Putting a finger on it the loops and whorls of biometrics
This topic is sponsored by the Australian Government's National Innovation Awareness Strategy.
Automated measurement techniques to verify a person’s identity are attracting widespread attention. In Australia, Woolworths and the banking industry are already using fingerprint identification technology.
James Bond has known about it for years. Charlie’s Angels are also up to speed, as is the team at Mission Impossible. But for the rest of us, the idea of using fingerprint scans or iris scans to gain access to restricted places or information is still a well-kept secret.
But maybe not for long. Biometrics could be coming to a scanner near you!
People have always used individual traits for identification. In ancient times, the presence of scars, birthmarks and other unusual features helped minimise mistaken identify. Even today, we use techniques that have been around for centuries, such as passwords and signatures. But passwords are notoriously insecure, and signatures can be forged or ignored. Shop assistants, for example, often don’t bother to compare the signature on the back of a credit card with the sample provided by the purchaser.
The search is on for better ways of proving identity. As computer power has grown, so too has the idea that the automated capture, measurement and identification of distinctive physiological or behavioural characteristics could safeguard our identities and therefore our property and privacy, and could also be used to fight crime. The technologies now being developed for these purposes have come to be labelled 'biometrics', because they apply statistical methods to biological observations and phenomena. However, the discipline of biometrics is much broader than just identity verification. Biometrics plays a crucial role in agriculture, environmental and life science.
Fingering the issue
The most well-known biometric technology of all is the fingerprint we all know that the biggest mistake a criminal can make is to leave a fingerprint at the scene of the crime. If you look closely at the underside of your fingertips you’ll see dozens of swirling lines. These are made by minute, raised ‘friction ridges’ on the skin; their purpose is to give your fingers better grip in the way that car or bike tyres have ‘tread’ to keep them from skidding on the road. You can see similar friction ridges on the palms of your hands and the soles of your feet. The friction ridges form several macro-patterns, the three most common of which are the arch, loop and whorl.
Individual ridges also have distinctive variations, known as minutiae. These include:
- ‘ridge endings’, where the ridge ends abruptly;
- ‘bifurcations’, where a single ridge divides into two or more ridges;
- ‘enclosures’, where a ridge bifurcates and then rejoins, leaving a little island in the middle;
- dots, which are short fragments of ridges of approximately the same width and length; and
- spurs, which are short offshoots from a main ridge.
The arrangement of the ridges and their minutiae on the finger is random: probability theory suggests that the chance of two fingers having exactly the same arrangement is more than a billion to one. Indeed, in a hundred years of the systematic fingerprinting of criminal suspects and more than 100 million fingerprints later, no two have ever been found to be identical. Fingerprints are fully formed in the womb and remain unchanged throughout life.
In Australia, the use of fingerprinting in fighting crime was recently updated under the CrimTrac system. But it is not only the police who are excited about fingerprint biometric technologies: ideas for applying them commercially (eg, to control access to personal computers) are coming almost as fast as you can push a button.
The difference between identification and verification
The use of biometric technologies against crime mostly involves identification; whereas verification is more common in commercial uses. The difference between the two can be shown in the following examples. Imagine an automatic teller machine (ATM) that uses a fingerprint instead of a number as a password. The machine confirms your identity by comparing your fingerprint with the ‘reference’ fingerprint originally encoded into the card. That’s verification.
If a thief breaks into a house, he might leave behind a fingerprint. The question the police want to answer is: who does this fingerprint belong to? It can be checked against a database of criminal fingerprints; finding a match is identification.
In terms of computing power, the difference between verification and identification is important: comparing the fingerprint entered by the user with the reference fingerprint (verification) is a simple task. Matching a fingerprint with all those contained in a database of thousands or even millions (identification) requires considerable computer grunt. In most commercial applications of biometrics, the aim is to verify the identity of the user.
The potential applications of using fingerprints are being made possible by the development of automated finger scanning. Up until a few years ago, fingerprints were collected in the way we see in police movies: put the finger on an inkpad, then place it carefully on a sheet of paper. In the last decade or so, electronic scanners have been used to digitise the old, paper-based prints to form an electronic database. Now, technologies to scan the finger directly are developing rapidly.
Optical finger-scanners, which work in a similar way to a photo scanner, have been in use for a decade or so and are starting to be replaced by other methods. One of these is called capacitive scanning: it measures the electrical charge produced by the contact of the fingertip with an array of tiny capacitors mounted onto a silicon microchip. Since the ridges will make better contact with the capacitors than the valleys, this technique generates an image of the fingerprint that can be processed in the same way as an image produced by optical scanning. Ultrasound finger-scanners are also being developed.
Once the fingerprint image has been obtained it needs to be measured. In one approach, a computer algorithm a program designed to turn raw data into code that can be used more easily by the identification/verification software identifies minutiae points on the scanned print and ‘locates’ them relative to other points on the print. It then establishes a mathematical ‘template’ to serve as a reference. When the same finger is scanned at a later time perhaps when its owner wants to use an ATM the computer software compares the template, which could conceivably be stored on a microchip in the user’s card, with the newly scanned print.
Applications of finger scanning
Fingerprint verification is already being used on a limited basis so far to control access to personal computers, cell phones and ATMs. A quick search of the internet reveals a host of companies selling finger scanning devices and citing very low ‘false rejection’ rates and even lower ‘false acceptance’ rates.
Techno-visionaries predict applications for finger scanning far wider than merely access to the laptop or ATM. They foresee a time when the right finger in the right place will unlock car doors, open briefcases, verify identity over the internet, facilitate travel across international borders and prevent voter fraud.
But sceptics point to potential shortcomings. For example, fingerprinting has criminal connotations that will turn many law-abiding people away and some consumer resistance seems inevitable. Others worry that it could even provoke a wave of violent ‘finger snatching’, because possessing someone else’s fingerprint could be extremely lucrative.
The eyes have it
Meanwhile, technology companies continue to invest research dollars in other biometric options. Iris and retina scanning seem to have considerable potential: the patterns in both these parts of the eye are unique to the individual.
The retina is the innermost layer of the eyeball ‘wall’ and is criss-crossed by tiny blood vessels. As these vessels develop in the womb, they form a unique pattern that does not change over the individual’s lifetime; retina scanning can map, code and compare these blood vessel patterns. The iris, the coloured part of the eye, contains about 260 unchangeable characteristics compared to less than 40 in fingerprints that can be scanned by video camera, coded by algorithms and, later, compared. The chance of an identical match with a different eye is said to be about 1 in 1078, which is a very small chance indeed.
Of the two eye-scanning technologies, iris-scanning is the more likely to gain in popularity. It can be done at a distance of a metre or so in contrast to retina-scanning, which must be done quite close-up and is therefore likely to be more acceptable to the public.
Other biometric tools
We all have other unique characteristics that can be measured. Examples of these other biometric options include hand geometry, typing patterns and voice recognition (Box 1: Other biometric technologies for identity verification).
Biometrics-based identification and verification systems must deal with a host of privacy issues if they are to gain widespread acceptance. For some, the prospect of submitting body parts for detailed examination is enough to make them break out in a sweat, while amputees or the blind may not find certain biometric systems to be particularly user-friendly.
Meanwhile, some people worry that biometric data given for an innocent purpose, such as opening a bank account, will be used for other, more sinister purposes by governments or corporations. Another concern is the potential ‘hijacking’ of biometric data if transmitted over the internet, for example by criminals who would then use it to defraud individuals and institutions.
Such arguments must be weighed against the fact that the aim of most biometric systems is to increase privacy by requiring a more rigorous proof of identity than has been necessary in the past. If the system is robust enough, criminals will find that beating it is a difficult task. Nevertheless, the technologies present civil libertarians with many issues that must eventually be addressed.
Biometric systems face another crucial question: supposing they do bring an increase in security, will it be worth the financial cost? Advocates say the answer to this question is increasingly ‘yes’ and that the role of biometric technologies in our lives will grow quickly. But if the sceptics are right and such enthusiasm is not yet warranted, James Bond and his peers in the police forces may remain the biggest users of the technologies for some time yet.
Posted October 2001.