Card, mobile credential, payment and security
Wisconsin’s proposed voter ID law, billed as potentially one of the toughest in the nation, would be less susceptible to legal challenges if university student IDs are allowed. That’s the opinion of a University of Wisconsin political scientist who testified before a legislative committee.
“You already have tens of thousands of these (student) IDs being produced by the state (at UW campuses). So why duplicate the state’s efforts in terms of having (students) go out and get another free ID at a cost to the state?” he said.
Voters would be required to present a valid ID, such as a Wisconsin driver license or a military ID card, to vote if the Senate Voter ID bill becomes law. Student IDs are not a valid form of voter identification under the Senate bill.
The bill’s proponents say the legislation would limit voter fraud while opponents contend that the bill would disenfranchise voters such as poor people and college students who are less likely to have a Wisconsin driver license or other type of photo ID. Read more here.
So zombies might not be the typical badge holders on campus but as the campus game known as Humans vs. Zombies spreads we may see a new use for the student ID. This week at Case Western Reserve University in Cleveland, zombie students tried to tag human students to turn them into zombies, while humans defended themselves with nerf dart guns.
Participants sign up online to play and receive a ‘human’ ID card. When a zombie tags a human, he claims his victim’s ID number and logs the kill online. The human then becomes a zombie and can join the hunt.
One zombie told a reporter for the Plain Dealer, “It’s a lot of fun … you meet people from every major and talk to people you would have never talked to.” And a faculty member added, “This school has a reputation of people sitting in their rooms doing chemistry homework so to see someone running around campus at full speed is good.”
Humans vs. Zombies first started at Goucher College in Baltimore but is now played on campuses around the world.
While the human ID at Case Western is not the official campus card, could this be the next application for our campus card system providers?
Read more about the Case Western battle here
Read more about the game, its rules and software support
Some scoff at the idea of emerging biometrics, saying that the identification technology as a whole is still emerging. In reality, however, fingerprints have been used to identify criminals for nearly a century and around the world biometrics are used to gain access to buildings, get cash at ATMs and authenticate online transactions.
The days when biometric scanners were merely props in James Bond movies are gone. The North American market appears to be on the precipice of a change. Use cases for secure authentication are everywhere, and the technology foundations to enable biometrics have matured.
Re:ID editors spoke with a group of industry leaders to get their thoughts on what's coming in the biometric market. The individuals deploy and look at biometric systems every day and the emerging trends they identified were remarkably consistent. They include the rise of two formerly outlying modalities and the coalescence of biometrics and mobile devices for two distinct applications.
Trend: Vascular biometrics gets under your skinVein pattern biometrics is a modality that is garnering a lot of interest, says Rick Lazarick, chief scientist at the identity labs for CSC. Some large-scale test results show that both finger vein and palm vein biometrics are extremely accurate, he says, and possess some really important convenience attributes.
The modality is being used in ATMs throughout Japan as well as in Brazil and Poland. "The ATM implementations show that they have the capability to be used in large scale and mainstream applications," Lazarick says.
The Japanese ATMs use three-factor authentication for transactions–card, PIN and a vascular biometric, says Walter Hamilton, a senior consultant at ID Technology Partners and chairman of the International Biometrics and Identification Association.
The technology is starting to show up in North America as well. The Port of Halifax in Nova Scotia is using vascular technology for physical access control and Baycare Health System in Tampa, Fla. is using it for patient identification, Hamilton says.
"It works well, and based on independent testing, I see the technology being just as accurate as fingerprint for one-to-one matching," Hamilton says. "I also see the general population having fewer challenges submitting a good sample of their vein pattern in comparison to the problem some people have with fingerprints."
Some individuals have difficulty with enrolling a usable fingerprint sample, Hamilton says. Very fine fingerprints are tough to pick up and others may have damaged their fingerprints making it difficult to get an image and then match later.
Vein pattern biometrics use light to map the vascular pattern underneath the skin so the surface doesn't matter. Failure-to-enroll rates for vein pattern technologies are very low, Hamilton says.
Test results have shown that the technology is very reliable, adds Lazarick. "Many times vascular outperforms iris," he says.
It can also be viewed as a privacy-enabling technology compared to fingerprints, iris and facial, Hamilton says. Fingerprints leave a residue that can be lifted off a surface and potentially replicated.
"Some people doubt (fingerprint biometrics') ability for credentialing because there's a chance someone may copy a fingerprint from a glass," Hamilton says.
Since vein pattern records the pattern beneath the surface it's virtually impossible to covertly observe. "Unions and certain segments that would object to fingerprints would not object to vein pattern," Hamilton says.
Vascular is also touted as the hygienic biometric, Hamilton says. Typically with this technology a user places his hand or finger on a guide above the scanner whereas with contact scanners there is the possibility of germ transfer between users.
But there still are challenges vascular technologies will have to overcome, Hamilton says. Fujitsu and Hitachi are the two main vein recognition providers and each uses its own proprietary algorithm for matching. This means templates from a Hitachi scanner cannot be read by a Fujitsu scanner and vice versa.
This may change, however, as the National Institute for Standards and Technology is working on a standard for vein recognition. But, Hamilton explains, the work is in the early stages.
Trend: Iris gets a second lookIris is the other modality that seems to be on the cusp of widespread deployment, says Bryan Ichikawa, vice president of identity solutions at Unisys. "Long distance iris recognition opens up whole new worlds and works very well," he says.
The U.S. Department of Homeland Security contracted Unisys to test the different long distance iris products last year. The test, says Ichikawa, showed that iris solutions from multiple vendors could be used for one implementation.
Long distance iris systems from Sarnoff and AOptix show tremendous promise, Lazarick says. "They are close to having something pretty phenomenal," he says.
"Mainstream iris adoption has already begun," says Dale Bastian, VP of Sales – Biometrics, AOptix Technologies. "There are many large scale, production and final stage testing deployments underway that demonstrate that important end-users have fully accepted the modality."
In the Middle East iris is being used for immigration applications and to track individuals expelled from the country, Hamilton says. Airports are also considering using iris for employee access control to secure areas.
"The data from real-world, large scale deployments will demonstrate that iris offers significant advantages over other modalities for appropriate applications," adds Bastian.
The real innovation that is bringing iris to the forefront is its newfound flexibility. In the past, iris capture required a user to precisely and purposefully place the eye in front of a camera. Newer solutions enable the images to be captured from long range, while the subject is in motion and even without his knowledge.
"Longer distance identification means that an officer no longer has to be close to a subject to identify him so there can be a larger safety buffer," explains Mark Clifton, Sarnoff's acting president and CEO. "Distance enables identification in large venues, perimeter control and discrete applications."
Additionally, Clifton explains that longer distance also enables one system to capture both the iris image and face image simultaneously, providing multiple modalities to improve accuracy, speed and ease of use.
Iris nullifies a lot of the hygienic concerns that people have with fingerprints. It also has the potential, like it or not, to be used for non-intrusive or surreptitious identification as shown by a recent announced deployment in northern Mexico.
Trend: Biometrics going mobileWhat may bring biometrics to the masses is its use in smart phones and mobile devices. These devices are being used more frequently for higher-value transactions and steps need to be taken to so they can be better secured. PINs and pattern-based applications exist but many argue they don't offer the level of security that biometrics can provide.
Traditionally the topic of biometrics and handsets has centered on hardware, most often the integration of fingerprint sensors into the phone. Globally a variety of handsets have launched with built-in sensors, and early this year LG released the first model with U.S. availability.
But it is software not hardware-centric biometrics that has the industry buzzing these days. Using the tools already built into phones, a range of biometric authentication is possible.
Adding biometrics to mobile devices could be relatively easy, says Cathy Tilton, vice president of standards and emerging technology at Daon. "The obvious (modalities) are face and voice," she says. "The devices already have cameras and microphones."
Adding iris to the mix wouldn't be much of a stretch either, adds Lazarick. "Without an additional infrastructure you could fuse them," he says. "As the functionality of these devices increases, the security of the transactions will more and more demand identity verification."
There is also the opportunity for multi-modal application via mobile devices. In a multi-modal environment, the system would take a score from a voice pattern, facial image and perhaps an iris image to determine if the individual is authorized to use the device or conduct the transaction, Lazarick says.
Getting acclimated to use the mobile device for biometric verification may be the biggest challenge. Because it is a one-to-one match, however, many of the issues that exist with large-scale one-to-many matches don't apply.
Because you are matching against a single known template, the captured image does not need to be as precise as it would to isolate a match from thousands or millions of templates in a one-to-many environment. "It's all manageable if you get used to using the device," Lazarick says.
And for most smart phones these features could be added with a software application and no additional hardware. "To coin a phrase, ‘there's an app for that,'" Hamilton says.
Enabling biometrics on mobile devices will take away the need for people to verify identity at fixed locations, says Ichikawa. A credential could be stored on the mobile device and confirmed via facial recognition iris, fingerprint or voice. "Once you create a level of mobility, you don't have to authenticate at fixed points," he says. "You can now identify them anywhere."
Trend: Law enforcement takes biometrics from the station to the streetsThe next trend again matches biometrics with mobile devices, but this time leaves the realm of the consumer world for that of law enforcement. The days of being arrested and having your fingerprint placed on an inkpad and rolled onto paper are already history for many police departments. Paper-based collection has been replaced by electronic scanners in the station. But what's coming next is the extension of the capability to the street, says Tilton.
Mobile biometrics devices have been used by the military in Iraq and Afghanistan for years to identify insurgents and make sure only authorized individuals enter restricted areas. The devices are also becoming popular to confirm access to U.S. ports with the Transportation Worker Identification Credential.
While many of the devices used by military officials are dedicated for those purposes, there are different peripherals that can be added to the iPhone and other mobile devices so it can be used to check biometrics, Hamilton says. Most of these are aimed at law enforcement applications to enable officers to enroll and check biometrics in the field.
BI2 Technologies has a sleeve that works with the iPhone and can capture face, fingerprint and iris, Hamilton says. A number of law enforcement agencies are already using the system, he says.
At the same time companies providing systems to the military are releasing updated products with increased functionality. Analysts predict that these dedicated devices will be used for both military and law enforcement applications while add-ons build biometric functionality into other mobile devices such as smart phones.
While biometrics have been teetering on the edge of mass adoption for years in North America, the momentum may finally exist for widespread adoption.
Interestingly, the trends identified for this article suggest that it may be different modalities and use cases that ultimately provide the spark.
In the past, facial images and fingerprints were the modalities of choice, and most looked to physical security and one-to-many identification as the applications to drive adoption.
While these modalities and applications are certainly still important and even dominant, it may be this newer generation–call it Biometrics 2.0–that finally gives Sisyphus his much needed break from pushing the biometric rock up that adoption mountain.
Hitachi's VeinID finger vein scanners have been deployed since 2004 by major banks in Japan and more recently Poland," says Lew Iadarola, VeinID sales manager for Hitachi Security Solutions. "Some South American banks are conducting trials as well."
"In total we have more than 100,000 embedded modules in ATMs, time and attendance readers and other devices," says Iadarola. Another 100,000 of the company's USB-connected logical access readers have also been deployed for authentication to various networks and applications, he notes.
According to Iadarola, one of the largest use cases in the U.S. is with Konica Minolta's bizhub multi-function printers. The finger vein scanner secures document output in government, military and health care environments. Additionally, Japanese telecom giant KDDI has deployed more than 10,000 VeinID scanners for employee logon.
Rather than using the biometric to identify an unknown individual from a population, Iadarola sees vascular technology as ideal for operational biometrics. "Use the vein pattern to ensure the individual is who they claim to be and only then initiate the service, access or transaction," he says.
"Our focus with VeinID is one-to-one matching on a smart card or device," he explains. This comes from the company's historical preference to enhance privacy in public facing applications.
Many of our large customers preferred to minimize the liability that comes with handling personally identifiable information by performing match-on-card transactions rather than storing information in a database, he says. Government Integrators and end-users worldwide did not want to use the same technologies used and stored in databases by law enforcement.
"Some people want to buy a coke, rent a car, and pick up their prescriptions without providing something personally identifiable," he concludes. "People prefer to verify identity and walk away leaving nothing behind."
Sarnoff Corp., a subsidiary of SRI, is a leader in long distance iris recognition technology. The company offers two models in its Iris On the Move (IOM) line: a walk-thru gate called the IOM PassPort and a small mountable unit called the IOM Glance.
"Sarnoff revolutionized iris recognition by providing longer distance, higher speed, and higher throughput than traditional systems," says Mark Clifton, Sarnoff's acting president and CEO. "We have improved upon systems that require you to be uncomfortably close," he explains, "and have enabled recognition up to 3 meters in distance while walking at a natural pace. Because of that we can process up to 30 people per minute."
The initial adopters include airports, banks, stadiums, construction sites, he explains, "any place where you have need to get people in and out very quickly."
AOptix Technologies, a Campbell, Calif.-based iris innovator, launched its first "iris at a distance" product, the InSight VM, early in 2009. "It puts the advanced adaptive optics technology of the original InSight into a new form factor appropriate for access control, immigration control and eGate applications," says Dale Bastian, VP of Sales – Biometrics, AOptix.
Immigration control is a key application being addressed by the InSight line. "We recently completed three highly successful proof-of-concept studies in the Middle East where the adoption of iris recognition for enrollment of deportation subjects and the screening on in-bound travelers is underway," he explains. "They demonstrate extraordinary results on key criteria including failure-to-acquire and failure-to-enroll rates, average time of capture and accuracy."
Leading the adoption of iris are national identity programs following closely behind immigration applications, Bastian says. He suggests that governments around the globe are evaluating iris recognition technology, which could lead to cooperation between governments to share methodologies creating more secure immigration and travel environments.
Animetrics is offering facial recognition for Android, Windows Mobile and RIM (Blackberry) operating systems. Using the phone's embedded camera, a facial image patterns is generated at the point of access and compared to the enrolled pattern to grant or deny access.
On the voice front, PerSay, a spinoff from Verint Systems, SecuriMobile, Palo Alto, Calif., VoiceVault in the UK and Germany's VoiceSafe all offer voice biometric solutions to secure mobile devices and transactions.
Other companies are using mobile biometrics to add an additional factor to out of band authentication solutions.
PhoneFactor, Overland Park, Kan., uses the phone as the second authentication factor, ‘something you have.' They also use voice pattern biometrics via the phone to add the third factor, ‘something you are,' to the authentication process.
When a user authenticates to a PhoneFactor-enabled site, he enters his username and password. The PhoneFactor technology calls the user's pre-supplied phone number. The user answers the phone and hits the #-key to affirm the transaction and only then is the online access granted. Additionally, a secret passphrase can be required for voice pattern recognition to further increase security.
iPhone app, off-campus payments take DukeCard to the streets
Duke University students have been using mobile devices to check their DukeCard account balances for years, but a newly launched iPhone application simplifies access to the card program’s site and makes it easier to perform a range of functions, says Matthew Drummond, director of the campus card office at Duke.
Previously, the DukeCard Office had a mobile-friendly version of its web site that could be viewed on smart phone browsers, but the functionality was limited.
Duke saw what Stanford University had done with its iPhone app and decided to do the same, Drummond says. In October 2008 Stanford rolled out its app featuring the university’s course catalog, calendar, real-time animation on the campus map and live scores for Stanford basketball games. A group of Stanford students had developed the application and founded Terriblyclever Design, which was later acquired by Blackboard.
Duke worked with Blackboard to create its app, Drummond says. It features a course catalog, directory, calendar, news and videos. There is also a spot for the DukeCard functionality.
“We wanted to provide a campus card section of that Duke mobile application,” he says. “Students can login with their university net ID and they can view their balance, view their last seven days of transactions and add funds to their account without ever getting out of line.”
Students can also use the map feature to find the nearest dining hall, Drummond says, or they can find the closest print center and see how busy it is or check the status of their print job.
It also has an interactive map that provides directions and public transportation routes, Drummond says. The app was recently updated to include information on when a bus would be arriving at a specific stop.
Drummond says they do not currently plan to add Android or Blackberry support, but students can still access the DukeCard office through the mobile Web site on those devices.
Taking payments with the mobile phone
Another new DukeCard feature eases the ordering and payment processes for off-campus food delivery.
Previously students would call in food orders where they would be entered into a PC and a four-part receipt generated. Upon delivery the student would sign the receipts–one copy would go to them, one with the driver and another to the school’s finance office, explains Drummond. Each week the restaurant would submit its receipts and they were manually checked against those submitted to the finance office, a time consuming process.
The system has been automated so that delivery drivers can electronically confirm payments via a mobile phone, Drummond says. Instead of having to call orders in, students can now email orders.
When the driver shows up with the delivery the student enters his ID number and PIN on the mobile device, Drummond says. The entire process is electronic and no paper is needed. Students can also tip with the new system, something they were not able to do in the past.
Airport shuttle services are also using the mobile devices so students can use their DukeCard accounts when heading home, Drummond says. The entire transaction, from entering the ID number, PIN and receiving verification, takes 15 to 30 seconds.
With this strong foundation of phone-based applications and services already in place, the DukeCard seems to have a very mobile future.
UK’s Association of School and College Leaders, representing secondary school and college personnel, is fighting legislation that forces schools to seek approval from both parents before they can use their child’s biometric data.
It would be a “huge bureaucratic burden” for schools using fingerprint recognition systems for cardless libraries and cashless canteens, the association said. The new Protection of Freedoms Bill also gives pupils in schools and colleges the right to refuse to give their biometric data and compels schools to make alternative provisions for them.
Until now, schools have only had to explain to pupils and parents what they are doing, but seeking permission has not been obligatory. The association said schools already running the systems may see a surge in those deciding not to opt in. They also fear pupils may refuse to give their data just to make trouble.
The thousands of schools that already use the technology will also have to seek parental permission retroactively, even if their systems have been established for years. Read more here.
Launching a brand new campus card program isn’t as easy as signing a contract and cutting a check. There are many steps a schools needs to go through before they even choose a vendor.
CR80News asked questions to campus card vendors asking what a school would have to do if starting a campus card program from scratch. The questions ranged from how much an existing IT infrastructure impacts system selection, to what needs to be budgeted beyond the vendor contract amount to upgrade existing networks and how a campus card office should be staffed.
Vendors were hesitant to talk dollar figures for a new system as costs can go beyond the contract with the campus card vendor. Software and IT networks may have to be upgraded, an expenditure that could potentially be more than the contract with the campus card vendor depending on the size and scope of the project.
But at the same time an institution can reap rewards. Significant cost savings and even new revenue streams are attainable. “We review with them areas where they can make money back and do an ROI based on the scope of the project,” says Fred Emery, vice president and general manager at Heartland Campus Solutions.
And then there are the very real benefits–such as increased security–that are difficult to quantify. “Can you put a price on the security of students,” asks Emery. “Just having a safe environment is a prime driver for educational institutions and it’s hard to do an ROI on that.”
Systems also automate previously manual tasks, says Read Winkelman, vice president of sales at the CBORD Group. “There are many soft costs in a manual operation that may not be so evident,” he says, “so a true (cost) comparison may be difficult.”
But there are other items to take into account when it comes to cost, Winkelman says. “There are key indicators that can be used to benchmark the cost over time–deposits on hand, increase in meal plan sign ups, reduction of lost keys,” he says. “Taken with the hard costs of hardware, software, implementation and staffing, it is possible to determine the cost, or benefit, of a campus card system.”
Before even looking for vendors a university should figure out what they want the ID card to do and then take stock of the different systems that could be impacted by those applications, says Tom Bell, vice president of industry relations at Blackboard.
Point-of sale systems in the dining halls and book stores, print and copy services, student information systems, personnel systems and physical access control systems are just a few of systems that could be impacted with a campus card.
Campus cards with debit functionality are catching on among universities, according to this article in Nebraska’s Lexington Clipper-Herald, which calls the card “a must-have accessory.”
About 2,000 U.S. campuses now issue such cards, which can be used to purchase books, items from vending machines and almost anything else with a price tag.
However, the MavCard issued by the University of Nebraska at Omaha is not a true debit card because students there did not request that a banking relationship be added to the card, said a university spokesperson. Instead, money is placed in an account at the university’s MavCard Services Office.
The card went off campus for the first time last fall. Ten stores now accept the card.
Meanwhile, at the University of Nebraska-Lincoln, students, faculty and staff can link their card to a Wells Fargo Bank checking account to make purchases on and off campus. The card also can work as an ATM card.
Read more here.
Jolly Technologies announced a technology partnership with S2 Security, manufacturer of the S2 NetBox and S2 Enterprise integrated IP-based physical security systems, that provide integrated visitor management and access control.
Visitors, contractors and employees are enrolled through Jolly’s Lobby Track System via driver license scan. Access control cards are issued and the visitor is automatically assigned a record and group access privileges within the S2 NetBox system.
This combined solution enables front desk security to issue access control cards that provide limited facility access to selective users. Watch list checks, duplicate record checks and flash photo capture are all automatic. At an expiration date or during check out the access privileges are revoked and Lobby Track removes the record from the S2 NetBox system.
The joint solution integrates Lobby Track with the S2 NetBox network appliance through a proprietary access manager utility. Users connect the two systems by entering the account name, password, group and field selection.
Seattle University’s new student ID card with debit functionality is probably more secure than standard cards. For example, the U.S. Bank-backed card has no account number on the face of the card. As one university spokesperson said: “Everyone’s pretty protected because your digits aren’t out there. It’s got your face on it, and it can be canceled immediately any time.”
The new card with the debit option was launched in January in response to student polls and surveys. The university wanted to make sure that implementing the debit card option would be seen as a positive action to the students.
The debit part of the card is optional and students can cancel the debit function without affecting any other services associated with the card.
In Additon, with U.S. Bank’s zero liability policy, the card holder is not responsible for any unauthorized transactions that occur after a card is lost or stolen. The bank will refund the individual if any fraud should occur.
Read more here.
To ensure high quality printing for your IDs and to protect your card printer investment and extend its lifespan, remember three simple words: keep it clean. Basic cleaning of desktop printers is a simple, straightforward process that anyone can do with just a bit of research and a basic understanding of the printer’s components.
A card printer is a complex machine, so it should come as no surprise that routine upkeep is required. Printers contain both moving parts and sensitive, precise components that must be maintained and kept cleaned to avoid jamming, damage and reduced performance.
“We do our best to educate everyone to keep the printers clean, tuned up and use the proper supplies,” says Mark Degan, corporate marketing manager at ColorID.
The good news is that printer manufacturers have made the task of routine cleaning easy with specially designed cleaning kits. Customized kits are available for specific manufacturers and models and are typically available from printer suppliers or online retailers. A common single use kit costs around $30.
Items contained in a cleaning kit will vary based on the requirements of the specific printer but often include elongated cards or rollers with adhesive to grab dust and dirt, pens or swabs with cleaning solution, dust-free cleaning cloths and other supplies.
Instructions for cleaning specific models will vary so refer to the manual, cleaning kit inserts or search online for instructions. Additionally there are online videos demonstrating specific techniques for many makes and models. “Basic techniques are common across many units,” explains Degan.
He recommends the following schedule to keep your printer in optimal working order:
Beyond these normal cleaning processes that can safely be done on site, Degan recommends annual maintenance from a factory trained service technician as well.
“We send out reminders to our customers telling them that when they have a moment of down time, it is a good idea to get a tune up,” says Degan.
He describes ColorID’s tune-up program as, “a small investment that covers replacement parts and gives them insurance that their printer is operating at its peak.” During the tune-up, a factory-trained technician inspects, calibrates, cleans and tests the unit.
“Your campus and your students rely on the ID and that means your card office must be able to rely on the card printer,” says Degan. “The best way to ensure it is ready when you need it is to keep up with regular, scheduled cleaning and maintenance.”
