High-tech

Biometrics for travel

By The Chilli analysts

The lot of the modern traveller has never been a simple one. The attacks of September 11th made security, and with it confidence, a top priority - security to curtail the activities of terrorists, and confidence to convince people that it is safe to travel. As both investors and entrepreneurs look at this sector for new growth opportunities, The Chilli investigates biometric security applications in the transportation sector. What is biometrics? It is a method of authenticating or verifying an individual based upon a physical or behavioural characteristic.

1. Background
2. Technology
3. Logistics
4. Civil liberties
5. Harmonisation and interoperability
6. Cost imperative
7. Summary for entrepreneurs

1.Background

A security system is only as strong as its weakest link, but travel - like terrorism - is a global phenomenon, with any number and combination of destinations, including airports, rail/bus terminals and seaports. This article will focus specifically on air travel, although the majority of it applies to other forms of travel.

Just what are the challenges of increasing security? Firstly, access to vulnerable facilities (aircraft, airfield, buses and so on) at a terminal should be restricted to essential staff only. Staff should be vetted, as well as flight crew. Passengers, their luggage and freight should also be screened. Taking these broad requirements into account, it is essential to be able to authenticate or verify an individual, whether staff or traveller. Security experts recommend a three-pronged approach to proving identity:

• something you know (a password or access code)
• something you have (a physical token of some form factor)
• something you are (a biometric).

Such a system has to work with the various stakeholders charged with transport security:

• the airlines (passenger and carry-on/checked baggage)
• transport terminals (general security, law enforcement, parking, airport perimeter)
• the responsible agency (policies, regulation, audits and threat information)

In some cases, the airline and terminal management may choose to use private contractors for some of these services. How would biometrics be deployed in this scenario? Given that biometric technology has been deployed in airports on a limited basis, how would it be deployed on a wider scale?

2.Technology

According to Dennis Carlton, director of special projects at International Biometric Group, a biometric consulting firm, "A key issue for biometrics is that they should ideally support a one-to-one match for identification, and a one-to-many search against a watch list of security threats. This limits the number of technology options".

For one-to-one matching, these options include fingerprints, hand geometry and iris scans. A one-to-one system requires a user to enrol by submitting to background checks and to a scan that creates a template that subsequent scans are compared to. A one-to-one system must have a low false non-match rate and a low failure to enrol rate, otherwise a high percentage of individuals will require manual processing, leading to delays and a loss of confidence. Carlton noted that "A lot of errors come from a user's lack of familiarity", e.g. participating in a fingerprint scan with dry fingertips, requiring the user to be asked to rub the back of their ear with the fingertip, to coat it with oil. However, in order to process people speedily, the one-to-one match must be compatible with unattended operation.

For a one-to-many match there is facial scanning, where faces in the crowd are matched to photos of known suspects on file, by comparing nodal points formed by peaks and valleys of bones under the skin. A one-to-many system requires no enrolment. A one-to-many system has weaknesses in that it must match video clips of individuals in a crowd to a photo on file - not all terrorists are known to the authorities, and photos date over time as faces change. This is compounded by video quality, matching time, movement and crowding. There is a continuing debate about the accuracy of facial scanning, with supporters claiming over 90% accuracy and detractors claiming 50%. The sensitivity of a face scanner is tuneable, increasing accuracy, but resulting in more false positives, which would halt the flow of travellers through the system as security guards made the necessary manual checks.

If an individual can obtain a passport under an assumed identity and then enrol into a biometric system requiring their iris scan or fingerprint, they have slipped beyond the grasp of a biometric security system. The enrolment process should therefore require a background check. According to Carlton, many embassies in the developing world find it "Almost impossible to trust any passport that's brought forward because the fraud rate is so high and in fact, legitimate passports are still done by hand and are not machine readable, making it very hard to tell valid passports from forgeries". Overcoming some of these challenges creates huge opportunities for entrepreneurs, both as start-ups and departments within established organisations.

3. Logistics

Getting people through an airport and onto aircraft is a major logistical challenge. Low-cost airlines transport passengers on a point-to-point basis, and major carriers use a hub-and-spoke system leaving travellers and aircraft waiting at hubs for the next leg of a journey. This is also complicated by the fact that some regions have agreements for the freedom of movement, e.g. Schengen treaty in Europe.

Both airlines and airports want to move as many people through terminals as efficiently as possible, making the design of lanes vital. Implementing biometric technology will have an impact on the waiting times that passengers must endure. No airline or airport wants a reputation for being inconvenient to use. According to Carlton, "There's going to be lots of physical changes at all of the ports of entry if for no other reason we're going to have to do a better job of tracking people exiting the US so that you have a clear case closure on entry and exit"

Provision must be made for dealing with people who are rejected by the enrolment process. This could entail the use of both a primary and secondary biometric, and has implications for staffing, training, delays and the space for such equipment. According to Carlton, what's required is "Investment in changes in inbound lanes, staffing and the technology, so that you can absorb the performance issues that might arise because of the biometric".

A luggage-scanning machine capable of detecting bombs and plastic explosives costs around $1M, plus annual costs of approximately $750K for operation and maintenance. They are slow, handling only one planeload of luggage per hour, and they are inaccurate, with false alarms sounding off for 22 out of every 100 bags, requiring personnel to open and check the bags. They are also hard to fit into existing spaces, being sixteen feet in length and requiring reinforced floors. This logistical challenge actually presents opportunities for scanners that are cheaper, smaller (perhaps mobile) and can detect a wider range of threatening materials, e.g. metals, alloys and plastics.

There are voluntary schemes to fast track frequent fliers, involving background checks and some form of biometric, including the US INSPass programme, and similar schemes at Amsterdam Schipol & Tel-Aviv's Ben-Gurion airports. By screening passengers both prior to entering the gate concourse and upon boarding the ramp to the aircraft, it would be possible to generate accurate passenger manifests in real-time and allow airlines to match passengers with their luggage.

Airport and airline employees could be issued with biometric cards to restrict access to airport buildings and aircraft, and it is possible that such measures will be required as part of future insurance cover. Such schemes are already in place at Stuttgart airport and Chicago O'Hare.

4. Civil liberties

In order to encourage people to enrol onto a biometric scheme, they must be convinced that it is not a big brother scheme tracking their every move, but a system that proves that they are who they say they are. The distinction seems subtle, but makes a major difference in terms of benefits to end-users. This has advantages not just in travel, but also in combating fraud perpetuated by identity theft - a growing crime that can be committed anytime, anywhere. People are already identifiable by various government agencies, with unique numbers for health care, tax, voting, driving, and so on. What is missing however is a solid link to the individual at the point of a transaction, where it is vital that they are indeed who they say they are.

While not a strong issue in SE Asia, S America or developing nations, various civil liberties groups in Europe and N America, and the International Organisation for Migration (IOM) have raised concerns that face scanning could violate an individual's right against unreasonable searches, and that biometric data could be stored in centralised databases, allowing the exchange of biometric data with other government agencies.

How would these concerns be addressed? In terms of one-to-many face scans in public, they could be operated on the basis of "no match, no memory", although it would be a great challenge to convince travellers that their data wouldn't stored. For a one-to-one matching system this could be overcome by storing the biometric data on the card, and also matching it on the card - this actually enhances security because you are not at risk of unwittingly transmitting data to a rogue reader. However, the thickness of cards incorporating fingertip sensors need to be reduced in order for them to work with existing card readers, otherwise the implementation costs and rollout time will be crippling.

5. Harmonisation and interoperability

A weak link can undermine the entire transport network. In order to maintain the highest levels of security and confidence, systems & processes must be interoperable both nationally and internationally. Legislation must be overhauled and harmonised, for areas such as privacy, extradition, data protection, freedom of movement, etc.

Standards must be agreed for enrolment, including background checks. Biometric performance and accuracy must be objectively defined and not be vendor-dependent. Processes must be defined for manual processing when the enrolment process rejects individuals or when equipment failure occurs.

Above all, the system must function as a closed loop, updated with the latest threat data and upgradeable with the latest algorithms. In order to fit in with existing user behaviour and accelerate acceptance, it should be broadly compatible with the existing system of travel documents, e.g. passports & visas, by using photographs when the biometric has failed or is not present.

Standards for primary and secondary biometric will take ages to pick unless a powerful influencer, e.g. the US Government, creates a de-facto standard. Once a standard has been set as to the type of biometric, e.g. fingerprint or iris scan, the next challenge is to define standards for the specific biometric. According to Carlton, "The ISO is reticent to grant a standard designation for a technology (iris) that has only one implementation worldwide".

In terms of fingerprint matching, Carlton notes "You are unlikely to have a harmonisation among the major fingerprint algorithm vendors anytime soon. Each of the vendors has a major investment in the way they match fingerprints. To put their solution into the public domain risks their entire business model". This however should be improved with standardisation efforts such as BioAPI, as well as licensing arrangements from vendors such as Veridicom, who have licensed key intellectual property to STMicroelectronics, Fujitsu and Precise Biometrics.

6.Cost imperative

Security, whilst assuming greater importance post 9/11, must be balanced against costs and convenience. In terms of costs, research by The Chilli indicates that a fingerprint scanner for a PC costs $100 per seat, hand recognition is $200-1000 per unit, and iris recognition is in the range of $1500-9000 per seat. A card incorporating a fingertip sensor costs over $30 today, but is forecast to go below $10 over time. A single baggage scanner costs $1M. These costs exclude installation, maintenance, operation & training. Given the time delay imposed by performing such checks, multiple systems would have to be used in the individual lanes of any given airport terminal.

To develop an interoperable security infrastructure globally is in the order of billions of dollars, changing computer systems, converting data, updating legislation, training law enforcement personnel, etc. Any wide-scale deployment, even nationally, is a massive, multi-year exercise. Only government could fund such an undertaking.

Major carriers have operating margins of around 3-4%, with low-cost carriers in the range 9-20% (set to decline as they upgrade their fleets and deal with increased competition), making it hard for them to invest alone, although insurers can bring pressure to bear. According to a study recently carried out by the Federal Reserve Bank of St. Louis, unregulated private equity markets are unlikely to provide adequate aviation security. Carlton echoes this, saying "Governments have to fund extra research and deployment".

The costs of implementing increased security globally are prohibitive. It is instead much more likely that the weakest parts of the chain, e.g. staff access, voluntary schemes to fast-track travellers, will be strengthened and trust networks (for visa waivers, etc) between countries will be renewed.

7. Summary for entrepreneurs

• Biometrics are a small part of any heightened security solution for travel, and their true value can only be realised with harmonisation and interoperability on a wide scale driven by governments, whose sales cycles are lengthy, involving trials, tenders, etc
• With limited funds and time, the focus will be on strengthening the weakest parts of the chain, with airlines & airports taking smaller-scale initiatives
• Without counting the number of transportation employees in the world, the Air Transport Action Group in Geneva says that the air transportation industry alone employs around four million workers worldwide and airlines carry 1.6 billion passengers per year. According to the St. Louis Fed, prior to 9/11, the air transportation sector accounted for approximately 1% of U.S. employment.
• If several airlines, as part of an alliance, decided to adopt a voluntary fast-track scheme involving background checks and biometrics, the volumes would still be quite significant
• Other niche opportunities exist in areas such as freight (low-power RFID tags) and explosive substance detection (sensor technology)
• Bottom line - with potential revenue streams from this application area a little patchy, this is best pursued as an activity within a large, well-established organisation

Comments on this story? Send an e-mail to woz@TheChilli.com.

© Chilli Publishing Ltd 2003

07NOV2002