Biometric security — which employs systems that read people’s fingerprints or compare their voiceprint or retina scans to information in data banks in order to authenticate them — is being heavily used in some of the United States’ most critical installations.
For example, the United States Department of Defense is focusing strongly on biometric security. The U.S. Army Biometrics Task Force has selected Raytheon to provide biometric-related services and support.
How reliable are biometric systems, anyhow? What happens if you have a cold or haven’t had enough sleep and your voice is hoarse, your nose is running, and your pupils are contracted or dilated? Can security systems mistakenly identify you as a terrorist or a person of interest in an ongoing police investigation?
That’s where biometric systems run into trouble.
What Is Biometrics, Anyhow?
Biometric systems are fallible and need more work, concludes the National Research Council in a new report. The committee defines biometrics as the automated recognition of individuals based on their behavioral and biological characteristics.
The report, “Biometric Recognition: Challenges and Opportunities,” was prepared by the Whither Biometrics committee, chaired by Joseph N. Pato, a distinguished technologist at HP Labs. It was funded by DARPA, the CIA, and the U.S. Department of Homeland Security, with aid from the National Science Foundation.
Biometrics is not just a technology but a set of systems, and complex systems have multiple points of failure, the report explains. Further, technical issues such as the calibration of sensors and data degradation can impact the accuracy of a biometric system.
That’s not all; biometric systems provide probabilistic results, meaning they offer up the best match to the data that’s been input or is being held in data banks. This could lead to misidentification, with unfortunate consequences for the misidentified, as Brandon Mayfield learned — more on this to come.
Also, biometric characteristics are not stable and may vary over the lifetime of a person due to age, stress, disease or other factors.
“We need more research into the distinctiveness and stability of biometric measures,” said Jim Wayman, research administrator with San Jose State University’s office of graduate studies and research, who collaborated on the report.
“We also need more research into how biometric measures change with aging,” Wayman told TechNewsWorld. “How easy is it to recognize my iris now compared with 10 years ago?”
Fingerprints, that much-loved staple of police shows, aren’t stable, either, he pointed out. They can be altered by using more or less force when a subject is being fingerprinted — and they can change with age.
The Case of the Bulldozed Lawyer
The case of Oregon lawyer Brandon Mayfield is often held up as a classic example of what can go wrong with biometric security. In 2004, Mayfield was arrested on suspicion of being involved with the bombings of commuter trains in Madrid, Spain, after the Spanish police forwarded a set of fingerprints to the FBI.
The FBI disregarded the Spanish authorities’ notification that the fingerprints probably weren’t Mayfield’s. It also ignored its own records, which showed the fingerprints were only one of 20 “similar” prints to those retrieved from Madrid.
Mayfield was held in a county jail under a false name and later transferred to an unidentified location without any notification to his family. Eventually, he was released. It was only after Mayfield successfully sued the FBI and government that he got an apology for his trouble.
How could FBI agents mistake his fingerprints for those of a suspect in the Madrid bombings?
Inexperience is one reason, said San Jose State’s Wayman. Further, the sheer size of the database searched meant there would be some close matches.
“The FBI searched the fingerprints against the 650 million fingerprints in its database,” he explained. “They had no previous experience with the very close matches that can occur when you search such a large database.”
The certainty of a match depends on the number of matches made and the size of the database, Wayman pointed out. This is why it’s important to consider biometric systems in context rather than as standalone systems or devices.
Security Only Needs to Be Good Enough
How large does a biometric security system’s database need to be in order to provide accurate results? That depends — security is always a tradeoff between the ideal and the possible.
“When used for security, you are trying for a high confidence match, and are not searching to see if there’s anyone else like you in the world,” Rob Enderle, principal analyst at the Enderle Group, told TechNewsWorld.
Most biometric security systems are designed on a probabilistic basis, meaning the more likely a breach is, the tighter the security. Doing otherwise would make security solutions highly expensive and slow.
“We are constantly forced to deal with the question of ‘good enough’ in security,” Scott Crawford, a managing research director at Enterprise Management Associates, told TechNewsWorld.
“While in some cases the ‘good enough’ approach is inadequate, as shown by the large number of data breaches reported, the practical approach is to weigh all one’s options,” Crawford remarked.
You Say Yes, I Say No
Misidentification — where the system generates false negatives or positives — is a very real problem. Mayfield was the victim of a false positive, but a false negative can be just as harmful, and purchasers and implementers of biometrics systems should always consider the possibility of false negatives and positives, Wayman suggested.
For example, the NRC committee heard testimony from a government official who was planning to implement fingerprint controls at airports to restrict employee access to certain areas.
“That project made no accommodation whatsoever for mistakes and it failed on arrival,” Wayman said. “It was turned off the same day.”
Designing better biometric systems isn’t enough; users need to be trained on the systems, Randy Abrams, director of technical education at ESET, told TechNewsWorld.
“Computers lie all the time,” Abrams said. “Too many people think that computers and technology are infallible. That just isn’t the case. For the foreseeable future, a pure biometric system is a fool’s folly.”
Loading ...
