Technology Review - Published By MIT
Advertisement

Simson Garfinkel's blog

A commonsense take on computer security, usability and why IT does matter.

View Complete Bio
Advertisement
Thursday, March 08, 2007

Biometrics in ID Cards?

Americans say they want it. They're wrong.
According to a recent poll by Truste, 82 percent of Americans "support the use of
biometric identification on passports," 75 percent support adding biometrics to driver's licenses, and 73 percent support adding it to social-security cards.

The survey polled 1,025 American consumers between September 25 and September 29, 2006. The margin of error is plus or minus 3 percent.

The survey has some contradictions. For example, 68 percent of the respondents believe that biometrics added to identity documents will make it harder for thieves to engage in identity theft, but 67 percent think that "criminals will find a way around the technology."

Say what?

The real problem with adding biometrics to identity documents isn't that crooks will find a way around the technology, but that crooks will get identity documents that have your name but their biometrics. If you think identity theft is bad now, just imagine how bad it will be when the crook's fake identity is verified through the
use of fingerprints or iris scans:

"Yes, your honor, we know that Mary Johnson was there, because she presented her identity card and had her iris scanned. That's what the computer says, and the biometric backed it up."

"Is the woman in the defendant's chair the same woman who presented the ID card?"

"I don't know, your honor. I didn't look at her face. The computer did."
Advertisement

Comments

  • Biometric IDs Not A Problem For Identity Theft
    Simson,

    You posted these comments:

    <" Say what?

    The real problem with adding biometrics to identity documents isn't that crooks will find a way around the technology, but that crooks will get identity documents that have your name but their biometrics. If you think identity theft is bad now, just imagine how bad it will be when the crook's fake identity is verified through the
    use of fingerprints or iris scans:

    "Yes, your honor, we know that Mary Johnson was there, because she presented her identity card and had her iris scanned. That's what the computer says, and the biometric backed it up."

    "Is the woman in the defendant's chair the same woman who presented the ID card?"

    "I don't know, your honor. I didn't look at her face. The computer did." ">


    If an identity thief creates a document with a victim's info, and his/her own biometric, it will be VERY easy to prove that the victim was not the person who made a disputed transaction.

    The biometric will prove that the real "Mary Johnson" is not the same person as the identity thief "Mary Johnson". The biometric attached to the fake ID can then be flagged, in the database, as a false identity and the thief can be caught during a future transaction.


    clear laker
    Rate this comment: 12345

    clear_laker
    03/09/2007
    Posts:1
    • Re: Biometric IDs Not A Problem For Identity Theft
      The world according to garfinkle is a simplistic world indeed. In Realityland, biometrics are more a boon than a boondoggle as portrayed by naysayers and loony ACLU "rights" advocates.  Post-industrialized society enjoys precious little privacy thanks to pervasive tracking methods already in existence - paper and electronic transaction trails, CCTV surveillance, intrusive dataminers like Doubleclick, and the lying FBI/NSA snooperspooks. OTOH, society suffers significantly from the parasitism of-
      >> looters who steal identities to rob from stores and moneylenders
      >> criminals who want to hide from past misdeeds
      >> illegals who burrow into the countryside like sand fleas by using fake/forged documents

      Biometrics aren't a panacea and criminals will always figure out ways to game systems and get around security. Yes, some earlier forms could be thwarted or spoofed when used alone; however, top of the line modern multi-layered biometric applications as will be used on secure ID cards, drivers licenses and passports/visas are EXTREMELY difficult to duplicate. Will poor imitations fool the ignorant? Sure. Will as many people lose their identities, assets or suffer less privacy because of biometrics. NO! The big plus is the audit trail left behind when they're used will serve to indict them when they're caught.

      Dreaming up lame scenarios isn't going to deter this much-needed technology, Garf.  Far too much stonewalling has already put this nation at risk.  A fake Mary Johnson who mysteriously was able to merge her own biometrics (iris and fingerprints) with the real Mary Johnson's name, SSN and bank/credit account would be easily caught as soon as the ID was flagged by a state/federal agency or credit card company investigating an alleged crime. The holder of flagged credentials would have to provide confirmation, i.e., archived biometrics, so your scenario would go like this...
      A - Fake Mary smiles innocently and presents fake D/L to cop on side of road or the fake passport to the border guard or the fake credit card to a shopkeeper or fake SSN to welfare agent.
      B - Cop, guard, shopkeeper or welfare agent slides fake credential into the portable LiveScan IBIS units built by L-1/Identix - http://tinyurl.com/2r7ahp
      C-  What's this? A red flag in the database? Mary ain't really Mary? Not only is fake Mary caught red-handed because her face and fingerprints incriminate her, her rap sheet and outstanding warrants pop up and she's arrested on the spot without being able to sweet talk her way out. Not many Mary's will be trying this anymore once word gets out, will they, Garf? 

      Of course, this assumes the traitors in Congress, the idiot legislators who want to give illegals drivers licenses, credit cards and free medical care, fat cat bankers who've stonewalled biometrics in favor of passing losses on to consumers, and the ACLU are deported first. We wouldn't have a standing army of 15 million illegals and tens of thousands more sleazy citizens running around using fake ID's and stolen credit cards if it weren't for our NONrepresentatives' malfeasance. Don't be part of the problem... be part of the solution. Support biometrics. Fight the politically correct crowd who pander to criminals.
      Rate this comment: 12345

      ultimate_con...
      03/09/2007
      Posts:1
      • Value of bio info within "card"?
        I don't understand the value / reason to have the biometric info, encrypted or not, locally within the "card".

        Shouldn't the "card" have a "serial number" that is transmitted along with an encrypted version of fresh / live biometric info to be compared to what is already on file?

        My "card" says the ID lookup number is 123456 and the just "measured" encrypted bio info is zxy54321 are both securely sent for verification?  Don't all three pieces have to, essentially, mutually verify each other, that every thing "matches" - that is to say, match (identity) confirmed?  Otherwise, no match - no confirmation?

        Security / verification / encryption info, sure.
        But why have the bio info locally within the "card"?
        Rate this comment: 12345

        nekote
        03/09/2007
        Posts:132
        Avg Rating:
        4/5
        • Re: Value of bio info within
          I believe you are right, nekote. That is a much better idea. So why do we even need the card? Everyone just has to remember their own unique ID, which doesn't even need to be secret. Nothing to lose, compromise, duplicate, or extort. This seems to be foolproof. What are we missing?
          Rate this comment: 12345

          ChrisG_UK
          03/11/2007
          Posts:2
    • Re: Biometric IDs Not A Problem For Identity Theft
      Biometric ID documents (cards and passports) will work fine for organisations where everyone concerned is on the database and every point of transaction has equipment to read these documents.



      Nationally it is virtually impossible to satisfy both these conditions and hence it is obvious that these documents will fail. In reality they will tempt fraudsters to use fakes of these documents as IDs where there is no reading equipment and hence make bad problems worse by boosting identity fraud.
      Rate this comment: 12345

      yogesh
      03/11/2007
      Posts:1
  • Thank You, Canada
    Homeland Security admits to hanging six Saddam Husseins this last week, because they all matched the bio template. The unidentified HSA spokesperson said "There should not be much ado because four of them were Canadians."
    Rate this comment: 12345

    Phineas
    03/10/2007
    Posts:68
    Avg Rating:
    3/5
  • David Llewellyn-Jones may have a solution
    I found this article on-line which encrypts all data on the ID card (http://www.flypig.co.uk/thoughts/lsi.pdf).  The card would contain an application which would answer question in a simple "Yes/No" style.  The author, David Llewellyn-Jones, provides a great amount of detail with respect to how decentralizing identification information actual make ID theft *more* difficult.  I considered the concept counter-intuitive at first.  However, after much thought, I can see his idea makes perfect sense.

    In short, I highly recommend the read!
    Rate this comment: 12345

    bug_me_not
    03/14/2007
    Posts:6
    Avg Rating:
    2/5
Advertisement

Log In

Forgot your password?     Register »
Advertisement
Technology Review July/August 2009

Current Issue

Search Me
Inside the launch of Stephen Wolfram’s new “computational knowledge engine.”
•  Subscribe
Save 41%
•  Table of Contents
•  MIT News
» Gift Subscription
» Digital Subscription
» Reprints, Back Issues
» Subscribe
» Table of Contents
» MIT News

More Technology News from Forbes

Advertisement
MIT Massachusetts Institute of Technology © 2009 Technology Review. All Rights Reserved.