industry focus
How "Minority Report" affects the majority
Future Proofing the World of Biometrics in a Mobile Age
By Isabelle Moeller, Chief Executive, The Biometrics Institute
It may be the stuff of science fiction and the dystrophic movie Minority Report, but biometric technology, the way in which unique body landscapes authenticate our identities—whether it is a fingerprint, vein pattern, or iris or cornea scan—is no longer the future, but very much the present.
Almost 200 experts from across the world met in October in London at Biometrics 2014 to discuss the opportunities that the technology presents, but more importantly, the current and future threats as mobile technology continues its unrelenting journey into our everyday lives. Retail—the bellwether barometer of economic success or failure—is a growing area where biometrics will be increasingly tested and used.
Biometrics in Retail
We are seeing an increased interest and take up of biometrics in the commercial and consumer markets, which was confirmed by the Biometrics Institute Industry Survey 2013. Biometrics in retail could see two major applications—(one) increasing levels of security in the retail environment or (two) supporting marketing and operations activities.
In the security space we see biometrics being increasingly used in the following ways:
■ Payment authentication at POS or on smart devices to help prevent fraud.
■ Method to assist in detecting and preventing unwanted behaviour in faster and more efficient ways.
■ Means to protect customers, staff, and assets.
■ Method to identify known suspects, such as shoplifters and violent offenders.
■ Vehicle to detect crowds, flash mobs, and queues in order to manage dangerous situations.
■ Means to identify authorised individuals.
In the retail marketing and operations environment, biometrics can perform anonymous facial analysis for multiple purposes, such as:
■ People flow and traffic patterns.
■ Wait times.
■ People demographics.
■ Data to enhance interior design, plan staffing resources, align merchandise placement, display advertising, or intelligent signage.
■ Age range and gender of a person looking at a digital sign to trigger an audience-specific message, including advertising and other announcements.
■ Count, age range, gender, viewing time, and other statistics for persons looking at signage.
The benefit for retailers is that biometrics offer a convenient and additional layer of security, help to prevent fraud, and create a better customer experience. But there are challenges, not the least that of privacy in an increasing public world where many people live their lives on social media.
Promoting Responsible Use
The Biometrics Institute was set up in 2001 to promote the responsible use of biometrics as part of an independent and impartial international membership organisation. This mission has not changed in thirteen years, an amazing foresight by the founding directors and members. It is essential that any implementation of the technology first addresses potential privacy impacts. The Biometrics Institute has therefore developed privacy guidelines to advise members on its proper use. This addresses issues such as:
■ Enrolment of biometric data with informed-consent only.
■ Adherence to laws, guidelines, and best practices.
■ Policies surrounding template storage and deletion.
■ Informing the population visibly about the technology and data use and sharing results through a privacy impact assessment.
We are providing an international forum for our over 155 members to share their experiences and best practice in a user group, where the board of directors represents a majority of users, such as Immigration New Zealand, the Metropolitan Police in the UK, and the FBI in the US. Our membership also involves suppliers and academia bringing together all parts of the industry.
Privacy protection is a critical component in the responsible use and development of biometric technologies. As an industry body, we obviously want to see growth for the industry. We believe, however, that this growth is only going to be successful if biometrics are implemented with due consideration to privacy. We have therefore issued the Biometrics Institute Privacy Guidelines, a best-practice guide outlining seventeen principles including, for example, the need for consultation with those affected by the technology, informed-consent and voluntary use, as well as security of the biometrics data.
Another area we focus on is biometric vulnerability assessment. We have formed an international Biometrics Vulnerability Assessment Expert Group (BVAEG) that exchanges knowledge and information on this very important, but also sensitive, topic and aims to raise awareness about its importance of vulnerability testing.
International Conference
We decided to partner with Elsevier for the “Biometrics 2014: The Future of Identity Starts Here!” conference and exhibition that was held in London from the 21–23 October 2014 as it combines two very strong brands who can service the industry in a unique way. It also gave us, as the industry group, a fantastic international platform to discuss the future of identity and the role biometrics can play in this space.
We were in charge of the programme development and secured over sixty amazing speakers from around the world. We also created a new format focusing on discussion and even an “un-conference” style session where delegates dictated and discussed the content, which helped make it a not-to-be-missed event to help influence the future of identity.
The exhibition attracted approximately 1,200 visitors, and there were some interesting new things on offer on the exhibition floor that drew in the crowds, including a range of free seminars providing invaluable insights from the suppliers.
The conference programme was developed in close consultation with our members and the incredible network of people we have around the world, and it certainly reflected the current status of the industry.
This has also been confirmed by our recently released “Industry Survey 2014” suggesting that the adoption and use of biometrics on mobile devices is seen as the most significant development in the biometrics world over the last twelve months and will remain so in the near future. We were therefore thrilled that Samsung Electronics appeared at this biometrics and identity-related event, providing evidence of the unparalleled outreach of this conference.
The discussion on Government identity management is continuing and some important lessons can be shared with the commercial sector in this field. The event also offered a whole track on biometrics in commercial sectors, such as retail, banking, and hospitality with Citi, Wells Fargo Bank, and Mastercard. We are certainly seeing a growing interest for biometrics in the financial sector, but there are some important issues that need to be addressed to make this happen.
The conference finished with the big privacy debate involving interviews and discussions with privacy experts as well as privacy advocates. This was followed by the vulnerability assessment session involving the Chaos Computer Club who, you may remember, attacked the Apple iPhone 5. This was a first. I don’t think we have ever seen an event that had everyone who is involved in this industry together in the one place.
What the Future May Hold
I am no crystal-ball reader; however, the future does look interesting for the evolution of biometrics. To look forward though, we have to look back at the break-neck development of converging technologies. Who would have thought five years ago that mobile devices would be this disruptive? Consequently, mobile is going to continue to be the hot topic for the sector, and I personally think we are going to see biometrics evolve in many places where secure transactions are needed.
Biometric technologies are extremely valuable, but must be deployed with security and privacy front of mind. The Biometrics Institute is taking an active role in promoting the responsible use of biometrics by bringing together the users, vendors, academics, and privacy experts to facilitate this important mission.
There are numerous “juicy” themes, which are at the heart of the industry, including:
■ The big privacy debate.
■ The importance of vulnerability assessments.
■ The new mobile paradigm.
■ Opportunities for commercial applications in retail, hospitality, and banking, including identity as the new money and for secure customer conference.
■ Biometrics in Government including borders and travel, law enforcement, and use in developing economies.
The Biometrics Institute will continue focusing on these themes and any new ones that may emerge at the many biometrics-related events we regularly organise around the world.
Future Safety
Biometric authentication has the potential to ease the burden of security given its simplicity and usability. All security technologies have flaws, including PINs and passwords, and when subject to a determined attack, none will guarantee absolute security. Most biometrics are not “secret” and should be used with a secure second factor. Security relies not only on one factor, but on combining them, such as relying on a PIN and fingerprint. There are a number of technologies, both software and hardware, that can be used to detect such spoofing attacks.
When we provide a biometric or other sensitive personal data, it does come down to a question of trust and control. Governments are typically required to put very robust trust models in place to ensure end-to-end security is provided, through, for example, Government-accredited networks, compliance processes for privacy and record keeping legislation, assurance mechanisms involving partnerships, and processes around access to data.
Can we future-proof biometric technology? That is a difficult question to answer without having that crystal ball referred to earlier. Where some organisations are involved, that end-to-end security and assurance just might not exist—what happens with your face or fingerprints in that environment is potentially riskier and requires far more than just a technology solution.
Another question is control and data retention. What happens to that biometric? Who looks after it? At what point in time is it destroyed? After a person leaves school or a particular job? What processes exist for managing any compromise of identity data, for re-establishing confidence in identity, for redress?
We have seen many successful implementations where biometrics has helped to transform identity management, privacy protection, and identity security. Applications like electronic passports facilitating a better and more secure travel experience or large-scale identity management systems, such as the Unique Identification Authority of India (UIDAI) scheme that facilitates the delivery of Government’s services to the poor and marginalised.
India’s adoption of biometrics is nothing short of an audacious technological mission as the country is building a near foolproof database of personal biometric identities for nearly a billion people, something that has never been attempted anywhere in the world.
Poorer Indians who have no proof to offer of their existence will leapfrog into a national online system—another global first—where their identities can be validated anytime, anywhere in a few seconds. The UIDAI has already registered 200 million members, less than two years after the first enrolment.
If we get the privacy and vulnerability issues addressed and create trust and control for the consumer, biometrics has a great future.
Biometrics has come a long way in just over a decade. On a micro-transactional level, the technology is already playing a role in making buying consumer items safer. But on a macro- or bio-economic and political level, as the example given about India illustrates, biometrics are helping to improve lives and bring people out of poverty—where big Government meets big demographics head on.
Like many technologies, there may be irreconcilable issues of privacy and technological advancement and compromises may need to be agreed to ensure minimal impact on individual liberties as we move into a more wireless and cashless transactional world. That is why it is so important that independent organisations, such as the Biometrics Institute, exist so that this grown-up debate can be conducted transparently and consensually, and where both lobbyist and libertarian can have an equal voice on one of the biggest issues facing the modern world—a world that is literally at our fingertips.
More information on this fascinating subject can be found by visiting biometricsinstitute.org
Bio:
ISABELLA MOELLER is chief executive of the Biometrics Institute where she has worked since May 2002. After almost ten years in Australia, she is now based in London. Moeller has extensive experience in the formation and management of new associations, event development, and the creation of global expert networks.
She has managed many Government-funded projects successfully, including the Biometrics Vulnerability Assessment Project that was co-funded by the Australian Department of Prime Minister and Cabinet and the Biometrics Institute Privacy Code. Moeller is supported by a unique board of directors consisting of subject-matter experts, including the FBI, Metropolitan Police UK, and New Zealand Immigration and several expert and sector groups that are sub-committees of the Biometrics Institute. She can be reached at Isabelle@biometricsinstitute.org.
