Feeds

Report fingers prints as ID scheme's point of failure

Over 75? Show us your retinas instead

Combat fraud and increase customer satisfaction

Yet more trouble assails the government’s £4.4bn National Identity Scheme (NIS), as an official report puts the boot into the preferred scheme for “exception handling” – and a bunch of techies show how the recommended system can be beaten.

Official trouble comes in the form of the latest annual report (pdf) from the Biometrics Assurance Group (BAG), published very quietly toward the end of June. It is not hard to see why.

The report expresses particular concern over plans for exception handling of fingerprints: “it would be a large part of the NIS (for example, more than 4 million people are over the age of 75 in the UK, a group for which it is hard to obtain good quality fingerprints).”

It continues: “Exception handling has a large impact not only on the technical elements of the Scheme but on business processes, schedules and costs.” BAG’s solution was to urge the Identity and Passport Service (IPS) to adopt iris scans as a 'fallback' to be used when there are problems taking or matching a fingerprint.

In response, the IPS have said that they are looking for suppliers to provide “cost and performance options, with a minimum level of acceptable performance”, because “if the performance can be met without enrolling iris, the programme would cost less and be delivered more easily”.

In other words: budget constraints are already leading the guardians of the NIS to grasp at the cheaper option and hope for the best.

Despite concerns expressed over the proliferation of different fingerprint readers, the IPS has no plans for a coordinated strategy. Its preference “is to impose minimum standards on suppliers rather than mandating hardware”.

This is where the current project may collide with work done by a group of techies over at IEEE. To understand the problem they pose, it is necessary to rewind slightly.

Over the last few years, schools have started to use automated fingerprint identification systems (AFIS) for registration, library book borrowing and cashless catering. The Information Commissioner warns (pdf) that while this does not necessarily breach the Data Protection Act, “those implementing such systems need to be very careful”, because where “interoperable biometric systems were in common use for identification purposes, the consequences of the loss of one’s fingerprint template could be severe”.

That is (in plain English), if the data is readily transferable out of the school system and real fingerprint information could be extracted, there would be a problem.

However, we have nothing to fear because, as Jim Knight, the Minister for Schools and Learners made clear in a Commons Debate in July 2007, these systems “hold an algorithmic representation of a fingerprint — not the recording of a fingerprint”.

He went on: “It is not possible to recreate a fingerprint using the numbers that are stored”.

Whoops! Here come the techies. In a paper published in the April 2007 issue of the IEEE Transactions On Pattern Analysis And Machine Intelligence, they demonstrate how three key levels of information about the parent fingerprint can be elicited from the “minutiae template” that is created by many scanners. If other information, such as the location of singular points is available, then it is possible that the original fingerprint can be reconstructed in its entirety.

“Minutiae” are fingerprint details matched to co-ordinates – and it is these co-ordinates that are used by a number of school systems to create Jim Knight’s impenetrable algorithm.

So the sort of data that could be used to recreate fingerprints is captured by school systems, albeit in encrypted form, although it is not clear whether sufficient details are captured to reconstruct a whole fingerprint.

If this does turn out to be the case, then it would appear that while one part of government is busy basing the new NIS on a one-strike method of validating id, another bit is equally busy making that method less secure through its desire to see library books returned on time.

Joined up government? Probably not. ®

Top three mobile application threats

More from The Register

next story
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
APPLE FAILS to ditch class action suit over ebook PRICE-FIX fiasco
Do not pass go, do cough (up to) $840m in damages
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.