Body language: Using biometric technology

A few years ago, a dangerous criminal walked out of the Lancaster County (Pa.) Prison after fooling officials into believing that he was someone else. Despite the safeguards that were in place to prevent such a mistake, the man’s cunning and close resemblance to another prisoner scheduled for release won him freedom.

Once officials realized what had happened and found the man, they vowed that mistake would never be repeated. They invested in new technology that would reduce the chance of human error and would verify prisoners’ identities by the unique — and nearly impossible-to-fake — characteristics of their irises.

“[The technology] does not take the place of the screening process when individuals are released,” says Luther Schwartz, department network administrator for the prison. “But we are ensuring that, when a person goes out under a particular name, it is the same person that came in under that name.”

The iris recognition system used in Lancaster County is one of several biometric technologies being used by local governments to improve security in prisons and beyond. Biometric technologies automate the process of identifying people based on their unique physical or behavioral characteristics.

The most widely used biometric technologies rely on fingerprints to distinguish individuals, but, as Lancaster County’s system shows, they are not the only systems available. Researchers have been pursuing ways to measure the qualities of human voices, signatures, eyes and faces to help combat identity fraud and to enhance computer and building security and public safety.

The public sector interest in biometrics is following a private sector trend. “Civilian” applications include voice recognition systems for securing telebanking activities; facial recognition systems for securing ATM transactions; and fingerprint recognition systems for securing laptop computers and cellular phones. Likewise, local governments are using biometric technologies to secure computer systems, buildings, public spaces and, most recently, airplanes.

Getting a good sample

While biometric technologies come in many forms, including fingerprint, face, voice and iris recognition systems, the procedure for storing and retrieving biometric information is uniform. “There are two phases in the system,” explains Anil Jain, professor of computer science and engineering at Michigan State University in East Lansing. “One is the enrollment phase, and the other is the verification phase.”

During the enrollment phase, subjects submit a “live sample” of their biometric information (e.g., the eyes, face or fingerprints), which is scanned and stored in a database along with the subject’s name and any other identification information. During the verification phase, subjects present their biometric information, and the recognition system compares the current scan with the sample stored in the database. System administrators also can conduct a “one-to-many” search, comparing the scan to all samples in the database.

Lancaster County Prison now uses iris recognition in conjunction with traditional fingerprinting when arrestees are booked into the prison. The system, by Moorestown, N.J.-based Iridian, takes a digital picture of a subject’s eye and creates a code of the unique characteristics of his iris. Unless a subject’s pupil is dilated so that only a small part of the iris is present, officials can get enough information to store in the database.

“With a fingerprint, you only have maybe 60 to 70 points of identification,” Schwartz says. “With the iris, there are over 400 points to map, so it’s a lot more exact.”

Besides using its iris recognition system to verify inmates upon release, the Lancaster County Prison has begun screening prison visitors to verify their identities. (The prison prohibits released inmates from returning as visitors within six months of their release, and the iris recognition system ensures that released inmates do not visit under fake names.)

A touchy choice

Because fingerprints have been used in forensic investigations for so many years, many law enforcement agencies choose to invest in automated fingerprint identification rather than in other biometric technologies. “Fingerprints have always been proven to be the one and only positive aspect for identification,” says David Cotton, forensic investigation manager for the Pierce County, Wash., Sheriff’s Department. “We have had 100 years of history with this. We don’t have that with lip impressions, iris scans, ear impressions and all the things that people are saying are just as unique as fingerprints.”

The Pierce County Sheriff’s Department uses fingerprint identification systems by Tacoma, Wash.-based Sagem Morpho to verify inmates upon release. It also has installed fingerprint readers throughout the prison facilities to track prisoners’ movements and to secure doors to sensitive areas.

While Pierce County prison officials could have invested in access badges or keys to secure facilities, they decided that automated fingerprint identification was less fallible. “What is more unique to you than your fingerprint? Nothing at all,” Cotton says. “Can you lose your fingers? I doubt it. Can you lose your key? Can you lose your card? You lose control of the security of your system without using something very unique to the individual.”

The certainty offered by biometric access control systems also appealed to Michael Sherwood, director of information technologies for Oceanside, Calif. “A typical IT problem is that users’ passwords expire, or they lock themselves out of their computer,” Sherwood says. “We were looking for ways to avoid that and to avoid the typical user having their password on a sticky note on their computer. That represents a breach of security.”

About two-and-a-half years ago, Sherwood installed fingerprint readers by Los Gatos, Calif.-based Identix on almost 1,200 computers throughout city offices. “It has cut down on all of our operational costs,” Sherwood says. “It’s saved us the time of not having to reset passwords, and it’s given [employees] flexibility because they don’t have to remember their passwords now.”

Sherwood chose to use fingerprint readers rather than other biometric systems partly because users were familiar with the idea of fingerprint recognition. “The iris scanners are probably more effective, but there’s still a user perception that their eyes are going to be destroyed or damaged,” Sherwood says. “We’re looking at sticking with the hand- and palm-type scanning because it’s less intrusive to the end user.”

Although city employees were familiar with fingerprint identification systems, some questioned how their fingerprint information would be used. Sherwood had to allay employees’ fears of misuse before going live with the technology. “Some people have been concerned that we can reproduce their fingerprint, which is a fallacy,” Sherwood says. “We explained that we were not going to be able to re-create their fingerprints or do anything with [their fingerprint] data or submit their fingerprints to any special agency or anything.”

Looking for a face in a crowd

Subjects’ concerns for data misuse are particularly high in communities that have begun using facial recognition systems to monitor public spaces. Tampa, Fla., for example, first experimented with a facial recognition system that scanned attendees of the 2001 Super Bowl and Super Bowl festivities in its Ybor City entertainment district. Although the system did not make any matches at those events, the city decided to test a similar system for a year to monitor crowds throughout Ybor City.

The facial recognition system integrated easily into the closed circuit television surveillance system that had been installed in the entertainment district in 1997. “It was a perfect fit in Ybor City for a couple of reasons,” says Bill Todd, detective for the Tampa Police Department. “The infrastructure of the cameras and the fiber-optics were already there, and we were addressing large transitory crowds [in the area].” The police department populated the database of the facial recognition system with images of runaway children, sexual predators under court supervision and wanted felons.

The system, by Jersey City, N.J.-based Visionics, captures faces from surveillance cameras and compares them against the images in the database. If the system finds a match, it sounds an alarm at the department’s command center, and officers compare the real-time and database images to decide whether they are the same.

Visitors to Ybor City have donned masks to protest the use of the cameras, and the New York-based American Civil Liberties Union (ACLU) weighed in with a report on Tampa’s application of the technology (“Drawing a Blank: The failure of facial recognition technology in Tampa, Florida”) in January.

The ACLU argues that facial recognition technology is too intrusive and ineffective to be used as a surveillance tool. The Tampa report cites the findings of Richard Smith, a security consultant, who tested the technology and found several problems with its accuracy, including its sensitivity to lighting conditions and changes in facial expressions.

Jain agrees that, in general, facial recognition systems have several problems. “Accuracy-wise, iris and fingerprint [systems] are much more accurate than face [systems],” he says. “The problem with face [recognition] is makeup, jewelry, lighting conditions and facial characteristics change. If your hairdo has changed, the facial recognition systems don’t perform as well. If you can control the lighting and background, the performance improves.”

So far, Tampa’s system has been unsuccessful at positively matching anyone in the database to anyone in the crowds. That could be because no one in the database has appeared in the crowds or because the technology has trouble matching images. However, Todd believes that the technology is bound to improve. “I believe very strongly that the facial recognition software is going to prove to be an invaluable tool for law enforcement, but it’s still a work in progress for us.”

Searching for a proper use

The Pinellas County (Fla.) Sheriff’s Office has begun using facial recognition technology in a more controlled environment than that of Ybor City. The Sheriff’s Office, which has been handling law enforcement for the St. Petersburg-Clearwater Airport for about three years, began using facial recognition systems by Littleton, Mass.-based Viisage at two airport security checkpoints in January.

The office installed cameras directly in front of the magnetometers through which all passengers must pass. Passengers look directly into the cameras, which take a couple of images, and the facial recognition system instantly compares the images to those stored in a database. If the system does not find a match, passengers are allowed to proceed to the gates. “In most cases, [passengers’] bags are still being x-rayed by the time [the scanning is] done, so it hasn’t slowed down the process at all,” explains Lieutenant Jim Main for the Sheriff’s Office.

The airport implementation is part of a larger project for which the office received a $3.5 million federal grant last year. The office is replacing its existing digital mug shot system with a facial recognition system, and it will install facial recognition work stations throughout the state for use by other law enforcement agencies.

Because the office already had the funding and the facial recognition system on Sept. 11, Sheriff Everett Rice saw an opportunity to use the system to improve security at the airport. The office put together an interlocal agreement with the airport authority and the airport’s primary air carrier, which is responsible for security at the checkpoints. “Getting an agreement in place with everybody knowing everybody’s roles and how they’re going to be affected by the system was extremely important,” Main says.

With the agreement in place, the department built a database of images that includes the FBI’s top 10 wanted persons and the wanted lists from the U.S. Marshal, the state Department of Law Enforcement, county sheriffs and even the Royal Canadian Mounted Police. If the system alerts security personnel to a potential match between passenger and database, the personnel alert sheriff’s deputies who compare the images and check the passenger’s identification.

So far, deputies have not captured anyone in the database by using the system, but they have gotten one false identification. “False positives are part of it,” Main says. “It’s only a pointer system. It’s not 100 percent accurate, although, with all of the testing we’ve done with it, it’s been pretty impressive.”

Main expects the facial recognition software to perform well because it is in a controlled environment. “We have a choke point where the passengers come in one at a time, and we get a nice, clean image of them,” he says. “It’s going to be a lot more accurate than if you’re going from ceiling-mounted cameras that are pointing down at a 45-degree angle.”

Generally, airline passengers have been supportive of the facial recognition system in St. Petersburg-Clearwater Airport, but the ACLU still contends that the technology should not be used. “If the technology promised a significant increase in protection against terrorism, it would be important to evaluate its dangers and benefits in depth,” says a policy statement on the ACLU Web site (www.aclu.org). “But that conversation is beside the point when face recognition has been shown to be so unreliable as to be useless for important security applications. Face recognition at the airport offers us neither order nor liberty.”

Others are more willing to accept the use of facial recognition systems in airports, despite the technology’s flaws, if a chance exists that it could prevent another terrorist attack. “There’s always a trade-off between privacy and security,” Jain says. “If you want to feel secure and you want to make sure that the criminals don’t get into the airport or the county courthouse, then we have to be willing to compromise the privacy issue.”

Whether local governments consider implementing iris, fingerprint or facial recognition systems, they will have to deal with subjects’ concerns of effectiveness, privacy and data misuse. Although the technology is promising, it still has room for improvement. “Especially since Sept. 11, biometrics is a huge buzz word,” Sherwood says. “Everybody wants to get on board with biometrics, but you really have to have a plan before you can start implementing this kind of technology. You need to know what you’re trying to do.”