BISSEX: An Eye for an ID
The signature on your checks, the PIN on your ATM card, the password on your e-mail account -- these safeguards protect your money and private information from frivolous or malicious misuse. Yet they are not perfectly secure. Signatures can be forged. Cards can be stolen. PINs and passwords can be spied from over your shoulder.If promoters in the burgeoning "biometrics" industry get their wish, these tokens of identity will soon be replaced by methods both simpler to use and harder to defraud. Biometric methods involve no external representation of your identity at all; your body becomes your passport.To biologists, the term "biometrics" refers generally to the numerical study of living things. In its new life as a buzzword, it is about the measurement of only one thing: identity. Its scientific foundation is in physical characteristics different for every individual, yet similar enough for variations to be meaningfully defined: the shape of the face, for example.The most familiar example of biometric identification, the fingerprint, predates the computer by decades. Long established to be unique for each individual, the fingerprint is compact, quick and painless to take, and easy to store. This is true of prints on paper, but it is especially true of digitized prints stored on computer.The state of California, which has been collecting fingerprints with driver license applications since the early 1970s, has been storing them digitally since 1990. Cheaper biometric technology will give them something to do with that massive database. For instance, if you get pulled over and don't have your license, a quick scan of your finger and a connection to the DMV database can tell the officer all about you.Biometric technologies can also measure the shape of the hand, the sound of the voice, the hidden textures of the eye, even the patterns of DNA itself.Next to the fingertip, the most promising biometric site today seems to be the eye. Two different aspects of human eyeballs -- the pattern of veins on the retina in the back of the eye, and the geometry of the colored ring, or iris, surrounding the pupil -- are used in current biometric products.Corporations that lose large amounts of money to fraud are very interested in these technologies. For instance, Visa would love to be able to bust the person who claims their card was stolen just before a $2000 charge at Saks showed up; biometrically confirmed charges are better than any paper trail.Police and parole officers are also expressing great interest. The promotional web site for a product called "VoiceTrack" boasts that it can "track individuals on a virtually unlimited basis anywhere in the U.S., Canada or the US Territories."A parolee "enrolls" simply by speaking to the VoiceTrack computer via telephone. The computer creates a unique voiceprint for the person and stores it in a database. Then, at scheduled (or random) times during the day, a special pager worn by "the offender" (as he is referred to in the VoiceTrack press material) is dialed by the computer. When the parolee calls the computer back, he simply speaks into the handset; the computer records the time of the call, the location it was placed from (thanks to Caller ID), and the results of the voice test. If the computer suspects that the caller is not who it is supposed to be, the parole officer receives notice via beeper three minutes later.Banks, airports, and other workplaces with security concerns are already using biometric identification to restrict access to work areas and monitor employees' comings and goings.Biometric identification is carried out by computers, and therefore we have a naive tendency to regard it as infallible. Yet it is no more so than other complex systems, from Intel's flawed Pentium chips to computers that will bomb when the clock strikes 2000.Randall Fowler, who works for a company called Identix that makes fingerprint scanning equipment, recently told Hotwired host John McChesney in a live interview that his system's mathematical characterization of the human fingerprint "identifies irrefutably who that person is." Yet in the same interview he claims a "false rejection" rate of one percent. It's a small number, but no solace if you're the one person in 100 who gets shut out of work or the ATM booth or the subway or your own apartment building.In addition, because many biometric techniques are passive and can be carried out without the consent or even the knowledge of the subject, establishing ethical principles for their use is important.Until that debate happens, I'm keeping my fingers to myself.***Sites in my Sights In the near term, it's likely that biometric identification will be combined with hand-held technologies like "smart-cards." You might be surprised how many companies have jumped on this bandwagon (www.smart-card.com/page10.html). Don't Just Sit There, Sit There and Do SomethingThough the crime of "identity theft" may sound far-out, it's a nightmare if it happens to you. To find out what you can do if somebody impersonates you for their own gain, visit the Privacy Rights Clearinghouse (www.privacyrights.org/identity.html)How can you prove you're you? Send a letter in care of this publication, drop a line via e-mail (email@example.com), or visit the Cyberia website (www.well.com/user/pb/cyb).