Australian IT

Immature biometric ID systems flawed

March 03, 2003
By Karen Dearne

BIOMETRICS have been propelled into IT's heavyweight division, as governments worldwide seek to tighten border security in the wake of September 11.

But flaws and limitations underline the industry's immaturity, while there are growing public concerns about surveillance, privacy and the creation of vast databases containing personal information.

Nevertheless, the United States is demanding that all visitors have some form of biometric identifier attached to their travel documents, setting a deadline as soon as October next year.

"Right now, one of the basic challenges for the industry is how to utilise biometrics for visas and passports," says Raj Nanavati, partner at US research and consultancy firm International Biometric Group (IBG).

"In Australia, the folks at DFAT (Department of Foreign Affairs) are doing projects, Customs is doing some projects and that process is going on globally -- every country is looking at this."

One difficulty is that the US is yet to specify which biometric system it intends implementing.

"It isn't yet well established whether face, fingerprint or iris recognition is the leading technology," Nanavati says.

"The standards group, International Civil Aviation Organisation (ICAO), has rated facial recognition highest, but this was before 9-11 and there are some questions as to whether face technology is as accurate as fingerprint and iris.

"The US does have a lot of influence, and its decision will influence what happens elsewhere."

IBG has just completed a study for the White House on the use of biometrics in the US visa issuance and border entry/exit system and found that fingerprint was the most accurate and reliable technology, with iris second.

But, for technical reasons and to engage greatest cooperation from other countries, it recommends the US deploy all three technologies in a complementary fashion.

"Countries like Australia and Japan, for example are less likely to use fingerprinting," he says.

"Here in the US, if you're a teacher or a school bus driver you have to be fingerprinted to get a job.

"In Australia, you only get fingerprinted if you are a criminal, so there are a lot of cultural issues to be addressed."

Local authorities seem keen to avoid a political stoush over fingerprint technologies, and are instead focusing on face systems.

"I suspect Australians would not be thrilled about giving their fingerprints," says Christine Gallus, parliamentary secretary to the Minister for Foreign Affairs.

The MP is working on plans to incorporate a chip containing facial biometric data in Australian passports, both to improve local border security and to meet US requirements.

Australia has been very involved in the global development of biometrics, and currently heads the ICAO new technologies working group sub-committee on standards.

Gallus sees facial biometrics not as an invasion of privacy, but simply an advance on the photo ID check.

"I mean, someone arrives with a passport, the guy looks at the photo, looks at the person and says yes, pass through," she says.

"We're just making that identification more accurate."

Putting a chip in the passport would also obviate the need to provide matching biometric data to foreign authorities.

"There has been criticism of this technology, but it is considered the least intrusive option," Gallus says.

"Clearly, with passports it is easier to achieve accuracy because the person presents the document to a reader and then stands there while the data on the chip is compared with the person's image caught on camera. If there is a problem, a real person will take over."

Australian Customs is among the first globally to test an automatic passport photo matching system.

Since November, SmartGate has been used by Qantas crew at Sydney airport, and it is planned to eventually extend it to all travellers.

Based on Cognitec's access control technology used in Germany for high-security environments, including banks, pharmaceutical companies and a nuclear power plant, the local system has been developed and implemented by Biometix.

"Look, the system is not foolproof," Gallus says. "It will improve identification of people entering the country and limit the ability of criminals to obtain false passports, but it's not the solution to all the world's problems as some people think."

But the question of whether the US would accept biometric data on a chip is yet to be considered.

IBG director of special projects Michael Thieme says centralised databases are key to border control, as every individual needs to be matched against every other individual.

He believes regional databases that allow US authorities to "share" identification information with visa-waiver countries, including Australia, will be necessary.

"You could imagine a stovepipe approach where Australians' data can be checked but it's never really in the possession of the US," Thieme says.

"If Australia also passed laws regarding biometric passport entry, the US would similarly need to share its data."

Gallus says that if the data is held on the passport, there will be no need to match it against databases, shared or otherwise. But she concedes it's possible for US authorities to scan or capture the data themselves for their own purposes.

Meanwhile, biometric trials at both Sydney and Melbourne airports experienced turbulence last week.

Customs Minister Chris Ellison admitted SmartGate had been fooled by two Japanese visitors who swapped passports during a demonstration for IATA's Simplifying Passenger Travel delegation.

And Qantas had to abandon plans to trial a biometric time and attendance system for baggage handlers, when the Transport Workers' Union opposed the introduction of fingerprint scanning machines.

After a hearing at the Australian Industrial Relations Commission, Qantas agreed to instead implement an electronic swipe-card system to log workers' start and finish times.