ID card 'will drown in a billion mismatches'

The government has underestimated the likely failure rate of the ID card scheme, according to a biometrics expert who reviewed the system.

The ID card scheme will guard against one person having multiple identities by checking the two fingerprints and facial scan held on a chip on the ID card against biometrics in a central database, the National Identity Register.

But academic John Daugman, a former member of the Biometrics Assurance Group (BAG) which reviewed the scheme, says its reliance on fingerprints and facial photos to verify a person's identity will cause the system to collapse under the weight of mismatched identifications.

silicon.com's A to Z of Biometrics

Click on the links below to find out everything you'll need to know about biometric security.

A is for Accuracy
B is for Behavioural biometric
C is for Cash machine
D is for Database
E is for Ear
F is for Facial recognition
G is for Gummi bears
H is for Hand geometry
I is for Iris
J is for Juan Vucetich
K is for Keystroke dynamics
L is for Liveness testing
M is for Mobile phones
N is for Network security
O is for Oxford
P is for Palm
Q is for Queues
R is for Registration
S is for Signature verification
T is for Twins
U is for Universality
V is for Voice verification
W is for Walk
X is for X-ray
Y is for Young
Z is for Zurich Airport

Daugman, an expert on iris recognition, says fingerprints and facial photos are not distinctive enough to be able to tell the UK's 45-million-strong adult population apart.

Daugman said that even if the error rate was as low as one in a million, the 10 to the power of 15 comparisons needed to verify the IDs of 45 million people would result in one billion false matches.

He told silicon.com: "The use of fingerprints will cause deduplication to drown in false matches.

"The government was badly advised by its internal scientists in the Home Office when it took the decision to base the biometric system on fingerprints instead of iris patterns.

"Only iris patterns have enough randomness and distinctiveness to survive so many comparisons without making false matches."

The Home Office refuted allegations that the scheme would be swamped with false matches, citing the example of two already operational schemes larger than the ID card - the FBI's fingerprint database with more than 50 million records and the US-VISIT database with more than 80 million records.

A spokesman for the Identity and Passport Service said: "Unexpected matches reported by an automated fingerprint system are checked by expert human fingerprint examiners."

"The level of false matches for current large scale automated fingerprint systems is sufficiently small that it is entirely practical to use human examiners to resolve them," he added.

Daugman also echoed the findings of the recent BAG report, which said there could be about four million elderly people in the UK whose fingerprint skin is either too dry or fine to take useful prints from.

Speaking at the launch of the UK's first ID cards on Thursday, Home Secretary Jacqui Smith claimed problems with taking or recognising fingerprints pose no threat to the effectiveness of the ID card system.

"Because it is so exceptional, it is not going to be a problem that undermines the entire scheme," she said.