it.gen.nz

Writings on technology and society from Wellington, New Zealand

Thursday, April 10, 2008

Biometrics

Today on Radio New Zealand National I talked about the technology of biometrics – that’s teaching computers to recognise people by aspects of our bodies such as face geometry. This all seems a little spooky until you realise that fingerprinting has been doing this for years.

There are a lot of different ways that biometrics can be made to work, and I talk about some of them on air. Well-implemented biometrics can be beneficial, but there are some real risks as well. Read on for my notes and links, or pull the podcast.

Q: Now to biometrics. What does it mean?

A: Sounds like it should mean “measuring life”, doesn’t it? In practice it means how we recognize people, and especially how computers recognize people.

Q: You mean with passwords?

A: Not really. Biometrics is more about measuring some aspect of your body and using that. Let’s just talk about the general problem of identifying someone for a while. We humans do it with some rather nifty dedicated hardware in our brains. At a very early age, babies start staring into people’s faces. They are learning how to use their brains to recognize people – matching faces is something that it built right into us and we don’t really know how it works, we just do it.

Incidentally that sometimes lets us down – and I’m thinking about identical twins here. How many of us have felt foolish after greeting someone to discover that the person we thought we were talking to has an identical twin and we are actually talking to the other one? The assumption that identity is the face is deeply built in to us.

Then came fingerprints. The New Zealand Police have been using fingerprints over a century. They are a very reliable way of placing someone at a crime scene. But it was very labour intensive – you know, the problem is to search for a print through a database of hundreds of thousands. That took a huge amount of time of some very highly trained people. That searching is automated now of course – which was not a trivial problem for computer programmers to solve by the way. So, a correctly programmed computer can, with a good degree of probability, tell you whether two fingerprints are from the same finger. Incidentally, identical twins don’t have the same fingerprints so fingerprints are more reliable than faces.

Q: Is that how the fingerprint scanners at overseas airports work?

A: Yes. The US routinely fingerprints all aliens – that’s you and me – at the border, even I think if you are just in transit. I understand that Japan is starting to do that as well.

Q: Aren’t there privacy concerns here?

A: Well yes, there absolutely are. We have the Privacy Act in this country which is pretty tight about what someone could do with your fingerprints. But we have no idea what data is being held about us by foreign countries and no way of finding out. Increasingly, it seems, being treated like a criminal is becoming part of the price we pay for overseas travel – to some countries, at least. As a side note, Heathrow’s spectacularly unsuccessful Terminal 5 was also supposed to have fingerprinting of domestic passengers – you were to be fingerprinted at check in and again at the gate, but the UK equivalent of the privacy commissioner put his foot down hard about it and it never happened. Mind you, since they seem to be incapable of even making simple things like toilets and lifts work, who knows what would have happened I they’d turned the fingerprint scanners on!

Anyway, computer matching of fingerprints can be used for other things as well. Some laptops have a fingerprint scanner built in – you use it to sign on.

Q: So you don’t need a password!

A: You can probably set it that way, or you could require both so someone else couldn’t get into your laptop even if they have your password. When you are trying to authenticate someone for access, someone who is cooperating I mean, there are three kinds of thing that you can get a computer to check – something they know, something they have, and something they are. Something they know might be a password or a PIN number. Something they have might be a plastic card, or it might be another gadget or their mobile phone. So, ATMs and EFTPOS work by checking the something we have – our EFTPOS card – and something we know, our PIN. That’s what computer security people call two-factor authentication.

Q: We’ve talked about this before when we’ve discussed Internet banking.

A: Exactly so. And you will recall me saying that you need your Internet banking account to have two-factor authentication, unless your bank is prepared to give an unconditional guarantee of safety of your funds. Just knowing the password is not enough, there has to be some other safeguard like a text message to your mobile phone or a reference to some numbers on another card or machine.

But that’s something you know and something you have. Biometrics is about something you are. Finding your fingerprints gives a high probability of it being you. But fingerprints have their problems – they don’t work on everyone, especially on people who do manual labour for a living, and they don’t work so well on women either.

Q: Why not on women?

A: I don’t know. It could be an actual gender difference – although I’m struggling to understand why that might be the case – or it might be that since most criminals are men, sadly, all the effort has been put into understanding men’s prints.

Q: What are the alternatives to fingerprints?

A: There are lots of other unique aspects to our bodies that can be measured. Fingerprints have traditionally been used because they are understood, and they are understood because of their use in criminal work. Ultimately that’s because we leave them around us involuntarily wherever we go. Other things that we can measure are not on the whole things that can checked without our knowledge or cooperation.

Q: Like our faces?

A: Face recognition is the prime example. Increasingly, computers are being taught to recognize faces. It’s not as accurate as fingerprinting yet – I’m not sure that it ever could be – think about the identical twins I mentioned earlier. There’s a real-life application of that coming to an airport near you, as well.

Q: How so?

A: There’s a thing called SmartGate that’s being progressively installed in Australian airports. Currently it’s in Brisbane and Cairns, and its going into the others over the next year or so. To use it, you need to have a passport with biometric data about your face embedded in it electronically. When you check in, you do so at a machine, a bit like you do on Air New Zealand domestic these days. The change comes when you go through passport control – you go through a kind of turnstile with a TV camera, and the machine looks at you and decides whether you match the information in your passport.

Q: Spooky!

A: It’s not really any different from a human controller checking that you match your photograph. And people seem to like it – Australian customs are getting some very good feedback. Although using the machine is entirely voluntary – you can just go through the normal passport desk if you prefer – 99% of people using SmartGate said they’d use it again. Australian Customs expects it to be used for 70% of travelers by 2011.

Q: Are we going to get it here?

A: Apparently there will be some gates put into Auckland airport for flights to Australia only. I don’t know whether New Zealand Customs has any plans to use it though.

Q: We’ve talked about face recognition and fingerprint recognition – are there other biometrics?

A: Yes, there’s a whole list of them. There’s iris recognition – that’s where you peer into a machine like a telescope which looks back at your eye and matches it against records. That’s pretty accurate, but it doesn’t have a high user acceptance factor – people don’t like to have something that close to their face.

There’s hand geometry – it measure the lengths and shapes of parts of your fingers. That’s in active use in a few places. And there are more exotic things like looking at the pattern of veins in your wrist, which is also unique, or whole palm prints.

Then are things like voice recognition. That’s good under some circumstances, like if someone is on the telephone, but it has problems if you have a cold, say.

Then you have the gold standard – DNA. That’s highly accurate, but it’s not generally acceptable to people to collect their DNA. And the privacy concerns get very high there as well. There was a film a few years ago called Gattaca – I can recommend it to anyone who is interested in the social issues around biometrics and particularly DNA collection. The name Gattaca incidentally looks like a DNA sequence, which all made of just the four letters G,C,T, and A. In that film, people were judged by their DNA and categorized. The hero goes through his life pretending to be someone else – which is pretty hard when they are checking your DNA all the time. It’s worth a watch – and it has Uma Thurman and Ethan Hawke if you get bored by the plot.

Links

As always, you can discuss this broadcast at it.gen.nz.

Wikipedia on Biometrics.

Australia’s SmartGate system for automated clearance of immigration

The film Gattaca about discrimination of genetic grounds.

posted by colin at 11:52 am  

2 Comments

  1. Uma Thurman was like a thousand times drop dead gorgeous when she was still younger.:-.

    Comment by Madison Davis — 5 July 2010 @ 4:57 am

  2. i seen Uma personally and she is quite a tall lady,..’`

    Comment by Joseph White — 2 August 2010 @ 4:03 pm

RSS feed for comments on this post.

Sorry, the comment form is closed at this time.

Powered by WordPress