And then there were TEN

Homeland Security Secretary Michael Chertoff's new requirement that first-time visitors to the United States provide 10 fingerprints -- rather than the two currently required -- is being applauded as a move toward more meticulous identification and better security.

But the conversion is likely to be complex, expensive and inconvenient for incoming travelers, according to security and IT experts.

Chertoff announced the new standard July 13 in his overhaul of the Homeland Security Department, which has been received favorably by Congress and industry officials.

"Anything to improve accuracy is a good thing, and it's good for the industry," said Walter Hamilton, chairman of the International Biometric Industry Association in Washington, and vice president and general manager of biometric solutions at biometric and smart-card security solutions provider Saflink Corp., Bellevue, Wash.

The fingerprinting change presents possible opportunities for systems integrators, including the holder of the U.S. Visit contract, Accenture Ltd. Accenture officials were not available for comment. Cost estimates for the conversion range from $30 million to more than $100 million, not including additional personnel costs.



'RIGHT THING TO DO'

Daunting is the likely greater inconvenience to foreign travelers who may face longer waits at U.S. airports while the 10-fingerprint enrollment and database checks are done.

Although many visitors would get their scans when they apply for visas at embassies in advance of their trips, the primary concerns are about the millions of travelers from the 27 visa-waiver countries, including France, Great Britain and Japan.

Visitors from such countries may have to enroll fingerprints upon arriving at U.S. airports, and some, or possibly all, would have their prints checked against databases of suspected terrorists and criminals.

Both the enrollment and the database checks are expected to take more time than the two-fingerprint standard. Informal estimates of additional wait times range from 10 seconds to 15 seconds more per person for the scans, and several minutes more per person for the database checks.

Asa Hutchinson, the department's former undersecretary of border and transportation security, said the move to 10 fingerprints will be worthwhile, but not simple.

"It's absolutely the right thing to do," said Hutchinson, who is chairman of the homeland security practice of Venable LLP law firm in Washington. "I would agree that there will be added costs, and they will have to wrestle with the timing. ... There will be challenges in the implementation."

For example, even with rapid "flat" fingerprint readers, scanning 10 fingers instead of two means there is much more opportunity for finger misplacement on the readers, Hutchinson said.

"There likely will be some inconveniences, and it will take a longer time," he said, although he declined to provide estimates of expenses or inconvenience, saying additional research is needed.

Hutchinson has raised similar concerns in the past. On Dec. 3, 2004, in comments about a Justice Department inspector general's report on DHS and FBI fingerprint databases, Hutchinson asked whether it would be "operationally feasible" to consider adding 10 to 15 seconds per traveler to capture 10 fingerprints, rather than two, for 43 million visitors a year.

"Even discounting the processing time required, the additional 10 to 15 seconds for print capture would have an enormous impact," Hutchinson wrote. "It would require a significant number of additional inspectors and consular officers, as well as significant facility modifications to handle the increase in wait times."

Questions also arise as to whether the IT infrastructure supporting the FBI's database of 45 million prints can handle the additional screenings from U.S. Visit, which processes as many as 180,000 travelers a day.

Hutchinson also wrote in December of major expenses for FBI and DHS to convert DHS programs to a 10-fingerprint standard.

"Even discounting the significant cost to the FBI required to restructure the Integrated Automated Fingerprint Identification System (IAFIS) architecture to provide the capacity to perform the transactions quickly and improve the reliability and availability, the costs to DHS are prohibitive," he wrote.

Hutchinson declined to comment on his December 2004 writings, saying more research on technologies is needed.

FBI has long used the 10-fingerprint standard, which has been recommended for identity verification systems by scientists at the National Institute of Standards and Technology.

BRIDGE FOR A GAP

Chertoff's plan to convert U.S. Visit to the standard comes after months of criticism from Congress, federal agencies and the media about incompatibilities between U.S. Visit's two fingerprints and the FBI's IAFIS criminal database, which uses 10 prints.

U.S. Visit officials have said the two-print approach meets the program's goals and was designed for quick implementation. U.S. Visit's budget is about $370 million a year.

"We don't have any specifics right now on how the conversion [to 10 fingerprints] will be implemented," said DHS spokeswoman Kimberly Weissman.

On July 13, Chertoff said first-time visitors must scan, or enroll, 10 prints, although subsequent visits would require only two fingerprints for verification.

"This will dramatically improve our ability to detect and thwart terrorists trying to enter the United States, with no significant increase in inconvenience," Chertoff said.

Reaction has been mostly positive. Requiring 10 fingerprints "is a strong first step to identifying terrorists at our borders," wrote the 13 Democrats on the House Homeland Security Committee in a response to Chertoff's reorganization.

But accomplishing the change may be a larger undertaking than anticipated. The long history of controversy over fingerprint standards between FBI and the U.S. Immigration Service, which became part of DHS when the department opened in March 2003, suggests that the conversion may be difficult, IT experts said.

The new standard will require more data processing power, greater data storage capacity, data programming and infrastructure changes and better integration with the FBI's database, according to several IT industry officials who asked not to be identified because they fear any criticism of DHS may rebound against their employers.

The conversion will necessitate "a well thought-through plan," said one executive. "It's not an easy answer, but it is the right decision."

Switching to 10-fingerprint scanning also will mean new, larger biometric scanners and readers capable of enrolling and reading 10 fingerprints, rather than two prints. The 10-print scanners cost about $5,000 to $10,000 each vs. about $500 for the current scanners.

Worried travelers also wonder whether 10 fingerprints are too intrusive. "Many people are concerned about the privacy and security of these databases," said Christer Berman, president of Precise Biometrics Inc., Lund, Sweden.

Staff Writer Alice Lipowicz can be reached at alipowicz@postnewsweektech.com.