ciphergoth | ID cards and iris codes

From http://news.bbc.co.uk/hi/english/uk_politics/newsid_1559000/1559245.stm

[Blunkett] also maintained that improvements in electronic thumb or fingerprint technology or even "iris-prints" meant the threat of forgery would not make the system redundant.

Iris codes are a very effective identification technology. They scare the crap out of me. This BBC news story provides a summary of how they work:

http://news.bbc.co.uk/hi/english/sci/tech/newsid_1477000/1477655.stm

More information is provided in Section 13.5 of Ross Anderson, "Security Engineering". Here's some tidbits.

They're devastatingly accurate. With any identification system, you can trade off "false accepts" (accepting someone who is not who they say they are) against "false rejects" (rejecting someone who is who they say they are). With iris codes, if you're prepared to put up with a false reject rate of one in ten thousand, you can get a false accept rate of less than one in a trillion.

Unlike fingerprints, iris codes have a very simple structure. As a result, they can be compared very rapidly, and they're not limited to checking that you are who you say you are - it's practical to look up who you are in a database using your iris code. The Nationwide Building Society piloted a cash machine for which no cards were needed - the machine looked you up in their database using your iris code.

http://news.bbc.co.uk/hi/english/sci/tech/newsid_81000/81859.stm

An iris code database for the whole of the UK would fit onto any new PC.

Iris code scanners will be very cheap - they're just a simple low-res digital camera with a fixed-focus lens and fixed exposure. You put your eye in just the right place, close to the lens, and it takes a photograph. However, Anderson says

There's no technical reason why a camera could not acquire the iris from a distance of several feet [...] - it would just cost a bit more - but that brings Orwellian overtones of automatic recognition of individuals passing in a crowd.

Mirrorshades or vanity contact lenses would stop this at the moment. But existing vanity contact lens printing techniques are not fine grained enough to allow me to pass as someone else in an iris code test.

In summary, they might decide they don't need to issue us with ID cards. They may just use the two ID cards we carry with us every day.

Update: More commentary from Ross Anderson

Flat | Top-Level Comments Only

Didn't EIRE make some decree that they wouldn't pass ludicrously opressive laws like this?

If this looks like going ahead, how about you, me, kitty_goth and welshofdave head over to Dublin and set up a company there?

You'd have to learn that no one in Ireland calls it Eire unless they're speaking Irish if you wanted to fit in...

As to the rest, it's the whole written constitution and being citizens rather than subjects thing at work, I imagine.

Eire sounds less clumsy than "Southern Ireland".

I love Guinness and I like U2. Can I get citizenship? :-)

Try just saying Ireland and not feeling the need to define exactly what political entity you're talking about, which will generally be clear from context anyway...

BTW, the Irish are perfectly capable of arguing nomenclature til the cows come home - so feel free to ignore me :)

I hate Guinness and tea and they haven't taken my passport away yet. I fancy the idea of Dublin becoming a haven for people fleeing draconian rules in London - it's even better than when they started using British workers on the building sites a few years ago.

Fair enough. I know about the nonclemanture, I spent a few hours arguing with an Irishman and a geographer about the meaning of "The British Isles" in both geographical and political contexts...

I like the idea of Dublin becoming a haven from people fleeing the English government - there's nice people and good beer by all accounts, and I can communicate with most of the population. And all the young innocent Catholics to corrupt ;-)

Off the top of my head, the most likely legal challenge would be under the Human Rights Act 2000, which incorporates the ECHR into UK law.

That's what Blair and co seem to think, and they don't care. That dreadful little arse Blunkett has been quoted in the press yesterday that his new draconian measures would be in breach of the ECHR and the Human Rights Act, and that Britain would derogate from the treaty. The poisonous squit was actually boastful about it.

These are dangerous times.

Soph xx

How long before they take the ID card with iris recognition, combine it with bank card, credit card etc., driving license - and GPS / homing device. So that you can find your way around easily... and they can track everyone's every movement *anywhere in the whole world*. Except the Poles, maybe.

And then, instead of a card, it'll be an implant. It will monitor your health for signs of lack thereof, and be able to send paramedics to your exact position to treat you. And, of course, tell when you're using illegal substances / are a bit pissed.

And you can't leave that one at home.

J

Are these cheap iris scanners capable of telling the difference between a normal eye, and one that has been removed from its usual owner? I ask merely for information...

http://www.panasonic.com/medical_industrial/iris.asp

Less than US$300. (Disclaimer- I directly own shares in the company). At that rate, I expect common usage very soon.

I've been working with the Imaging Division of ST Microelectronics over the summer and I had access to confidential data from the company who designed this. We design most of the webcams on the market and produce the chipsets for them, both the imaging sensors and coprocessors http://www.vvl.co.uk (http://www.vvl.co.uk) This system seems so incredibly accurate and can be implemented from around 3 feet away with a cheap vga webcam as long as the eye fills most of the frame. With tracking and facial feature recognition this is not hard, especially in a two camera system where one wide angle camera aligns a telephoto one.

In theory this could be implemented in a mobile phone without too much processing power. As a basis for a digital signature in secure transactions it is amazing. Just look at your computer and it confirms your id. Or phone someone and they know it is you as it confirms the code on your business card.

As a system for identity and tracking this really scares me. It is a distant based system so it can be used without your knowledge. And yes, although I reckon it would in itself not be able to tell the difference between a live or recently removed eye, it could tell the difference between a real eye and contact lens or a totally dead eye and by looking also at blood flow you can easily tell if an eye is alive.

Unfortunately I can't say any more than is publically available but hopefully that answers a few questions

They can't exactly be used as digital signatures, because biometrics are not keys. See Schneier's commentary:

http://www.counterpane.com/insiderisks1.html

Thanks for an informative comment!

ID cards and iris codes

Fancy a Guinness?

Re: Fancy a Guinness?

Re: Fancy a Guinness?

Re: Fancy a Guinness?

Re: Fancy a Guinness?

no subject

bad laws

How long?

no subject

FYI, available soon...

Scary stuff

Re: Scary stuff