Public Attitudes to the use of Biometrics in Transport Smartcard Schemes Phil Blythe Professor of Intelligent Transport Systems Director:Transport Operations Research Group, University of Newcastle upon Tyne SNF Northern Showcase Event, Kingston Park, 26th October 2004 Structure Why Biometrics Identity Theft Authentication and Identification Options Biometric Characteristics Assessment of Options Applications of biometrics in Transport Attitudinal Questionnaire Summary of Findings TORG Research in Area of Smartcards TORG is an established centre of excellence in the area of smartcard research. Research covers application development, standards, policy, innovative service delivery, market/business analysis and expert advice to Governments, local authorities and agencies. Developed an innovative solution for smartcard applications software for a high-speed multi-lane electronic tolling and Congestion charging application Coordinated a highly successful Integrated Applications of Digital Sites project In the 4th Framework which developed a framework for future citizen-based Smartcards. More than 2 million cards are now in use. Developed the University smart campus card using the DISTINCT architecture Integrated Transport Smartcard Organisation has developed an Interoperable ticketing specification for the UK. TORG undertook the initial auditing role for the ITSO steering committee As well as a study of the implication for legacy smartcard ticketing schemes TORG is a member of the Transport Card Forum Steering Committee and advises on smartcard standards and emerging technologies TORG is a member of the eEurope smartcard charter TORG is a member of the North East Regional Smartcard Consortium Steering Committee. They provide advice and research to support the development of a region-wide local authority and transport smartcard scheme TORG provided expertise to the eEnvoy’s Smartcard Policy Working Group ( SCPWG) which is developing a policy Framework for the future of Government Smartcards TORG provides expertise on policy and standardisation to European and International bodies Why Biometrics? Smartcards are increasingly being used as a payment and access token by the transportation sector. High value ticketing (such as an annual rail pass) and the need to ensure the card-holder is indeed who he or she is claiming to be suggest some form of authentication may be required for certain applications. Following 9/11 criminal activity is not the only concern and identity fraud for terrorist purposes is also a major worry. Biometrics may offer some solutions to this problem – but not yet well researched within the transport sector Why? Identify Fraud The total cost of all types of economic fraud in the United Kingdom is thought to be at least £13.8 billion per annum (Cabinet Office, 2002). Of this identity theft/fraud is estimated to cost the economy a minimum of £1.3 billion each year, split equally between the public and private sectors (Secretary of State, 2002). Whilst in America some 1,200 people suffer from identity fraud each day (Etzioni, 1999). There is growing consensus, between the public and private sectors that the amount of identity fraud is growing in the UK The problem is increasing! Figures from CIFAS, the United Kingdom’s fraud prevention service showed an increase of identity fraud of 462% in 2000 compared to 1999 and an increase of a further 122% in 2001 (Cabinet Office, 2002). 3 Elements that make an identity 1. Biographical identity - Which builds up over time. This covers life events and how a person interacts with structured society 2. Attributed identity - The components of a person’s identity that are given at birth, including their full name, date and place of birth, parents’ names and addresses. 3. Biometric identity: Attributes that are unique to an individual, i.e. fingerprints, voice, retina, facial structure, DNA profile, hand geometry, heat radiation, etc. Source: Cabinet Office 2002 Categories of Authentication 1. Something you know – This generally involves a password, personal identification number code, a secret handshake, mother maiden name etc. 2. Something you have – This generally involves some type of ‘token’ to allow access, e.g. a key, a ticket etc. 3. Something you are – This is a unique individual living trait of some kind that an individual possesses i.e. biometrics. Level of security increases from 1 -3 Level of Security Source: Smartcard Alliance (2002) A Preference for Biometrics Biometrics are preferred over the other categories of authentication, because: The person who wishes to ‘gain access’ has to be physically present at the point of identification. Biometrics removes the need to remember or carry any form of token that can be forgotten, borrowed, lost or stolen. So, what are the biometric techniques available? Primary Characteristics and Requirements: Universality – Every person must have the characteristic. Uniqueness – There must be sufficient variability of the characteristic in the population that the application will be used within (no 2 people can be exactly the same). Persistence – The characteristic must not change with time or be changeable. Collectability – The characteristic must be easily accessible for collection in a quantitative measurement. Main Biometric Behavioural and Physical Characteristics Physical Behavioural Antibody signatures Gait recognition (manner of Blood chemistry walking) Deoxyribonucleic acid (DNA) Keystroke dynamics analysis Ear structure (typing patterns) Face Signature (look) Finger Fingerprint Signature geometry (look as well as pen pressure, signature speed etc.) Hand geometry Driving style Iris scan …etc Nail bed analysis (ridges in finger nails) Odor (scent) analysis Retina scan Skull measurement Sweat pore analysis Teeth Vascular (vein) heat patterns Voice verification (pioneering technique) To be practical? For transport services the biometric measure must be: Readily accessible Storable (on a smart card/in a central system) Non-intrusive Fast(ish) to process Secure and fraud-proof Address privacy and DPA concerns …. and be reliable to measure…. ….. at an acceptable cost. Which culminates in a current market share for the leading techniques: Voice 20% 2% 13% Fingerprint Face Signature 7% 5% 36% Iris 17% Hand Other Source, Logica 2002 Considering applications in the Transport Sector Airport Security Airport Check-in General Travel ID Passport Control Vehicle Security Vehicle Preferences (customised to a particular driver) Access Control Transport Sector Applications Employees ID Secure Parking High-Value Ticketing Identification of Individuals who may be exempt from charges (i.e congestion charging) Driving licence Template: On ID Card? Hand/Finger Scan Retina Scan Determining which biometric techniques may be acceptable Prior to considering what biometric techniques are most applicable for implementation in the transport sector it is necessary to obtain a ‘feel’ as to how such techniques are perceived and understood by the public and which, if any, is accepted by them Public attitudes Questionnaire In the summer of 2003 a questionnaire was designed that to examine 4 aspects of attitudes to biometrics: To establish whether the population know what biometrics are. To establish whether the potential user population would be willing to use a biometric authentication systems in order to identify themselves. To establish which would be the most preferred options for the way a biometric system is setup e.g. storage template method, most preferred biometric authentication method, etc. To establish if a biometric system was introduced would there be a need to educate users how to use it. Questionnaire The questionnaire was piloted in July 2003 Surveys took place in Newcastle and Manchester in July to September 2003 Second Round Surveys February/March 2004 Sample population by age 100 92 Female respondents: 130 80 Male respondents: 127 No gender declared!: 2 60 58 52 40 39 20 8 9 0 Missing 21 To 30 41 To 50 61 Or Ov er 20 Or Under 31 To 40 51 To 60 Knowledge of biometrics 100 47 51 90 Overall: 80 70 Yes: 53 responses (20%) No: 206 responses (80%) 60 % 50 51 49 Similar response for 40 Knowledge of smartcards Gender 30 20 Female 10 Male 0 Missing Yes No Knew What Biometrics Means Consider themselves IT literate 100 46 61 90 Overall 80 70 73% (186) IT Literate 60 26% (71) not IT Literate % 50 54 40 38 Gender 30 20 Female 10 Male 0 Missing Yes No Consider Them selves To Be IT Literate IT Literate by Age 100 7 9 90 32 20 80 Age Category 70 25 60 61 Or Ov er 20 51 To 60 % 50 40 41 41 To 50 15 30 31 To 40 20 21 21 To 30 10 20 Or Under 0 Missing Yes No Consider Them selves To Be IT Technology Literate Willingness to accept a smartcard identity card in order to access certain service? 160 140 146 120 100 80 60 62 40 34 20 14 0 Def initely Not Uns ure Def initely Probably Not Probably Willingness To Accept Smart Card ID Card Most Preferred Biometric Method 100 94 80 60 48 40 39 26 25 20 11 9 7 0 Missing Fingerprint Iris Voice Face Hand Signature No Pref erence Mos t Preferred Biometric Method Least Preferred Biometric 80 70 60 63 40 42 33 25 20 12 10 0 4 Missing Fingerprint Iris Voice Face Hand Signature No Pref erence Leas t Preferred Biometric Method Rank order of preference Biometric Most Preferred Least Preferred Most – Least Rank Order Method Frequency Frequency Preferred Preference Frequencies Fingerprint 94 12 82 1st Hand 26 4 22 2nd Iris 48 33 15 3rd Face 39 42 -3 4th Voice 7 63 - 56 5th Signature 11 70 - 59 6th Would you accept a smartcard Identity card if it contained your preferred biometric method? 160 140 144 120 100 80 60 65 40 30 20 0 12 Def initely Not Uns ure Def initely Probably Not Probably Willingness To Accept Biom etric Smart Card ID Card Willingness to accept most preferred biometric method on a bank card or transport card? 140 120 100 80 60 40 Banking 20 Transport 0 W U W W M W ns is ou ou ou ou s ur ld ld ld ld in e g de pr de pr ob ob fin fin ab ab ite ite l l ly ly y y us no no us e tu e tu se se Willingness to accept most preferred biometric method on a bank card? 100 33 56 71 50 45 90 Breakdown by 80 Gender 70 67 60 % 50 54 50 40 44 Gender 30 29 Female 20 Male 10 0 Missing Def initely Not Uns ure Def initely Probably Not Probably Willingness To Accept Most Preferred Biom etric Method For Banking Preference for the storage of the biometric template 120 114 100 80 60 53 51 40 40 20 0 Missing On A Smart Card WNLBISAT Central Database No Pref erence Preferred Method For Storage of Anonym ous Biometric Template Would you have privacy concerns if you knew a Government Organisation had a copy of your biometric template? 100 80 84 66 60 49 40 43 20 15 0 Missing Probably Not Probably Def initely Not Uns ure Def initely Privacy Concern Level Use of biometrics in Transport 100 90 80 70 60 50 Passport 40 Airline Boarding 30 Access Control 20 High value PT tickets 10 Charging Exemptions 0 Driving Licence W W U W W ns ou ou ou ou ur ld ld ld ld e/ us Pr de pr on ob ob e fin op ab ab at i ly ni l l y y on no no us tu e tu se se Summary Smartcards clearly offer new means of payment and access to transport services. Authentication and the validation of a persons identity is likely to become more of an issue as fraud and identification theft increases DVLA, Passport Agency and Home office are all advancing plans for biometric smartcards Revisions to Homeland Security Act (USA) Summary (2) Biometrics offers a range of methods for uniquely identifying the individual However, in practice many of these techniques are not practical for implementation in the transport environment, either due to cost, complexity, the intrusive nature of the biometric or privacy concerns Few members of the general public are yet aware and knowledgeable of biometrics of smartcards Because of that they tend to select authentication methods that they are familiar with and understand (like a finger print) Summary (3) A majority of respondents would be willing to have a biometric on a smart card for general government, transport and banking applications (with varying degrees of enthusiasm) Feel that the biometric information should be retained on the smartcard Would have privacy concerns if a Government Agency held such information Need for education and making the case why such biometrics may be needed New round of surveys are complete – will determine whether attitudes have changed in the past 18 months and whether there is now a greater general knowledge of biometrics and associated issues.