# Presentation: 666454

## Acceptance of Biometrics: Things That Matter That We Are Ignoring

**Andrew Patrick, Ph.D.**
**Information Security Group**
**Institute for Information Technology**
**http://iit-iti.nrc-cnrc.gc.ca**
**Andrew.Patrick@nrc-cnrc.gc.ca**
**http://www.AndrewPatrick.ca**

## “Biometrics are unique identifiers, but they are not secrets.”

**“****Biometrics are unique identifiers, ****but they are not secrets.”**

## "Many people consider this to be a scientific or technical question, but it’s more than that.  Ultimately we must adopt an integrated long-term system that is built on sound science, is socially and ethically acceptable to our citizens, and reflects their values.

Citizens need to be heard on important public policy issues. This dialogue provides an opportunity for people who do not belong to stakeholder groups to consider the long-term issues in a thoughtful and structured manner and to talk about what they value in determining a way forward."

***"Many people consider this to be a scientific or technical question, but it’s more than that.  Ultimately we must adopt an integrated long-term system that is built on sound science, is socially and ethically acceptable to our citizens, and reflects their values.***
***Citizens need to be heard on important public policy issues. This dialogue provides an opportunity for people who do not belong to stakeholder groups to consider the long-term issues in a thoughtful and structured manner and to talk about what they value in determining a way forward."***

**Nuclear Waste Management Organization**

## Slide 4

## policy matters

**policy matters**

## Slide 6

## Public Policy Debate

**Public Policy Debate**

**how to enhance the public-policy debate about biometrics?**** **
**how to instill understanding of the technological capabilities and limitations?**** **
***“...******the debate is surrounding a technology that the vast majority of people have no actual experience of using, and therefore what is not so clear is what these people really understand about it*****” **** **
**Furnell & Evangelatos, Computer Fraud & Security, 2007**

## context matters

**context matters**

**Notes:**
The likely factor that explains the discrepancy in acceptance is context, meaning the identity, place, time, and activity that is associated with using the biometric system. Thus, the acceptance of biometrics in a commercial context will likely be quite different from acceptance for border control or other government applications. 

## Slide 9

**Notes:**
Biometric systems are showing up in a wide variety of contexts, meaning places, applications, authorities, importance, etc.

## Slide 10

**Notes:**
“New Future in Store” Report for www.tnsglobal.com
4,600 online surveys with primary household shoppers during Jan-Feb 2008

## ApplicationSuitability

**Application****Suitability**

- Elliott, Massie, & Sutton, *The perception of biometric technology: A survey*. 2007 IEEE Workshop on Automatic Identification Advanced Technologies.

## Concerns are often not with the biometric system, but with the back-end processes and policies

**Concerns are often not with the biometric system, but with the back-end processes and policies**

**Notes:**
Biometric systems involve much more than gathering the physical or behavioral characteristics.

## privacy matters

**privacy matters**

**Notes:**
* deployments likely covered by provincial and/or federal privacy legislation
* privacy impact assessments would be required
* some tools and guidelines are emerging
* bioprivacy.org
* Ontario Privacy Commissioner recommendations for possible Toronto anti double-dipping deployment 
* require: encryption, single use, no match to latents, strict access controls, separate storage of personal information

## Deloitte & Touche survey in 2007 found little interest in Registered Traveler Program, with 75% citing privacy concerns 

**Deloitte & Touche survey in 2007 found little interest in Registered Traveler Program, with 75% citing privacy concerns **

**Notes:**
Federal Minister of the Interior 

As a protest against his support for the increasing use of biometric data, the influential hacker group Chaos Computer Club published one of Wolfgang Schäuble's fingerprints in the March 2008 edition of its magazine Datenschleuder. The magazine also included the print on a film that readers could use to fool fingerprint readers.

## Slide 16

## Schneier’s Mantra

**Schneier’s Mantra**

**“****Biometrics are unique identifiers, but they are not secrets.”**
**can biometrics be used to create unique secrets?**

## Ontario Privacy Commissioner and Biometric Encryption

**Ontario Privacy Commissioner and Biometric Encryption**

***Biometric Encryption technology not only holds the promise of superior privacy and personal control for individuals over their own biometric data, but also stronger information security and greater user confidence and trust in biometric identification systems.*****  **

**Notes:**
Ontario commissioner has recently released a white paper describing her interest in biometric encryption as a tool for doing reliable identification while protecting privacy.

## Selling Privacy Solutions

**Selling Privacy Solutions**

**"Here's a solution I've ****invented**** and patented which solves the problem you don't know you have, in ways you'll never understand. It gives you other benefits you never expected or sought and frankly wouldn't believe possible until you do the math, which you won't be able to." **
***Microsoft lines up with the good guys on identity tech*****, By William Heath, 4th April 2008, http://www.theregister.co.uk/2008/04/04/brands_credentica_analysis/**

## opinions matter

**opinions matter**

## Furnell & Evangelatos

**Furnell & Evangelatos**

**study of perceptions about biometrics in the UK**
**survey conducted Mar-June 2006**
**209 people via email or paper**
**65% of people had “heard or read about” biometrics**

## Sources of Knowledge

**Sources of Knowledge**

**Notes:**
Note the frequency of non-factual sources, such as sci-fi movies, and perhaps the Internet

## Preferences For Applications

**Preferences For Applications**

## Risks to Health

**Risks to Health**

## Easy to Cheat?

**Easy to Cheat?**

## Biometric Information Stolen

**Biometric Information Stolen**

## Limited Use

**Limited Use**

## Andrew’s Challenges

**Andrew’s Challenges**

**understand biometrics in-context **
**address non-secret nature of biometrics**
**address privacy issues**
**make strengths and limitations of biometrics transparent**
**engage in meaningful public policy debate**