Archives for February 2023

I work on digital identity and this described below experience really highlighted the problem with much of the Biometrics industry and governments who use the technology – no explanation of what is actually happening or how a system got the template of my face. It re-affirmed for me the need for the Thoughtful Biometrics Workshop coming up March 16th.

I left SFO on Saturday at midnight on an EVA flight to Taipei. 

Biometric Exit combined with boarding that involved no presentment of a ticket or passport really caught me off guard. It was quite frankly creepy. 

I never agreed to share my photo with the airline – or to be part of a gallery (The group of photos of all people who would be getting on a plane). I just thought I was going through normal boarding where I would share my ticket and passport as part of getting on the plane. 

Instead I was asked to stand in front of a camera/screen that took my photo and then beeped/flashed green to say it was ok for me to get on the plane. 

When I said to the woman who was at the gate – what was going on that I hadn’t consented to this and where did they get the template to do this.  She was a bit surprised by my question and  shrugged and said she thought they got it off the chip on my passport.  Except I know this didn’t happen.  When I checked my bag in they only did that machine readability off the visual MRTD part of my passport – by swiping it through the reader on their keyboard.  

So I’m putting things together about what I think happened. 

CBP is doing Biometric Exit in collaboration with the airline.  (article confirming this)

The PNR – passenger name record is shared ahead of time with CBP – they put together a gallery (templates/photos of all the people who’s names appear as being on the flight) and then they use this gallery when folks pass through the live scanner.  This is me putting things together based on some of what I know and what I think is going on. 

The fact that there was no signage to explain to folks what is happening or how is really scary to me. This type of thing – where all of a sudden a thing is scanning your face and giving you a go/no-go to get on a plane is why people mis-trust facial recognition systems and technology.  I checked San Francisco has a ban on facial recognition technology – but only for local government agencies. 

I hope we can talk about this experience and others at the Thoughtful Biometrics Workshop coming up March 16th.  Please join us. 

I am reading a new article out asking if 2023 is the year of Digital ID.

It might be – lots of good developments are happening.

AND we also have a disaster of communication about how some systems work.

The article is referencing the way that TSA works where the employee puts the ID into a card reader which verifies the ID and then looks at the picture of the person presenting it to see if it matches. Then goes on to talk about how the digital version would work.

A digital ID would work the same way. The person would present a phone, which would have a barcode or QR code, which can be scanned, and links to a government record. “Essentially, your phone becomes a token which refers to a government authorized database,” said Miller.

– Is 2023 the Year of the Digital ID?

If that is how it is going to work – where I am presenting tokens that “refer to a government authorized database” then count me out. It sounds like to the non-sophsticated reader it pings the database and pulls down a photo of the person sharing the token. It might work this way – if people think reading it it does work this way – we can’t get adoption in the US. The ACLU has a whole report out about the worrisome phone home architecture that is optional with the mDL standard.

I did a search for mDL and TSA and this PDF showed up.

Look there is a direct link between the issuing authority and the TSA in the Relying party role – the little arrow says Key/Cert Exchange but is the public going to read that? Or are they going to think there is a connection to the database.

Another problem with the report and the way they talk about the solutions is that there are only phone hardware and software manufactures that are listed as the rightful arbiter of this system of IDs. What about other wallet manufactures.

One of the big developments related to biometrics in the United States in the last month is a call by senators “calling on TSA to immediately halt its deployment of facial recognition technology.”

My understanding of what is going on is facial matching between a presented document with a photo on it (passport or drivers license/stateID) and the person present. This is a similar kind of matching that happens when I cross the US boarder with my green card – they have my green card picture on file and then they point a camera at me and see if I match the picture on my card. 1:1 matching.

There are a lot of questions the Senators ask you can see the full letter here.

1. Please provide data on the accuracy and volume of TSA’s facial recognition technology program from 2020 to 2022 broken down by race, ethnicity, and gender that includes:

1. the rate of false positives and negatives produced;
2. the total number of travelers who had their face scanned by TSA;  
3. the total number of travelers who opted out;
4. the total number of cases where TSA stored its facial scans, instead of immediately deleting.

2. How are travelers notified of their right to opt-out of facial recognition? What are the effects on a traveler who chooses to opt-out of facial recognition?

3. Under TSA’s current system, do travelers who choose to opt-out face any additional consequences or additional screenings, pat-downs, interrogations, or even detention, beyond what they would have encountered at a non-facial recognition airport?

4. What training measures does TSA currently mandate for staff to regarding travelers who choose to opt-out of facial recognition technology?

5. Has TSA ever shared biometric data with other government agencies? If so, which agencies and for what purposes?

6. What measures is TSA taking to protect biometric data from cyberattacks or any other form of unauthorized distribution or release? How does TSA ensure the security of Americans’ data that third-parties have access to? Is TSA aware of any breaches of travelers’ biometric data collected at US airports? If so, please detail all such breaches.

This has prompted some responses from the biometrics industry with a post by the International Biometrics and Identity Association (IBIA) and the Security Industry Alliance (SIA). Both push saying that there are significant mis-understandings about the technology and how it works.

There is also video interview with Robert Tappan the Executive Director of IBIA on the Identity Week site. The interview is about 10 min and covers these topics:

1. Why do you think the terms “surveillance” and “identity verification” have been conflated? What are the perceptions of facial biometrics? True or not?
2. Is there evidence at all to suggest face verification technology is being used in the wrong way to invade privacy?
3. Talking to some vendors, some say there are some inherent biases in the level of technology that are being mitigated. Do you disagree that bias in biometrics now exists?
4. What are the differences between surveillance and verification that you suggested in your comments?
5. How do these claims/ beliefs affect trust?
6. Describe the level of progress in America with biometric deployments and are some unfounded beliefs that biometrics are ‘threatening our democracy’ derailing progress?

It is these deep disconnect between how the technology works in the real world, what it does and the public and legislator’s concern about it that the Thoughtful Biometrics Workshop was created for. My hope is we can dig and explore the nuances. I hope you will join us on March 16th.

The workshop is coming up March 16th virtually. If what I write below resonates with you please consider joining us

I thought long and hard about key constituencies to invite to the Thoughtful Biometrics Workshop and why. I collaborated with Kyra Auerbach to create this image that captures it.

There are many biometrics, ways to capture and measure them, and places in a techno-social system they can be implemented.

The technology landscape is wide and the policy and issue landscape they present is also vast.

This is what we explore at the Thoughtful Biometrics Workshop. 

Biometrics as a technology are not entirely “new” – for example, photos have been a part of government-issued identity documents for almost 100 years as 1:1 matching between a human and an identity document. As technologies have progressed (computer vision, AI, ML), new biometric technologies have emerged, enabling products with various use-cases and applications.

There is much to consider regarding thoughtful use. This is one reason we don’t pre-set an agenda, but instead invite key stakeholder communities with different knowledge bases and perspectives to engage in mutual learning and dialogue. 

Our hope is to gather humans who care about, are interested in, and are concerned about technology, in order for new perspectives and opportunities to shape future policy to emerge. These are the stakeholder groups invited to the Thoughtful Biometrics Workshop and why:

Civil Society Advocates and the Interested Public

New technologies have many implications. The public is naturally concerned about Biometric Technologies, while Civil Society Advocacy organizations are tracking the development of these technologies and raising concerns about their usage in various contexts. 

TBW provides an opportunity to share concerns and ask deep questions of the people who make and implement the technologies, to understand more about how they work in practice. There is also opportunity to share research and studies that have been done highlighting the flaws and misuses of biometric technology with creators, implementers and policy makers. 

Biometric Research Scientists & Companies that make Biometrics Products

Companies use the work of biometric scientists to make products. Many technologies are combined to make products that apply to different use-cases.  TBW provides an opportunity to share details of how various biometric modalities work (capture and comparison mechanisms) in practice, and to dispel misconceptions. There is also opportunity to share how technologies are combined to make products and how these work with other systems. 

Policy Makers and Regulators

Biometrics are diffusing and being adopted in a variety of settings across many domains: employment, government, commercial and civil society.  Some of these uses are aligned with existing policy requirements, some are novel uses that are not yet regulated at all. 

TBW provides an opportunity to understand the concerns that civil society advocates and the public have about existing and future uses that require reasonable regulation. The event is also an opportunity to learn in more detail from experts in biometrics and understand how the technology works in practice. 

Biometrics Implementers in the Private Sector, Government, Civil Society

These are organizations who buy biometrics technology solutions from companies to use in their day-to-day operations. They apply the technology either for authentication (checking someone matches an enrolled identity) or for identification. TBW provides an opportunity to share how and why they use biometric products to solve operational needs and explain more about their reasoning. 
​The event is also an opportunity to learn more details of how the technology works from the researchers, and to hear more about concerns regarding misuse and overuse. 

Technologists Working in Related Areas

There are a range of neighboring technologies and systems often used in conjunction with Biometrics, including identity and access management. TBW provides an opportunity to learn from a  range of stakeholders involved in biometrics technology, and to share perspectives about how neighboring technologies interact with biometrics.  

I first was exposed to biometrics at scale when I was working within the National Strategy for Trusted Identities in Cyberspace – Identity Ecosystem Steering Group that would host meetings “next to” biometric industry conferences. They were really kinda freaky for the technology presented and how I imagined it all being used.

I still have a very cautionary attitude towards biometrics technology however I am not scared of them in part because I have met folks who work more closely with and deepened my understanding.

In the fall of 2020 I proposed to Jack Callahan. We put on the first Thoughtful Biometrics workshop in March 2021. Now we are organizing the 2nd one coming up March 16, 2023. It is virtual and online. Learn more here and Register!

This is explanation of Biometrics I wrote for the workshop.

The term “biometrics” comes from two roots:  

bio meaning biological life + metrics meaning measurement

Therefore, it is defined as the measurement of biological characteristics. Every person has unique bodily or physical (biological) characteristics, and these can be measured, described and recorded or documented in various ways. Once documented they can be compared for identification or authentication purposes. 

Biometrics existed well before the creation of digital computers. For example, fingerprints have been collected and compared to establish identity since the mid-1800’s, and photographs used on documents such as passports starting about 100 years ago. 

Digital technology and other key innovations over the last 40 years, including advances in computer vision, algorithmic processes, and matching algorithms have expanded biometrics deeply into our digital world. 

Types of biometrics

All biometric modalities are basically two types; physiological and behavioral.

Examples of physiological biometrics include fingerprint, iris, retina, face, palm, and vein recognition. Examples of behavioral biometrics include signature and voice recognition.

APPLICATIONS OF BIOMETRICS:

1:1 matching for authentication:

Looking at a biometric associated with a particular person or record and seeing if the person presenting a sample of their biometric matches the biometric template that was previously enrolled. For example, 1:1 Matching on devices such as unlocking a phone using a fingerprint or faceprint.

Human 1:1 Matching against a document such as a passport, drivers license or other document. This can be done by a human looking at the picture and comparing, such as when you buy an age-restricted product. The clerk does a match between the document and a face along with checking the age of the person presenting the document. 

Computer 1:1 Matching against a document such as a passport, drivers license or other document. Computer vision is used to look at the person standing in front of a camera and compare them to a photo encoded on a document.

1:1 Matching against a sample enrolled in a system. An employer might have a biometric enrolled and on file to be compared to 1:1 when the employee presents themselves.

1:small n matching for authentication

This type of biometric usage involves the enrollment of a small group of people into a system. One use-case is all the people boarding a particular plane. The individuals traveling can share their photo and travel documents with the airline in the check in process. The photos are now in a gallery of a few hundred. When going to board the plane individuals can present themselves and be allowed to board after they match one of the faces in the gallery of photos of people who are passengers on the plane.

1:large n matching and identification

An important question for this mode is: does it happen in real time, or later in a forensic context?

In real time a video can capture snapshots of faces and then run the faces against a large n of potentially millions of people. If implemented on a camera on a public street, this would output a list of all the people who walked past. 

Forensic use of biometrics really began over a century ago with fingerprint matching. Fingerprints lifted from crime scenes were compared with fingerprint records of people. This is still done today but with electronic systems doing the matching. For forensic facial recognition, images of people are captured in retrospect from video or still photographs from a crime scene. These are compared with large data sets of images of people along with their names. 

EXAMPLES OF OTHER PLACES WE USE BIOMETRICS

Smart Speakers

Voice recognition goes beyond understanding speech; some devices are able to distinguish between people based on a pre-enrolled voice print. We could also see databases of voice prints created to compare samples against, much like we have photos of people being compared using facial recognition algorithms.

Wearable Sensors for Health tracking

There are more and more devices that use sensors to track things like heart rate, temperature, or oxygen levels. These devices in the form of rings, watches, bracelets, etc. record and share this information.

Augmented Reality (AR) and Virtual Reality (VR) Devices

AR and VR work with sensors that track head location and movements, eye movement and focus, facial expressions, hand movements, heart rate and even perspiration.  

We may have missed some biometrics use-cases –  feel free to reach out and share more!