D3.10: Biometrics in identity management

Title: CONVENIENCE

Another benefit and advantage of biometrics – hereby making abstraction of any possible adverse effect of biometrics as described in this report and other studies – is the ability of biometrics to simplify physical access to specific areas, networks and objects. As the biometric characteristic is always carried with the person, there is no risk of forgetting or losing the biometric. This is different with other access keys such as physical keys or personal identification numbers (PINs) as these keys need always to be carried or remembered. In smart cards, the signing functionality and data stored on the card are protected by a PIN. Now biometrics can be used in addition to the PIN, or even replace it, in order to unlock the card’s functionality. In a way, biometrics enhance user authentication indirectly if they are used to unlock a private key needed to perform the authentication.

The advantage of combining biometrics with a PIN is that they allow a finer control over the release of information from the card. They increase security without increasing the complexity towards the user. User acceptance is a critical success factor in eGovernment applications. Therefore it might be a good idea to take into account the preferences of the user and offer the ability to choose which biometric recognition mechanisms should be activated, if any. The potential convenience of integrating biometrics in electronic identity documents can give a boost to user acceptance and is a synergy of the government controlled ID model (Type I) and the convenience model (Type IV b). 

Biometrics is not only an advantage to the benefit of the user-individuals because it is simple to gain access, but also an advantage for the entities which traditionally manage physical or magnetic keys (e.g., a hotel lobby or a car rental company) or passwords. 

Moreover, the use of a biometric characteristic also allows distinguishing amongst multiple users of one product or service, which allows personalisation of the product or service. This area of application of biometrics for convenience is part of a larger area called Human-to-Computer Interaction (HCI). The goal of using biometrics in this case is to improve the performance and the accuracy of interfaces between human beings and computers. The biometrics would in that case allow the machine to recognise the user and to adapt the system to user specific characteristics for recognition tasks. This feature of the use of biometric characteristics and systems could be applied to consumer products, such as cars or personal computers used by different persons. As everyday life may evolve into an ambient intelligence environment with seamless and ubiquitous computing, human-machine interface will gain importance. In case biometrics are used in this context for purely private purposes and are fully controlled by the individuals, the applications would fall in Type IV a convenience model. HCI could however also be applied to an array of different services. In that case, HCI will not be solely controlled by the user (data subject), but also by a commercial organisation, in which case the use of the biometrics would exceed private use and fall in the Type IV b and c convenience model.

Concluding remarks on the advantages and needs of biometrics 

By way of a conclusion, one can say that the increasing popularity of biometric technologies in combination with the association of some of them (e.g. fingerprints) with criminals is followed by an intensified concern over the loss of privacy and potential misuse of biometric data. The security vulnerabilities of current biometric systems and the resulting privacy concerns, however, seem to be mistakenly putting aside the privacy enhancing aspect of biometrics. Thus, an extended legal, social, economical and technical analysis of both positive and negative effects of biometrics on privacy should take place. From the technological perspective, applications must be designed and implemented following a decentralised vision and with the individual being given the ability to control access to his own biometric data, whereas the system should safeguard the individual’s data and include mechanisms for the protection of this data against theft or misappropriation. In fact, biometrics can be privacy enhancing if the technology is designed and implemented with this requirement in mind.