Report fingers prints as ID scheme's point of failure

Yet more trouble assails the government’s £4.4bn National Identity Scheme (NIS), as an official report puts the boot into the preferred scheme for “exception handling” – and a bunch of techies show how the recommended system can be beaten. Official trouble comes in the form of the latest annual report (pdf) from the Biometrics …

[Anonymous Coward]

4.4billion pounds

Just imagine the kind of science you could fund with 4.4bn pounds.

Imagine the tax rebates of 4.4 billion pounds.

Imagine all the wonderous things you could do with 4.4 billion pounds if you were in power, and now live with the happy knowledge all that you are going to receive is a broken database with broken ID that shall be forged within months and make it ever more difficult to prove that you are you if someone does steal your data.

We could have a fleet of airships for 4.4 billion pounds >.<

[Anonymous Coward]

Because the over-75s

never have degenerative eye conditions which would thwart that option do they? Oh wait.

[Simon Neill]

Clearly there is only one option....

... and the little green men have discovered it before us.

Colonic maps all round!

[Dan]

£4.4bn my ar$e

I am MUCH more inclined to believe that the London School of Economics figures add up properly rather than the dodgy politically-slanted ones issues by the government - so that'll be nigh on £20 billion then - just imagine what you could do with that AC.

Joke icon, because that scheme is one big one.

[Anonymous Coward]

That's an idea!

Just had a silly idea...

For all the anti-ID people out there (and I am definitely one of them), if/when the government do force this on us all, what about setting up a separate completely public repository of fingerprints (ie - a web site)? I think it could be anonymous (just the prints with no other associated data).

FOI rules should mean that one could request the fingerprint data that the govt has forced out of us, and by making this information publicly available, surely that would render the "official" ID scheme useless (because the integrity of the data it holds would be known to be compromised and therefore provably unreliable).

[Eddie Edwards]

Joined up thinking?

"If other information, such as the location of singular points is available, then it is possible that the original fingerprint can be reconstructed in its entirety."

So they haven't reconstructed the fingerprint from the algorithmic data at all. They need "other information".

"it is not clear whether sufficient details are captured to reconstruct a whole fingerprint."

There is no reason to suppose that this is possible. The best researchers need "other information" so the most plausible answer right now is "no".

"If this does turn out to be the case ..."

And if my Uncle was a woman he'd be my Aunt.

[Richard]

@That's an idea!

Nice idea but I bet the Government will just make it a criminal offence to knowingly publish biometric information that is legally required for identification ... thereby having a very useful side-effect of closing down facebook et al.

[Anonymous Coward]

@£4.4bn my ar$e

With 20 billion we could have a legion of killer robots and a functioning economy!

[The Mole]

Recreation

Surely you don't need to recreate the entire finger print anyway? If the fingerprint readers are identifying based on keypoints all you need to do is generate another pattern that matches with the same keypoints. It doesn't matter if the rest of the area is blank or straight lines as long as the scanner comes up with the same results as the original result. The readers also have to provide a high level of tolerance if they want to ensure that superficial injuries like cuts or burns don't immediately give problems.

[Anonymous Coward]

Only Britain....

....could take a simple id card and turn it into a biometric, biographical computer database storage boondongle that is so invasive it needs to be heavily marketed to the public as a way to prevent identity theft.

And even though this train wreck is crashing into the buffers, they all can't afford to lose face, so whether it costs $4 billion or $40 billion they'll pay the bill rather than look stupid.

But Jacqui can't back down, to do so would appear weak, so we have to go through propaganda, and forums aimed at children filled with fake posts, and the public 'meetings' where those opposed to the scheme are arrested.

http://news.bbc.co.uk/2/hi/uk_news/scotland/7480360.stm

[Anonymous Coward]

Grr...

Over 75s only? What about:

Lab chemists

Hair Dressers

Brickies

Workshop Engineers

Hell you can even remove your own fingerprints, if you want (this was quite popular with a particular class of German migrant upon entering Southern American countries in the mid-to-late 1940s) it just takes a bit of battery acid and ability to deal with a bit of pain.

And iris as fallback? Use of the less reliable more expensive method as fallback? 'tards.

[Anonymous Coward]

@AC 10:21

Dream on - the money is reserved. For averting more Northern Rocks.

Hey, "things can only get better".

[Ash]

@AC (That's an idea!)

No point. Anywhere you drink, anywhere you touch a knife and fork, anywhere you press buttons, use the phone, open a door, click a mouse, or make a cup of tea, you leave your fingerprints.

Instead, i'm investing in a large quantity of superglue to coat my fingertips before the Govt. comes and breaks my fingers to get a print.

Without arrest (For a crime other than failing to provide ID for the database), that's pretty much what it would take.

[Anonymous Coward]

Iris Fallback...

Fine till you get a Black person with really dark eyes.

There's not enough contrast in the iris pics to actually enroll/identify them.

They'll just have to fit us all with RFID tags, tiz the only way to stop Terrorism.

I'll take the coat in the secure bunker which won't let anyone in.

[Chippy-Minton]

Just think...

What you could do with the £20billion from this.

Plus the £50 billion from Northern Rock.

Plus the £2-3 billion per year from not fighting two wars.

Plus the £4billion from not giving our gold away.

Surely free hovver cars on the NHS?

I've never in all my life lived under such a bunch of incompetent wasters as these clowns. It's no mystery why we have around a trillion of public national debt.

[James]

@Eddie Edwards

Who says you need to reconstruct the whole fingerprint? You'd only need to reconstruct enough to produce something that will fool a scanner. How about forensic science, you know, those chaps who can secure convictions using partial fingerprints? Even if it's not possible right this minute, I'd put money on the techies getting better reconstructions far faster than this tech-dazzled government will wise up to either information security or why biometrics are fatally flawed.

Paris cos there's (quite astonishingly) a "Govermental Stupidity" icon. Ideas on what that should look like to the usual address at El Reg ;)

[Anonymous Coward]

Fingers

I wonder how long it will take before gangs start stealing the fingers that are used for identification purposes

PH : Because she can take more than one finger.

[James]

Focalism

This is just one more example of what is termed Focalism - focusing too much on the event in question and not enough on the consequences of other future events.

Projects, IT and otherwise, and those involved in these projects all too frequently suffer from focalism. Those involved consider only the focal event - the project - and do not consider the consequences of other events that are likely to occur. The projects acquires a momentum all of its own. Saying stop is not tolerated and seen as treachery and taken personally by those who have invested so much in the project.

In reality, there is no such thing as the point of no return in projects such as this. They can be cancelled at any time. They should be constantly reviewed to avoid the bias of focalism.

Gordon Brown simply cannot admit that he is wrong - on 10p tax rate, on car tax, on 42-day detention, on ID cards. He would rather spend more - such as 10p tax rate - that admit he is wrong and go back.

[TC]

@Fraser

Chemists = Terrorists ('yes Sir, we know its fertilizer, now where's the rest...)

Hair Dressers = Communication links for Terrorist cells (well they chat don't they?)

Brickies = Foreign no-gooders (Poles, didn't they used to be Commies?)

Workshop Engineers = Labourers = who cares, are they middle class?

fingerprint = (Wavelet?) transform of data = data reduction (FBI style)

Off The Shelf kit = hacked, cracked and broken

Well designed upgradeable custom kit = expensive, non-market driven non-competitive, oh, of course a bit difficult for a bunch of lawyers to get right.

Discussions of how things can go oh so easily pear shaped = difficult (see above) because it involves some understanding of Maths/probability/engineering/design (see above), also see any discussion about science Vs woo. This project is WOO WOO through and through.

[Anonymous Coward]

ha ha ha love the CLAs (Capitalised Letter Abreviations)

Missed one though. This really is a load of Biometric User Licence Lasting Some Horribly Indeterminate Time.

[david wilson]

@Fraser

>>"And iris as fallback? Use of the less reliable more expensive method as fallback? 'tards"

Doesn't it make some sense to use a more expensive method as a backup?

That means somewhere where ID is checked (airport, etc), you only need a few of the more expensive iris scanners (possibly backed up with expensive staff?), and lots of the cheaper fingerprint ones.

Even if they're less reliable in general, if they're only covering a gap in the cheaper system, the number of errors may not be too great.

[Scott]

Great Idea

When you go in to get a home loan and the ID checks come back your fred bloggs from Manchester, sorry mate ain't me it was fred bloggs that borrowed all that cash go see him.....sweet free money for all...

Like someone commented above rectal scans for all by the looks of it.

[Anonymous Coward]

ha ha ha love the CLAs (Capitalised Letter Abbreviations)

Missed one though. This really is a load of Biometric User Licence Lasting Some Horribly Indeterminate Time.

[Tom]

@ Eddie

"reconstructed the fingerprint from the algorithmic data"

If the equipment used is compatible in both systems then the data from one system can be imported into another. They may not know who the data belongs to but if they can match it with data from another system where they do know who you are...

They don't need to reconstruct the fingerprint if they can match it with known data, it's like a super Google cookie that you can never delete.

[David Hicks]

I stil don't get the "why" here

I'm against the proposition anyway, ID cards are not something I'm willing to participate in, but I still haven't heard a single good reason why the government even want them, forge-able and insecure or otherwise. I certainly don't know what benefit the citizens of the UK will get out of all this expenditure, even if the system somehow proved perfect and incorruptible.

I guess I'll just file it under "Expensive things the government are doing that the people don't want" with all the other rubbish. I'll make sure to add a cross-reference to "Police State" though.

Paris, because I don't have a clue either

[philbo]

er.. your retina ain't your iris

After working with biometrics (mainly fingerprint recognition) for over a decade, this report is ridiculously old news: the government is guilty (again) of believing what the biometrics salesmen told them about improving technology being able to get around the problems seen in trials.. the problem is, that the technology hasn't, and fundamentally *can't* get round what you do with people with no usable fingerprints, irises (5% of the population... plus those who get hay fever or colds) or even retinas (though retinal scanning was never on the cards - for anyone who's ever tried it, the reasons why are obvious).

And anyone who has ever touched a hot iron with their fingertips, then tried to use a fingerprint reader knows it's very easy to at least temporarily erase your prints.

This government needs to stop taking advice from the people who are going to make lots (and LOTS) of money from the courses of action they recommend - the ID card project looks like it may well be the biggest waste of government money so far... that is, until the next one

...the faceless icon with no obvious iris pattern..

[Anton Ivanov]

Over 75 my a****

Have these guys ever tried taking the fingerprints of a builder using an automated reader? It is close to impossible and for tiling and bathroom people outright impossible. Their fingerprints cannot be read. Same for car mechanics and many other professions who have their precious "ID" metric damaged on a daily basis. Add to that children, add to that over 75 and end of the day the only people who can be fingerprinted are the Whitehall mandarin themselves.

So why don't they call it "biometric government employee card" and get over with it. It will be useless for everyone else.

[Anonymous Coward]

Problem solved.

Kill everyone over 75.

[Anonymous Coward]

NPL had something to say on this a while ago

Dr. Tony Mansfield's group at NPL did some interesting work for CESG.

In summary there findings on practical biometrics were in this short document.

http://www.npl.co.uk/upload/pdf/biometrics_psrevho.pdf

But if you dig around there's a lot more:

http://www.npl.co.uk/server.php?show=nav.474

So far as fingerprint scanners go, they work by running the scanned print through an algorithm and matching the result against a database of encoded prints. However you would normally maintain a separate database of finger print images if you need to provide the match as evidence. If it's part of a two factor authentication then you don't need to be able to reconstruct a fingerprint. When this fails, you have to have manual procedures to resolve the failure. False negatives are usually resolved by swiping the finger again, but when they are not, then the user's identity would have to be re-established.

There are plenty of people who have no scanable fingerprints, some of whom are blind, so manual procedures are needed to cover them. Where I suspect NIS will fall down, is that because these people only represent a fraction of a percent of the population, and small percentages don't interest managers or politicians, and they don't understand how many people it actually relates too, as yesterdays bit on CRB illustrated.

0.01% of the UK Population is still thousands of people.

[Andrew Culpeck]

What do the fingerprint readers read

“It is not possible to recreate a fingerprint using the numbers that are stored”

If the fingerprint readers only store the coordinates of key features, then all you need to steal are the numers that are stored and fill in the blanks in a way that will not create new features or numbers. This will create a fingerprint that will fall the reader.

I give it a week before someone writes the software to do this, afterall creating a fulse national ID is at stake so there is plenty of insentive.

I suspect it will take a while before a machine is avalible to print these fingerprints out, unless we use a printer and possibly special inks?

STOP - because we should stop this waist of money now

[Clive Powell]

Misreading

For some bizzare reason, whilst reading the article and comments, my Iris was seeing retina, but my brain was translating this to either rectal or rectum. Maybe an idea, a rectal scanner ("Xmas party time, climb on board the photo copier").

Paris because from the internet videos it might be easy to copy her rectal image.

[Anonymous Coward]

We are in a recession

can they be wasting 4.4Billion at the moment.

ID will not generate revenue, instead it will put a layer of red tape around all activity, further depressing our economy. Is it the intention of the current government to completely wreck this country, then move abroad, because their actions so far appear to be demonstrating this.

[philbo]

@Anton Ivanov

> Have these guys ever tried taking the fingerprints of a builder using an automated reader?

I have (or rather a system that I wrote has), as it happens - on average, the builders & brickies had considerably better prints than the general population (given that most turned up to work with barrier cream on, which definitely enhanced the fingerprint quality)

[Charles Tsang]

Removing fingerprints

To those enamoured with the idea of removing their fingerprints, I heard that it's quite difficult to pick up coins from a flat surface without the grooves and swirls.

[Anonymous Coward]

The problem isn't...

...in recording and creating a good copy of the fingerprint in the controlled, well-maintained conditions of your locall <strike>SS HQ</strike> Identity office, but in the false fails that will be generated in the real world. By the end of the day, that brickie's prints are gone, to all intents and purposes, so if there's any need to prove their ID after work (to buy alcohol, maybe, or anything at all, if the Banks decide that ID is needed to use credit/debit cards), they'll be stuffed, and there won't *be* a backup system. So anyone who wants to fall off the ID radar just needs to do some serious sanding, and use that to explain why their prints don't match the card biometric...

[Anonymous Coward]

Biometric data should not be confidential

Biometric data is not confidential and any system that depended on its confidentiality to mitigate a significant level of risk would be broken. The key point is that the conditions under which biometric data is captured must be under control of the risk holder.

Unless everyone is going to permanently wear gloves and dark glasses, capture of biometric data by any unknow member of the public is perfectly possible. The important point is that even if such data (finerprint on beer glass, iris in photo) were in the hands of an attacker, it should not be exploitable. Hence the need for the risk holder to assure themselves that captured biometric data is that of the individual and not injected from a different source.

[Dodgy Geezer]

Some useful information...

"If the fingerprint readers are identifying based on keypoints all you need to do is generate another pattern that matches with the same keypoints. It doesn't matter if the rest of the area is blank or straight lines.."

The readers typically identify a number of points in the print where lines or whorls cross or stop. Then they encode that data and that is your record. They don't 'store a fingerprint' in any meaningful sense..

"And anyone who has ever touched a hot iron with their fingertips, then tried to use a fingerprint reader knows it's very easy to at least temporarily erase your prints."

So now you know just the points on your fingers to touch with a hot iron before being scanned. If done gently, accurately and quickly it should be fairly painless......

"Have these guys ever tried taking the fingerprints of a builder using an automated reader?...I have (or rather a system that I wrote has), as it happens - on average, the builders & brickies had considerably better prints than the general population"

I would guess that hands with large amounts of superficial damage, such as builders (if they don't wear gloves) would have no problems registering an initial scan, but might have major problems giving reproducible matching scans some weeks later. Is this the case?

I am sure that, faced with a civil disobedience campaign of damaging fingerprints, the fingerprint ID plan won't work. Has anyone got any plans for subverting the iris scan yet?

[David]

Removing fingerprints

Apparently Pineapple Juice contains enzymes that digests your fingerprints, prolonged exposure can remove them permanently. I say apparently because I heard that fact on QI. Worth a try though

[bob_blah]

Two weeks to go!!

and then I can leave this country and its ID malarky to you, the poor citizens of the UK.

If I had chosen to remain in the UK, I would have been amongst the first group to have been fingerprinted for a new work visa. Trying to explain to my boss and colleagues that I was leaving because I don't trust the UK government met with an interesting array of reactions, from the 'good on you' to 'but if you've got nothing to hide...'

Funny how after I then went on to explain that I was the lucky one, because I _could_ leave, and that they were stuck with it, and within the next 5 years they wouldn't have a choice in handing over their fingerprints to the UK government did they quickly grasp that I wasn't just some looney antipodean with something to hide.

Bring on China and their libertarian society!

[michael]

@Dodgy Geezer

*I am sure that, faced with a civil disobedience campaign of damaging fingerprints, the fingerprint ID plan won't work. Has anyone got any plans for subverting the iris scan yet?*

contacts?

cost?

the reasion the gov i not using iris scanners in the first place

[RW]

Jacqui weak?

AC @ 11:29 GMT: "Jacqui can't back down, to do so would appear weak"

Funny how those types don't realize that their adamant refusal to admit they're wrong about *anything* utterly destroys their credibility. I suppose their thought process is something like "we possess the perfect ideology, hence our ideologically informed decisions cannot be wrong,. to admit they are means our ideology is flawed, and that is impossible." Hence they are never wrong.

Most El Reg types have probably seen this on one or another online forum of some sort: nothing establishes your credibility like saying "I was wrong". The ego-defensive types who hang on to obviously mistaken points of view or information just become laughing stocks -- just like NuLab and the idiots in it.

From where I sit, it looks like Jacqui, Gordon, and all the rest are way in over their heads, haven't a clue how to govern Britain, so they're constantly falling back on cheap shots and trivialities like the ID scheme, Gordon's laughable "don't throw away food" advice. I sometimes wonder if their briefing notes are clippings from the Mail and the Sun.

[Dennis]

Re: Iris Fallback...

"They'll just have to fit us all with RFID tags, tiz the only way to stop Terrorism."

Damn. Not another field modification. I've only just had the barcode tattooed on the back of my neck. Trouble is, I think it includes a 'best before date'.

[Amanda]

Good job I don't live there...

Because I accidentally remove parts of my fingerprints every few months due to clumsiness or inattention in the kitchen. Fortunately, my reflexes are fast enough that I just graze my fingertips against 400-500 degree pans only long enough to give a first-degree burn (no blistering). The tips of my fingers were slick for two weeks after that.

I'm sure my home country (USA! USA!) is trying to figure out how to implement some form of this foolishness in that "REAL ID" mess, and am only surprised we didn't get around to thinking about it before the UK did.

[Anonymous Coward]

@focalism - Gordon Brown simply cannot admit that he is wrong

I seem to remember a couple of thousand years ago a chap called Hadrian knocking up a large long wall to try and stop those from over the border coming down and destroying everything to the south. There have been several attempts over the years but lets look at the facts. Since 1997 two people from North of the border have done more damage to those of us in the South than two world wars managed.

Gordon Brown wrong! Never, he is just fulfilling every Scots schoolboy fantasy of stuffing it to the rest of the island.

[Steve B]

these prats never learn....

“cost and performance options, with a minimum level of acceptable performance”

is stipulated and that is exactly what they will get - A costly system with the minimum acceptable performance.

[philbo]

@Dodgy Geezer

>So now you know just the points on your fingers to touch with a hot iron before

>being scanned. If done gently, accurately and quickly it should be fairly painless......

I usually find if I touch an iron by mistake it's not that painless.. but the effect on the skin is very obvious on a fingerprint reader - I had a thick white line right through the scanned print, and it was a week or two before I could use that finger to get into the building...

> would guess that hands with large amounts of superficial damage, such as

> builders (if they don't wear gloves) would have no problems registering an initial

> scan, but might have major problems giving reproducible matching scans some

> weeks later. Is this the case?

A lot depends on how they treat their hands - one or two minor scars don't affect fingerprints that much; barrier cream softens the skin and enhances the FP capture considerably. I have come across quite a few people with no usable fingerprints whatsoever: the majority were old women who'd probably spent their lives working their fingers to the bone.. at least metaphorically... one was a solicitor who probably hadn't done a minute's manual labour in his life.

> Has anyone got any plans for subverting the iris scan yet?

Hay fever... or onions ;-)

http://www.theregister.co.uk/2004/05/07/watery_eyes_iris_scan/

[Chris G]

Paranoid? Who? Me?

I have a theory that all the things like fingerprints, irises and rectal scans to read your ( hopefully ) well protected sphincters, are supposed to fail, the reason being that when finally all are proven useless the govuk will be able to insist on inserting a chip into each and every one of you. Probably at birth and into bone that will grow around the chip so that it is difficult to mess with. I thankfully don't live in the UK and although the nanny state attitude is slowly being taken up by other countries I will most likely be dead of old age before they get it working in Spain. Of course wearing a foil coat will be punishable by far greater penalties than would apply to kicking an old lady to death. Who remembers Harold Wilson's phrase for Labour? `You know it makes sense´.

[quester]

Paranoid? Who? Me?

well said!

[marc bolan]

Fingerprints

Well I've got no objection to having my fingerprints taken, I just hope that some nasty person doesn't clone them and then spread them far and wide, such as to every gov dept, lamp post, and police station for example,[by registered post, for security you see, ] 'cos that would make them unreliable methinks.And please god not on the internet either.

Wouldn't it be awful if that happened, no use in a court of law, seeing as how they're in the public domain, and of course "unhelpful" wrt id card thingys.

Now I DO NOT BELIEVE that Gordy or Dave would use that as an excuse to implant a chippy thingy in my bottom 'cos, as any electronics bod will tell you, semiconductors are extremely sensitive to certain types of radiation and that would require me to walk around in a tinfoil catsuit[and hat][and mask][you get the idea].

I think I'd also be inclined to avoid ignition systems like the plague as well 'cos, well, you never know,high voltage radio transmitters and all that.

Hope this convinces all you doubters and thingys.Have a nice day now.

[Anonymous Coward]

Some bugger (this is a true story, no ID required)

nicked me name, address and phone number the other day. They tried to set up an account with some share trader. I got a letter asking me to deposit €500 and if I could activate the account. Anyway the convo went like this:

Me: Hello. I got a letter this morning asking me to register an account with the stuff you sent me.

Them: Oh, yes OK.

Me: I haven't opened this account.

Them: Oh, I'll pass you on to customer services.

Them: Hello, customer services

Me: This account you're trying to open for me, I don't want it nor have I authorised it.

Them: OK

Me: Can you give me the details of what you have?

Them: Yes.

<name>[right]

<address>[right]

<phone>[right, but numbers in wrong order]

<date of birth>[wrong]

<e-Mail>[wrong]

Me: This is NOT ME!!! Some stuff is wrong. Close this account.

Them: OK - we've closed it. Check your bank etc etc.

The rest of the day was then spent checking everything, fortunately nothing suspicious has happened. However, had this site opened an account for me and deposited said €500, I would be the one being chased for it, copping any comeback. During the convo they mentioned that it had been done before.

A stolen address and phone number is enough to cause folk all sorts of problems, let alone a whole set of biometrics. Biometrics assumes that entropy (e.g bindness or accidents such as chopping off fingers, newly emerging gene therapy etc) doesn't happen, so it's doomed to fail. It proves one thing: You can't prove who you are; all you have is supporting evidence.