Once the stuff found only in James Bond movies, biometrics identification technologies based on biological features-is rapidly moving into the mainstream to help prevent unauthorized access to ATMs, computers, buildings and other important assets.Propelled by cheaper and better software and hardware, as well as enhancing security and eliminating pesky passwords, biometrics, many experts believe, will become increasingly popular during the next few years.
"PINs and passwords can be lost, but it's hard to misplace your hands, face or eyes," says James Wayman, director emeritus of the U.S. National Biometrics Test Center and a biometrics researcher at San Jose State University in San Jose, Calif.
The biometrics market has skyrocketed, rising from just US$6.6 million in 1990 to $63 million in 1999, according to Wayman. During the same time span, the average unit cost for biometrics devices dropped from more than $5,000 to less than $600. But as biometrics gain momentum, many CIOs still wonder which of the major technologies-fingerprint, iris or facial recognition-is best. Others worry about how much of a trade-off between security and personal privacy people will be willing to accept.
Fingering Cheats
Fingerprint readers are the most widely used and least expensive biometrics technology. Complete systems can cost less than $100, says Martin Reynolds, a vice president and research fellow at Dataquest Inc., a technology market research company in San Jose, Calif. "They're also reliable and very rugged," he adds. The units are so reliable, in fact, that they will accurately match fingerprints even when a user gains weight or ages.
In Connecticut, fingerprint scanning already helps the state government snare welfare cheats. The Connecticut Department of Social Services uses a Polaroid identification system that creates digital fingerprint images of welfare recipients. While the system records and matches the fingerprints (to determine whether an individual may al-ready be receiving benefits under another identity), the operator photographs the ap-plicant and records the person's signature. The matching process takes less than five minutes, after which the applicant receives a photo ID card. To safeguard against false readings, a fingerprint expert (in this case, a Guilford, Conn., police officer) reanalyzes questionable matches.
The program, which launched in 1996, has saved taxpayers approximately $23 million in its first three years of operation, says David Mintie, the project's program manager.
The Eyes Have It
Although fingerprint scanning is cheap and generally accurate, it's not as foolproof as some other biometric technologies. According to Reynolds, various types of fingerprint reproductions (latex moldings, for one) have fooled readers in the past. That loophole could pose a big problem for banks, government agencies and other organizations that require ironclad security, he notes.
Then there's the performance problem. Fingerprint recognition technology can bog down when connected to a massive database. Leisurely performance usually isn't a problem for small businesses or government agencies with captive clients. But for organizations with large databases and significant customer service commitments, fingerprint scanning is often too slow. But other technologies purport to be far faster. Bill Voltmer, president and CEO of Iridian Technologies, a Marlton, N.J.-based biometrics vendor that specializes in iris recognition technology, estimates that an iris recognition system can sort through 100,000 records in two or three seconds, while claiming that a fingerprint system would require at least 15 minutes to perform the same task.
When scanned for identification, the iris serves as a kind of human bar code-a unique pattern of connective tissue and other features. In the entire human population, no two irises are alike, even between identical twins.
Customer convenience, enhanced security and rapid verification convinced Houston's Bank United to test Iridian technology in its next generation ATMs (a recent acquisition by Seattle-based Washington Mutual may change those plans). "We wanted to use this technology to replace both the ATM card and PIN number," says Ron Coben, Bank United's executive vice president for community banking. Bank United has operated its "EyeTMs" in Houston, Dallas and Fort Worth, Texas, since 1999. "We have learned that iris recognition is consumer-friendly and easy to use," says Coben.
Iris recognition's biggest disadvantage has been its high cost. But prices have fallen dramatically during the past few years. Iridian, for example, recently introduced a low-end iris recognition product, Authenticam, which will sell for $299 as a single unit. Regardless of cost, iris recognition offers an important intangible benefit, says San Jose State's Wayman. "Many people associate fingerprinting with criminal activity." Iris recognition is a hands-off technology that works at distances of up to several feet and is less intrusive than fingerprint scanning. "It's much more readily accepted by users," he says.
Face-Off
Facial recognition is another biometrics technology that's widely considered nonintrusive. It's so passive, in fact, that the systems can scan people without their knowledge. Gartner Dataquest's Reynolds notes that many casinos, and even some police departments, use a combination of security cameras and facial recognition software to match faces against databases of known troublemakers.
Facial recognition works by isolating human faces in still pictures and measuring an array of facial characteristics, such as the geometry of a person's eyes, mouth and nose. Using a proprietary algorithm, the system compares the image to database-stored photos for probability-ranked matches. And certain facial aspects don't change, even with age or weight fluctuations.
Besides spotting potential pests, facial recognition can also provide access verification. San Francisco-based InnoVentry uses technology from Jersey City, N.J.-based Visionics in its cash management machines, which reside in supermarkets, convenience stores and other retail outlets in 20 states. To protect against fraud, the system snaps a picture of each user and compares the image to a database of about 800,000 customers. The process takes approximately four minutes on the user's first session and about 90 seconds on return visits.
Although generally satisfied with the technology's performance, Frank Petro, InnoVentry's chairman and CEO, admits that being an early adopter has presented some challenges. "We had to figure out a way to get people to look at the camera properly," he says. Light control also proved to be a problem, since too much light entering the camera lens can reduce recognition accuracy. "But you learn how to control these things by creating better user instructions and positioning units more carefully," says Petro.
Like other biometric technologies, facial recognition system prices have fallen rapidly. Visionics estimates that a bank can add the capability for less than 10 cents per transaction. In a corporate setting, costs range from about $50 to $70 per seat.
Brave New World
As biometrics products become simpler and cheaper, the technology has begun to turn up in a number of places including PC keyboards, notebook computers and mobile phones. Acer America, for example, has incorporated a fingerprint reader into its TravelMate 739TLV notebook. "The technology is designed to prevent thieves from accessing critical data," says Arif Maskatia, Acer's vice president for advanced technology. The device could also verify a user's identity for online purchases, although no Web shopping service currently supports the technology. For notebook users who wish to retrofit their systems, Compaq Computer Corp. recently introduced a fingerprint reader that works on any Windows notebook with a PC card slot.
Facial recognition technology may also be headed into the mainstream. Visionics already offers a Pocket PC/CE version of its FaceIt facial recognition technology. The software works on a variety of handheld devices, including Casio Computer Co. Ltd.'s Cassiopeia, Hewlett-Packard Co.'s Jornada, and Microsoft Corp.'s Mi-Pad, which all feature built-in or attachable video cameras. The next generation of camera-fitted mobile phones could take advantage of similar software.
Voice recognition, long touted as a convenient, nonintrusive security technology, could also come of age in the next three to four years, predicts Patti Cloar, a senior industry analyst with Business Communications Co., a technology research company in Norwalk, Conn. "Right now, the software isn't refined enough. Background noise and hoarse voices can affect reliability and accuracy." But rapid advancements are being made in speech algorithms and related technologies. "People feel very comfortable using their voice," says Cloar. "There will probably be very little user resistance to voice systems."
While many industry observers believe that people will gladly swap their passwords and PINs for biometric access, the growing availability of advanced security technology has some people worried. San Jose State's Wayman, for instance, wonders where biometrics is leading us. "On one hand, you have these great tools for computer security and user authentication, which will enhance user privacy, but on the other you have systems that can spy on people without their permission," he says. "It's certainly a new world we're entering. What we don't know is what sort of world it will be."
