9

current activity to date, and contact centres dem-onstrating the largest demand for the coming years. The contact centre is a good illustration of businesses facing significant pressure to intro-duce efficiencies. Additionally, financial institu-tions are required to support new regulations and industry expectations, such as the FFIEC guidance in the US, and SEPA across Europe. Experience has taught us that you need drivers like these for businesses to make changes.

In the US, meanwhile, corrections facilities (prisons) are already using speaker verification to ensure that when a prisoner says they are speaking to a loved one, that really is who they are speaking to, and not a fellow criminal. Is it too much of a leap to imagine that authorities will start recording a criminal’s voiceprints in the same way they keep fingerprints today, forcing them to read from a script after they are arrested and storing the results? The print could then be used in a variety of crime prevention scenarios although it’s important to recognise that voice-print technology today is usually used for verify-ing a claimed identity rather than providing the ability to pick someone out of a crowd.

Monitoring for fraud also offers a compel-ling pain point to tackle, and is an application of the technology that’s already been proven. Spotting the calls of frequent offenders requires the use of text-independent voiceprints, which are built up over a period of time based on capturing the caller speaking broader, more random sets of phrases over numerous calls. Curiously, this inherently becomes more accurate for spotting repeat offenders, because accuracy improves as more – and more diverse – audio of the speaker is captured. For most applications, however, it is quicker, more practi-cal, and more successful to use text-dependent voiceprints.

One area that has not taken off yet, but could be an important application for speaker

verification, is the securing of mobile devices. Awareness of the need for greater personal security of mobile devices is growing with every laptop containing sensitive information that falls into the wrong hands. Within the last few months, it was reported that a British Home Office laptop with an encrypted top secret disk was sold on eBay. Passwords might be the user access control of choice in Microsoft’s latest operating systems, but a spoken phrase could provide a higher level of security. Mobile phones now contain and provide access to almost all our personal data; voiceprints are a natural and logical method for securing them and tying them to the individual.

Extend this concept to the ultimate mobile device, the car, and you start to see how far the technology could go. Speaker verification could be the ultimate in personal access control because its access device – the voice – is some-thing we carry around with us all the time and something that can’t be forgotten, like a PIN or password.

Making deposits in the voice bankOnce some of these use cases start to take off, there will be a critical mass of voice-prints being generated, and that’s when this market will get really interesting. Companies are not going to want to reinvent the wheel by generating their own prints, in the same way that ecommerce sites don’t set up their own trust certificates – they just get Verisign or another security provider to do it for them.

In a typical commercial model where the speaker verification application runs

in the data centre, the voice print is stored locally, for access as and when that particular individual calls in. But we are already see-ing companies offering to manage banks of voiceprints on behalf of multiple customers and it’s possible that agencies will emerge that act as central repositories for all a coun-try’s voiceprints. Clearly, there’s some value attached to the voice prints companies col-lect, in the same way that customer data is a tradeable commodity. But it may make sense for both the company and the consumer to have a third party managing voiceprints.

There are of course commercial and securi-ty hurdles to be overcome, and whoever takes responsibility for a nation’s voiceprints will become a target for criminals. But will Big Brother sentiments prohibit such a set up? We don’t think so as it’s relatively straight-forward to use encryption techniques so that the voice print never has to be stored locally and remains dissociated from any identifying data like a person’s name or address. Even if it could be decrypted and turned into some-thing usable, which we are confident is not the case, a voiceprint without an associated identity has negligible value

These emerging business models will become part of the future of speaker verifi-cation. What matters for today is that voice biometric technology is here, it works and companies that are adopting it now are gaining meaningful competitive advantages.

This article was provided by Dan Faulkner, director of product management at Nuance Communications. A Nuance White Paper called “Supporting Multi-Factor Authentication Using Speaker Verification and Speech Recognition” is available from www.nuance.com/biometrics. Meanwhile, Mr Faulkner may be contacted at Tel: +44 1483 794340 for further information.

FEATURE / SURVEY

May 2008 Biometric Technology Today

Linking the person to the UK identity card

An identity card is issued to record the process of registration. When issuing a card, the intention is to link the information recorded on the card with the person that

the card was issued to. There are several considerations that must be addressed when issuing any form of identity An identity card is issued to record the process of

registration. When issuing a card, the inten-tion is to link the information recorded on the card with the person that the card was issued to. There are several considerations that must be addressed when issuing any form of identity document: the need for reliability; the prevention of manipulation and the counterfeiting of cards; the data

This article considers the linking of the identity of the person to an identity card, in particular, how biometric measurements can help to link the holder of the card to the information stored on the card.

10

SURVEY

accurately reflects the information recorded on the register; and when a card is issued, it is necessary that the person to whom the card was issued is clearly identified as the same person that was registered, and the card is able to clearly demonstrate that the person to whom the card was issued is the same person in physical possession of the card.

Paper passports and identity cards have been issued for centuries, and in the nine-teenth century, governments used the rapid developments in technology to counteract the actions of forgers: a struggle that contin-ues to this day. The inclusion of engraving on passports required a forger to pay an engraver; then the development of ‘security paper’ was used, not always successfully, to prevent the reprinting of passports with sophisticated printing techniques, and to prevent the manipulation of passports by using special types of ink. For instance, the passports issued by Prussia in the mid to late nineteenth century were so sophisticat-ed, that the security features prevent mod-ern copiers from reproducing the document.

The use of digital technology may help to resolve some of these issues, but it is not certain. The use of the physical attributes of a person in the form of biometric measure-ments may go some way to provide a strong link between the information recorded on the card and the person in possession of the card – and to be successful, it will be neces-sary to include more than one form of bio-metric measurement, either on the card, or on the register and on the card. Ideally, the measurements chosen ought to use the best available technology to enhance security and significantly reduce the risks of forgery and manipulation.

The purpose of the national identity registerOne of the most important considerations about a registration card is the purpose for which it is designed. The purpose of the national identity register can be divined by considering two sections of the Identity Cards Act 2006. First, section 1(3) provides for a ‘reliable record of registrable facts about individuals in the United Kingdom’ and section 1(3)(a) suggests that it will be a ‘convenient method for such individuals to prove registrable facts about themselves to others who reasonably require proof ’, and section 1(3)(b) refers to a method of

ascertaining and verifying registrable facts about people ‘wherever that is necessary in the public interest.’

The public interest includes national security; the prevention or detection of crime; the enforcement of immigration controls; the enforcement of prohibitions on unauthorised working or employment; and to secure the efficient and effective provision of public services (section 4). It is recognised that a registration card will not prevent terrorism or reduce crime, but it is conceivable that the use of such a card may deter some, and for others, they will merely alter the point of attack.

The data required to fulfil the purposeIn order to know what data is necessary to fulfil the purpose under the Act, it is necessary to know what a registrable fact is. This is set out in section 5, and includes the identity of the person (section 7 sets out what this includes: full name; other names by which the person is or has previously been known; gender; date and place of birth and, if dead, the date of death; and external characteristics that are capable of being used for the purpose of identification); the present and all previous addresses of the person; where and when the person was previously resident; their current and previous resi-dential status; information about numbers allocated to the person for identification purposes and about the documents to which they relate; information about occasions on which information recorded about the person in the Register has been provided to any per-son; and information recorded in the Register at the request of the person (Schedule 1 provides more detail).

Clearly, a great deal of information is included about each individual. The sheer amount of information will lead the percep-tive reader to acknowledge that the card will be much sought after by people with a nefari-ous intent, and the enrolment and verifica-tion process will be crucial in ensuring the data is accurate and correct. Any failure in the enrolment process or the technology will undermine the purpose of the register.

The meaning of identityGenerally, the meaning of identity is that of personal identity, which describes the condition or fact of continuity of personal

existence. Another important part of the concept of identification is the ability to establish a continuity of association with an individual, that is whether the person now presenting himself or herself is the same person that presented themselves on a previous occasion.

The precise meaning of personal identity differs, according to the circumstances. Personal identity can be the unique name of an individual, a name and an address, a name and a date of birth, or perhaps a name and an occupation. An identity can be the establishment of a relationship between one manifestation of personal activity and another. An example is where a patent is to be transferred from the person named in the register to a third party. The person acquir-ing the title needs to derive a satisfactory title to the patent. They must establish a link between the person named in the regis-ter and the person they are dealing with, or with the predecessor-in-title. This illustrates the point that there is a need to distinguish between the concept of identity and infor-mation associated with identity, such as the name, address and nationality of an individ-ual. This distinction is important, because our identity does not change, but informa-tion relating to identity does. It is where an attempt is made to identify people by using the information linked with identity, that things go wrong.

Alternatively, identity can be a condi-tion of being, identified for a purpose. One example is when an individual is prosecuted for driving while disqualified. It might be necessary to prove that the person before the court is the same person as was previ-ously disqualified. If this can be proved, it does not matter whether they have the same name, address or occupation as when they were disqualified previously.

Equally, some individuals may wish to be known under a nom de plume. There are perfectly good reasons for this, such as where an author writes fiction, but does not wish to confuse their real life identity with their activities as creative writer. Two English examples are that of C. L. Dodgson, who lectured in mathematics at Oxford University during the nineteenth century and wrote under the name of Lewis Carroll, and Mary Ann Evans, who wrote under the name of George Eliot.

For the purposes of this article, it will be taken that ‘identity’ means the personal identity of an individual person that is linked to their existence by means of their birth certificate. In the case of a woman who, upon marriage, takes her husband’s

Biometric Technology Today May 2008

11

SURVEY

May 2008 Biometric Technology Today

family name, the root of her identity remains with her birth certificate, and the marriage certificate provides the evidence that she has adopted the name of her husband.

Verification of the individualThe most basic document relating to iden-tity, the birth certificate, does not prove that the holder of the certificate is the person whose birth is recorded in the certificate. There is no nexus between the content recorded on the birth certificate and the holder, despite the legal presumptions that apply. Although a birth certificate is a record of the birth of an individual, it does not follow that the person whose name is identified on the certificate is same person as the individual in whose possession the certificate rests. In the absence of proof of a link between the holder of a birth certificate and the content, the assertion of identity rests on the proposition that a person’s identity is demonstrated by the record of a birth, entered in a birth certificate, which in itself is not capable of proving the link between the individual and the certificate. The identity of an individual is predicated on the existence of the record of their birth. This evidence can be described as the foun-dation document that links the individual to their identity. Until recently, this record was rarely used as evidence to corroborate the identity of an individual when issuing other documents, such as a passport or driving licence, or to open a bank account.

In contemporary society, more diverse types of evidence are available that serve to corroborate the identity of an individual. The longer a person lives, the more fre-quently they interact with agencies that create their own records. As a result, the link between the original record of birth as evidence of identity may cease to be relevant because it is too remote, or no such link may have been made when other records are created. In many, if not most instances, a document that is also used to corroborate

identity is created without a direct reference to the certificate of birth. In this respect, the independent recognition of identity will also exist within a context other than by evi-dence of birth. There are a range of records, both public and private, that do not identify an individual, but form a pattern of behav-iour or history of events, and are available as a means of reference, such as: government records (passport – which is a travel docu-ment; driving licence – which is a permit to drive; national insurance number – the pur-pose of which is to record national insur-ance contributions and income tax, and for claiming benefits); local authority records (records of the names of the occupiers of a dwelling for the purposes of collecting local taxes, registering the occupants on the register of electors); bank accounts; credit reference agencies; Inland Revenue tax notification; telephone and utility payment history; credit card reference and other such examples. It is possible to corroborate a per-son’s identity by referring to such records, even if these are records of daily activities or grants of permissions, rather than evidence of the identity of the individual.

The strength of the biographical history acts to bind the identity of an individual to a historical record of daily events. If such records are to have any meaning, it is important that they are accurate if they are to be relied upon to corroborate a person’s identity. It is difficult to link identity to a physical token, although it is possible to strengthen the information linking the person to the registration card.

The signature as a means of preventing fraudOf interest from a legal point of view is the additional information set out in Schedule 1 to the Act, especially the provisions for the inclusion of identifying information in the register and on the card. This may include a photograph of the person, their signature, fingerprints and other biometric information. At present, most documents

include a scanned manuscript signature of the individual, such as on a driving license. However, manuscript signatures are notori-ously easy to forge, and even experts only mange to identify forgeries fifty per cent of the time.

If the signature of a person recorded on an identity card is to have any value as a form of security as well as to prevent the misuse of the card, it may be that the agency responsible for implementing the identity card might consider the use of some of the technologies available in terms of a biodynamic version of a manuscript signature, where a person can write their manuscript signature by using a special pen and pad. The signature is reproduced on the computer screen, and a series of measure-ments record the behaviour of the person as they perform the action. The measure-ments include the speed, rhythm, pattern, habit, stroke sequence and dynamics that are unique to the individual at the time they write their signature.

Advances in technology are capable of providing for the assurance that a biody-namic signature cannot easily be forged, unlike a scanned manuscript signature. If such technology were available, then the inclusion of a signature on the identity card, and a replacement of the justifiably maligned PIN, might prove to be a sig-nificant advance. The point is, advances in technology will continue, and the replace-ment of the PIN ought to be on the agenda of every organization that relies on the PIN.

The manuscript signature is unique to the individual, and is very difficult to replicate, which makes the biodynamic signature such an attractive proposition. It is also easier for a person to remember, no matter how old they are, unlike a PIN. If a technological solution were sufficiently robust to dem-onstrate the near impossibility of forging a biodynamic signature, arguably the identity card may prove to be useful in some legal circumstances, especially where a lawyer or notary might need to be convinced that the signature of the person is that of the genuine person, and not some impostor.

Continued on page 12...

12

...continued from page 11

Biometric measurements tend be used to authenticate the person (such as an iris scan, or fingerprints for example), and the person is then required to sign a document physi-cally, although biodynamic versions of the manuscript signature are increasingly being used by notaries in the USA, which act to verify the means of authentication, whilst also performing as an electronic signature.

Consider a man who jointly owns a house with his wife, and divorces her. He marries another woman, who adopts his name. He and his second wife sell the house, and the second wife signs the documents in her married name. Unless the lawyer managing the sale is aware that the wife that is signing the papers is not the person that is the joint owner of the prop-erty, it is conceivable (and this has occurred) that the first wife will then have to take legal action to recover her share of the property.

A similar problem was highlighted in ‘First Person’ in the FT Weekend, May 10/11 2008 on page 7. A thief obtained a scanned copy of a deed with the manuscript signature of the owner of the house they were renting. The thief, part of a group that stole houses, forged the signature and sold the house. It took the rightful owner some time to prove the house did not belong to the thief. In such circumstances, it is pos-sible for a registry, such as the land regis-try, to have a record of the first signature, perhaps a biometric manuscript signature, so the different biometric signatures can be compared before the transaction for the sale of the land is irrevocable.

Concluding remarksThe reader ought to be aware that introduc-tion of an ‘identity card’ was (and remains) an anathema to the author. However, given the development of the networked world, which exists in parallel to the physical world, there are a number of compelling arguments for individuals to take action to protect their identity. If an ‘identity card’ is introduced that has a sufficient number of robust meas-ures in place to make it difficult to forge or almost impossible to alter, it is conceivable that the card, providing the registration process is suitably robust, may go a long way to providing a benefit to individual holders, both practically and legally.

This article is copyright by Stephen Mason, Barrister. For any further information he can be contacted at www.stephenmason.eu

credential

DHS alters TWIC compliance date

The US Department of Homeland Security (DHS) has announced

that the final compliance date for the biometric-based Transportation Worker Identification Credential (TWIC) program has been delayed until 15 April 2009, almost seven months longer than the 25 September 2008 original date for compliance. According to DHS the extension is a direct result of talks with port officials and industry.

TWIC was established in the Maritime Transportation Security Act and the SAFE Port Act to serve as an identification pro-gram for all Coast Guard credentialed mari-ners and personnel requiring unescorted access to secure areas within a port. The program is on track to complete enrolment

for a substantial number of jurisdictions by the end of 2008, and several ports will still be required to comply with TWIC regulations this year, DHS said.

Owners and operators of facilities located within Captain of the Port Zones Boston, Northern New England, and Southeastern New England will need to comply by 15 October 2008. These three ports were selected thanks to their geographic proxim-ity, the size of their TWIC enrolment popu-lation, and their respective enrolment efforts to date. Additional ports will be announced in the coming weeks, and the Coast Guard will provide at least 90 days notice prior to enforcement.

DHS says that the TWIC program is progressing steadily and has opened more than 100 fixed enrolment centres and doz-ens of mobile sites nationwide. More than 250 000 workers have enrolled to date and thousands more are being processed each week. Enrolment began at the Port of Wilmington, Del. in October 2007.

Although the compliance date has been extended by seven months, workers are being encouraged to enrol as soon as possible.

The UK is to implement facial recognition at an airport (rumoured to be somewhere in the north of the UK) designed to fast track people through bor-

der control. The image will be taken from the passenger’s ePassport, rather than a seperate token, and will be a one-to-one verification scheme.At a speech given at the Identity Loop confer-ence in London, Gary Murphy, head of opera-tional design for border control at UKBA commented that the UK needed to dip its toe into the water now, and had decided not to wait for several years until there were enough fingerprint-based ePassports to trial.In response to the news there was the usual objections from the privacy lobby. Phil Booth of the No2Id Campaign was reported in the Guardian as saying: “The last time I spoke to anyone in the facial recognition field they said the best systems were only operating at about a 40% success rate in a real time situation.”Meanwhile, Gus Hosein, a specialist at the London School of Economics in the interplay between technology and society, was reported

in the same article as saying: “It’s a laughable technology. US police at the Super Bowl had to turn it off within three days because it was throwing up so many false positives.”Somebody needs to send these two a message. First of all Hosein is comparing apples to oranges. There is a huge difference in the per-formance of a one-to-one verification system using ICAO-compliant facial images and that of an unconstrained surveillance operation using non-ideal facial images. Not to mention that this super bowl experiment was many years ago – since when facial recognition tech-nology has improved by more than an order of magnitude.Booth’s 40% success rate does not stand up to scrutiny either. As noted in this month’s lead story, an almost identical arrangement is in place at airports across Portugal. Tests on the system by a local University showed that the system is now operating at an FRR of less than 2% and an FAR of 0% so far. Meanwhile each border crossing is taking an average of 20 seconds.But let’s not let inconvenient facts get in the way of a good story…

Mark Lockie

COMMENT

SURVEY / NEWS / COMMENT

Biometric Technology Today May 2008