Follow that face
When a 17-year-old buys a fake drivers licence, it's hardly a threat to national security. When an Al-Qaeda operative does, you could have some problems, says Australian Federal Agent Rob Tunnicliff.
"A NSW drivers licence might be used by an underage drinker or someone who's avoiding having points removed from his licence," he says. "Or it could be used by someone who is trying to get a security licence at the Sydney Opera House for the sole intention of blowing it up."
Tunnicliff, the national coordinator of the Australian Federal Police's Identity Security Strike Team, knows how hard identity crime is to investigate. "We've had instances where people have used hundreds of names and addresses," he says. "So the face is what's important to us."
Trying to pin down criminals who specialise in creating partially or completely fabricated identities means a long paper trail, and following it is often fruitless. Now, however, with some clever technology at his fingertips, Tunnicliff's team has changed the equation by following suspects' faces, not their forged or fictitious details.
Jill Savage, Customs' national manager
His team is pioneering the use of facial recognition software in Australian law enforcement.
"We've found that our offenders are very mobile, very adaptive and they have committed frauds in every state in Australia," he says. "But once you actually find the person you've got them because they've got their face all over everything."
It works like this: The Federal Police are handed a false ID, suspect photo, or CCTV footage from other agents, agencies, or even private organisations like banks. Tunnicliff loads it into a massive image database, and cross checks it for possible matches to other images they've captured. He can even cross-match against other image databases, like drivers licence databases held by roads and traffic authorities in most states and territories.
In some cases, it will lead to other fraudulent identities. In others, it helps federal agents to identify who a criminal really is.
Since its establishment in 2003, the Strike Team's efforts have been successful. Recently, operation Hickey netted 13 arrests. The federal government is impressed, having allocated an extra AU$20 million in funding to the team in the last budget.
While the team's high profile arrests have involved fraud offences, Tunnicliff says his group also focuses on counter-terrorism. However, he's less forthcoming on details when it comes to those operations. When ZDNet Australia asked him if he could elaborate on the use of facial recognition technology in counter-terrorism investigations, his answer was a firm "no".
Despite this, he says there are obvious national security benefits for tackling ID crime in all its forms. Tunnicliff says over 400 false documents were used by the 9-11 hijackers, for example. "It's not just about passports, it was to avoid scrutiny, immigration visas, work permits," he says.
By busting the syndicates that create false documents, he says, it's harder for terrorists to obtain the credentials they need to carry out an attack.
The AFP isn't the only agency that's using facial recognition technology. Customs will launch its new SmartGate system at Brisbane airport in February next year. Jill Savage, Customs' national manager, Border Intelligence and Passengers Development Branch, says the project will enhance border security, but is geared more towards efficiency goals. "The primary driver is we've got increasing traveller numbers and infrastructure limits at airports," she told ZDNet Australia. "Normally our response would be to increase staff ... but we don't have extra space so that normal manual process isn't an option for us [anymore]."
The SmartGate system is completely automated. Australian e-passports are embedded with chips loaded with a biometric imprint of the photo on the main page of the document. The passport holder can enter a booth, be automatically scanned by a video camera and let through, all with no human intervention. If the system can't verify that the person being scanned is the passport holder, they're presented to a customs officer who can perform further checks.
So what's the security advantage? "In terms of border security, essentially it means that we've got a high degree of confidence that the person presenting the passport is the person who has their image in that passport," says Savage.
ZDNet Australia tried to play devil's advocate with Savage, but she wasn't having it. "I'm sure a customs officer would notice that you're a man with a woman's mask on," she says when presented with a cunning plan to evade SmartGate's facial recognition software. "It's been tested on things like masks and so on, and they don't let you through."
Stephen Kent, who has written authentication standards and testified before the US Congress on the issue of identity systems, agrees that biometrics come in handy in border control applications. "If an individual asserts two different identities when crossing a border at two different times, biometric authentication can detect this anomaly and call it to the attention of border control officials," he says. "Also, in the case of facial recognition, if an intelligence agency has photographs or video of a 'person of interest' but no ID, it may be possible to use this covertly collected biometric data to alert border control officials when the individual tries to enter a country."
But Savage says SmartGate "series one" won't have that capability just yet. "In SmartGate series one the emphasis is on self processing at the border, not necessarily [on] comparing them with biometrics from other places, that's pretty much out of scope from what we're doing at the moment," she says. "It's about doing the border clearance process, rather than getting into other activities that other organisations might be interested in."
Kent, vice president and chief scientist for Information Security at technology solutions firm BBN, says there is little independently verified data on the reliability of facial recognition software, but Savage says the SmartGate trial has yielded fantastic results.
And, says Kent, biometrics at the border is a good idea, even if it is just about adding an extra layer of authentication to existing documents. "Because the inclusion of biometric data in passports also tends to make use of digital signatures to provide authenticity and integrity for the reference data, it makes passport forgery harder at the same time," he says.
In law enforcement applications, like the AFP's ID Security Strike Team, it's a covert method of investigation, he says. "The big concerns here are the accuracy of these systems, and whether their use in border control contexts might trigger more widespread, domestic surveillance use," Kent says.
Indeed, privacy concerns have rattled some. Is it possible that government agencies could zoom in on ordinary citizens at a protest rally and immediately identify them from their face?
According to Ken Pfeil, a security consultant and former Security Program Manager for Identix, a biometrics company, it's not completely fanciful. "This technology has serious privacy implications, especially here in the US," he says. "It is not beyond the realm of possibility at all for it to be grossly misused in the name of combating terrorists."
"(While) the marginal accuracy and incompatibilities between systems would inhibit the scenario ... today on a large scale, technology gets better with time and is conceivable in the future."
