In 2010, Oklahoma Representative Charles Key introduced "The Religious Exemption
Act." According to Key:

"It would have allowed a citizen to assert a religious exemption so that no
biometric data could be kept in the DMV database. It also prohibited Social
Security numbers being retained in DMV database. Those electing exemption would
not be required to accept a RFID chip in their driver's license."

No hearing was held on Key's bill.

In an October 21, 2011 editorial, Key noted that a court case is considering a
similar issue.

http://pryordailytimes.com/editorials/x859491763/An-Oklahoma-battle-and-the-Bill\
-of-Rights

We are using the Hitachi finger vein reader in a project. During the use of the
reader, sometimes more than expected failures occur. We expect there is a
relation with the fingers being cold.

Therefore we did some desktop research and found some information about the
Raynaud's Phenomenon. Most information we can find is from medical papers. We
found only a very limited number of references with respect to biometrics.

We wonder whether someone here is familiar with that phenomenon? Do you have any
information about it and are you willing to share some information with us? We
are trying to trace the problem using the systems logbooks and trying to
identify persons with whom the phenomenon occurs. But we still have a lot of
open ends…

It also looks like it is not discussed very open in the biometrics community.
Any information you can share with us is welcome. More specific we are of course
interested in suggestions how to cope these problems.

Any help and /or information is welcome.

Kind regards, Ruud van Munster.

Dear all,

Just wanted to share a with you the availability of a tenure-stream
faculty position at the Department of Computer Science and
Engineering, Michigan State University in the field related to
computer vision and image processing.

For further details please refer to the following link:
http://www.cse.msu.edu/?Pg=45&Col=2

Best regards,
Abhishek Nagar
Ph.D. student,
Dept. of Computer Science and Engineering,
Michigan State University

Hello everyone,

we have released an eye movement biometric database (EMBD v1.0) for the benefit
of eye tracking/biometrics community.
http://www.cs.txstate.edu/~ok11/embd_v1.html

database info:
Size: 358 eye movement recordings collected from 59 unique individuals.
Equipment: All recordings are captured by an Eye Link II eye tracker at the
sampling rate of 1000Hz. Chin rest is employed to stabilize subjects'  heads
during the recording.
Stimulus: pulse-step (jumping dot of light) vertical and horizontal, textual
Recording intervals: response to pulse-step stimulus is collected in two
sessions over the course of a single day, the response to textual stimulus is
collected in four sessions over the course of one week.
Data quality: average calibration error prior to each recording is 1.1 degrees
of the visual angle (SD=1.25), average dataloss during recording 3.59%
(SD=0.05%)

The database was employed in the following works

O. V. Komogortsev, A. Karpov, L. Price, C. Aragon, Biometric Authentication via
Oculomotor Plant Characteristic, In Proceedings of the IEEE/IARP International
Conference on Biometrics (ICB), 2012, pp. 1-8. [.pdf]

C. Holland, and O. V. Komogortsev, Biometric Identification via Eye Movement
Scanpaths in Reading, In Proceedings of the IEEE International Joint Conference
on Biometrics (IJCB), 2011, pp. 1-8. [.pdf]

Dear All,

I wanted to share information regarding publication of the first textbook on
biometrics:

Anil K. Jain, Arun A. Ross, Karthik Nandakumar, Introduction to Biometrics,
Springer, 2011. ISBN: 978-0-387-77325-4

The book is also available online to Springer subscribers at
http://www.springer.com/computer/image+processing/book/978-0-387-77325-4

Best regards,
Abhishek Nagar

Ph.D. Student,
Dept. of Computer Science and Engineering,
Michigan State University, USA

http://latitude.blogs.nytimes.com/2011/12/22/the-false-promise-of-biometrics-in-\
india/

Latitude - Views From Around the World
December 22, 2011, 6:02 am
The False Promise of Biometrics
By AMAN SETHI


NEW DELHI — Earlier this month, just two days after my grandfather and I
received a summons to register for India's national unique identification (UID)
program, a sweeping initiative launched with much fanfare, a parliamentary
committee ordered a review of the project, effectively freezing it.

When the UID program was created in 2009, the idea was to assign a unique
12-digit number to 200 million of India's poorest citizens based on their
biometric information. The goal was to ensure that welfare entitlements would be
delivered to their intended recipients rather than siphoned off by corrupt
middlemen. The project was subsequently expanded to cover India's entire
billion-plus population and serve as the basis for issuing cellphone connections
and bank accounts.

But in its report calling for a review of the UID, the parliamentary committee
noted that in the absence of a legal framework to collect and protect all that
personal information, the database could be abused.

You might think that the freeze would come as a victory to those who have feared
that the UID project would create a state-controlled panopticon under the guise
of curbing corruption — except that the measure was suspended in favor of the
National Population Register (NPR), an older effort to gather the same
information that has far more questionable objectives.

The NPR has its roots in "Operation Pushback," a 1992 government policy launched
under pressure from xenophobic groups in order to identify and deport
undocumented Bangladeshi immigrants from Delhi. It seeks to gather the biometric
data of every single Indian citizen exclusively to assist law enforcement. The
idea gained traction in 2003, while the right-wing Bhartiya Janta Party was in
power.

The Indian government hopes to eventually integrate the UID and the NPR to
create the world's largest biometric database. But it is unclear that either
project can deliver on its promises, and both have the potential to do much
harm.

Lacking the documents to prove that they are entitled to government schemes, a
large percentage of India's poor are currently forced to bribe officials to
obtain benefits. Theoretically, the UID could fix this problem, but as the
parliamentary review committee noted, there are hurdles.

The biometric identification of manual laborers fails in 15 percent of cases,
for instance: it seems that working with your hands blurs your fingerprints.
This means that a significant number of workers could find themselves locked out
of their welfare accounts. UID officials have said that they expect contingency
plans to address such failures as they occur, but in India, contingency plans
have a way of becoming standard operating procedures that enable unscrupulous
officials to subvert the system. Designed as a tool of inclusion, the UID could
thus become a means of exclusion.

The problems with the NPR are even worse. In 2003, the Delhi High Court tasked
the city police with arresting and deporting at least 100 undocumented
Bangladeshi immigrants every day. Officers started rounding up impoverished
Bengali-speaking Muslims who couldn't furnish enough evidence of their
Indianness. At least 40,000 individuals were deported between 2003 and 2006,
according to government figures, and many of them, according to NGOs, were
Indian citizens. If a malfunctioning UID could deny you entitlements, a missing
entry in the NPR could get you deported.

Proponents of the databases insist that technology can help make the Indian
state more transparent and more accountable to its citizens. I am not convinced.
Technology may eliminate certain kinds of corruption by reducing the potential
for human interference in the disbursement of entitlements. But administrators
will still wield inordinate power as the gatekeepers of these vast and opaque
information banks.

Why put our biometrics, faith and freedom in the hands who those who have done
little to gain our trust so far?

Aman Sethi covers conflict, mining and industrialization in central India for
The Hindu. He is the author of "A Free Man."

     * Copyright 2011 The New York Times Company
     * Privacy Policy
     * NYTimes.com 620 Eighth Avenue New York, NY 10018

http://www.nytimes.com/2011/12/24/technology/logging-in-with-a-touch-or-a-phrase\
-anything-but-a-password.html?_r=1&hpw=&pagewanted=print

Logging In With a Touch or a Phrase (Anything but a Password)
By SOMINI SENGUPTA

Passwords are a pain to remember. What if a quick wiggle of five fingers on a
screen could log you in instead? Or speaking a simple phrase?

Neither idea is far-fetched. Computer scientists in Brooklyn are training their
iPads to recognize their owners by the touch of their fingers as they make a
caressing gesture. Banks are already using software that recognizes your voice,
supplementing the standard PIN.

And after years of predicting its demise, security researchers are renewing
their efforts to supplement and perhaps one day obliterate the old-fashioned
password.

"If you ask me what is the biggest nuisance today, I would say it's the 40
different passwords I have to create and change," said Nasir Memon, a computer
science professor at the Polytechnic Institute of New York University in
Brooklyn who is leading the iPad project.

Many people would agree. The password has become a monkey on our digital backs —
an essential key to our many devices and accounts, but increasingly a source of
exasperation and insecurity.

The research arm of the Defense Department is looking for ways to use cues like
a person's typing quirks to continuously verify identity — in case, say, a
soldier's laptop ends up in enemy hands on the battlefield. In a more ordinary
example, Google recently began nudging users to consider a two-step log-in
system, combining a password with a code sent to their phones. Google's latest
Android software can unlock a phone when it recognizes the owner's face or — not
so safe — when it is tricked by someone holding up a photograph of the owner's
face.

Still, despite these recent advances, it may be premature to announce the end of
passwords, as Bill Gates famously did in 2004, when he said "the password is
dead."

"The spectacularly incorrect assumption `passwords are dead' has been harmful,
discouraging research on how to improve the lot of close to two billion people
who use them," Cormac Herley, a researcher at Microsoft, the company that Mr.
Gates founded, wrote in a recent paper. Mr. Herley suggested instead that
developers try "to better support the use of passwords" — for example, by
helping people protect their wireless connections from eavesdroppers.
"Passwords," Mr. Herley continued, "have proved themselves a worthy opponent:
all those who have attempted to replace them have failed."

The touch-screen approach of Professor Memon in Brooklyn works because, as it
happens, each person makes the same gesture uniquely. Their fingers are
different, they move at different speeds, they have what he calls a different
"flair." He wants logging in to be easy; besides, he said, some people find
biometric measures like an iris scan to be "creepy."

In his research, the most popular gestures turned out to be the ones that feel
most intuitive. One was to turn the image of a combination lock 90 degrees in
one direction. Another was to sign one's name on the screen. In principle, the
gesture can be used to unlock a device, or an app on the device that safely
holds a variety of passwords.

Despite their resilience, passwords are weak, notably because their users have
limited memories and a weakness for blurting out secrets. Most people need
dozens of them, and they tend to pick ones that are so complex they need to be
written down, or so simple they can be easily guessed. Recently, criminals have
become adept at stealing passwords by sneaking malicious software onto computers
or tricking users into typing them into an illegitimate site.

Companies like Facebook and Twitter have sought to address the frustration with
passwords by allowing their usernames and passwords to open the door to millions
of Web sites, a convenience that brings obvious risks. A thief with access to a
master username and password can have access to a host of accounts.

Rachna Dhamija, a California computer scientist turned entrepreneur, sought to
combat those weaknesses by breaking up the password. The user first logs in to
the service that Ms. Dhamija built, UsableLogin, and signs in with her own
partial password. Behind the scenes, the service verifies that the user is on an
authorized device, and pulls the third piece from the cloud, generating a unique
password for any Web site that the user wants to log in to — Facebook, for
instance. In other words, one piece of the password rests with the user, another
is stored in her device, and a third piece is kept online.

"You take a secret and you spread it across," said Ms. Dhamija, whose service
was recently acquired by Webroot Software, based in Broomfield, Colo. "You're
spreading the risk. The password is not stored in its whole form anywhere."

But even if a user has been authorized at the start of a session, what if
someone else gains access to her computer an hour later? Darpa, the Defense
Department's technology research arm, has invited security researchers to
develop ways to verify a user every instant, based on the way the individual
uses the machine — "for example, how the user handles the mouse and how the user
crafts written language in an e-mail or document," it explains on its Web site.

Each of these techniques is driven by the notion that a password alone is an
insufficient means to verify online identity. Think of them as a fortification:
a password-plus.

Many companies use a smart card or a security "dongle" — a small piece of
hardware that plugs into the computer and functions as a key — as that second
step of verification to allow access to internal networks. Today, biometrics —
an individual's unique physical traits — are emerging as an alternative.

At least a half-dozen banks in the United States ask their customers to verify
who they are by reciting a two-second phrase to a computer over the phone, in
addition to punching in their PINs. It could be as simple as "at my bank," and a
million customers could recite the very same phrase and still sound unique,
according to Nuance Communications, a company based in Burlington, Mass., that
makes the technology.

As mobile phones become bodily appendages for people worldwide, they too are
emerging as instruments to verify identity. Google introduced its two-step
process earlier this year. It sends a six-digit code to an application on a
Google user's cellphone to be entered, along with a password, when signing onto
a Google account on a computer or tablet. The code can also be sent as a text
message for those who don't have smartphones, or it can be conveyed through a
phone call.

The extra step is not mandatory, and the company will not say how widely it has
been adopted. But as vulnerable as passwords are to theft and compromise, Google
says, it is increasingly important for a user's identity to be verified through
another channel — a cellphone, in this case.

"I think we'll start to see people using their mobile devices as their pervasive
identifiers," said Brendon Wilson, a security researcher at Symantec. "The
password will no longer be the final arbiter that you are you. You will see
layers on top."

http://bits.blogs.nytimes.com/2011/12/23/finding-the-unique-in-you-to-build-a-be\
tter-password/?pagemode=print

Bits - Business, Innovation, Technology, Society
December 23, 2011, 9:25 pm
Finding the Unique in You to Build a Better Password
By NICOLE PERLROTH
Demo image of Microsoft's new picture password.


Sophisticated hackers can now crack into an account in one second. Using
automated password-cracking software, hackers can crack 1,000 accounts in 17
minutes, according to Imperva, a data security firm.

That's hardly surprising when you stop to consider the passwords that stand in
their way. Last July, Daniel Amitay, an iOS developer, wrote a creepy line of
code that anonymously surveyed passwords for some 204,508 iPhones and found
"1234" was by far the most common.  The runner-up: 0000.

In Saturday's New York Times, my colleague Somini Sengupta reported about
efforts by security researchers to supplement, and perhaps one day get rid of,
the old-fashioned password. Their work is urgent. For now, hackers are still
focused on computers. But as more people store sensitive data like bank account
and credit card information on their smartphones, mobile devices are poised to
become a magnet for hacks, security experts say. And with millions more
smartphones making their way into consumer hands, technology companies and the
government are beginning to second-guess the way we log on.

"It's an exciting time in authentication," said Brendon J. Wilson, an
authentication researcher at Symantec, the computer security firm. "There's a
lot going on under the covers to figure out whether a person really is who they
say they are."

In its recent forecast for 2012, I.B.M. predicts that we may never need a
password again: "Biometric data – facial definitions, retinal scans and voice
files – will be composited through software to build your DNA unique online
password," the company said in a blog post.

Retina scan authentication for smartphones is not so far off. Dozens of police
departments across the country now use a smartphone-based retina scanning
technology made by B12 Technologies, a biometrics outfit based in Plymouth
Mass., to match suspects with a criminal database. For now, privacy concerns and
the retina scanning technology's $3,000 price tag has kept it from going
mainstream.

But biometric authentication is by no means foolproof. Google's new Android 4.0
software, the Ice Cream Sandwich, inadvertently exposed its vulnerabilities. Ice
Cream Sandwich uses facial recognition technology to match users to their
devices, but clever hackers have already found a way to unlock the phones using
a photo. Likewise voice recognition can always be compromised if a hacker
records a victim's voice and replays it for a machine.

The most serious problem with biometrics, said Tal Be'ery, a senior Web
researcher at Imperva, is that "once your digital biometric signature is
compromised, you cannot even replace it."

This may explain why the government is beginning to take a more behavioral
approach to authentication. The Defense Advanced Research Projects Agency, or
Darpa, is developing ways to identify device owners and account holders using
unique behaviors like hand gestures and typing styles.

"My house key will get you into my house, but the dog in my living room knows
you're not me," Richard Guidorizzi, a Darpa program manager, stated in a press
release. "No amount of holding up my key and saying you're me is going to
convince my dog you're who you say you are. My dog knows you don't look like me,
smell like me or act like me. What we want out of this program is to find those
things that are unique to you, and not some single aspect of computer security
that an adversary can use to compromise your system."

Last week, Microsoft introduced a behavioral password system for its new Windows
8 operating system. Its so-called picture password has three parts. In addition
to a usual password, Windows asks users to upload a personal photo and make
three or more touch-screen gestures on top of it. Because smudges risk giving
gestures away, Windows remembers not only where the user gestured but how they
gestured. Which gesture did they make first? Did they move their finger left to
right or right to left? Did they draw a circle clockwise or counter-clockwise?

"When the types, ordering and directionality are all correct, we take a look at
how far off each gesture was from the ones we've seen before, and decide if it's
close enough to authenticate you," Microsoft's product manager, Zach Pace, wrote
in a blog post.  He said Microsoft's three-gesture password was as secure as a
randomly generated six-digit PIN — and much easier to remember.

Mr. Wilson of Symantec cautioned that every authentication system had its
drawbacks. "It's always best to use a number of authentication mechanisms," he
said. "Every single one of these solutions has its vulnerabilities."

Is anybody aware of studies that try to perform a reliable iris identification
with images from a regular webcam?

Also are there studies out there that investigate the prevention of iris
spoofing techniques?

http://www.physorg.com/news/2011-12-unleash-car-seat-rear.html

(PhysOrg.com) -- Cars of the future may use the driver's rear end as identity
protection, through a system developed at Japan's Advanced Institute of
Industrial Technology. A report surfaced earlier this month that researchers
there developed a system that can recognize a person by the backside when the
person takes a seat. The system performs a precise measurement of the person's
posterior, its contours and the way the person applies pressure on the seat. The
developers say that in lab tests, the system was able to recognize people with
98 percent accuracy.

The car-seat team led by Associate Professor Shigeomi Koshimizu wants to
commercialize their work as an anti-theft product in two to three years if
automakers agree to collaborate. The Institute began working on the seat idea
last year.

The bucket seat's lower section is lined with pressure sensors. Pressure is
measured on a scale from 0 to 256. A total of 360 sensors in the seat send their
information to a laptop, which aggregates the information, generates the key
data and produces a precise map of the seated person.

As the process suggests, the device is targeted for use as a personal identifier
and is being promoted as a useful option to having to use more familiar
biometric techniques. The researchers have discussed advantages to this seat
identifier.

They say that traditional biometric techniques such as iris scanners and
fingerprint readers cause stress to people undergoing identity checks, while the
simple act of getting seated carries less psychological baggage. Their other
point is that other technologies such as fingerprint scanning can be compromised
when sensor surfaces are unclean, or when there is poor lighting as in iris
scanning, contaminating results.

Koshimizu sees the possibilities of this device being used beyond auto-theft
identity protection to a device for security identification in office settings,
where users log on to their PCs as they sit down.

Their work at the institute is yet another indicator that sensors are in focus
in many areas of today's research. Sensor vendors are quick to remind everyone
that sensors will be around us everywhere, in the home to remind residents to
take medicine and turn things on and off, to parking meters transmitting data,
to sensors in transport.

Car sensor technologies are being developed that bridge varied car scenarios
from driver only to vehicles providing dual driver/self-driving modes to
self-driving cars. Research efforts are resulting in sensors that tell the
driver there are obstacles ahead along with a range of sophisticated sensors
envisioned for robotic cars on tomorrow's highways.

© 2011 PhysOrg.com

(And now the butt of our humor...)