NIST recommends dual biometrics for visas

The National Institute of Standards and Technology is recommending a dual biometric system of fingerprint and facial recognition, possibly stored on smart cards, to identify visa holders at the nation's borders.

"With two fingerprints and a face, you'd have quite a secure system," said Charles Wilson, manager of the Imaging Group in NIST's Information Technology Laboratory.

NIST delivered its recommendations in a report to Congress after conducting a study last year as mandated by the USA Patriot Act of 2001 and the Enhanced Border Security and Visa Entry Reform Act of 2002.

The report recommended placing two fingerprints on each card?noting that thumbs produce the highest accuracy rates, followed by the index and middle fingers?combined with facial scanning. NIST said each image, whether of a fingerprint or face, would take up 10K or less of storage, for a total within the capacity of many smart cards.

The system should follow existing standards and specifications, the report said, such as the Digital Signature Standard for public-key infrastructure encryption. Fingerprint background checks for foreign nationals requesting a visa would likely be performed by the FBI's Integrated Automated Fingerprint Identification System, the report said. It recommended accuracy tests for IAFIS.

Wilson said the testing was "a different experience" for NIST, because of the multiagency cooperation mandated by the laws. The IT Lab measured fingerprint performance on an Immigration and Naturalization Service database of 1.2 million prints from 620,000 people. It tested facial recognition systems on a State Department database of 121,000 images of 37,000 people.

"I've got almost a terabyte of data behind a firewall here in the lab," he said.

The Defense Advanced Research Projects Agency, the Defense and Justice departments, and other agencies contributed to the study.

"Because of the laws, I got a tremendous amount of cooperation from all these agencies," Wilson said.

The report noted that, with the INS data, a single fingerprint gave a 90 percent probability of verification and a 1 percent probability of a false positive. It said the best facial recognition systems, with good quality images, produced the same results?although in less constrained, outdoor conditions with poor quality images, facial scan accuracy could fall below 50 percent.

The combination of the two technologies, however, yielded reliable identification, Wilson said, particularly because of recent improvements in biometrics. "The fingerprint technology I was using was about what commercial technology was five years ago," he said, adding that fingerprint systems have improved significantly since then. The facial recognition systems were newer, "so the results were the floor for fingerprints and the ceiling for face," he said.