Summary of the March 5th -6th, 2008 

NIST Mobile ID Workshop 

March 25, 2008 

The Mobile ID workshop (held March 5-6th, 2008, at NIST) was attended by over 40 

participants. After welcoming remarks, a review of the November 29, 2007, meeting was 

presented. The week prior to this meeting a “Strawman” document was developed and 

placed on the NIST “fingerprint.nist.gov/mobileid” website. A notice of this listing was 

sent to all registered participants but not everyone had a chance to review the document. 

During the November meeting, there was considerable discussion regarding the approach 

of linking the characteristics of the Mobile ID device itself with the application function 

(enrollment, identification, or verification) for which the device was used. In order to 

alleviate this situation, a new proposal was presented and accepted. This approach 

consisted of separating the required parameters for each biometric modality from the 

application function itself. 

For each biometric modality, a table was constructed of different levels of Subject 

Acquisition Profiles (SAPs). Each SAP consisted of parameter requirements for the 

capture characteristics of the device. The increasing SAP numbers call for progressively 

more stringent sets of requirements to be met. The question was raised as to whether the 

specified requirements were too demanding for many current applications. For example, 

fingerprint readers are available that may meet the area requirement for a sensor but not 

the width and length requirements. For this specific requirement, the consensus was that 

all devices had to meet minimum dimensional specifications of width and length. It was 

also agreed upon that this “Strawman” for Mobile ID was not intended for commercial 

consumer applications. Comments were also made that the size requirements for the 

fingerprint sensors were not yet available for the upper SAP levels. Many of the 

participants thought that the table should be limited to what was currently available and 

not reach for the future. But it was decided to keep the more demanding SAP 

requirements as stated in the tables. 

To address the question of application function, additional tables were developed looking 

forward a couple years or more, listing the SAP levels to be satisfied. These tables were 

constructed for fingerprints, faces, and irises. Each column of the table compared the 

application function of enrollment, identification, or verification to the rows listing risks 

of severe, moderate, or mild threats to public safety. A recommended SAP level was 

entered at each intersection of function versus risk. This triggered discussion of the 

meaning of ‘severe’, ‘moderate’, and ‘mild’ threats. In an attempt to resolve the 

uncertainty, Tony Misslin developed a chart for presentation the morning of the second 

day that provided an explanation and examples of various risk levels. That table was also 

massaged during the morning session and lunch. A final version of the table was agreed 

to after the lunch break. 
The “Strawman” document contained a section on communicating with the FBI. It 

describes the type of transactions (TOT) to be sent to the FBI and what could be expected 

in return. The workshop participants decided that this section should be more generic. 

Therefore, all FBI specific information shall be omitted with only the ANSI/NIST-ITL 1-

2007 references being retained. 

David Hall provided a presentation on communication protocols. The group decided that 

the Strawman’s treatment of this should be general in nature. Available protocols should 

be introduced and listed but no requirement should be dictated. George White and David 

Hall discussed security and encryption needs and together will develop updates for the 

communication and security sections.. Again, the decision was made to keep things 

general and together they will prepare a contribution for the next version of the 

Strawman. 

After discussing the merits of specifying the characteristics of various Mobile ID device 

features, the decision was made to split the Strawman document into two major pieces. 

The first would be the “Best Practice Recommendations.” The second will be things to be 

considered when procuring Mobile ID devices. This provided a line between what 

recommended characteristics of the Mobile ID device for a specific function and those 

features that would be desirable to have. 

There were several other suggestions presented for improving the document, which shall 

be implemented in the next version. A discussion also took place regarding the future of 

this “Strawman”. In particular, there was no intention to make it into a standard. In light 

of the fact that Mobile ID is a moving target with regard to improvements, it should not 

become a standard but rather a publication, such as a NIST Special Publication. For this 

reason it was decided that the word “standard” would not be used in conjunction with this 

document, but rather it would be defined as a “specification.” This seemed to be 

acceptable to all present. 

The agreements reached during this workshop will be used to update the existing 

Strawman. An updated version of this Strawman is targeted for release by May 1st. A 

thirty-day window will be given for comments. A discussion of the timing and location 

for the next meeting then took place. The consensus was that the next Mobile ID 

meeting would be tentatively scheduled for the beginning of June. CA-DOJ was 

mentioned as a possible alternative to NIST.