Facing a biometric future

By Jo Twist
BBC News Online technology reporter

By the middle of next year, the British passport could be quite different to the document currently waved at immigration.

Tests on fingerprinting and iris scanning are underway

As part of growing concerns about national and global security, immigration and asylum, as well as plain old identity theft, the official UK travel document will not just carry a photograph, it will also have a microchip in it.

The chip will hold biometric data - unique physiological or behavioural characteristics - and will be mandatory in passports renewed from 2007/8.

From mid-2005, this data will be in the form of a digitised photograph which will be matched with the passport's chip.

The photo and the chip will have the digital signature of the UK Passport Service (UKPS), in an attempt to protect against possible fraud.

One other biometric identifier, iris pattern or fingerprints, will also eventually be stored on the chip and trials are underway in the UK to decide which one is used.

According to Bernard Herdan, chief executive of UKPS, "biometrics are an essential element in the UKPS drive to strengthen identity authentication and reduce identity fraud and related crimes."

Facing facts

Although "facial recognition biometric data" all sounds very sci-fi, it is in fact the least accurate biometric identifier there is, according to experts.

It will, however, be good enough for entry into the US without a visa.

In May 2003, the International Civil Aviation Organisation (ICAO), approved facial recognition as the global standard for biometric data, with the option of including a secondary biometric, such as a fingerprint or iris image.

Iris scanning is thought to be the most accurate biometric

But do not expect to see machines picking out suspected terrorists in the crowd just yet.

"The current encoding of photographs digitally into passport chips is almost entirely for the purpose of ultimate visual comparison by a human," says Professor John Daugman.

And although humans are not very good at that, he says, machines have an even harder time.

Based at the University of Cambridge, the Professor developed the international algorithms used in iris recognition technology being tested by the UKPS.

If a machine were to take over in order to match passport images against a database of pictures, Professor Daugman says the rate of error would still be five to 40%, even with the best algorithms.

"Today's computer algorithms for automatic face recognition have a truly appalling performance, in terms of accuracy," he says.

"Even small variations in pose angle, illumination geometry, viewing angle, and facial expression have catastrophic effects on algorithm accuracy," says the Professor.

These factors mean there are more variations in your face than there are between your face and another.

So, machines will be able to verify identity purely by matching the face on the photo with what is on the chip. No big technological leap there.

What it will not be doing is searching and matching faces from a database of potentially dangerous individuals.

Do the eyes have it?

Fingerprinting and iris scanning could be a far more accurate test than facial recognition.

The key to the power of biometrics to identify people is the amount of randomness and complexity that the biometric contains, according to Professor Daugman.

"Face recognition is inherently unreliable because there isn't nearly enough randomness in the appearance of different faces.

Fingerprints are vastly better biometrics than faces, he says, but better still are iris scans.

"Irises have about 249 degrees-of-freedom," explains Professor Daugman, "whereas faces have only about 20 degrees-of-freedom (independent dimensions of variation), and fingerprints have about 35.

"This makes a huge difference in the uniqueness of each one."

In January 2004, the UKPS began a six month test of the recording and collection of facial, iris and fingerprint recognition involving 10,000 volunteers.

It is testing not only how people feel about having this data collected, but also how feasible it is to collect this information in the first place, practically and financially.

The results will feed into the UKPS passport plan, but also the wider scheme for national identity cards.

Dr Tony Mansfield of the National Physical Laboratory and co-author of a key study on the use of biometrics, says the technology is good enough to start the trials.

But there will be some stumbling blocks and no biometric method offers 100% certainty.

ID PLANS 2008: 80% of economically active population will carry some form of biometric identity document Estimated cost of £3.1bn Consortium of companies in UKPS trials led by SchlumbergerSema include NEC, Identix, Iridian Source: Home Office

"It will still improve over next few years, but the technology is capable of being used, even though there are still some areas of uncertainty."

He thinks these areas of uncertainty, including acceptable margins of error, and the overall cost of a such a scheme, will be clearer after the UKPS trial.

As well as the practicalities of getting biometric data from people, the fact they might not like doing it could prove difficult.

Iris scanning is currently used at Schiphol Airport in Amsterdam, Toronto, Vancouver, and six other Canadian airports.

By next summer, 10 UK airports will be using iris scanning technology, with a planned roll-out awaiting approval for all 141 UK ports, says Professor Daugman.

But with more than 60 million people travelling through Heathrow each year, even if an iris scanning system with 99.9% accuracy was used, it could still fail to recognise 63,000 individuals a year.

Ultimately, these hi-tech solutions are only as good as the existence and the size of the databases they are compared to.

"All of this identification power by iris patterns could only help thwart terrorist attacks if terrorists were already enrolled in a database as terrorists," says Professor Daugman, which, he adds is "highly unlikely".

"More generally, and in a modest way, having a means to know reliably who is who - whilst not their intentions - is surely some valuable contribution to national security."