Biometrics: Who Has Your Data?
By: Varju Luceno
Tags: Airports, Fingerprint, AI, Facial Recognition, Biometrics

I started learning about biometrics after the Equifax hack which exposed information of approximately 143 million accounts.

It’s mind-boggling how easy it can be to steal identities.

There are different software tools and processes available for individuals to protect themselves and exercise good cyber hygiene.

But our efforts may turn out to be a waste of time if companies holding our information don’t follow best practices for securing sensitive data.

Perhaps we need to change the way we think about proving who we are, both digitally and face-to-face?

Biometric systems, widely used now, but controversial, show great promise, especially if businesses will be able to develop trust in these systems.

How can we make sure that companies will not use our biometric data without our permission? How can we guarantee that this data will not end up in the wrong hands?

Hackers always find ways to compromise new systems, including biometrics.

The hackers could, for example, create a trigger to corrupt images used to train the Artificial Intelligence (AI) system. The system would, therefore, learn incorrect labels and develop models that make the wrong predictions of what an image contains.

There are many sources of information on the web that may create confusion and fear.

I believe that a public awareness campaign that explains the benefits and dangers of biometrics in simple language is needed.

What are biometrics?

Biometrics or biometric systems measure and analyze people’s physical and behavioral features. These technologies are mainly used for identification and granting access, or for identifying and monitoring persons who are under surveillance.

Biometric verification incorporates different ways of identifying a person using one or several biological traits. Unique identifiers may comprise of fingerprints, retina and iris patterns, voice, DNA, hand or earlobe geometry, as well as signatures.

Who invented biometrics?

In the late 1800s, an explorer and anthropologist Francis Galton, obtained a large sample of fingerprints through his laboratories, collecting over 8,000 sets. He constructed a statistical proof of the uniqueness of individual prints. Galton’s study provided the foundation for a meaningful comparison of different fingerprints, which led to the first fingerprint classification system.

According to Wikipedia, Josh Ellenbogen and Nitzan Lebovic made a case that biometrics origin comes from the systems developed by Alphonse Bertillon (1853–1914). He was a Parisian anthropologist and police desk clerk, who developed a method for identifying criminals, known as Bertillonage.

The idea for using the iris for identification purposes originated in the 1930s. But the first iris recognition algorithm was not patented until 1994.

In the 1960s, developers founded facial recognition methods that made it possible to analyze facial features within an image and extract tractable feature points.

By 1969, fingerprint and facial recognition became widely used by law enforcement. The FBI then funded the development of automated processes. The creation of more sophisticated sensors for biometric capture and data extraction started.

In the 1980s, the National Institute of Standards and Technology (NIST) founded a Speech Group to study similar applicable methods for speech recognition technology. These studies are the foundation for the new voice command and recognition systems.

In 1991, the first crude facial detection technology, making real-time recognition of a person from an image or video possible, was developed. Nowadays, this technology uses biometric software with Artificial Intelligence (AI) enabled devices for facial feature mapping.

Hundreds of biometric identification algorithms were patented in the United States by the 2000s.

Biometrics found use outside large enterprises and government institutions. Biometric systems were incorporated into commercial products and implemented at events.

However, even advanced facial recognition systems still often fail to map the faces of women and people of color correctly.

“Object recognition is a key component of future intelligent systems, and the Army must safeguard these systems from cyberattacks,” MaryAnne Fields, program manager for the Army Research Office’s (ARO’s) intelligent systems, said in a statement. “This work will lay the foundations for recognizing and mitigating backdoor attacks in which the data used to train the object recognition system is subtly altered to give incorrect answers.”

(Source: Techxlpore)

How are biometrics used now?

Biometric identification has become a standard feature on various platforms, including smartphones.

Examples from everyday life:

Newer iPhone and Samsung phone owners use Face ID to unlock their phones. Many consumers are getting used to biometric authentication, thanks to smartphones.

Citibank and Bank of America allow logging into bank accounts using a fingerprint.

Facebook and Google have implemented sophisticated facial recognition technology.

Employers provide fitness tracking devices to monitor every step employees take.

Beauty apps analyze customers’ skin to recommend products and services.

As part of their admission system, Disney theme parks collect fingerprints data from visitors who have tickets.

The Transportation Security Administration (TSA) is using and testing fingerprint scanners at various U.S. airports. Global Entry kiosks take photos of travelers.

In 2018, Delta Airlines launched optional facial recognition in Atlanta after two years of testing. The carrier now offers biometric boarding also in Minneapolis, Salt Lake City, New York, Detroit, and Los Angeles. They have stated that 72% of travelers in Atlanta preferred biometric boarding as it is faster than traditional boarding. Delta does not save or store any images or biometric data.

High-end hotels and retailers are using facial recognition for loyalty programs and to identify VIPs for preferred service.

In retail outfits, faces of persons caught on camera are turned into a biometric template and compared with a database for a possible match with known criminals.

Retailers use the same platform that helps identify shoplifters to find out which displays are working better, where the customer traffic is, to improve sales.

Technology has evolved much faster than legislation. Improper use of facial recognition technology is on the rise and is concerning.

The most recent example of possible improper use involves a New York start-up, Clearview AI. It matches photographs submitted by subscribers against more than 3 billion photos, scraped from various public websites.

Although Clearview AI’s database has supposedly helped law enforcement officials identify and find criminals, there is currently no way for people whose photos are included in the database without their knowledge, to remove their images from this collection.

The Commercial Facial Recognition Privacy Act of 2019, introduced to US Congress in March 2019, strives to prohibit entities from using facial recognition technology to identify or track an end user without obtaining consent, and for other purposes.

Hopefully, new laws will protect consumers. I also hope that the government will not develop a system of surveillance following China’s example.

There is a difference between monitoring individuals as an effort to protect them versus stalking people.

What can businesses do to keep customers’ trust?

New biometric technologies, if implemented carefully, bring new opportunities for improved and safer customer experiences.

David Britton, who is currently VP of Industry Solutions of Global Fraud and Identity at Experian, believes that legitimate consumers trying to gain access to an account need a seamless, frictionless consumer experience. The company’s system should recognize them and block fraudsters out.

(Source: Biometric Update)

In their recent study, Experian found that 74 percent of businesses are confident that if they can recognize the consumer by identifying them upfront, they can prevent fraud. By understanding how the consumer behaves and interacts with the company’s services, businesses believe they can differentiate a legitimate user from a fraudster.

In summary, businesses and organizations must protect customer data. Transparency is critical; customers need to know how companies use their information, including biometric data.

As a consumer, I give my trust and loyalty to companies that serve me well, are transparent, and protect my information.