FEATURE
Biometrics for the mass market – are we ready? Eric McDonogh, Argus Global
Eric McDonogh
The last decade has seen a sharp rise in the use of biometrics. In 2011 the global market for National e-IDs achieved a turnover of nearly $7bn, while India enrolled 1.2bn people as part of its national identity scheme (UID)1. This was also the year in which Apple began talking about its own facial recognition patent2. Are biometrics about to go mainstream? Biometrics have been used in consumer applications like laptops and computers for some years now, but in a recent survey by Findbiometrics3, biometrics suppliers revealed that mobile technology was one of the key areas of growth and potential growth for the industry. Recent uses of biometrics for mobiles include the Motorola Atrix fingerprint scanner4, which gives customers the option to unlock their phone using biometrics, and Visidon’s Facelock for Android5 that uses face recognition for accessing email and other mobile applications. Mobile applications like Daon’s IdentityX6 take things a bit further, by allowing people to authorise financial transactions through face recognition. In this example, people receive alerts via their mobiles when a transaction is about to be processed and then deny/permit the transaction through taking an image of their face.
In-store transactions But it’s not just biometrics for mobiles that are taking off. Biometrics are also being used more widely by consumers for in-store transactions. In fact, pay by finger has been used in the US for making payments since as far back as 2006. According to AllTrust Networks (formerly Pay By Touch) over 7m customers are enrolled to use biometric-enabled payments7.
“Pay by finger technology is also increasingly popular in China, with consumers receiving discounts on things like cinema tickets and food, as a reward for registering their finger” Pay by finger technology is also increasingly popular in China, with consumers receiving discounts on things like cinema tickets and food, as a reward for registering their finger.
May 2012
One of the leading pay by finger providers, Live by Touch, is also planning to launch a service that links prints with VIP and discount cards so that people don’t have to use lots of different cards to get more than one discount8. While security is still a key factor in these uses of biometrics, most providers who implement biometrics for consumer use, even where banking is concerned, are driven largely by efficiency, cost and even fashion. Efficiency, because biometric payments are less time-consuming than fishing for wallets and cards and require less administration; cost when it comes to issuing new or replacement bank cards; and fashion because there’s no mistaking a certain ‘cool’ factor about using biometrics, rather than a card.
The pitfalls The problem with mass market biometrics is that they typically use a lower threshold than the biometrics in high security environments. And this is partly because high threshold biometrics are so cost-prohibitive: for businesses to afford biometric devices on a mass scale, they cannot implement the kind of high cost, sophisticated biometrics that are used in high risk environments. On a more practical level, mass market biometrics have to have a lower threshold to reduce the number of false rejections. Raise the threshold too high and all sorts of complaints will start stacking up from consumers who can’t access their phones or process transactions. Of course a low threshold is problematic because it makes biometric identification less secure than perhaps it should be. And while there is less of a risk when unlocking your mobile, when biometrics are used for authorising transactions via a mobile, or in-store, the stakes are considerably higher. This could be one of the reasons why mass market biometrics haven’t really taken off just yet. Even when we’re talking about millions of consumers in places like the US and China,
this is still a drop in the ocean when it comes to being a truly mainstream technology. In fact the trade-off between low-cost biometrics and security is one that continues to cause problems for car manufacturers, who are yet to successfully introduce biometrics for unlocking cars. Understandably with such a high cost commodity at stake, manufacturers are reluctant to jump on the biometrics bandwagon just yet.
Dual factor ID That’s not to say that biometrics can’t and shouldn’t be used in the mass market, they just have to be used carefully. For example, rather than solely relying on biometrics for identification, we may need to see more dual factor authentication, using both PIN and biometrics. It’s also worth noting that some mobile phone providers, like Visidon, are already wise to this and provide the option to use more than one form of authentication. Another example of this is the way that ATMs use dual factor authentication. Again, biometrically-enabled ATMs aren’t mainstream just yet, but they are enjoying increasing popularity, with banks like the First Bank of Nigeria introducing fingerprint biometrics in 2011. Here biometrics is used as well as PINs to add another layer of security9. Biometric providers who intend to use biometrics for financial purposes would be wise to use dual factor authentication as often as they
Motorola Atrix fingerprint scanner provides option to unlock the phone using biometrics.
Biometric Technology Today
9
FEATURE tor management, not unlike that used in prisons and other high risk environments, but with the emphasis on experience rather than controlling who accesses what and where. Of course in the hospitality industry security is still a factor, but it won’t always be the driving force for implementation.
Soft biometrics
Soft biometrics in the Xbox Kinect carry few ethical issues.
can, not only to increase take-up, but also to ensure that safety is rarely, if ever, compromised. Mobile phone providers may also want to ensure that users have the option of a biometric or a PIN, as even with the low threshold, there are still plenty of instances where mobile biometrics have received negative coverage due to their unreliability10. Atrix’s forum has some complaints from customers who can’t access their mobile using finger biometrics 11, for example, so it’s certainly an issue to keep an eye on.
Personalisation There’s also the question of whether ‘security’ is the most appropriate use of biometrics when it comes to the mass market, as argued by Tim Carmody, who suggests that the future of biometrics isn’t in security, rather in ‘personalisation’12.
“One example of biometrics for personalisation concerns the new Apple patent, which outlines an alternative kind of face recognition that doesn’t analyse the entire face, just certain features” One example of biometrics for personalisation concerns the new Apple patent, which should soon see face recognition technology incorporated into Apple’s iPhones, iPads and MacBook devices. The Apple patent outlines an alternative kind of face recognition, which doesn’t analyse the entire face, just certain features. 10
Biometric Technology Today
Experts are saying that it will be used to change the settings on ‘shared’ Apple applications, so that what is seen is dependent on the user. For example, if a family is using an iPad, different inboxes will be shown, depending on who’s using it13. Personalisation isn’t new. Biometric technology is already used for personalisation in the hospitality and leisure industry. For example, some hotels use face recognition to identify a returning guest as they walk into a hotel and then notify the hotelier, so that they can greet them by name at reception. Hotels could extend their use of biometrics by allowing regular guests to enrol biometrically and then access their hotel room using face or fingerprint biometrics, again adding personalised greeting messages like ‘Last time you requested a newspaper in the morning? Would you like to request one again?’ with the guest then authorising the request with their finger. This kind of personalisation has great potential in gyms, where biometrics have already been used as a means of access control14. It wouldn’t be much of a stretch to use biometrics instead of key fobs, to give people locker access, cutting down on the costs of administering hardware and giving people more secure access at the same time. On recognising the user, a welcome message could be displayed in the locker, including the number of times they’ve visited the gym that week/month. Go one step further and gym users could start up a machine using fingerprint biometrics. The machine then tells the user how far they went the last time they used it and how many calories they burnt, totalling calories burnt per week/ month. Using biometrics for personalisation in the hospitality industry is just another form of visi-
Soft biometrics work quite differently to traditional biometrics, because they don’t identify an individual. Rather they identify certain characteristics, like height, voice, weight and movement, and then produce a suitable response. The most common examples are the Xbox Kinect15 and Microsoft’s Project Natal16, which control what happens in a game through tracking body movement, whether that’s clapping your hands or kicking a ball. In this scenario, biometrics are used purely as a means of entertainment and carry few if any ethical issues. Soft biometrics are also increasingly used in cars, for example, allowing drivers to use their voice to request temperature changes or directions17. Here the objective is safety rather than entertainment, but it’s a different kind of safety measure to that of protecting a person’s identity. Its aim is to reduce the level of physical distractions that can cause drivers to take their eyes off the road. In these scenarios, biometrics carry few, if any, ethical issues. However problems do arise when soft biometrics are used as a means of manipulation. For example ReconAge from AppTech, an application for Android phones18, uses face recognition to determine a person’s age and has the potential to be used by advertisers to control what adverts are shown and to whom. Time Warner uses neuroscience biometrics to measure people’s responses to different types of advertising. The Time Warner Medialab, located within the Time Warner Centre in New York, creates settings like theatres and home style living rooms and then uses biometric monitoring to track people’s responses to different media, in different locations. These responses are then used to tailor advertising to Time Warner’s clients so that they are more effective. While advertisers and biometric providers are bound to come under pressure to consider whether this is a fair and appropriate use of biometric technology, suppliers can argue that advertising in all its forms in a kind of manipulation and that while less sophisticated, advertisers have been targeting ads at suitable demographics for years. Using biometrics to more accurately identify and then target an audience is just a step further.
May 2012
FEATURE
Biometrics and social media Social media’s use of face recognition is another example of unconventional biometrics and again raises some quite uncomfortable questions. One example is Facebook’s image tagging, which is now used to identify people in photographs and make it easier for people to find and tag one another. While this application is reasonably fun and innocent in concept, it does have the potential to create enormous problems if it remains unregulated. Indeed, the Hamburg Data Protection authority has already begun legal action against Facebook19 for not getting individual’s permission to use the tagging feature. Joseph Atick, vice chairman of the International Biometrics and Identity Association (IBIA), believes that the problem with social media’s use of biometrics is the potential cross-referencing of Facebook images with others out there. He says, “With little effort, an off-the-shelf web-crawler program can methodically browse the web and in a short period of time build large databases of identified faces. In fact, more efficient versions of these publicly available software programs are employed by the major search engines which, as a result of their ongoing harvesting over the years, have now accumulated face image databases that in their size dwarf the earth’s population.”20
“As a relatively new technology, biometrics fits well within the consumer landscape, but it will need to keep on changing to keep up with demand and maintain its position while keeping an eye on new uses, like personalisation and entertainment’ Atick says the problem isn’t insurmountable, but it must be addressed quickly. Biometric providers must become more proactive in controlling how biometrics are used, so that take-up continues in the consumer market. Too many high profile ‘problem’ cases could bring about enormous setbacks that will stunt the industry’s consumer growth.
Keeping apace Ethical and legal issues aside, consumer biometrics must develop at a different pace to their government counterparts. Consumers
May 2012
are a demanding and fickle breed that will always want more from their technology. Mobile phones, laptops and games are changing at a lightening pace that requires ever more interesting and sophisticated uses of technology. As a relatively new technology, biometrics fits well within the consumer landscape, but it will need to keep on changing to keep up with demand and maintain its position while keeping an eye on new uses, like personalisation and entertainment. Most importantly, biometric providers mustn’t lose sight of the privacy and security obligations that they are so used to meeting in the security industry. Biometrics will be used in many weird and wonderful ways for years to come, but they will never cease to be integral to personal safety.
About the author Eric McDonogh became business development manager for Argus Global in February 2011 and has extensive experience in both project management and software implementation, across a wide range of industries. He divides his time between project management for biometric installations and managing the scope and range of Argus’ products. He is also a member of the Biometrics Institute.
References 1. ‘FindBIOMETRICS Year in Review 2011, question 1 In your view, what have been the three most significant milestones/ announcements for the identification/ Biometric Industry this year?’ Accessed May 2012. http://www.findbiometrics. com/creo_files/interviews/findBIOMETRICS_-_Year_in_Review_2011_-_ Question_1.pdf. 2. Kahn, J. ‘Apple patent reveals face detection system with multi-user logins for iOS devices macbooks’. Accessed May 2012. http://9to5mac.com/2011/12/29/applepatent-reveals-face-detection-system-withmulti-user-logins-for-ios-devices-macbooks 3. ‘FindBIOMETRICS Year in Review 2011, question 1 In your view, what have been the three most significant milestones/ announcements for the identification/ Biometric Industry this year?’ Accessed May 2012.http://www.findbiometrics. com/creo_files/interviews/findBIOMETRICS_-_Year_in_Review_2011_-_ Question_1.pdf 4. ‘Writing Fingerprint-Enabled Apps’. Accessed May 2012.http://developer. motorola.com/docstools/library/writingfingerprint-enabled-apps
5. Wimberly, Taylor. “Facial recognition coming to Ice Cream Sandwich. Accessed May 2012. http://androidandme.com/2011/09/ news/facial-recognition-coming-to-icecream-sandwich/ 6. Daon’s Identity X. Accessed May 2012. http://identityx.com 7. AllTrust Networks. Accessed May 2012. http://www.alltrustnetworks.com 8. ‘Pay by finger’. China.org.con. Accessed May 2012. http://www.china.org.cn/ living_in_china/news/2009-07/21/content_18173779_3.htm 9. Grubb, Lindsay. ‘ATM security solutions for Africa’. Accessed May 2012. http:// technologybanker.com/news/atm/ATMsecurity-solutions-for-Africa 10. Molen, Brad. ‘Android 4.0 Ice Cream Sandwich review’. Accessed May 2012. http://www.engadget.com/2011/12/01/ android-4-0-ice-cream-sandwichreview/#lock 11. Atrix support forums. Accessed May 2012. http://www.atrixforums.com/forum/ motorola-atrix-help/1403-finger-printscanner-not-working.html 12. Carmody, Tim. ‘Apple patent uses biometrics for personalisation’. Accessed May 2012. http://www.wired.co.uk/news/ archive/2010-09/29/apple-patent-biometrics 13. Carmody, Tim. ‘Apple patent uses biometrics for personalisation’. Accessed May 2012. http://www.wired.co.uk/news/ archive/2010-09/29/apple-patent-biometrics 14. ‘24 hour gym access with fingerprint recognition’. Precise Biometrics case study. Accessed May 2012. http://www.precisebiometrics.com/fitness-chain-gym-access.aspx 15. Xbox 360 + Kinect. Accessed May 2012. http://www.xbox.com/en-GB/kinect 16. Project Natal video. Accessed May 2012. http://www.youtube.com/watch?v=g_txF7iETX0 17. ‘Does it work: Voice activated Lexus (2008)’ video. Accessed May 2012. http://www.youtube.com/ watch?v=C3M3Epd8wZY 18. ‘Biometrics – changing the face of mobile marketing’. Accessed May 2012. http:// www.planetbiometrics.com/articledetails/i/991/ 19. Fiveash, Kelly. ‘Hamburg loses rag with Facebook, threatens to sue’. Accessed May 2012. http://www.theregister. co.uk/2011/11/11/facebook_facial_recognition_tech_hamburg/ 20. Atick, Joseph. ‘Face Recognition in the Era of the Cloud and Social Media: Is it Time to Hit the Panic Button? – 19th October, 2011’. Accessed May 2012. http://www. findbiometrics.com/industry-news//i/9335
Biometric Technology Today
11