U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

95–133 PDF 2005

USE OF BIOMETRICS TO IMPROVE

AVIATION SECURITY

(108–69)

HEARING

BEFORE THE

SUBCOMMITTEE ON

AVIATION

OF THE

COMMITTEE ON

TRANSPORTATION AND

INFRASTRUCTURE

HOUSE OF REPRESENTATIVES

ONE HUNDRED EIGHTH CONGRESS

SECOND SESSION

MAY 19, 2004

Printed for the use of the

Committee on Transportation and Infrastructure

(
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE

DON YOUNG, Alaska, Chairman

THOMAS E. PETRI, Wisconsin, Vice-Chair

SHERWOOD L. BOEHLERT, New York

HOWARD COBLE, North Carolina

JOHN J. DUNCAN, JR., Tennessee

WAYNE T. GILCHREST, Maryland

JOHN L. MICA, Florida

PETER HOEKSTRA, Michigan

JACK QUINN, New York

VERNON J. EHLERS, Michigan

SPENCER BACHUS, Alabama

STEVEN C. LATOURETTE, Ohio

SUE W. KELLY, New York

RICHARD H. BAKER, Louisiana

ROBERT W. NEY, Ohio

FRANK A. LOBIONDO, New Jersey

JERRY MORAN, Kansas

GARY G. MILLER, California

JIM DEMINT, South Carolina

DOUG BEREUTER, Nebraska

JOHNNY ISAKSON, Georgia

ROBIN HAYES, North Carolina

ROB SIMMONS, Connecticut

SHELLEY MOORE CAPITO, West Virginia

HENRY E. BROWN, JR., South Carolina

TIMOTHY V. JOHNSON, Illinois

DENNIS R. REHBERG, Montana

TODD RUSSELL PLATTS, Pennsylvania

SAM GRAVES, Missouri

MARK R. KENNEDY, Minnesota

BILL SHUSTER, Pennsylvania

JOHN BOOZMAN, Arkansas

CHRIS CHOCOLA, Indiana

BOB BEAUPREZ, Colorado

MICHAEL C. BURGESS, Texas

MAX BURNS, Georgia

STEVAN PEARCE, New Mexico

JIM GERLACH, Pennsylvania

MARIO DIAZ-BALART, Florida

JON C. PORTER, Nevada

VACANCY

JAMES L. OBERSTAR, Minnesota

NICK J. RAHALL, II, West Virginia

WILLIAM O. LIPINSKI, Illinois

PETER A. DEFAZIO, Oregon

JERRY F. COSTELLO, Illinois

ELEANOR HOLMES NORTON, District of

Columbia

JERROLD NADLER, New York

ROBERT MENENDEZ, New Jersey

CORRINE BROWN, Florida

BOB FILNER, California

EDDIE BERNICE JOHNSON, Texas

GENE TAYLOR, Mississippi

JUANITA MILLENDER-MCDONALD,

California

ELIJAH E. CUMMINGS, Maryland

EARL BLUMENAUER, Oregon

ELLEN O. TAUSCHER, California

BILL PASCRELL, JR., New Jersey

LEONARD L. BOSWELL, Iowa

TIM HOLDEN, Pennsylvania

NICK LAMPSON, Texas

BRIAN BAIRD, Washington

SHELLEY BERKLEY, Nevada

BRAD CARSON, Oklahoma

JIM MATHESON, Utah

MICHAEL M. HONDA, California

RICK LARSEN, Washington

MICHAEL E. CAPUANO, Massachusetts

ANTHONY D. WEINER, New York

JULIA CARSON, Indiana

JOSEPH M. HOEFFEL, Pennsylvania

MIKE THOMPSON, California

TIMOTHY H. BISHOP, New York

MICHAEL H. MICHAUD, Maine

LINCOLN DAVIS, Tennessee

(II)
SUBCOMMITTEE ON AVIATION

JOHN L. MICA, Florida, Chairman

THOMAS E. PETRI, Wisconsin

JOHN J. DUNCAN, JR., Tennessee

JACK QUINN, New York

VERNON J. EHLERS, Michigan

SPENCER BACHUS, Alabama

SUE W. KELLY, New York

RICHARD H. BAKER, Louisiana

FRANK A. LOBIONDO, New Jersey

JERRY MORAN, Kansas

JOHNNY ISAKSON, Georgia

ROBIN HAYES, North Carolina

TIMOTHY V. JOHNSON, Illinois

DENNIS R. REHBERG, Montana

SAM GRAVES, Missouri

MARK R. KENNEDY, Minnesota

BUD SHUSTER, Pennsylvania

JOHN BOOZMAN, Arkansas

CHRIS CHOCOLA, Indiana, Vice Chairman

BOB BEAUPREZ, Colorado

STEVAN PEARCE, New Mexico

JIM GERLACH, Pennsylvania

MARIO DIAZ-BALART, Florida

JON C. PORTER, Nevada

VACANCY

DON YOUNG, Alaska

(Ex Officio)

PETER A. DEFAZIO, Oregon

LEONARD L. BOSWELL, Iowa

WILLIAM O. LIPINSKI, Illinois

JERRY F. COSTELLO, Illinois

ELEANOR HOLMES NORTON, District of

Columbia

ROBERT MENENDEZ, New Jersey

CORRINE BROWN, Florida

EDDIE BERNICE JOHNSON, Texas

JUANITA MILLENDER-MCDONALD,

California

ELLEN O. TAUSCHER, California

BILL PASCRELL, JR., New Jersey

TIM HOLDEN, Pennsylvania

SHELLEY BERKLEY, Nevada

BRAD CARSON, Oklahoma

JIM MATHESON, Utah

MICHAEL M. HONDA, California

RICK LARSEN, Washington

MICHAEL E. CAPUANO, Massachusetts

ANTHONY D. WEINER, New York

NICK J. RAHALL II, West Virginia

BOB FILNER, California

JAMES L. OBERSTAR, Minnesota

(Ex Officio)

(III)

(V)

CONTENTS

TESTIMONY

Page

Huddart, Martin, Chairman, Board of Directors, International Industry Association .................................................................................................................... 10

Norton, Richard E., Executive Vice President, National Biometric Security

Project ................................................................................................................... 10

Rhodes, Keith A., Chief Technologist, Applied Research and Methods, U.S.

General Accounting Office ................................................................................... 6

Verdery, Hon. Stewart, Assistant Secretary for Policy, Border and Transportation Security, U.S. Department of Homeland Security ................................. 6

PREPARED STATEMENT SUBMITTED BY A MEMBER OF CONGRESS

Johnson, Hon. Eddie Bernice, of Texas .................................................................. 48

PREPARED STATEMENTS SUBMITTED BY WITNESSES

Huddart, Martin ...................................................................................................... 40

Norton, Richard E. ................................................................................................... 52

Rhodes, Keith A. ...................................................................................................... 56

Verdery, Hon. Stewart ............................................................................................. 83

ADDITION TO THE RECORD

Report of the 2002 Silicon Valley Blue Ribbon Task Force on Aviation Security and Technology, June 17, 2002 .................................................................... 92

(1)

USE OF BIOMETRICS TO IMPROVE AVIATION

SECURITY

Wednesday, May 19, 2004

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON AVIA- TION, COMMITTEE ON TRANSPORTATION AND INFRA- STRUCTURE, WASHINGTON, D.C.

The subcommittee met, pursuant to call, at 10:05 a.m. in room

2167, Rayburn House Office Building, Hon. John L. Mica [chairman of the subcommittee] presiding.

Mr. MICA. Good morning. I would like to call the meeting of the

Aviation Subcommittee to order.

This morning’s hearing is going to focus on the use of biometrics

to improve aviation security, and also review some of the progress

of instituting biometric standards with the Department of Homeland Security and other Federal agencies.

We have two panels. I am going to ask all of the panelists to

come up today and join us. We will hear from the Government

panel first, and the second panel right afterwards. Somehow they

want to be separated. But we will get them together here. I am a

uniter, not a divider.

We are going to start with opening statements from Members. So

we will start this morning’s hearing with my opening statement,

and then I will yield to other Members as they join us.

Again, the purpose of today’s hearing is to review the progress,

or lack of progress, in using biometric technologies to improve aviation security, and also to examine how similar biometric standards

are being incorporated into our existing security systems.

We are spending billions of dollars each year to screen passengers and bags for weapons and explosives. But after some two

and a half years since September 11, we have failed to adopt a biometric standard to address the even more basic problem of airport

access control. The low tech security credentials that are currently

being used to authorize access to the most sensitive areas of our

Nation’s aviation system could be courting disaster. Our multibillion screening regime is defenseless against a terrorist who uses a

lost, stolen, or forged security badge or law enforcement officer credential to walk right past a screening checkpoint.

This Committee took action on this issue in the Aviation Transportation Security Act, which was enacted shortly after the terrorists acts of September 11. I have got up on the screen the provisions of this Act dealing with biometrics. The Act includes several

provisions intended to strengthen airport access control through

the use of biometrics. I look forward to hearing from our witnesses

today regarding the actions that have been taken in response to
2

these provisions, or the lack of response. And again, we have various sections of the bill that refer to these requirements or directives, that language put into the Act, we want to hear about

progress on.

Unfortunately, we have a hodgepodge of airport security credentials today and access control systems at our Nation’s airports.

Each individual airport is responsible for its own security and

issues its own security badges. These badges are referred to as

‘‘sterile’’ and given the acronym SIDA badges. To date, they contain

no biometric standard. The sterile badges authorize access to the

terminal areas beyond screening checkpoints.

Biometrics could improve employee, passenger, and flight crew

identify verification and access authorization. For example, adding

biometrics to existing access control systems could protect against

unauthorized accessing using lost, stolen, or forged badges. Biometrics could also protect against a terrorist on a Watch List attempting to obtain a credential using an assumed identity. In addition, biometrics could protect against the impersonation of a pilot,

other crew member, air traffic controller, or employee of the airport.

Biometrics could also help close a similar gaping hole in our aviation security system having to do with law enforcement credentials.

Currently, law enforcement officers armed with a weapon can fly

at any time simply by presenting their agency’s credential. In fact,

law enforcement officers from 18,000 separate State and local law

enforcement agencies may fly armed if they present their agency’s

credential and a letter on their agency’s letterhead stating they

have an official work related reason to fly armed. And this does not

include the multitude of Federal law enforcement personnel.

Lost, stolen, or forged law enforcement credentials could easily

be used by unauthorized persons to carry guns on board. I just

asked one of my sheriffs to show me what they need to present. So

they write a letter, and this is a copy of the credentials that the

Volusia County Sheriff’s Office is required to present. Now let me

say, I have no problem with officers carrying weapons on board

from some 18,000 agencies or Federal officers. The problem I have

is having some biometric standard to ensure that that is the individual who is authorized. I want to make that perfectly clear.

Fake badges of all kinds are widely available on the Internet. In

just ten minutes worth of research, one of my Subcommittee staffers located the following sources on the web. They have got it up

on the screen here. Slide one, badge stuff.com is where you can buy

all the equipment and software you need to make your own badges.

Slide two, at fire store on line.com you can buy a sheriff’s badge

for $39.99. Slide three, make your own fake IDs.com is where you

can have an ID card tailored to your specifications. Slide four, select from 1,816 different ID card logos, including many police department logos. Slide five, buyidentity.com boasts of the most advanced technology, including features such as bar codes, smart

chips, and overlay holograms. So, I was a little bit shocked by what

we found. And this is not to degrade the talents of any college student who can make great IDs. We were going to display some of

those but the local bars wanted to hold on to them.
3

Using biometrics may be the only way to ensure that the person

presenting the law enforcement or other credentials is actually entitled to that credential. Even more startling is that GAO conducted an undercover test on exactly this issue in the year 2000.

GAO agents created fake law enforcement identification using commercially available software packages and information downloaded

from the Internet. The agents then used the faked credentials to

perform penetration tests at various Federal buildings as well as

two commercial airports. The GAO agents were 100 percent successful in penetrating each site.

At the two airports GAO visited, the agents used tickets that had

been issued in their undercover names. These agents declared

themselves to be armed law enforcement officers, displayed their

counterfeit badges and identification, and were issued law enforcement boarding passes. The GAO agents then presented themselves

at the security checkpoints and were waived around the

magnetometers. Neither the agents nor their briefcases were

screened. A copy of the GAO report on this penetration test was

later found in an Al Qaeda cave in Afghanistan we have learned.

I have got a copy of testimony, this is not the report but is testimony, before the Subcommittee on Crime of the House Committee

on Judiciary, dated May 2005, and I will submit that for the

record. Without objection, so ordered.

Let me also say, I recognize that biometrics may not be a total

panacea. Biometrics can tie an identity to a particular person, but

biometrics alone cannot ensure that the identity is always accurate

or that the person is not a potential terrorist. Furthermore, biometric systems are not 100 percent accurate, and certain systems may

be vulnerable to intentional thwarting. For example, some fingerprint systems, I am told, can be thwarted by the use of a fingerprint impression on a gummy bear. Not very sophisticated, but I

understand it works.

Two and a half years later and approaching the three year anniversary of September 11, we still lack performance data on many

biometrics. Without large data samples to use for testing and methodology standards for such testing, it is difficult to evaluate each

of the many vendors’ claims of accuracy. Even with these caveats,

however, I believe the use of biometrics still has the potential to

significantly improve aviation security. Again, it has been some two

and a half years, going on three years since September 11th and

we know that airport access remains of interest to terrorists. According to the Transportation Security Administration, within the

past few months alone there have been several suspicious incidents

of possible surveillance of airports, including surveillance of an

area containing a SIDA access door.

We need to address this issue without delay. I am kind of surprised that nearly three years later we still do not have a biometric

standard adopted at the Federal level that can be used as a model

for Federal identification for State and local and other agencies

with some certainty of properly identifying the individuals who

carry those credentials.

I look forward to hearing the testimony of our witnesses on this

important topic and discussing the ways in which biometrics may

be used to close the gap in our security system.
4

I would like to yield at this time to the Ranking Member, Mr.

DeFazio.

Mr. DEFAZIO. Thank you, Mr. Chairman, and thank you for your

persistence in this matter. Unfortunately, it seems that the Transportation Security Administration is continuing to move at a glacial

pace on these issues. For the life of me, I cannot understand why

we have not been able to develop and issue a uniform national

transportation worker identification card. It is beyond me. How

could this take years? We have this mishmash of badges, some of

which are flashed at rather inattentive security guards, as we noticed at Detroit airport, to gain access to the terminal without any

minimal screening while you are wearing a bulky coat and carrying

big bags full of whatever. This is security? This is just extraordinary to me.

We have created the illusion of security for the American people.

It manages to inconvenience them, put them in long lines, but they

all say, everyone I talk to, ‘‘I do not mind, it is making us safe.’’

But if they knew people were going around the system—and I almost had the briefing two weeks ago to answer the question I have

been asking for more than a year, how many airports allow vendors

and other people who work in the airport to freely go in and out

daily without going through any security at all? But for some reason, the briefing was canceled, so I have not had it. So we do not

have uniform identification cards. In some airports, how many hundreds of thousands a people a day, we do not know, people flash

these non-uniform cards at inattentive guards and walk through,

while the pilots, the flight attendants, and all the passengers are

over there standing in long lines to go through security.

These are not unsophisticated people we are dealing with in any

fashion. They tested the system again and again and again before

they struck on September 11. The Chairman displayed the GAO report. He showed you that people can go on line and buy fake IDs.

Why can we not get to a uniform national ID for transportation

workers, for anybody who is getting access to secure areas in airports? I think it is a reasonable question. And why has it taken

more than two years? I think the technology exists, I think there

are plenty of models out there in the private sector, in other Government sectors. And then biometrics, not only doing the background checks on the people to be certain they are who they say

they are, but then issuing them a card which will verify that they

are the person to whom that card was issued. Again, the technology has existed for years. It is being used elsewhere in the private sector. It is being used by other levels of government in this

country, other governments around the world. Why can’t the

United States of America, the country who was attacked, put in

place such a system? Why are we taking this sort of lackadaisical

attitude toward this? I just do not understand.

And finally, I am pleased to see, after the Chairman and I for

two years have been raising the issue of trying to reduce the burden on the screeners, expedite passengers through the airports,

and help the airlines with some of their highest revenue customers,

we are finally, after two years, moving ahead with what has been

called a number of things, but a trusted or Registered Traveler

Program, where we will be able to expedite people whose back-
5

grounds have been vetted, who will be issued, hopefully, I am not

sure what you can issue them, some sort of a biometric identification, through security lines. This could help the airlines, it could

help the screeners and security by allowing them to focus on unknown people, and it will be an improvement in the system. I am

pleased the pilot is moving forward. I will be looking forward to understanding and being briefed on that.

But on these other issues, I have got to say, time and time again

the Chairman has convened meetings—privately, publicly, secure

and unsecure—and we have raised these issues time and time

again, and here we are two years later and we are still talking

about it. I fear that someday this is going to have catastrophic consequences. We have got to get this done. Thank you, Mr. Chairman.

Mr. MICA. I thank the gentleman. Other opening statements?

Mr. Matheson?

Mr. MATHESON. Thanks, Mr. Chairman. Just real briefly. It is

real clear that we have got to do better at securing our airports.

We have got to embrace technology and we have got to embrace

biometrics.

I introduced the Aviation Security Technology Enhancement Act

on October 11, 2001, along with my colleague Congressman Honda.

That legislation called for the establishment of best practices for

emerging aviation security technologies, and it created a pilot program for the FAA to test new and emerging aviation technologies

in at least 20 airports across the country. Our legislation would

have taken the necessary steps to examine the effectiveness and

cost of security technologies, including biometrics, in our Nation’s

airports.

I was pleased that many of the provisions of that legislation were

included in the aviation security legislation that was passed by

Congress and signed into law almost three years ago. The provision

was in the item that was up on the screen at the start of this hearing a few minutes ago. Specially, there is a provision that established demonstration projects at 20 airports nationwide to evaluate

emerging security technology. So I look forward to hearing from today’s witnesses about the status of these demonstration projects,

which I remain hopeful that efforts from those projects will pave

the way for more efficient and effective security in airports

throughout the country. I yield back.

Mr. MICA. I thank the gentleman. Any further opening statements? If not, we will go right to our panel of witnesses. We will

recognize first the Honorable Stewart Verdery, Assistant Secretary

for Policy, Border and Transportation Security, U.S. Department of

Homeland Security. We also have another Government witness,

which is Keith Rhodes, Chief Technologist, Applied Research and

Methods, U.S. General Accounting Office. So we will hear from the

two Government panelists first.

Stewart Verdery, Assistant Secretary for Policy, Border and

Transportation Security of DHS. Welcome, sir, and you are recognized.
6

TESTIMONY OF HON. STEWART VERDERY, ASSISTANT SECRETARY FOR POLICY, BORDER AND TRANSPORTATION SECURITY, U.S. DEPARTMENT OF HOMELAND SECURITY; AND

KEITH A. RHODES, CHIEF TECHNOLOGIST, APPLIED RESEARCH AND METHODS, U.S. GENERAL ACCOUNTING OFFICE

Mr. VERDERY. Thank you, Chairman Mica, Mr. DeFazio, and

other distinguished members of the Committee, it is a pleasure to

appear before you today to discuss how the Department of Homeland Security is using biometrics to enhance aviation security and

also to facilitate legitimate trade and travel. This is my first opportunity to appear before this Subcommittee and I hope that in my

role as Assistant Secretary as Border and Transportation Security

Policy and Planning, I will be able to explain how we are using biometrics to enhance the security and facilitation missions assigned

to the BTS directorate and our agencies.

Biometrics is the science of identifying, recording, and matching

unique physical characteristics, such as fingerprint, facial, iris, or

hand, to particular individuals. The ability to verify and freeze an

individual’s identity in this manner has numerous applications for

improving the security and efficiency of our transportation and immigration systems.

The Department, under the leadership of our Science and Technology Directorate, is assessing future applications for biometrics

and also examining how to leverage the success of existing programs. One of the principal reasons for having a BTS Directorate

is to oversee programs run by our bureaus, that is Transportation

Security Administration, Customs and Border Protection, and USVISIT, among others, is to find synergies and to apply lessons

learned across multiple program offices.

One of these offices, of course, is US-VISIT, which has been deployed successfully while meeting its goals of enhancing security,

facilitating travel and trade, ensuring integrity of our immigration

systems, and protecting privacy. US-VISIT is adding an average of

only 15 seconds to the inspection process, yet is significantly enhancing the security of travellers by collecting biometric and biographic information, comparing that information with data collected by the Department of State at the time of visa issuance, and

vetting the biographic and biometric information against Watch

Lists and other criminal history information.

Today, more than 130 of the 211 visa-issuing posts overseas are

capturing fingerscans and photographs of foreign nationals when

they apply for visas. At the U.S. border, visitors provide this biometric as well as biographic and other documentation which is

checked against the US-VISIT databases, including visa issuance

information, terrorist watchlists, and immigration status information. In its first four months of operation, DHS has processed over

4 million foreign applicants for admission through US-VISIT at our

air and sea ports of entry. During that period, approximately 340

individuals were identified by biometrics alone as being the subject

of a lookout, some 60 percent for criminal violations. Among the

many hits was a drug dealer who had entered the U.S. more than

60 times in the past four years using multiple names and dates of

birth, before being detected on his first trip under US-VISIT.
7

The Department is also exploring the use of biometric technology

to better secure sterile areas in airports. TSA has commenced

Phase I of the Airport Access Control pilot program. One project,

for example, will test a system that combines fingerprint biometrics

and RFID technology to control vehicle access. Another will test a

system that uses fingerprint biometric technology to allow only authorized persons to enter secure areas of an airport. And yet a

third will control access to the secure area via an iris biometric recognition system.

In a fusion of access control and identification purposes, TSA has

been testing alternatives for developing and/or implementing a secure credential for transportation workers through the TWIC program. These credentials could be used to mitigate potential threats

posed by workers in the transportation sector with fraudulent identification. The program is intended to enhance security controls applicable to personnel whose duties require unescorted access to secure areas of a transportation system.

An implemented TWIC program would most likely incorporate

the use of biometrics to identify each TWIC holder as unique, linking individuals to their cards and to their security assessment. Biometrics could also be incorporated locally as part of a physical and/

or logical access control, leveraging the existing local facility control

systems to the maximum extent possible.

The current phase of TWIC includes testing at a variety of transportation facilities, a complete cost benefit analysis, and a review

of security effectiveness. And biometrics will clearly be a key component of whatever shape the TWIC program takes in the future.

Now concerning the Registered Traveler Pilot Program, as mentioned in the opening statements, I share the Subcommittee’s keen

interest in establishing an RT program that will attract travelers

and allow TSA to better utilize its resources.

TSA’s pilot testing for a Registered Traveler program is designed

to determine the feasibility of providing expedited movement

through airport security checkpoints for travelers who volunteer

personal information and receive a clean security assessment. Volunteers who participate in such an RT pilot program will be required to submit personal data, such as biometrics, that will be

used for identity verification. Participants in the program will still

be required to submit to screening for weapons, explosives, and

prohibited items at the checkpoint. And in June, TSA will begin RT

pilots at a limited number of airports which will last for approximately 90 days.

Part of the RT pilot program will focus on improving law enforcement officer LEO credentials. The use of so many different types

of LEO credentials increases the risks of an unauthorized armed

person could use the forged credential to board an airplane. Under

the RT pilot, LEOs who wish to fly armed at the five pilot airports

will be issued a biometric identification card by TSA to ensure that

the individual seeking to carry a gun on board is, in fact, authorized to do so by the LEO’s parent agency.

In conclusion, the advent of automated matching capability gives

us the ability to improve performance and permit the deployment

and use of new biometric technologies to assist us in freezing or fixing the identities of foreign nationals, improving document secu-
8

rity, and deterring illegal access. In order to maximize our return

on investment, it is vital that Federal agencies and associated industries who are also responsible for security of infrastructure

work together to create compatible systems which will bring our

Nation’s transportation and immigration security systems into the

21st century. Technology must be utilized in achieving our goals of

secure U.S. borders and transportation systems and open doors to

legitimate trade and travel.

I thank you for the opportunity to be here. I look forward to your

questions.

Mr. MICA. Thank you, and we will hold questions.

We will hear next from Keith Rhodes, Chief Technologist, Applied Research and Methods, of the U.S. General Accounting Office.

Welcome, sir, and you are recognized.

Mr. RHODES. Thank you. Chairman Mica, Ranking Member

DeFazio, and members of the Subcommittee, I appreciate the opportunity to participate in today’s hearing on the use of biometrics

for aviation security.

Technologies called biometrics can automate the identification of

people by one or more of their distinct physical or behavioral characteristics—by something they are. The term biometrics covers a

wide range of technologies that can be used to verify identity by

measuring and analyzing human characteristics. Biometrics theoretically represent a more effective approach to security because

each person’s characteristics are thought to be distinct and, when

compared with identification cards and passwords, are less easily

lost, stolen, or guessed.

When used for personal identification, biometric technologies

measure and analyze human physiological and behavioral characteristics. Unlike conventional identification methods that use something you have, such as an identification card to gain access to a

building, or something you know, such as a password to log on to

a computer system, these characteristics are integral to something

you are.

Biometric technologies vary in complexity, capabilities, and performance, but all share several elements. Biometric identification

systems are essentially pattern recognition systems. They use acquisition devices such as cameras and scanning devices to capture

images, recordings, or measurements of an individual’s characteristics and computer hardware and software to extract, encode, store,

and compare these characteristics. Because the process is automated, biometric decision-making is generally very fast, in most

cases taking only a few seconds in real time.

Depending on the application, biometric systems can be used in

one of two modes—verification or identification. Verification, also

called authentication, is used to verify a person’s identity; that is,

to authenticate that individuals are who they say they are. Identification is used to establish a person’s identity; that is, to determine who a person is, regardless of who they say they are. Although biometric technologies measure different characteristics in

substantially different ways, all biometric systems start with an

enrollment stage followed by a matching stage that can either use

verification or identification.
9

Biometrics is a relatively young technology, having only recently

reached the point at which basic matching performance can be acceptably deployed. It is necessary to analyze several metrics to determine the strengths and weaknesses of each technology and vendor for a given application. The effectiveness of any biometric system is a balance between (1) the false match rate—that is, how

many times someone is incorrectly identified as being someone else;

(2) the false non-match rate—how many times someone is not identified as who they are; and (3) failure to enroll rate—how many

times people are not able to enroll in the system for whatever reason.

Identifying, exchanging, and integrating information from different and perhaps unfamiliar sources and functions are essential

to an effective biometrics application. Without standards, system

developers may need to define in detail the precise steps for exchanging information, a potentially complex, time-consuming, and

very expensive process. Progress has been made in developing biometrics standards; however, the majority of biometric devices and

their software are still proprietary in many respects. For example,

the method for extracting features from a biometric sample, such

as a fingerprint, differs among most, if not all, vendors. Devices

from company A do not necessarily work compatibly with devices

from companies B and C.

As you have heard, the FAA, and subsequently DHS and TSA,

have been examining the use of biometrics for aviation security for

several years. They, with the Department of Defense, examined the

use of biometrics in four aviation security applications: (1) identity

verification of employees and ensuring that access to secured areas

within an airport is restricted to authorized personnel; (2) protection of public areas in and around airports using surveillance; (3)

identity verification of passengers boarding aircraft; and (4) identity verification of flight crews prior to and during a flight. In 2002,

TSA contracted with the International Biometric Group to evaluate

the use of biometrics for automated surveillance within airports,

trusted traveler cards for passengers, and identity verification of

employees for access control in airports.

And as you have stated, Mr. Chairman, since the 2001 terrorist

attacks, the Congress has directed a greater use of biometrics.

While biometric technology is currently available and used in a variety of applications, questions do remain regarding the technical

and operational effectiveness of biometric technologies in largescale applications. We have found that a risk management approach can help define the need and use for biometrics for security.

Biometric technologies are available today that can be used for

aviation security. However, it is important to bear in mind that effective security cannot be achieved by relying on technology alone.

Technology and people must work together as part of an overall security process. As we have pointed out, weaknesses in any of these

areas diminish the effectiveness of the security process.

We have found that three key considerations need to be addressed before a decision is made to design, develop, and implement biometrics into a security system: (1) Decisions must be made

on how the technology will be used; (2) a detailed cost-benefit analysis must be conducted to determine that the benefits gained from
10

a system outweigh the costs; and (3) a trade-off analysis must be

conducted between the increased security, which the use of biometrics would provide, and the effect on areas such as privacy and

convenience.

Mr. Chairman, this concludes my statement. I would be pleased

to answer any questions that you or members of the Subcommittee

may have.

Mr. MICA. Thank you. I will withhold questions. I want to hear

from the other two panelists, Mr. Richard Norton, Executive Vice

President of the National Biometric Security Project; and Mr. Martin Huddart, Chairman of the Board of Directors of the International Biometric Industry Association.

We will first hear from Richard Norton, with the National Biometric Security Project.

TESTIMONY OF RICHARD E. NORTON, EXECUTIVE VICE PRESIDENT, NATIONAL BIOMETRIC SECURITY PROJECT; AND

MARTIN HUDDART, CHAIRMAN, BOARD OF DIRECTORS,

INTERNATIONAL INDUSTRY ASSOCIATION

Mr. NORTON. Good morning, Mr. Chairman, and members of the

Subcommittee. Thank you for the opportunity to testify on behalf

of the National Biometric Security Project, or NBSP. NBSP is one

clear sign of Congress’ commitment to establish comprehensive new

security capabilities in the wake of September 11th--to plug the

sort of holes in our system that have been noted this morning--by

developing sophisticated advanced biometric technologies solutions

to address this specific need.

The specific mission of the NBSP is to provide the Federal Government with the R&D capabilities, the testing and evaluation capabilities, and the deployment experience to get these broad based

solutions in place and address these gaps in the critical infrastructure. We are, therefore, concentrating in four key areas to address

this problem. The first area is to sort of conduct the applied research necessary to know what our requirements are. Second is to

establish a cadre of trained professionals who can deploy these solutions, the scientists, the engineers, and the experts, of which

there are only a handful today, by creating educational programs

to provide that level of expertise. Third, we are establishing a testing and evaluation capability, as noted by both the Department of

Homeland Security and GAO, to make sure that vendors’ claims

are accurate, and to make sure that the equipment will perform as

expected in the rigorous operational environments that we often

face. Conducting trials in laboratories is one thing. Making sure

they operate under a variety of ambient conditions and over a long

period of time is another story. And finally, we have been moving

forward aggressively in the area of standards to make sure that we

are adequately represented and push the United States standards

agenda in every forum possible to make sure we have the interoperability needed to make these systems work.

We have a lot of lessons we have already learned about how effective biometrics can be, especially within an airport footprint. A

program has run at San Francisco for the better part of a decade

now that has proved that you can manage a system, that it is a

cost effective system, and that it can help protect your airport with
11

your employees, making sure that only the authorized people have

access to sensitive areas such as ramps and the jetways. That program, as I said, has been in place for ten years.

However, biometrics have not expanded much beyond that extent, for a variety of reasons. The Federal aviation regulations

noted the need to identify people securely. And as we have seen

today, merely having an ID badge in your hand does not provide

that level of security. But biometrics were not mandatory and no

clear mention was made of the desire to move in that direction

until September 11th. Now a number of efforts are underway to address that problem.

TSA’s Airport Access Control Program is one of those. It should

help supplement the information we already have on sites such as

San Francisco with good metrics on how other biometrics can get

measurements of usability of these biometrics. We think that between the San Francisco experience and the TSA trials, a clear

case will be made that an airport footprint can be protected using

current biometric technology. The bigger challenge is going to be to

move forward with a national program that can cover the itinerant

workers in the system, the people who are not just employees of

a particular airport, but move about in the course of the their business, such as airline employees who will show up at a variety of

different airports, often multiple airports, in a single day. To address this, we are looking at a number of things to prime the

pump: Again, interoperability standards; taking steps to ensure

that the problem of multiple identities can be corrected; and ensuring that the systems developed recognize cost factors and certain

privacy concerns about sharing of the information.

The Transportation Worker ID Card Program we think provides

a solid structure for addressing this problem. TWIC has come up

with a good concept of operations where people will be screened for

multiple identities using fingerprints and face recognition technologies. However, applying those same technologies might not be

the most appropriate way to protect an airport. We think the TWIC

architecture has taken into account the need to be able to upgrade

the system, adopt new technologies as they are introduced, and

apply the best biometric technology to the particular operational

need. TSA is also examining the existing infrastructure to try to

make sure that we leverage existing capabilities. NBSP thinks that

this is an absolute essential compliment of the approach to make

sure that we can introduce such a system in a cost effective way.

NBSP is taking a couple of different actions on a variety of different levels to make sure that we have the testing and research

support that is available to the Government as they move forward

with deployment. For example, Mr. Chairman, you noted the requirement for a database of information that can help with research. We are working actively with TSA and NIST in establishing a database of fingerprint, iris, and face recognition templates

that can be used for further research to make sure that these technologies work properly in the field.

Again, we are establishing a laboratory that can provide the sort

of testing regime that can evaluate the effectiveness of biometric

products and solutions prior to their installation in the field. And

we are developing a cadre of trained biometric professionals who
12

not only can do the testing, but also be of assistance in developing

the requirements and supporting deployment.

We are also working with the Customs and Border Protection

Bureau and also US-VISIT Program Office to identify citizens who

are coming into the country in an effective way, kind of a registered traveler program on behalf of U.S. citizens, who are often

the forgotten component at the borders and often are now forced

to wait in long lines.

So we are working actively with the Administration on a number

of fronts to provide these capabilities, as directed by Congress, and

would certainly welcome any questions about the efforts of NBSP

to date. Thank you.

Mr. MICA. Thank you.

We will hear now from Martin Huddart, who is Chairman of the

Board of Directors of the International Biometric Industry Association. Welcome, and you are recognized.

Mr. HUDDART. Thank you, Mr. Chairman, and the Subcommittee

for the opportunity to speak on behalf of the International Biometric Industry Association.

Biometrics have had a long history in both the public and private

sectors of protecting critical national infrastructure, computer networks, preventing welfare fraud, border control, and even labor

management. I think when restaurant workers in McDonald’s are

punching in for work using biometrics, I am comfortable that this

is no longer new and emerging technology.

Since 9–11 there have been many initiatives with biometrics.

However, two and a half years later, there has been little done to

implement the technologies outside of the US-VISIT program. Fifteen years ago, the Department of Energy of the U.S. Government

decided that credentials alone were not sufficient to protect our Nation’s nuclear facilities. They decided that a credential had to be

tied to an individual using biometrics. So today, and for the past

15 years, hand readers have protected our Nation’s nuclear facilities, 97 percent of those facilities in this country.

Looking at the aviation segment, current TSA regulations imply

the need for biometrics. For example, regulations state ‘‘only those

individuals authorized to have unescorted access’’ should have access. The regulations do not say authorized pieces of plastic, it says

‘‘authorized individuals.’’ That implies the need for biometric technology to meet current regulations in aviation. Cards are just

pieces of plastic that can be used by other people. For example, a

colleague of mine was told confidentially by a Category X airport

in the United States—that is one of the top 20 airports—that in a

given year 400 badges go missing at that airport and are replaced.

I think that represents a significant security issue.

There is a long track record of biometrics in aviation in the

United States. Mr. Norton mentioned San Francisco Airport has

been doing this since 1991. Today, 15,000 workers at San Francisco

Airport will use biometrics to get to the air operations area. In

total, to our best knowledge, there are about eleven airports with

significant deployments of biometrics today in the United States.

Out of a total of 429, that represents less than 3 percent using

hand geometry, fingerprint, and iris technologies in airports. Com-
13

pare that 3 percent in aviation with 97 percent in the nuclear industry.

It is ironic that some of the well-intentioned efforts that came

out after 9–11, and I personally spent time with Congressman

Matheson and Congressman Honda on some of these initiatives,

some of them, unfortunately, have actually I believe slowed

progress down. For example, the pilot program to implement biometrics at 20 airports. We are now just entering the first eight airports to be installed with the pilots and I think we are many, many

months away from a conclusive report. And it is unclear to me

what the outcome of that effort will be. Curiously, some of the more

proven technologies have been excluded from this testing so far as

we focus on new and emerging technologies, not proven technologies. Through my own calculations, I estimate that the money

spent on this pilot effort could have retrofitted by now 45 of the top

200 airports with biometric technology.

Turning now to the Transportation Workers ID Credential. I

think this is a very positive program and it provides a clear infrastructure for implementing biometric identity verification within

the airport community. I think it makes an intelligent distinction,

as all biometrics are not created equal, as has been said earlier.

Some biometrics are better suited as a reference biometric that

helps the enrollment process. This makes sure that people do not

apply for multiple credentials under different identities and it enables background checks. That is an important part of the process.

But the TWIC program also references the operational requirements. When you have large volumes of people coming through access points, fast and efficient verification is a different operational

requirement for biometrics, and they have done a good job of distinguishing that. We recommend that this program proceeds quickly

and is funded to be implemented very quickly.

We also welcome the recent solicitation for a Registered Traveler

Pilot Program, another important application. This is just a great

application of biometrics, because it not only improves security but

provides better convenience on behalf of the traveler. What we encourage, though, is a look at existing implementations. Again, there

is a focus on pilot systems and testing. Let us look at what has already been implemented. Since 1993, the INS implemented NPASS, a passenger accelerated service system, using biometric

kiosk for frequent travelers. So far, 130,000 users have used that

system. At Ben Gurion Airport in Tel Aviv a similar system processes 80,000 frequent travelers per month through Tel Aviv Airport

reliably and efficiently, and at great service to the passenger, and

improved security. Later this year, 90,000 Palestinians will cross

the land border into Israel using combined hand geometry and face

recognition to expedite arrival into Israel for their daily work.

So we encourage looking at what has already been implemented

and is able to be moved quickly for Registered Traveler, and look

at the difference between operational and reference biometrics

within the context of a Registered Traveler program.

Turning to the issue the Chairman made earlier about the vulnerability of the credentials of law enforcement officers getting on

planes with firearms. This issue relates closely to the issue of

TWIC. You really need to prevent two vulnerabilities today. One is
14

that the current credentials are very easily copied, or lost, or stolen. So there is a copying threat. Second of all, there is no tying

of the individual to the credential using biometrics. Similarly to

TWIC, there is mature technology available today that could improve the security of that situation considerably.

Finally, one of the criticisms of the biometric industry has been

around standards. It is not accurate to say that there are no standards in the industry. There are many efforts that have been concluded and some that are about to be concluded that the industry

has been collaborating with this Government and international

governments on a multitude of standards.

So, in conclusion, I agree that biometrics are not a panacea for

aviation security. Security is a function of the weakest link in the

technologies and in the processes within which those technologies

are used. However, credentials are currently a weak link in aviation security and biometrics have proven themselves when tied to

secure credentials to not only improve security, but improve convenience. So I propose that we move quickly out of this multitude

of testing phases that we are in and into implementation of this

technology. Thank you.

Mr. MICA. Well, that concludes our witnesses. I wanted these two

witnesses to testify while our Government witnesses were here so

they could hear just what was conveyed to the panel here. We are

almost three years since we passed the Transportation and Aviation Security bill. Section 106 said: ‘‘The Administrator shall establish pilot programs in no fewer than 20 airports to test.’’ On May

3, you announced three of these airports, Mr. Verdery, is that correct?

Mr. VERDERY. I am not sure if it was three exactly, but that is

when the announcement came out, yes. I think it was eight.

Mr. MICA. What has taken so long?

Mr. VERDERY. This is on the access control issue, correct?

Mr. MICA. Access control, adoption of any standard so that we

can get some biometric IDs in place.

Mr. VERDERY. Well, this is a complicated issue on all things biometric, and we have seen this——

Mr. MICA. Well, we just had this witness say that for 15 years

they have been doing it at nuclear plants, 97 percent are covered.

It sounds like we are studying the thing to death. We could have

covered 40 of our major airports for the money we have spent on

studying. How far are we away, Mr. Norton, from adopting a standard? Can they not adopt some standard and put something in place

with some flexibility for changes in the future?

Mr. NORTON. The standards are largely in place to support the

issuance of a——

Mr. MICA. The standards are largely in place?

Mr. NORTON. To support the issuance of a Transportation Worker

ID Card.

Mr. MICA. Mr. Pearce, let me borrow his, this is his pilot license.

It is almost a joke. Here are access cards for National Airport and

none of them have a biometric component. Mr. Pearce’s does not

even have a photo, as handsome as he is. We do not even have facial recognition. And I doubt that he still weighs 175 pounds.

[Laughter.]
15

Mr. MICA. You cannot imagine how frustrating this is. Now DHS

has basically assumed responsibility for developing the biometric

standard; is that correct, Mr. Assistant Secretary?

Mr. VERDERY. Again, I just want to make sure that we are talking about the same issue. Are you talking about the armed LEO

access, is that the issue?

Mr. MICA. Anything. Anything.

Mr. VERDERY. Well, we have responsibility for biometric standards for programs that fall within our Department, of which there

are many.

Mr. MICA. OK. US-VISIT, Registered Traveler is going to be part

of it. But again, just some standard identification. Until you move,

until somebody in the Federal Government moves on adopting a

standard, we have no identification that has a biometric standard

for our U.S. Marshals, for our Capitol Police, for anyone. No one

will move until you move in adopting a standard, not to mention

the State and local governments.

Mr. VERDERY. If I could, because I do not want the record to be

incomplete, NIST is in charge for the Federal Government in terms

of doing the research and setting broad standards for Federal Government purposes for biometrics, and they have been ongoing in

that research and we feel that their research has been very useful

to us in the various programs that we are trying to implement,

whether it is VISIT or these other things we have mentioned.

Within our Department, the Science and Technology Directorate is

in charge of taking that broad research and applying it to particular problems we want to solve.

Mr. MICA. To standards, adopting a standard.

Mr. VERDERY. Yes.

Mr. MICA. How far are we from adopting some standards? Somebody in the Federal Government has to adopt some standard to

move forward. Is this a little vendor competition that is just going

around in circles, or what?

Mr. VERDERY. No. We are working both within and without the

Department on the broad identification standards that might apply

for a range of biometric uses. But as the witnesses testified, we

have the expertise in place largely on the technology side to do programs that are fairly simple biometrically, on what the biometric

will be on a card and how it will be read, whether it is a TWIC

program, and RT program, US-VISIT, border crossing cards, and

the like.

Mr. MICA. You have adopted that standard and said this is the

standard?

Mr. VERDERY. It is not a single standard, but we have the ability

to take the biometric, usually a fingerprint but it could be other

things, and to have a reader that can read that. That is not really

the difficult issue. The difficult issue is more the deployment of the

machines, the vetting of the passengers or the persons to make

sure they have had an accurate watchlist and terrorist check, and

also to make sure that can be updated.

Mr. MICA. We have no watchlist, a consolidated watchlist, so I

guess we do not have to worry about that, which is something else

we asked for almost three years ago.
16

Again, it is very frustrating that we have some airports—San

Francisco, it was testified, has had a program in place for years

now. But as far as iris, as far as facial recognition, as far as fingerprint, someone has to adopt a standard. Most of the privacy questions and things like that someone also has to answer so these systems can be put in place. But right now we have 18,000

credentialed law enforcement officers, we have pilots, we have airport access badges, none of them have any standard or biometric

provision that allows us to say that person in fact is who has the

card or the badge or the license. When can we expect to have something in place?

Mr. VERDERY. Each one of the situations you mentioned is a

slightly different part of a large puzzle of identification and the use

of biometrics, and each one of them we are looking at to try to come

up with a tailored solution that fits the audience that we are trying

to address. So, for Registered Travelers and for LEOs, we have the

pilots we have announced this month that will be going into place

next month and we hope to have the results very quickly.

Mr. MICA. Almost three years later after we asked. Section 136

also says: ‘‘The Under Secretary of Transportation for Security

shall recommend to airport operators, within six months after the

date of enactment, commercially available measures to prevent access to secure airports.’’ Where are we on that?

Mr. VERDERY. Well, that is the guidance that has gone out for

the Access Control pilots that were announced last month at the

eight airports, we have announced eight out of ten.

Mr. MICA. And it says further: ‘‘Review the effectiveness of biometric systems currently in use at several airports.’’ And we put

specifically in the law, two and a half years ago, including San

Francisco International. Do you have a copy of the review of that?

Mr. VERDERY. I do not have it with me. I am not aware, sir, as

to exactly how the San Francisco experience is being utilized in the

eight pilots that have been announced. But, obviously, we are

very——

Mr. MICA. This was not like some of these things ‘‘may’’ provide

the use of biometric, this is shall do certain things within a certain

period of time. Can you provide the Subcommittee with your review, as required by Section 136 of the law?

Mr. VERDERY. I would be happy to go back and see if that has

been accomplished, and if not, see when that might be.

Mr. MICA. OK. Were you aware that this report was found in the

Al Qaeda cave, this is just the testimony, but the security breeches

at Federal agencies and airports, were you aware of that?

Mr. VERDERY. Yes.

Mr. MICA. You were.

Mr. VERDERY. And it obviously highlights the issue. Yes, it is a

problem.

Mr. MICA. Well, again, we are nearly three years out. Do you

have regular meetings with all of the other agencies? Really, DHS

is going to set the standard. But do you have regular meetings with

all the other Federal agencies that may be adopting identification

cards or——
17

Mr. VERDERY. Yes. OMB chairs an interagency working group

that brings all the relevant players to the table on broad biometric

policy development.

Mr. MICA. If I ask FAA, because we have been after them to get

some sort of a pilot’s license that does not look like it comes out

of a Cracker Jacks box, they are going to tell me they have been

part of that and you have been part of that meeting.

Mr. VERDERY. I cannot speak for FAA. I would be surprised if

they were not there. I know DOT has been involved, but I cannot

speak for FAA today. I know we have been involved both at a departmental level and through our component parts, whether it is

TSA——

Mr. MICA. Do you think that it would be important given this

kind of a report?

Mr. VERDERY. Of course. Of course.

Mr. MICA. OK. Again, it is very frustrating that we have not

had—I mean, with everybody so concerned about screening passengers, and we know that the folks we are dealing with have access to the same information that we are talking about publicly

here today——

Mr. VERDERY. Sir, if I could. I understand the frustration and I

just would point out that in the last months, especially since we

have had the full integration of the Department, we have been extremely active on getting biometrics into play, whether it is the

VISIT program as it initially was deployed and our expansion we

have announced to the visa waiver countries coming up this fall,

the RT pilot we have announced, the TWIC pilot we have announced, the coordination of the APIS and ident fingerprint systems, which is absolutely crucial to making sure law enforcement

has access to that biometric of criminals and other folks that we

are worried about, our work in international bodies. I can just tell

you, we are taking this issue extremely seriously and are using the

technology that our good witnesses have provided for us.

Mr. MICA. OK. Now this OMB group, are you aware of State and

local participation in those types of meetings or evaluation of how

you are going forward?

Mr. VERDERY. I am not aware that there is official State or local

representation in that group. I believe it is a Federal standard-setting or policy-making body. But we would obviously need to work

with them on things like HAZMAT drivers and other things where

the States have a very legitimate role to play.

Mr. MICA. Law enforcement officials. We have 18,000 different

credentialed people able to carry arms. As you saw, I got a copy

from my sheriff of what it requires, and it is very little. And, again,

I have no problem with people carrying weapons. I do not care if

they carry bazookas on aircraft if they do not pose a threat. Mohammed Atta is a different story with a bazooka. But we would

never know who he is given the type of technology or lack of standards or biometric edification cards.

Mr. MICA. And we completely agree that the LEO issue is a serious one, a very legitimate one. We hope that the pilots we are deploying, which will be mandatory, will provide us the kind of

knowledge to go out on a more broad basis for LEO control. We
18

completely agree that this is a serious issue that needs to be addressed.

Mr. MICA. Even pilots. Pilots are flying the planes, and we have

also had some reports of attempts to secure uniforms and things

of that sort. Well, again, it is very frustrating. We can talk about

certain things in this open forum, but we are limited. I think you

know the situation we are in and we need some attention to this.

Mr. DeFazio?

Mr. DEFAZIO. Thanks, Mr. Chairman. Mr. Verdery, if we could

sort of start with the basics. First, I think we can all agree we

would like to know who the people are who have access to secure

areas at airports and that they do not have either a terrorist or

criminal background. We can agree on that; is that correct?

Mr. VERDERY. Of course, yes.

Mr. DEFAZIO. OK. And not to get you in trouble here with a superior—well, I do not know the chain of command, actually I think

you are in a different chain of command—but Admiral Stone was

here a couple of months ago and I raised the concern that in Europe not only do they have a much more advanced identification

background check system, but, as they told us in Great Britain, we

do not think an intense background check is adequate security for

people who have access to the air side of the airport. We check anything and everything that goes on and off there. Admiral Stone

says they actually have access to bomb-making materials and other

things right there in the airport. And of course I said, plastic explosives, sheet explosives? No, no. There is fuel and there is this and

that. Well, pretty primitive stuff. So he says there is no need to

screen what is coming on and off the air side of the airport, and

admits that we are doing background checks that are basically cursory, that we are not doing even enhanced background checks. Do

you think that is adequate?

Mr. VERDERY. Well, I was not here when Admiral Stone testified,

so I was not privy to the back and forth. But we are in the same

chain of command. He is the Acting Administrator of TSA and we

both report to the Under Secretary.

Mr. DEFAZIO. OK. OK. Well they kind of ‘‘disappeared’’ him, but,

OK, since he is acting.

Mr. VERDERY. Yes. We think that folks who have access to the

secure areas do deserve background checks, they are getting background checks.

Mr. DEFAZIO. Enhanced background checks. I mean, a background check that is beyond you run it through NCIC and come

back with a negative. You do not know whether that is really that

person or anything really about him, but you did not get a positive

on that name which they have assumed or actually possess.

Mr. VERDERY. Well, again, there are two issues. There is somebody who has a possible hit that you need to chase down the lead

and that is why the whole mechanisms we are putting in place

starting with the terrorist screening center and through our

watchlisting efforts, our efforts to run screening points through our

ONRE database or through National Targeting Center, all these efforts to enhance the screening of people, whether it is airport workers or——

Mr. DEFAZIO. Are we talking physical screening or screening——
19

Mr. VERDERY. I am talking about vetting of a background check.

Our capabilities there are becoming greatly enhanced throughout

this year.

Mr. DEFAZIO. But as we move forward, at long last, with the

trusted traveler—now I guess we are calling it, what is it, it has

got a different name now?

Mr. VERDERY. Registered Traveler.

Mr. DEFAZIO. Registered Traveler Program, good, which I am

very supportive of. We are saying that registered travelers who

have had an intensive background check and who will have a counterfeit-proof ID, perhaps biometric, still need to take everything

they are carrying with them and go through security. But vendors,

employees, who may or may not have had anything other than a

cursory background check, probably have not, caterers who have

access directly to the airplane, cleaners who have access directly to

the airplane, and others who have had a much less intensive background check do not need to go through any security and the things

they are carrying on or off or around do not need to be screened.

How do we justify that to the traveling public? The people I saw

at Detroit were wearing big, bulky coats and could easily have had

Uzis under them, taken them around through security, they did not

go through a metal detector, unlike all the passengers out there,

and met a passenger in the airport or maybe they had an e-ticket

in their pocket and they were going to get on the plane themselves.

The one answer I got before was, ‘‘Well, Congressman, they are not

getting on the planes.’’ I said, ‘‘How do you know they are not getting on the planes?’’ ‘‘Well, they work there.’’ ‘‘Well, yes, but maybe

they only work there as a cover and they are going on the plane.’’

How do we justify that to the American public, that all these hundreds of thousands of people—how many people, let us just take La

Guardia, how many SIDA badges are there at La Guardia?

Mr. VERDERY. I do not have the number in front of me.

Mr. DEFAZIO. Could you get it? I think it is tens of thousands.

Mr. VERDERY. Sure. It would obviously be quite large, a busy airport.

Mr. DEFAZIO. Right. Right. So all the passengers over here in the

long lines, and the flight attendants and the pilots are over here

in the long lines, and all these other people—and I do not know

whether La Guardia is an airport that requires screening or not because you have not been able to get me a list on what airports require screening of employees, vendors, and others—but we know on

the air side we are not screening them, for sure, because that is

policy. Do you think this is a good plan? We did find box cutters

concealed on the planes that were grounded after 9–11 that had

not been used that were somehow smuggled onto the planes.

Mr. VERDERY. I think as we put together the RT program, the

pilots, we are trying to come up with a plan that will attract the

traveler and that——

Mr. DEFAZIO. Oh, no, we agree on RT. There is no problem with

that. But what I am saying is the registered traveler has an intense background check, I am moving a little fast for you, but they

are going to have a very intense background check, they are going

to have a counterfeit-proof ID, but still everything they are carrying and they themselves have to go through screening, as poor as
20

it is, or as good as it is. I think the screener is good, the equipment

sucks, but that is a different issue not for today. We have all these

other hundreds of thousands of people who have less intense background checks, who have various IDs that are not even uniform

across the United States, going either around to the backside of the

airport and the airplanes or right around security and into the airport at an unknown number of airports. Now what I am saying is,

is that not a problem?

Mr. VERDERY. Well the question here is what level of background

check is appropriate for folks who have access to the SIDA. That

is something that we are going to be able to have better capabilities for once these mechanisms for vetting folks and the TSC is

stood up. So this is not related to the RT issue except for people

who happen to maybe see the folks who are not going through

screening. They are separate issues, obviously, under the same rubric of aviation security.

Mr. DEFAZIO. Yes. But if I might, the fact is that enhanced background checks are available; you can buy them, they are out there.

And we have decided as a Federal policy to not require enhanced

background checks of all these hundreds of thousands, millions of

people nationally who have access. We know who the pilots are, we

know who the flight attendants are, we do not really know who the

passengers are. That causes me a lot of concern. Does the technology exist, since we cannot decide on a biometric, to print and require re-badging everybody with a uniform national badge at least?

Could we do that? Could we require that?

Mr. VERDERY. Would technology allow that? Sure.

Mr. DEFAZIO. Sure. Why do we not do that? Why do we have this

multiplicity of badges across the country? We have already heard

biometric is being used and deployed, but we have not been able

to get there. But absent that, would it not at least give us some

level of confidence if we re-badged all these millions of people who

have access to airports and airplanes on a daily basis with a uniform ID nationally? It would not cost much, I would not think, and

it might be worth it.

Mr. VERDERY. I think it would cost quite a bit. But as we look

at——

Mr. DEFAZIO. How much do you think? I am just curious. Do you

think it would cost less than one hijacked airplane being used as

a weapon?

Mr. VERDERY. That is a very tough comparison to make. But I

would err on the side of safety.

Mr. DEFAZIO. Well, then, I think we ought to re-badge people. I

think in fact the Committee, as I recall, had some discussion two

years ago that we were going to re-badge everybody. That we were

going to pull all the badges and we were going to re-badge everybody. I guess maybe we did that but we did not do it with a uniform badge.

Mr. VERDERY. When we looked at the broad sweep of transportation security needs in the country, and part of that is screening

people who have access to sensitive transportation facilities, whether they are airports or other types of facilities, the fact is that the

airport workers have a better security regime now than most. And

so, as we are looking at prioritization of resources——
21

Mr. DEFAZIO. Well what does that mean? Could you explain

that? When we witnessed the people at Detroit Airport who pulled

out one of those IDs, wore a big coat and carried a bag, and walked

through without even going through a metal detector, is that better?

Mr. VERDERY. Compared to most of our ports and other transportation facilities, it is better.k

Mr. DEFAZIO. Wow. You have drawn a pretty low standard here.

I mean, yes, it is better than walking out the door, but it is not

exactly what I would consider to be——

Mr. VERDERY. And that is the point of the TWIC program, is to

enhance security across the broad swath of——

Mr. DEFAZIO. The TWIC which we have not been able to develop

in two years, and we have not figured out what it is going to look

like or how we are going to do it, when we are going to do it. That’s

great.

Just one last question, Mr. Chairman, I know I am badgering the

witness. But Mr. Huddart, tell me, is this rocket science? If we are

doing biometrics at all in nuclear plants, why could we not apply

it more broadly?

Mr. HUDDART. I am not sure, sir.

Mr. DEFAZIO. Could you give me a guess? Does it fail a lot? Is

it undependable? Has there been big problems with it?

Mr. HUDDART. There are many applications that I have outlined

where biometric technology has been very successful. All biometrics

are different. Some have different fits for different applications. I

personally think the issue of standards has been blown up way beyond what it is. For example, if I have a key to open a door at San

Francisco Airport, there is no standard that exists that that key

has to open a door in LAX or La Guardia. Why are we holding biometrics to somewhat of a different threshold and we are trying to

create a perfect system when, in fact, it is taking the extra time

to create a perfect system when we have deployments all over the

world that can be looked at that have happened today. How did the

Department of Energy do this?

Mr. DEFAZIO. They mandated it, I believe.

Mr. HUDDART. There are many access control standards that biometric devices——

Mr. DEFAZIO. One last question. Did they, and I have been to nuclear plants and I have seen the system but I cannot think back

whether they all used the same system, did they mandate a standard system, or did they just mandate that it had to be a biometric

system with people’s backgrounds verified?

Mr. HUDDART. The Department of Energy conducted a study and

consolidated, to my knowledge, all of the facilities around one particular biometric that met their needs the best.kl

Mr. DEFAZIO. OK. Great. Thank you. Thank you, Mr. Chairman.

Mr. MICA. I thank the gentleman. Mr. Ehlers?

Mr. EHLERS. Thank you, Mr. Chairman. Let me just get into

some of the more technical aspects I am interested in. To what extent the Under Secretary of Science and Technology at DHS has

been involved in this issue of biometrics, and to what extent have

their scientists been consulted on this issue?
22

Mr. VERDERY. They have been working quite closely with the

various program offices, whether it is the TSA programs that have

been the topic today, or other programs like US-VISIT and other

things. So we have a pretty good team effort between S&T and the

programs at NBTS. They have essentially been given the lead by

the Secretary to be the brains for the future, to take our grant programs and solicit proposals from the private sector, to understand

better enhancements and the like. So I think we have been working quite well with them. Obviously, we are a new department with

hiring up an standing up new facilities and the like, and there is

obviously room for improvement, but I think it has been a pretty

productive relationship to date.

Mr. EHLERS. And what role has the National Institute of Standards and Technology played in your effort?

Mr. VERDERY. The most notable part of this was they were required under the entry-exit laws that Congress passed to develop

and certify the standard for the entry-exit system for biometrics.

That was done early in 2003 through a report from NIST to the

Attorney General and I believe the Secretary of State, and they

chose the ten print-two print combination that we are using for

US-VISIT. So that was probably the highlight of their involvement.

But they have also been quite engaged at the technical level, working with our program offices to ascertain how the systems are

going to work as they build up entries in the database. One particular example I am well aware of is, there is concern that the USVISIT database will eventually grow too large in a two print form

and will not be able to sustain the good six second response time

we are working now because it will have too many false positives.

We are really in unchartered waters building a database that is

going to eventually be this big. So we have been working with

NIST to try to figure out ways to extend the life of that database.

Eventually, we may have to migrate to a different style of fingerprint capture.

Mr. EHLERS. So are you saying that in the biometric systems you

have settled on using prints instead of other physical characteristics?

Mr. VERDERY. For the US-VISIT system, the base architecture is

the two print capture at the visa issuance stage, a two print verification at the port of entry, yes, along with a digital photograph,

as opposed to other biometrics.

Mr. EHLERS. But I am talking about if you go to a general system, do you not want something that yields fewer false positives?

Mr. VERDERY. Well the fingerprint system has worked quite well.

The number of false positives is very low to date. The number is

in the less than 1 percent range. And so it has actually worked

quite well as opposed to other things that have been on the table,

such as facial recognition which has a much higher false positive

rate. So we need to continue to monitor how the system stands up

as it grows larger, but we have been happy with it to date.

Mr. EHLERS. What about iris identification, what is the false

positive rate there?

Mr. VERDERY. I am not aware—I will have to get back to you on

the specific figures from NIST. I think the bigger concern with the

iris is not the false positive but the difficulty of capture, especially
23

in an action environment like a port of entry. With the lighting and

the like, it is not easy to get a good enough picture to acquire an

iris that could be matched quickly.

Mr. EHLERS. I find that a little hard to believe. And I believe the

false positive rate is negative on that case. I mean, 1 percent is still

pretty big; that is one out of every hundred people.

Mr. VERDERY. It is less than 1 percent. I think I have it in here

somewhere, but it is quite low.

Mr. EHLERS. OK. I am just trying to get at what is the hold up,

why are we not moving faster on this. You have heard the frustration from my two colleagues about the lack of progress. And you

are saying the science is understood, the technology is there, and

then the question is, what is the hold up? What is the problem?

Because it seems to me that is the most difficult part. The implementation is relatively easy, but trying to decide on the best system and make sure that it works well is the most difficult part,

and I understand you are saying that is done.

Mr. VERDERY. Well, no. I think that is why in these environments like the Registered Traveler, like TWIC, like LEO credentials, we are looking at different types of access points, whether it

is what type of biometric it would be, how it is collected, and those

kinds of things. But that is really only half the puzzle. The implementation part is quite a challenge. We are talking about multiple

millions of people in the TWIC environment eventually who would

have a need for that kind of card. How do you get the card to

them? How do you acquire the biometric? What kind of updates do

you need? Do you have everyone come in at once? I mean, these

are very difficult questions. The US-VISIT program has been a

great success, I think everyone would agree, but it also was funded

I believe at $330 million for this year. It is an expensive, but effective, program. And the other programs that we are working

through are much lower dollar. We are trying to make sure we

have both the biometric technology in place and also a clear plan

for implementation before we charge forward with a one-size-fitsall when we are talking about literally millions of potential customers.

Mr. EHLERS. OK. I guess I view it somewhat differently. It seems

to me once you do the science and technology, then the implementation, although troublesome and complex, is relatively easy.

Adopting a standard, deciding on the system to use is the tough

part and the rest of it is mechanics. And I agree, if you need

money, well, then, you ought to ask us for more money for the implementation.

Mr. VERDERY. The implementation is very difficult. Another issue

we are working on is the border crossing card, which has a biometric built in for Mexican citizens who travel frequently across the

border. It has a biometric but it has no mechanism for it to be read

while a person is in a car without getting out. So we are looking

at building in radio frequency technology into the card so that the

person does not have to leave their vehicle and can still have the

biometric information read and vetted as they cross. But getting

that biometric in place on six million border crossing cards is a

very difficult venture when these cards are good for ten years. Do

you make everyone go back in and be retrofitted at the same time?
24

Do we phase it in? There are a lot of difficult implementation questions. And that is just one biometric issue.

Mr. EHLERS. Yes. And I would worry about using RFI technology

because it is too easily tampered with. So I would not put a great

deal of faith in that system.

I would yield back, Mr. Chairman.

Mr. MICA. Thank you. Mr. Honda?

Mr. HONDA. Thank you, Mr. Chairman. I appreciate having this

hearing. Mr. Huddart had made a comment about the 20 pilot programs that were incorporated into the authorization bill. And I

need some clarification. I thought I heard you say that portion had

retarded the progress of the deployment of the pilot programs. You

said that you started with eight now, but, from what I understood,

if the pilot programs were not there, you could have been at 45 out

of the 82 top airports. Could you clarify that for me please.

Mr. HUDDART. Sure. When I say that it may have slowed down,

the company I work for talks to a lot of airport managers who have

an interest in adopting biometrics, and since 9–11 several airports

have actually implemented biometrics but they have done so somewhat reluctantly, and may other airports have decided to wait until

there is clear direction that comes from the Government with regard to any standards or recommendations around the technologies. So the fact that the Government has come out and said

we are going to test biometrics at airports has lead to a wait and

see attitude on behalf of the airports and has slowed many airports

from actually implementing.

Mr. HONDA. The purpose of having a pilot is to test the biometrics, but also to establish a process by which each airport, understanding their own characteristics, can look at the selection of

over-the-counter newly emerging technologies to be prescribed to

their own particular characteristics. That was the intent of the pilots.

So to TSA, my question is, there seems to be a lag in execution

of programs. I share the frustration of my colleagues, and they

have been here a hell of a lot longer than I have and I have caught

up to them. And I think that their frustration is that they have

seen a history of tragedies prior to 9–11 in trying to get security

placed into airports, and then after 9–11 we put together a bill that

directs our agencies to put together, and working with airports and

airlines, to come up with strategies around each airport. And I

agree that we should not have one-size-fits-all; that is stupid. But

in the San Jose Airport, we put together a blue ribbon task force,

in conjunction with those in technology, airlines, commercial, transport, those who run the airport facilities, looking at validation of

individuals, validation of the property, and coming up with processes that could be standardized in terms of studying how you

would apply technologies. Have you read this, Mr. Verdery?

Mr. VERDERY. I have not seen that report, but I would be very

interested in seeing it.

Mr. HONDA. This was submitted to the Department of Transportation prior to the switch. We were told that this is something they

needed to have in order to understand how to do it. You have plenty of people backing up this study. We have recommendations in

looking at every aspect of airport security, including taking care of
25

the issue of privacy and civil liberties. I would like a response from

you within at least three weeks, if you can, because I hear we will

get back to you but I do not hear a time line for which we can expect a response. So I would like a response on how this would fit,

how this would facilitate the deployment of the pilot programs.

Mr. HONDA. And quite frankly, $8 million for eight project just

escapes me because it is such a small amount of investment in a

very critical arena that our entire economy and our homeland security centers around. On top of that, Mr. Chairman, I am not sure

what the strategy for TSA is right now. It seems like it is disjointed and pretty much like what our intelligence community was

prior to 9–11, that you had different stacks and none of them are

talking to each other. It does not seem like there is any kind of

communication or any concise overall strategy. And I would like

some response on the suggestion what date you can get back to us

on your response to this study and how it applies to deployment

of biometrics.

Mr. VERDERY. Well, sir, when I said I had not seen it, I mean

personally, although I would like to. I would hope that the folks

within TSA, both in the national office working on these types of

programs, and also at the San Jose Airport directly, would have

seen this. And if they have not, they should. And I will make sure

that they have.

Mr. HONDA. I am sorry, the director of what?

Mr. VERDERY. The San Jose Airport FSD should have seen your

report, and I hope that he or she has.

Mr. HONDA. It is a he, and I agree, he should have.

Mr. VERDERY. Right. So I will make sure that happens if it has

not happened already. In terms of your comments more broadly

about TSA, as the supervising entity for TSA, we feel good with

where they are. It is a very challenging mission. But we think we

have got very good leadership over there and we, with the leadership of the Under Secretary Asa Hutchinson, we are working to

harmonize the various pieces of the puzzle. As you mentioned,

there are a number of different programs but they do fit together.

They have come up with a layered security approach and these programs, whether it is the screener work, the air marshals, the

LEOs, the RT project, all these things work together in harmony

to minimize the chance that we are going to have an aviation security incident. Is there improvement that could be done to coordinate those functions? Of course. But I think we have seen a good

improvement in that coordination since the Department stood up,

and, perhaps as importantly, the interaction between TSA and the

other parts of our Department, because they work together and

have to work together on lots of things, especially with customs

and border protection, on port of entry issues, and airport security

issues, and with our investigative arm at IS to make sure that law

enforcement incidents are investigated and handled properly. So,

room for improvement? Of course. But we think we have had a

good start.

Mr. HONDA. Through the Chair, Mr. Chairman, your job is not

only to monitor TSA, but also to deploy what we are talking

about—biometrics and the kind of technology we have there for airport security. Is that correct?
26

Mr. VERDERY. One of our responsibilities, yes.

Mr. HONDA. So airline security is one of your main concerns?

Mr. VERDERY. Definitely.

Mr. HONDA. And the deployment and the application of technology, including biometrics, is part of that. I do not get a sense

that there is a coordinated or a thoughtful approach in looking at

each airport and finding out how they are going to be doing it. I

read the report on the selection of the eight airports. And I do not

know all of them, but I do not get a sense that they are varied in

their characteristics. So what is it that you expect out of these pilots that is going to help deploy the technology across the board?

Is it the technology, or is it a process by which they will go through

in order to understand how they are going to secure their airport?

Mr. VERDERY. Perhaps it is both. If you look at the list of the

eight airports and the exact pilots that are being funded, it is a

range of sizes of airports, mixes of types of travelers, and what the

pilot going to do, whether it is attempting to secure the perimeter

of the airport, particular parts of the airport, passengers, workers.

We are trying to see different aspects of the puzzle and then stitch

them together in something that could be deployed more widely,

funding allowing.

Mr. HONDA. And that was the basis upon granting the pilot status?

Mr. VERDERY. That is the goal of the pilots.

Mr. HONDA. But was that a requirement in order to grant them

the status of a pilot, that they had done that already, or are they

going to start from scratch with the grant?

Mr. VERDERY. I am not sure, honestly, Congressman, as to what

the broader characteristics were they were required to demonstrate. To be a pilot site, they had to submit forms talking about

what the goals of their particular pilot were, and how they were

going to work with TSA to provide that information back to us, and

a number of other factors. But I am not sure exactly what they

were required to do. I would be happy to get the submission form

to you.

Mr. HONDA. I am not trying to beat up on you. I would like to

see the evaluation document that is relative to San Jose Airport.

It seems like this document is exactly what it is that you are talking about in terms of process by which you evaluate a site for validation of not only equipment and movement of passengers, but also

of those who work there, including biometric. So can you tell me

when you can have a response with the analysis of San Jose Airport and why it was not selected, and your response on what you

think this report in its application to other airports would be?

Mr. VERDERY. I would need to double back to the TSA folks and

understand exactly how the criteria selection were determined,

what the application for the airport was. How about if I promise

to get back to you ASAP with a time frame on when we can get

together and provide more information?

Mr. HONDA. I did not get a date. You said ASAP.

Mr. VERDERY. I think we could get back to you within just a couple of days as to when we could get back with a more formal presentation as to the exact questions that you raised.
27

Mr. HONDA. So in two days we can get a time line from you by

which——

Mr. VERDERY. That sounds reasonable to me.

Mr. HONDA. And then a response on the study, what do you

think, how long would it take?

Mr. VERDERY. A couple of weeks, I will say.

Mr. HONDA. Two weeks for that. OK. Thanks, Mr. Chairman.

Mr. MICA. I thank the gentleman. Mr. Shuster?

Mr. SHUSTER. Thank you, Mr. Chairman. Mr. Verdery, I guess

you feel the frustration over here of I think everybody on this Committee. I have been here three years now and we have been hearing the same thing over and over again about a number of different

programs through TSA and now through Homeland Security. It is

very frustrating. And, God forbid, that we have another terrorist

incident, but if it happens, we are all going to get fired because we

are not doing our job and I do not think we are doing it fast

enough.

I am not quite sure now—I thought at first when I started to

hear you speak that this was a standard problem and that is why

we are not moving forward, then later on I hear you saying about

implementation—but is it an implementation problem, or a standard problem, or both?

Mr. VERDERY. Is there a particular program you are talking

about, or more broadly?

Mr. SHUSTER. I am talking about either the airport employee

program or the Registered Traveler Program, either one of those

two. Is it a standard problem or—using biometrics I guess is what

I am asking.

Mr. VERDERY. For the Registered Traveler, it is more of an issue

of selecting appropriate airports where we think that we can entice

the traveler to actually want to use the program. Are there benefits

that are going to make it interesting and useful for the person to

go through the biometric and the background check. Certain airports are going to have better access to the way we can structure

the checkpoints so that there is a benefit to them. Certain airports

may have other benefits outside the security realm that would be

enticing to a traveler. We need to work with the airlines to set up

those checkpoints.

Mr. SHUSTER. So we can implement that today if we find out

what is going to motivate a person to be in that program, is that

what you are saying?

Mr. VERDERY. I think we are scheduled to deploy those pilots

within a month or so. We are looking at five different pilot airports.

Those have not been announced yet. We are working with the airports.

Mr. SHUSTER. So we have a standard for that? We can do that

today if we had to?

Mr. VERDERY. I do not think they are going to be cookie cutter

pilots. Different pilots may have different enticements or different

structures, depending on the particular airport.

Mr. SHUSTER. OK. I do not believe we are going to have a problem enticing travelers to do it. From what I hear from the business

traveler, they are willing to do anything to get out of the line—

$100, $200, do somersaults if they have to. So if the President or-
28

dered the TSA to have a Registered Traveler Program in place by

the end of this month, or say the end of this year, do we have a

standard in place to be able to move forward with that?

Mr. VERDERY. Yes. We do not need the President to order it. We

are going to have it in place at these pilot sites I think the middle

of next month or end of next month.

Mr. SHUSTER. OK. So we have a standard?

Mr. VERDERY. We have the biometric captured.

Mr. SHUSTER. You use biometrics?

Mr. VERDERY. Yes.

Mr. SHUSTER. OK. We have a standard. So, now going back to

the airport employee situation, do we have a standard in place that

we can use biometrics to be able to identify people? Is that correct?

Mr. VERDERY. No. That is why we are doing the pilots. We are

trying to ascertain which biometric is going to work best in an active environment like an airport security system. That is why—I

mean, I can walk through the different pilots that we are looking

at.

Mr. SHUSTER. No, you do not have to do that. I think I got a pretty good understanding, and that is what I think Mr. Honda was

talking about. San Francisco, I do not know if that was San Jose

or San Francisco, but it has been in place, is my understanding.

Are you utilizing that ten year or twelve year history to decide

which standard is best?

Mr. VERDERY. Well, they are not one of the pilots because they

have a good system in place. But we are using the knowledge that

they——

Mr. SHUSTER. That answered my question. They have a good system in place. Why are we not modelling ourselves after a good system in place instead of trying to develop—and it is not just you,

I hear this all the time in the Federal Government. We are always

looking for something new when we have San Francisco that has

something and it is working. We can go to the Israelis to their air

system, it works. The INS I understand, somebody said here today,

the INS has a biometrics in place. Our nuclear facilities are all utilizing biometrics. It is very frustrating to keep studying and studying. Let us put this in place. Let us get it out there. Because if

something terrible happens, as I said, we are all going to get fired,

and we all should get fired because we are not putting something

in place. We have got to go out there and we have got to put it in

place. We all know that it is not going to be perfect. We can see

that if you look at the CAPs system, they have been developing

that for years and I think I just heard they are not going to utilize

it because it is not going to work the way we thought it would. And

if we put something in place today, the technology is going to be

new six months from now or a year from now. So we have got to

move forward. We have got to put something out there and get the

system moving into place.

Mr. VERDERY. But it is just not the case that we can take one

successful program, whether it is San Francisco or somewhere else,

and just replicate it everywhere. San Francisco, as I understand it,

uses a hand geometry system which apparently works great for

them, which we encourage. But if we are looking at a system where

we want to build a check against a terrorist database, hand geom-
29

etry does us no good. Our systems are based on fingerprints,

names, dates of birth, other pieces of information. The biometric is

the fingerprint as the base. So a hand geometry does no good to

find a terrorist working at that airport. So we need to understand,

is that trade-off worth it? And so that is what we are looking at.

Mr. SHUSTER. But right now we have nothing. We do not have

anything in place. That is my point. Let us move forward with

something. Let us get something in place. We just keep talking and

studying about it.

Let me move to Mr. Huddart. What is your level of confidence

that if we said to you set up 40 airports, can the folks in your industry do that now? Can we implement those things that will

work?

Mr. HUDDART. Absolutely. The industry does it everyday in

banks, in hospitals, in schools——

Mr. SHUSTER. McDonalds.

Mr. HUDDART. And McDonalds, yes.

Mr. SHUSTER. Mr. Norton, what is your view on that. Is that

something we can put into place?

Mr. NORTON. Yes, it is. I would like to clarify. The comparison

was made as to whether or not one technology could be used over

another. Fingerprints and face recognition, iris recognition, for that

matter, can be used to see if you have multiple identities and multiple enrollments. Hand geometry and a number of other capabilities can be used in an operational environment to make sure that

you know who you are dealing with. So there are different uses of

biometrics for different purposes.

I think it is important to understand what we have and what we

really need in order to get these solutions out there. And what we

have, and I think it has come up here today at the hearing, is mature technologies that are there to support the mission, whether it

is screening people for enrollment, or screening people in an airport

environment where they are trying to get access to a facility. We

know they work within an airport footprint. Those analogues are

there. We know they are supported by standards. And it is important that we perhaps define what we mean by standards. We mean

the technical descriptions that enable these technologies to be deployed. And we know that we have a pretty good concept of operations about how these applications may work.

What we really need is then to move forward to the phase of defining what the requirements are, establishing a government and

industry policy that is appropriate for the circumstance, and then

moving forward with the processes of funding and technology selection. We see that these activities are underway in this area. I think

we can put a lot of the technology questions behind us. And as we

move forward now to some of the stickier issues on industry and

government policy and the requirements definition, we can get over

that phase quickly because the technologies are there and they are

mature.

Mr. SHUSTER. One final question, Mr. Secretary, on the Registered Traveler Program. Are we including in the development of

this program, these pilots, people that are travelers, business travelers? It is my understanding that there has not been a whole of

participation from the business community in developing this pilot.
30

It seems to me that if we are developing a product, first and foremost, security has to take precedence, but if we want to attract

them, we need to be talking to the traveler to say what will attract

you. Are we doing that? Are we doing marketing research in that?

Mr. VERDERY. The business traveler along with the LEO is the

target audience of these pilots because that is who we understand

is most likely to want to use this program and are the people we

are trying to assist as well as leveraging our own resources. But

TSA is reaching out to the stakeholders here—the airlines via their

frequent flyer clubs and the like, that is kind of the crowd we are

looking at. And we need to work with the airlines because they

may be able to offer things to people to induce them into the program, whether it is frequent flyer miles, or access to the lounge,

these kinds of amenities that might be an inducement as well. So

that is who we are working with and that is our target audience.

Mr. SHUSTER. We are working with the airlines or are we working with the traveler themselves?

Mr. VERDERY. With the airlines and with the travel industry. I

am not aware of the particular meetings they are having on a day

to day basis, but that is the target audience and the people we are

trying to leverage.

Mr. SHUSTER. OK. Thank you very much.

Mr. MICA. Thank you. Ms. Johnson?

Mrs. JOHNSON. Thank you very much, Mr. Chairman, and thank

you and the Ranking Member for having this hearing. I apologize

for being late. I had to preside at another hearing prior to coming.

Since 9–11 we have hired thousands of primarily new trained

screeners, placed hundreds of air marshals on flights, required advance manifests and increased inspections of air cargo, armed pilots, and secured cockpit doors, and passengers still have to practically undress to come through security—without shoes, without

belts, without anything but underwear and a little cover. I am really concerned about how it is possible to be discriminatory with the

techniques and technology we are talking about now.

My congressional district has DFW, Love Field, and two other

airports in it. And DFW has 52 million passengers each year and

it is really the pillar of our economic growth there. We want to provide safety and security and certainly efficient passenger processing while we preserve privacy, which is almost gone with the process now. If we had just 1 percent of bad prints, that is 52,000, and

that would mean standing in lines longer almost than we have

now. I am really concerned about the cost of failure. You have that

many people that is failing, then what is the perfection level of the

biometric system, and as it relates to privacy and security? Give

me an explanation as to how you think this is going to increase security.

Mr. VERDERY. Ma’am, if you are speaking about the Registered

Traveler Pilot Programs or the eventual Registered Traveler Program we might have in place, this would be a voluntary system.

So the privacy impact is something that the traveler would assume,

but we would have robust privacy procedures in place on the use

of the biometric and the like. It would not be a mandatory program. TSA, you may know, recently hired a Chief Privacy Officer,

who is now on board, reporting up to our departmental Chief Pri-
31

vacy Officer, who has been quite aggressive in these areas and is

an integral part of our policy-making process. But we feel comfortable that the biometric part of a Registered Traveler Program

would have a very low false positive match. The US-VISIT system,

which is a similar type of fingerprint verification, has had an extremely low error rate, far less than 1 percent. So we are confident

that we are not going to have logistical problems with the program

in terms of making sure people are who they say they are. There

will be certain cases where there is a false positive or a false match

and we need to have people on the ground who can resolve those.

And that is part of the implementation strategy that is necessary.

But in general, we feel very good about the privacy protections

that can be put in place for RT and we will be working those aggressively. In fact, just as a related matter, the Department this

week received the first ever so-call adequacy finding from the European Union for our privacy protections for airline passenger data.

This is being used by Customs and Border Protection on incoming

flights. But it is the first time that a foreign government has ever

been certified by the European Union, who has extremely tough

privacy laws, for our privacy procedures and redress mechanisms

that are in place for Customs and Border Protection. And that will

be a very useful thing for securing the international travel to your

airport and others.

Mrs. JOHNSON. You know, 35 percent of the residents in my area

were born in other countries. And the stories that I hear from what

they have to go through with profiling is kind of hard to take. How

do we explain to many of them what this new technology will do

to either keep them from being so highly profiled, or will it add

more to it?

Mr. VERDERY. Well, of course, TSA, under our current operations,

does not profile a person’s race, gender, or other characteristics. It

is not a factor in whether somebody is singled out for secondary

screening. As you know, most people who are sent to secondary is

either due to an alarm or due to the mechanism by which they

bought their ticket, which has nothing to do with them, it is just

a travel pattern. The beauty of the biometrics, though, is that it essentially makes it a personal evaluation—is this person who he or

she says that they are. It has nothing to do with their race, or

height, or gender, or anything. It is a one person versus many

check. And it allows us to tailor our programs to look at the person.

And so to the extent that there is any residual profiling out there,

which, again, we do not support and do not believe is happening,

the biometric usage, whether it is in TSA procedures or others,

should minimize that. It is one of the beauties of the technology.

Mrs. JOHNSON. Thank you very much, Mr. Chairman.

Mr. MICA. I thank the gentlelady. Mr. Pearce?

Mr. PEARCE. Thank you, Mr. Chairman. During all this process,

Mr. Verdery, this process of trying to get to the next step, you have

had industry and airlines and everyone involved in the process?

Mr. VERDERY. Very much so, yes.

Mr. PEARCE. Mr. Huddart, the International Biometric Industry

Association is a fairly small industry, biometrics is a fairly small

industry. Do you know most of the people in that industry?
32

Mr. HUDDART. A good portion. We have about 25 members, leaders in the industry, who are members of our Association.

Mr. PEARCE. But is there a large industry outside your knowledge base?

Mr. HUDDART. I would say not generally, no.

Mr. PEARCE. Not generally. Do you know the biometric industry

representatives who were sitting in the collaborative process or trying to get us through the roadblocks?

Mr. HUDDART. Personally, not. That does not mean to say that

there was not, but personally I do not have knowledge of that.

Mr. HUDDART. You had representatives from the biometric industry in there in trying to figure your way through this logjam of

problems?

Mr. VERDERY. The folks within our Department, the program

agency managers and the likes, are working closely with the potential vendors, with other people who have good ideas. If we have not

made a connection between this particular Association and——

Mr. PEARCE. No, no. But I mean you did have biometric industry

representatives in your meetings?

Mr. VERDERY. Yes. I mean, they are brainstorming, they are soliciting ideas. There obviously are rules on the contracting process

between the official interaction. But yes, they are, and should be,

part of our brainstorming and idea process. And I am a couple of

layers above the program heads, but I would want the biometrics

people who are experts in this to come in to see us and to give us

an idea of what is possible and what the roadblocks are.

Mr. PEARCE. What is your educational background?

Mr. VERDERY. My background? College and legal degrees.

Mr. PEARCE. And your boss?

Mr. VERDERY. Under Secretary Hutchinson, I believe the same,

college and legal, then he served in Congress.

Mr. PEARCE. How about the two layers below you?

Mr. VERDERY. Well, there are a lot of layers below me, but probably a wide variety. We have scientists——

Mr. PEARCE. Just the two layers, the two people right below you

in your department, what is their background?

Mr. VERDERY. Well, within my particular office, we would be

talking about policy analysts who might be lawyers, might be

former Federal law enforcement agents. It is a variety of people

that work directly for me.

Mr. PEARCE. So no airline experience, no biometric experience.

You have got legal experience, you have got no operational experience.

Mr. VERDERY. No. We do have folks, I am not going to claim that

somebody in my immediate office is an expert on biometrics, although we feel like we are getting that way. But within our apparatus of policy-making, there are people who are quite expert on

this issue. The US-VISIT office has a Chief Strategist who is very

experienced in biometrics.

Mr. PEARCE. Are there people with operational backgrounds at a

level that can unplug the logjam, or are the decision-makers that

have the logjam in place the people with legal backgrounds, legal

educations?
33

Mr. VERDERY. No. We have a wide variety of people who are

making decisions, some of them are lawyers, some of them are not,

some of them are technologists, some of them are accountants, we

have TSAs.

Mr. PEARCE. So the logjam originates up and down through the

management spectrum. You do not have someone at the top who

can say break the logjam who can make a decision. That is what

the Chairman was saying, when are we going to make a decision.

You have said that is a legal person, and you are a legal person.

Tell me, Mr. Verdery, we have got this logjam sitting in place,

what is going to change in the foreseeable future? The logjam is

about cost, the logjam is a problem of implementation—I am reading from your statement—the logjam is vetting passengers, the logjam is civil liberties. What in the near future is going to change?

Which one of those problems is going to go away? We have not broken the logjam because those problems exist. The technology is

here, Mr. Huddart has said so, you have said so. The standards are

here, Mr. Norton has said so. The standards and the technology are

here, so we have got a logjam going because of these implementation problems. And which of those problems is going to go away to

cause us to suddenly be able to do what we should be doing?

Mr. VERDERY. These types of problems never vanish, it is just

going to take an incredible amount of hard work from people all

the way from the Secretary on down to the program managers to

fight through these. And I think you have seen from our remarks

today, we are moving extremely aggressively. Again, just in the

past month we have announced deployment on Registered Traveler, on LEO, on TWIC, on VISIT. There is an incredible amount

of activity underway. Is it complete? Of course no. But this is not

stuff that is sitting in a dusty room somewhere. This is stuff that

is being deployed out in the field.

Mr. PEARCE. In my opinion sitting here, and I see my time has

expired, but in my opinion, it is like you are trying to hit a hole

in one. You are going to play golf by hitting a hole in one. I am

sorry, a hole in one happens occasionally. Most of us have to hit

the dadgummed ball and it is going to go over here, it is going to

go over here, and you progressively get closer to the pin.

Now we have decided that we are not going to give anyone anything except these pilot certificates because we cannot vet passengers, and because we have got six million people coming across

the Mexico border that we cannot read their stuff. Even if we had

one group and we begin to correct that and say, OK, now we have

got that problem solved, and, yes, it is going to have to be tweaked,

but we have got it solved. And the Registered Traveler, we do not

know exactly how we are going to pay for it, but I suspect if we

asked the people to raise their hands, they would pay for the

dadgummed thing themselves, and those who did not could stay in

the long lines. If nothing else, we could begin to do some implementation.

But we have got a logjam and I do not really see anything that

is going to change. You are going to have 20 pilot programs. And

Mr. Shuster said it well, why do you not use the one that is working? Well, it works out there but it might not work here. So you

are going to have 20 pilot programs. What is going to make them
34

work anywhere except where they are working in the pilot program? It seems to me that we have got enough people with legal

expertise but not enough people with operational backgrounds that

just know that you have to start somewhere and you have to improve on what you get and that you are not going to get a hole in

one. Even when you hit the ball off the tee, when you finally pull

the trigger on something, it is not going to go in the hole.

You are going to have spent years vetting and trying to get the

process worked down and getting the nerve to make a decision, and

the cost is going to remain the same, the obstacles of implementation are going to remain the same, and the civil liberties are going

to remain the same, and the vetting problem is going to remain the

same. They do not disappear over time. They do not just cure

themselves. So somebody is going to have to have the courage to

do something, sometime, somewhere and maybe get the ball moving forward.

I hope that these pilot projects that you are doing right now are

that move. Frankly, being frozen in the headlights does not go

away, and so what we generally do is we move from one frozen position to the next. I think that we are going to get the pilot projects

and we are going to be frozen in place as to what to do with them

because I do not think we are really integrating people. I do not

think we have gone to Israel to study and, if they have already

solved the problem, why we have not imported it back to here instead of creating it all from the ground up. You can make any response you would like. Thank you, Mr. Chairman.

Mr. VERDERY. Sir, if I could. Again, I think your description of

not waiting for the perfect shot or perfect deployment, I used to

play golf before I took this job and I catch the analogy. But for instance, in the US-VISIT, Congress had mandated an entry-exit system going back all the way to 1996 and it did not happen because

people could never agree on kind of what the grand plan was going

to be. It was, well, there is no point in deploying it here if you have

not done it here. And so nothing ever happened. Well, this Department started on I believe it was March 1, and April 29th, it was

actually my second in the job, Secretary Ridge announced, no, this

is the plan, we are going to have entry-exit at the end of this year.

It is not going to be universal because we are doing the first phase.

Airports and seaports, it is in place, we beat the deadline, we beat

Congress’ mandate, we got it in place, we are finding bad guys

every single day. And now we have to move on to the next building

blocks—land borders, visa waiver countries, the exit scenarios

which are incredibly important. But we took I will not call it a

baby step because it was a huge step, but it part of the answer.

These other issues that we are working on, it is a similar thing.

We understand we are not going to be able to deploy a TWIC program to every one, I think it is 21 million is the number I heard,

of workers in one fell swoop. We have got to figure out a deployment plan and make sure it works.

So I think there is leadership coming down from the top from the

Secretary and Under Secretary Hutchinson to make these programs a reality. And I feel confident—I am not going to put a time

frame sitting here—but there is progress underway. And if there

was a logjam, the logjam has been broken.
35

Mr. PEARCE. Thank you, Mr. Chairman.

Mr. MICA. Mr. Verdery, how long have you been Assistant Secretary?

Mr. VERDERY. I was confirmed last June.

Mr. MICA. Well, as you can tell, there is a sense of great frustration here. Mr. DeFazio and I, he is the Ranking Member, we have

decided we are going to, if necessary, change the law. So we are

going to hold a markup the first week when we get back after Memorial Day, and instead of ‘‘may’’ we are going to have ‘‘shall,’’ and

then we are going to define what we want you to do very specifically. So you can go back and tell Secretary Hutchinson, Mr. Ridge,

anybody above or below, we are going to try to define what we

want you to do and get it done as quickly as possible. Everybody

is frustrated with this. The test airports that you are doing, they

are not all biometric. I see a number of video surveillance projects.

They are not all biometric, are they?

Mr. VERDERY. I believe you are correct. I need to find the list

again. But I think that is right, some are and some are not.

Mr. MICA. So we are not even talking about eight biometrics.

And again, this has all been done somewhere. If we could get you

all to set some standards for the different types of functions, or

adopt the nuclear plant standard, some standard, the rest we believe will begin to fall in place. What is really frustrating about the

test airports, and I talked about the test airports before, I do not

think one of these test airports has an integrated in-line check baggage system. Tampa does not, T.G. Green State does not, Southwest Florida does not, Savannah does not, Newark does not, Minneapolis, Miami does not, Boise does not. Just from common sense,

can we do—we have eight to fourteen, depending on who we ask,

integrated in-line check baggage systems across the country. Can

we not have one airport where we have a biometric system in place

for access control with all the whistles and bells in one place?

Would that not make sense to have sort of a model, maybe East

Coast, one in the center of the United States, so people could go

and at least look at the technology? San Francisco is not 100 percent but they have not done that. But just from somebody’s thinking, and we talked about this before, have one place where we can

show the latest technology operational for a choice of airports that

wanted this, would that not make sense?

Mr. VERDERY. It might. I was not part of the grant selection process here in determining which particular airports were going to be

awarded these.

Mr. MICA. Somebody had better get in charge of things over

there and start thinking about this before we have a disaster. And

the way we spend this money is just so frustrating. You cannot

imagine how frustrating. I am surprised you have been around as

long as you have and somebody has not taken control of these programs and made some sense out of them.

Mr. DeFazio, did you have anything else?

Mr. DEFAZIO. Thank you, Mr. Chairman. Mr. Chairman, you

have expressed I believe the sentiments not only of yourself and

myself but many other members of the Committee who could not

be here because of other obligations. And I expect we will have a

unanimous vote when we move toward a realistic mandate for im-
36

plementing some of these systems. Mr. Verdery, not to lay it all on

you. You are not the first person to be in the hot seat here. We

went from Mr. Magaw to Admiral Loy, and they all managed to

squirt out and move on somewhere else, and Admiral Stone, they

do not let him come up anymore, or he does not want to, I am not

sure which. But you are here today and you are the guy. But you

have got to understand that we are not doing this to be petty. We

just feel an extraordinary sense of urgency about these things. And

I realize there is a huge range of threats and when I start to think

about the wider scope beyond this Committee’s jurisdiction, I start

to get bogged down a little bit, too. OK, well, gee, what are we

going to do on the ports, what are we going to do on trains, another

Subcommittee I am on. But for aviation I think we can do better

without an extraordinary expense.

Mr. Huddart, I just want to explore a little more about who is

using—you know, we can look at the nuclear plants and say, well,

that involves a few hundred people at each plant, there are not

that many of them, and this is not really a very big model to say

the technology has been working for fifteen years and we could implement it elsewhere. Could you give us other examples? What is

the broadest example? What does DoD do, for instance?

Mr. HUDDART. There are many DoD. In fact, the Air Force has

used biometrics extensively for base security. So, for example, at

Scott Air Force Base there are turnstiles. That when you arrive to

Scott Air Force Base, it is an unattended application, they use biometrics to get through those turnstiles, to verify your identity. I do

not know how many users there are but it must be several thousand.

Mr. DEFAZIO. And that takes care of the follow-on thing that we

are still trying to figure out a way to deal with—piggybacking, they

call it?

Mr. HUDDART. Yes. The turnstiles prevent piggybacking.

Mr. DEFAZIO. Only one person can get in the turnstile, or the

turnstile is surveyed remotely to see.

Mr. HUDDART. That is correct. That is one example. As I mentioned, San Francisco is quite a large application. There are 15,000

daily users who probably use the system each four, six, eight times

a day.

Mr. DEFAZIO. And what biometrics are they using?

Mr. HUDDART. Hand geometry biometrics, the same as the nuclear industry.

Mr. DEFAZIO. OK. And what is the false positive? I mean, is it

tested regularly? Do people try and defeat it?

Mr. HUDDART. The Department of Energy has done extensive

testing on different biometrics. There has been several different

tests done within the Government. There are really two attributes

when you are designing a system of a biometric you have got to

look at. One is the false positives, one is the false negatives. Both

errors that different biometrics can make. In the case of that particular biometric, it is in the range of .2 to 1 percent depending on

the particular application.

Mr. DEFAZIO. That was .2 to 1?

Mr. HUDDART. Yes, .2 to 1 percent, depending on the application.
37

Mr. DEFAZIO. What is the delay time? I plunk down my hand,

how long does it take?

Mr. HUDDART. The total transaction time is about three seconds,

in that range.

Mr. DEFAZIO. Three seconds. That is pretty good.

Mr. HUDDART. And enrollment time is generally less than a

minute.

Mr. DEFAZIO. OK. Anybody else have anything they did not get

a chance to say that they would like to say on my time?

Mr. VERDERY. If I could sir, just as a conclusion. We share your

sense of urgency. These programs are being developed as rapidly

as we can develop them within the funds that we have.

Mr. DEFAZIO. Aha. The key point. And you are not allowed to ask

for more funds, I know that. So, OK.

Mr. VERDERY. I can tell you though that this travel facilitation

issue along with the security side is something that we are focused

on quite a bit. Within my office, we are just a part of the puzzle

here, of course, but Under Secretary Hutchinson would tell you the

same thing, that he is anxious to get both the RT program in place

to try to help alleviate some of the crowding at the airports and

facilitate the business travel we know is so important, and the

LEO issue, as we talked about, incredibly important, we have got

to show progress there, and we think that this will be a step in the

right direction.

So I just would not want the record to be closed without sharing

your sense of urgency both within TSA and up the food chain.

Mr. DEFAZIO. I appreciate that. I do not denigrate the motivations of anybody in these matters. And I know you would not be

working there if you did not take it seriously. But the key thing,

and I have said it to Admiral Stone, and I have said it to agency

people all the time, and, unfortunately, I know the constraints and

it is not just under Republican Administration, you are not allowed

to come and tell us you need more money. But the fact is we are

not going to get the security that I think the Chairman and I want

for the American traveling public on the cheap. When you are up

there, and I have had this debate on safety with the airlines and

others, I have yet to sit next to someone who says, I really do not

mind there is a terrorist on the plane because I got a really cheap

ticket, so it is OK with me. No. There is no one up there saying

that. So we have got to work our way through this. And I think,

under the Chairman’s leadership, when we put forward a mandate,

then you may well be able to pass the ball back to us and say, OK,

we have got the mandate, here is what it is going to take, here is

what it is going to cost. Ultimately, Congress has got the power of

the purse. So that may be a way to get you out of the hot seat and

pass the thing back to us. Thank you very much. Thank you, Mr.

Chairman.

Mr. MICA. Thank you. I am even more frustrated by reading

where they have given these grants. And this is not going to get

us any closer to a solution. You have got video surveillance technology in at least two of these; then you have got biometric radio

frequency technology to control access vehicles, that is testing wireless capability to transmit data, that is not going to solve our problem; you have got one iris and I see two fingerprint technology
38

readers. All this stuff has been done. If you all would just go back

and say we have got to make a decision, we have got to adopt a

standard for identification for law enforcement people, for airport

workers, for other Federal workers, and the rest will fall into place.

I strongly believe that. But these tests, all of this has been done,

maybe with the exception of the wireless transmission. And if you

want to go ahead and look at that. But the technology has been developed. Standards are there. Adopt something that can be used by

these people. The airports would reissue these badges. They lost,

somebody just testified, what, one airport lost 400 badges.

Mr. DEFAZIO. Mr. Chairman, if I could. On this wireless issue,

are we not using the wireless on the Canadian border for people

who transit the border frequently? I think we are.

Mr. VERDERY. The Nexus program on the northern border and

Century for the southern border for vehicle access.

Mr. DEFAZIO. OK. So we have already got it working. I do not

know why we need to test it.

Mr. MICA. I know. But I do not see anything. Somebody over

there please make a decision and the rest will fall in place, we

guarantee it. Local law enforcement will get a card and it will have

the biometric requirement that you have and we will be able to tell,

with some modicum of certainty, that that is that individual that

has got a loaded weapon and going on an aircraft. Cost-benefit,

there is no cost. You are not going to absorb it for local government. Just set a standard. Sit down with these people, and it is not

a very big circle of people participating in this, just a handful. Of

course, there are going to be some losers, some vendors. Again, I

am wondering if it is just vendors keeping this stirred up so nobody

wins a prize. But it does not even appear to be that.

If you all could move forward in some way. I talked to other

agencies preliminary to this hearing, they are all waiting for DHS

to make a decision before anybody else moves. No local law enforcement is going to move, no State agency is going to move, no other

Federal agency is going to move until you make a decision. I know

it is hard and somebody has to assume responsibility and go forward with this. But there is nothing here in any of these tests that

is going to come up with anything new that I know of that you

could not make a decision on a standard or a technology. And what

kind of reader is acceptable? We have readers, do we not, guys,

that read these things?

Mr. NORTON. Yes, sir.

Mr. HUDDART. Yes, sir.

Mr. MICA. We were over in Amsterdam and we saw that they

have iris—was it iris that I failed? Yes, iris. We have tested them.

They tested iris, Sue Myrick told me, more than a year ago at

Charlotte Airport I believe. San Francisco. Just do something. OK?

I just do not know what else to say. This is the most frustrating

thing I have ever been involved with.

Now we are going to change the law and we are going to direct

you to do something. We all agree. People are coming up to me,

‘‘Why can’t they do something?’’ It is not a partisan issue; not a Republican, not a Democrat issue. And it is nothing against you guys.

We love you. We wish you well. But somebody has got to make a

decision so that we at least get something in place.
39

Mr. DeFazio has asked unanimous consent that the record be left

open for a period of two weeks. Without objection, so ordered.

No other business to come before this Subcommittee, this hearing

is adjourned.

[Whereupon, at 12:20 p.m., the committee was adjourned, to reconvene at the call of the Chair.]
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216

Æ