Biometrics in Developing Regions

​BIOMETRICS—the use of a physical attribute or personal trait to identify a person—is a growth market, but what is most interesting is how this technology is being deployed differently in countries with less developed infrastructure. First-world countries have long used biometrics for security and forensics, but developing countries are using biometrics to create IDs that can be used to facilitate services like voting or the distribution of financial aid, according to Identification for Development: The Biometrics Revolution, a 2013 report from the Center for Global Development (CGD). The report, which looked at 160 case studies of how developing countries are using biometrics, noted that they are technologically leapfrogging the industrialized world in much the same way that such countries adopted mobile technology more quickly because they weren’t burdened by a legacy land-line infrastructure.

These projects are not always successful. For example, a project in Afghanistan in 2009 attempting to register voters based on their iris scans was scaled back due to “numerous technological and logistical problems,” according to the CGD study. But there have also been some remarkably impressive projects that are serving as a model for others, chief among them what India is doing. Following is a look at that project and a smaller, more focused effort in Brazil.

India
When individuals lack a means of obtaining and providing a valid form of identification, they can find themselves shut off from society, unable to vote or receive government services. For example, the government distributes $40 billion annually in subsidies, oftentimes to citizens in rural and even remote areas. Delivering these services requires a robust identification solution, one that ensures protection of private data while allowing registrants to authenticate themselves from multiple access points.

But the challenge of providing a valid ID can be daunting in developing countries. For nations like India, where there is no standard form of identification like a Social Security number or national ID card, there is enormous difficultly in registering the population, which is nearly four times the size of the United States’ population. The information needs to be secure, mitigating the potential for fraud, and the enrollment process must be easy for residents who, in some cases, are neither numerate nor literate.

The solution for India has been biometrics. In 2009, the Unique Identification Authority of India (UIDAI) was created to tackle the challenge of registering India’s 1.2 billion residents. Registration is on a voluntary basis.

Srikanth Nadhamuni is head of technology at UIDAI. He spoke at the 2013 RSA Conference in San Francisco about the installation process and technology behind the program. To enroll a person in the database, a trained system operator obtains multiple biometric identifiers: 10 fingerprints, two iris scans, and one facial photo. Those 13 biometric profiles are stored in the Central Identities Data Repository (CIDR), a centralized database that acts as the managed service provider for enrollees. Each person also provides his or her demographic information. Linking the system generates a unique 12-digit number for each registrant, known as one’s “Aadhaar,” which has become the common name for the program.

When a person is registered, their biometrics profiles are compared to others already in the system to ensure that duplicates are not being created. Nadhamuni said the de-duplication process is a critical aspect of registration.

That process is not as simple as it might sound, however, because of the number of comparisons that must be computed in a large population and because of the potential for false positives and false negatives. As the CGD study notes, “Frustratingly little information has historically been available on the performance of biometric identification in the field,” but UIDAI “broke new ground in March 2012 when it released performance data on its processing of 84 million” biometric registrations.

India’s stringent quality controls and use of multiple biometrics “resulted in a low biometric failure-to-enroll ratio of 0.14 percent,” and “the probability that a duplicate entry will not be caught (a false negative) was estimated at only 0.034 percent. The probability that an entry would be erroneously classified as a duplicate (a false positive) against the gallery of 84 million was estimated at 0.057 percent.” That’s still a possible error rate in the tens of thousands for each 100 million re cords, notes the CGD report, but that error rate is deemed “quite manageable” for large populations.

To enhance accuracy, the government decided to use more than one type of technology for Aadhaar. It went with three providers for that reason. For example, if one provider believes a duplicate identity is attempting to enroll into the system, it can send that information to the other two providers for comparison, helping to keep the false negatives and positives down.

Alan Gelb, a senior fellow at CGD and a coauthor of the report on biometrics, says that India’s Aadhaar program is a good model for the creation of a national database that relies on biometric data. “Over the next couple of years, the number of people in the developing world who are biometrically enrolled is going to keep rising very sharply, and that’s partly because of India,” he says.

Not only has India paid attention to error rates, but it is also addressing privacy concerns. The system provides privacy by making sure that each person’s Aadhaar number is randomly assigned and contains no personal identifying information. Furthermore, the authentication process is secure, keeping personal information private even from the institution where enrollees give a fingerprint or iris scan. An operator monitoring the results from someone’s attempt to authenticate will see only a “yes” or “no” response, rather than any detailed data on the person.

The technology required for encrypting, storing, and authenticating hundreds of millions of Aadhaar participants requires an interoperable, interconnected network across a large nation. But in India, much of the country is made up of villages, which lack the necessary infrastructure like broadband Internet to move large amounts of data. To achieve that, India developed “an ecosystem of partners.” That included state governments, which wield a lot of power in India, as well as the technology companies, explained Nadhamuni.

State governments serve as registrars, and they enroll people on behalf of UID. The states contract with companies that go into villages and enroll people using field kits that collect the biometrics and provide participants with their Aadhaar numbers.

To handle its many demands, the UIDAI commissioned vendors to design products with unique specifications for the program. “We created an entire industry, an entire set of partners of government, private vendors, and so on, that are actually taking the project forward,” Nadhamuni said. That level of customization makes India’s program a model for others.

Gelb says the sheer scope of the Aadhaar program—it has already enrolled about 200 million, and it seeks to enroll more than a billion people—is enough to make it unique. Also, the fact that the program’s core is based on several different biometrics really makes it stand out.

“What’s interesting about the Indian program is that they very consciously set out to combine the use of multiple biometrics,” he explains, noting the various challenges that would be involved in relying on a sole biometric in a country like India, such as a fingerprint alone.

“Many people can’t give good fingerprints—people who are farmers, who are doing a lot of manual labor, and also very old people,” Gelb says. “Their fingerprints are worn. And so it helps to have another alternative, which is sort of independent of fingerprints, and that’s where the iris comes in.” Alternatively, he explains, some people are unable to give a good iris image because of cataract surgeries or other medical implications, making the fingerprint a better way to authenticate them.

Gelb also says Aadhaar stands apart for its use of multiple vendors who tailor their products to the project, and not vice versa. “[India] would definitely be a benchmark for the industry,” he says. “Because of its scale, they’ve been able to get companies to produce to their own specification…. So they are in control, not the vendors,” he says.

Brazil
Brazil provides another example of a developing nation using biometrics to register its citizens, in part to have a reliable way to distribute funds under a federal assistance program called Bolsa Familia, which means “family purse” in Portuguese. The program, set up in 2003, is aimed at reducing poverty.

The way the program works is that participating families receive cash transfers as an incentive for them to keep their children in school and take them for regular medical checkups.

The Brazilian government chose ATMs as a way to securely and conveniently disburse the cash assistance. At first, the process did not go smoothly because potential recipients were unfamiliar with the concept of banking and they forgot their PIN codes, meaning they had to ask for the bank manager and prove that they were who they claimed to be.

To solve the problem, the Brazilian government turned to biometrics technology from Lumidigm, a company that specializes in fingerprint authentication.

“What we were able to do was replace the password with a biometric,” explains Bill Spence, vice president of Transaction Systems at Lumidigm, Inc.

When the fingerprint authentication was installed on ATMs, “they had the ability then to verify the individual without a PIN. They use the [Bolsa Familia] card, and then they use their fingerprint,” he says. There is now nothing the person has to remember.

Environmental factors, such as dirt or a dry climate, can interfere with a reader’s ability to capture the information from a fingerprint, but Lumidigm’s technology addresses that. “All conventional fingerprint systems essentially rely on the fact that when you put your finger down onto it, you make good contact with the surface. So the ridges of your fingerprint are able to make good contact with the glass or the silicon. And then air gets trapped in the valley of the fingerprint,” Spence explains. “If either of those two things doesn’t happen, you don’t get a good image, because it can’t see the difference between a ridge and a valley in the fingerprint, and so then it can’t really see the fingerprint.”

Similarly, age can interfere with capturing a good fingerprint. “Your skin is not as elastic as you grow older, and so when you press down hard, what will happen is the ridge can actually squish out the air that’s in the valley of the fingerprint,” says Spence.

Like other fingerprint readers, Lumidigm’s reader is composed of a light source and an imaging system that captures unique characteristics in the ridges and valleys of a print. But Lumidigm’s sensor uses multispectral imaging by transmitting three separate wavelengths of light, effectively capturing an image of the fingerprint both on and below the surface of one’s skin.

“It turns out, you have a capillary bed about a millimeter deep in your fingerprint with an identical pattern of the fingerprint,” says Spence. “You can think of it as your internal fingerprint. So even if you don’t have an external fingerprint, we can actually pull out the internal [print].” This “extra” data from below the external skin supports and augments surface data in order to produce a clearer image of the fingerprint. Spence says this enhanced imaging technique overall reduces false positives and false negatives.

More than 58 million users have been registered into the Bolsa Familia program using the biometrics. The ability to get the aid distributed has reduced poverty overall by about 8 percent, according to the United Nations International Policy Center for Inclusive Growth.

Biometrics Trends
According to the CGD paper, “Among the new biometrics being developed, rapid DNA analysis deserves special mention [because it is] the only biometric that can be taken at birth and is stable over a lifetime,” making it an ideal basis for tying an individual to some primary ID, like a birth certificate. The report notes that it is now possible to get a sample in an hour and that the way this biometric is implemented, the DNA sample has “none of the personal details encoded in DNA, and [it is] therefore no more intrusive than any other physical attribute such as fingerprints.” But it’s still too expensive to deploy on a mass scale.

Gelb says not every country realistically needs biometric identification. For example, “Estonia has a very advanced, very sophisticated national ID card which is heavily enabled. You can do all kinds of things using the national ID card, but they don’t use biometrics to underlie it. They don’t need to,” he says. “They’re a small country; they have very good vital registration and population data. So the issue is not as critical for them.”

Moreover, his report notes that biometrics aren’t infallible—and criminals will continue to find ways to crack so-called foolproof high-tech ID cards—even finding ways to spoof what are deemed highly secure biometrics, like iris scans. But that “dialectic should not undermine the use of biometric identification” in appropriate situations, as is being done in developing countries, the report states.

“We can actually reach the people now with this technology,” Nadhamuni concluded in his presentation at the RSA Conference. “I think we can be more socially inclusive with the kind of technology we have.… We have a real opportunity to get a large number of people in poverty to jump over to the bandwagon of economic progress and prosperity.”