Biometric Technology Today

20 August 2008

IPS invites bids for next-gen biometric passports

The UK’s Identity and Passport Service has invited companies to express an interest in bidding for a contract to design and provide second-generation biometric passports. This contract will replace the services currently provided by 3M SP&SL, once that contract expires on 4 October 2010.

The estimated value of the new contract has been published in the OJEU Notice as £700m, although IPS stresses that this is only an indicative value. IPS told Btt that, at this stage, the term of the contract should not exceed 10 years, although the exact contract length will be set during the procurement process to ensure there is a balance between the level of investment required, the need for good relationships to be fostered, and the need for IPS to remain flexible and responsive to the way the market changes over time.

No suppliers have already been selected for the new passport contract – all interested parties will be evaluated against the same criteria in a fair, open and transparent way. The new contract will be awarded by autumn 2009, according to IPS. Some critics have asked why there is a need for a new ePassport. IPS commented: “The contract for the existing supplier expires in 2010 so a new contract has to be let. As part of the new contract the new supplier will have to deliver a new second biometric passport. The key business driver for the new passport is to ensure that the security of the UK passport is continually improved to ensure the risk of compromise through fraudulent activity is kept at a minimum.”

The UK is not bound by the terms of the EU regulation as it is not a member of the Schengen group of EU countries, but ministers have made it clear that the British passport must meet the highest international standards. This is to avoid it becoming a weak link and therefore a target for forgers and fraudsters, and to facilitate holders of British biometric passports being able to benefit from automatic border control processes.

The new passport will have a second biometric-ready enhanced, extended access control (EAC) chip, with the biodata page moved from the back (current location) to the front of the book. The passport will also look different as IPS will be introducing a new design. The OJEU notice makes it clear that IPS expects contractors to propose new and improved security features to ensure the integrity of the passport remains intact.

The new contract will be effective from 5 October 2010, and IPS says it will work with the new supplier to develop a low-risk strategy to ensure the effective delivery of the new passport. The fees and charges to be levied, within the National Identity Scheme (NIS), and in the context of the projected financial position of the entire Agency, are still being finalised. IPS insists, however, that the procurement process will deliver value for money.

Currently there are around 48 million passport holders in the UK, which represents 80% per cent of the eligible population. The new supplier will be expected to produce up to approximately 6 million passports every year.

04 June 2008

UK plans automated facial recognition trials at the border

The new UK Border Agency (UKBA) has announced it is to hold trials this summer using automated border gates equipped with facial recognition technology – very similar to those in use at airports across Portugal, where a comparison is made between the image in the ePassport chip and the live image.

There are currently 120 million passengers arriving from outside of the UK each year, 85- 90% of who are EEA nationals (all EU states as well as Iceland, Liechtenstein and Norway). UKBA’s plan is to allow EEA passengers to use the technology, helping to speed them through in an average of 20 seconds. UKBA is not ruling out using the technology on visa holders, however, or indeed non-visa holders in the future. (From 2007, all visa applicants have had their biometrics recorded and checked. By 2011, the UK intends to record the biometrics of all non-EEA, non-Visa travellers before they enter the UK – similar to the US-VISIT scheme in the USA.)

Speaking at the Security Document World and Identity Loop 2008 conference and exhibition in London last month, Gary Murphy, head of operational design for border control at UKBA commented that the UK had needed to decide on whether to trial first generation ePassports using facial recognition or wait until there were enough second generation ePassports in circulation using fingerprints. Murphy noted that using face would allow a trial to begin this summer, at which point an estimated 13% of EEA passengers would have the appropriate ePassport document. For fingerprint they would have to wait until 2012 to achieve a similar roll out rate. “We are therefore planning a trial of facial recognition at gates to see if they can deliver what we require,” Murphy explained.

There are a number of key issues said Murphy, including security, reliability of the technology, public reaction and an assessment of the cost/benefits.

Murphy commented that an internal analysis suggested that a machine might be able to do a better job at comparing faces than border agents – even if the technology was facial recognition, which is not seen as robust as other biometrics such as fingerprint or iris.

A key question was whether the removal of the border guard would remove the element of intuition, perhaps catching out a suspect passenger based on their behaviour. Murphy said that this factor would not be lost completely as there would be a supervisor in attendance and UKBA is thinking of introducing wider control zones, within which technologies such as behavioural analysis could be used.

Turning to the biometric technology itself, Murphy said there was the risk of a greater false accept and false reject rate. However, he contended that the chosen manufacturer of the system for the trial had demonstrated to UKBA a very low error rate. “The only way we are going to find out the answer to this is to test it ourselves in a live environment, and use security testers to try and override the system.”

From a public reaction perspective the main question is whether the public will use it. Another issue is how the public will handle rejection by the system – and indeed how UKBA will handle passengers rejected by the system.

Also speaking at the Identity Loop show was the Portuguese Government and the supplier of its facial recognition system, Vision-Box. In Portugal almost 500 000 people are expected to use the ePassport facial recognition gates this year, and according to Francisco Batista, IT Director at SEF (Portuguese Immigration and Border Control): “We’ve been very pleased with the results.” Vision-Box had been set a target of achieving a false reject rate of less than 7% at a false reject rate of less than 1%. In fact, according to Batista the system is operating at an FRR of less than 2% and an FAR of 0% so far. Meanwhile each border crossing is taking an average of 20 seconds.

15 April 2008

Sir James Crosby offers advice to UK's identity card scheme

The long-awaited publication of Sir James Crosby report into the establishment of a universal identity assurance system has come up with a list of 10 recommendations, many of which fly in the face of the current ID card proposals being tabled by the UK Government. In particular Crosby recommends that any ID card should be provided for free, it should be operated independently of government and full biometric images should not be kept.

The report was originally commissioned in July 2006 by the UK’s Chancellor to consider how the public and private sectors might work together in identity (ID) management for their mutual benefit and that of citizens and consumers. Crosby strongly believes that to realise the greatest economic and social benefits every aspect of an ID card scheme should be designed from the consumer’s perspective. Bearing this in mind, he criticised the UK’s ID card plans as published in the Government’s Strategic Action Plan (2006).

He said: “I have no remit to comment on the desirability or otherwise of this plan. However, in my opinion, the Strategic Action Plan (2006) will not be the catalyst for the emergence of the consumer-driven universal ID assurance system envisaged by this report.”

Crosby argues that the design of any ID card scheme would need to be based on ten broad principles:

The purpose of any scheme should be restricted to that of enabling citizens to assert their identity with ease and confidence. The scheme should set targets for the quality of assurance achieved at enrolment and verification, which should generally exceed those achieved elsewhere, and it should regularly report its performance against those targets.

The scheme’s governance should be designed to inspire the highest level of trust among citizens. It should be operated independently of Government (say, accountable directly to Parliament) and in principle its processes and security arrangements should be subject to the approval of the Information Commissioner, who should have the power periodically to review delivery.

As a matter of principle, the amount of data stored should be minimised. Full biometric images (other than photographs) should not be kept. Only non-unique digital representations of biometric images should be stored. Additional data accessed during enrolment and records of verification enquiries should not be retained. All data and systems should be protected by “state of the art” encryption technology.

Citizens should “own” their entry on any register in the sense that it should not be possible, other than for the purposes of national security, for any such data (to include digital representations of biometrics) to leave the register without their informed consent. Verification of identity should be performed without the release of data.

Enrolment processes should be different for individuals with different circumstances, and change over time so as to minimise costs and give citizens the simplest and most hassle-free experience consistent with the achievement of the published assurance targets.

In order to respond to consumer demand and achieve early realisation of economic and social benefits, the scheme should be capable of being rolled out at pace.

Citizens who lose cards or whose identity is compromised should be able to rely on their cards being replaced or their identity being repaired quickly and efficiently and in accordance with published service standards.

Technically the scheme’s systems should be closely aligned to those of the banks (both initially and in the future) so as to utilise their investment, de-risk the scheme’s development, and assist convergence to common standards across the ID assurance systems and processes deployed internationally by banks and other national ID card schemes.

To engage consumers’ hearts and minds on the scale required, enrolment and any tokens should be provided free of charge.

The market should play a role in delivering a universal ID assurance scheme. This will improve the ease with which consumers can use the scheme and minimise costs.

Crosby commented that the Government may not regard its ID cards scheme as the best way to stimulate the creation of the universal ID assurance system as envisaged in his report. However, even if this is the case, Crosby strongly recommended:

• Working with the private sector, Government should take all necessary action to ensure that, as soon as possible, consumers have access to a “one stop” agency for the swift repair of compromised identities across the public and private sectors; and

• Government should commit to the development work across public sector databases necessary to ensure that all employers can quickly and confidently satisfy “right to work” and related regulations for all their employees.

To conclude Crosby said: “In the absence of a universal ID assurance system, I believe consumers will have to grapple with an increasingly complex array of identity assurance processes of uncertain quality. As a result, the UK will fail to secure the economic and social advantage achievable at the forefront of ID assurance systems and processes. In a competitive world, any failure to secure advantage quickly becomes tantamount to locking in disadvantage. In other words, the opportunities inherent in ID assurance will not have been grasped but the challenges will remain.”

20 March 2008

Biometric standard announced for e-transactions

A new standard to increase the security of financial transactions over electronic media has been published by ISO. The new standard, ISO 19092:2008, Financial services – Biometrics – Security framework, establishes the security requirements for the implementation and management of biometric identification technology within the financial industry.

According to ISO 19092:2008 the sheer volume and value of daily payments and other financial systems through telephone, wire services and other electronic communication mechanisms exposes the financial community and its customers to severe risks from accidental or deliberate alteration, substitution or destruction of data. With biometrics being considered increasingly as a reliable means of identification ISO 19092:2008 describes the security framework for using biometrics for authentication of individuals in financial services. It introduces the types of biometric technologies and addresses issues concerning their application.

The standard presents the architectures for implementation, specifies the minimum security requirements for effective management, and provides control objectives and recommendations. It promotes the integration of biometrics into the financial industry and the management of biometric information as part of the overall information security management programme of the organization.

25 January 2008

Lockheed and Cognitec to Cooperate

Lockheed Martin and Cognitec have announced that they have signed a cooperation agreement. A major systems integrator, Lockheed Martin is focusing its efforts in the biometrics industry on integrating a range of biometrics technologies allowing customers to incorporate multiple biometrics techniques – including fingerprint, facial and iris scanning – into their operations.

This deal comes hot on the heels of another co-operation agreement (announced in last month's BTT) which saw the integrator team up with iris recognition company IriTech.

In May 2007, Lockheed opened its Biometric Experimentation and Advanced Concepts (BEACON) facility in White Hall to serve as a collaborative centre to develop integrated biometrics solutions. Through this agreement the company, which reported sales of US$39.6 billion in 2006, hopes to further advance its capabilities and offerings in biometrics solutions.

According to Bob Eastman, Lockheed Martin Vice President, Information Systems, “Biometrics is an increasingly important technology area for our customers in intelligence, defense, law enforcement and homeland security. This cooperation agreement will improve our ability to offer our customers a complete and fully-integrated portfolio of biometrics technologies. We're also committed to helping small, innovative businesses such as Cognitec continue to advance the state-of-the-art in biometrics technology in an open and collaborative marketplace.”

Cognitec Systems is the developer of FaceVACS. The facial recognition technology has been in development since 1995 and has been tested and proven in a number of independent evaluations, including the Face Recognition Vendor Tests in 2002 and 2006.

Alfredo Herrera, Cognitec Systems CEO, noted: “We are excited about this cooperation with Lockheed Martin, which reinforces our commitment to provide leading-edge facial recognition technology to our customers. We look forward to working with Lockheed Martin to integrate and deploy our technology in a variety of important biometrics projects.”

Contact: Matt Kramer at Lockheed Martin, Tel: +1 703 293 4333; Email: matthew.s.kramer@lmco.com

01 December 2007

A new identity – are you ready for biometrics?

Travel documentation is probably the largest civilian use of biometrics. Yet although biometric data is already used in border control – notably on entry to the USA – it remains a relatively nascent technology. Most European countries are still at a relatively early stage of deployment.

An early pace setter is Norway. In anticipation of the need to capture biometrics for all forms of identity documents, the country’s Ministry of Foreign Affairs (UD) and the National Police Computing and Material Service (PDMT) recently launched a ‘multi-mode’ biometric enrolment system. Approximately 18 000 passport applications and 130 000 visa applications were made at Norway’s embassies in 2006 and a 20% annual increase is expected in visa applications. The total number of passport applications made in Norway itself during 2006 was around 550000, the vast majority of which are applied for at police stations. The country is also planning for national ID cards to be issued at the same locations as passports and visas.

Integrated system
The logical aim was to create an integrated system for multiple public agencies that could be deployed both in passport offices at police stations throughout the country and at overseas embassies to enrol biometric data (2D facial images, fingerprints and signature) quickly, efficiently, and accurately. Needed by June 2009 to satisfy Schengen requirements on storing fingerprint data in e-passports, Norway is one of the first countries in Europe to start production of travel documents (passports and visa) using biometric data via integrated national systems. To meet these challenges, the Biometric Enrolment (Bio-Enrol) Kiosk from Motorola was selected following a thorough evaluation of prototypes. It takes the form of a compact rugged kiosk comprising a control computer, colour display, fingerprint scanner, camera and digital signature pad. There are currently three national administration systems interfacing with the Bio-Enrol solution, to support two different workflows:

• standard passport – 2D facial image, two fingerprints (left & right index fingers) and applicant signature
• standard visa – 2D facial image, 10 fingerprints

Meeting the standards
The complete solution meets International Civilian Aviation Organisation (ICAO) standards for machine-readable travel documents and data interchange, as well as International Standards Organisation (ISO) specifications for the storage, secure encryption and interoperability of biometric information. Some additional key factors had to be considered for Norway’s foreign embassies:

• ease of installation with a minimum of effort from the local ICT staff
• the kiosk’s design had to ensure operational security and functionality
• the applicant screens had to be self explanatory (i.e. no text) to overcome the problem of having to cope with too many languages

Two-to-three hundred Bio-Enrol Kiosks are to be deployed in time for the 2009 deadline. Of the 21 Motorola Bio Enrol solutions installed so far, 11 are located in Norway and the remaining 10 are at Norwegian embassies in Cairo, Kiev, London, Nairobi, and Stockholm. There will also be a number of portable systems for use in locations with a low volume of applications. As part of this initial deployment, applicants’ fingerprints are being captured. However they are not currently stored as this would require a change to the country’s legislation.

BIODEV II
The Bio-Enrol software solution has also been delivered in line with the total Identity Management solution to the five EU Member States (Austria, Luxembourg, Portugal, Spain and the UK) to support the BIODEV II project, which is a pilot to help trial European Visa policy which will integrate the use of biometrics by 2009. The project is partially funded through the Argo Programme of the European Commission and managed by CIVIPOL, France. In BIODEV II, the complete visa workflow is piloted and includes:

• capture of biometrics (2D face, 10 fingerprints) of the visa applicant in a consular post
• forward the captured data to be stored and searched (1:N) in a central AFIS
• verify the biometrics of the visa carrier at the border

The UK recently went live based on the complete biometric visa application process in Sierra Leone, with participants arriving at Gatwick North Terminal. Luxembourg is capturing biometrics from visa applicants at its embassy in London, and verifying the biometrics at Luxembourg Airport. Meanwhile, Austria is trialling the project from Albania in conjunction with Vienna Airport, and Spain is collecting biometrics of visa applicants in Tetuan (Morocco) with Madrid Airport. And Portugal has started with Dakar (Senegal) linked to Lisbon Airport.

Line of defence
Fingerprint visas are fast becoming the first line of defence against illegal immigration. By establishing people’s identities beyond any doubt before they enter a country, multiple applications and identity fraud can be stamped out. Biometric technology is transforming the way countries protect their borders. The BIODEV trial project is creating a triple ring of security: identifying individuals before they travel to the UK through a biometric visa, then checking it at the border, and finally, from 2008, rolling out ID cards for foreign nationals in the UK.Government officials will use the data from BIODEV II to help:

• develop the technology approach for the visa process
• determine standard operating procedures for integrating biometrics into the visa process
• evaluate policies/legislation necessary to make biometrics an official part of the visa system

A biometric visa system helps ensure the validity of visas, and the identity of those who carry them. Improved identity assurance around visas is anticipated to help streamline the cost of processing visa applications, primarily by reducing fraudulent applications.

This feature was provided by Gillian Ormiston, senior solutions consultant, Biometric Identity Management and Security Solutions, Motorola.

Link
Web: www.motorola.eu/biometrics

01 October 2007

Daugman, NIST and the saga of the brown paper bag

There was clearly something afoot when one of the world's most esteemed biometric scientists brought out and then threatened to put a paper bag on his head in front of hundreds of government and industry participants at a recent show in the USA.

John Daugman, professor at Cambridge University and the inventor of iris recognition – as well as chief scientist for iris recognition at L-1 Identity Solutions – resorted to such graphic measures when expressing his frustration at what he describes as “mischievous” reporting by researchers in the highly-respected US government organisation, NIST.

Daugman's frustration is aimed, in particular, at two recent reports published by NIST, namely FRVT 2006 and ICE 2006 Large Scale Results and Meta-Analysis of Third Party Evaluations of Iris Recognition.

In the first of these reports, which was published in March 2007, NIST reveals the results of its latest face and iris trials and amid many interesting conclusions it also reports that the performance of iris recognition, still face recognition and 3D face recognition are comparable, given the various constraints of the tests.

In the second paper, which was published in August 2007, the author, Elaine Newton, questions the reputation of iris recognition as being “highly accurate” due to the lack of independent testing. She analyses the results of three major tests of iris recognition, namely NIST's ICE 2006, the Independent Testing of Iris Recognition Technology (ITIRT) study conducted by the International Biometric Group (IBG) and the Iris RecognItion Study 2006 (IRIS06) conducted by Authenti-Corp.

Similar to the first NIST paper, Newton compared the three studies at a False Match Rate of 0.001 and reported the False Non Match Rate (FNMR) for the best performers in each test to range from 0.0122 to 0.0175.

Daugman's arguments
Daugman's conference presentation was given at the recent Biometric Consortium event in Baltimore. In his presentation he quoted one ‘unnamed’ US Government sponsor of the NIST 2006 FRVT and ICE tests, as having said that: “The deck was stacked against iris.”

Most controversial to Daugman is that the NIST report focuses on a part of the ROC curve which does not, in his view, display the true power of the technology – namely its ability to operate on very large databases in identification mode.

According to Daugman: “Recent NIST reports dispute the iris reputation for accuracy by selecting a point on the ROC curve where FMR = 0.001. Since hi-resolution face recognition based on skin texture can also reach this, NIST concludes they are ‘comparable’.”

Daugman continues: “The slope of log ROC curves for these algorithms is about 2:10 000 (the FnMR only doubles while FMR is reduced by a factor of 10 000 when the HD threshold changes from about 0.37 to about 0.32). So, while citing a FnMR of about 1%−2%, testers could equally well cite a FMR of: 1 in a million, or 1 in 100 000, or 1 in 10 000, or 1 in 1000.”

In other words, according to Daugman: “FnMR is hardly a function of FMR over this range. FnMR is mainly determined by the number of rubbish images included; not the threshold used.”

In his presentation Daugman showed a selection of the worst quality images used in NIST's tests (although not the exact images, as these have been kept confidential by NIST). Although these poor quality images are not representative of the entire ICE dataset, some were impossible to match, such as those where printed patterned contact lenses were used.

According to Daugman, comparing facial and iris recognition fairly would mean that the testers should have used some facial images where the candidate had placed a paper bag over their head.

In direct response to Daugman, Dr Jonathon Phillips, the ICE programme manager at NIST, said that iris image quality is a crucial part of testing. He points out that bad biometric samples happen and that technology evaluations must not ignore bad samples, although scenario evaluations may filter for quality. Interestingly, Phillips also challenged the notion that iris ROC curves are indeed “virtually flat”.

In Newton's paper which did not compare different biometric modalities, but only the results of three iris trials, she defends her decision to use the FMR of 1 in a 1000. This is because of the low number of samples in each of the three studies (ranging from 240 subjects in ICE to 1224 subjects in ITIRT). Going much beyond 1 in a thousand, could be statistically irresponsible Newton told Btt. That said Newton does provide a table in her paper (Table V) that compares the results of the various trials at a FMR of one in ten thousand. At this point the False Non Match Rate (FNMR) for the best performers in each test falls from (0.0122 to 0.0175) to (0.0141 to 0.02).