National Research Council Takes Biometrics Down a Notch

Late last month, the National Research Council released a book entitled Biometric Recognition: Challenges and Opportunities that exposes the many difficulties with biometric identification systems. Popular culture has portrayed biometrics as nearly infallible, but it's just not so, the report emphasizes. Especially at scale, biometrics will encounter a lot of challenges, from engineering problems to social and legal considerations.

"[N]o biometric characteristic, including DNA, is known to be capable of reliably correct individualization over the size of the world's population," the report says (page 30). As with analog, in-person identification, biometrics produces a probabilistic identification (or exclusion), but not a certain one. Many biometrics change with time. Due to injury, illness, and other causes, a significant number of people do not have biometric characteristics like fingerprints and irises, requiring special accommodation.

At the scale often imagined for biometric systems, even a small number of false positives or false negatives (referred to in the report as false matches and false nonmatches) will produce considerable difficulties. "[F]alse alarms may consume large amounts of resources in situations where very few impostors exist in the system's target population." (page 45)

Consider a system that produces a false negative, excluding someone from access to a building, one time in a thousand. If there aren't impostors attempting to defeat the biometric system on a regular basis, the managers of the system will quickly come to assume that the system is always mistaken when it produces a "nonmatch" and they will habituate to overruling the biometric system, rendering it impotent.

Context is everything. Biometric systems have to be engineered for particular usages, keeping the interests of the users and operators in mind, then tested and reviewed thoroughly to see if they are serving the purpose for which they're intended. The report debunks the "magic wand" capability that has been imputed to biometrics: "[S]tating that a system is a biometric system or uses 'biometrics' does not provide much information about what the system is for or how difficult it is to successfully implement." (page 60)

"Biometric Recognition: Challenges and Opportunities" is a follow-on to the 2003 National Research Council report, "Who Goes There?: Authentication Through the Lens of Privacy." That was one of few resources on identification processes and policy when I was researching my book, Identity Crisis: How Identification is Overused and Misunderstood. (Mine is quite a bit more accessible than this new book, so if you're interested in the field, you might want to start there.)

There is nothing inherently wrong with biometrics. They will have their place, and they will make their way into use. But the dream of a security silver bullet in biometrics is not to be. Identity-based security---using the knowledge of who people are for protection---is valuable and useful in day-to-day life, but it does not scale. National or world ID systems would not secure, but they would carry large costs denominated in both dollars and privacy.