Traveler Biometrics Is Here

• By Frank Barbetta
• Nov 12, 2007

Since 9/11, transportation officials have been attempting to balance the requirement for heightened airport security with the need to move large volumes of travelers through checkpoints with minimal delays.

Security specialists began discussing a biometric solution, backed by telecommunications networking and information technology, in the months after the attacks. Finally, after several years of trials, combined with declining equipment costs and greater commercialization of the necessary technology, systems that merge sophisticated biometrics with high-speed data networking are positioned to hit the mainstream.

Passengers are starting to see airports and airlines ramp up introduction of the socalled Registered Traveler (RT) program, an air transport marketing initiative conducted in cooperation with the federal Transportation Security Administration (TSA). RT relies on customer willingness to provide personal information, submit to fingerprint and iris scans and pay registration and subscription fees in return for U.S. government-assessed security clearance and the privilege to use TSA-issued smart cards. Registration permits travelers to use a special line for faster check-in. Then, instead of waiting on line for the standard TSA check of ID and boarding pass, RT participants use their smart card at a kiosk that approves their access to secure areas.

RT travelers still must have their carry-on bags x-rayed for expedited entry into secure airport areas.

Dating to proof-of-concept demonstrations around 2002 and an Orlando International Airport trial in 2004 and 2005, RT appears to have the benefits and blessings of biometric, telecom and IT standards.

AAAE Takes Charge

Air transport business interests, technology vendors and the TSA initiated the RT program as a result of the U.S. Support Antiterrorism by Fostering Effective Technologies (SAFETY) Act of 2002, which encourages incentives for the development and deployment of “qualified anti-terrorism technologies.”

The RT activity is in the hands of private industry under the auspices of the American Association of Airport Executives (AAAE), which created the Registered Traveler Interoperability Consortium (RTIC), a group comprised mainly of scores of airlines and airports, to spearhead the effort.AAAE also formed various bodies or subsidiaries for the following ongoing tasks:

• Write specifications for TSA approval.
• Operate a conformance lab to test the systems and solutions.
• Act as the single source gateway to the TSA.
• Run computer-intensive clearinghouse operations that maintain biometric/ID databases and secure network communications.

Service Providers Selected

The TSA’s role is largely administrative. The agency accepts sets of written applications from travelers and looks at specific criteria to clear and certify RT participants.

This process includes the selection and use of authorized service providers that act as the prime contractors for RT services among airports and airlines, which the program calls “sponsoring entities.” Right now there are five service providers: FLO Corp. (formerly Saflink), Kirkland,Wash.; Unisys Corp., Reston,Va.; Verant Identification Systems Inc., Rochester, N.Y.; Verified Identity Pass, New York; and Vigilant Solutions, Jacksonville Beach, Fla. They all have handfuls of partners from the computer, software, systems integration and biometrics security industries to implement and deploy RT installations nationwide.

Sponsoring entities themselves must also apply for TSA approval to participate in the RT programs. Virtually all of the more than 400 airports in the U.S. are potential RT locations. As of September,RT services were in place in airports serving Albany, Cincinnati, Indianapolis, Little Rock, Ark.; the New York City area (Kennedy International, Newark Liberty International); Orlando, Reno/Tahoe, Nev., San Francisco and San Jose, Calif. Participating airlines include Air France, British Airways and Virgin Atlantic.

Requests for proposals (RFPs) and awards reportedly are pending in Atlanta, Dallas-Fort Worth, Denver and Washington Dulles, with more anticipated. The pace of RT rollout, and how widespread RT services will become, however, remain major industry questions.The answers may be contingent on public perceptions of biometrics technology, privacy concerns, security importance and willingness to pay, as well as industry attempts to convince sponsors of the RT program’s business imperatives and customer service merits.

Successful So Far

“The program success and adoption is positive,” says Bryan Ichikawa, the Unisys solutions architect heavily involved in the RT program. Unisys is the supplier in Reno, operating an RT service under its RT GO brand name. “People understand and accept what is being done, but how much faster RT progresses is hard to say,” he adds.“The notion in the past that biometric security is scary and unknown is being lifted. Behavior is moving more readily toward acceptance.”

“The RT program can change the way people think about security,” says Jason Slibeck, chief technology officer at Verified Identify Pass, which operates the Clear brand service for RT installations and counts General Electric and Lock- heed Martin among its investors and vendor partners. “It is a huge, unique biometric program based on standards, with wide public exposure and availability. There are a lot of things within RT that can really pave the way for biometrics. The only expansion challenge is that airports and airlines have to agree to do it.”

Airports with pending RFPs could move relatively rapidly, according to Conor White, chief technology officer of Daon, whose ID assurance software has been used with the Clear service in Orlando since 2005. “We can surely see a sharp uptake later this year or early next year,” he says.“And I’m not really aware of any technical issue preventing RT’s adoption at any airport in the U.S.”

User acceptance, which will drive RT’s progress, is growing, according to Tim Myerhoff, North American program director at LG’s Iris Technology Division, which has worked on providing its iris scan know-how with AAAE, Unisys, Verified, Flo Corp., Daon and Motorola. “RT is in a roll-out mode now nationwide and will be available to a lot more airports very soon,” he maintains. “But it may take a while for it to reach its full scale and breadth.” Andrew O. Omidvar, senior director of business development for Motorola’s Federal Markets Division, is enthusiastic about future RT deployment, but counsels patience because the initial pace of rollout may be a bit slower than expected. Motorola’s contribution to the RT program -- a backend biometric system at the AAAE’s Transportation Security Clearinghouse -- comes from its Biometrics Business Unit, part of the manufacturer’s Public Safety and Government sector. Motorola worked with sponsors for about two years before the formal March 2007 system cutover.

Seeking Traveler Buy-In

“There are 433 airports in the United States. Maybe not every one is a candidate for RT, but at least the primary ones are,” Omidvar says. “One of the motives behind RT is to shorten the lines and cut the security waiting time for frequent flyers. RT is handled by the airports and airlines, and they have to convince their customers.This is more of a challenge than just putting in the backend systems.

“Once more RT systems are deployed in more major airports and they begin to permeate the environment, people will see the service benefits,” he says. “They also can spread information about RT by word-of-mouth, and then we will see a major difference in deployments.”

Meanwhile, like others in the industry, Omidvar maintains that as currently envisioned, RT faces no major technical issues or challenges because biometrics, smart card, computer and networking interoperability and compatibility matters were addressed early on in the RT design, specification and agreement process.

The AAAE and the TSA were able to draw on standards bodies, including the International Standards Organization (ISO), the American National Standards Institute (ANSI) and the National Institute of Standards and Technology (NIST). Omidvar was previously manager for homeland security in the NIST’s Advanced Technology Program.

“There have been no major problems; the only operational issue is power outage matters,” says Ichikawa of Unisys. “And there shouldn’t be any incompatibility challenges. RT was fully designed and tested, confirmed and certified first regarding such interfaces.”

RT data, for instance, must be shared among all five service providers, no matter which airline or airport are designated sponsors. “Cards must be interoperable at other airports,” Myerhoff of LG points out. “So enrollment and the cards are good elsewhere. This interoperability was required.”

As part of the total reliability solution, seamless communications and secure networking are definitely necessary. TSA and the AAAE’s Security Biometric Clearing Network (SBCN) maintain constantly updated lists of RT passenger information-including revocations-and these are uploaded one or more times daily to on-site SP systems and kiosks where flyers start their on-site access/entry routines.

Diverse Infrastructure

According to Verified’s Slibeck, the typical RT infrastructure for transport includes encrypted messages, passcodes, security certificates, XML schema, virtual private networks (VPNs), Internet Protocol (IP) packets, mobile kiosks, broadband cellular and telephone company digital subscriber line (DSL) loops. And there’s a lot of network and resource technology for security, including public key infrastructure (PKI) coding for smart cards and all primary local authentication, according to LG’s Myerhoff.

“Kiosks won’t work if they go for more than 24 hours without updates,” adds Ichikawa of Unisys. “If the hot list has negatives -- meaning cards that are revoked for whatever reason -- the cards and biometric ID won’t pass through.” Most revocations are attributed to cancelled RT accounts and not security clearance losses, according to TSA and AAAE.

Depending on the configuration, local, regional and wide area networks all can come into play in implementing the RT program. According to Daon’s White, good communications among the kiosks, computer systems, databases and all the participating government and business entities was a “core guarantee” among the multiple service providers. Communications then is considered a critical function, piggybacking on well-established protocols and standards, he says.

In fact, White also explains that service providers are bound by service level agreements on networking uptime, kiosk uploads and the integrity of biometrics, enrollment and personal data and other RT information traversing the VPNs.

“Interoperability was agreed to by the prime providers in order to expand the service in contrast with proprietary solutions,” Slibeck of Verified points out. “Interoperability guidelines were a huge undertaking and a big step. Different providers at different airports must accommodate all RT passengers like an automatic teller machine. We can’t minimize the amount of work and cooperation needed to make it all happen.We all decided to establish such an open program and help the market grow.”

By all industry accounts, the RT program is on the verge of a full-scale commercial rollout, although it is still officially designated as a “pilot” under TSA nomenclature.

This is because the TSA’s $28 fee -- paid by passengers for the pre-enrollment background check -- requires the agency to conduct a formal notice of proposed rulemaking (NPRM), a regulatory process with rounds of comments and replies. RT-registered passengers also pay separate fees for the service to their respective primary service providers. Clear’s fees, for instance, are $99.95, $199.90 and $299.85 for one, two and three year periods, respectively.

All Standards Issued

Even though no NPRM has begun and no date has been set for its start, the RT project has broad status under its “pilot” designation. Service providers, airports and airlines may go forward with the program, according to Amy Kudwa, media relations officer for the TSA at the U.S. Department of Homeland Security. “TSA has issued all the technical standards at this point. All it needs are the applications from the service providers and sponsoring entities, and those are being turned around quickly,” she adds.“The pace is being driven by private industry.”

Kudwa indicates that no more Capitol Hill codification is necessary, although late July hearings at the House of Representatives’ Homeland Security Committee were held to track RT progress. There were differing opinions among politicians, U.S. bureaucratic officials and industry executives about the pace of the RT program’s progress. Yet it was clear from testimony that the TSA regards the RT program more as a business marketing/customer service concept than as a counter-terrorist, security/ air safety measure.

Nevertheless, the industry viewpoint is that RT adds another security layer to the air safety process. RT doesn’t eliminate existing security measures, including security personnel and luggage, clothing and body scans. In addition, the industry ostensibly is buoyed by RT’s current green light as well as future biometrics security prospects.

LG’s Myerhoff sees the U.S.RT program producing renewed interest in biometrics security on both the domestic and international levels. And Motorola’s Omidvar, among many others, agrees: “No other country has what the U.S. has with the RT program. It can become a model for the European Union members and other major countries of the world.”

The industry thinks RT can help the biometric market in general because it can complement public knowledge and acceptance regarding the likes of iris and fingerprint scanning as long as privacy issues are addressed. “I would say yes, biometrics in general can get more acceptance,” Omidvar says.

Daon’s White also sums up RT’s potential positive impact on the biometrics market : “For RT, we solved the interoperability challenge and the federation challenge [multiple service providers] and there are a lot of adopted systems, so biometrics can be viewed as an enabler elsewhere.”

Registered Traveler: How It Works

Registered Traveler’s customer process flow starts with service providers and sponsors collecting biometric fingerprint, iris data and other personal information at airports and other designated locations, such as hotels and resorts, or at third party biometrics companies. Iris scans are an optional passenger choice, but vendors must support the technology.

The data goes to the Transportation Security Administration (TSA) for a background check as part of enrollment. Potential RT passengers also are given account numbers that are validated and verified by both the TSA and the AAAE’s Transportation Security Clearinghouse, which also uploads data to kiosks at participating airports. The whole data package moves from the AAAE’s Security Biometric Clearing Network (SBCN) back to TSA for background security decisions.

TSA’s security assessment involves dipping into terrorist, law enforcement, immigration and other government databases to confirm the lawful status of travelers who are citizens, resident aliens and other foreign nationals in the U.S. A TSA clearance results in the five current RT service providers, or their partners, producing smart cards that are sent to customers.

Each time an RT customer swipes a card at an airport kiosk, card information is checked against that day’s hot list. The hot list is generated daily by the SBCN, and is always downloaded to kiosks. As an added security measure to prevent hacking or database doctoring, kiosks are not built to upload information.

Customers also opt in favor of primary and secondary ID methods from fingerprints or iris scan criteria or both. Computerized facial recognition isn’t yet part of the biometric mix, although facial photographs are stored on the smart cards for optional manual viewing by airport security personnel.

Experts say that while facial recognition technology has been improving dramatically in the last two or three years and standards bodies are doing important benchmarking work, there remain challenges in achieving high accuracy rates. Other adverse factors are expensive cameras and the need for controlled lighting conditions.

No further RT program automation along the various airport security checkpoints in the special RT lanes is envisioned by the industry or approved by the TSA. Future additions to automation aren’t entirely ruled out, however. Vendors are testing explosives-sniffing technology for body/clothing scans and are said to be capable of performing so-called shoe scanning, which looks for metal differentiation in footwear.