By Thomas Bush III, Strategic Advisor for BIO-key International
Introduction
Wikipedia defines biometrics as “methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits.” In current use biometrics generally relates to unique physical traits, such as fingerprint, face recognition, hand geometry, and iris recognition.
Biometrics is not new to law enforcement. Fingerprints have been used since the early 1900’s to positively identify individuals in custody and some local agencies are using facial recognition to identify suspects. In the past few years, biometrics has realized significant reductions in hardware costs while producing major improvements in speed and accuracy. As a result, law enforcement agencies are taking a closer look at biometrics to authenticate the identity of their own employees – uniformed and civilian – for applications such as access to agency systems, facilities and other resources.
Satisfying Law Enforcement Authentication Requirements
For virtually every department, the focus on strong user authentication begins with the need to satisfy imminent FBI requirements for access to federal criminal justice data, especially from in-car mobile data system users.
Although the deadline will likely be extended from September of this year to September 2013, the FBI’s Criminal Justice Information System (CJIS) security policy requires “advanced authentication” – another authentication method in addition to a PIN or password - for remote access to CJIS data from any laptop or smartphone. Biometric technologies, such as digital fingerprints, which several agencies have already deployed, can be easily deployed to satisfy this regulation.
In addition to meeting FBI requirements, biometric solutions that provide significant improvement in security while reducing operational costs are being deployed in a variety of applications including:
• Facility Access
o Front doors and restricted areas, such as the Comm Center or dispatch room or evidence locker
• Network Logon
o Computer workstation access, file resources (e.g., confidential data), etc.
• Application Sign on
o Access to specific applications, such as CAD, RMS and intelligence systems, over the internal LAN, intranet or internet
• Integration with the time clock system, ensuring accurate time reporting
Biometric authentication:
• Eliminates badges and cards and their costs
• Eliminates the down time when passwords need to be reset.
• Eliminates the help desk and administration costs associated with passwords
• Improves user convenience
Guidelines for selection: The Four E’s
Biometrics technologies used in any application should be measured against four key criteria:
• Effectiveness: The basic measure of any authentication solution is accuracy. However, biometrics accuracy often comes with a price - in the form of “false negatives” or improper rejection of individuals who should have been successfully authenticated. While this is often be attributed to “user error” – like not placing the finger correctly in the reader – the potential end result in user frustration and time lost in re-authenticating must still be part of the measurement of overall effectiveness.
• Ease of deployment and use: No technology can be effective unless and until it’s operational and in regular use. A “bleeding edge” biometrics solution, even if it’s potentially more effective, may never get out of pilot, and one that users find confusing or cumbersome may not even make it that far. The solution should be easy to deploy and maintain and shouldn’t require significant changes to business processes.
• Enterprise-wide capability: While the agency may deploy an authentication solution to meet a single need today, it makes sense early in the selection process to look at where and how the use of biometrics may be expanded to meet future needs. This can save money and simplify administration. One agency, for example, deployed 800 fingerprint readers to be used by officers to establish their ID when they access mobile data systems based on the ability of the readers to also capture the fingerprints of arrestees when the agency has access to a state offender fingerprint database next year.
• Economic considerations: Keeping costs under control is important – even when budgets aren’t under the strain they are today. So choosing a solution that complies with established federal or industry standards will ensure that the capture hardware costs can be controlled since this hardware can be obtained from multiple sources – initially and over the lifecycle of the system. While the software is usually proprietary, a strong ongoing maintenance and support agreement can help ensure that the software can be enhanced on an ongoing basis, extending the lifecycle of the solution, even as technology changes.
Thomas Bush, III retired from the FBI in 2009 after over 33 years of service. As the Assistant Director of the FBI’s Criminal Justice Services Division (CJIS), he was responsible for the day to day operation of the FBI’s largest division. CJIS is the focal point for a wide range of Federal justice initiatives, including the Integrated Automated Fingerprint Identification System (IAFIS). IAFIS maintains the largest criminal biometric database in the world, containing the fingerprints for more than 60 million subjects. Following his retirement, he established a consulting business, Tom Bush Consulting, LLC.
