	Biometric Technologies for Personal Identification

When used for personal identification, biometric technologies measure  and analyze human physiological and behavioral characteristics. The corresponding biometric  technologies are fingerprint recognition, hand geometry, and facial, retina,  and iris recognition. Depending on the application, biometric systems can be used in one of  two modes: verification or identification. Leading Biometric Technologies

			Facial Recognition

Retina Recognition    Signature Recognition    Speaker Recognition Facial recognition technology identifies people by analyzing features of  the face not easily altered—the upper outlines of the eye sockets, the  areas around the cheekbones, and the sides of the mouth. Speaker recognition can be used to verify a person’s claimed identity or to  identify a particular person. Federal Applications of Biometric Technologies

Biometrics have been used in several federal applications including access  control to facilities and computers, criminal identification, and border  security. In the last 2 years, laws have been passed that will require a  more extensive use of biometric technologies in the federal government. Laws passed in the last 2 years require a more extensive use of biometrics  for border control. Weaknesses in the security process or failures by  people to operate the technology or implement the security process can  diminish the effectiveness of technology. As we described, not all people can enroll in a biometrics system. Similarly, false matches and false nonmatches will also sometimes occur. Procedures need to be developed to handle these situations. Exception  processing that is not as good as biometric-based primary processing  could be exploited as a security hole. In conclusion, biometric technologies are available today that can be used  in security systems to help protect assets. However, it is important to bear  in mind that effective security cannot be achieved by relying on  technology alone. Technology and people must work together as part of an  overall security process. As we have pointed out, weaknesses in any of  these areas diminishes the effectiveness of the security process. We have  found that three key considerations need to be addressed before a  decision is made to design, develop, and implement biometrics into a  security system:  1. Decisions must be made on how the technology will be used. A detailed cost-benefit analysis must be conducted to determine that  the benefits gained from a system outweigh the costs. 3. A trade-off analysis must be conducted between the increased  security, which the use of biometrics would provide, and the effect on  areas such as privacy and convenience. Security concerns need to be balanced with practical cost and operational  considerations as well as political and economic interests. A risk  management approach can help federal agencies identify and address  security concerns. As federal agencies consider the development of  security systems with biometrics, they need to define what the high-level  goals of this system would be and develop the concept of operations that  will embody the people, process, and technologies required to achieve  these goals. With these answers, the proper role of biometric technologies  in security can be determined. If these details are not resolved, the  estimated cost and performance of the resulting system will be at risk.
Why GAO Did This Study

One of the primary functions of any security system is the control of people into or out of protected areas, such as physical buildings, information systems, and our national border. Technologies called biometrics can automate the identification of people by one or more of their distinct physical or behavioral characteristics. The term biometrics covers a wide range of technologies that can be used to verify identity by measuring and analyzing human characteristics--relying on attributes of the individual instead of things the individual may have or know. In the last 2 years, laws have been passed that will require a more extensive use of biometric technologies in the federal government. Last year, GAO conducted a technology assessment on the use of biometrics for border security. GAO was asked to testify about the issues that it raised in the report, the use of biometrics in the federal government, and the current state of the technology.

What GAO Found

Biometric technologies are available today that can be used in security systems to help protect assets. Biometric technologies vary in complexity, capabilities, and performance and can be used to verify or establish a person's identity. Leading biometric technologies include facial recognition, fingerprint recognition, hand geometry, iris recognition, retina recognition, signature recognition, and speaker recognition. Biometric technologies have been used in federal applications such as access control, criminal identification, and border security. However, it is important to bear in mind that effective security cannot be achieved by relying on technology alone. Technology and people must work together as part of an overall security process. Weaknesses in any of these areas diminishes the effectiveness of the security process. The security process needs to account for limitations in biometric technology. For example, some people cannot enroll in a biometrics system. Similarly, errors sometimes occur during matching operations. Procedures need to be developed to handle these situations. Exception processing that is not as good as biometric-based primary processing could also be exploited as a security hole. We have found that three key considerations need to be addressed before a decision is made to design, develop, and implement biometrics into a security system: (1) decisions must be made on how the technology will be used; (2) a detailed cost-benefit analysis must be conducted to determine that the benefits gained from a system outweigh the costs; and (3) a trade-off analysis must be conducted between the increased security, which the use of biometrics would provide, and the effect on areas such as privacy and convenience. Security concerns need to be balanced with practical cost and operational considerations as well as political and economic interests. A risk management approach can help federal agencies identify and address security concerns. As federal agencies consider the development of security systems with biometrics, they need to define what the high-level goals of this system will be and develop the concept of operations that will embody the people, process, and technologies required to achieve these goals. With these answers, the proper role of biometric technologies in security can be determined. If these details are not resolved, the estimated cost and performance of the resulting system will be at risk.