Biometrics is about trade offs, not a silver bullet

“Confirm fingerprint to continue.”

Ever seen this message on your phone? Congratulations, you’re using biometrics. Fingerprints and facial matching aren’t just the provenance of law enforcement anymore. As they become more common on personal electronics like cellphones, more organizations are trying to figure out how to implement them, and which ones are right for that scenario.

But in the case of the government, is any one biometric — fingerprint, facial, iris or voice recognition — the right one?

“There is no one perfect biometric modality,” Arun Vemury, director of the Biometrics Technology Engine at the Homeland Security Department told the Federal Drive with Tom Temin. “It really comes down to what are you trying to use it for? What are the needs of the specific operations, so you can find the right setup, technologies and fit?”

Advertisement

He said the expansion of biometrics is all about tradeoffs between three categories: what you know, what you have and what you are.

For example, it might seem like fingerprints are more secure than passwords. After all, passwords can be cracked through brute force or man in the middle attacks. But no one else has your fingerprints, or your face, right?

“One thing people don’t realize about biometrics is that technically, they’re not secret,” Vemury said on Identity Governance Month. “We walk around and show our face to the world. We leave our fingerprints all over everything we touch.”

Ideally, people work as hard as they can to keep their passwords and PINs secret and difficult to figure out. But they don’t take the same precautions with their biometrics.

Vemury said biometrics are very similar to other online or IT systems. They have similar cyber risks, they’re just exploited in different ways. After all, it only took a week for a security firm to crack the facial recognition program on the new iPhone.

“We’re in this situation where, as technology comes out, and honestly as it becomes more pervasive, more people will be incentivized to figure out how to beat it,” Vemury said. “Not only because it’s there and it can be beaten, but because the targets on the other side become more enticing as this stuff starts to get used beyond government applications but now for financial services and other places where people could find financial benefit. They’re going to get more creative, more people are going to look at it, they’re going to figure out how to beat it.”

And that’s not the only trade off involved in biometrics. DHS is one of the largest users of biometrics in the world, but as it implements these new technologies, it’s not always receiving the cost benefits that it should.

“When you put a technology out, people don’t actually understand how to use it. And these errors start to accumulate,” Vemury said.

So DHS sees new costs in training its employees to use these new technologies, and new costs in the support it takes to fix these errors.

There’s also a trade off between security and facilitation. The more secure a biometric system is, the more slowly it moves. And that can be a problem in situations like airport security. The answer, Vemury suggested, could come in the form of a combination of technologies.

That’s one of the possibilities he intends to explore at an upcoming biometrics technology rally. Vemury said vendors will be given a small space, 7-8 square feet, in which they can install any combination of technologies they want. They are also encouraged to use any strategy they want to encourage people to look at cameras or in a certain direction in order to facilitate capture of the biometrics.

Then between 300 and 500 people will pass through that space. Vemury wants to see which combinations of technologies and strategies yield the highest number of matches, and how long it takes to do so.

“The intent is to help provide better feedback to industry about ‘this is how people really interact with your technology,’ so that they get an understanding of how they can continue to improve on not only just a better camera, but a better user interface. We want to use this as a way for us to get a better understanding of what the state of the art is, or what the creative thoughts are out there,” Vemury said.

Copyright © 2019 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.