrics industry, the success stories demonstrate why the industry is full of true believers and evangelists.

Viisage, for instance, has installed its facial recognition technology in the Pinellas County, Fla., sheriff's office. When a suspect is brought in to be booked and photographed, the technology can screen to see if the person is using an assumed name and is actually someone else who's been in the system before.

"You can use facial recognition to identify that it's really not John Doe, it's Fred Smith, and he's got three outstanding warrants," Dorr said. "You're going to handle the situation completely differently."

Visitors to the Pinellas County jail also are screened and matched to the database. The facial recognition system has identified two or three visitors who had outstanding arrest warrants, Dorr said. As a result, there has been a 17 percent drop in visitors.

"When you've got bad guys in a building, everybody visiting isn't going to be goody two shoes," Dorr said. "This is kind of a deterrent."

Facial recognition technology also is being used extensively in state motor vehicle licensing systems to combat false issuance and duplication of licenses. The state of Illinois, for example, has collected 15 million images since 1999. Not that long ago, the system identified someone who had created 13 different identities.

"The facial recognition element is what enabled them to figure that out. That's solving a real problem," Dorr said.