Biometrics in Airports

asv108 writes: "Extremetech has an article by renowned security expert Bruce Schneier about why face recognition in public places such as airports is not a good idea." Schneier is being generous - real world results show that facial recognition systems are a lot less than 99.99% accurate even under laboratory conditions (people posing for the camera under ideal lighting).

Comments

Enemy of the State?

[govtcheez]

C'mon, Enemy of the State showed us that not only should they be advanced enough to give a definite ID, the single camera should be able to pan around the person, zoom in, and even show you the label on their T-shirt...

Re:Enemy of the State?

[Wyatt Earp]

According to the FAS website, the KH-12 "IMPROVED CRYSTAL", which is the best the US has in orbit, can..."readily identify and distinguish differing types of vehicles and equipment with resolutions better than 10 centimeters."

So unless you are playing with big cards, I doubt the Man can read your hand.

The optical sensors like KH-11/KH-12 can't see through clouds, so they also have the Lacrosse series, which use Synthetic Aperture Radar (SAR) to image thier targets.

http://www.fas.org/spp/military/program/imint/la cr osse.htm
http://www.fas.org/spp/military/program/imint/kh -1 2.htm

Re:Enemy of the State?

[Panaflex]

The KH-11/KH-12 are basically hubble telescopes pointed at the earth.

As a student in HS, my teacher was involved in the spec'ing of the hubble telescope. We're talking about using mid/late-eighties technology up there. The CCD was equivalent to what you can purchase at Best Buy today on a decent digital camera.

The optics were pretty good, and chances are that the military bought the good optics instead of the lowest contract price (I seem to remember 2-3 companies that each produced optics).

Anyhow, needless to say, all the "hubble-like" telescopes received upgrades these past few 2-3 years. There's a good chance that the resolutions have gone from the 4/8 megapixel (best of the 80s) to the 268+ megapixels. (The optics will probably never get much better).

Pan

Biometrics are coming....

[baptiste]

Even if face recognition doesn't 'fly' you can bet we'll see more and more of this stuff at airports and elsewhere.

For example - would you agree to putting your thumb on a fingerprint scanner at teh jetway entrance before you got on the plane? Retinal scan? The idea of the airlines having fingerprints for every passenger is pretty scary - but banks and many stores fingerprint when you use/cash checks. What level of this type of stuff will we accept? At what cost?

But then - the best biometric system in the world wouldn't have stopped the WTC attack - the hijackers were passengers with tickets and many used their real names anyway so.... I fear we'll find many liberties and the like given up in the name of security that really won't help that much.

Re:Biometrics are coming....

[alen]

The photos of the hijackers were on file. And they were very good ones too, not those taken from 1000 yards away. If we had put a face recognition system whereby everyone who boards a plane is scanned and compared to terrorist photos on file we may very well have prevented it. Ditto for scanning faces during entry into the US.

Remember you don't own the airplane. The airline have every right to know who's boarding their $100 million toys.

Re:Biometrics are coming....

[wiredog]

Most banks require a fingerprint on a check that is being cashed if you don't have an account with them. If the check turns out to be forged, the bank gives it to the police, who now have the fingerprint of the forger.

Re:Biometrics are coming....

[wurp]

Anthrax isn't deliverable by water. Your worst fear should be clouds of anthrax delivered via air, since anthrax:
*lasts 30-40 years in the open
*is easy to produce
*is infectious in miniscule amounts
*when inhaled is nearly 100% fatal once symptoms occur, regardless of treatment
*the US government isn't letting anyone but the military be vaccinated!

Vaccination appears to provide a 95%+ immunity to airborn anthrax (evidence is sketchy for humans, since we don't experiment with infecting the vaccinated ;) If we don't have enough vaccine for everyone, why the hell not? Anthrax has been well known to be a major bio warfare hazard for years, and the vaccine has likewise been known for years. Livestock handlers and livestock have been getting vaccinated for anthrax for ages.

Re:Biometrics are coming....

[nathanm]

*the US government isn't letting anyone but the military be vaccinated!

That is completely not true. The anthrax vaccine has been FDA approved and available since 1978. It was only commonly given to veterinarians or animal workers until the military started giving them. Right now there is just a shortage of the vaccine, since the cultures can take years to grow.

Re:Biometrics are coming....

[wurp]

Add some factual information, indeed.

Per your link to the CDC:
"Inhalation: Initial symptoms may resemble a common cold. After several days, the symptoms may progress to severe breathing problems and shock. Inhalation anthrax is usually fatal."

Yes, anthrax is treatable. They can give you an IV of 2 million units of penicillin every two hours and you will die anyway, the vast majority of the time. Note that I didn't say all anthrax is fatal, just inhalational. I am unsure about gastrointestinal or cutaneous infection, but it is my understanding that it can be treated with good success.

Per the Defence Journal
"Within twenty-four to thirty-six hours, the victim experiences the rapid onset of shock and subsequent death. Inhalation anthrax has a mortality of 95-100% despite antibiotic treatment."

Per the Biological Weapons FAQ
"Some authors maintain that anthrax is an even more deadly agent. According to one study, in principle, if its spores were distributed appropriately, a single gram would be sufficient to kill more than one-third of the population of the US. Of course, the authors were quick to point out that an attack of such magnitude would not be feasible. However, more realistic, smaller-scale scenarios still posit large numbers of casualties. For example, the US Law Enforcement Assistance Administration reported in March 1977 that a single ounce of anthrax introduced into the air-conditioning system of a domed stadium could infect 70-80,000 spectators within an hour). And a 1972 study by the Advanced Concepts Research Corporation of Santa Barbara, California, postulated that an aerosol attack with anthrax spores on the New York City area would result in more than 600,000 deaths."

I agree wholeheartedly that getting hysterical is not going to solve anything. However, it is just as naive to discount real, viable threats as it is to fret about weak or unlikely threats. Certainly it is true that anthrax is not going to cause a plague; it doesn't really spread very well. But it just as certainly is true that anthrax is a very potent, low-tech weapon for the psychotically discontent when spores are directly blown into the air.

Certainly it is not safe to produce biological weapons. I think that goes without saying.

Thanks for the link to Bioport, btw! I hadn't found that. And thanks also for the note about Aum Shinrikyo. I hadn't known of any publicized anthrax attacks in modern times. The sources I've looked at so far casually mention that he tried one attack. If it is in fact true that there is some factor that I haven't seen yet that invalidates anthrax as such an easy and potent weapon, I would love to know about it so I can find something else to worry about : )

More links on anthrax:
http://www.metrokc.gov/health/phnr/prot_res/anth ra x.htm

It just don't work!

[CaptainAlbert]

See:

http://www.theregister.co.uk/content/4/21916.htm l

But imagine the fun you could have

[Evil Al]

Top 5 ways to have fun with an airport face scanner

5: Wear a Nixon mask and watch the security guys do a double-take looking at their computer readout
4: Attach a /bin/laden mask to the back of someone's back and watch the fireworks
3: Sell time on the system to Oil of Olay to spot oily, reflective skin
2: Adapt it to seek out hot chicks
1: Link it to Am I Hot Or Not!

Besides which

[DrXym]

Any terrorist prepared to commit suicide is going to think nothing of having reconstructive surgery if that's what it takes to foil such a system.

nonsensical

[gargle]

If the system were 99.99% accurate and it indicated a match, wouldn't you want to pull the person out for closer inspection? (this is not to say that you treat him like a terrorist)

After all, airports already arbitrarily subject people to random inspection of their luggage.

Why are "false positives" bad?

[alkali]

While I'm generally a Schneier fan, I am more than a little mystified by this article. Schneier's argument is that face recognition systems in airports are bad because they will almost certainly give large numbers of "false positive" results -- i.e., some non-terrorists will be identified as terrorists. But why are false positives so bad?

I imagine that airport patrons identified as "terrorists" by the face recognition system would be detained by security, have their ID rigorously checked and have their luggage rigorously inspected. (With high levels of accuracy, this would amount to a few people per airport per day.) I do not imagine that they would be shot on sight. Inconveniencing (and embarrassing) a few patrons at each airport every day is certainly not a good thing, but it is hardly self-evident that it would be intolerable.

I am not a big fan of universal use of face recognition technology for the reasons outlined in Phil Agre's excellent essay on that subject (linked at the bottom of the Schneier piece as well). But we all understand that some compromises have to be made to make air travel secure. If this is the best argument against using face recognition at airports, it's not a good one.

Re:Why are "false positives" bad?

[djmurdoch]

The fact that only a few people will be inconvenienced isn't the real problem. The problem is that the users of the system will mistrust it.

If only one in 10000 positives is really a terrorist, then most airport security personnel will never see one. They'll stop and inspect a few people each day, and in every case, they will be false positives. That will lead to a tremendous mistrust of the system.

Imagine if you were running airport security, and every day the computer told you that you should detain someone because they looked like a terrorist, and in every case it turned out to be false. You'd feel like a fool.

It would be just like having false fire alarms a couple of times a day, every day. You wouldn't evacuate every time, would you?
In the same way, the airport security people would stop responding as diligently after months of false alarms. Then the system wouldn't work.

A system that people don't trust isn't worth having. It's just a waste of time and money.

Surviellence methods need to have oversight

[Masem]

To me, I don't have a big problem with survellience at places like airports or other places where you have already given up your anonymousity in order to use the service (banks, etc). I'd rather see them stop and check more people, maybe only catching 1 in 10000 that are wanted for something, than stopping only those that fit exactly, catching 1 in 10, and missing a few that might slip through.

The important thing is that the surviellence information must be handled in the right way; it's way too easy nowadays for companies in the name of profits to pool customer databases together and generate a large profile on you without you knowing. If surviellence is being used for government purposes, then only the government should have access to it; furthermore, if you are detained only because the computer indicated a match but you are otherwise innocent, there should be no record about this made in the computer beyond doing a $missed++ increment on the global database.

Thus, any sort of increased surviellence absolutely needs some sort of public oversight to make sure the information is not abused or that information that should not be stored isn't. Frequent inspections of the use of biometrics, unrestricted access to the computer files and data collected, all done by private citizens with NDAs, is necessary before these systems should be in place.

More info and Links

[Alien54]

The Register has a pretty good story on how Face Recognition is essentially useless, especially in uncontrolled environments.

There is also this vendor nuetral test

Bottom line is that this is merely a marketing opportunity for someone to get capital for products that are NOT ready for prime time.

This has actually been examined by the US Department of Defense (DoD) Defense Advanced Research Projects Agency (DARPA), which sponsored the Facial Recognition Vendor Test (FRVT) 2000, the test linked to above

Under live conditions in an uncontrolled enviroment, the best false detection rate (FDR) was 33 per cent, with a false acceptance rate (FAR) of ten per cent. This means that to detect 90 per cent of terrorists we'd need to raise an alarm for one in every three people passing through the airport.

I would say it is somewhat unacceptable.

Wrong tool for the job?

[First Person]

Biometrics are much easier to implement when the person's alledged identity is known. If the person claims to be X, the system need only compute B(X) and compare that to a precomputed data base entry B'(X). These values will almost never be identical due to noisy real world systems (different lighting, microphone noise, dirt on the fingerprint/retina scanner, etc.). Instead a statistical comparison must be made. If B(X) is statistically similar to B'(X), admit entry, otherwise call the firing squad.

In the article, Bruce assumes his readers understand this. His explanation of why face recognition systems cannot find the rare targets in large populations is quite good. The same logic applies to voice matching for projects like Eschelon.

And, of course, this wouldn't prevent individuals from using their own valid IDs to access public areas. The assumption of most security systems is that the intruder wants to commit a crime and get out while minimizing the probability of detection. A suicidal terrorist does not have this goal. He/she seeks to enter an area, commit a crime, and then die in the attempt. The tools developed for normal security may not be appropriate for suicidal terrorists or individuals on shooting sprees.

Why don't we start with the simple stuff?

[John Harrison]

This rush to biometrics seems like a 21st century solution to a problem that could be solved with 20th century technology.

Wouldn't it make more sense and be much easier to simply link the FBI "watch list" to the airlines computers? Many of the hijackers were on this list. It seems incredible to me that a person on the list could buy a one-way ticket with cash without the system bringing up all sorts of warnings. Some of the hijackers (not all) fall into this category.

The following things should cause there to be extra scrutiny (especially if you do/are more than one of them):

• You are on the FBI watch list.
• You pay cash for your ticket.
• You buy a one-way ticket.

It seems that doing a lookup on a name in a database is much quicker/easier/less expensive than installing facial recognition systems all over the place. Why not implement a simple solution that would have caught these guys first instead of a complex on that might not work?

If you feel that we must use high-tech solutions, maybe a smart card put into passports and driver's licenses would make more sense and be more accurate. Once simple solutions are implemented then we can worry about the crazy complex ones.

Re:So what would you do?

[Absynthe]

I understand your frustration with people who aren't open to ideas without having any to replace them. However, I'm going to do just that. The converse of that idea is that we just do anything regardless of whether it helps or not.
I'm terrified by the reaction of this country far more than terrorists. I'm wondering what "terrorist" means. The wierd totalitarian things that have happened here have fueled my paranoia. The White House issuing a statement telling people they have to "watch what they say" has me wondering if "terrorist" might mean anyone who dares dissent.
I'd rather let things cool down for awhile. The way terrorist cells operate is that after an action everybody flees and goes back into cover. We have awhile to think about this. I think it would be a very good thing to let these decisions come at a more cool headed time.

Might have flagged terrorists!

[edremy]

But then - the best biometric system in the world wouldn't have stopped the WTC attack - the hijackers were passengers with tickets and many used their real names anyway so

You do know that the FBI was busy looking for several of the terrorists even as the planes hit the WTC, right? They got into the country and disappeared- a face check at the gate might have flagged them and possibly prevented the attacks. The terrorists would have at least been delayed enough to stop some of the attacks.

You're right: biometrics is coming. This could be a very good thing if we drive the technology to good use. Fingerprint check when I use a credit card: why not? I'd love it if the store *knew* I was the owner of that card- I've had my number stolen before. Ever spoken with someone who's had their identity stolen? It's a multi-year nightmare of wrecked credit, endless phone calls and general heartburn.

Realize that we have almost no privacy anyway. Various large companies know a *lot* about me. They know personal details down to my last dollar, my taste for mint chip ice cream and the fact my wife and I are infertile. The government has run at least 3 background checks on me that I know of, the most recent within the last month. (I got my pilot's license recently: the FBI has already visited the airports I used to pull my records.)

Biometrics won't change that-what we need to do is make sure the transparancy goes both ways.

Eric

Arab names? Don't think so.

[cryptochrome]

Putting aside the fact that there are numerous terrorists who aren't Arab (which may be appropriate in this select case), is it really that easy to pick out an Arab versus some other ethnic group if they dress and groom themselves in a westernized manner? I doubt it. There's such a huge variety of ethnicities in America that it can be nearly impossible to say with certainty where someone is from just by looking at them, even if you're trained to do so. If Mr. Atta were going by the name of Mr. Mancini or Peres or Rodriguez, I bet hardly anyone would have thought of him as Arab.

Missed point....

[Kanabiis Atiiva]

I think alot of people are missing the point here. This system is supposed to 'stop terrorists by identifying potential terrorists'. The only way to catch a potential terrorist is if that individual has been caught or spotted and had his/her picture taken to compare. Of the 19 suspected terrorist that commited the Sept. 11 attacks only TWO of them had any kind of profile the rest were unknowns. So, someone please explain to me how exactly biometrics would have helped us here. Sure 2 of the terrorists would have potentialy been stoped, but the other 17 terrorists would have boarded the plane without much of a problem. Im sure biometrics might stop things for a small amount of time, but the terrorists will adapt quickly and all we are left with is a billion dollar step twords big brother is watching. There are sleeper agents all over the world, guys who have never been seen talking to a known terrorist, have been living in thier respective country for 5-10-15 years, have wives, kids, successfull careers, just waiting for thier 'phone call'. How exactly is a biometrics system going to solve that problem?

Baysian math

[wowbagger]

I've seen several comments that "If the system gives a false positive only 1 in 1000 times, then it must be pretty good!". This demonstrates that many people have no clue about how to properly apply probability - what is called Baysian math.

You have to start out with two probabilities that are based on the system: probability of a false positive (Pp) and probability of a false negative (Pn).

A false positive is mis-identifying a non-terrorist as a terrorist. Let us say that a collection of 1 million non-terrorists are run through a system, and it fingers one of them as a terrorist. That system has a Pp of 1 in a million, or 1E-6.

A false negative is mis-identifying a terrorist as not being a terrorist. Let us say that we run a thousand known terrorists through the system, and let us say that only one is not detected. Then this system has a Pf of 1 in a thousand, or 1E-3.

Now, that is ALL that you can say about a system. You cannot state the actual number of false positives vs. the number of false negatives in real use without an additional piece of data, the probability of any given person in a crowd being a terrorist, Pt. Let us say that in any given crowd, one in ten thousand people are terrorists (Pt = 1E-4). This may seem very high, but the lower Pt, the worse the system will perform, and I am heavily weighting this in favor of the face scanner.

Now, let's run a million random people through the system, and see what happens.

First, out of that million people, 1E6 * Pt = 1E6 * 1E-4 = 1E2 = 100 of them are terrorists. We would expect that of that 100 terrorists, 100 * Pf = 100 * 1E-3 = .1 terrorist will be mis-identified. So we will assume that all 100 of the terrorists trip the alarm.

Now, out of the remaining 999,900 people, we would expect the system to finger 999,900 * Pn = 99,900 * 1E-6 = .9999, so we will assume that one innocent person gets fingered as a terrorist.

Now, we had 101 trips, of which 1 was false, so the odds that you aren't a terrorist given that you were fingered are just under a percent. That's given the assumption that the system mis-identifies innocent people only one in a million times, and assuming that one person in ten thousand is a terrorist. Increase the false positive rate by a factor of ten (one in one hundred thousand innocents gets fingered), and decrease the terrorist population to a tenth of what we assumed (one terrorist in one hundred thousand) and you now have roughly fifty-fifty odds that a person fingered by the system is innocent.

And that, people, is why systems like this don't work.

Re:Baysian math

[remande]

Now, we had 101 trips, of which 1 was false, so the odds that you aren't a terrorist given that you were fingered are just under a percent. That's given the assumption that the system mis-identifies innocent people only one in a million times, and assuming that one person in ten thousand is a terrorist. Increase the false positive rate by a factor of ten (one in one hundred thousand innocents gets fingered), and decrease the terrorist population to a tenth of what we assumed (one terrorist in one hundred thousand) and you now have roughly fifty-fifty odds that a person fingered by the system is innocent.

And that, people, is why systems like this don't work.

By that logic, metal detectors are a lousy system. Anecdotally, at least 50% of the passengers trip off the metal detector. Note that it's not there to detect metal, but weapons. If 1 in 1000 people are carrying weapons, then the metal detectors are giving 500 false positives per 1000 people.

That, is of course, why the metal detector isn't a system. It is a part of the system; security officers and protocols are the remainder of the system. As such, tripping off the metal detector isn't a huge deal, but it does require further securing you (emptying pockets, etc.) until you no longer trip it.

Similarly, facial recognition software is a bad system when used alone. When used in conjunction with a security officer, it can be damned effective. I suggest in another post that the software's response to finding a match is showing the security officers the snapshot it matched to. Let the officer quickly check the real person against a mug shot, and most false positives won't even be noticed by the passenger falsely matched. Those who are incorrectly detained are detained because an officer thinks you look like a particular mug shot, regardless of what the machine says. As a society, we regard that as an acceptable risk, otherwise we wouldn't post faces in post offices.

It's not the technology, it's the way that you use it.

Would it have mattered if it flagged the terrorist

[Shivetya]

Remember, they flew the routes beforehand. They had studied the routes and passenger loads, picking the flights that would have the fewest passengers thereby minimizing their risk of failure?

So, the question becomes, if your on a Government list are you allowed to use mass transportation? Would we stop at terrorist? What about know protesters for major events? Say if some G7/G8 meeting or IMF meeting is going on, do we monitor or prevent know organizers of the protests that follow? What if they had violent behaviour before?

Really, the only security that I wouldn't mind in an airport is similar to that portrayed in the Total Recall, where everyone walks past a screen which highlights solid objects. Its totally fair and cannot be considered intrusive for it doesn't violate you.

It's not whether it works, it's who it works on

[Rogerborg]

• the best biometric system in the world wouldn't have stopped the WTC attack - the hijackers were passengers with tickets and many used their real names anyway so

Which leads to a good point. How "suspect" do I have to be before you restrict my ability to move around and basically live a normal life?

If you stick to putting only known foreign terrorists in the database, fair enough. If you put known escaped US felons and bail jumpers in as well, again fair enough.

But the September the 11th terrorists were only suspects; we knew they were here, but they were here legally and openly, so we had nothing to charge them with. These are the people we want to stop, so we have to put them in and, what? Stop them flying? Search and question them? OK, lives are at stake, let's do that. it sucks, but it's necessary.

So, what's the criteria for putting a US citizen in? You don't have enough evidence to charge me. Am I an acknowledged activist, spouting anti-American slogans and calling for the end of US involvement in the Holy Land (pesky old 1st Amendment)? Or do I just have an uncle in Afghanistan who likes to send me encrypted mail? What are the criteria?

Do you stop me flying altogether, or do you just search me every time? If I'm not trusted on a plane, am I trusted with a gun? With access to explosives, or the materials to make them? Do you stop me using encryption? Or do you just watch me closely? Do I even know that I'm in the database at effectively wearing a big "suspicious" label because of my ethnicity, religion, family or political leanings?

I'm not against this technology (assuming we can get it to work), but I am very concerned that there be a clear, open procedure for who goes in the database. Specifically, I want to know:

• Who can put people in the database?
• Who can take people out of the database?
• Am I in the database?
• How did I get in?
• How do I get out?
• How do I prove my innocence and ensure that I don't get put back in this or similar databases again?

if only we had face recognition 5 years ago...

[abe ferlman]

maybe we would have caught this guy sooner, assuming we didn't accidentally lock up weird al yankovic first.

bryguy

only works as a "good guy" system

[beanerspace]

I was king code-monkey on the original implemenation of INSPASS. A system designed to expedite one's wait as they enter the U.S. from a "friendly" country. It was designed to reduce the lines so that INS inspectors had more time to focus on bad guys and people from "unfriendly" countries.

It was essentially a "good guy" system. Meaning, I'd swipe my card, which claimed I was "Joe Smoe". I then put my hand in the box and had it's geometry scanned. If it passed, it would "confirm" my identity and send me along to the Customs line. If it threw a false result, I was compelled to stand in the long line with everyone else.

Using biometrics to determine "bad guys" is a horse of a much different color ... and a far girthier size. Imagine, I walk into an airport. I scans my face, or fingerprint. From there the image is sliced and diced into various quadrants. Even with a beowolf, there are thousands of minutea points I share with the rest of the worlds population.

So up comes a list of "close matches". Then human intervention comes along and finishes the job. This is a poor-man's quick and dirty explanation of our current "bad-guy" systems work to match figerprints. Like I said, a far girthier and much colored horse.

If biometrics were to be implemented as an airport, I would see it as again, a "good guy" system to expedite the long lines currently at the airport ... where it's easy for a bad guy to take advantage of the overworked employees with managers demaning they keep the line moving.

I would think it better to be a system provided by the airlines. Heck, credit cards are already putting my face and other info on smartcards, why not a frequent flyer plan along with it ... that can also be used to confirm my baggage on the flip side.

We'll see.