Anyone doubting the speed of innovation in biometric ID should attend a conference on Identification. A major conference, Connect:ID, is taking place March 17-20 in Washington, D.C., shortly after the 2014 Winter Biometrics Summit, March 3 – 6 in Miami. I recently participated in the ASPCA’s 10th Government Forum on Electronic Identity in Cambodia, as well as the 2012 Biometrics Consortium Conference in Tampa. These meetings always have a heavy commercial presence, both speakers from industry and presentations of new technology and shiny new products. They also include academics and government representatives, as clients and also as speakers, sharing experience and approaches to common identity-related issues.
Security is still the major driver of the biometrics industry. Some high-security technologies are not practical for widespread deployment but for many there is a growing dual-use overlap into commerce, health, pension administration, elections and national identification. Indeed, the applications are so numerous that I called this phenomenon a “Biometrics Revolution” in a CGD working paper published last year.
Most of the firms and individuals participating in the conferences have had some exposure to developing countries, the most rapidly growing segment of the $7 billion biometrics market. The Connect:ID conference in Miami features a set of sessions on ID for development, recognizing the significant experiences of countries like Mexico, Indonesia and India, as well as some in Africa like Rwanda. Companies from Pakistan and South Africa, among other developing countries, have emerged as global competitors in the area of biometric identification. Korea, China, India and others are major producers of hardware for capturing users’ credentials and machinery for making smartcards.
Here are four trends worth watching—whether you will be attending one of these fascinating conferences or just trying to keep up with the explosion of activity linking biometrics, the right to individual identity, and development.
1. Remote authentication: To quote the program for Connect:ID, identity is “increasingly mobile, global and transactional.” With ever more transactions and interactions online the need for a secure “virtual identity” is driving innovation, in particular to link identification to mobile devices. There is still no dominant approach. Some favor embedding identification data into portable devices like cell-phones while others advocate storing it on a separate card that can be read by mobiles using Near-Field or Bluetooth technology. Multi-modal identification is the name of the game—combinations of something-you-have, something-you-know, and something-you-are. Secure systems will need multiple identifiers, possibly including biometrics as well as PINs and tokens.
Estonia is the world leader in virtual identity. Every citizen has a virtual e-ID which includes the ability to sign documents; the legal status of these electronic signatures is equal to those performed physically. Biometrics are recorded to ensure uniqueness when issuing the credential but PINs (stored on the ID card and under the control of the user) are used to authenticate and sign. A citizen only needs to visit a government office twice, once to register and the other time to get married—Estonia does not (yet?) accept virtual marriages. Massive time savings are claimed for citizens and also savings for government.
Not all countries might find such systems practical, since Estonia is among the most connected and computer-literate countries in the world. But if it becomes possible imagine the much greater economy and convenience that such a system would offer to poor countries with scattered settlements and high transport costs.
2. Identification of children. Many children are not registered at all. According to the latest UNICEF data each year almost 50 million births are not registered, almost all in poor countries. Yet some developing countries have made big strides in increasing birth registration. Uruguay has instituted a one-stop- shop approach, providing birth registration, certification and a national ID number before mother and baby leaving the hospital.
Security of birth records is a major problem. Unlike with e-Passports, there is no standard for birth certificates, which are nonetheless often the foundational documents for subsequent identification systems. Many registries are in shambles and some, as in Cambodia, have been destroyed in civil conflict. In Europe, a high proportion of new biometric passports is believed to have been issued in error, mostly because of erroneous or fraudulent birth certification.
There is still no consensus on when and how to link a child to a birth credential using biometrics. DNA could be used for infants but it is not practical on a wide scale and will be seen as intrusive by many. Iris scans can now be used down to 3-5 years and possibly less, but for now an infant can only be “connected” to his or her ID through that of the mother.
3. Standardization and interoperability. One of the participants in the 2014 Summit is the BioAPI Consortium, a group of more than 120 organizations with a common interest of promoting standardization. India’s UID program has had a huge impact here, developing standards to enable competitive procurement and bring down costs.
4. Privacy. At the ID conferences, privacy concerns are viewed mostly as something to be addressed in order to ensure growing acceptance of the new technology rather than because of genuine concerns about surveillance and the possible erosion of civil liberties. Even so, similar questions come up. How can individuals control the storage and use of their personal data? So far privacy has been more of a focus in rich countries but, as Robert Gellman discussed in a CGD policy paper, the issue is likely to become increasingly important in poorer ones, too.
Overall, the outlook for ID technology in developing countries is very strong. With encouragement from vendors, some countries are now upgrading their technology, including towards rather (too?) costly multi-function smartcards along the lines of Malaysia’s MYKAD to enable citizens to interact with government as well as allow a wide range of commercial applications. China is conservative on technology, but Macao has one of the most sophisticated contactless cards in the world. Voice recognition is beginning to be used on quite a large scale, more for low-value engagements and – rather like the iPhone fingerprint -- to increase convenience.
Oddly, amidst this boom, the US, which so often leads on technology is a laggard in identity management. As shown by the recent surge of identity thefts from Target and other retailers and the IRS and other government agencies, an US upgrade in this area is long overdue.