Public Attitudes to the use of Biometrics in Transport Smartcard Schemes

1. Public Attitudes to the use of Biometrics in Transport Smartcard Schemes Phil Blythe Professor of Intelligent Transport Systems Director:Transport Operations Research Group, University of Newcastle upon Tyne SNF Northern Showcase Event, Kingston Park, 26th October 2004

2. Structure • Why Biometrics • Identity Theft • Authentication and Identification Options • Biometric Characteristics • Assessment of Options • Applications of biometrics in Transport • Attitudinal Questionnaire • Summary of Findings

3. TORG Research in Area of Smartcards • TORG is an established centre of excellence in the area of smartcard research. • Research covers application development, standards, policy, innovative service delivery, market/business analysis and expert advice to Governments, local authorities and agencies.

4. Developed an innovative solution for smartcard applications software for a high-speed multi-lane electronic tolling and Congestion charging application Coordinated a highly successful Integrated Applications of Digital Sites project In the 4th Framework which developed a framework for future citizen-based Smartcards. More than 2 million cards are now in use. Developed the University smart campus card using the DISTINCT architecture Integrated Transport Smartcard Organisation has developed an Interoperable ticketing specification for the UK. TORG undertook the initial auditing role for the ITSO steering committee As well as a study of the implication for legacy smartcard ticketing schemes

5. TORG is a member of the Transport Card Forum Steering Committee and advises on smartcard standards and emerging technologies TORG is a member of the eEurope smartcard charter TORG is a member of the North East Regional Smartcard Consortium Steering Committee. They provide advice and research to support the development of a region-wide local authority and transport smartcard scheme TORG provided expertise to the eEnvoy’s Smartcard Policy Working Group ( SCPWG) which is developing a policy Framework for the future of Government Smartcards TORG provides expertise on policy and standardisation to European and International bodies

6. Why Biometrics? • Smartcards are increasingly being used as a payment and access token by the transportation sector. • High value ticketing (such as an annual rail pass) and the need to ensure the card-holder is indeed who he or she is claiming to be suggest some form of authentication may be required for certain applications. • Following 9/11 criminal activity is not the only concern and identity fraud for terrorist purposes is also a major worry. • Biometrics may offer some solutions to this problem – but not yet well researched within the transport sector

7. Why? Identify Fraud • The total cost of all types of economic fraud in the United Kingdom is thought to be at least £13.8 billion per annum (Cabinet Office, 2002). • Of this identity theft/fraud is estimated to cost the economy a minimum of £1.3 billion each year, split equally between the public and private sectors (Secretary of State, 2002). • Whilst in America some 1,200 people suffer from identity fraud each day (Etzioni, 1999). • There is growing consensus, between the public and private sectors that the amount of identity fraud is growing in the UK

8. The problem is increasing! • Figures from CIFAS, the United Kingdom’s fraud prevention service showed an increase of identity fraud of 462% in 2000 compared to 1999 and an increase of a further 122% in 2001 (Cabinet Office, 2002).

9. 3 Elements that make an identity • 1. Biographical identity - Which builds up over time. This covers life events and how a person interacts with structured society • 2. Attributed identity - The components of a person’s identity that are given at birth, including their full name, date and place of birth, parents’ names and addresses. • 3. Biometric identity: Attributes that are unique to an individual, i.e. fingerprints, voice, retina, facial structure, DNA profile, hand geometry, heat radiation, etc. Source: Cabinet Office 2002

10. Categories of Authentication • Something you know – This generally involves a password, personal identification number code, a secret handshake, mother maiden name etc. • Something you have – This generally involves some type of ‘token’ to allow access, e.g. a key, a ticket etc. • Something you are – This is a unique individual living trait of some kind that an individual possesses i.e. biometrics. Level of security increases from 1 -3

11. Level of Security Source: Smartcard Alliance (2002)

12. A Preference for Biometrics • Biometrics are preferred over the other categories of authentication, because: • The person who wishes to ‘gain access’ has to be physically present at the point of identification. • Biometrics removes the need to remember or carry any form of token that can be forgotten, borrowed, lost or stolen.

13. So, what are the biometric techniques available? • Primary Characteristics and Requirements: • Universality – Every person must have the characteristic. • Uniqueness – There must be sufficient variability of the characteristic in the population that the application will be used within (no 2 people can be exactly the same). • Persistence – The characteristic must not change with time or be changeable. • Collectability – The characteristic must be easily accessible for collection in a quantitative measurement.

14. Physical Antibody signatures Blood chemistry Deoxyribonucleic acid (DNA) Ear structure Face Finger Fingerprint Hand geometry Iris scan Nail bed analysis (ridges in finger nails) Odor (scent) analysis Retina scan Skull measurement Sweat pore analysis Teeth Vascular (vein) heat patterns Voice verification (pioneering technique) Behavioural Gait recognition (manner of walking) Keystroke dynamics analysis (typing patterns) Signature (look) Signature geometry (look as well as pen pressure, signature speed etc.) Driving style …etc Main Biometric Behavioural and Physical Characteristics

15. To be practical? • For transport services the biometric measure must be: • Readily accessible • Storable (on a smart card/in a central system) • Non-intrusive • Fast(ish) to process • Secure and fraud-proof • Address privacy and DPA concerns • …. and be reliable to measure…. • ….. at an acceptable cost.

16. Which culminates in a current market share for the leading techniques: Source, Logica 2002

17. Considering applications in the Transport Sector • Airport Security • Airport Check-in • General Travel ID • Passport Control • Vehicle Security • Vehicle Preferences (customised to a particular driver) • Access Control

18. Transport Sector Applications • Employees ID • Secure Parking • High-Value Ticketing • Identification of Individuals who may be exempt from charges (i.e congestion charging) • Driving licence

19. Template: On ID Card?

20. Hand/Finger Scan

22. Retina Scan

23. Determining which biometric techniques may be acceptable • Prior to considering what biometric techniques are most applicable for implementation in the transport sector it is necessary to obtain a ‘feel’ as to how such techniques are perceived and understood by the public and which, if any, is accepted by them

24. Public attitudes Questionnaire • In the summer of 2003 a questionnaire was designed that to examine 4 aspects of attitudes to biometrics: • To establish whether the population know what biometrics are. • To establish whether the potential user population would be willing to use a biometric authentication systems in order to identify themselves. • To establish which would be the most preferred options for the way a biometric system is setup e.g. storage template method, most preferred biometric authentication method, etc. • To establish if a biometric system was introduced would there be a need to educate users how to use it.

25. Questionnaire • The questionnaire was piloted in July 2003 • Surveys took place in Newcastle and Manchester in July to September 2003 • Second Round Surveys February/March 2004

26. Sample population by age Female respondents: 130 Male respondents: 127 No gender declared!: 2

27. Knowledge of biometrics Overall: Yes: 53 responses (20%) No: 206 responses (80%) Similar response for Knowledge of smartcards

28. Consider themselves IT literate Overall 73% (186) IT Literate 26% (71) not IT Literate

29. IT Literate by Age

30. Willingness to accept a smartcard identity card in order to access certain service?

31. Most Preferred Biometric Method

32. Least Preferred Biometric

33. Rank order of preference

34. Would you accept a smartcard Identity card if it contained your preferred biometric method?

35. Willingness to accept most preferred biometric method on a bank card or transport card?

36. Willingness to accept most preferred biometric method on a bank card? Breakdown by Gender

37. Preference for the storage of the biometric template

38. Would you have privacy concerns if you knew a Government Organisation had a copy of your biometric template?

39. Use of biometrics in Transport

40. Summary • Smartcards clearly offer new means of payment and access to transport services. • Authentication and the validation of a persons identity is likely to become more of an issue as fraud and identification theft increases • DVLA, Passport Agency and Home office are all advancing plans for biometric smartcards • Revisions to Homeland Security Act (USA)

41. Summary (2) • Biometrics offers a range of methods for uniquely identifying the individual • However, in practice many of these techniques are not practical for implementation in the transport environment, either due to cost, complexity, the intrusive nature of the biometric or privacy concerns • Few members of the general public are yet aware and knowledgeable of biometrics of smartcards • Because of that they tend to select authentication methods that they are familiar with and understand (like a finger print)

42. Summary (3) • A majority of respondents would be willing to have a biometric on a smart card for general government, transport and banking applications (with varying degrees of enthusiasm) • Feel that the biometric information should be retained on the smartcard • Would have privacy concerns if a Government Agency held such information • Need for education and making the case why such biometrics may be needed • New round of surveys are complete – will determine whether attitudes have changed in the past 18 months and whether there is now a greater general knowledge of biometrics and associated issues.