What's wrong with these pictures?

Scientists at the Defense Department's Biometrics Fusion Center test hand geometry readers, iris recognition systems and fingerprint scanners, among other authentication products. They've found a weakness in virtually all of them.

DOD center puts biometric devices and software to the test, and finds plenty of failures

The government's rush to secure buildings and airports has raised interest in biometric products. But as testers at the Defense Department's Biometrics Fusion Center know, all of those products are fallible.

'Just this afternoon, [an iris recognition device at the center's entrance] said it didn't recognize me,' said Paul Howe, director of the Bridgeport, W.Va., facility.

Howe's staff enters the center one by one, some having to look into the device a few times before a green LED flashes and the door unlocks. Once inside, his staff of 35 scientists gets to work on finding the faults in a variety of other biometric products.

'Our purpose here is not to see how well something works but how well it doesn't work,' said the center's chief scientist, who asked not to be identified because of DOD policy.

'The field still is in its infancy,' Howe said, 'so we want to come up with a knowledge base for biometrics and a premier testing and evaluation database.'

A biometric device's performance can depend on a variety of subtle factors, including where it will be used, by how many people, at what distances and in how much ambient light, he said.

And then there is the more urgent question of how well it de-fends against attack or intrusion. Howe compared biometrics testing to picking old-fashioned locks.

'If you had enough time and resources, you could probably pick all the locks,' he said. Likewise, testers have figured out how to fool almost all of the devices the center has evaluated, as vendors failed to anticipate at least one potential weakness.

Howe and his staff, mainly contract employees from STS International Inc. of Berkeley Springs, W.Va., have tested about 50 devices since November 2000, including those using iris scanning, hand and face geometry, voice and signature recognition, and fingerprint scanning.

The center reports each device's strengths, weaknesses and suggested uses to the Biometrics Management Office at the Pentagon.

The center's chief scientist said he expects to see new types of devices that can identify patterns of wrist veins or a person's walking gait.

'We're still trying to formulate our 'go or no go' policy,' Howe said, because some devices do not merit the usual three weeks of tests.

He said he could not disclose which devices have performed best or worst because he doesn't want to give some vendors 'a black eye.' Some products are unreliable or still in beta form, he said, and the companies expect the center's staff to debug them.

The center recently has been testing facial recognition software and hardware from Identix Inc. of Minnetonka, Minn. Identix's FaceIt can store facial images in a database for comparison against faces in a crowd.

Another device in testing is MorphoAccess, a fingerprint terminal from Groupe Sagem of France.

Howe said fingerprint devices work well overall, although problems do come up. Twins' prints, for example, are indistinguishable.

'If I'm a twin, I've got to have my own personal identification number,' he said, and the PIN alone would work in case of finger injury.

The center also is testing the iris-recognition Authenticam camera from Panasonic Security and Digital Imaging Co. of Secaucus, N.J. So far, one scientist said, the device doesn't work well enough for enterprise network access. 'There's no connectivity between the server and the application,' and middleware would have to be developed, he said.

DOD, which used to accept free submissions, now buys each product it tests.

Every other month, Howe and his scientists meet to propose new devices for testing. 'We decide what's important and put together an acquisition list,' Howe said. And occasionally the center places a 'device wanted' advertisement in the Commerce Business Daily.

For recent GCN Lab reviews of biometric products, click on Advanced Search in the Search box on the top left of this page. Type in 'biometrics' and click Product Reviews in the category window.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above