EU pushes for safeguards on biometric technologies

Although biometric technologies can contribute to a more secure society, governments need to take measures to inform citizens how the technologies will be used and put privacy protections in place before they are widely adopted, according to a European Commission report released this week.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

The conclusions were outlined in a 166-page report probing the possible effects of biometric technologies on citizens' lives following the European Union's decision to introduce biometric passports, visas, and resident permits into E.U. member states beginning in 2006.

The release of the report came one day before E.U. Commissioner Franco Frattini asked the U.S. to extend its deadline for the introduction of high-tech passports from October 2005 to August 2006 because the security and interoperability of the technology is still being finalized.

The U.S. set out tougher rules following the Sept. 11, 2001, World Trade Center attacks, requiring foreigners to carry passports with digital photographs or electronically embedded information to gain entry to the country. The E.U. has already been granted one extension on the original October 2004 deadline. It now says that of the 25 E.U. member states, only six -- Belgium, Germany, Austria, Finland, Sweden, and Luxembourg -- will be able to issue the new passports by October 2005.

The request for an extension to ensure the security and interoperability of the technology mirrors suggestions laid out in the European Commission report. It concluded that while biometric technologies such as fingerprint, iris and face recognition will help in securing countries' borders as well as creating a "trusted" information society, their use needs to be well tested and defined.

On the technical side, biometrics are vulnerable to errors and can be spoofed, so large-scale field tests are in order, the Commission found. Because biometrics systems are "never 100 percent effective," expectations surrounding their use need to be brought in line with reality, it wrote. It also suggested the creation of fallback procedures to deal with the failures of biometric systems, such as skilled workers who can deal with identification problems.

Privacy and the creation of a "surveillance society" is also a concern, but the Commission proposed that biometrics can be used to enhance privacy because they allow for authentication without revealing a person's identity. It also suggested that when using multiple biometric features the information can be stored separately to limit the erosion of privacy through the linkage of data sets. The Commission encouraged policy measures that increase privacy, saying that they are key to making biometrics acceptable to the public.

Public acceptance of biometrics was listed as a primary goal by the Commission, which not only wants to put the technologies in use across its member sates, but also wants to create a thriving European biometrics industry. Such an industry "is unlikely to emerge by itself and will need kick-starting by governments in their role as launch customers, not as regulators," the report states.

The report identified some key areas for future biometric research which the E.U. could engage in, such as technological development of strong mechanisms for authentication and identity, technical interoperability and research into multimodal biometric systems, which combine more than one identifier, such as face and fingerprint scans. The Commission also emphasized the need for large field trials that provide realistic cost and benefit data and test how biometric technologies can be implemented.

Finally, after an investigation lasting roughly eight months, the Commission emphasized how biometric technologies are poised to spread from their current main use in the public sector to private sector applications. It encouraged the creation of policies to shape the use, interoperability and privacy implications of the technologies before they become an everyday component of peoples' lives.

"Costs will come down, people will become used to them through their travels, and further commercial and civil applications will undoubtedly follow," the report said.

However, without safeguards and thorough testing, there are risks of social exclusion for citizens who choose not to use the technologies or are prevented from doing so through factors such as age or disability, the report warned.