By Tamara Walid
Gulf governments are considering using biometric data as a way of combating fraud. Tamara Walid examines the details.
The UAE national ID card is already being issued to UAE nationals. Expatriates and residents will be able to register and receive their cards from January of next year," says Liaquat Parkar, lead consultant at LogicaCMG Middle East.
The ID card Parkar is talking about, however, does not contain that regular set of information we're all familiar with such as one's nationality, date of birth, mother's maiden name, and others. This card has much more specific data about you than you've ever dreamed of carrying around in your wallet. Such cards might include up to 10 fingerprints, a digitised facial and iris scan, current and past places of residence throughout one's life, and much more, possibly reaching up to 50 categories of personal identification.
What we are looking into are electronic passports, national ID cards, border control and electronic gates.
As announced by the Emirates Identity Authority (EIDA) early last month, ID cards are being issued only to Emirati government employees, starting with military staff at the Ministry of Defence, while citizens will be granted cards at a later stage. In early 2008, every expatriate in the UAE will be obliged to take an eye scan for the new ID card, which is expected to replace the driving licence, labour, residency and health cards.
The card could also be used as an e-gate card, ATM card and an e-passport when commuting between various GCC countries. Numerous governments worldwide already have national ID cards on the way to implementation, according to Parkar. This, however, is only the first step.
"A national ID card is the first step to enabling a smart society and its citizens to use their national ID cards on a daily basis to carry out daily transactions. Those daily transactions could be, for example, opening a bank account, applying for a credit card, paying for books and services over the internet, and paying for your parking - rather than putting a coin into the machine you top up the chip on your ID card and put your ID card into the machine," he says. Whereas many GCC governments have shown interest in issuing identity cards for their citizens, Parkar explains, the next challenge they face is the adoption and usage of those ID cards. LogicaCMG, covering the entire Middle East region from Dubai, says it is currently implementing one of the biggest national ID card projects for a GCC country - though, due to the sensitivity surrounding a country's implementation of biometrics, Parkar declines disclosing the identity of his client. The company is also in talks with a number of other governments in the region on helping them realise business benefits and implement processes and procedures which will enable their citizens to use ID cards on a daily basis as well as reduce the total number of cards they carry around.
With over 20 years' presence in the Middle East, LogicaCMG has only just begun to focus on biometrics in the region over the last four to five years. An international company with 40,000 staff worldwide and operating out of 41 countries, LogicaCMG's first major biometrics implementation was back in 2000 in the Netherlands, where it implemented the e-gate system for an airport in the country.
In the region, the company is mainly targeting government organisations.
"There are many ministries out there that have issues with regards to identity. What we are looking into are electronic passports, national ID cards, and border control and electronic gates. These are the three main propositions that we have for the government sectors. Propositions include electronic passports and electronic gates and they are all underpinned by biometrics, whether facial biometrics, fingerprints or irises," says Parkar.
When it comes to the private sector, LogicaCMG has more than a thing or two to offer in terms of identification systems. Having handled a number of projects outside the region before, the company is now hoping to introduce these to private corporations in the Middle East and has prepared a set of propositions around the use of biometrics.
"Some private companies might want to implement facial recognition software. For example, in a shopping mall in the Netherlands we've implemented a system where shoplifters are identified by cameras that are streaming video to our software and we're comparing photos of known shoplifters against the live screening. Then we can quickly alert security officers if known shoplifters are in that area," he says. Parkar points out that with incidents such as the Wafi Mall robbery this year, which saw a professional raid on a jewellery shop, a growing country like the UAE could make use of the benefits of this type of software.
"The software is a good means to make sure that you don't have any people that you do not want in a particular area," he says with confidence.
He adds: "The other area is with banks, we're starting now to speak to a lot of financial institutions. Just a couple of days ago there was an announcement by Barclays Bank and MCR that Barclays is going to be one of the first banks in the region to implement biometrics-enabled ATMs."
All of this boils down to, says Parkar, finding a way - at the back end - to enroll customers, capture their fingerprints and store them in secure databases. This, he adds, is where LogicaCMG can help financial institutions.
The other area of focus for LogicaCMG is speech authentication, a fairly new technology. "It is fairly well-proven that by actually analysing somebody's voice you can authenticate who that person is and it is very accurate. There are 100's of unique features in every person's voice and by analysing each one of them it is very easy to authenticate the voice," Parkar says.
One person had 17 different identities and was actually getting benefits from 17 different people.
This system, he adds, is particularly applicable in the financial sectors where customers traditionally employ the phone to finalise transactions or services.
"We all go through a series of questions like ‘what's your date of birth', ‘what's your mother's maiden name', all of this. If speech authentication technology is applied, it will give the bank the confidence to make sure they are speaking to the right person on the other end of the line," he says.
Using the system, however, is not expected to eliminate the need for such procedures as answering security questions, but will be seen as a complimentary technology, according to Parkar.
So far, regionally, most of the interest in what LogicaCMG has to offer with regard to biometrics has come from government organisations. Parkar believes this is not a surprise as these kinds of technologies are normally introduced to government entities "where the impact of a lack of identity is mostly evident". He cites the UK government as an example, saying it suffers from US$3.4bn in losses each year due to identity theft - that is, someone claiming to be who they're not.
"Now in the UK there are many people who take a driving test on behalf of somebody else and that's because it's very easy to forge documents. They turn up at a driving centre and show those identity forged documents and then fulfill the test and pass that test on behalf of somebody else," he says.
Similarly, he adds, documented cases exist of people claiming welfare benefits from governments under different names. "One person had 17 different identities and was actually getting benefits from 17 different people. That was one person. Now, by the use of an identity document like a national ID card for example, where biometric information is also attached it becomes a lot more difficult for somebody to come to a government office and claim to be somebody who they're not," he says.
"At the end of the day a fingerprint is very unique to that individual and when you're checking the fingerprint and authenticating the person using the fingerprint the chances of them slipping through the net are drastically reduced."
Has the implementation of those systems, however, proven to be effective in combating crime and reducing the number of fake identities escaping the radar? Parkar's answer is a resounding ‘yes'.
"For example, with what we are doing with the facial recognition software that we've installed in one of the shopping malls in the Netherlands, we've actually found a 90% accuracy in capturing or identifying people who are shoplifters in that area," he says.
Another area where the technology has been successfully applied is in football stadiums, says Parkar. In a particular stadium in the Netherlands, where people have been identified and brought to the notice of security officers, the rate of vandalism has seen a dramatic drop a short time after implementation.
It is still too early, however, to assess the benefits and the results of these implementations on a larger scale such as in government sectors, according to Parkar. Nevertheless, it is safe to expect a sharp drop in identity theft after introducing national ID cards, for instance, or by capturing people with their biometrics, Parkar explains.
"A lot of countries are now saying if you want to apply for a visa for that country, you must submit your fingerprints. To the average citizen this is almost like an infringement on their privacy, but the fact is that these governments are suffering from people who get rejected in the first instance and then change their identity and apply to come into the county again, usually succeeding the second or the third time around," he says.
If the biometrics of the person have already been captured and stored, irrespective of how many times he or she change names, a biometric remains constant. "Unless the person changes his or her eyes it's really very difficult for that person to get entry," says Parkar.
One of the places where the implementation of biometrics has been very successful and advanced, says Parkar, is the UAE. A popular system has been iris scanning, he says, which the UAE immigration department employs. He explains that any individual, prior to being deported from the UAE, has their iris captured and stored in a central database. Previously, people deported from the UAE would simply go out of the country, change their names, get new documents, and apply to come back into the country with a clean slate.
"Now that they are scanning the iris when this person goes and changes his or her documents and comes back into the country, their iris scan is checked against the central database to see whether this person was deported in the past.
"The UAE government captures on a daily basis a number of people who try and get into the country by changing their names," he says.
Parkar reveals that the emirate is very advanced in the adoption of biometrics, and is one of the first places worldwide to implement e-gate projects.
"The only two places that were adopting this technology back in 2000 were Dubai and Amsterdam. Dubai has been at the cutting edge of this technology, and even the UAE iris system is fairly advanced. I believe it is the world's largest programme for iris scanning," he says. Whether the benefits of implementing biometric systems outweigh the costs is a question asked by many. Prices, however, differ and ultimately depend on the type of system required. Some of the most basic biometric systems such as access control - presenting fingerprints upon entering an office or organisation - are available on the market for a few hundred dollars.
At the same time the government has to be very open about the type of data that it is holding on citizens.
"Immediately, you alleviate that problem of one of your staff members losing their ID card, and someone else picking it up and opening the door with it. I think for a few hundred dollars you see an instant return on investment," he says.
Where more sophisticated programmes are concerned, especially for government use, prices reach to many millions of dollars. Parkar argues that this is understandable, as these systems sometimes involve millions of citizens, or entire nations.
"Sometimes they involve the replacement of personal identity documents like passports, which the government decides has to move from a traditional to an electronic passport or the introduction of an identity card for millions of its citizens. These projects tend to run into the multimillion dollar range," he says.
He adds: "It's still very early to say whether the return on investment has been worth it, but if you look at the sort of figures that are being quoted by governments with regard to identity theft, which run into billions of dollars, I'm very certain that with the introduction and the adoption of such schemes by governments, the losses to the economy will reduce drastically."
In 2005, according to statistics presented by the UAE Iris Expellees Tracking and Border Control System, the number of average searches based on iris scans per day reached 9000; 48,813 people were caught throughout the year with an average of 90 to 95 captured a day.
The UAE's is the largest such database of irises in the world, and the most comprehensive. What's more, the findings reveal that no false matches have been detected to date.
Implementing the Emirate's Identity Authority's vision of creating a multi-application national ID card for citizens, however, might not be the easiest task.
Parkar explains that a multi-application card will allow citizens to use it for multiple purposes, instead of having to carry around separate cards for parking, car registration and other needs - as most people in the UAE currently do.
"The vision, something that we are in discussion with the Emirate's Identity Authority about, is to show them how that can actually be realised, because first there's issuing the cards to the citizens. "The next step is how we actually make these things happen, how we allow citizens when they park their car to go to the parking machine and put in their national ID card, how they hand in their ID cards at the national traffic department when they're buying a car, so the data of their new car can be put on the chip," he says, adding that there are very complex areas that need to be addressed, and which require a technology infrastructure that supports the usage of the cards across different domains. Ultimately, this also has to be very secure to avoid easy access to information by unwelcome individuals, Parkar stresses.
From hence springs the sensitive subject of fraud, one of the main concerns of citizens worldwide. Through research conducted in Europe, LogicaCMG found that 38% of citizens expressed this concern.
Parkar says that people simply fear that information harnessed for one purpose will be put to another without permission.
"This stems from the fact that the sort of data being collected is the type that, as citizens, we've never been used to giving out - like fingerprints, or iris scans," Parkar explains.
He believes this concern should be addressed, and that one way of addressing it is through transparency between governments and citizens, as well as the establishment of a citizen's charter that "would lay down very openly what the government intends to use the information for".
"At the same time the government has to be very open about the type of data that it is holding," he adds. "This has to come from the government, noted down in law, and if the government does anything wrong the citizen has to have recourse in terms of making sure that the data was only used for what it was meant for."