Security
Security With the Wave of a Hand
Biometrics are finding a place on campus, but privacy concerns may inhibit wider acceptance.
Students at the Chiba Institute of Technology in Japan log in to their student registration system at kiosks, using a multifunction smart card and a Fujitsu PalmSecure authentication system that reads their palm veins (see "Palm Reading"). Indeed, biometric systems are becoming increasingly common in Asian society, particularly in financial settings, where more and more bank ATM machines employ fingerprint readers as a security measure.
Still, biometric systems haven’t yet gained much traction in the US, particularly in higher education. Exceptions usually involve high-security research labs like those in the biological process and development facility at the University of Nebraska-Lincoln, where an AMAG Technology biometric fingerprint reader controls visitor access.
Several factors may be inhibiting wider use of biometrics on US campuses, says Douglas Gale, president of higher ed tech consultancy Information Technology Associates in Big Sky, MT.
First, he notes, budget cuts have put many university CIOs in retrenchment mode. “Anything that requires significant capital outlay is tough to do, so cost is a factor,” says Gale, whose April 2006 CT article “Biometrics Go Mainstream” (campustechnology.com/articles/2006/03/biometrics-go-mainstream.aspx) and January 2008 follow-up “Biometrics Revisited” (campustechnology.com/articles/2008/01/biometrics-revisited.aspx) described the technological potential and limitations of biometric systems, ranging from fingerprint and hand geometry readers to iris scanners and keystroke dynamics.
Another inhibitor to adoption, Gale says, relates to the maturity of ID management systems on campus. “If you are going to do biometrics for one application such as entrance to dining halls, you have to figure out how it interfaces with a larger federated ID management scheme,” Gale explains. “Many people are working on those issues first and it may push biometrics to the back burner.”
Finally, and not surprisingly, students and employees have privacy concerns. Could biometrics be used to track their movements around campus? What about fingerprint theft? Lawrence Nadel, fellow at the Falls Church, VA-based technology-strategy nonprofit Noblis, points out that a copy of someone’s fingerprints could be obtained from a fingerprint sensor, a common object such as a drinking glass, or even from a database of fingerprint images. The thief could then “replay” the image to masquerade as that individual.
Gale emphasizes that fingerprint theft is not a trivial issue: “If you steal my wallet, that’s one thing,” he says, “but if you steal my fingerprint, that is stolen forever.”4
Nadel also notes that there’s a criminal stigma attached to the use of fingerprints as identity tools, further slowing the acceptance of these kinds of biometric devices on campuses. Nonetheless, he believes that as the use of biometrics becomes more common in society, the tools may be less stigmatized and people may be less concerned about their potential abuse. In order for that acceptance to occur, he stresses, “It is incumbent on the implementers of the technology to include mechanisms and protections that minimize the likelihood of such fraudulent activity.”
Despite higher ed’s slow adoption of biometrics, there are indications that more campuses are incorporating fingerprint and hand geometry readers into campuswide access and security systems. CT talked to IT and smart-card system leaders at three schools moving forward with biometric technology on campus.
Food Hall Biometrics
The University of Georgia-Athens is the granddaddy of university biometrics users, with campus systems dating back to 1972 when the university wanted to showcase biometric research happening in its own labs.
There is even a little museum in the food services division with artifacts of all the biometric systems ever used on campus, says Bill McGee, director of the UGACard office in food services.
Why food services? McGee explains that UGA decided to adopt biometric security devices because the university wanted to protect its unusually open campus-dining system. He describes the meal plan as “all you can eat,” explaining that the dining system is open all day, so students are entering and exiting all the time. The university needed a way to easily verify that outsiders were not getting into the dining halls, and decided that biometric readers offered the greatest level of security and ease of use.
UGA currently has 59 Ingersoll Rand Security Technologies Schlage HandKey hand geometry readers in the dining rooms, as well as in the campus recreation center and all residence halls. When students and employees first get ID cards, they enroll their hands into the system. The system takes a 3D image of hand size, width, and length. That image is used as part of the access control for restricted buildings.
“We get very accurate reads,” McGee reports. “It’s so good that a set of twins can’t fool it.” He says that the system stops intruders in their tracks. “It provides secure access and a means of control,” he adds, “all in less than half a second.”
McGee says the system is explained to all parents and students at orientation, and literature from the vendor is available to explain how it works. “We do not get privacy concerns raised as you might with a fingerprint reader,” he says.
Other biometric applications are being developed on campus. For instance, the school just completed a pilot project using the HandKey to provide access to exam sites. UGA also is using Kronos 4500 Touch ID terminals with biometric verification (fingerprint scanning) for employee time and attendance tracking. “The uses are as many as your imagination will allow regarding access control,” McGee says.
Verifying Online Test Takers
How do you determine that the person taking an online test is the same individual who is enrolled in the course? In the past, the University of West Alabama in Livingston turned to independent proctors or commercial testing centers to verify the test-taking identities of the 2,000 students enrolled in the school’s online degree programs. Students had to travel to the proctors or centers and pay a fee to take tests.
Now, West Alabama online students log in for exams from home using a biometric device from Software Secure called Securexam Remote Proctor. A fingerprint scanner authenticates the identity of a test taker, while a camera and microphone monitor the exam environment.
The video is uploaded to a Software Secure server, so instructors can check on students they’re concerned about. For example, if someone is doing poorly in the course and then aces the exam, the instructor can examine the video to check who actually took the test.
Starting in fall 2009, all West Alabama online students are required to purchase the device for $180, says Professor Wayne Bedford, the project’s champion. “We have to ensure that the person enrolled in a course is the one taking the test,” he says. “That is the driving factor.”
There have been a few technical issues to resolve, such as interfacing with the school’s Blackboard course management system to ensure the Remote Proctor software would recognize the faculty assigned to the course.
And, yes, the school has had to address student concerns about privacy. “One fellow said to me, ‘What if my wife walks into the room naked?’” recalls Bedford, who teaches computer science. “But the camera is only on when [the student is] taking the test. No other time.”
Laptop Logins
Bentley University (MA) has had a mandatory mobile computing requirement for 25 years. Since August 2008, all 4,000 Bentley students have been issued HP Elitebook 6930p laptops that come with a fingerprint reader. The availability of the biometric feature was key in the hardware selection process, says Jonathan Everett, director of IT client services.
“We were interested for security reasons,” he explains. “It’s not that difficult to look over someone’s shoulder and detect his password. But when he is just swiping a finger, there’s nothing to steal. It is more secure and it’s more convenient. It removes the hassle of entering and re-entering passwords.”
Using the fingerprint scanner and software called DigitalPersona, Bentley students can log in to campus networks and access all university-based web services, including Blackboard.
One convenience is logging back in once the laptops lock after 10 minutes of inactivity. Previously, students would have had to re-enter their passwords, but now they just swipe a finger.
Everett praises the ease of use of the DigitalPersona software, which he selected over the fingerprint recognition software that comes with the HP Elitebook 6930p. “It’s intuitive. I give the students an orientation, but I almost don’t have to. They get it right away.”
Although he hasn’t done an official analysis yet, Everett believes that the use of fingerprint scanning has cut down on calls to the help desk about resetting passwords.
The Future of Campus Biometrics
The development of more government standards may have an impact on the wider adoption of biometrics. According to a market research report from International Biometric Group, global biometric revenues are projected to grow from $3.42 billion in 2009 to $9.37 billion in 2014, driven in part by government ID and border management programs.
The National Institute of Standards and Technology has created federal standards for how biometrics should be incorporated into federal government employee and contractor ID credentials, Noblis’ Nadel says. Those standards are now being adopted by first responders and law enforcement. “Once that model is better established, it can easily move to the campus setting, first perhaps for campus police, fire, and EMS forces,” he says, noting that when an organization as large as the federal government commits to standards, usually more equipment becomes available, prices come down, the learning curve flattens, and it becomes a commodity technology.
