Washington Post

Biometric Technology and Homeland Security

September 25, 2002
By David McGuire and Raj Nanavati

*Below is a transcript from an online discussion about the biometric industry between David McGuire of the Washington Post and Raj Nanavati, Partner of IBG.

David McGuire: We're joined today by Raj Nanavati, the co-founder of the International Biometric Group in New York, N.Y. Founded in 1996, Nanavati's company tests biometric devices for reliability and applicability in various settings.

David McGuire: Hello Raj, thanks for joining us. Can you tell us a little about the research your company performs and who your clients are?

Raj Nanavati: International Biometric Group is the industry's leading biometric consulting and integration firm. Our role is to help govermnet agencies and private sector corporations understand how to evaluate, design and deploy biometric solutions. Our clients include Citibank, Chase, World Bank, FAA, Dept of Energy, Ontario Govt, Lockheed Martin, Microsoft and Intel.

Chantilly, VA: How valuable will biometrics be in fighting bioterrorism under the new Department of Homeland Security? What type(s) of biometrics solutions are valuable to the Office of Homeland Security (soon to be Homeland Security Department)?

Raj Nanavati: Biometric will be an important part of the overall security process. The technology will play a key role in ensuring that people possess true and valid documents. The main biometric technologies will be iris, face and finger-scan.

Herndon, Va.: With the privacy requirements under the pending HIPAA regulations, to what extent will biometrics play a role in assuring that data privacy standards are met?

Raj Nanavati: HIPAA regulations call out biometrics as one of the technology measures that can be used to ensure that patient records are secure. Technologies such as finger-scan can be used to ensure that only authorized personnel have access to a given patient's information. It should be noted that biometrics play a small part in the overall HIPAA requirements.

Waco, Texas: In your opinion, are most biometric technologies on the market today ready for prime time?

Raj Nanavati: Many of the technologies are indeed ready for prime time. Biometrics are currently used in very large scale applications...the Philippines has enrolled 5 million people in their social security program; Nigeria, China, and many Latin American countries are rolling out nationwide identification systems. Mexico uses face technology for 60 million people to prevent election fraud.

David McGuire: Does your company involve itself at all with questions about privacy, or do you focus entirely on the technical issues surrounding biometrics deployment?

Raj Nanavati: IBG places a great emphasis on privacy issues. We have created a website that focuses on an objective privacy framework: www.bioprivacy.org.

Annandale, Virginia: To what extent are biometrics companies staking their business plans on the government taking the lead in biometrics use?

Raj Nanavati: A lot of biometric vendors have recognized that the US goverment will play major role in deploying large scale systems over the next few years. The Visa Enhancement Act, Patriot Act, and Aviation and Transportation Security Act all specifically call out for the use of biometrics.

David McGuire: Face recognition technology has been singled out by critics of biometric technology. What's your opinion on commercially available face scanners? Do they work? Are there settings where they represent the best available biometric product?

Raj Nanavati: Face technologies work well under carefully controlled circumstances. In challenging surveillance environments where lighting and image angles are not controlled the accuracy rates will be negatively impacted. There are some privacy concerns associated with the fact that face can be used without a user's consent. There are many applications where face is the best biometric.

Freedomville Junction, Pa.: What are your thoughts on the privacy v. security arguments of biometrics? Do biometrics companies have an obligation to try to balance the two, or is that an exercise best left to lawmakers and civil libertarians?

Raj Nanavati: Biometric companies should strive to develop systems that are secure AND safeguard our privacy. There are many steps a deployer can take to make sure that a system does not infringe on users' rights:
-3rd party auditing of system
-clear notice to users
-defined scope of use for the data
-users have access to review their data

Randallstown, Maryland: Which biometric technology will be utilized the most...iris/retina scans, face recognition, figureprint, etc.? Why?

Raj Nanavati: Currently finger-scan is the most popular biometric technology. There are no commercially available retina scan products. Face recognition is generating a lot more revenue this year. Note: for more detailed market numbers available to the public, please see our website at www.biometricgroup.com

Arlington, VA: Raj, what do you make of those that argue that biometrics is an invasion of privacy and stomps on people's civil liberties?

Raj Nanavati: I think it's important to understand privacy concerns and to build systems that protect users' rights. "Biometrics" are just a technology and aren't good or bad per se -- the real question is how the technology is deployed and maintained.

Fairfax, VA: Will this technology be used by governement organizations, such as the Department of Justice's Office for Domestic Preparedness in the near future, or is this something which will have to be phased in over many years?

Raj Nanavati: Many government agencies, both state and federal, currently use biometrics for forensic, diver's license, welfare, and other applications. We will see more agencies begin to adopt biometrics over the next few years.

Falls Church, Va.: Are you at all concerned that oppressive countries like China and Iraq might use biometric technology to further abuse their citizens? And should U.S. companies be prohibited from selling products to countries that are shown to be abusing biometric technology?

Raj Nanavati: Yes, this a concern with any technology. IBG as a company does not get involved in providing input as to whether US companies should do business in these countries. We strive to ensure that any systems we develop are not deployed in an oppressive manner.

Shaker Heights, Ohio: Hello - What kind of role should biometrics devices play as part of a national ID? Do you think biometrics should play any role at all in such a potentially invasive plan?

Raj Nanavati: Biometrics can help to ensure that the card holder is indeed the correct person. IF a national ID is instituted in the US, biometrics can make the system more secure. However, it doesn't look like there are an immediate plans for such a roll out.

Alexandria, Va.: Reuters reports today that Congress is unlikey to pass consumer privacy legislation this year. Given the privacy deadlock in Congress, what hopes do we have that your industry would actually work closely with privacy groups like the ACLU to craft real compromise protections for biometric devices?

Raj Nanavati: It's important to work with privacy groups and to solicit their input. We work with groups, such as the ACLU, to provide them information about biometrics and to discuss the best, most privacy-sympathetic ways for deploying the technology.

Provo, Utah: What is the outlook for internal chips that could be used for access, verification or other uses? We know about chips in our pets, and some people talk about putting chips in our kids so we know where they are. What about chips or even some other kind of device --- that resides in ourselves? Is it even under discussion?

Raj Nanavati: Interesting question...technically such chips are not a biometric as they don't identify one's physiology or behavioral characteristic. Such technology is indeed becoming common for pets, however it seems a ways off for more widespread human deployment.

Clifton, Virginia: the biometrics industry is composed of lots of relatively small startups, competing with some of Washington's biggest systems integrators for biometric contracts with the fed. govt. what chance do they have of actually landing such an opportunity?

Raj Nanavati: Many of the small start ups are technology corporations that produce the sensor devices or matching algorithms. For most large gov't projects, the large SI's will partner with such smaller technology firms.

David McGuire: Of the major biometric technologies -- face, fingerprint, iris and hand scanners -- do you have an opinion as to which one works the best? Or are different technologies needed in different settings? Can you give an example of where one technology may trump another based on setting?

Raj Nanavati: Each technology works differently in different settings. For example for telephony-based applications, voice works best; for surveillance, face works best; for network access, finger is probably the most convenient.

Montreal, Canada: what are the limitations of biometrics technology?

Raj Nanavati: The technology is not always 100% absolutely accurate. As with any technology, there is some degree of error. And there is a very small percentage of the population that may not be able to use a given biometric.

Cleveland, Ohio: Have you heard whether the U.S. Customs Service or other law enforcement involved in border control are interested in using biometrics devices as a way to cut down on illegal immigration, notably from Mexico
and Central America?

Raj Nanavati: The INS has been doing a lot of work with biometrics, most notably, finger-scan for many years. And they have built up a database with millions of images which can be used to identify people.

David McGuire: What about hand scanners? I was given to understand that they were among the most widely used biometric products? What makes them so popular?

Raj Nanavati: Hand geometry is indeed one of the most widely deployed. The technology has been around since the '70's and it is very easy to deploy; a card swipe can be easily replaced with a hand-scan unit.

Arlington, VA: We here a lot about iris-scanning devices and fancy fingerprint readers. Can you talk about some of the more cutting-edge biometrics technologies that might not be in the mainstream yet? Thanks.

Raj Nanavati: The main biometrics are iris, voice, face, finger, hand, and signature. There are also commercially available keystroke verification systems. Other than that, other types of biometrics, such as gait movement, are relegated to academia.

Vancouver, Canada: Why don't the bank, credit card company, visa offices include some form of the biometric ID in their data bases and check against it every time to see if user is the same person they say they are? Is the cost of this an issue?

Raj Nanavati: Financial services provides and government agencies are currently looking at biometrics for such applications. In fact the Visa Enhancement Act requires that by the end of 2004, every person coming into the US be identified using a biometric.

David McGuire: Could you tell us a little more about how biometrics are used in conjunction with the social security program in the Philippines?

Raj Nanavati: It is a card-based benefits system that includes employment records, employment insurance and other types of information.

David McGuire: What do these devices actually do? How do they "read" body parts and compare them to stored information? Are there some common scientific underpinnings to the different technologies or do they all follow different approaches?

Raj Nanavati: Biometric devices capture a sample (ex: voice sample, image of fingerprint) and then extract certain data points from the sample to create a template. They can "read" body parts by using simple camera based technology. In essence, most finger-scan devices just take a picture of the fingerprint. Some devices utilize electical capacitance or ultrasound technology to generate an image.

Washington, DC: I'd like to invest in biometric technology companies. Is there an index of biometric companies akin to the Philadelphia Semiconductor Index or any mutual funds that are dedicated to the field?

Raj Nanavati: Most biometric companies are not publicly traded. And for many large corporations that have biometric products (e.g., Siemens, Fujitsu, Sony, NEC), biometrics make up a small portion of their revenue stream. Therefore there is not a technology index for this industry.

David McGuire: It seems like including a biometric identifier in a bankcard could cause problems. What if I needed money, but the iris scanner on the ATM failed to recognize me? Are these applicability questions on the minds of financial institutions?

Raj Nanavati: With any technology, there should be a back up process in case the primary system does not work. ATMs have phones for users to call customer service if the machine is not working properly. Banks are very concerned about making sure the the banking process is not disrupted by biometrics or any new technology.

Chantilly, VA: For many years, the media and the biometrics industry has been touting this technology as 'the next big thing' but so far, none of the predictions have come true. Many companies have entered the biometrics market with great fanfare, then exited the market place with their tails between their legs (assuming they even have a tail left). In your opinion, what has changed or what still needs to change in order for biometric technologies to start delivering on its promise as a viable business?

Raj Nanavati: Biometric technologies have continued to improve in accuracy and stability over the past few years. Over the next 18 months as more projects begin to roll out on larger scales, vendors will need to ensure that the technology works effectively. Bioemtric vendors can do this by:
-addressing privacy issues head-on
-level setting clients with realistic performance expectations
-improving the QA process to make sure that devices are more stable

Tokyo, Japan: The FRVT biometric test results are scheduled to be announced in November this year. What do you think the effect of being rated the top Facial Recognition software will hold for the lucky company rated #1?

Raj Nanavati: The FVRT tests a number of factors, so I'm not sure if one company will be rated as the clear winner. Objective testing like what NIST/DoD and IBG do are very valuable criterian in assessing which biometric product to use.

DC: Are there any issues surrounding standards in this field? With all the money spent by governments on incompatible technology, I'd think there is a need...

Raj Nanavati: There are a lot of complex issue surrounding standards -- there are standards relating to application interfaces, file formats, system processes, and standards specific to particular technologies (finger-scan imaging, voice, etc.). BioAPI is the leading application standard and the M1 committee is addressing several standard issues. The Biometric Consortium and NIST are effective resources in this area.

Memphis, Tennessee: Do you believe that biometrics will in the forseeable future be incorporated into ATM and PC and/or internet security features at an affordable price point?

Raj Nanavati: Some companies have already incorporated biometrics such as finger, face and iris into ATMs -- Bank United and Purdue Credit Union in the US have used iris and finger, respectively. Overall banks need to ascertain what the business case is for using biometrics at an ATM; ATM fraud is not a critical issue, when compared to check or credit card fraud.

David McGuire: Could you explain FVRT for our readers?

Raj Nanavati: This summer, in cooperation with other government agencies, NIST conducted its Face Recognition Vendor Testing (FRVT).

FRVT 2002's stated objective is to "provide independent government evaluations of commercially available and mature prototype face recognition systems."

NIST conducted its first Face Recognition Vendor Test back in 2000. That testing was co-sponsored by the Department of Defense Counterdrug Technology Development Program Office and other federal agencies.

Separate from FVRT, IBG has conducted extensive benchmarking of face technology in real world operational environmnets. Our testing is sponsored by Microsoft, American Airlines, FSTC, Wells Fargo and Star Systems.

David McGuire: Since 1996, when you started looking at this industry, how much has the field evolved? Where are biometrics now as compared with seven years ago? Where do you think they'll be in the next seven years?

Raj Nanavati: The technology has improved quite dramatically in terms of both accuracy and ease of use. The systems are also easier to integrate. Costs have come down substantially; finger devices are less than $100 and even an iris system is only about $200.

Also there are many more programs around the world that are using the technology. Spain has rolled out a national health care card system based on finger-scan. Even companies like McDonald's have used biometrics.

David McGuire: What resources are available for people who want to learn more about biometrics?

Raj Nanavati: If anyone has any additional questions or is considering using biometrics, they should give us a call at 888-IBG-8-IBG or email us at contact@biometricgroup.com.

Further, our website (www.biometricgroup.com) contains a wealth of information about biometrics.

David McGuire: It looks like our time is up. I'd like once again to thank Raj Nanavati for his time and I'd like to thank our audience for all the thoughtful questions we've received today.