Feeds

Report fingers prints as ID scheme's point of failure

Over 75? Show us your retinas instead

Choosing a cloud hosting partner with confidence

Yet more trouble assails the government’s £4.4bn National Identity Scheme (NIS), as an official report puts the boot into the preferred scheme for “exception handling” – and a bunch of techies show how the recommended system can be beaten.

Official trouble comes in the form of the latest annual report (pdf) from the Biometrics Assurance Group (BAG), published very quietly toward the end of June. It is not hard to see why.

The report expresses particular concern over plans for exception handling of fingerprints: “it would be a large part of the NIS (for example, more than 4 million people are over the age of 75 in the UK, a group for which it is hard to obtain good quality fingerprints).”

It continues: “Exception handling has a large impact not only on the technical elements of the Scheme but on business processes, schedules and costs.” BAG’s solution was to urge the Identity and Passport Service (IPS) to adopt iris scans as a 'fallback' to be used when there are problems taking or matching a fingerprint.

In response, the IPS have said that they are looking for suppliers to provide “cost and performance options, with a minimum level of acceptable performance”, because “if the performance can be met without enrolling iris, the programme would cost less and be delivered more easily”.

In other words: budget constraints are already leading the guardians of the NIS to grasp at the cheaper option and hope for the best.

Despite concerns expressed over the proliferation of different fingerprint readers, the IPS has no plans for a coordinated strategy. Its preference “is to impose minimum standards on suppliers rather than mandating hardware”.

This is where the current project may collide with work done by a group of techies over at IEEE. To understand the problem they pose, it is necessary to rewind slightly.

Over the last few years, schools have started to use automated fingerprint identification systems (AFIS) for registration, library book borrowing and cashless catering. The Information Commissioner warns (pdf) that while this does not necessarily breach the Data Protection Act, “those implementing such systems need to be very careful”, because where “interoperable biometric systems were in common use for identification purposes, the consequences of the loss of one’s fingerprint template could be severe”.

That is (in plain English), if the data is readily transferable out of the school system and real fingerprint information could be extracted, there would be a problem.

However, we have nothing to fear because, as Jim Knight, the Minister for Schools and Learners made clear in a Commons Debate in July 2007, these systems “hold an algorithmic representation of a fingerprint — not the recording of a fingerprint”.

He went on: “It is not possible to recreate a fingerprint using the numbers that are stored”.

Whoops! Here come the techies. In a paper published in the April 2007 issue of the IEEE Transactions On Pattern Analysis And Machine Intelligence, they demonstrate how three key levels of information about the parent fingerprint can be elicited from the “minutiae template” that is created by many scanners. If other information, such as the location of singular points is available, then it is possible that the original fingerprint can be reconstructed in its entirety.

“Minutiae” are fingerprint details matched to co-ordinates – and it is these co-ordinates that are used by a number of school systems to create Jim Knight’s impenetrable algorithm.

So the sort of data that could be used to recreate fingerprints is captured by school systems, albeit in encrypted form, although it is not clear whether sufficient details are captured to reconstruct a whole fingerprint.

If this does turn out to be the case, then it would appear that while one part of government is busy basing the new NIS on a one-strike method of validating id, another bit is equally busy making that method less secure through its desire to see library books returned on time.

Joined up government? Probably not. ®

Intelligent flash storage arrays

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.