Volume VI • Number 6 • Friday, April 2, 2004
IBIA Tells the U.S. Treasury Department that
Biometrics Are the Single Most Essential Solution
to the Fastest Growing U.S. Crime,
Financial Identity Theft
Yesterday, April 1, IBIA sent the U.S. Treasury Department a detailed response to Treasury’s request for public comment about “Formulating and Conducting a Study on the Use of Biometrics and Other Similar Technologies to Combat Identity Theft.” The study was mandated by the Fair and Accurate Credit Transaction Act of 2003 (the “FACT Act”). In its submission IBIA made three key points, as follows.
The Problem. Identity theft for the purpose of stealing personal financial resources is by far the fastest growing crime in the United States. We’re talking exponential. The Federal Trade Commission reported in 2003 that over 27 million Americans were victims of identity theft in the previous five years but more than a third of that number, nearly 10 million, were victimized by identity thieves in just the last year.
The Solution. Deployment of biometrics is not the only solution to the problem but it is by far the first and most important because “only biometric technologies have the ability to automatically distinguish the identity of one person from the identity of another,” to quote from IBIA’s Treasury submission.
The Cost. As IBIA said to Treasury, “The cost of deploying biometrics to deter identity theft would quickly be recouped many times over by the virtual elimination of identity theft and by the elimination of the costs of security personnel, network managers, and customer service representatives employed in administering PINs, passwords, and tokens and the systems that support them.”
IBIA is seeking to reinforce and supplement its written comments about the uses of biometrics to deter financial identity theft by arranging to conduct a biometric industry roundtable dialogue with pertinent Treasury officials.
Following is the full text of IBIA’s submission to Treasury.
April 1, 2004
Ms. Susan Hart
Financial Economist
Office of Critical Infrastructure Protection
factabiometricstudy@do.treas.gov
Attention: FACT Act Biometric Study
Subject: IBIA Response to the Treasury Department’s Request for
Comment on “Formulating and Conducting a Study on the Use of
Biometrics and Other Similar Technologies to Combat Identity Theft”
Dear Ms. Hart:
On March 2, 2004, the Treasury Department requested comment on “Formulating and Conducting a Study on the Use of Biometrics and Other Similar Technologies to Combat Identity Theft.” On behalf of manufacturers and integrators of core biometric technologies that are being deployed to help protect the critical infrastructure of the U.S., the International Biometric Industry Association (IBIA) welcomes the opportunity to comment on the document.
IBIA is a trade association established in September 1998 to advance the collective international interests of the biometric industry. IBIA is governed by leading developers, manufacturers, and integrators of biometric technologies, and is impartially dedicated to serve all biometric technologies in all applications. IBIA speaks with authority for the biometric industry to the public, opinion leaders, and government officials in the U.S. and abroad.
Section 157 of the Fair and Accurate Credit Transaction Act of 2003 (“the FACT Act”) asks Treasury to conduct a study “of the use of biometrics and other similar technologies to reduce the incidence and costs to society of identity theft by providing convincing evidence of who actually performed a given financial transaction.”
This letter sets forth the attributes of proven biometrics in general and the capabilities of biometrics to deter identity theft in particular. It also addresses the magnitude, growth, and cost of the problem of identity theft. The attachment to this letter provides answers to the questions Treasury posed in its request for comment.
About Biometrics. Proven biometrics automatically identify or verify the identity of an individual based on physiological or behavioral characteristics. Such authentication is accomplished by using computer technology in a noninvasive way to match patterns of live individuals in real time against enrolled records. Examples include products that recognize faces, hands, fingers, signatures, irises, voices, and fingerprints.
Biometrics have been tested under the most demanding conditions. They protect facilities that are vital to national security, prevent unauthorized people from crossing borders, and preserve the integrity of financial systems and data networks. Real-world results show that biometric products are dependable, easy to use, and cost-effective. IBIA members, recognizing that truth is the key to industry credibility, go a step further by attesting that their stated claims are accurate and can be independently verified by a competent authority.
Biometric technologies have been in the marketplace for over two decades. The technologies are non-intrusive and user-friendly and present no risk to public health and safety. IBIA member companies are committed to the highest standards of systems integrity and database security to deter identity theft, protect personal privacy, and ensure equal rights under the law.
Biometrics and Identity Theft. Identity theft — using stolen credit cards, phony checks, benefits fraud, network hacking, and other impostor scams to defraud businesses, government agencies, and consumers — costs multiple tens of billions of dollars per year. Identity theft drives up the prices of goods, increases taxes, complicates routine transactions, and strains law enforcement resources. Until recently, the only way to attack the problem has been to deploy costly, labor-intensive screening and administrative procedures that require the use of identity documents, PINs, passwords, and tokens; the asking and answering of intrusive personal questions; and the creation of vast databases administered by security and account verification personnel. These means are not merely costly, time-consuming, and inconvenient; they are insecure stopgap measures easily defeated by enterprising crooks and terrorists.
Proven biometric technologies offer effective, low-cost solutions that replace these traditional, expensive, labor-intensive processes. Biometric technologies are an effective substitute because they create highly accurate digital records of a person’s physiological features. These records can be safely stored for later comparison against a live image that is captured from the user at the time the service or benefit is requested. Because biometric technologies automatically recognize personal features such as an iris, a voice, a signature, a fingerprint, a hand, or a face, biometrics enable end-users such as banks, merchants, government agencies, and employers to ensure the integrity of transactions without inconveniencing or embarrassing employees and customers.
Biometrics are especially important means of deterring identity theft in two major venues important to consumers, citizens, and the United States: financial services and border control. Financial identity theft immediately injures the consumers who fall victim to the crime. Identity theft committed by people who cross the nation’s borders causes a wide range of problems, including illegal employment, improper demands on educational resources, wrongful access to welfare benefits and other entitlements, and terrorism.
Cost of Identity Theft. The Federal Trade Commission (FTC) in 2003 released data showing that 27.3 million Americans had been the victims of identity theft in the past five years. Moreover, the survey reported that over one-third of the victims (9.9 million) had been victimized in the past year, a fact that shows that the problem is growing exponentially. The most common ID theft complaint related to credit card fraud, followed by phone or utility fraud, bank fraud, employment-related fraud, government document or benefit fraud, and loan fraud.
Established in November 1999, the FTC’s Identity Theft Clearinghouse received a total of 94,100 claims in its first three years, 161,836 in 2002 and 214,905 in 2003. These statistics too demonstrate that the problem of identity theft is increasing explosively.
There are two losers in every instance of financial identity theft: A financial institution and a consumer. Losses to financial institutions from identity theft per se are difficult to calculate because of the different ways in which different kinds of financial fraud are recorded and reported, but one conservative estimate suggests that financial identity theft cost over $100 billion in a recent year.
Losses to consumers are equally hard to document in full owing to nonreporting of cases of identity theft and different ways in which the crime is accounted for by different jurisdictions. Under the heading of “new accounts opened in false name,” which the FTC says includes a large percentage of the total financial impact of identity theft, the agency concluded that average personal losses were as follows for each recent case of identity theft:
· Money or goods obtained: $10,200.
· Other out-of-pocket costs of victimization: $1,200.
· Time spent by victims correcting transactions and records: 60 hours.
While the cost of identity theft to banks, credit card issuers, and lenders is not inconsequential, it pales in comparison to the harm caused individuals. Victims face bills for merchandise and services they did not buy, falsification of credit records, and the inability to open bank accounts, secure mortgages, rent residences, and meet other urgent and time-sensitive financial obligations, such as paying school tuition.
Moreover, identity theft is a crime that keeps on hurting. Often a victim of identity theft does not know or learn about it for months or even years, or concludes that he or she has contained the damage and resolved the problem only to have it reappear when a fresh attempt to conduct a financial transaction is denied by a financial institution that failed to be informed about the crime in the first place.
The Solution in Perspective. Biometrics are an absolutely necessary but not the only solution to the problem of financial identity theft. Biometrics are indispensable to ensure that a person conducting a financial transaction is in fact who he or she claims to be. But in addition, strong encryption and IT security tools are necessary to protect against Trojan horse viruses and spyware. The use of smart cards incorporating biometrics is a great leap past the use of magnetic stripe cards to protect the validity of financial transactions, but the delivery by mail of cards of all sorts, accompanied by stealable personal information, must be made more secure.
A commonly overlooked vulnerability is the widespread defect of procedures to initially validate personal identity for purposes of biometric enrollment or registration. An unacceptable outcome is to create a system of biometric enrollment that can be scammed to certify false identities. A person whose sham credentials are authenticated by his or her biometric template could effortlessly lay claim to the entitlements, benefits, or privileges that enrollment confers upon him or her, confident that only a freak accident or bad luck will reveal his or her secret. Everything that can be done must therefore be done to ensure that “breeder documents,” such as drivers’ licenses and birth certificates, are authenticated before their bearers use them to validate their identity at the time of biometric enrollment.
In short, IBIA recommends that Treasury address the problem of identity theft holistically, by simultaneously directing its attention to the least technical as well as the most techical means to deter identity theft.
IBIA’s Offer of Assistance. In the attachment to this letter, IBIA sets forth answers to the direct questions asked by Treasury in its March 2 request for comments. These answers are necessarily incomplete, however. In the spirit of the consultation mandated by the FACT Act, IBIA believes that it can provide indispensable supplementary advice and counsel to Treasury by means of a biometric industry roundtable conducted at a convenient time and place for the benefit of pertinent officials of Treasury. This initiative would accommodate and encourage the dialogue with senior executives of leading biometric companies that IBIA believes is essential to help Treasury find accurate and complete answers to the questions it has posed.
To arrange a date and time for a biometric industry roundtable with you and your colleagues, or to address any other matter, I urge you to contact Verrick French, Managing Director of IBIA, Rebecca Dornbusch, Deputy Director of IBIA, or me at (202) 783-7272.
Sincerely,
Richard R. Gill
Richard R. Gill
Executive Director
Attachment: Treasury’s Questions and IBIA’s Answers
ATTACHMENT TO IBIA LETTER
DATED APRIL 1, 2004, TO U.S. TREASURY DEPARTMENT
Responses by the International Biometric Industry Association (IBIA)
to Questions Posed by the U.S. Treasury Department (Treasury)
in its Request for Comment on “Formulating and Conducting a Study on
the Use of Biometrics and Other Similar Technologies
to Combat Identity Theft”
April 1, 2004
1. a. What range of biometric solutions could the private sector use to reduce the incidence and costs to society of identity theft by providing convincing evidence of who performed a given financial transaction?
IBIA Response. Every proven biometric technology, properly deployed and integrated in appropriate applications, can be used to provide not merely convincing but virtually irrefutable evidence of the identity of a person performing a financial transaction. Use by Congress and Treasury of the past tense “performed” in the question perhaps inadvertently suggests that a financial institution wants to be able only to reconfirm the identity of persons conducting financial transactions after such transactions occur. Creating evidence or an audit trail is certainly an important function that biometrics are well suited to perform. Even more important, IBIA suggests, is to use biometrics to authenticate the identity of persons before they perform financial transactions in order to permit only authorized persons to perform such transactions.
There are a wide range of circumstances, settings, and conditions in which financial transactions are performed. Moreover, some financial transactions are more sensitive than others. IBIA suggests that it can best help Treasury to understand which biometric solutions are well suited to different circumstances, settings, and conditions of financial transactions by convening for Treasury officials the biometric industry roundtable panel proposed in IBIA’s cover letter dated April 1 to which this document is an attachment. All proven biometric technologies would be represented on the panel.
b. How are biometric technologies being applied now to reduce the costs and incidence of identity theft?
IBIA Response. Proven biometric technologies are being applied now in hundreds of circumstances, settings, and conditions to reduce the costs and incidence of identity theft. IBIA believes that it could best help Treasury to understand the all-important particulars of the answer to this question by means of the biometric industry roundtable panel proposed above.
c. What other technologies are being applied now to reduce the costs and incidence of identity theft?
IBIA Response. Tokens, PINs, and passwords are the most common means used to try to reduce the costs and incidence of identity theft. But they are insecure. Something one possesses, a token, and something one knows, a PIN or password, cannot ensure positive identification of a person. Tokens, PINs, and passwords can prove that a person holds a valid tool to perform a transaction, but they cannot prove a person’s identity. Only biometric technologies have the ability to automatically distinguish the identity of one person from the identity of another. Moreover, tokens are routinely mislaid and stolen. PINs and passwords are routinely shared, forgotten, left in plain sight, and stolen. Properly stored and encrypted, biometric data cannot be stolen. The exponential increase in identity theft for the purpose of committing financial fraud is directly related to the ease and thus the proliferation of stealing and abusing tokens, PINs, and passwords.
Smart cards, properly integrated with biometrics, are very useful tools to help deter identity theft. A smart card can contain a biometric template that can be read and matched with a live sample by a computer at the time of a financial transaction and thus confirm that the bearer of the card is in fact its rightful owner. Or a smart card can have the processing power to internally execute a 1:1 match of a person’s live biometric sample with the enrolled biometric template contained in the smart card. Moreover, smart cards integrated with biometrics offer a flexible multi-use platform for logical access, e-authentication, credentialing, and other purposes and procedures directly related to authenticating persons who wish to conduct financial as well as many other kinds of transactions.
d. What biometric technologies could be applied in the future to reduce the cost and incidence of identity theft?
IBIA Response. Depending upon the particular application, all proven biometric technologies could be used for this purpose in the future. There are a variety of unproven biometric technologies in various stages of research, development, and testing. IBIA strongly advocates the adoption of open-source global standards for biometric interoperability and integration that will permit new biometric technologies, once proven, to be seamlessly integrated and deployed in appropriate applications.
e. Does the private sector have adequate incentives to adopt biometric and other technologies to reduce the costs and incidence of identity theft?
IBIA Response. The savings from converting manual processes to those driven by biometric devices can be significant. This is especially true in circumstances where safety and security are important, and customer service and accessibility are essential.
In the past, maintaining security and controlling transactions required labor-intensive screening or insecure PIN/password/token systems, and often both. Biometrics offer an effective alternative by automating these processes for a fraction of what other approaches cost. Businesses, schools, and government agencies as well as financial institutions have found that the return on investment in biometric solutions is large when they are used to deter identity theft and save resources at the same time.
There are many examples of how biometrics can improve efficiency. Until recently, network security could be protected, ineffectively, only by PINs or passwords; now, biometric peripherals can be used to automatically authenticate computer and network users. Until recently, financial transactions could be protected, ineffectively, only by PINs, passwords, or tokens; biometric technologies now replace these vulnerable means with a process that gets high marks from consumers. Going through border controls always meant waiting in lines; for several years now, travelers at selected airports have been able to move seamlessly through inspection processes with the assistance of biometric technologies. Biometrics can be used in similar ways to stop losses due to payroll fraud and save time in trying to resolve questions of eligibility for benefits.
During the past decade or so, the average unit cost of proven biometric hardware and software has fallen by many orders of magnitude. Mass deployment of biometrics to deter identity theft would further substantially reduce unit costs. IBIA believes that the cost of deploying biometrics to deter identity theft would quickly be recouped many times over by the virtual elimination of identity theft and by the elimination of the costs of security personnel, network managers, and customer service representatives employed in administering PINs, passwords, and tokens and the systems that support them.
2. a. What is the rate of adoption by the financial services industry of biometric solutions for the purpose of verifying or authenticating who performed a given financial transaction? By other industries?
IBIA Response. IBIA is not aware of current, comprehensive studies or data that authoritatively answer these questions. The biometric industry roundtable panel proposed above by IBIA could provide Treasury with meaningful examples and indicators that suggest what the rate of adoption has been in different particular applications, and what it is likely to be under different future scenarios and assumptions, in the financial services industry and other industries.
b. What is the rate of adoption of other similar technology solutions provided by the private sector for the same or similar purpose?
IBIA Response. Passwords and tokens are very widely used with the intent of serving the same purpose but they are inherently incapable of doing so securely. See the answer to question 1.c.
3. What are the public’s concerns with the use of biometrics?
IBIA Response. In circumstances in which (1) the use of biometrics has been accurately and carefully explained to potential users in advance and (2) users have been assured that biometrics will be used only for stated purposes, acceptance has been highly positive. In circumstances in which the possible or proposed deployment of biometrics has been neither accurately nor carefully explained, and no assurance has been given that biometrics will be used only for stated purposes, public concerns have included privacy and safety.
The privacy-protecting attributes of biometrics are powerful and deserve clear understanding and appreciation. Properly deployed, biometrics effectively strengthen and protect personal privacy by erecting a barrier between personal data and unauthorized access. Technically, biometric capture devices create electronic digital templates that are encrypted and stored and then compared to encrypted templates derived from “live” images produced when there is a need to verify the identity of an individual. The templates are generated from complex and proprietary algorithms and are then encrypted using accepted strong cryptographic algorithms to secure biometric records and protect them from disclosure. Standing alone, these templates are of no use; they cannot be reconstructed, decrypted, or otherwise manipulated to reveal a person’s identity to someone else. Used this way, biometrics can be thought of as a very secure key, but a key that cannot be handed to someone else. Unless a biometric gate is unlocked by the proper bearer using the right key, no one can gain access to a person’s identity.
In regard to safety, biometrics, properly used, pose virtually no risk of harm – less, for example, than the risk posed by the proper use of personal computers.
Members of IBIA are committed to the ethical and safe deployment of biometrics by honoring IBIA’s Statement of Principles and Code of Ethics and IBIA’s Privacy Principles.
4. What are the costs of the use of biometrics? What are the risks of using biometrics?
IBIA Response. In regard to the first question, see the answer to question 1.e above. If the second question refers to safety, the answer, set forth under question 3, once again is that biometrics, properly used, pose virtually no risk – less, for example, than the risk posed by the proper use of personal computers.
5. What are the tradeoffs for the consumer in using biometrics?
IBIA Response. The question suggests that consumers may have something to lose as well as something to gain by using biometrics. IBIA believes that substituting proven biometrics, properly deployed, for all other means of deterring identity theft will produce uniformly positive results. Moreover, biometrics offer benefits in addition to identity security. Biometrics are a convenient alternative to carrying identification documents, possessing tokens, remembering PINs and passwords, and entering personal identification numbers. Since individuals can be accurately identified by biometric technology alone, both consumers and end users, notably including financial services companies, also gain benefits by relieving security personnel, network managers, and customer service representatives of the tedious – and often intrusive – tasks of identity verification and PIN and password administration. Biometrics offer companies and governments a simple and cost-effective way of achieving much higher productivity, cutting waste and fraud, and delivering consistent, reliable customer service.
6. What are the benefits to consumers of the use of biometrics?
IBIA Response. See the answer to question 5.
7. a. What has been the experience of industries that have used biometrics for the purpose of providing convincing evidence of who performed a given financial transaction? What has been the customer reaction?
IBIA Response. The experience of industries and their customers who have used biometrics, properly deployed, for this purpose has been highly positive. Participants in the biometric industry roundtable panel proposed above by IBIA can provide Treasury with representative examples. See also the answers to questions 1.a, 3, and 5.
b. What has been the experience of industries that have used other similar technologies for the same or similar purpose? What has been customer reaction?
IBIA Response. The answer to question 1.c about the use of PINs, passwords, and tokens applies to all industries. Customers whose identity has been stolen because their token or PIN or password has been stolen and abused of course react negatively.
8. What barriers are there to the greater use of biometric and other technologies to reduce the cost and incidence of identity theft?
IBIA Response. In the judgment of IBIA, inertia and the need for education are the principal remaining barriers. As indicated in the answer to question 1e, the unit cost of biometric hardware and software has declined steeply by many orders of magnitude over the past decade and will decline further when biometrics are deployed commercially on a mass basis. There is no doubt, in IBIA’s view, that the cost of replacing passwords and tokens and the systems that support them will be recouped swiftly and many times over by the virtual elimination of the costs of identity theft and the elimination of the costs of security personnel, network managers, and customer service representatives employed in administering PINs, passwords, and tokens and the systems that support them.
ibia.org
steve |
