ID cards and iris codes

[ciphergoth]

From http://news.bbc.co.uk/hi/english/uk_politics/newsid_1559000/1559245.stm

[Blunkett] also maintained that improvements in electronic thumb or fingerprint technology or even "iris-prints" meant the threat of forgery would not make the system redundant.

Iris codes are a very effective identification technology. They scare the crap out of me. This BBC news story provides a summary of how they work:

http://news.bbc.co.uk/hi/english/sci/tech/newsid_1477000/1477655.stm

More information is provided in Section 13.5 of Ross Anderson, "Security Engineering". Here's some tidbits.

They're devastatingly accurate. With any identification system, you can trade off "false accepts" (accepting someone who is not who they say they are) against "false rejects" (rejecting someone who is who they say they are). With iris codes, if you're prepared to put up with a false reject rate of one in ten thousand, you can get a false accept rate of less than one in a trillion.

Unlike fingerprints, iris codes have a very simple structure. As a result, they can be compared very rapidly, and they're not limited to checking that you are who you say you are - it's practical to look up who you are in a database using your iris code. The Nationwide Building Society piloted a cash machine for which no cards were needed - the machine looked you up in their database using your iris code.

http://news.bbc.co.uk/hi/english/sci/tech/newsid_81000/81859.stm

An iris code database for the whole of the UK would fit onto any new PC.

Iris code scanners will be very cheap - they're just a simple low-res digital camera with a fixed-focus lens and fixed exposure. You put your eye in just the right place, close to the lens, and it takes a photograph. However, Anderson says

There's no technical reason why a camera could not acquire the iris from a distance of several feet [...] - it would just cost a bit more - but that brings Orwellian overtones of automatic recognition of individuals passing in a crowd.

Mirrorshades or vanity contact lenses would stop this at the moment. But existing vanity contact lens printing techniques are not fine grained enough to allow me to pass as someone else in an iris code test.

In summary, they might decide they don't need to issue us with ID cards. They may just use the two ID cards we carry with us every day.

Update: More commentary from Ross Anderson

Comments

Fancy a Guinness?

[diffrentcolours]

Didn't EIRE make some decree that they wouldn't pass ludicrously opressive laws like this?

If this looks like going ahead, how about you, me, kitty_goth and welshofdave head over to Dublin and set up a company there?

[ergotia.livejournal.com]

Off the top of my head, the most likely legal challenge would be under the Human Rights Act 2000, which incorporates the ECHR into UK law.

How long?

[jhg.livejournal.com]

How long before they take the ID card with iris recognition, combine it with bank card, credit card etc., driving license - and GPS / homing device. So that you can find your way around easily... and they can track everyone's every movement *anywhere in the whole world*. Except the Poles, maybe.

And then, instead of a card, it'll be an implant. It will monitor your health for signs of lack thereof, and be able to send paramedics to your exact position to treat you. And, of course, tell when you're using illegal substances / are a bit pissed.

And you can't leave that one at home.


J

[ex-meta.livejournal.com]

Are these cheap iris scanners capable of telling the difference between a normal eye, and one that has been removed from its usual owner? I ask merely for information...

FYI, available soon...

[hbergeronx.livejournal.com]

http://www.panasonic.com/medical_industrial/iris.asp

Less than US$300. (Disclaimer- I directly own shares in the company). At that rate, I expect common usage very soon.

Scary stuff

[alienspacebat.livejournal.com]

I've been working with the Imaging Division of ST Microelectronics over the summer and I had access to confidential data from the company who designed this. We design most of the webcams on the market and produce the chipsets for them, both the imaging sensors and coprocessors http://www.vvl.co.uk (http://www.vvl.co.uk) This system seems so incredibly accurate and can be implemented from around 3 feet away with a cheap vga webcam as long as the eye fills most of the frame. With tracking and facial feature recognition this is not hard, especially in a two camera system where one wide angle camera aligns a telephoto one.

In theory this could be implemented in a mobile phone without too much processing power. As a basis for a digital signature in secure transactions it is amazing. Just look at your computer and it confirms your id. Or phone someone and they know it is you as it confirms the code on your business card.

As a system for identity and tracking this really scares me. It is a distant based system so it can be used without your knowledge. And yes, although I reckon it would in itself not be able to tell the difference between a live or recently removed eye, it could tell the difference between a real eye and contact lens or a totally dead eye and by looking also at blood flow you can easily tell if an eye is alive.

Unfortunately I can't say any more than is publically available but hopefully that answers a few questions