Feeds

Report fingers prints as ID scheme's point of failure

Over 75? Show us your retinas instead

New hybrid storage solutions

Yet more trouble assails the government’s £4.4bn National Identity Scheme (NIS), as an official report puts the boot into the preferred scheme for “exception handling” – and a bunch of techies show how the recommended system can be beaten.

Official trouble comes in the form of the latest annual report (pdf) from the Biometrics Assurance Group (BAG), published very quietly toward the end of June. It is not hard to see why.

The report expresses particular concern over plans for exception handling of fingerprints: “it would be a large part of the NIS (for example, more than 4 million people are over the age of 75 in the UK, a group for which it is hard to obtain good quality fingerprints).”

It continues: “Exception handling has a large impact not only on the technical elements of the Scheme but on business processes, schedules and costs.” BAG’s solution was to urge the Identity and Passport Service (IPS) to adopt iris scans as a 'fallback' to be used when there are problems taking or matching a fingerprint.

In response, the IPS have said that they are looking for suppliers to provide “cost and performance options, with a minimum level of acceptable performance”, because “if the performance can be met without enrolling iris, the programme would cost less and be delivered more easily”.

In other words: budget constraints are already leading the guardians of the NIS to grasp at the cheaper option and hope for the best.

Despite concerns expressed over the proliferation of different fingerprint readers, the IPS has no plans for a coordinated strategy. Its preference “is to impose minimum standards on suppliers rather than mandating hardware”.

This is where the current project may collide with work done by a group of techies over at IEEE. To understand the problem they pose, it is necessary to rewind slightly.

Over the last few years, schools have started to use automated fingerprint identification systems (AFIS) for registration, library book borrowing and cashless catering. The Information Commissioner warns (pdf) that while this does not necessarily breach the Data Protection Act, “those implementing such systems need to be very careful”, because where “interoperable biometric systems were in common use for identification purposes, the consequences of the loss of one’s fingerprint template could be severe”.

That is (in plain English), if the data is readily transferable out of the school system and real fingerprint information could be extracted, there would be a problem.

However, we have nothing to fear because, as Jim Knight, the Minister for Schools and Learners made clear in a Commons Debate in July 2007, these systems “hold an algorithmic representation of a fingerprint — not the recording of a fingerprint”.

He went on: “It is not possible to recreate a fingerprint using the numbers that are stored”.

Whoops! Here come the techies. In a paper published in the April 2007 issue of the IEEE Transactions On Pattern Analysis And Machine Intelligence, they demonstrate how three key levels of information about the parent fingerprint can be elicited from the “minutiae template” that is created by many scanners. If other information, such as the location of singular points is available, then it is possible that the original fingerprint can be reconstructed in its entirety.

“Minutiae” are fingerprint details matched to co-ordinates – and it is these co-ordinates that are used by a number of school systems to create Jim Knight’s impenetrable algorithm.

So the sort of data that could be used to recreate fingerprints is captured by school systems, albeit in encrypted form, although it is not clear whether sufficient details are captured to reconstruct a whole fingerprint.

If this does turn out to be the case, then it would appear that while one part of government is busy basing the new NIS on a one-strike method of validating id, another bit is equally busy making that method less secure through its desire to see library books returned on time.

Joined up government? Probably not. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Net neutrality protestors slam the brakes on their OWN websites
Sites link up to protest slow lanes by bogging down pages
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Uber alles-holes, claims lawsuit: Taxi biz sued by blind passengers
Sueball claims blind passengers ditched, guide dogs abused
Drag queens: Oh, don't be so bitchy, Facebook! Let us use our stage names
Handbags at dawn over free content ad network's ID policy
Italy's High Court orders HP to refund punter for putting Windows on PC
Top beaks slam bundled OS as 'commercial policy of forced distribution'
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
Heavy VPN users are probably pirates, says BBC
And ISPs should nab 'em on our behalf
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.