Public Attitudes to the use of Biometrics in Transport Smartcard Schemes

Phil BlytheProfessor of Intelligent Transport SystemsDirector:Transport Operations Research Group,University of Newcastle upon Tyne

SNF Northern Showcase Event, Kingston Park, 26th October 2004

Structure Why Biometrics Identity Theft Authentication and

Identification Options Biometric Characteristics Assessment of Options Applications of

biometrics in Transport Attitudinal Questionnaire Summary of Findings

TORG Research in Area of Smartcards

TORG is an established centre of excellence in the area of smartcard research.

Research covers application development, standards, policy, innovative service delivery, market/business analysis and expert advice to Governments, local authorities and agencies.

Developed an innovative solution for smartcard applications software for a high-speed multi-lane electronic tolling and Congestion charging application Coordinated a highly successful Integrated Applications of Digital Sites project In the 4th Framework which developed a framework for future citizen-based Smartcards. More than 2 million cards are now in use.Developed the University smart campus card using the DISTINCT architecture

Integrated Transport Smartcard Organisation has developed an Interoperable ticketing specification for the UK. TORG undertook the initial auditing role for the ITSO steering committee As well as a study of the implication for legacy smartcard ticketing schemes

TORG is a member of the Transport Card Forum Steering Committeeand advises on smartcard standards and emerging technologies

TORG is a member of the eEurope smartcard charter

TORG is a member of the North East Regional Smartcard Consortium Steering Committee. They provide advice and research to support the development of a region-wide local authority and transport smartcard schemeTORG provided expertise to the eEnvoy’s Smartcard Policy Working Group ( SCPWG) which is developing a policy Framework for the future of Government SmartcardsTORG provides expertise on policy and standardisation to European and International bodies

Why Biometrics? Smartcards are increasingly being used as a

payment and access token by the transportation sector.

High value ticketing (such as an annual rail pass) and the need to ensure the card-holder is indeed who he or she is claiming to be suggest some form of authentication may be required for certain applications.

Following 9/11 criminal activity is not the only concern and identity fraud for terrorist purposes is also a major worry.

Biometrics may offer some solutions to this problem – but not yet well researched within the transport sector

Why? Identify Fraud The total cost of all types of economic fraud in

the United Kingdom is thought to be at least £13.8 billion per annum (Cabinet Office, 2002).

Of this identity theft/fraud is estimated to cost the economy a minimum of £1.3 billion each year, split equally between the public and private sectors (Secretary of State, 2002).

Whilst in America some 1,200 people suffer from identity fraud each day (Etzioni, 1999).

There is growing consensus, between the public and private sectors that the amount of identity fraud is growing in the UK

The problem is increasing!

Figures from CIFAS, the United Kingdom’s fraud prevention service showed an increase of identity fraud of 462% in 2000 compared to 1999 and an increase of a further 122% in 2001 (Cabinet Office, 2002).

3 Elements that make an identity

1. Biographical identity - Which builds up over time. This covers life events and how a person interacts with structured society

2. Attributed identity - The components of a person’s identity that are given at birth, including their full name, date and place of birth, parents’ names and addresses.

3. Biometric identity: Attributes that are unique to an individual, i.e. fingerprints, voice, retina, facial structure, DNA profile, hand geometry, heat radiation, etc.

Source: Cabinet Office 2002

Categories of Authentication

1. Something you know – This generally involves a password, personal identification number code, a secret handshake, mother maiden name etc.

2. Something you have – This generally involves some type of ‘token’ to allow access, e.g. a key, a ticket etc.

3. Something you are – This is a unique individual living trait of some kind that an individual possesses i.e. biometrics.

Level of security increases from 1 -3

Level of Security

Source: Smartcard Alliance (2002)

A Preference for Biometrics

Biometrics are preferred over the other categories of authentication, because:

The person who wishes to ‘gain access’ has to be physically present at the point of identification.

Biometrics removes the need to remember or carry any form of token that can be forgotten, borrowed, lost or stolen.

So, what are the biometric techniques available?

Primary Characteristics and Requirements: Universality – Every person must have the

characteristic. Uniqueness – There must be sufficient

variability of the characteristic in the population that the application will be used within (no 2 people can be exactly the same).

Persistence – The characteristic must not change with time or be changeable.

Collectability – The characteristic must be easily accessible for collection in a quantitative measurement.

Main Biometric Behavioural and Physical Characteristics

Physical Antibody signatures Blood chemistry Deoxyribonucleic acid (DNA) Ear structure Face Finger Fingerprint Hand geometry Iris scan Nail bed analysis (ridges in finger

nails) Odor (scent) analysis Retina scan Skull measurement Sweat pore analysis Teeth Vascular (vein) heat patterns Voice verification (pioneering

technique)

Behavioural Gait recognition (manner of walking) Keystroke dynamics analysis

(typing patterns) Signature (look) Signature geometry (look as well as

pen pressure, signature speed etc.) Driving style …etc

To be practical? For transport services the biometric

measure must be:Readily accessibleStorable (on a smart card/in a central

system)Non-intrusiveFast(ish) to processSecure and fraud-proofAddress privacy and DPA concerns…. and be reliable to measure…. ….. at an acceptable cost.

Which culminates in a current market share for the leading techniques:

13%

36%17%

5%7%

20% 2%Voice

Fingerprint

Face

Signature

Iris

Hand

Other

Source, Logica 2002

Considering applications in the Transport Sector

Airport Security Airport Check-in General Travel ID Passport Control Vehicle Security Vehicle Preferences

(customised to a particular driver)

Access Control

Transport Sector Applications Employees ID Secure Parking High-Value Ticketing Identification of

Individuals who may be exempt from charges (i.e congestion charging)

Driving licence

Template: On ID Card?

Hand/Finger Scan

Retina Scan

Determining which biometric techniques may be acceptable

Prior to considering what biometric techniques are most applicable for implementation in the transport sector it is necessary to obtain a ‘feel’ as to how such techniques are perceived and understood by the public and which, if any, is accepted by them

Public attitudes Questionnaire In the summer of 2003 a questionnaire was

designed that to examine 4 aspects of attitudes to biometrics: To establish whether the population know what biometrics are. To establish whether the potential user population would be

willing to use a biometric authentication systems in order to identify themselves.

To establish which would be the most preferred options for the way a biometric system is setup e.g. storage template method, most preferred biometric authentication method, etc.

To establish if a biometric system was introduced would there be a need to educate users how to use it.

Questionnaire

The questionnaire was piloted in July 2003

Surveys took place in Newcastle and Manchester in July to September 2003

Second Round Surveys February/March 2004

Sample population by age

61 Or Over

51 To 60

41 To 50

31 To 40

21 To 30

20 Or Under

Missing

Fre

qu

en

cy

100

80

60

40

20

09

39

52

58

92

8

Female respondents: 130Male respondents: 127No gender declared!: 2

Knowledge of biometrics

Knew What Biometrics Means

NoYes

%

100

90

80

70

60

50

40

30

20

10

0

Gender

Female

Male

Missing

5147

4951

Overall:

Yes: 53 responses (20%)No: 206 responses (80%)

Similar response forKnowledge of smartcards

Consider themselves IT literate

Consider Themselves To Be IT Literate

NoYes

%

100

90

80

70

60

50

40

30

20

10

0

Gender

Female

Male

Missing

6146

38

54

Overall

73% (186) IT Literate26% (71) not IT Literate

IT Literate by Age

Consider Themselves To Be IT Technology Literate

NoYes

%

100

90

80

70

60

50

40

30

20

10

0

Age Category

61 Or Over

51 To 60

41 To 50

31 To 40

21 To 30

20 Or Under

Missing

7

329

20

20

15

25

21

41

Willingness to accept a smartcard identity card in order to access certain service?

Willingness To Accept Smart Card ID Card

Definitely

Probably

Unsure

Probably Not

Definitely Not

Fre

qu

en

cy

160

140

120

100

80

60

40

20

0

62

146

34

14

Most Preferred Biometric Method

Most Preferred Biometric Method

No Preference

Voice

Signature

Iris

Hand

Fingerprint

Face

Missing

Fre

qu

en

cy

100

80

60

40

20

0

25

711

48

26

94

39

9

Least Preferred Biometric

Least Preferred Biometric Method

No Preference

Voice

Signature

Iris

Hand

Fingerprint

Face

Missing

Fre

qu

en

cy

80

60

40

20

0

25

63

70

33

4

12

42

10

Rank order of preferenceBiometric Method

Most Preferred Frequency

Least Preferred Frequency

Most – Least Preferred

Frequencies

Rank Order Preference

Fingerprint 94 12 82 1st

Hand 26 4 22 2nd

Iris 48 33 15 3rd

Face 39 42 - 3 4th

Voice 7 63 - 56 5th

Signature 11 70 - 59 6th

Would you accept a smartcard Identity card if it contained your preferred biometric method?

Willingness To Accept Biometric Smart Card ID Card

Definitely

Probably

Unsure

Probably Not

Definitely Not

Fre

qu

en

cy

160

140

120

100

80

60

40

20

0

65

144

30

12

0

20

40

60

80

100

120

140

Missing

Would definitely not use

Would probably not use

Unsure

Would probably use

Would definitely use

Banking

Transport

Willingness to accept most preferred biometric method on a bank card or transport card?

Willingness to accept most preferred biometric method on a bank card?

Willingness To Accept Most Preferred Biometric Method For Banking

Definitely

Probably

Unsure

Probably Not

Definitely Not

%

100

90

80

70

60

50

40

30

20

10

0

Gender

Female

Male

Missing

4550715633

5450

29

44

67

Breakdown by Gender

Preference for the storage of the biometric template

Preferred Method For Storage of Anonymous Biometric Template

WNLBISAT

No Preference

On A Smart Card

Central Database

Missing

Fre

qu

en

cy

120

100

80

60

40

20

0

40

51

114

53

Would you have privacy concerns if you knew a Government Organisation had a copy of your biometric template?

Privacy Concern Level

Definitely

Probably

Unsure

Probably Not

Definitely Not

Missing

Fre

qu

en

cy

100

80

60

40

20

0

49

66

43

84

15

0102030405060708090

100

Would use

Would Probably use

Unsure/no opinion

Would probably not use

Would definatly not use

Passport

Airline Boarding

Access Control

High value PT tickets

Charging Exemptions

Driving Licence

Use of biometrics in Transport

Summary Smartcards clearly offer new means of

payment and access to transport services. Authentication and the validation of a

persons identity is likely to become more of an issue as fraud and identification theft increases

DVLA, Passport Agency and Home office are all advancing plans for biometric smartcards

Revisions to Homeland Security Act (USA)

Summary (2) Biometrics offers a range of methods for

uniquely identifying the individual However, in practice many of these techniques

are not practical for implementation in the transport environment, either due to cost, complexity, the intrusive nature of the biometric or privacy concerns

Few members of the general public are yet aware and knowledgeable of biometrics of smartcards

Because of that they tend to select authentication methods that they are familiar with and understand (like a finger print)

Summary (3) A majority of respondents would be willing to have a

biometric on a smart card for general government, transport and banking applications (with varying degrees of enthusiasm)

Feel that the biometric information should be retained on the smartcard

Would have privacy concerns if a Government Agency held such information

Need for education and making the case why such biometrics may be needed

New round of surveys are complete – will determine whether attitudes have changed in the past 18 months and whether there is now a greater general knowledge of biometrics and associated issues.