THE EYES HAVE IT
Concerned about security, companies may soon rely on a wide range of biometrics. Turns out you're even more unique than you thought you were.
By Russ Banham

Indeed, devices already exist that identify individuals by fingerprints, faces, voices and, yes, even irises. Biometrics can ID people by more unusual human characteristics as well - things like ear patterns, walking gaits and even body odors. And make no mistake, in this post-9/11 era of heightened corporate security, Big Brother is big business. According to the US-based International Biometric Industry Association, the biometrics market will jump from US$165 million a year in 2000 to US$2.5 billion by the end of the decade. Even discounting the usual industry association fluff-factor, it's clear that biometrics will play an increasingly important role not only in public security but in the corporate realm as well.

Fingerprint identification remains the mainstay of the biometrics industry, representing well over half of the total commercial biometrics market. But since no biometric technology is foolproof, security experts recommend combining several technologies to pinpoint potential threats.

According to industry watchers, this need for triangulation is fueling interest in less conventional biometric technologies. The fact that these experts even use the phrase "less conventional biometric technology" speaks volumes about the fact that biometrics has come on fast enough for there to be "conventional" approaches. What follows is a guide to both mainstream and emerging forms of biometric identification.

Fingerprints

It's mature, reliable and cost-effective, as old as John Dillinger and as dead-on as DNA. How it works: Every person's fingerprint has a unique, unchanging ridge pattern. Like snowflakes, no two patterns are alike. By photographing fingerprints and other parts of the hand with a specialized digital camera (ink pads will soon be as obsolete as buggy whips), these images can be stored in a database to facilitate automated comparisons.

The US government is the primary buyer of fingerprint biometrics. To enter a secure location or even to log onto a secure web site, a government employee must press a thumb against a fingerprint reader or sensor. Typically, the user also is required to carry a smart card - all the better to confirm a worker's identity.

On tap: Fingerprint technology will likely play a big part in electronic commerce. Soon, experts say, computer keyboards, cell phones and personal digital assistants will come equipped with fingerprint scanners and sensors.

Moreover, since no two ridge patterns are the same, some experts believe fingerprint scans will someday replace credit cards. A fingerprint would serve not only to identify a customer, but would automatically link to a bank account or credit-card number. Such an application has tremendous potential for retail gas station chains, as well as service providers like restaurants and hotels.
Meanwhile, three school districts in Pennsylvania are experimenting with a biometric system enabling students to buy lunches at school cafeterias using fingerprints. If nothing else it may finally get kids to wash their hands before meals.

Facial Recognition

Like fingerprints, no two faces are alike, even with the growing popularity of Botox.

But facial recognition biometrics fall short when compared to fingerprints - mismatches are common despite recent technological advances. Still, this particular biometric technology can prove a useful barometer of who a person might be, which can then be verified via other biometrics.

How it works: A person's face is photographed, scanned and assessed by software that measures dozens of features - the distance from the bottom of the nose to the top of the upper lip, the angle of the head, the overall facial shape, and so on. These measurements are then encoded, digitalized and stored in a database for comparison purposes. A single face can be compared against millions of other faces in seconds.

At the most recent US football championship Super Bowl game, for instance, many unsuspecting fans were furious when they learned their faces had been scanned and compared to crude mugshots of known criminals. In the wake of 9/11, the US National Football League defended this as a necessary security measure. In fact, with terrorism still a real threat in the US the National Park Service operates a face recognition surveillance system that snaps pictures of visitors who board ferries to the Statue of Liberty.

As of now, Las Vegas casinos are major commercial buyers of face recognition technology - unobtrusive video cameras routinely keep an electronic eye out for high rollers and card-counting cheats. Several police departments also use facial biometrics to scan for suspected criminals in high-crime areas.

On tap: Face-scanning software at ATMs that will eventually replace personal identification numbers.

Iris Scanning

So you thought fingerprints were the most unique facet of the human body? Guess again. No current biometric technique is more accurate than iris scanning.
How it works: Complex patterns in the iris (the colored portion of the eye) make ridges on fingerprints look like stick-figure drawings. The statistical false-rejection rate for iris recognition systems is 0 percent, compared with 3 percent in fingerprint recognition systems.To date, few corporations have bought into iris recognition technology. The reason? Cost. Iris scanning systems are almost twice as expensive as comparable fingerprint systems. Moreover, they're a bit intrusive, requiring high compliance from users who must stare into a camera lens for several seconds to win recognition.
As for unobtrusive surveillance: current iris scanning devices do not possess anywhere near the level of sophistication seen in the movie "Minority Report". The US government has conducted experiments with iris-recognition systems in extremely secure environments, where the tradeoff of accuracy is worth the intrusiveness.
On tap: Iris scanning holds tremendous commercial potential. The first major commercial venture is already under way: Two UK airlines, Virgin Atlantic and British Airways, recently announced a joint five-month trial of a "self-service" iris recognition system at Heathrow Airport. Frequent international passengers can volunteer to have their irises scanned and entered into a database. Once the customers show up at customs, they simply look into a biometric reader that verifies their identities to UK immigration officials.

Voice Recognition

Unless you're a professional mimic, the chance your voice will be mistaken for somebody else's is highly unlikely. That's because everyone speaks in different rhythms, cadences, pitches, frequencies and volumes. Voice recognition is based on that premise.

How it works: Speaker-verification biometrics record and store voice streams for comparison purposes. The technology has not yet evolved beyond pure security applications (allowing access to secure areas, for example). But it has potential in other areas as well, particularly for direct-to-consumer businesses.

On tap: Say someone has stolen a credit card or appropriated a card number off the Internet. That person then calls clothing company J Crew to order a year's supply of khakis and polo shirts. If J Crew has the victim's speech patterns stored in a database, it can easily verify that the customer is not who they claim to be. .

Gait Recognition

On some level we all walk the walk - the walk that is uniquely ours.

How it works: Each of us can be measured by the "spatial motion" we create as we walk. Think in terms of flow image, i.e. the changing measurements between body parts as you move through each phase of your stride. Even runway models have different gaits.

On tap: Biometric scientists are only beginning to discern the unique differences in the ways we walk, but the uses are obvious. A suspected hijacker enters an airport and is picked up by a facial recognition system. But since these systems are not foolproof, and other biometric technologies are impossible to deploy without detection, the person's gait is captured on camera and compared to others.

If two biometric technologies say someone is someone, then the odds of a mistake are slim. Indeed, scientists say cross-referencing two techniques brings the likelihood of an accurate assessment to 99.999 percent.

Ear Pattern Recognition

Auricle images are the newest frontier in recognition systems.

How it works: Each person has an outer ear pattern that is every bit as unique as Fidel Ramos, the former Philippine president. Scanning and measuring the geometry of the outer ear is akin to the process used in iris recognition, but has more creative utility. Using the J Crew example above, instead of authenticating a caller through voice recognition, a reader device on the phone receiver would unobtrusively capture ear shape and pattern to discern identity.

On tap: No commercial development yet, but potential security applications abound. Biggest hurdle: ear-muffs.

Smell Recognition

Pheromones aside, people give off different odors (insert your own joke here) that evidently are unique.

How it works: While the idea of authenticating someone's identity based on personal odor seems far-fetched and potentially unsavory, scientists at Caltech think otherwise. They're at work developing chemically sensitive conducting polymer films that will capture a person's ... emanations. Our "gaseous vapors", these scientists say, could be absorbed by an "electronic nose" device to yield an ID.

On tap: Thankfully, commercial applications are years away.

Russ Banham is a contributing editor at CFO in Boston.