Biometrics, the automated recognition of individuals using unique characteristics, continues to spread into many areas of our everyday lives. We use our faces to unlock our phones, scan our eyes to board a plane, and use fingerprints to access our laptops. As the use of biometrics has become more commonplace, the implications of utilizing physical features, particularly facial features, to grant access to needed services have grown in severity.
Recognition vs Analysis
Facial biometrics fall into two general categories. Facial analysis does not tie a face to a name; rather, it looks for specific characteristics to make a decision on whether or not to grant access. Your iPhone uses facial analysis. A website designed for people 18 and older could use facial analysis to determine if someone is able to access the content. Facial recognition attaches a face to a name. In the case of security, it not only grants access but also connects that access to a specific user. It can also be used to identify a person to confirm or suggest an identity. Facial recognition requires the storage of an original image to compare the biometric scan to, say, a driver's license or passport photo.
The privacy and equity concerns are different depending on which technology is used. Facial recognition carries a risk of identity theft or misidentification whereas facial recognition's risk is tied more closely to discrimination or inaccuracy. These risks are being closely watched and calculated as more and more biometric access is rolled out across government services.
Government's Front Door
Login.gov is a platform that provides citizens with a single point of entry to government benefits and services. Utilizing the site, citizens can login once and move across services provided by a variety of federal agencies. This spring, the site began piloting biometrics as a form of identity verification.
The pilot will offer users the ability to match a "live selfie" with a self-supplied form of photo identification, like a driver's license. The goal is that this form of identification will bolster Login.gov's anti-fraud capabilities, providing even more robust and equitable identity verification to protect against "increasingly sophisticated identity fraud and cyber-attacks." This pilot will help evaluate the overall user experience throughout the new workflow and identify any issues with providing access to legitimate users.
Traveler Identification
Airlines and the Department of Transportation utilize biometrics to confirm passenger identities.
The Transportation Security Administration (TSA) has been using facial recognition at airports since 2022 as a way to update its Credential Authentication Technology (CAT) devices. The new technology compares real-time photos of travelers against their government-issued identifications. It has been rolled out at 80 airports so far, and agency officials are looking for additional funding to speed up the process across all devices in U.S. airports.
Privately run programs like CLEAR and airlines themselves are utilizing facial recognition to speed check-in processes for travelers. The Department of Transportation recently launched a privacy review of top airlines to ensure that personal information and images are not being shared with third parties and only being used for the intended and expressed purposes of identity verification.
Immigration Support
U.S. Customs and Border Protection (CBP) plans to expand the use of biometrics through its CBP One app. The capability would allow the Department of Homeland Security to collect biometric information on nonimmigrants leaving the country. It would require a selfie photo with geolocation tracking to confirm that they've actually departed. This verification can help reduce travel document fraud and improve the agency's "ability to identify criminals and known or suspected terrorists." Use of this update in the app is currently voluntary.
To stay on top of biometric use in government as well as policies impacting its use, check out these resources.
- ATARC's Federal Law Enforcement IT Summit (August 28, 2024; Reston, VA) - Law enforcement agencies face a multitude of cybersecurity challenges that demand innovative solutions and collaborative strategies. From the intricacies of threat intelligence sharing to the ethical considerations surrounding data privacy and governance, the discussion will navigate the complex intersection of cybersecurity and law enforcement, offering valuable perspectives to inform policy decisions and operational initiatives.
- One Identity UNITE 2024 (September 23-27, 2024; San Diego, CA) - Attendees will discuss solutions, innovations, and challenges in the identity security market.
- Border Technology Summit 2024 (September 24-25, 2024; Del Mar, CA) - The forum will explore the latest advancements in border security technology. The event will feature interactive discussions surrounding advancements in biometrics, non-intrusive inspection, smart walls, current and future operations of border security, and much more.
- Gartner Identity & Access Management Summit (December 9-12, 2024; Grapevine, TX) - This event will address the most significant challenges that IAM and security leaders face as they respond to and drive change.
- Protecting Against Criminal Use of Stolen Biometric Data (white paper) - As a result of data breaches, identity data gathered over the last 15 years by the government has been compromised, including personal information about individuals who were part of government employee background checks. Unfortunately, even the best risk-based, multi-layered breach defense is imperfect, and incidents like this are inevitable. For this reason, there must be a greater focus on controlling what happens after the breach, including ensuring that stolen identities are unusable by anyone but their legitimate owners.
- Immigration: The U.S. Entry-Exit System (white paper) - This report provides an overview of the country's entry-exit system. It explains which biometrics are taken upon entry and/or exit to the United States, how facial recognition technology works, and who is required to provide biometric data. The report concludes with policy considerations for Congress, including the accuracy, security, and storage of biometric data and the ability of U.S. citizens to opt out, among other things.
To explore more about biometrics, check out additional resources on GovEvents and GovWhitePapers.
