Worries about Iraq's biometric database

could easily be exploited by a future government,” EPIC director Marc Rotenberg wrote.

The Army concedes there is potential danger. In a discussion with bloggers in 2007, Lt. Col. John Velliquette, a biometrics manager in Iraq, acknowledged that a biometric database is “very sensitive because essentially what it becomes is a hit list if it gets in the wrong hands.”

“The biometric task force works diligently” to ensure that does not happen, a spokeswoman said. “Biometric data and associated biographic information is only shared with authorized users and partners,” and it’s “a top priority to ensure that such important personal information does not fall into the wrong hands,” she said.

Rotenberg has another concern. As databases are compiled, the individuals whose information is stored in them have little or no opportunity to see what has been collected or to correct any errors, he said.

The tools
In Iraq and Afghanistan, biometric data is collected mainly with a Biometrics Automated Toolset (BAT) or a Handheld Interagency Identity Detection Equipment (HIIDE). The BAT is a four-piece kit that includes a rugged laptop, a separate digital camera for taking photos, a fingerprint reader and an iris scanner.

Photos, fingerprints and iris scans are fed into the computer, where they can be compared against the biometrics of insurgents, terrorists and other wanted persons. The collected data eventually is transferred into a much larger military “biometrics data repository.”

The HIIDE is also used to collect and compare fingerprints, iris images, photos and biographical data. It looks a bit like an oversized digital camera, but has enough memory to store 22,000 “full biometric and biographic portfolios,” according to manufacturer L-1 Identity Solutions. A portfolio includes two iris scans, 10 fingerprints, a photograph and 35 items of biographic information (see 18 August 2009 HSNW).

Troops use the collected biometric data to control access to bases, to screen job applicants, to restrict travel and to aid in forensic investigations, the Biometric Task Force said.

The task force has helped develop other specialized biometric hardware as well. For the Navy, there’s a water-resistant, vibration-hardened “mission-oriented biometric software jump kit” that’s used for gathering biometric data on the crew members of ships that U.S. sailors board and inspect.

There are hand geometry readers — “not terribly accurate,” but useful in certain situations, Swan said — along with iris scanners that unlock doors only for approved irises, and a high security lock that can be opened only by the correct fingerprint, an access card and a personal identification number.

Development goes on. The task force wants systems that are able to scan irises from a distance. If employed at a base gate, authorized personnel could be scanned and cleared for entry as they drive up. “You wouldn’t have to stop,” Swan said.

Matthews quotes task force spokesman Greg Johnson to say that over the course of a year, the task force has examined about 50 biometric identification systems, including some that identify individuals based on their gait, ear shape, vein patterns in fingers and palms, even by odor.

Once-promising automated facial recognition remains a technology that falls short.

Although the Navy is experimenting with it as a means to keep tabs on prisoners as they move about in the brig in Charleston, South Carolina, widespread use of facial recognition technology is unlikely anytime soon, Swan said.

Computers cannot yet reliably compare faces captured by cameras with photographs in databases. Poor lighting, images taken from angles and individuals who approach the cameras too quickly all lead to identification errors, she said.

Some biometric technologies are simply considered too intrusive. For example, it is possible to identify individuals based on retina scans, “but we typically don’t use the retina,” Swan said. “It can tell us things about your health, and that is a privacy concern.”

Retina scans can reveal symptoms of diseases ranging from diabetes to cancer. Disclosure of such data could make it harder for people to get jobs or qualify for insurance, Swan said.