2016 Global Identity Summit Pre-Conference Paper. Fingerprints

Transcription

1 2016 Global Identity Summit Pre-Conference Paper Fingerprints

2 This is a community-developed document. Information and viewpoints provided within are not necessarily the opinions of the paper coordinators nor their employers. Special thanks to the MITRE Corporation for their editorial assistance and coordination guidance.

3 Fingerprints Introduction The 2016 edition of the Global Identity Summit (GIS) will come at a unique time in federal circles, as it will be 50 days before a presidential election and 123 days before the new President takes office. Clearly, this is a very busy time for all federal officials, as they will be working with transition teams to explain current capabilities and draft plans for the next administration to implement. The GIS Planning Committee is using the 2016 conference to assist agencies during this critically important transition period. This information will be equally useful to the private sector as it develops its future strategies. The Planning Committee s ultimate goal is to gather and publicly post information that explains current capabilities and issues, provides a vision of future capabilities, and develops initial concepts for public and/or private activities for the next five years. The Planning Committee has identified approximately 20 critical identity topics to focus on at the 2016 GIS. Within each topical session, speakers will present information on the current state as well as discuss needs and priorities for the future. The session moderator will then invite feedback from audience members via an open floor and/or targeted workshops. This paper serves as a read-ahead on one of these topics, so that GIS attendees can be prepared to participate in onsite discussions. Abstract Introduction Fingerprints have been used in law enforcement for more than 100 years, but until the mid-1980s matching was almost exclusively done by human examiners. While slow and labor-intensive, the accuracy of the manual systems could be quite good. For example, when technology advanced to the level that automated comparison for the then 36-million person Federal Bureau of Investigation (FBI) criminal master file against itself was possible, the file was found to be 99 percent accurate despite 75 years of entirely manual operation by thousands of fallible humans. An extensive quality control process was required to maintain such accuracy. Until the late 1980s, reference fingerprint collection consisted of inked finger impressions on paper fingerprint cards. At crime scenes, manual techniques were employed for developing latent impressions. Initial standards for electronic capture focused on technology for converting paper fingerprint cards into an electronic format. Subsequent live scan devices were an extrapolation from the earlier specifications. Today most nations, many of their subdivisions, and a large number of commercial entities operate automated fingerprint identification/verification systems. In the United States, at the national level, virtually all tenprints are received electronically, although perhaps 15 percent are still initially collected on inked cards and converted into an electronic transaction. Commercial use of fingerprints, such

4 2016 Global Identity Summit as an authentication mechanism for mobile devices, has or will soon likely exceed the number of government fingerprint capture devices. Optical and capacitive fingerprint sensors emerged in the 1990s and were soon incorporated into physical and logical access control systems. Due to higher cost and relative satisfaction with userid/ password/ personal identification number (PIN) protection, fingerprint-based access control did not see widespread use until recently. That changed with the introduction of the Apple iphone 5S in September The 5S included the AuthenTec capacitive finger scanner providing a feature called TouchID. Before the 5S, about 49 percent of iphone owners used a passcode for access protection; afterwards about 83 percent used TouchID access protection. A year later, with the introduction of the iphone 6S and the Apple Pay application, fingerprint scans began to be used to authenticate financial transactions. Mobile fingerprint-based identification proved hugely useful to the warfighter in Iraq and Afghanistan. In 1999, the Army developed and fielded the initial Biometric Automated Toolset (BAT), which quickly proved its worth as a force multiplier. Addressing tactical identification needs, the device was not suitable for enrollment into, or querying, the FBI criminal master file. This led to the FBI fielding a Quick Capture device in 2003 to support military activities. BAT was followed by the more capable Handheld Interagency Identity Detection Equipment (HIIDE) in 2007 and the Secure Electronic Enrollment Device II (SEEK II) in Battlefield fingerprint identification success had proven the worth of mobile positive identification. However, the early mobile devices were far too large, expensive, and slow for domestic law enforcement. Planning for Next Generation Identification (NGI) included mobile near real-time search from the streets or at remote locations without the need to transport subjects to a central office increasing officer safety and greatly reducing the inconvenience to many subjects. In the last decade, fingerprint sensing technology has further advanced with sensors focused on presentation attack detection (PAD), semi-penetrating, non-contact, and standoff capture. A new generation of semi-penetrating fingerprint capture sensors serve two primary goals. First, they seek to improve the quality of captured for prints for individuals who have traditionally been hard to capture well. Second, they seek to detect presentation attacks. Non-contact and standoff fingerprint sensors are primarily aimed at improving high-volume throughput for access control. On the whole, these new fingerprint capture technologies are aimed at improving the usability and reliability of fingerprint technology. This trend is driven by fingerprint technology moving from government to commercial applications and autonomous usage without a human in the loop. Capabilities There are three major U.S. government national biometric screening systems: NGI, operated by FBI/ Criminal Justice Information Services; IDENT, operated by the Department of Homeland Security (DHS)/Office of Biometric Identity Management; and ABIS, operated by the Department of Defense (DoD)/Defense Forensics and Biometrics Agency. These systems, among other things, ensure an accurate criminal history, identify wanted persons, ensure that persons requiring licensing or employed in positions of trust have no disqualifying criminal history, verify admissibility for visitors and immigrants, and ensure battlefield identity dominance. All three systems interoperate effectively. Fingerprint 2

5 Voice Biometric matching is the principal mode for each. The fingerprint matching technology is excellent, with automated search accuracies of about 99.7 percent and stoplight response times within seconds. When they are augmented with human examiners to address the most difficult comparisons, both search accuracy and response time increase. To make the foregoing more concrete, we will consider the FBI NGI system and the Biometric Services Section staff that operates it. The NGI repository contains over 111 million subjects, of which over 71 million are for criminal justice purposes and nearly 40 million are for civil purposes. About 209,000 tenprint checks are conducted each day, 35 percent for criminal justice purposes and 65 percent for civil purposes, including national security. About 97 percent of transactions are fully automated. Response time for transactions referred to human examiners is determined by staffing levels in several functions. Civil fingerprint checks are performed on a fee-for-service basis, with a committed response time of 24 hours and an urgent transaction available (at a higher cost) with a 15-minute response. Criminal transactions have a committed response time of two hours. Criminal response time fiscal year to date averages less than seven minutes. Civil response time fiscal year to date averages less than one hour, 23 minutes. The FBI operates a Six Sigma quality program on fingerprint matching. In 2002, the hybrid machine/human examiner accuracy was percent. By 2003, the hybrid accuracy rate improved to percent. Since 2013, the hybrid miss rate has been unmeasurable. Comparable performance would be expected for other national-level hybrid fingerprint matching systems. Fingerprint positive identification systems are highly scalable. The Unique Identification Authority of India operates a biometrically enabled identification system with over a billion subjects enrolled, nearly all supported primarily by fingerprints. Using relatively low-cost equipment, it operates countrywide for a variety of applications, including identity proofing, benefits eligibility authentication, and attendance, among others. Biometric access control systems, including those that are fingerprint based, have yet to gain significant traction. Personal identity verification cards coupled with PINs have been regarded as a cost-effective solution thus far. Consumer adoption of fingerprints on mobile devices was the most significant trend in biometrics during 2013 through Apple alone shipped 286 million Touch ID-enabled iphones and ipads in the fiscal year that ended September Goode Intelligence predicted there would be over 16 billion mobile biometrics (fingerprint) payments by A May 2016 survey of 4,000 consumers in the United States and the United Kingdom found that some 80 percent of consumers believe biometric authentication (overwhelmingly fingerprint based) is more secure than traditional usernames and passwords. Mobile use of fingerprints for authentication to the device and ecommerce appear a massive trend both domestically and internationally. However, as good as the technology has become, shortcomings remain. Lights Out search reliability in the 99.7 percent range with low (roughly one per thousand) false positives would be exceptional absent the consequences of failing to identify a known terrorist or person wanted for serial commission of heinous crime. As a result, expensive and far slower human examiners, supported by complex quality control and review mechanisms, must augment the technology. Beyond 3

6 2016 Global Identity Summit that, fingerprint searching is limited by the quality of the submissions. The awkward rolling motions required to complete a tenprint card are a difficult skill to acquire. At the national level, about 2 percent of criminal and 3 percent of civil transactions must be rejected, primarily for image quality reasons. Fingerprints are unique among face, finger, and iris biometrics in that they alone can leave behind physical evidence of their presence in the form of latent fingerprints. Law enforcement crime scene latent fingerprint identification remains entirely dependent upon human examiners. The vast majority of the nation s over 18,000 law enforcement agencies do not have crime scene identification (CSI) units or fingerprint examiners, relying on big city, state, and federal agencies for such support for only the most serious crimes. Landscape Many countries have deployed, or are deploying, comprehensive biometrically based (primarily fingerprints) immigration and visitor control systems tracking both entry and exit. A few, notably India, are biometrically enrolling their entire populations. Most countries have a national automated fingerprint identification system, and a few, including the United States, have such systems widely deployed. Academic research into fingerprint capture technology, fingerprint matching, the scientific basis for forensic analysis, and other aspects is active at multiple institutions in the United States, Europe, Australia, Japan, India, and China, and less represented elsewhere. Development and marketing of commercial products tends to focus in the same areas. Within the United States, centers of excellence for fingerprint-related advances are within the FBI, National Institute of Standards and Technology, National Institute of Justice, DHS, DoD, and Intelligence Advanced Research Projects Activity. Future By 2021, advanced fingerprint capture technology should be commercially available, which will reduce the image quality reject rate to not more than 0.1 percent. Automated matching technology should provide a search reliability of 99.9 percent at a false non-match rate of not more than percent. Non-chemical latent fingerprint collection devices suitable for use by police officers without specialized CSI training should be commercially available, and automated latent matching algorithms should advance to the stage that candidate matches above a threshold score are suitable for lead generation without review by a qualified latent fingerprint examiner. 4