Using biometrics to protect India’s one billion people raises security, privacy concerns

The system has to be accurate enough to spot all but about 1 in 10,000 imposters. It should not, however, be so foolproof that it falsely rejects large numbers of people who are who they claim to be. Nor should it take so long that people have to wait in long lines. If either of those things happened, few people would sign up. Participation in India’s program is voluntary, not mandatory.

India’s system is sophisticated. When a person first enrolls, scanners take image data for all ten fingers and both irises. When people show up at a local office to receive a benefit, they get scanned again. That data is then sent to the central database, which compares it to the person’s original enrollment data.

Comparisons are complicated, however. One problem is that the scanning equipment where people first enroll is usually more expensive and sophisticated than the equipment at local government offices. That sets the stage for a lot of false rejections. Making matters more difficult, fingerprints and even irises vary tremendously in how distinctive they are.

The tradeoff is between accuracy and speed. Comparing all ten fingerprints, or both irises, is extremely accurate, but it takes about 107 seconds. That may sound lightning fast, but it is not for a system that is supposed to perform one million verifications an hour. To speed up the process, Indian officials originally compared only a person’s right thumbprint. A single thumbprint — or any other individual fingerprint — may be too hazy to compare, however. Indian officials then latched on to the idea of picking a person’s best fingerprint — the one that provides the easiest match. Results were better, but not ideal.

The release notes that Wein teamed up with two graduate researchers, Apaar Sadhwani and Yan Yang, to derive and test sophisticated algorithms based on the Indian biometric data. Wein did not charge for his work, but he thought that it might have ramifications for many other governments, as well as for commercial companies. Indeed, banks in India are already developing their own applications for the Aadhaar system.

The researchers’ solution, which Indian officials are studying at the highest levels, is to focus on a particular subset of each person’s fingerprints and eye scans that are the easiest to compare to those originally scanned. The combination of fingerprints and iris data will vary from person to person. For some people, it could be just the right index finger. For others, it could be an index finger and a thumb. Or, it could be the irises, or a combination of fingerprints and irises.

For many people, as it turned out, an easy check of only one or two fingerprints is enough for an accurate identity confirmation. For about 37 percent of people, it is necessary to compare just the irises. For a very small number of people, it’s necessary to compare both irises and some fingerprints.

By spending a small amount of time on most people, and more time on a minority of others, the researchers found they could keep the average verification time to just thirty-seven 37 seconds. This is a bit longer than it takes to just compare one finger, but the rate of false rejections is about 200,000 times lower.

Rajesh Mashruwala, a Silicon Valley tech entrepreneur as well as a former senior architect at UIDAI, the Indian government agency that oversees the biometric program, says Indian officials are almost certain to incorporate Wein’s findings.

“Larry [Wein’s] work is very valuable for understanding and improving the authentication process,” Mashruwala observed in a recent e-mail. “I am sure it will find its way into the production system in due course.”

Wein does not expect the United States to replicate the Indian approach. Americans are already suspicious about government surveillance, and most Americans already carry drivers’ licenses and other photo identification that are fairly hard to forge. For low-income countries, however, he says that biometrics may have a big future.

— Read more in Apaar Sadhwani et al., “Analyzing Personalized Policies for Online Biometric Verification,” PLOSone (1 May 2014) (DOI: 10.1371/journal.pone.0094087)