The two headline grabbing uses of biometrics technology in the public sector are, of course, e-passports and potentially national identity cards. The government is pushing both to reduce illegal immigration and the threat of terrorism, and maintains the card would help to reduce identity theft and social services fraud.
But these are not the only ways the technology is being deployed. While the police have taken fingerprints using ink since the late 1800s, they now also have the national IDENT-1 database at their disposal, holding biometric identifiers, taken on arrest, of about 10% of the male population.
The National Policing Improvement Agency expects to award a £30m-£40m contract by the end of this year to implement Project Midas, which will roll out of mobile biometrics scanners for officers to check suspects' index fingerprints against IDENT-1. The goal is to save time and reduce the administration involved in establishing whether an individual is providing the correct identity and to check for former convictions.
The initiative was reported to have hit problems during the Project Lantern proof-of-concept stage last year, when it emerged that the Airwave digital radio network installed was unable to handle the amount of image data generated. Solutions to the problem are currently being sought from organisations tendering for Midas but, despite these challenges, the eventual aim is to broaden the scope to include facial recognition and DNA.
Beyond border control and law enforcement, deployment of biometrics technology is currently limited, although it does go on where a clear business case can be made.
Rob McBride, the UK biometrics advisory lead for Deloitte's security and practice team, explains: "Biometrics replace other forms of strong authentication to verify identity, so using the technology to increase security is generally the primary driver or business case. But it's less on the agenda than 12-18 months ago due to the economic situation. As far as security goes, people are more looking to make do with what they've got."
This means public authorities are unlikely to rush into using biometrics readers for applications such as IT system or buildings access, not least because biometrics are often perceived as simply overkill.
Philippe Martin, a senior analyst at public sector specialist Kable, says: "Biometrics are an option, but they're a bit more expensive than regular systems so there are relatively few places that you'd chose to deploy them. There are pockets of use, but the technology hasn't been employed much so far and I don't think it's necessarily going to be used more and more in future."
One of the areas in which it has been used is in cutting costs in relation to time and attendance processes. Greater Manchester Fire and Rescue Service introduced a biometrics based rostering system in January 2006. Firefighters clock on and off by placing their hand in a scanner that measures its geometry, and a central crewing function is notified in real time that they have arrived or left. A self-service function also enables staff to view their own rosters, request holidays and swap shifts with colleagues. The service has estimated the cost savings at between £2m-£2.5m a year.
School place
A more widespread application is cashless catering in schools. Although smart cards are another option in this context, some local authorities such as Renfrewshire Council perceived that biometrics were more effective as children are prone to lose cards.
The local authority started evaluating the technology about two years ago following the introduction of Scotland's Hungry for Success initiative. The scheme aimed to improve the school meals experience for pupils, in particular by tackling the stigma attached to free meals by anonymising the children who receive them.
Ronnie Gourley, health support manager at the council's education and leisure services department, explains the benefits gained from introducing its biometrics technology: "One is the elimination of stigma so that everyone is treated equally in the system and the other is helping to reduce queuing times when there's a limited timeframe. Another is that you can keep an eye on what children are eating and that information can be shared with parents."
Renfrewshire's Impact finger scanning system from CRB Solutions was implemented about a year ago in 12 out of 52 of its primary schools after Yarg Biometrics, which developed the council's original choice of palm vein scanning technology, went into liquidation. PalmSecure was developed in collaboration with Fujitsu and is still sold by it, but had not been deployed in target schools at the time.
Apart from the issues involved in finding a replacement system among the small number of suppliers, the biggest challenges that the council faced related to concerns over civil liberties and the initial capital costs of the project.
As a result, says Gourley: "We found it important to involve all of the stakeholders, which included head teachers, catering suppliers and parents. What is paramount is communicating with parents, consulting with them and getting written permission for youngsters to participate in the programme. It was also necessary to provide alternative arrangements for the handful of parents that said no."
Template choice
Precautions were likewise taken when selecting the system to ensure that only templates of children's fingers based on coordinates rather than the fingerprint itself were stored. This is because such templates are useless if stolen as the person to which they belong must be present for matching purposes. A further safeguard was the introduction of new processes to ensure that all information was deleted from the database when a pupil left the school.
As for rolling out the initiative more widely, this is unlikely to happen in the near future. Three of the council's primary schools and all of its secondary schools already use a smart card based system, which is not scheduled for replacement soon. For the remaining primary schools, upfront investment is an issue in these "stringent financial times", despite the running costs for biometrics offerings being lower than those for smart cards.
"One of the crucial factors is the size of the establishment. Primary schools are smaller than secondary ones, but the per capita cost becomes much greater with smaller numbers," Gorley says. Nonetheless, the situation will be reviewed as return on investment and the impact on social agendas, such as uptake of school meals, becomes clearer.
As for other potential uses, John Elliott, head of security consultancy Consult Hyperion's public sector business, recommends that public authorities undertake a full risk assessment and cost benefit analysis to establish whether implementing the technology is worth their while.
"The key inhibitor is cost. Unless there's a clear need for what biometrics can provide beyond smart cards or user names and passwords, you'll have trouble getting projects off the ground, especially in these cost-sensitive times. Which is why you only tend to see the technology in high profile cases," he says.
This situation is not helped by the "tension between wanting to authenticate someone to use a service and not wanting to reveal who they are. So, unlike smart cards, biometrics and anonymity don't work well together, which means there's much more reluctance to go full steam ahead," Elliott adds.
Parameter problem
There are other issues. One is that it is not possible to set general parameters for the operation of biometrics systems, as each type has to be tweaked for the individual environment in which it operates and this can be time consuming.
For example, with face recognition technology, lighting and head position are crucial at enrolment and whenever they are checked to make the biometric usable. With fingerprint recognition, the quality of camera resolution and clean plates are important factors in preventing untenable numbers of false negatives and positives, particularly in the case of older people or manual workers whose fingerprints may be worn.
Another challenge is spoofing, whereby people fake or steal someone else's biometric, for example, by using contact lenses for iris recognition or latex shields for fingerprints. The need for staff training and practice is a further issue, as is introducing processes to deal with exception handling.
Perhaps the thorniest issue arises if a biometrics database is compromised or a biometrics based smart card is lost or stolen. As Elliot says: "The more often you leave a smart card around, the more likely it is to be compromised. But if someone's biometric is stolen and copied, they can't change it, so you have to think carefully before you add it to a system."
Nonetheless, should a national identity card be introduced and fulfil the promise of providing access to services, Neil Fisher, vice president of identity management at Unisys, believes that the adoption of biometrics will quickly become widespread elsewhere.
"Government departments aren't using biometrics at the moment as they're waiting for the ID card," he says. "But once things are up and going, you'll find that both citizens and government will be encouraged to use it to enable service transformation."
First published in GC magazine, April 2009. Apply for a subscription
