Your secret identity
The spread of biometric technology means that your fingertips,
hands, eyes and face have become physical passwords
that can unlock doors and grant you access
to computer terminals, banks machines and even Disney World
Thursday, December 10, 1998
LAWRENCE SURTEES
M.I.T. Media Laboratory; Peter Kruizinga (University of Groningen).
Toronto -- Entering the Mayfair Racquet and Fitness Club in Toronto is similar to getting into the top-secret War
Room at the Pentagon.
Just like U.S. generals, Mayfair's 12,000 members must verify who they are by passing their hand through a
scanning device, called a hand key, before they can get through the turnstile.
If the geometric pattern of their hand matches a digital image previously stored in a computer, the access barrier is
automatically unlocked.
For fitness club users, the hand key means no more fumbling for misplaced plastic membership cards.
"Our staff love it because they are no longer hassled when members forget their passes, and we know that
memberships aren't being shared with friends," says Shirley Vedder, Mayfair's general manager.
The hand key is just one form of modern biometrics, which uses advanced technology to measure variations in
human beings and identify individuals. Not only your hand but your finger, eye or entire face can be digitized and
used as a physical "password" to gain entry or access to anything from a fitness club to a bank machine or
workplace computer.
Once the preserve of highly secret facilities, biometric devices are being propelled from war rooms to locker rooms
and other public places by falling costs and a rising demand for reliable security measures.
Disney World is already using fingerprint biometrics to identify its annual pass holders. MasterCard International
Inc. has plans to begin tests of a biometrics credit card by 2000. And the International Civil Aviation Organization
(ICAO) is currently reviewing proposals to equip the world's airports with biometrics to speed document processing
and customs clearances for the 1.5 billion people who travel on airlines each year.
Biometrics can provide additional security and convenience for travelers, says Renato Costa Pereira,
secretary-general of the ICAO, pointing to the most frequently cited benefits of the technology.
Market watchers at the research firm Gartner Group Inc. cite biometrics as one of the 10 most critical technologies
of the next decade. The U.S. government recently formed the Biometric Consortium to help push the adoption of
biometric technologies by testing and researching products.
Already, it appears to be a burgeoning business. Yankee Group of Boston estimates that more than $500-million
(U.S.) was spent worldwide on biometric devices last year, with one-third of sales to the private sector.
Sales of fingerprint devices alone are expected to skyrocket to $1-billion in 2001 from $145-million last year.
Several countries are already using biometrics nation-wide. Seven million people in Spain, for example, have been
using fingerprint scanners and a stored-cash card to receive their government benefits. Jamaica also opted for a
fingerprint scanning system to register voters in its last election.
Yet the use of biometrics also raises privacy issues that have impeded its widespread adoption.
The Electronic Privacy Information Center in Washington fears that uncontrolled sharing of biometric data could
lead to widespread monitoring of individuals by governments and law enforcement agencies.
However, a leading expert in biometrics says those fears are unfounded. "The truth is, biometrics cannot be used
to find you. And it cannot be used to track you," says James Wayman, director of the U.S. National Biometric
Test Center at San José State University.
Ontario's Privacy Commissioner, Ann Cavoukian, endorsed encrypted biometric finger scanning a year ago. She
shares the view of many of its proponents -- that the technology will protect, rather than threaten, the privacy of
consumer data, and also reduce fraud.
Nevertheless, even some advocates of biometrics say legislation may be needed to assuage the privacy concerns
of a skeptical public.
In Ontario, for example, criticism of a law that allows the fingerprinting of welfare recipients led to the imposition
last year of added privacy restrictions on municipalities that plan to use it.
The prospect of legislation governing the use of biometrics prompted industry members from around the world to
form the International Biometric Industry Association this September.
"Biometrics offer ways to safeguard people, data and facilities in an increasingly dangerous world, without
sacrificing privacy," says Bill Wilson, chairman of the IABA and head of hand key maker Recognition Systems Inc.
of Campbell, Calif.
Biometrics has its roots in fingerprint identification systems developed by law enforcement agencies 30 years ago.
The development of cheap and small optical scanners in the past decade to capture fingerprint, hand and face
images has brought biometric devices to the brink of the mass market.
The most prevalent biometric today is based on fingerprints.
"Your finger becomes your password," says Terry Milkie, director of engineering at Toronto-based Mytec
Technologies Inc., which makes a fingerprint scanner dubbed Touchstone that can control access to personal
computers.
A user first registers a master copy of their biometric with the device in a process called "enrolment." Each time
the user attempts to gain access, their biometric is compared with the enrolled version to produce a match.
In Mytec's case, a finger is placed over a small glass lens. The image is digitized, then converted into an
encrypted number by the scanner's microprocessor.
"Privacy is protected because you can't use that data to go backwards to reconstruct a fingerprint," Mr. Milkie
says.
Competitive pricing is making biometric fingerprinting devices more popular. While Mytec's sells for $900
(Canadian), a scanner dubbed the BioMouse, designed by American Biometric Co. solely to provide access to a
personal computer, costs about $400. Meantime, Compaq Computer Corp. has begun selling a fingerprint scanner
for $99 (U.S.).
Yet even at that price, some companies remain skeptical of the market prospects of biometrics.
"We've not yet found a viable business application for biometrics," says Laleh Mahjour, manager of the emerging
technology group at Royal Bank of Canada.
MasterCard International doesn't share that view. In an attempt to reduce fraud, the credit card issuer is set to
expand its three-year fingerprint trial at its Purchase, N.Y., headquarters early next year, says Joel Lisker, senior
vice-president of security and risk management and a former fingerprint expert with the Federal Bureau of
Investigation.
The company will move to an expanded employee ID program that will encode a worker's fingerprint onto a tiny
chip embedded in a corporate credit card, which will also serve as their identity pass.
"This phase will allow us to test actual point-of-sale type equipment before we move to larger merchant trials," Mr.
Lisker says.
A year later, the trial is to move to Europe, where biometrics use is more accepted.
Mr. Lisker estimates the use of biometrics could slash credit card fraud by 90 per cent. Such fraud costs issuers
$2-billion a year.
That means MasterCard could recoup in three years the $1.5-billion it would cost to equip its 50 million merchants
with finger scanners, he says.
The development of relatively cheap fingerprint sensor chips may also bring biometrics to common consumer
products such as keyboards, cellphones and even automobile ignitions.
More sophisticated techniques, such as hand geometry readers, have also been developed, some of them capable
of sensing whether the hand they're analyzing is actually attached to a warm body.
Hand key scanners, like the one used by the Mayfair fitness club, take two infrared pictures of the user's hand --
one from above and one from the side. The device takes 90 measurements of the hand, including its width,
thickness and surface area, converts all those calculations into a nine-byte number, then compares it with a user's
stored template. It also updates a user's template each time their hand is scanned to account for minute
variations.
"Hand keys avoid the stigma associated with fingerprinting," says Susannah Kilroy, marketing manager at
Ottawa-based ITS Canada Inc., which distributes the device.
The same product was used at the Olympic Games in Atlanta and is currently being used by U.S. Customs and
Immigration in Terminal 2 at Toronto's Pearson Airport, at Ontario Hydro's nuclear plants, and by workers at all
federal prisons.
But fingers and hands aren't enough for some companies. More than 60 firms and universities have developed face
recognition systems, according to the magazine Biometrics Technology Today.
"Your face is the most sophisticated biometric; don't leave home without it," quips Michael Kuperstein, chief
executive officer of Miros Inc. of Wellesley, Mass.
Miros makes face recognition software dubbed True Face for bank machines and a PC-based version for secure
Internet sites. Its product is being used in 180 cheque-cashing machines in the United States, and by Wells Fargo
Bank.
Even if you get your face messed up in a car accident or hockey game, you'll still be able to use the bank machine
by re-enrolling, Mr. Kuperstein notes.
One company, Visionics Corp. of Jersey City, N.J., has progressed to identifying a moving face in a crowd.
Visionics' three founders, all academics, were pioneers of a recognition technique called eigenfaces, which takes
its name from the German word eigen, meaning "characteristic." The eigenface technique sorts faces into basic
types, based on patterns of light and darkness.
Although useful for narrowing the scope of the search, the eigenface technique needs to be combined with other
mathematical measurements to precisely identify a single face in a data base containing hundreds of thousands,
or even millions, of pictures.
Visionics uses "local feature analysis" to measure up to 50 defining characteristics on a face to make a precise
match.
The technique is good enough to spot a face in a crowd and several U.S. airports are interested in marrying
Visionics' software with video security systems.
The growth of video surveillance is helping to make face recognition one of the fastest growing markets in
biometrics, says Calum Bunney, editor of the Biometrics newsletter.
Faces can also be recognized in the dark using infrared cameras that produce heat-sensitive thermograms.
Many banks, however, are turning to a quicker biometric technique that scans the unique pattern in the iris, the
coloured part of an eye.
"We're betting that this is one biometric that will be a good substitute or replacement for personal identification
numbers," says Per-Olof Loof, a senior vice-president at NCR Corp., which makes a bank machine equipped with
an iris scanner.
When a customer inserts a bank card, a small camera on the ATM checks the iris and, if matched to a stored
pattern, allows access to the account without a personal code.
NCR will be testing these machines in Italy, Turkey and Norway following extensive trials at a British bank and with
Japan's leading bank machine operator, Oki.
But iris scanning is more expensive than other techniques.
To overcome the errors and deficiencies of any single method, some companies are combining biometric
techniques.
"We think finger and face recognition will become the preferred primary and secondary biometric techniques," says
Karl LaPan, president of Polaroid ID Systems Inc.
The division of film and camera maker Polaroid Corp. acquired a biometric imaging unit from NBS Technologies
Inc. of Mississauga, Ont., for $17.5-million (Canadian) in July.
It has married that company's fingerprint system with Visionics' face recognition software to create a new system
for driver's licence bureaus that can match a face to a record in a data base of 1.5 million images.
Site seeing
biometrics.org
EIGENFACES...
1. A large number of pictures of faces are collected in a data base.
2. A set of eigenfaces - two-dimensional facelike arrangements of light and dark areas - is made by combining all
the pictures and looking at what is common to groups of individuals and where they differ most.
3. Eigenfaces work as "primary faces." Just as any colour can be created by mixing primary colours, any facial
image can be built by adding together, with different intensities of light, a relatively small number of eigenfaces
(about 100 is enough to identify virtually any person).
4. To identify a face, the program compares its eigenface characteristics with those in the data base, selecting the
faces whose representations match the target most closely.
...AND LOCAL FEATURE ANALYSIS
1. The eigenface method is the foundation of local feature analysis, which is less sensitive to deformations of the
face, and to changes in poses and lighting. Local feature analysis considers individual features instead of relying
on only a global representation of the face. The system selects a series of blocks that best define an individual
face. These features are the building blocks from which all facial images can be constructed.
2. The procedure starts by collecting a data base of photographs and extracting eigenfaces from them.
3. Applying local feature analysis, the system selects the subset of building blocks, or features, in each face that
differ most from other faces. Any given face can be identified with as few as 32 to 50 of those blocks. The most
characteristic points are the nose, eyebrows, mouth and the areas where the curvature of the bones changes.
4. The patterns have to be elastic to describe possible movements or changes of expression. The computer knows
that those points, like the branches of a tree on a windy day, can move slightly across the face in combination with
the others without losing the basic structure that defines that face.
5. To determine someone's identity, the computer takes an image of that person and determines the pattern of
points that make that individual differ most from other people. Then the system starts creating patterns, either
randomly or based on the average eigenface. For each selection, it constructs a facial image and compares it with
the target face to be identified. New patterns are created until a facial image that matches with the target can be
constructed. When a match is found, the computer looks in its data base for a matching pattern of a real person.
6. The system can automatically detect a person's presence, locating and tracking the head. It can work from any
distance (depending on the optics) and even recognize moving people.
IRIS SCANS
The tangled mesh of connective tissue in the iris of each eye is unique. It is stable throughout life, making it an
ideal feature for biometric identification.
No two irises are alike
The iris pattern is encoded into an Iris Code, which is stored in a data base. The error rate for identification is one
in 1.2 million. |
