IWS - The Information Warfare Site
News Watch Make a  donation to IWS - The Information Warfare Site Use it for navigation in case java scripts are disabled


TESTIMONY of VALERIE J. LYONS
EXECUTIVE VICE PRESIDENT of IDENTIX INCORPORATED
U.S.SENATE JUDICIARY SUBCOMMITTEE on
TECHNOLOGY, TERRORISM and GOVERNMENT INFORMATION
Wednesday, November 14, 2001

Good Morning, Madam Chairwoman, Senator Kyl, and other members of the Subcommittee. My name is Valerie J. Lyons and I am Executive Vice President of Identix Incorporated. Founded in 1982, Identix is the leading global provider of fingerprint biometric solutions for the criminal justice, airport security and commercial business markets. We are headquartered in Los Gatos, California and have offices in Fairfax, Virginia and other cities in the U.S., Europe and Australia. Our technology is currently in use around the world. Our FBI-certified technology for capturing and managing fingerprint images electronically is used to identify criminals, screen job applicants, control physical access, protect proprietary information, and prevent identity theft and fraud in cyberspace.

Our fingerprint biometric solutions are extremely accurate, easy to use and already deployed on a large scale as a standard procedure. All U.S. military recruits and current holders of California drivers' licenses have had Identix finger images captured for purposes of identification. California teachers and day care providers are fingerprinted for background checks.

With the implementation of the Airport Security Improvement Act of 2000 in January, Identix fingerprint biometric solutions for background checks are now at the majority of large airports, including: Dulles, Reagan National, Baltimore-Washington, San Francisco, O'Hare, Logan, Orlando and Houston's Bush and Hobby airports. Identix also provides job applicant screening for United, Continental, and Horizon airlines. This law puts in place critical safeguards against potential threats. We urge Congress to expand its scope to apply to all airports.

On display is the Identix fingerprint capture device used for criminal and job applicant screening at the airports I just mentioned. In the law enforcement community this is known as a "livescan" or "tenprint" machine. Using this machine, the screening process is simple and straightforward. In about 10 minutes time, an operator can record forensic quality electronic images of the applicant's full ten fingerprints. For job applicants, this record is submitted electronically to the U.S. Office of Personnel Management, which in turn forwards the record to the FBI for a search of its Integrated Automated Fingerprint Identification System, known as the "IAFIS". The results of the IAFIS search are transmitted confidentially to the prospective employer within a window of time that varies from a few hours to no more than 72 hours. A search of this sort costs approximately $35 to $50 per applicant. The cost of the machine ranges from $20K to $40K depending on the functionality desired.

When used in a timely manner as part of a comprehensive security effort, fingerprint based job applicant screening can prevent persons from being employed in sensitive jobs who have a criminal history or are otherwise wanted in connection with unlawful activity. It is important to remember that fingerprint checks are effective because there are existing, "back-end" databases storing fingerprints against which checks can be made. Virtually all police and law enforcement networks worldwide and many border entry and visa control systems are fingerprint based. There is a worldwide network of skilled, professional fingerprint examiners and a core set of systems that are maintained and updated routinely, as a matter of standard practice.

Fingerprint biometric based job applicant background checking is an essential first step in authenticating employees in sensitive transportation and critical infrastructure related jobs. However, once this form of identity has been established for workers it is important to ensure that their identity is not compromised once they become employees and have access to secure areas and computers.

In many so-called secure enterprises today, employees are given an ID Badge for access purposes, however, this method does not ensure that the badge owner and user is in fact the person whose background was checked.

To test the integrity of any badging system we can ask 5 simple questions:

1) Is the employee who was cleared by the FBI the same person who receives the badge? The answer should be yes.
2) Is the rightful badge owner the same person gaining access through a door to a secure area? The answer should be yes.
3) Can the badge owner gain access through a door to a secure area without a badge? The answer should be no.
4) Is the rightful badge owner, the same person gaining access to a computer? The answer should be yes.
5) Can the badge owner gain access to a computer without a badge? The answer should be no.

We can enhance security through the concept of "continuity of authentication" for an individual's identity through the direct relationship between an individual, their badge, and the background check.

Allow me to demonstrate. On display is the fingerprint based job applicant system machine. Here is a smart card ID badge, with a fingerprint image on it. The background check results and my badge are tied together because they both have the image of my finger. No one else can use this badge without me.

This is a biometric door lock control. It can recognize my finger image when it is prompted to do so by this badge. It will only open for me with my badge and my finger. The same holds true for my computer. I insert this badge into a biometric enabled card reader that scans my finger and only I can enter a computer and exercise only the authorities assigned to me.

The "continuity of authentication" through biometric based badging offers greatly improved security that can be conveniently added to many existing systems for a relatively low cost. This approach can serve as a first line of defense against individuals who want to infiltrate airport facilities or other critical parts of the transportation infrastructure.

The U.S. Department of Defense paid $6 per card for smart card stock such as this. A computer can be locked down with biometric readers and software that are commercially available from most major brands of computer makers for about $100. Doors cost about $1000 per door in volume. Biometric based badging takes the next logical step to ensure that precautionary measures are in place in a way that maximizes background checks and physical access controls.

This technology and the concepts associated with it can be quickly implemented in transportation enterprises through timely and coordinated policy and management control. The General Services Administration has made smart ID badges available to the Executive and Legislative Branches through several vendors. Congress and the Administration should examine the merits of using biometric badging systems to improve the security of physical and computer access control systems in government buildings.

While my testimony has focused on personnel security matters, our approach can also be applied cheaply and conveniently to the frequent traveler to expedite check in and boarding for airline travel and other forms of transportation. Like the employee ID, the frequent traveler card starts with some form of identity proofing, not necessarily an FBI check, perhaps a bank process using applicable authority to check personal records. Also like the employee ID, a finger image is placed on a smart card so that the card cannot be swapped or counterfeited.

However, very much unlike the employee ID, the frequent traveler card would keep the finger image on the card and not in a central database. Also unlike a mandatory employee ID, a frequent traveler card would be voluntary, its principal purpose being to promote convenience and increased public confidence in the U.S. transportation infrastructure. There are very real privacy concerns with respect to the array of security solutions being considered. Identix believes that we can raise the level of security for travelers without undermining civil liberties.

Madame Chairwoman, we appreciate having had the opportunity to share our views with you and your colleagues today. We commend you for your leadership and vision in focusing attention on the role that technology can play in these challenging times. Your recently introduced legislation promoting visa reform demonstrates another area in which biometric technology can be used to enhance homeland security. We would be privileged to do whatever we can to improve safety and security in our nation through the application of biometric technology. We look forward to continuing to work with you.

Thank you very much.