Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 1

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 1 Gap Analysis of the Department of Homeland Security s Use of Biometrics Camille J. Acred Southwestern College Professional Studies MSA 570 Homeland Security Defense and Administration Week Six Portfolio Assignment Professor William J. Howard 23 September 2012

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 2 Abstract Resulting from the terrorist attacks of 9/11, the United States is extremely focused on advances in technology supporting the safety of our homeland. The Department of Homeland Security was instituted to keep America safe from all attacks. Immigration reform and the increased risk of terrorism on American soil have spawned the United States Visitor and Immigrant Status Indicator Technology (US-VISIT) program, aimed at enhancing the security of our citizens and visitors. US-VISIT does this by supplying the technology for collecting and storing biometric data, and providing it to designated federal agencies in order to support information sharing by the law enforcement and intelligent communities. There are several types of biometric modalities in use today and several other modalities currently being developed which could make our data profiles on individuals even more accurate.

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 3 Gap Analysis of the Department of Homeland Security s Use of Biometrics Biometrics is a term commonly used in America with the increase in terrorism and security awareness. By definition, biometrics are the measurable biological (anatomical and physiological) and behavioral characteristics that can be used for automated recognition (Bush, 2008). Examples of biometrics include fingerprints, facial recognition, and iris recognition. Since the catastrophic terrorist attacks of 9/11, The Department of Homeland Security (DHS), whose primary mission is to keep America safe from any type of threats, is deeply involved in all aspects of terrorism defense, including biometric technologies. This gap analysis will discuss DHS s current use of biometrics and any potential uses which may be used in the future to further protect our nation. DHS s biometrics program is the United States Visitor and Immigrant Status Indicator Technology program, commonly referred to as US-VISIT. The Office of US-VISIT falls under the National Protection and Programs Directorate (NPPD). DHS s organization can be confusing, therefore I have included the following chart for further explanation (see figure 1). US-VISIT initially provided fingerprint-based and photographic identity verification and analysis services to federal, state, and local government decision-makers to help them accurately identify the people they encounter and determine whether those people pose a risk to the United States. Focusing primarily on international travelers at U.S. visa-issuing ports of entry, US- VISIT helps immigration officers determine whether a person is eligible to receive a visa or enter the United States. The biometric collection processes used by US-VISIT is simple, convenient, and secure (US-VISIT). US-VISIT is continuously improving and adding to the standards and capabilities of the program as new technologies become available.

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 4 Figure 1 DHS Organization (DHS Organization Chart) Organizations supported by US-VISIT are the Department of Defense (DoD), U.S. Coast Guard, Department of Justice (DoJ), U.S. Customs and Border Protection, and U.S. Citizen and Immigration Services. Organization Requirements or Mandates US-VISIT is required to meet objectives outlines in National Security Presidential Directive (NSPD) 59, Biometrics for Identification and Screening to Enhance National Security. This directive requires them to coordinate the sharing of biometric and associated biographic and contextual information with other Federal agencies and foreign partners in accordance with applicable law (Bush, 2008). This policy stemmed from the lack of information sharing by law enforcement and other government agencies leading up to 9/11. NSPD 59 resulted in US-VISIT being the centralized location of all biometrics collecting, handling, and storage for all federal entities. The DHS document, Biometrics Standards Requirements for US-VISIT, clearly states

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 5 requirements for the collection, handling, storage, and transmission of biometric profiles of all types; including details such as the types of computer systems and encryption codes that must be used for each modality. US-VISIT also participates in the development of new biometric technology. There are constant technological advances in the field of biometrics, and US-VISIT is directly involved with many of the organizations responsible for these advances, e.g. The Registry of United States Government Recommended Biometric Standards. An investigative technique that began with fingerprints and photographs has evolved to iris scans, palm prints, etc. The main focus of US-VISIT is to support our fight against terrorism. US-VISIT provides data profiles to The Terrorist Watchlist (TWL), working directly with the Federal Bureau of Investigation (FBI), DoJ, Central Intelligence Agency (CIA), and Terrorist Screening Center (TSC). Data profiles which are part of the TWL are extremely sensitive and require transmission only through The Terrorist Watchlist Person Data Exchange Standard (TWPDES); this procedure is also outlined in Biometrics Standards Requirements for US-VISIT. It is important to remember that prior to 9/11 each agency, whether it be state, federal, or DoD, was completely separate from other agencies. Because of this, each of their standards were completely different. It is only in the past couple years that we have tried to merge them together into one standard; a difficult task. This is further supported by DHS in their statement: The diversity of transmission profiles and standards is due in part to the fact that the systems were implemented at different times and were intended to address the different mission requirements of Federal, State, and local law enforcement, military applications, and International police action; and in some cases because the standards available at the

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 6 time were not sufficiently developed or have been updated since the original system implementation. (Biometrics Standards Requirements for US-VISIT, 2012) Current Performance Effectiveness In the field of biometrics, there are two primary tools for measuring effectiveness; False Rejection Rate (FRR) (also known as False Non-Match Rate [FNMR]) and False Accept Rate (FAR) (also known as False Match Rate [FMR]). FRR is basically the number of times people are not identified when they should be while FAR is the opposite; the number of times people are identified when they should not be (Identity One). To give an idea of the actual results of biometrics within the US-VISIT program I have included the following analysis: According to the U.S. Department of Justice s analysis of US-VISIT after its first year of operation, on average 118,000 people pass through each day. Of these, 22,350 are subject to secondary inspection and 1,811 of these are refused entry. Of those who are subject to secondary inspection, 92 percent are subsequently admitted to the United States. (Jain, 2007) Currently, biometrics used within US-VISIT are extremely effective, with a much lower FRR and FAR than in 2007. The main issue of effectiveness now is the actual data profiles, which are having issues such as multiple names associated with a fingerprint, name misspellings, or date of birth issues. NSPD 59 requires federal agencies to disseminate accurate information associated with individuals and as of now, this is the biggest violation in the biometrics industry. Based on a recent inspection of US-VISIT published by DHS, it was found that US-VISIT needs to improve procedures that specifically target individuals using multiple biographic identities to enter the United States (Office of the Inspector General, DHS, 2012).

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 7 Gap Analysis Biometric technology has improved greatly in the last decade, a prime example being fingerprints. Initially two fingerprints were taken from individuals entering the United States, leaving two fingerprints which needed to be matched for identity verification. Currently all ten fingerprints are taken when entering the United States, ensuring much more accuracy because of the requirement of matching all ten prints. This is also true within the DoD where initially we took two fingerprints of suspected terrorists or detainees, and now we take all ten. Forensic labs supporting Iraq and Afghanistan take latent prints off weapons and explosive devices, having more fingerprints on file results in a greater chance of catching those responsible for attacks against coalition forces. The point of this system is information sharing, and all fingerprints taken by DoD are accessible to the aforementioned agencies. If a former Iraqi detainee attempted to enter the United States, we would identify him through US-VISIT. In this following, the biometric modalities currently in use are presented in addition to their advantages and disadvantages, and also the direction they appear to be going in the future. Examples will be used to help illustrate these points as much as possible. Fingerprints Fingerprints are the most popular form of biometrics and have been around the longest; over one hundred years. Fingerprints are very easy to collect; collection no longer requires ink and they can be taken in a mobile or even combat environment using small digital devices. The accuracy of using fingerprints for identification has proven effective over time. Fingerprints are unique to an individual and remain permanent throughout a person s life unless disfigured in some way.

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 8 The disadvantages of fingerprinting are that there is so much fingerprint data, storage and handling can cause problems. As with all biometric data, care must be taken during collection to ensure the best results. In combat situations, it is easy to input fingerprints incorrectly. Collecting ten fingerprints per individual generates more data, and increasing the quantity of data unfortunately increases the chances of inaccuracy. Many of the problems arising within US- VISIT are dealing with incorrectly processed fingerprints, leading to multiple identities popping up for one set of prints. The National Science and Technology Council (NSTC) (2012) mention another disadvantage being public perception and the link between fingerprinting and criminalizing people. This disadvantage is insignificant; we are concerned with immigrants and possible terrorists entering the United States, biometric procedures are now standard for entering the country therefore; there is no reason to associate this procedure with criminal processing. There should not be many changes in the future regarding fingerprinting. This technology has already improved by taking ten prints rather than two from each individual. What does need to be perfected is the collection, storage, and transmission of fingerprint data. The errors currently in this system within individual data profiles need to be fixed as well. As a biometric collector in Iraq there were many times we had multiple identities listed for one fingerprint, the process to fix the database was lengthy, but possible if you had the person in custody. If we wait and release the individual there is less of a chance of the profile getting corrected. This means at US ports of entry, time would have to be spent on the individuals who brought up multiple profiles in order to correct them. Iris Scans Technology has been established that makes scanning the iris very simple through the use of handheld devices, even in combat situations. I have conducted iris scanning on hundreds of

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 9 individuals using handheld devices and when done properly it is effective. The iris is like a fingerprint and does not change throughout your life. The iris is more advantageous than a fingerprint however since it is protected within the eye and less prone to injury. Although it is easy to scan an iris, it does take proper training and in many cases, proper lighting. The eye has to be open wide and focused in the correct position. This is a difficult task when working with foreigners just due to the language barrier and directing them in which way to look. I did not have any problems when using interpreters. As with fingerprints, there can be problems with the data. In Iraq there were individuals who had biometric profiles but they would not pop up using only an iris scan. This problem usually resulted from a poorly taken iris scan in the initial collection of the individual. As with the fingerprint, this could also be fixed in the database, but it had to be done with the person present. Another issue addressed by NSTC (2012) is that an iris scan cannot be analyzed or verified by a human. This modality relies solely on technology, which is a big disadvantage. A reliance on technology contributes to the FRR and FAR resulting from iris scanning. Facial recognition Taking a photograph of an individual for identification purposes is not a new idea. This modality is great because it is easy, requires little technology (a camera or phone), and can be verified by human eyes. A photograph is always attached to an individual s data profile. There are plenty of disadvantages to using photographs for identification purposes, the most obvious being disguises. A face can be easily disguised or even altered by plastic surgery. Faces also change naturally over your lifetime. There is also a huge variance in the quality of photographs available, which is why US-VISIT has a standard it must follow governing the quality of photos which are used.

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 10 I used photographs in data collection in Iraq. All of our subjects had immense data profiles which even included DNA. These subjects were issued a number coinciding with their data profile, their photo was attached and used mostly for quick identification while under U.S. control (e.g., through daily use by guards). For any other (external) identification, for example for the FBI or other government agency, their fingerprints, iris scan, etc. were used. Many of our detainees had been under U.S. control for many years, and an intelligence specialist brought to our attention that some of our photographs were close to eight years old. Because of this we brought all detainees in and took new photos. Comparing the two photos side-by-side was shocking; there were photographs less than five years old that did not resemble the detainees in the slightest bit. Photographs are not dependable however; I do believe they should be included in a data profile. US-VISIT should be required to obtain an up-to-date photograph when people enter the country, and the photographs included in the individual data profile should have the date stamped on them. Other modalities There are several other biometric modalities, some currently in use and some being developed. One of them that I have had experience with is palm prints. Just as with fingerprints, palm prints remain basically unchanged throughout your lifetime. These palm prints are taken in the same way as fingerprints and involve the same type of machine, only slightly larger. This print adds to the overall accuracy of the data profile. With the current use of fingerprints, iris scans, and photographs, palm prints probably will not become a vital part of biometric recognition for entry into the United States, it would be more beneficial in the law enforcement

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 11 community or when identifying a high level terrorist however, the subject would have had to be in a situation prior to identification where he gave his palm print. Another modality involving the hand is the use of hand vein patterns. This modality is not currently in use but is being researched. Researchers state that the pattern of blood vessels hidden underneath the skin is quite distinct in individuals, even among identical twins and is stable over long period of time (Brindha, 2012, p. 2). Obtaining hand vein patterns would require the use of a handheld type device which would not make contact with the skin, because of this it would be less prone to error than obtaining finger or palm prints on current devices. Brindha (2012) also explains that duplicating hand vein patterns would be impossible, while it is possible to duplicate both finger and palm prints (although difficult). Voice identification is another modality that is heavily reliant on technology. The advantage to using the voice modality is that it can be collected from video or telephone feeds. Voice identification is not very accurate and requires the filtering of background noises. This technology will become more advanced in the future however; it probably will not be used for immigration purposes. Ear identification gives great potential to the field of biometrics. According to oral pathologists, ears have also been proposed as a new class of biometrics for passive identification which have both reliable and robust features which are extractable from a distance (Kaushal, 2011, p. 3). It has been shown that many subjects leave ear prints at a crime scene from listening at doors, lying on the floor, etc. Ear prints, or photographs or sketches of ears could potentially add to the overall accuracy of an individual data profile. I predict that ear identification will be the next big breakthrough in biometrics.

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 12 America has come a long way in biometrics since 9/11. What started as photographs and ink flat fingerprints in criminal investigation department filing cabinets has morphed into fingerprint and iris scan technology you can download onto your smartphone. I have used handheld devices in Iraq which linked someone to a crime in another country from a fingerprint on a bomb. I have also uploaded data into the database from a subject captured within the hour while simultaneously taking to someone at the pentagon as they viewed the same information. The potential for biometric technology in the next ten years is limitless. Consequently, DHS has the massive responsibility of protecting our country and it does so by developing risk-reduction measures through the NPPD. One of NPPD s programs is US- VISIT, charged with (in NSPD 59) providing all designated agencies accurate information using biometric data. US-VISIT does this primarily through the use of photographs and fingerprints, however it also uses biometric modalities such as palm prints and iris scans. Great strides have been made in our biometric technology and are about as accurate as you can get however, we must ensure proper training collection, storage, handling, and transmission so that we do not nullify our efforts for the past eleven years.

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 13 References Biometrics Standards Requirements for US-VISIT. (2012, March 15th). Retrieved September 15th, 2012, from Department of Homeland Security: http://www.dhs.gov/xlibrary/assets/usvisit/usvisit_biometric_standards.pdf Brindha, V. E. (2012). Biometric Template Security using Dorsal Hand Vein Fuzzy Vault. Journal of Biometrics and Biostatistics, 1-6. Bush, G. W. (2008, June 5th). National Security Presidential Directive 59. Retrieved September 11th, 2012, from The White House: http://www.fas.org/irp/offdocs/nspd/nspd-59.html DHS Organization Chart. (n.d.). Retrieved September 11th, 2012, from Department of Homeland Security: http://ipv6.dhs.gov/xlibrary/assets/dhs-orgchart.pdf Identity One. (n.d.). Retrieved September 15th, 2012, from Biometric Technology: http://www.identityone.net/biometrictechnology.aspx Jain, A. K. (2007, October 16th). Debate over usefulness, pitfalls of biometrics intensifies. Retrieved September 13th, 2012, from Homeland Security New Wire: http://www.homelandsecuritynewswire.com/debate-over-usefulness-pitfalls-biometricsintensifies Kaushal, N. a. (2011). Human Earprints: A review. Jornal of Biometrics and Biostatistics, 1-5. National Science and Technology Council. (n.d.). Biometrics "Foundation Documents". Retrieved Septemeber 13th, 2012, from Biometrics.gov: http://www.biometrics.gov/documents/biofoundationdocs.pdf Office of the Inspector General, DHS. (2012, August). US-VISIT Faces Challenges in Identifying and Reporting Mulitple Biographic Identities. Retrieved Septemeber 17th, 2012, from

Running head: GAP ANALYSIS OF THE DEPARTMENT OF HOMELAND 14 Office of the Inspector General, DHS: http://www.oig.dhs.gov/assets/mgmt/2012/oig_12-111_aug12.pdf US-VISIT. (n.d.). Retrieved September 10th, 2012, from Department of Homeland Security: http://ipv6.dhs.gov/files/programs/usv.shtm