- Email: [email protected]
Market-enabled biometric enrolment
NEWS ...Continued from front page Editorial Office: Elsevier Ltd The Boulevard Langford Lane Kidlington Oxford OX5 1GB, UK Tel: +44 (0) 2920 560458 Fax: +44 (0) 1865 843933 Email: [email protected] Website: www.biometrics-today.com Editor: Mark Lockie Programme Editor: Steve Barrett Subscription Information An annual subscription to Biometric Technology Today includes 10 printed issues and online access for up to 5 users. Prices: E991 for all European countries & Iran US$1072 for all countries except Europe and Japan ¥131 700 for Japan (Prices valid until 31 December 2009) To subscribe send payment to the address above. Tel: +44 (0)1865 843687/Fax: +44 (0)1865 834971 Email: [email protected], or via www.biometrics-today.com. Subscriptions run for 12 months, from the date payment is received. Periodicals postage is paid at Rahway, NJ 07065, USA. Postmaster send all USA address corrections to: Biometric Technology Today, 365 Blair Road, Avenel, NJ 07001, USA This newsletter and the individual contributions contained in it are protected under copyright by Elsevier Ltd, and the following terms and conditions apply to their use: Permissions may be sought directly from Elsevier Global Rights Department, PO Box 800, Oxford OX5 1DX, UK; phone: +44 1865 843830, fax: +44 1865 853333, email: [email protected]. You may also contact Global Rights directly through Elsevier’s home page (www.elsevier.com), selecting first ‘Support & contact’, then ‘Copyright & permission’. In the USA, users may clear permissions and make payments through the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, USA; phone: +1 978 750 8400, fax: +1 978 750 4744, and in the UK through the Copyright Licensing Agency Rapid Clearance Service (CLARCS), 90 Tottenham Court Road, London W1P 0LP, UK; phone: +44 (0)20 7631 5555; fax: +44 (0)20 7631 5500. Other countries may have a local reprographic rights agency for payments. Derivative Works Subscribers may reproduce tables of contents or prepare lists of articles including abstracts for internal circulation within their institutions. Permission of the Publisher is required for resale or distribution outside the institution. Permission of the Publisher is required for all other derivative works, including compilations and translations. Electronic Storage or Usage Permission of the Publisher is required to store or use electronically any material contained in this journal, including any article or part of an article. Except as outlined above, no part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission of the Publisher. Address permissions requests to: Elsevier Science Global Rights Department, at the mail, fax and email addresses noted above. Notice No responsibility is assumed by the Publisher for any injury and/ or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. Because of rapid advances in the medical sciences, in particular, independent verification of diagnoses and drug dosages should be made.Although all advertising material is expected to conform to ethical (medical) standards, inclusion in this publication does not constitute a guarantee or endorsement of the quality or value of such product or of the claims made of it by its manufacturer.
02265 Printed by Mayfield Press (Oxford) Ltd.
2
Biometric Technology Today
system and we are pleased that our designs and plans for its implementation have been recognised by this decision.” Foreign nationals are already being issued with ID cards and from the autumn staff working airside at Manchester and London City airports will be issued with cards as part of an 18 month evaluation period. A limited number of British citizens who want to volunteer for an ID card can do so in the autumn, ahead of wider roll-out to young people in 2010. IPS will issue two further contracts this year:
UÊ >À`Ê iÃ}Ê>`Ê*À`ÕVÌÊqÊÌÊ`iÛi«Ê and produce the physical Identity Cards required for the implementation of the Scheme. Fujitsu, IBM and Thales UK are bidding for the contract which will be issued in the autumn; and UÊ *>ÃëÀÌÊ iÃ}Ê>`Ê*À`ÕVÌÊqÊÌÊ`iÛi«Ê and produce Passports, replacing existing arrangements when they expire. 3M SPL, De La Rue, Gemalto and Thales UK are bidding for the contract which will be issued in summer. In August 2008, Thales UK was awarded the £18 million three year contract to deliver the first ID cards to airside workers and volunteers starting in autumn this year.
Market-enabled biometric enrolment IBM has won the contract to provide the National Biometric Identity Service (NBIS). How this database will end up being filled with hundreds of millions of biometric data records is still under consideration – but the current front runner is to outsource biometric enrolment to the commercial sector. Speaking at the recent Security Document World 2009 conference and exhibition in London, Duncan Hine, executive director of integrity and security at the Identity and Passport Service told delegates: “We have said we absolutely want to use third parties to carry this part of the scheme out for us.” Clearly such a move is fraught with potential danger. One of the potential risks to the system is biometric spoofing, something which Hine, although mindful of, believes suffers from too much hype and can be overcome. He commented: “I think there is an awful lot of science fiction around this area. I do believe people will attempt to spoof the biometrics. I do believe that will always be possible to some degree. We believe that with a system design that brings together technology, people and business processes, it’s possible to defeat most of the attacks that you can postulate at the moment. But I am not complacent. Of course, if anyone knows of a new attack to get through these three things combined then I would love to hear from you.” He continued: “It is about being realistic about it… People watch too many movies, where people take photographs of eyeballs and chopped off fingers and the rest of it. I’ve seen all of those things in the past. But there is a countermeasure to most of them. And it is really about a system level design rather than a more clever reader or a fingerprint scanner on its own. It’s about supervision of the enrolment, supervision of the transaction, the human psychology that says ‘there is something wrong here’. It’s about all these things combined.” Hine told delegates that whilst outsourcing enrolment to the commercial sector is high on his agenda, IPS is still “nowhere near deciding how to do this in detail”. The benefits of outsourcing are compelling, however, Hine said. Commercial outlets, such as retail chemists, libraries, retailers of various types or post offices would be “convenient for the citizen… close to hand and have a good degree brand integrity”. Hine assured delegates that: “I can be certain that once we have accredited that [organisation], and audited and inspected it, those standards will be maintained, and we’ll be checking at random intervals to make sure that’s true… I think we get then reach and familiarity and footfall, that we won’t get if the government does it uniquely on its own.” Hine conceded that outsourcing is fraught with difficulty: “It brings out many, many security issues,” he said, such as, “binding into other people’s systems, how they handle the data, whether they keep it or not, how they can prove to us they’ve destroyed it once they’ve sent it to us, making sure they don’t have local copies, that they’re not using it for anything else, and on and on…” “In some ways,” Hine said, “it would be nicer if we just could do it ourselves and control all aspects of it. But I don’t think that’s practical, it’s not realistic at the moment. We need that convenience, that reach and penetration. And so we are developing all of the approaches into how we can do this with third parties, safety, and keep it safe over time.”
April 2009
02265 Printed by Mayfield Press (Oxford) Ltd.
2
Biometric Technology Today
system and we are pleased that our designs and plans for its implementation have been recognised by this decision.” Foreign nationals are already being issued with ID cards and from the autumn staff working airside at Manchester and London City airports will be issued with cards as part of an 18 month evaluation period. A limited number of British citizens who want to volunteer for an ID card can do so in the autumn, ahead of wider roll-out to young people in 2010. IPS will issue two further contracts this year:
UÊ >À`Ê iÃ}Ê>`Ê*À`ÕVÌÊqÊÌÊ`iÛi«Ê and produce the physical Identity Cards required for the implementation of the Scheme. Fujitsu, IBM and Thales UK are bidding for the contract which will be issued in the autumn; and UÊ *>ÃëÀÌÊ iÃ}Ê>`Ê*À`ÕVÌÊqÊÌÊ`iÛi«Ê and produce Passports, replacing existing arrangements when they expire. 3M SPL, De La Rue, Gemalto and Thales UK are bidding for the contract which will be issued in summer. In August 2008, Thales UK was awarded the £18 million three year contract to deliver the first ID cards to airside workers and volunteers starting in autumn this year.
Market-enabled biometric enrolment IBM has won the contract to provide the National Biometric Identity Service (NBIS). How this database will end up being filled with hundreds of millions of biometric data records is still under consideration – but the current front runner is to outsource biometric enrolment to the commercial sector. Speaking at the recent Security Document World 2009 conference and exhibition in London, Duncan Hine, executive director of integrity and security at the Identity and Passport Service told delegates: “We have said we absolutely want to use third parties to carry this part of the scheme out for us.” Clearly such a move is fraught with potential danger. One of the potential risks to the system is biometric spoofing, something which Hine, although mindful of, believes suffers from too much hype and can be overcome. He commented: “I think there is an awful lot of science fiction around this area. I do believe people will attempt to spoof the biometrics. I do believe that will always be possible to some degree. We believe that with a system design that brings together technology, people and business processes, it’s possible to defeat most of the attacks that you can postulate at the moment. But I am not complacent. Of course, if anyone knows of a new attack to get through these three things combined then I would love to hear from you.” He continued: “It is about being realistic about it… People watch too many movies, where people take photographs of eyeballs and chopped off fingers and the rest of it. I’ve seen all of those things in the past. But there is a countermeasure to most of them. And it is really about a system level design rather than a more clever reader or a fingerprint scanner on its own. It’s about supervision of the enrolment, supervision of the transaction, the human psychology that says ‘there is something wrong here’. It’s about all these things combined.” Hine told delegates that whilst outsourcing enrolment to the commercial sector is high on his agenda, IPS is still “nowhere near deciding how to do this in detail”. The benefits of outsourcing are compelling, however, Hine said. Commercial outlets, such as retail chemists, libraries, retailers of various types or post offices would be “convenient for the citizen… close to hand and have a good degree brand integrity”. Hine assured delegates that: “I can be certain that once we have accredited that [organisation], and audited and inspected it, those standards will be maintained, and we’ll be checking at random intervals to make sure that’s true… I think we get then reach and familiarity and footfall, that we won’t get if the government does it uniquely on its own.” Hine conceded that outsourcing is fraught with difficulty: “It brings out many, many security issues,” he said, such as, “binding into other people’s systems, how they handle the data, whether they keep it or not, how they can prove to us they’ve destroyed it once they’ve sent it to us, making sure they don’t have local copies, that they’re not using it for anything else, and on and on…” “In some ways,” Hine said, “it would be nicer if we just could do it ourselves and control all aspects of it. But I don’t think that’s practical, it’s not realistic at the moment. We need that convenience, that reach and penetration. And so we are developing all of the approaches into how we can do this with third parties, safety, and keep it safe over time.”
April 2009