The need for best practices in order to build inclusive futures and protect civil liberties.
It is fair to say that biometric technology is well proven and that standardised data security approaches are, in the main, very effective if implemented correctly. Therefore, the questions for policy makers today are more of an operational and ethical nature. Proportionality too is critical to avoid over-investing or over-engineering systems.
Discussions have moved on to cover critical issues such as how best to apply the multiple biometric options in specific identity-based scenarios, to how to contain cost, and the best approaches to ethical and responsible deployment. Here, the issues are both complex and diverse – from siloed approaches within governments, to the ever-present technical and logical challenges of enrolment, data management (centralised or de-centralised), systems integration and future proofing.
In the interdependent and interconnected biometrics environment, it is important that these (and other considerations) are understood by policy makers.
Which brings us to the need for a set of best practices – hard won and clearly defined from experience of successful (and not so successful) deployments across the world. There is no one-size-fits-all solution, with different biometric modalities and technologies suitable for some applications more than others.
The right biometric system is the one that fits the use case and delivers the desired outcome within the societal, ethical, operational and budgetary context each agency and government finds itself subject to.
The critical role of identity
A legally recognised identity is one of the most important human rights in the modern world – as enshrined in article 16.9 in the UN Sustainable Development Goals: “to provide legal identity for all, including birth registration” by the year 2030. It was also the impetus for the World Bank Group’s launch of the Identification for Development (ID4D) initiative in 2014.
Around the globe, citizens depend on government-issued identity documents to prove they are who they say they are, and to undertake commonplace transactions like opening a bank account, registering for school, obtaining formal employment, or receiving social welfare.
Identity is a validation of who we are. While we only need to expose just enough to enable secure and trusted authentication, there is little doubt that ID is becoming increasingly essential for full participation in our daily social, working and political lives.
This is the case whether we’re streamlining citizen access to digital government services or delivering unique, personalised digital identities that make it easy for companies to know and serve customers better. It is nothing short of a strategic necessity for governments and commercial organisations everywhere.
Ultimately, citizens throughout the world depend on government-issued identity documents to access a host of health and welfare programmes, education, financial services, and to move smoothly and securely across borders.
The need for legal, trusted identity
In response to growing citizen demand, governments around the world are fast tracking the shift to digital service provision. But, with multiple identity providers offering to host and manage digital identities for the general public, the root identity – the single sovereign trusted identity upon which all others are based – must start with government.
Indeed, the United Nations believes governments have a responsibility to develop and anchor legal identity, with its Sustainable Development Goal target 16.9 stating: “By 2030, provide legal identity for all including birth registration.”
Trust is critical in the digital ecosystem. And, as custodians of the ‘root’ identity, governments need to build their digital identity strategies in a manner that ensures they can retain control of national services and transactions, protect their citizens and allow individuals to use their derived digital identities as access points to commercial services – without exposing them to theft, misuse or attack.
This is particularly true when it comes to the collection, management and use of biometric data. Government, border management and law enforcement use cases typically require the development of biometrically-enabled identity. As such, there is a strong argument that they possess a considerably more legitimate reason to create and maintain biometric databases than private enterprises.
At the most fundamental level, the effective development of a secure and trusted identity relies on three pillars – all of which increasingly utilise the individual’s biometry:
• The creation of the root identity within a well-functioning civil registration and vital statistics (CRVS) system based on a unique set of characteristics (be that biometric or biographical data).
• The creation of a secure, government-issued physical document, such as birth certificate or passport, by which the individual can seek to ‘prove’ their identity.
• The creation of a digital ‘mobile’ identity as a convenient, derived credential that enables secure online interactions with governments and third-party services.
There’s more to it, of course. Such as ensuring that a biometric record taken at a particular point in time is tied to the root identity – for example when applying for a new passport, during an interaction with law enforcement or adding biometrics to authenticate access to a state-run welfare programme. Here, the ability to tie back to the root identity is critical in ensuring both accuracy and security, and requires a clear set of processes whatever the application.
Whether embarking on a government-driven centralised system in which state-issued digital ID serves as the basis for all public and private sector transactions, or initiating a federated model of multiple government-endorsed digital identity providers, the definition of what constitutes official legal identity should always remain the purview of the state.
The evolution of biometrics
Stepping back slightly, the automated biometric systems we know today first began to emerge in the latter half of the twentieth century, enabled by the growing capabilities of modern computer systems. The field experienced an explosion of activity in the 1990s and began to surface in everyday applications in the 2000s. Today’s biometrics systems are highly integrated, incredibly sophisticated and rapidly growing in functionality, ease of use and security.
In Europe, the European Union’s Eurodac serves 32 nations in Europe and offers a biometric identification system for asylum seekers. Eurodac was the first biometrically enabled system commissioned by the European Union (EU), and the first multinational biometric system in the world.
Looking beyond Europe, Aadhaar, the world’s largest biometric ID scheme, developed by the Indian government, manages staggering numbers of citizens. Over 1 billion people have been enrolled in the scheme since its 2010 launch to access a variety of government services following the submission of their biometric data. The scheme is being expanded into the private sector to provide access to a growing range of enterprise services.
So too in Uganda, where a countrywide biometric identity verification programme for more than a million asylum-seekers and refugees in Uganda has recently been completed by the UN Refugee Agency UNHCR, World Food and Uganda’s Office of the Prime Minister (OPM) – using some 68 verification sites across the country.
The list goes on.
In the consumer arena, it’s predicted that nearly all smart devices including mobile phones, tablets and wearables will have some form of biometric security enablement by 2020. And, according to a recent report from Good Intelligence, by 2021, 1,9 billion bank customers will adopt biometrics for a variety of financial services, including ATM cash withdrawals, accessing digital bank services through IoT devices, and mobile bank app authentication.
Tens of millions of Apple Pay and Google Pay customers are already familiar with this kind of fingerprint (or facial) biometric payment functionality, of course. But it’s also coming to credit and debit cards – with both Visa and Mastercard piloting ‘on card’ biometrics that capture and match the individual’s fingerprint to authenticate transactions as an alternative to a PIN code.
Another compelling example of the growth of biometrics in the consumer world comes from China. On ‘Singles Day’ (11 November 2018), the biggest day of the year for retailers in the country, Alibaba Group online retailer, Tmall, conducted 60,3 percent of its CNY213,5 billion ($30,7 billion) in business using biometric face or fingerprint identity verification.
Biometric use cases
Using physiological or behavioural characteristics is considered one of the most effective ways to prove an individual’s identity. The biological traits of each human being are unique and therefore very personal. Since every individual on the planet possesses unique physiological features that can’t easily be swapped, shared or stolen, biometrics has the potential to accurately identify someone with as near 100 percent certainty as is able to be achieved today.
This kind of functionality is particularly effective in a centralised database environment, and for government applications or government-sponsored programmes. By contrast, in the enterprise sector, the task is typically one of authentication rather than identification. In both environments, biometrics has a key role to play.
The following illustrate the key benefits of using biometrics within both identity and authentication contexts:
To prove identity: The use of a secure, accurate biometric, rigorously verified against the holder of a passport or ID card, can add important assurance on identity, in addition to any checks on the authenticity of the document itself. Biometrics, therefore, play an important role in preventing identity theft or fraud.
To enhance security: Biometric authentication offers a higher level of security than other methods of online identification. Between social media accounts, emails, application and services, the average person might have upwards of 20 different identities. Trying to keep track of our various logins, passwords and PINs is an almost impossible task – forcing people to use the same password/PIN for multiple uses, which makes them vulnerable to hacks. Biometrics makes having to memorise multiple passwords a thing of the past.
To improve customer experience: Consumers/citizens want an improved experience. We all want user-friendly and highly secure ways to undertake our daily life tasks, but traditional forms of authentication can feel clunky and inconvenient. Biometrics can go a long way to eliminating the complexity and time involved in securely boarding an aeroplane or cruise ship, moving between borders, paying for products and services, and more.
To enable financial inclusion: Supports the next wave of financial inclusion. Globally, about 1,7 billion adults remain unbanked – without an account at a financial institution or through a mobile money provider (Global Findex database, World Bank, 2017). Often as a result of the lack of appropriate documentation to prove their identity, biometrics offers significant potential to address unbanked populations. The Aadhaar system is a good example.
To manage population movements: Addresses migration and population movements. Biometrics offers a truly transformational opportunity to address today’s growing migration challenges – not simply to monitor population movements for border control and security purposes, but to provide previously undocumented migrants with an identity to access support services.
Biometrics, artificial intelligence and machine learning
For some, the marriage of biometrics and machine learning offers infinite possibilities to develop a host of frictionless and secure services. For others, particularly civil liberties groups, such developments can cause concern.
In China, for example, we are seeing examples of big (behavioural biometric) data collection and analysis, aided by artificial intelligence (AI) algorithms becoming commonplace in policing strategies. We have also seen questions over proportionality, with media reporting the Temple of Heaven Park in Beijing has trialled toilet paper dispensers with facial recognition to limit the number of sheets being dispensed.
In contrast, in regions where stricter individual privacy legislation is enacted and enforced – such as in EU with its GDPR – there are constraints as to how far such technologies can be deployed.
Whatever the regulatory environment, there is no doubt that AI will combine with biometric identifiers to drive a huge range of services. Analyst house, Gartner, reports that over the next few years, advances in AI will lead to increasingly sophisticated facial recognition technology – particularly useful in identifying lost children or elderly citizens. By 2023, there will be an 80 percent reduction in missing people in mature markets compared to 2018, due to AI face recognition.
Although current facial recognition is limited in application, the report says, the speed of recognition using one-to-many matching, even in large sample sets, is less than 600 microseconds.
On a more commercial note, a recent study by fintech researcher Autonomous NEXT showed how identity verification powered by artificial intelligence could reduce the costs of Know Your Customer (KYC) and Anti-money Laundering (AML) processes by 70 percent, while speeding them up by 80 percent.
Today’s behavioural biometric technologies can capture more than 2000 parameters from a mobile device, including the way a person holds the phone, scrolls, toggles between fields, the pressure they use when they type and how they respond to different stimuli that are presented in online applications. Indeed, by 2022, 80 percent of smartphones shipped will feature on-device AI capabilities (vs. 10 percent in 2017). It is precisely this kind of AI-powered analysis – carried out with due regard to ethics and privacy, and when opt-out practices are handled correctly – that sets AI-driven behavioural biometrics apart from more conventional approaches; offering tremendous opportunities to accurately verify and authenticate online users.
Biometrics in practice
The following section highlights key areas of adoption for biometrics across the world today.
Frictionless travel
Innovative uses of biometrics have been showcased at many airports around the world to help boost efficiencies and speed up the complete check-in-to-boarding process. As early as 2013, some 3000 British Airways passengers flying from London Gatwick were able to use iris scans to bag drop, clear security and board the airplane without any additional documentation.
In an example of a commercial roll-out, the automated PARAFE system (Automated Fast Track Crossing at External Borders), first introduced in 2009 and based on fingerprint recognition at Paris-Charles de Gaulle airport, has been updated. Now evolved to utilise facial recognition, close to 100 automated control eGates implemented across Paris-Charles de Gaulle and Paris-Orly airports give passengers the ability to cross through the new gates faster – saving appreciable time both on departure and arrival.
While the vision of document-free travel has yet to be totally realised, biometric trials or even full roll-outs are well underway. In Europe, 18 countries or more are already using facial biometrics, allowing 200 million passengers to cross borders using their face. In Middle East and Asia, multimodal and iris approaches are popular. Today 500 million passengers across the world are crossing borders using their face.
Secure borders
One of the first, and certainly most enduring use cases, for biometric identity systems is border management. Some, like the US IDENT systems, are built around an Automated Fingerprint Identification System (AFIS) to check the fingerprints of an individual seeking to enter the country against watch lists of known or suspected terrorists, criminals and immigration violators. Others, like the EU’s Eurodac system, have been designed to address specific border control and population movement issues in addition to supporting law enforcement activities.
Humanitarian aid
Biometric identifiers are finding a ready market in the humanitarian aid arena. In the recent Rohingya crisis, where an estimated 688 000 refugees flooded across the border from Myanmar, humanitarian agencies and the Bangladeshi government used biometric identification systems to manage the response. Biometrics continues to be a useful, if sometimes controversial, tool in relief operations.
Social inclusion
With the recognition that biometry plays a crucial role in social inclusion and economic development, adoption levels are growing rapidly across the world – in support of free and fair elections, health and social protection, and a wide range of financial support programmes. The standard bearer is, of course, India’s Aadhaar initiative but others are being rolled out apace across the world.
As these programmes evolve to cover whole populations (including children), citizens will enjoy fast, non-intrusive access to a multitude of digital services in increasingly smart cities and public places. Alongside the benefits to citizens, these biometric-based initiatives bring important benefits to governments, including fraud prevention, greater governance and budget control. They also contribute to the growth of national digital economies, so are often the catalyst for wider economic growth.
A time for action
As we have seen, biometrics have fast evolved into the de facto authorisation and recognition mechanism for a range of EU-wide and national government-led services. This trend is set to continue, with access to a growing range of services – from frictionless, multi-modal biometric end-to-end journeys at airports, through voice-enabled banking to iris-based voter registration and migrant processing, and much more.
Whether the chosen biometric is fingerprint, iris, face or voice (or the latest behavioural option), the issue of selecting the right biometric, or combination of biometrics, to get the job done (whatever that may be) is crucial. Of course, there’s more to consider: not least the acceptance levels of the audience.
As we have seen, there are vulnerabilities and challenges – and not just in the biometric itself. The complexity of design and deployment, and the need to ensure an ethical approach that champions the privacy rights of the individual, are also key.
And while millions of people are comfortable using their facial or fingerprint biometric to log into their smart devices, there remains significant citizen and third-sector concern when it comes to exposing more of their biometry to growing numbers of government and private organisations.
In Europe, the presence of the GDPR is a major factor in developing a baseline of best practices that ultimately becomes the launchpad for new biometrically-enhanced services and applications. But, of course, while GDPR is an international benchmark, it is certainly not a globally adopted standard.
A foundational pillar, the ‘Privacy-by-Design’ principles and framework established by Dr Ann Cavoukian from the University of Ryerson in Toronto (CA) back in the 1990s, is increasingly becoming an inspiring source of best practices to create global standards.
Added to this, the rapid proliferation of online identity creates innumerable opportunities for fraudulent use. While the unique characteristics of a biometric go some way to addressing the challenge, enrolment and registration processes and methodologies must remain robust and secure.
However, risk is not limited to large-scale data breaches and fraudsters. On a wider point, the growing usage of online services requires citizens to present a unique identifier that is accepted everywhere. Governments have a real opportunity to create that identity based on citizens’ biometry. If they do not, commercial organisations – those that already provide identity-based services including Apple, Facebook, Google and others – will come to the fore.
SIA believes that governments are best placed to provide the foundational, legal identity for their citizens. This includes biometric identity. It is a matter that goes beyond operational considerations, technology discussions and models of implementation, to the very heart of national sovereignty and citizen security. There is, without doubt, a role for private organisations, but this is one of access to online services, not of creating and managing root identities upon which all citizen interactions and protections are based.
Ultimately, however, policy makers are increasingly moving in this direction. To ensure initiatives are both responsibly designed and operationally efficient, the SIA has developed a set of best practice guidelines to help European policy makers’ ability to make informed decisions.
Best practice guidelines in biometric-enhanced ID
The following best-practice guidelines from the SIA not only address issues around the design, implementation and ongoing management of biometrically-enhanced identity systems, but aid policy makers in fully understanding and addressing the wider ethical, legal and privacy questions that sit at the heart of these complex environments.
Expertise
Beware of developing or acquiring a biometric system without fully understanding what you need, and make sure the solution delivers on objectives. Biometrics is not one-size-fits-all. For a major system, relevant experts need to be involved from the outset. Some requirements may be more complicated than a non-expert may expect: discussion to understand why the advice is being recommended can be a useful learning for the team, before a business decision is taken.
Modality
As we have seen, many different types of biometric are possible – be that face, fingerprints, iris, voice or a combination. Each has different characteristics and requirements. Deciding which modality – or modalities – are required for a new system may be complex. Will requirements change, e.g. to add a further modality during the life of the system? Is simultaneous processing of multi-modalities required? Similarly, it is important to judge the proportionality of using multi-modal biometrics against the use case and benefits of adding additional system complexity.
Standards
There are many standards relating to biometrics. They are complex, and the relevant ones need to be understood. Compliance with relevant standards has important advantages – interoperability of data and systems; faster and cheaper development of solutions; lower lifetime cost (initially and when upgrading the solution); interchangeability of components; easier and better testing. In a broader context a ‘standards’-based approach also includes professional learning and norms, and consistency in the uses of technical vocabulary to improve communication.
Accuracy and quality
Achieving accuracy and quality of biometric samples recorded on a system is critical to obtain reliable results from the use of the system. Enrolment of each record is a vital step – if the quality of samples captured and stored is poor, results will be compromised while that system and data remain in use. Accuracy is key, of course, and should a result prove inaccurate, it is possible to cascade down from a facial biometric to fingerprints, etc. It should be stressed that additional modalities alone do not guarantee a greater degree of accuracy. Many other considerations are required, including the algorithms.
Algorithms
The algorithms used to capture, encode and compare biometrics have an important bearing on how well and how efficiently the system will perform, how flexible the system will be (for example in handling biometric samples or images that are significantly degraded), and in being able to detect attempts to deceive (or ‘spoof’) the system by presenting a false biometric sample or image.
Testing
Testing a biometric system is critical. For larger systems it can be a major undertaking. Testing is not just something undertaken as a final stage but begins with a sound strategy related to the circumstances of the system being created, how to prove that it works as intended, delivering acceptable accuracy, for all its use cases. Significant quantities of test data may be needed and must be created or built. How will the quality of the system continue to be proved during its lifetime?
Performance
How will the size of the system grow over time? Searching and processing biometric data can be computationally intensive: setting up a large biometric database that will be used by many users demanding fast response times, all of which will expand year by year, requires major and efficient processing power. That too needs to be tested and monitored. Cloud services may help in dealing with requirements for flexibility and growth, but there is no ‘silver bullet’ or easy answer. Again, this comes back to proportionality and the right solution to fit the use case. If vast, highly performant, multi-modal systems are not required to achieve the outcome, then it makes commercial and operational sense to avoid such over-investments.
Security and privacy
A biometric system is inherently one that stores personal data, which therefore needs protection from attack and from improper processing, such as disclosure to anyone not entitled to receive it. Loss of personal data can be very damaging for the subject(s) and for the owner of the system and is subject to legislative protection – and potential penalties. Protecting data effectively not only relates to technical system security, but to business processes and therefore staff training in the use of the data. Security is also important for protecting the correct functioning of the system, avoiding corruption or loss of data or processing capability of the system itself, for example in the event of cyberattack.
Integration
A biometric system is not built for its own sake, but to create a biometric capability to support a broader business purpose. Therefore, effective integration, for example of planning, strategy, data, networks and user functionality, has to be envisaged from the start – and delivered. Look for partners with solid reputations, proven portfolios and a clear vision of the desired outcomes.
Change and growth
A system is unlikely to remain the same throughout its life. As a minimum there are likely to be new software releases which will need to be adopted; probably growth in the number of records and users to be accommodated which may require by design a comprehensive scalability strategy to grow as it progresses; while there may also be extra requirements that are added after the system has come into use. It is helpful to consider these factors in advance, and to think about how they could be accommodated if and when they are needed.
Proportionality
As we have seen in this paper, biometry offers significant problem-solving potential – from secure borders through to social inclusion. But along with great power comes great responsibility. It’s vital to remember biometry is deeply about personal information and should be operationalised appropriately, proportionately and ethically. Using facial biometric capture to, for example, deter thieves from stealing toilet paper is arguably disproportional and raises ethical questions – particularly with regard to how that data is stored and processed. Just because governments can capture biometry doesn’t mean they should, and the use must be ethically as well as operationally appropriate under clear legitimate purposes.
Driving value through partnership
Ensuring the success of proportional, ethical and outcome-driven ID programmes is both an economic and social imperative. As the biometric-enabled identity market continues to rapidly evolve, it is more important than ever for regional and national governmental bodies and policy makers to make use of experience and expertise of today’s wide and deep community of experienced partners.
The Secure Identity Alliance is an expert and globally recognised not-for-profit organisation. The organisation brings together public, private and non-government organisations to foster international collaboration, help shape policy, provide technical guidance and share best practice in the implementation of identity programmes
Printed with the permission of the Secure Identity Alliance. This paper has been shortened. Much more information, including case studies, can be found at www.securitysa.com/*sia (redirects to https://secureidentityalliance.org/publications-docman/public/156-biometrics-in-identity-building-inclusive-futures-and-protecting-civil-liberties/file).
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version