Biometrics: Brave new world?

• Article 7 of 33
• SC Magazine, January 2007
• View the original article online

Page 1 | Page 2 | Page 3 | Page 4 | All 4 Pages

And companies using biometrics need to consider their legal obligations. “The Data Protection Act doesn't have a specific technical stipulation,” says Rosemary Jay, partner and head of information law team at Pinsent Masons. “But there is the requirement that the controller of the information has taken appropriate security measures to ensure the integrity and validity of the data.”

Organisations also have to be specific about what they will use biometrics for. Some biometrics could be considered invasive and may be regarded as a breach of privacy under article eight of the European Convention on Human Rights, as the Landini Spa and SNCF court cases in Italy and France have demonstrated.

So although increasing in popularity, accuracy and utility, biometrics are only finding niche applications for their use. So far, few organisations have been able to justify the necessary investment, but if the technologies continue to develop and costs come down, a brave, new biometric world may be upon us. CASE STUDY: DEG

Irish company Data Electronics Group (DEG) provides IT and telecommunication services to customers such as Bloomberg, Expedia and Mitsubishi. Until December 2004, the group's data centre had a variety of access-control mechanisms for staff and customers alike: a photo ID swipe card integrated into a 3G system that monitors the centre's doors, manholes and burglar alarms.

However, Daniel Tinkiel, chief operating officer at DEG, decided that the system wasn't secure enough. “The main issue regarding badges is the possibility of granting access to somebody without checking their real identity,” he said. “Even though we do check photo IDs, there is always a possibility of error. A badge could be lost or shared with somebody who should not be given access.”

Based on his experience in other countries, he decided to implement hand-geometry authentication using hardware from Ingersoll Rand Recognition Systems. In 2005, DEG began to implement the hand-geometry system. It took four months to deploy, including connection, supply, set-up, integration and training, and cost £170,000.

“The process starts by authorising access through our portal,” Tinkiel explained. “Then authorised people are enrolled and hand recognition profiles recorded in our database server. After that, any attempt is checked against the database profile and logged in the system.” All data is eventually stored with the images provided by the company's IP cameras in a common repository on a storage area network, where events are correlated based on time stamping. After 30 days, the images are put onto tape for archiving.

For people who might not be physically able to use the system, there's an exceptions option that has to be authorised by a supervisor, with the security operator performing the enrolment having to provide a password.

According to Tirkiel, the system works well. “Customers adapted easily and staff reactions were very positive,” he claimed. “Our role enforcing the security of the building is quite a responsibility, and everybody felt that this is helping them. They are about having such a system in place.”

THE NEXT BIG THING
Biometrics have come a long way in the past few years, but what's next? David McIntosh, CEO of OmniPerception and chairman of the International Association for Biometrics (pictured), predicts a growth in facial recognition as a means of remote verification of identity over the Internet. His company already has technology for analysing webcam images, which he says is able to test for “liveness” to ensure a photo or movie of the correct user is not being substituted.

Page 1 | Page 2 | Page 3 | Page 4 | All 4 Pages