What do I need to know about biometrics?
Introduction to biometrics. Since the tragic events of September 11th in the US and, more recently, in the EU, there has been an increased demand for security measures. The use of biometric features – such as fingerprints, iris recognition, face and hand geometry – to identify or authenticate an individual is, under appropriate conditions, the only tool which can confirm an individual’s identity, based on unique and non-reproducible features. In many countries exposed to the risk of terrorist attacks, including the USA and the countries of the EU, the integration of biometric features in passports is being discussed. Identification processes would thus become more reliable. Within this context, initiatives have been promoted in Italy too, where biometric passports and residence permits – still at the experimental stage – will be introduced. The remarkable potentials offered by biometric technologies to authenticate identities have brought about a widespread interest in these technologies which is not only limited to investigation and prevention. The problems originating from the rapid digitalisation of information and the widespread use of networks are of crucial importance in terms of security in data access and online services. The first problem any public or private organisation faces when dealing with identification is to be sure that, whomever accesses confidential or sensitive sources of information, is really who they state they are. The most common measures adopted today are based on password login and are sometimes unable to guarantee an appropriate security level. With the exception of AFIS applications, biometric technologies used in the Italian public administration were, up to few years ago, limited to devices controlling access to sensitive areas, e.g. military sites. However, public services are now increasingly interested in biometric technologies to gain control over access to critical computer applications or sensitive data from employees or users of online services. An example of this is E-POLL, the electronic voting experiment carried out in Italy under the EU fifth Framework Programme for Research and Development using a smart card with an embedded fingerprint reader authenticating the identity of a citizen and voter. The combined use of biometric data and smart card makes it possible to assert the legal ownership of a specific card on the basis of “stronger” features than a normal PIN code. Furthermore, smart cards containing users' biometric data allow a more simple management of privacy issues. Therefore, the combined use of the two devices mentioned above lends itself both to contexts where authentication is of critical importance (e.g. digital signatures) and to a general control of physical and logical access of employees (e.g. multi-service smart card for the Italian Ministry of Defence). Study group on biometric technologies. Considering the importance biometric technologies can have in e-government and, more generally, in the relations between citizens and institutions, the CNIPA (National Centre for Information Technology in Public Administration) has decided to carry out an in-depth analysis of technical and regulatory aspects of biometrics and its fields of application, with particular attention to e-government. The CNIPA set up a study group on biometric technologies in July 2003 which concluded their activities in November 2003 and delivered a report containing: