A (2:59)

The butt biometrics sounds intrusive, but in fact it had a practical application. Was is this your car or not. Right. Should the car start when you sit in the seat?

B (3:06)

Yeah, it would be very good for that, of course, as long as you don't go on diet and lose weight suddenly, in which case. Or put on car. Yeah, but you know, some of these technologies are sort of fringe technologies. They're not really going to get very far. But others, such as DNA and possibly brain waves, eeg, are very likely going to be moving even more to the center stage than they are today. So there's a lot coming down the road that we really can't predict very well.

A (3:36)

And of course, this is growing so quickly, not only because there's demand for it, but also because the massive increases in computing power, the falling costs of both transmitting data and analyzing it, means that you can, at quite low cost, gather information on, say, iris scans for hundreds of millions of people.

B (3:56)

Yes, that's true. In fact, as we've been watching the price and the cost of the hardware and the software come down, it seems from our estimates that these costs are now lower than the costs of the logistics involved. For example, if you're doing a survey, it costs money to get a team out in the field. You have to do that anyway. And the incremental technology costs are probably not all that high anymore. I should say, Lawrence, that part of that cost reduction has actually been driven by developing country programs. India has been very important there in setting standards to enable more competition between different companies. And one of the sponsors of the Winter Biometrics Summit is actually a consortium which is pushing standardized programming interfaces. So this area is opening up to more competition.

A (4:51)

I think it's interesting that those of us in the west who have identification, we might not be able to find our birth certificate, but we were registered at birth and subsequently got a Social Security number and a driver's license. We tend to take this for granted. Whereas those in the developing world and in the developing community get very excited about biometric ID as a technology of empowerment. But for those who aren't familiar with the lack of an ID and how costly that is, I wonder if you can explain, why does ID matter to, say, a poor person in India?

B (5:27)

Well, Lawrence, if you look across the world today, there are probably about 750 million children. This is people under the age of 16 who do not have birth certificates, who've never been officially read registered. Some of these will catch up later through national ID programs, but others will not. And for these people, it's very difficult to transact. It's very difficult, for example, to register property. It's Difficult to get licenses in various types. It can be very difficult to open a bank account because banks need to know who they transact with. It's also difficult for governments if they have programs which are serving people, to. To be able to know who these programs are serving. And so you're having quite a big movement now globally to use this technology to increase the precision by which people can authenticate themselves and also by which they can be identified for various purposes by government and by private firms. If you look at the US today, and you look at some of the mess that we're in, including, for example, credit card fraud, that's an example of a system which is increasingly insecure. So moving to some of these technologies can help.

A (6:45)

The first time I came across this notion was when our former colleague here, Ruth Levine, was doing work on girls and women. And one of the strong recommendations coming out of her research was to have birth registration for girls. Because if they're not registered at birth, how do you know when they don't show up for school? When they're five or six? Because they're non persons, there's no record that they were ever born.

B (7:09)

Yes, exactly. But to give you another example, it's even worse than that. I recently came back from another conference in Cambodia, which was the 10th government forum on electronic identity. And in Cambodia, people have been registered, but because of conflict, you may remember the Khmer Rouge period, documentation has gone. So even if you were registered originally, you may not be able to find a birth certificate.

A (7:40)

I can't find my birth certificate. I haven't been through a war, so I can only imagine with those kinds of disruptions.

B (7:45)

Yeah, but you can probably go to a local registry and you can request a copy. In many of these countries, either the copies are not there, they've been destroyed, or the registries are in such disarray that they can't even find a copy. In some countries, for example, they actually store documents indexed by first name, which is not terribly helpful.

A (8:07)

We're going to go to a break. Before we do, I want to confront the gorilla in the room. For a lot of our Western listeners, and maybe for other people as well, which is privacy concerns. This just has Big Brother written all over it. If I'm nervous that the government is, you know, hacking my data, listening to my cell phone calls, it's going to have my biomedical records, and all of that is going to be organized around a single identity, then I can never escape. What do you say to people who worry about that kind of thing?

B (8:38)

Well, I think it's a very.

A (8:39)

Or maybe I should say, why shouldn't we worry about that kind of thing?

B (8:42)

Yeah, well, I think it's a very real concern, Lawrence, and it's something that does need to be looked at. It's clear that the technology is outrunning the legislation. That's the first thing that you see. And I think that's true not only in the area of personal identification, but in a whole range of other areas, including things like Facebook, Google, electronic transactions, credit cards, all of that area. So there's a very big agenda out there which is not just confined to personal identity. And I would say two things or three things, really. One is that there does have to be attention to some basic principles as these programs are implemented. The things that have been called by some fair information principles. We asked an expert to write a paper on this for us. It's a CGD working paper looking at the general question of fair information principles and how these can be applied to identification. It's not a simple question because concepts of privacy do differ between countries. So there isn't really an exactly uniform definition of privacy, although the European Union and the US together sort of form the center of that understanding. But secondly, it's very hard to argue that people at the bottom of the pyramid, and they almost are all people at the bottom of the pyramid, should not have an ID on the grounds that ID may be abused. Because it's interesting that despite all the screams about id, the ones that don't have it, and therefore who by this argument should be the most privileged because they have the greatest privacy, also the poorest, and they have privacy in that sense because nobody cares about them. They don't participate.

A (10:30)

And given the opportunity, they line up.

B (10:32)

Given the opportunity? Yes, given the opportunity, they line up. In general, that is true. And I think there's a very strong lesson actually coming out of the comparative experience, which is that people will come forward. People are not afraid of technology, provided they think that it has something to offer them. And I think this is the onus that this technological development has, is to show that it actually has something it can offer people.

A (10:57)

I'm reminded of the new iPhone, which I gather has a fingerprint identification. And even for people who are upper income and have some privacy concerns, I think we'll be driven to this kind of thing by convenience. It's like, how hard is it to get into your bank account? There's all these things you have to remember. And would it be easier if they had my iris scan? It could be. Could look at the camera. So I think some of us, when we're faced with the real trade offs, will say, yeah, okay, I'll give them the biometric information. It would save me a lot of trouble.

B (11:25)

I think that's true, Lawrence. I think, though, that what is going to happen is that the identification technologies are going to move increasingly towards multimodal models. You know, basically there are three ways that you can authenticate yourself. It can be something that you have, like a token or a. A card, like an ID card. Yeah, that's something you have. It can be something, you know, which is a PIN or a password. And it can be something that you are, like an iris print. And increasingly, the approaches towards authentication are combining these three. When you combine three of these together, for instance, it becomes a much more powerful system.

A (12:06)

We've gotten into what I want to do in the second half, which is the new frontiers. We've covered the basics. We're going to take a break. When we come back, I want to hear not only about these three modes, how they're combining, but some of the new things that you expect will be coming up at these new conferences. This is the Global Prosperity Wonkast from the center for Global development, I'm Lawrence MacDonald and I'm chatting today with Alan Gelb, senior Fellow here at CGD about advances in biometric identification and why that matters for development. We will be back in a bit.

B (12:43)

Sam.

A (13:08)

Welcome back to the Global Prosperity wonkcast. I'm Lawrence MacDonald, my guest is Alan Gelb and we're chatting about biometric ID and development. Alan, just before the break, you started to say that there are three ways that a person can be identified. I'm going to give myself a quiz. There's something you carry, like my driver's license, which you call a token. There's something, you know, which is like the PIN in my head, which I constantly forget. And there's something that you are, which presumably you can neither lose nor forget. And that's your iris scan, your voice print, your fingerprint, your butt print, your body odor, all those things.

B (13:45)

Yep, that's right. You got it right.

A (13:48)

And so you're saying these things are increasingly combined into a single identity, meaning I've got to have my card with me and remember my PIN and let them scan my iris in order to do the thing I want to do.

B (13:59)

Well, these things are already combined in various combinations now. For example, if you take a look at the new style credit or debit cards, they will be a combination of a card plus a PIN So that'll be something you have and something that you know. Now, of course, that's fine, but you can give your PIN to someone else so someone else can transact on your card. So the third layer of you write.

A (14:22)

It down on your card because you can't remember it until you lose the card.

B (14:26)

Yeah. Or you. Or you write it down on your card, which is not a very smart thing to do. But people.

A (14:31)

People do it all the time.

B (14:31)

People do it all the time. Yeah. So what? The most difficult kind of systems to crack are the ones that combine a number of these things. So you have to do several things together, but the different technologies are used at different stages of this process. And to see this, it's very interesting to look at a country like Estonia, which has right now the most advanced system for virtual identity in the world, electronic identity. In Estonia, every citizen has a card. It's a card which is issued against certification, including fingerprinting, to make sure that the recipients are unique. And on that card there are two PIN numbers. One is for authentication, to show who you are, and the other is for signing documents. So with that kind of system, the pins are kept within the card themselves. They are under the control of the users.

A (15:34)

If you steal my card, you can't.

B (15:36)

Read it some way. Yeah. If I steal your card, I can't duplicate your pin. Right. Unless I happen to know that pin. Or else. Unless I'm incredibly lucky, which would be a very small probability. And of course, if your card is stolen, you go back to the registry and cancel the certificate, which means that card is no longer usable and you get a new card. Right. But in the process of enrolling for that, how are they supposed to know that you, Lawrence, don't have 20 cards, which I'm sure is something it would occur to you to do, so that you could pretend to be different people. Right.

A (16:09)

Pension payments.

B (16:10)

Get a pension payment on each one. Yeah, yeah. So for that purpose, they will use biometrics to make sure that they can identify you against the rest of the population. So these are being used in different ways. And it's not clear to me that for remote authentication, that biometrics is going to be the only, or indeed the major technology.

A (16:31)

Remote authentication. You mentioned before the interview that that's one of the new frontiers you said. I think on air that that was something. There was a lot of discussion at the conference in Cambodia. What do we mean by remote identification?

B (16:44)

Well, I think that the Connect ID prospectus for the conference says it very well. It explains that identification is Increasingly, three things. It's increasingly global, it's increasingly mobile, and it's increasingly transactional. So looking ahead in the future, as individuals engage in transactions, whether it's going to be commercial transactions or transactions with government, that these transactions will require them to be able to authenticate who they are. And many of them will be cross border, including, of course, travel. Cross border.

A (17:20)

Authenticating who you are without being there.

B (17:22)

Without being there? In some cases, yes. In some cases, without being there.

A (17:26)

If you walk when I access my Amazon account.

B (17:28)

Exactly.

A (17:29)

I need to remember this impossible password to tell them I really am the person that does business with me.

B (17:34)

Yeah, exactly. And the question is, how do you develop a secure system for this? And right now there are different types of systems which are competing. One system is to actually embed credentials within a mobile device, within, for example, a cell phone, so that the cell phone or the SIM card and the cell phone actually contains your identification credentials. Another approach is to keep the identification credentials separate on a card, which is what they would do in Estonia, but make that card readable by a cell phone through near field technology. So basically, when you want to transact through your cell phone, you authenticate yourself using your card through your cell phone, but the credentials themselves are not kept on the cell phone, they're kept in the card.

A (18:22)

Well, that seems to me like it's the obvious winner because I might want to undertake a transaction and not have my phone, the phone's lost, broken, out of date.

B (18:32)

Or you might have several phones.

A (18:34)

Yeah, indeed.

B (18:35)

Exactly. Well, some people think that exactly for that reason, this kind of approach is going to be the one that wins out in the end.

A (18:42)

Why are people putting money on the other one? It seems maybe there's something about it that I'm missing that has some appeal.

B (18:49)

Well, I think that, Lawrence, some people think that the cell phone, or the equivalent of a cell phone is going to become the unique device that people carry. And they're looking very hard to find something which is unique, which is simple, which is one thing. And clearly having a separate card and a cell phone means you have to have two things. I suppose you could always design a. A cell phone holder that slips your card into the back of the cell phone, in which case it would be readable. So you could physically combine the two elements. I'm sure we'd see that, well, if.

A (19:27)

I have my card, I really only need one thing, presuming I can also go to your PC and say, hey, this is me, and then do what I need to do.

B (19:37)

Right, sure.

A (19:37)

I don't actually need to own any device, especially in poor settings, people may not have devices.

B (19:43)

Yes, exactly. And that to me, I agree with you. I think that that is a more promising technology than embedding it into cell phones. But you know, right now you're seeing companies competing with different types of solutions and that's really what's driving this forward.

A (19:57)

So what else is new that you expect to come up at these conferences? There's the remote identification. We've heard about a couple systems competing. What else?

B (20:05)

Well, the other one that's I think very interesting coming up is really right at the other end of the spectrum. I mean, remote identification is the sort of technology frontier. But the other issue that is coming up is more and more is the question of children, how to identify children. And here we have a very interesting situation. We've talked about birth registration already and the fact that a lot of children don't have birth certificates. But in addition to that, there is another problem which is that birth certificates are not terribly secure. There is no standardization across countries or sometimes even across regions on birth certificates. They can be easily forged and sometimes it's very difficult to go back to the source, the registration source, to verify a certificate. And at the Cambodia conference there was some discussion of a quite alarming number, percentage of French passports that have been issued, which supposedly have been issued to the wrong people because of fraudulent or wrong birth certificates. So unless you have the birth certificate fairly secure, you're building an ID infrastructure on a pretty flimsy foundation.

A (21:20)

So can you take a baby and get her iris scan and her fingerprint and you're off to the races?

B (21:25)

Well, not right now. You can get an iris scan down to about three years. Apparently it's possible to iris scan down to around one year, but it's very difficult to get the baby to hold their eyes open to be scanned. But the Indians in their UID program will scan children as young as five or six. However, there is one technology you can use if you want to, to lock, if you like, a body into a credential from birth and that's DNA. You could now technically create DNA enabled birth certificates where anyone could be checked at any time against their credential. But this is costly. It's certainly beyond the reach of most countries and it probably would be seen as intrusive by many people.

A (22:16)

Did you have to extract.

B (22:17)

That would be the only thing.

A (22:18)

Did you sample blood or.

B (22:19)

No, no, no, that's not the problem. You can just do it from a saliva. But still most people would see that as being probably today they would see it as being intrusive, but it's really the only way now where you could actually lock an infant in against its birth certificate if you wanted to do that. I think that's in the future, if at all. Meanwhile, what's happening is that the best practice is to lock in the infant's or the child's identification with that of the mother.

A (22:47)

I think we need another term than locked in since this is manifestly good for the child. Yes, but being locked in is not. We need a way to talk about this that doesn't sound so alarming.

B (22:58)

Yeah, yeah, I think you're probably right. That is not the right, the right terminology, especially given the association between fingerprinting and law enforcement.

A (23:07)

The point is to uniquely identify a child is difficult, is difficult because as we mentioned before, if the child has not been identified, especially in the case of girls, but boys too, then how do you know if they show up for school? How do you know if they die? You know, you don't have that information.

B (23:23)

Yeah. In most countries, you know, Lawrence, in terms, in order to get an official identification credential, you have to have some interaction with the government. There has to be a point of interaction. And the question is, what is that point of interaction? Is it the hospital that you're born in? If in fact you're born in a hospital, you. Is it when you first go for vaccinations, for immunization? Is it when you first go to school? Is it sometimes later when you leave primary school and you go to secondary school? And different countries have different points in time that they're using to ID individuals within their country. There's no uniform practice here, but it's something that's being debated very much. In some countries, for instance, it's possible to get the equivalent of a retroactive birth certificate for children as old as 16, which to me is a very sensible thing because it's not the children's fault.

A (24:18)

In the notes you gave me for this interview, you said that 40%. Am I getting this right? 40% of children are not registered at birth?

B (24:26)

It's something like that.

A (24:28)

50 million births per year, almost 40% are not registered at all.

B (24:33)

Yes. Even today. I mean, there's been a lot of progress in some countries and regions. In Latin America, for example, they've brought down the rate of non registration by half over the last 10 years and now it's under 10%. But in the, you know, they're a middle income region and in the poor parts of the world, particularly South Asia, sub Saharan Africa. There's still lots of countries with very low levels of birth registration.

A (25:00)

Alan, thank you very much. I think we're going to have to leave it here. The thing that I've been remiss at is not plugging your forthcoming book. We were chatting beforehand. I guess the title is still a work in progress, but I like the one Individual Identity, Rights and Development. I think there's going to be a big appetite for it when it comes out.

B (25:18)

Yeah. Lawrence, thank you. I think that's a good title, and I think it summarizes the nature of the debate that's going on. And of course, one particular focus of this is how technology is changing the nature of that debate on both sides, how it's making certain things easier but also raising new concerns that were never there before.

A (25:40)

Thanks very much, Alan. This has been the Global Prosperity Wonkcast from the center for Global Development. My guest today is Alan Gelb, and we've been discussing biometric identification and development and watch for his forthcoming book. You'll hear about it here. When it does come out, Individual Identity, Rights and Development. You can find the Wonkast online on itunes and on Stitcher. That's my favorite way to get podcasts. Just search for Wonkast or CGD and sign up to hear a new interview every week. Until next time, I'm Lawrence MacDonald. Thanks for listening.

B (26:25)

Sa. Hey.