By Rajiv Chandrasekaran, Washington Post Staff Writer

Sunday, March 30 1997; Page HO 1

The Washington Post

It's long been the stuff of science fiction movies, spy thrillers and ultra-secure Defense Department installations: futuristic gadgets that can scan a person's hands, eyes or speech patterns - and determine instantly who the person is.

Lately, these imaginary devices have started popping up in the real world.

At Coca-Cola Co., hand-scanning machines recently replaced the venerable time card for many workers. In New Jersey and six other states, fingerprint scanners are now used to crack down on people claiming welfare benefits under two different names. In Cook County, Illinois., a sophisticated camera that analyzes the iris patterns of an individual's eyeball is helping ensure that the right people are released from jail. And at Purdue University in Indiana, the campus credit union is installing automated teller machines with a finger scanner that will eliminate the need for plastic bank cards and personal identification numbers.

In an era when governments and corporation, are trying harder to crack down on fraud – and consumers are grumbling about the number of passwords they have to remember -- the human body is becoming a popular form of identification. You never leave your hand or eye at home, and these body parts represent unique, unforgeable signatures. According to backers of We technology, called biometrics, no two people -- even identical twins - have hand or eye patterns shaped exactly the same way.

"People see it as a fast and convenient and almost foolproof means of personal identification," said William A. Rogers, an industry analyst in St. Louis who publishes a journal called "Biometric Digest."

A tiny business that was almost exclusively focused on defense-related government agencies a few years ago, biometrics is now beginning to boom commercially.

About 51 billion worth of computer systems that include biometric identity devices are expected to be installed worldwide this year, according to Benjamin L. Miller, an industry consultant and editor of Bethesda-based Personal Identification News. The equipment recently has been put in places as diverse as a day care center near Boston, a hospital in Jacksonville, Fla., and a Comrnerce Department computer center in Northern Virginia.

"It's now bursting out of the very closed niches of very high security," said Miller. "Banks, manufacturers, almost everyone is interested in this technology."

Consider these examples of biometrics at work:

MasterCard International Inc. and Visa USA Inc., the world's two largest credit card companies, have begun to study the feasibility of using finger-scanning devices at the point of sale to verify that the card user is really the card holder. The scanners would compare fingerprints with biometric information stored on a microchip embedded in the credit card. MasterCard is beginning a pilot program with more than 20,000 users later this year, said Joel S. Lisker, the company's senior vice president for security and risk management, who calls biometric technology "the future of money."

Walt Disney World in Orlando has started taking hand scans of people who purchase yearly passes. These visitors now must pass through a scanner when entering the park preventing them from lending their passes to other people.

The Immigration and Natualization Service is letting a select group of travelers bypass lengthy lines at New York's John F. Kennedy International Airport and Newark lnternational Airport by sticking their bands and special cards the service has issued into an automated turnstile. International Business Machines Corp. is working on a project called FastGate to commercialize the service, possibly having airline frequent-flier programs and businesses pay for the program.

The technology also received widespread attention at last sunmer's Olympic Games in Atlanta, where 65,000 athletes, coaches and officials used a hand-scanning system to enter the Olympic Village.

Getting Physical

In basic terms, biometrics is the science of measuring unique physical characteristics, be they the tiny swirls etched in the skin of a fingertip or the pattern of blood vessels in the face. Those measurements are matched against previously recorded information to determine a person's identity.

Common biometric systems scan fingerprints, the shape of one's band, speech, handwriting and parts of the eye - specifically the pattern of the iris and the shape of blood vessels in the retina. Some newer systems attempt to distinguish people by facial features, the pattern of heat given off by the face and patterns with which people type on keyboards.

Although finger and hand scanners are the most popular technologies, other systems are catching on. Several Japanese banks, for example, plan to include iris scanners in their ATMs this year. Voice recognition devices are used to monitor about 10,000 people nationwide who are under house arrest; a computer calls the house on regular intervals and the prisoner checks in by talking, Miller said.

When working properly, some of these devices can be nearly faultless. The most sophisticated finger and eye scanners will accept an unauthorized person just once in a million times, Miller said.

"It's a major jump in our security," said William F. Connors, chief executive of the Purdue Employees Federal Credit Union in West Lafayette, Md., which is installing its first finger scanner-equipped ATM next week "It gives us an assurance that the person who opened an account yesterday is the same person trying to withdraw money today."

Banks aren't the only ones talking about security issues. Privacy and legal experts say the technology raises thorny questions about the safety of personal data. "When you give your biometric identifier to a private institution, what's going to happen to it?" asks John D. Woodward, a former Central Intelligence Agency operations officer who now researches biometric issues. "Is there going to be a secondary market in biometric information like there is with mailing lists of people's names and addresses today?"

Businesses implementing biometric technology, especially financial institutions, promise they will be responsive to those concerns. In fact, they say it's in their interest to allay security worries if they want to convince people to adopt the new technology.

In MasterCard's case, for example, the company said it is working on ways to prevent any permanent record or transmission over a computer network of biometric information. When a person applies for a card, they will place a fingerprint on paper, which eventually will be scanned into a computer and encoded on a chip-based "smart card," Lisker said. The paper copy would be destroyed, he said.

When a person uses the card to buy something, the finger image simply would be compared with what's stored in the card, he said. "We're very, very conscious about people's privacy concerns," Lisker said. "We're going to accommodate those concerns, because if we don't, people aren't going to want to use our product."

One of the biggest problems for a company such as MasterCard, however, is that the technology could work too well. On average, Miller said, finger scanners reject legitimate users about 3 percent of the time, forcing people to present their finger a second or third time. "The more important thing is that we don't insult our good customers than we let a crook in," Lisker said.

Lisker said it likely will be three or four years before the technology will be rolled out nationwide. The company has not yet decided whether merchants, banks, customers or all three should pay for the cost of designing and implementing the system, estimated at several billion dollars.

But such a system could pay for itself; industry' experts said. Credit card companies lose about $2 billion a year through fraud, much of which could be eliminated through biometric technology, the industry believes.

On a smaller scale, several companies are marketing computer-mouse-sized finger scanning devices that are attached to keyboards and cost less thin $500. In offices that put a premium on security and change employee passwords every few weeks, such devices could pay for themselves in two or three years, said John Gustafson, chief executive of National Registry Inc., a Florida company that's selling the low-cost scanners.

Using the New Devices

Many people who use biometric devices give the technology generally positive reviews, industry analysts and executives say. At the Commerce Department's computer center in Springfield, though, endorsements came only alter an initial round of skepticism.

"People thought the technology wouldn't work" said Patrick F. Smith, director of the department’s 70-employee office of computer services. The center uses 15 hand-scanning devices to restrict access to sensitive areas and to punch employees in and out. The shoebox-sized devices compare the scanned measurements - about 90 of them -- to data stored on an employee's identification card, which is inserted into the machines.

After using the devices a few times and learning the right way to slide one's hand in for the scan, people warmed up to the idea, said Smith, who uses one of the devices to enter his office. "It's working wonderfully now," he said. "Most people feel pretty comfortable with it."

In larger environments, however, the technology is still experiencing growing pains. At Newark Airport, breakdowns are regular occurrences for the INS scanning system, which handles hundreds of passengers every day. Industry experts expect the same thing to happen when the technology is added to ATMs, but they remain sanguine that such bugs eventually will be worked out.

"It's natural with any new technology," Rogers said. When it comes to fingerprint and hand-scanning devices, privacy and reliability aren't the only worries for consumers and businesses, industry watchers say. The trickier problems will be dealing with people who are reluctant to touch the fingerprint reader for fear of picking up germs, accommodating disabled people and dealing with manual workers, such as plasterers, who might produce poor scans. "It's also got a criminal al connotation, because fingerprints nowadays are generally taken only when a person is arrested," Rogers said.

And then there's a religious objection. Christian Coalition founder Pat Robertson has expressed doubts about biometric technology on his "700 Club" television show, saying "The Bible says the time is going to come when you cannot buy or sell except when a mark is placed on your hand or forehead."

Questions also have been raised about the technology's effectiveness in its most-heralded application, stamping out fraud. Some preliminary results from states in which biometric systems are being used to prevent welfare "double dipping" show that only modest numbers of scofflaws have been identified. But project backers say it's still too early to jump to conclusions. They contend that publicity about the technology may be scaring away potential perpetrators.

"In most cases, biometric technology is impersonal and it's overkill, complained Robert Ellis Smith, publisher of Privacy Journal in Providence, RI.

Privacy Concerns

The privacy questions aren't trivial, say analysts and industry executives.

Computer Data Systems Inc., an information technology firm in Rockville that designed the biometric security and time-card system for the Commerce Department computer center, has had trouble selling the system to other agencies and commercial clients because of privacy concerns.

"Right now, the market is absolutely nil for us," said Peter A. Bracken, the company's chief executive. "We believe people stilt have a lot of worries."

It's an assessment others in the industry share. Despite the $1 billion estimated sales of biometric-equipped systems this year, the market for such devices has been slower to take off than initially expected, several industry leaders said. Many of the systems that have been implemented, from the INS project to Purdue's ATMs, still are part of pilot projects.

Even MasterCard says widespread distribution of the system is unlikely before the year 2000. But that hasn't stopped the company from running commercials touting the feature: "Some day a computer chip in your MasterCard will be able to recognize your finger pattern, making your personal ID truly personal and your MasterCard even more secure."

Before that time, though, specialists predict the devices will crop up in enough places, from office buildings to college campuses, that most people will have a chance to touch the technology.

"It's not going to jump to ubiquity right away," Miller said. "But we're still going to be seeing this technology more and more in our everyday lives."

HERE'S LOOKING AT YOU

Here are some of The advantages and disadvantages of fully developed biometric systems that are fairly accurate:

Retinal scans (electronic scan of the innermost layer of the eyeball's wall):

Advantages: ;Retina generally remains stable through life, ensuring accuracy. -

Disadvantages: Requires close physical contact MW scanning device; may not be generally accepted by public.

Iris recognition (recording of iris using standard video technology):

Advantages: Non-invasive procedure (close physical contact not required).

Disadvantages: Relatively expensive; requires large amount of computer storage; may not be generally accepted by public.

Finger imaging (recording of fingerprint using optical scanner):

Advantages: Widely accepted by public and law enforcement communities as reliable identification.

Disadvantages: Requires close physical contact with scanning device; residue on finger may cause recognition problems; has criminal overtones.

Hand geometry (three-dimensional recording of length, width and height of hand and fingers, using optical scanner):

Advantages: User-friendly; requires small amount of computer storage space.

Disadvantages: Isn't as unique as other biometric methods; hand injury can cause recognition problems.

Facial thermography or imaging (photograph of face converted into digital code):

Advantages: Non-invasive procedure.

Disadvantages: People who look alike can fool scanner; people can alter their appearance and facial hair can fool device.

Voice verification or recognition (acoustic signal of voice converted into digital code):

Advantages: Works well over the telephone.

Disadvantages: Requires large amount of computer storage; people's voices can change; background noises can interfere.

Signature recognition (computer record of pen/stylus speed, pressure, direction and other characteristics of signature):

Advantages: People are used to providing a signature.

Disadvantages: Poor long-term reliability; accuracy difficult to ensure.

SOURCE: "Biometric Scanning, Law & Policy" by John D. Woodward

@CAPTlON: A hand scanner at the Department of Commerce computer center in Springfield, used to secure a mainframe computer area. Fl