|
TESTIMONY of VALERIE J. LYONS
EXECUTIVE VICE PRESIDENT of IDENTIX INCORPORATED
U.S.SENATE JUDICIARY SUBCOMMITTEE on
TECHNOLOGY, TERRORISM and GOVERNMENT INFORMATION
Wednesday, November 14, 2001
Good Morning, Madam Chairwoman, Senator Kyl, and other members of the
Subcommittee. My name is Valerie J. Lyons and I am Executive Vice President
of Identix Incorporated. Founded in 1982, Identix is the leading global
provider of fingerprint biometric solutions for the criminal justice,
airport security and commercial business markets. We are headquartered
in Los Gatos, California and have offices in Fairfax, Virginia and other
cities in the U.S., Europe and Australia. Our technology is currently
in use around the world. Our FBI-certified technology for capturing
and managing fingerprint images electronically is used to identify criminals,
screen job applicants, control physical access, protect proprietary
information, and prevent identity theft and fraud in cyberspace.
Our fingerprint biometric solutions are extremely accurate, easy to
use and already deployed on a large scale as a standard procedure. All
U.S. military recruits and current holders of California drivers' licenses
have had Identix finger images captured for purposes of identification.
California teachers and day care providers are fingerprinted for background
checks.
With the implementation of the Airport Security Improvement Act of
2000 in January, Identix fingerprint biometric solutions for background
checks are now at the majority of large airports, including: Dulles,
Reagan National, Baltimore-Washington, San Francisco, O'Hare, Logan,
Orlando and Houston's Bush and Hobby airports. Identix also provides
job applicant screening for United, Continental, and Horizon airlines.
This law puts in place critical safeguards against potential threats.
We urge Congress to expand its scope to apply to all airports.
On display is the Identix fingerprint capture device used for criminal
and job applicant screening at the airports I just mentioned. In the
law enforcement community this is known as a "livescan" or
"tenprint" machine. Using this machine, the screening process
is simple and straightforward. In about 10 minutes time, an operator
can record forensic quality electronic images of the applicant's full
ten fingerprints. For job applicants, this record is submitted electronically
to the U.S. Office of Personnel Management, which in turn forwards the
record to the FBI for a search of its Integrated Automated Fingerprint
Identification System, known as the "IAFIS". The results of
the IAFIS search are transmitted confidentially to the prospective employer
within a window of time that varies from a few hours to no more than
72 hours. A search of this sort costs approximately $35 to $50 per applicant.
The cost of the machine ranges from $20K to $40K depending on the functionality
desired.
When used in a timely manner as part of a comprehensive security effort,
fingerprint based job applicant screening can prevent persons from being
employed in sensitive jobs who have a criminal history or are otherwise
wanted in connection with unlawful activity. It is important to remember
that fingerprint checks are effective because there are existing, "back-end"
databases storing fingerprints against which checks can be made. Virtually
all police and law enforcement networks worldwide and many border entry
and visa control systems are fingerprint based. There is a worldwide
network of skilled, professional fingerprint examiners and a core set
of systems that are maintained and updated routinely, as a matter of
standard practice.
Fingerprint biometric based job applicant background checking is an
essential first step in authenticating employees in sensitive transportation
and critical infrastructure related jobs. However, once this form of
identity has been established for workers it is important to ensure
that their identity is not compromised once they become employees and
have access to secure areas and computers.
In many so-called secure enterprises today, employees are given an ID
Badge for access purposes, however, this method does not ensure that
the badge owner and user is in fact the person whose background was
checked.
To test the integrity of any badging system we can ask 5 simple questions:
1) Is the employee who was cleared by the FBI the same person who receives
the badge? The answer should be yes.
2) Is the rightful badge owner the same person gaining access through
a door to a secure area? The answer should be yes.
3) Can the badge owner gain access through a door to a secure area without
a badge? The answer should be no.
4) Is the rightful badge owner, the same person gaining access to a
computer? The answer should be yes.
5) Can the badge owner gain access to a computer without a badge? The
answer should be no.
We can enhance security through the concept of "continuity of
authentication" for an individual's identity through the direct
relationship between an individual, their badge, and the background
check.
Allow me to demonstrate. On display is the fingerprint based job applicant
system machine. Here is a smart card ID badge, with a fingerprint image
on it. The background check results and my badge are tied together because
they both have the image of my finger. No one else can use this badge
without me.
This is a biometric door lock control. It can recognize my finger image
when it is prompted to do so by this badge. It will only open for me
with my badge and my finger. The same holds true for my computer. I
insert this badge into a biometric enabled card reader that scans my
finger and only I can enter a computer and exercise only the authorities
assigned to me.
The "continuity of authentication" through biometric based
badging offers greatly improved security that can be conveniently added
to many existing systems for a relatively low cost. This approach can
serve as a first line of defense against individuals who want to infiltrate
airport facilities or other critical parts of the transportation infrastructure.
The U.S. Department of Defense paid $6 per card for smart card stock
such as this. A computer can be locked down with biometric readers and
software that are commercially available from most major brands of computer
makers for about $100. Doors cost about $1000 per door in volume. Biometric
based badging takes the next logical step to ensure that precautionary
measures are in place in a way that maximizes background checks and
physical access controls.
This technology and the concepts associated with it can be quickly
implemented in transportation enterprises through timely and coordinated
policy and management control. The General Services Administration has
made smart ID badges available to the Executive and Legislative Branches
through several vendors. Congress and the Administration should examine
the merits of using biometric badging systems to improve the security
of physical and computer access control systems in government buildings.
While my testimony has focused on personnel security matters, our approach
can also be applied cheaply and conveniently to the frequent traveler
to expedite check in and boarding for airline travel and other forms
of transportation. Like the employee ID, the frequent traveler card
starts with some form of identity proofing, not necessarily an FBI check,
perhaps a bank process using applicable authority to check personal
records. Also like the employee ID, a finger image is placed on a smart
card so that the card cannot be swapped or counterfeited.
However, very much unlike the employee ID, the frequent traveler card
would keep the finger image on the card and not in a central database.
Also unlike a mandatory employee ID, a frequent traveler card would
be voluntary, its principal purpose being to promote convenience and
increased public confidence in the U.S. transportation infrastructure.
There are very real privacy concerns with respect to the array of security
solutions being considered. Identix believes that we can raise the level
of security for travelers without undermining civil liberties.
Madame Chairwoman, we appreciate having had the opportunity to share
our views with you and your colleagues today. We commend you for your
leadership and vision in focusing attention on the role that technology
can play in these challenging times. Your recently introduced legislation
promoting visa reform demonstrates another area in which biometric technology
can be used to enhance homeland security. We would be privileged to
do whatever we can to improve safety and security in our nation through
the application of biometric technology. We look forward to continuing
to work with you.
Thank you very much.
|