Feeds

Report fingers prints as ID scheme's point of failure

Over 75? Show us your retinas instead

Intelligent flash storage arrays

Yet more trouble assails the government’s £4.4bn National Identity Scheme (NIS), as an official report puts the boot into the preferred scheme for “exception handling” – and a bunch of techies show how the recommended system can be beaten.

Official trouble comes in the form of the latest annual report (pdf) from the Biometrics Assurance Group (BAG), published very quietly toward the end of June. It is not hard to see why.

The report expresses particular concern over plans for exception handling of fingerprints: “it would be a large part of the NIS (for example, more than 4 million people are over the age of 75 in the UK, a group for which it is hard to obtain good quality fingerprints).”

It continues: “Exception handling has a large impact not only on the technical elements of the Scheme but on business processes, schedules and costs.” BAG’s solution was to urge the Identity and Passport Service (IPS) to adopt iris scans as a 'fallback' to be used when there are problems taking or matching a fingerprint.

In response, the IPS have said that they are looking for suppliers to provide “cost and performance options, with a minimum level of acceptable performance”, because “if the performance can be met without enrolling iris, the programme would cost less and be delivered more easily”.

In other words: budget constraints are already leading the guardians of the NIS to grasp at the cheaper option and hope for the best.

Despite concerns expressed over the proliferation of different fingerprint readers, the IPS has no plans for a coordinated strategy. Its preference “is to impose minimum standards on suppliers rather than mandating hardware”.

This is where the current project may collide with work done by a group of techies over at IEEE. To understand the problem they pose, it is necessary to rewind slightly.

Over the last few years, schools have started to use automated fingerprint identification systems (AFIS) for registration, library book borrowing and cashless catering. The Information Commissioner warns (pdf) that while this does not necessarily breach the Data Protection Act, “those implementing such systems need to be very careful”, because where “interoperable biometric systems were in common use for identification purposes, the consequences of the loss of one’s fingerprint template could be severe”.

That is (in plain English), if the data is readily transferable out of the school system and real fingerprint information could be extracted, there would be a problem.

However, we have nothing to fear because, as Jim Knight, the Minister for Schools and Learners made clear in a Commons Debate in July 2007, these systems “hold an algorithmic representation of a fingerprint — not the recording of a fingerprint”.

He went on: “It is not possible to recreate a fingerprint using the numbers that are stored”.

Whoops! Here come the techies. In a paper published in the April 2007 issue of the IEEE Transactions On Pattern Analysis And Machine Intelligence, they demonstrate how three key levels of information about the parent fingerprint can be elicited from the “minutiae template” that is created by many scanners. If other information, such as the location of singular points is available, then it is possible that the original fingerprint can be reconstructed in its entirety.

“Minutiae” are fingerprint details matched to co-ordinates – and it is these co-ordinates that are used by a number of school systems to create Jim Knight’s impenetrable algorithm.

So the sort of data that could be used to recreate fingerprints is captured by school systems, albeit in encrypted form, although it is not clear whether sufficient details are captured to reconstruct a whole fingerprint.

If this does turn out to be the case, then it would appear that while one part of government is busy basing the new NIS on a one-strike method of validating id, another bit is equally busy making that method less secure through its desire to see library books returned on time.

Joined up government? Probably not. ®

Internet Security Threat Report 2014

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.