The Truth about Biometric Exit

Technology to verify departures by foreigners has become affordable

• By James Albers
• Oct 01, 2014

How can the United States ensure that the millions of visitors who travel to this country with a temporary visa uphold their agreement to leave before it expires, while also enhancing convenience for travelers? Biometrics technology holds the answer. In fact, this technology dramatically lowered cost estimates for U.S. airport exit control systems from $6 to $3 billion in 2008 to $1 billion today.

However, despite more than 17 years since a law called for a biometric exit system to help secure our nation’s air and seaports and more than 12 years since the 9/11 Commission recommended it, we still don’t have a system in place in the United States. The problem is that some people continue to rely on outdated cost estimates and technology when considering the solution.

In reality, advanced biometric entry and exit control systems are already being used in airports and border crossings outside of the United States. These systems are affordable, convenient, and can accommodate a high rate of traveler throughput. When properly implemented, biometric exit controls can provide a higher degree of identity assurance than biographic controls alone. Furthermore, this can be done without disrupting operations at airports, seaports or other ports of entry, and at a reasonable cost when considering the benefits.

What is Biometrics?

While the latest iPhone familiarized us with biometric technology, particularly fingerprints, most people still don’t have a full understanding of it. Biometrics is who we are; each mode of biometrics, including face, fingerprint and iris, contains a number of unique identifying features. They are completely unique to individuals and cannot easily be faked. Each distinct biometric modality offers numerous unique benefits, that, when used together, can dramatically increase identity assurance.

Facial recognition. Though not a new concept, as police officers have been using it for as long as there have been criminals such as when reviewing mug shots, algorithms for face recognition have progressed to the point where software is better at matching faces than the average human could. Face recognition is a potential solution for biometric entry and exit as high-quality video cameras are already installed at most major airports. If mounted in the gates used for international departure, these cameras could capture the faces of departing visitors.

Iris enrollment and verification. In 2008, this was still a niche technology, but today, iris devices have become reasonably priced, as several iris camera manufacturers have driven down the costs per unit with high-quality image results. The recent addition of iris to the NIST Personal Identity Verification specifications has added certainty to the technology and gives it room to grow.

An iris template cannot easily be reverse engineered to the original iris photo; thereby, it protects the privacy of the traveler’s biometric information. Iris recognition can be unobtrusive. High resolution cameras have improved to the point that photographs taken from up to three meters away from the subject will have the desired quality, along with the good focus that is required for iris recognition. Similarly, iris recognition systems are contactless and hygienic. There is no need to touch a surface that has been touched by thousands of travelers, helping to prevent the transmission of disease via contact. Considering fingerprints can sometimes be associated with criminal behavior, iris may be less offensive to a subset of travelers.

Iris recognition systems are stable. The iris is an internal organ that is protected against damage and wear by the cornea. It is mostly flat with a geometric configuration that is mainly dictated by pupil dilation. This makes the iris shape far more predictable and stable than an individual’s face. Because of this, iris recognition is highly reliable with the ability to reach extremely low false accept rates, comparable to that of any other biometric modality.

Finally, iris results are returned quickly. Iris templates are small, and as a result, database searches are fast. Current server hardware can match an iris template to tens of millions of templates in less than a second. This means that iris can provide a “lights out match,” comparing one template to many records faster than any other biometric.

Stand-off dual capture. There is even more to gain by using stand-off dual capture units, which simultaneously captures both face and iris images. Today’s dual face and iris cameras are of sufficiently high resolution; a photograph taken with the appropriate lens and lighting, from a distance, still has the resolution necessary to perform accurate matches.

Stand-off technologies allow for photographs to be taken unobtrusively, in seconds and can be configured to fit into natural chokepoints at airports, such as check-in counters, security checkpoints or at the departure gate. Within seconds, a stand-off simultaneous face and dual iris biometric collection device can take photographs of a subject’s face and eyes and send the images to a back-end search engine. Depending on the complexity of the search workflows, results can return in seconds. At natural document handling points, search results could be returned before the document examination is completed. With faster computer systems and advances in computer vision algorithms, these systems will only get better.

Fingerprint recognition. There are exciting advances in fingerprint capture devices that provide new options for exit configurations. There are contactless fingerprint capture solutions that can capture four finger images with a single movement of the hand in less than a second. Its fast acquisition capability allows subjects to provide fingerprints while on the move, making it suitable for high-traffic environments. This method of fingerprint capture alleviates hygienic concerns when using a commonly touched surface.

Biometric Exit Offers Greater Security

The use of biometrics is the single best way to quickly and accurately prove an identity. Biographic information, such as a person’s name and date of birth, as well as the documents used to verify biographic information, are all vulnerable to fraud. All of this information and documentation can be falsified and stolen. In addition, biographic data is fraught with errors because it is reliant, in most cases, on human collection. The Boston Marathon bombing serves as an example of this: Russia warned the United States about Tamerlan Tsarnaev, but an opportunity to question him was missed because our records contained a spelling error.

Biographic data is presented inconsistently around the world. Birth dates can be presented as day/month/ year or as month/day/year and names can be presented as first/middle/last or the reverse. This is in addition to limitations associated with transposed or erroneous numbers or letters. Many names—especially those associated with foreign languages—allow multiple spellings or use of hyphens or other marks that can reduce the reliability of biographic systems. Biometric identification and verification, on the other hand, is based on international standards and is generally not subject to the same vulnerabilities as biographic data.

Multi-Modal Biometrics Takes Security to a New Level

Today, when a nonimmigrant arrives at a U.S. port of entry and applies for admission to the United States by air or sea, the only biometrics collected are fingerprints and photographs; but, the photographs are often not suitable for use by facial recognition technology. Because of this, many assume that an exit system should be based on a fingerprint matching system. Collecting additional biometrics from visitors, fingerprints for sure, but also quality photos that work with facial recognition systems and are iris-capture compliant with recently issued National Institute of Standards and Technology (NIST) standards would provide additional flexibility to employ a system that works most effectively in different airport environments. In some instances, this may include iris scans; in other instances, facial recognition; and in others, fingerprints.

Regardless, collecting multiple modalities of biometrics at the time of entry would provide more options for capturing biometrics at exits. Contactless biometric capture using face, fingerprint, iris scans or a combination thereof would allow operators to take advantage of the relative benefits of each biometric identifier and method of capture such as accuracy, passenger throughput, convenience and cost. In this scenario, fingerprints would continue to be collected during enrollment, allowing for comparison against relevant databases. And, with the addition of iris and facial recognition scans at the time of entry, the added security benefit of allowing matching against face and iris databases would be provided.

With multiple modalities implemented, the primary modality used on a given day can be changed, mitigating the ability to plan for methods to spoof any single biometric. In addition, a multi-modal system ensures that each visitor would have at least one biometric identifier in the system that can be used to confirm identity. And, while each of the three biometric technologies has a relative margin of error, collectively they can ensure high probability matches on data sets with tens of millions of records and more, and can be used to reduce the impact of failed biometric capture, for instance, due to dry fingerprints. Statistics from the Indonesian multi-modal national ID card project, for example, shows that there is only a 0.008 percent chance of false positive identification and a 0.18 percent chance of false negative identification on a database of more than 100 million records.

Additionally, multi-modal biometric entry/exit systems actually reduce processing times. Combination facial recognition and document scanning systems can process a passenger in as little as eight seconds. Iris scanning systems can capture and process an iris image in a few seconds, while contactless, finger- on-the-fly technology can read four fingerprints in as little as three seconds.

The Cost of Biometric Technology Continues to Drop

In studying the opposition to biometric exit controls, there is significant reliance on a 2008 report that estimates the costs for implementing a biometric exit system at airports and seaports between $3 billion and $6 billion. These cost estimates are out of date and orders of magnitude too high, and do not take into account the dramatic price declines in biometric technologies in the six years since—the same kind of declines we’ve seen in other technologies.

This original study rested on the assumption of building a system to specifications without considering the range of commercially-available, off-the-shelf (COTS) biometric capture devices offered by vendors today that are affordable, highly accurate and are designed specifically to fit within an airport footprint. To illustrate this point, the first live scan fingerprint devices were put into use 20 years ago, were big and bulky, and cost $15,000 or more per unit. Today, live scan devices are small and cheap enough to put on an iPhone, and law enforcement agencies buy high volume, 10-print fingerprint devices for less than $1,500.

Smartphones are a good example of how the cost and size of cameras has declined. An iPhone 5 has an 8-Megapixel camera, and the newer models even have autofocus. Nokia now has a 41-Megapixel camera. When this study was done, a 41-megapixel camera was impossible to buy at any price. These remarkable changes have allowed cameras to become ubiquitous, and have facilitated law enforcement activities using facial recognition.

Likewise, iris recognition was in its early days about six years ago, but it is now recognized as the most efficient and effective biometric when comparing one template with many records. A prime example of the scalability of biometric enrollment and verification is the Unique Identification (UID) program in India. There are 425 million Indian citizens now enrolled in that national ID program, with a goal of enrolling 600 million by 2014.

Biometric Exit Systems around the World

Australia has an eGate based on facial recognition and ePassports called Smart- Gate. SmartGate has since been expanded to New Zealand and has processed a combined 15.1 million passengers since 2007. Currently, there are over 150 eGate systems within 24 international airports across eight countries, processing over one million passengers per month.

Other major deployments include fingerprint-based systems in France and Indonesia; iris recognition systems in the United Kingdom and the United Arab Emirates; and facial recognition systems in Germany and the Czech Republic. Many of these systems are not limited to ePassport holders of the host country. Of the systems mentioned, holders of second generation American ePassports are able to use Australia and New Zealand’s SmartGate and the French Parafe, and the systems in France, the United Kingdom, Germany and the Czech Republic are open to all second generation ePassport holders of the European Union.

Closer to home, a collaborative partnership between government agencies, known as the Apex Air Entry/Exit Re-Engineering (AEER) project, is evaluating a variety of readily available biometric applications in a Maryland testing facility designed to replicate airport environments. This testing is squarely focused on helping the U.S. increase screening capacity to accommodate growing traveler volumes and identifying cost-effective biometric exit solutions to meet the requirements of the law.

Considering the significant advances in biometric technology, dramatically falling costs and successful implementations worldwide, it is clear that a fully functioning biometric exit system is quite practical in airport settings without disrupting legitimate trade and travel. Nearly 12 years since the 9/11 Commission recommended it and 17 years since Congress mandated it, biometric technology to verify that foreigners have left the country when scheduled is more than ready for deployment in U.S. airports.

This article originally appeared in the October 2014 issue of Security Today.