August 6, 2004
Passport ID Technology Has High Error Rate
The State Department is moving ahead with a plan to implant
electronic identification chips in U.S. passports that will allow computer
matching of facial characteristics, despite warnings that the technology is
prone to a high rate of error.
Federal researchers, academics, industry experts and some
privacy advocates say the government should instead use more-reliable
fingerprints to help thwart potential terrorists.
The enhanced U.S. passports, scheduled to be issued next
spring for people obtaining new or renewed passports, will be the first to
include what is known as biometric information. Such data, which can be a
fingerprint, a picture of parts of eyes or of facial characteristics, is used
to verify identity and help prevent forgery.
Under State Department specifications finalized this month
for companies to bid on the new system, a chip woven into the cover of the
passport would contain a digital photograph of the traveler's face. That photo
could then be compared with an image of the traveler taken at the passport
control station, and also matched against photos of people on government watch
lists.
The department chose face recognition to be consistent with
standards being adopted by other nations, officials said. Those who drafted the
standards reasoned that travelers are accustomed to submitting photographs and
would find giving fingerprints to be intrusive.
But federal researchers who have tested face-recognition technology
say its error rate is unacceptably high – up to 50 percent if photographs are
taken without proper lighting. They say the error rate is far lower for
fingerprints, which could be added to the chip without violating the
international standard.
The new system would differ from U.S. requirements for many
foreign travelers, who are fingerprinted when they apply for visas to visit the
United States. The visitors then have their fingers scanned when they enter the
country to compare against the data on the visa.
Similar requirements are to be imposed for travelers from
countries whose citizens do not need visas to come to the United States, who
will be fingerprinted when they arrive in the country.
"I don't think there's a debate," said Charles
L. Wilson, who supervises biometric testing at the National Institute of
Standards and Technology, an arm of the Commerce Department.
"Fingerprints are much better."
The concerns come at a time of heightened terrorism alerts
and urgent calls for changes in national security from the commission
investigating the Sept. 11, 2001, attacks. Among its many recommendations were
quick adoption of biometric passports and more secure drivers' licenses, though
the commission did not specify which type of data should be used.
Last weekend, government sources told The Washington Post
that a South African woman was under investigation for possible terrorist
connections after she apparently walked or swam across the Mexico-U.S. border
last month. The South African passport she presented to authorities at
McAllen-Miller International Airport in Texas appeared to have been altered,
the sources said, leading to her detention.
The State Department settled on face recognition as the
biometric to comply with specifications set by the International Civil Aviation
Organization, a Montreal-based standards agency affiliated with the United
Nations.
In seeking to have countries use one common biometric to aid
anti-terrorism efforts, the international group designated face recognition two
years ago in part because it would be easiest for most countries to implement
and it was deemed the least likely to raise privacy concerns.
"Facial photographs do not disclose information that
the person does not routinely disclose to the general public," the group
said in a final technical report issued in May. "The photograph . . . is
already socially and culturally accepted internationally."
But while the agency set face recognition as a standard, it
said countries could add one or two other approved biometrics: fingerprints and
scans of the eye's iris. Several European countries are considering adding
fingerprints to their passports.
With expiration dates varying among U.S. citizens, it will
take years for the new system to affect everyone who holds a passport. Critics
ask why the department is not adding fingerprints now –
even if they are not immediately used – rather than starting
over again later.
"The biometric that makes most sense is the fingerprint
with proper privacy and security guidelines," said Ari Schwartz, associate
director of the Center for Democracy and Technology, a think-tank on digital
policy issues. "By not taking this opportunity today, the State Department
is really missing out."
Frank E. Moss, deputy assistant secretary of state for
passport services, emphasized the importance of having a global standard for
identity verification. The U.S. government will consider adding biometrics in
the future, Moss said, but he added that several countries expressed privacy
concerns over the use of fingerprints.
Moss said adding fingerprinting stations at passport
application offices would be a serious logistical burden, with roughly 8
million new or replacement passports issued each year.
Moss said the State Department will not take new digital
photos. Instead, applicants for new or replacement passports will submit photos
as they do now, and the department will digitize them.
Passport-photo vendors have been given updated
specifications for taking the pictures, to help provide proper illumination and
other specifications to maximize the effectiveness of the face-recognition
methods, Moss said. The department hopes the program will pay for itself
through a surcharge of about $10 per passport.
Rebecca Dornbusch, deputy director of the International
Biometric Industry Association, said that the U.S. view has long been that
fingerprint technology is preferred but that it was important to be in harmony
with the international standard.
"The important thing to recognize is that it is an improvement,"
Dornbusch said of the face-recognition requirement. But she said her
organization is encouraging the State Department to "continue to implement
as many biometrics as they can, so they can ensure . . . the most secure
protection."
But James L. Wayman, director of biometric identification
research at San Jose State University in California, said face recognition is
not reliable enough to be useful.
"Facial recognition isn't going to do it for us at
large scale," Wayman said. "If there's a 10 percent error rate with
300 people on a 747, that's a problem."
According to tests by the National Institute for
Standards and Technology, two fingerprints provide an accuracy rate of 99.6
percent. With face recognition, if the pictures are taken under controlled
circumstances with proper illumination, angles and facial expression, the
accuracy rate was 90 percent.
"The numbers would be better today, but they are not
going to be comparable with fingerprints," Wilson said. Even a
person's aging can affect results, especially with children.
Dennis Murphy, a spokesman for the Department of Homeland
Security, which employs passport-control agents, said the agency has not yet
determined how images of travelers will be taken to compare against the photos
on the embedded chips.
He said the department will put out its own request for bids
for equipment – probably something similar to a Web camera – that visitors
would look into for a photograph. The bid documents, he said, will specify
standards for making the face-recognition match as accurate as possible.
Murphy declined to comment on the State Department's
decision not to include fingerprint data in the passports.
Some said the government feared a potential backlash.
"The simple answer is that they don't want to put in a
fingerprint biometric because they don't want to deal with the political
recriminations" said Robert D. Atkinson, a member of a national security
task force at the nonprofit Markle Foundation, which studies digital issues.
Atkinson also heads the Progressive Policy Institute, a part of the Democratic
Leadership Council.
Privacy advocates argue that taking fingerprints is no more
invasive than face recognition, and certainly not more than other Bush
administration initiatives launched since Sept. 11, 2001, that have sought to
link databases of buying habits, bank accounts and other personal information
to try to predict terrorist activity.
The fingerprint data could be placed on the passport chip
but not saved in a database, they said, removing the concern over a central
government repository. The data on the chip is simply matched against a finger
scan when the traveler arrives at the passport control station.
"My passport belongs to me," said Ian
"Gus" Hosein, a senior fellow at Privacy International, a
Britain-based advocacy group. "They should not be using this as a back
door to international databases."