On Q Professional Investigations

HUNTSVILLE, Alabama — Forget the key card to your office building? Just wave your hand at the door, and you’re in. “You don’t have to stop at a station. Nobody checks your ID. You just walk through,” explains Clemson-educated physicist Joel Burcham of his new Huntsville company called IDair.

IDair makes a machine that Burcham says can photographically capture a fingerprint from as far away as six meters in enough detail to match against a database. Add facial and iris-recognition technology, Burcham said, and you have the basis for a good biometrics system that can control access to any building or room within a building.

Who needs this level of security? “Sooner, rather than later, we’re all going to need it,” Burcham said in a recent interview at his office at Huntsville’s HudsonAlpha Institute for Biotechnology.

HudsonAlpha, known for human genome and other biological research, gave Burcham a desk for his startup company – “one desk,” he said – because Burcham plans to expand to latent print imaging, a process that involves biological questions of the kind routinely investigated at HudsonAlpha.

Currently, IDair’s customers are military. The system can be used, for example, to tell the difference between friendly locals and potential terrorists while soldiers stay safe behind blast walls.

But the future lies in commercial use. A 24-hour fitness center chain is beta-testing the system now as a way to stop access key sharing by friends or roommates, he said. Ultimately, Burcham said, the vision is that “when you walk into Target and run the items you want to buy across the checkout counter, you aren’t going to have to pull out your wallet or dig out your credit card, which is easily stolen and getting easier to steal every day.”

How does the IDair unit work? Burcham says it’s closer to the way satellites process ground images than the way Photoshop refines our vacation pictures. “There is a little bit of pattern recognition,” he said, “but a lot of it is different ways of sharpening the image … a lot of edge detection, things like that.”

Using image processing means there’s no need for the subject to touch the scanner to get a reading. That eliminates problems associated with oil or dirt on the finger. The basic IDair machine now, which costs under $2,000, processes one finger’s print. That’s good enough to get into a building, when added to iris or face-recognition software, but ironically it isn’t good enough to make a commercial transaction. Four fingers is the standard for that level of identification, he said.

Burcham understands the privacy concerns raised by fingerprint capture. His systems are not connected to major databases such as the FBI’s, he said, so there is no chance you will be screened for outstanding arrest warrants, for example, when you enter a building using the IDair system.

“What realistically happens is you’re an employee of a company,” Burcham said. “The company wants to put one of these devices on the door. You enroll in the system right there and then. They are not connected to anywhere else. You give your prints to the system, and they are collected on the system.”

It’s the security of the fingerprint database that concerns privacy experts such as Lee Tien, a senior staff attorney at the Electronic Frontier Foundation. “There are so many steps where a (digital) fingerprint can leak,” Tien said.

Tien said electronic fingerprints can be like Social Security numbers. He calls them “coat hangers” on which a lot of identifying information can be hung. In other words, with a Social Security number, you can find out many other things about someone. Fingerprints could be same way, he said, and “someone else could use it to pretend to be me.”

“Yes, it can be abused,” Burcham agreed. “Anything can be abused. The point is, are there restrictions in place to not abuse it?” The answer with IDair is yes, he said. “But what it’s going to come down to is: Do you want to go through that door? Do you want to buy something with Amazon?”

IDair is a spin-off of Advanced Optical Systems, and Burcham said two of the company’s officers are investors in the new company, which has three employees and an intern today. It will grow soon, he said. The company, which has a website at IDair.com, will seek a second round of financing soon, Burcham said, and investor interest is welcome.

Read more

Documents just released by US Immigration & Customs Enforcement (ICE) in response to one of EFF’s Freedom of Information Act requests show that DHS is considering collecting DNA from kids ages 14 and up—and is exploring expanding its regulations to allow collection from kids younger than that.

The proposal appears to be working its way through DHS in the wake of regulations from the Department of Justice that require all federal agencies—including DHS and its components such as ICE—to collect DNA from individuals arrested for federal crimes as well as “from non-United States persons who are detained under the authority of the United States,” whether or not they have been involved in criminal activity. While the law specifically exempts a few classes of “aliens,” the documents we received show DHS may start DNA collection from anyone it fingerprints. Currently, that’s any child over 14 who’s detained, but we also found records that show ICE could lower that age even more.

DHS estimates that as many as 1 million people who are subject to administrative detention or arrest annually could now be subject to DNA collection. But it’s important to note that many of these people are not involved in criminal activity. Collecting DNA from anyone detained by the government for any number of non-criminal reasons—especially juveniles—seems to be yet another step on the slippery slope to collecting DNA from everyone in the United States, no matter their status.

ICE is the first component within DHS to collect DNA under the new DOJ regulations. ICE’s Homeland Security Investigations (HSI) offices in San Diego, St. Paul, and San Juan, Puerto Rico are part of a 6-month pilot program to test out the new procedures and were set to start collecting DNA around July 2010. After the pilot program, the rest of HSI’s offices (more than 200 throughout the US and abroad) will start collecting DNA and presumably all other DHS components will follow suit shortly thereafter.

When the DOJ expanded its DNA collection regulations in 2009, it specifically required agencies to collect DNA from all populations they fingerprint. DHS regulations allow the agency to collect biometrics from aliens coming into the US who are 14 and older, so DHS can currently collect DNA from kids this age as well. However, the agency may also be considering collecting biometrics from kids younger than 14. A slide presentation from March 2011, titled “Working Group on Expanding the Biometric Age Range” notes that some DHS programs are already collecting biometrics from kids younger than 14 and proposes expanding the age range for more DHS entities (including ICE). Because of the DOJ regulations, this would mean that DHS could collect DNA even from very young kids.

It turns out that DHS is not the first federal or even state agency to collect DNA from juveniles. The records ICE released show that the US Marshals are required to collect DNA from juveniles whenever the Marshals collect fingerprints. And the Drug Enforcement Agency’s (DEA) internal regulations make clear that “Both adults and juveniles who are fingerprinted are subject to DNA sample collection.” Its agents may also collect DNA from non-United States persons who are merely detained (not formally arrested). And according to the Council for Responsible Genetics, twenty-eight states already collect DNA from juvenile offenders, as well.

However, a DNA collection program run by DHS feels very different because it could affect so many people who have no involvement with the criminal justice system. EFF has strongly criticized warrantless DNA collection in criminal contexts, as we’ve discussed here, here and here. The DOJ argues that collecting DNA from all people arrested and non-US persons detained will allow it to find and identify more criminals, solve more crimes, and “prevent and deter subsequent criminal conduct.” but it is hard to see how that argument couldn’t be extended to apply with equal force to mandated DNA collection from everyone.

DNA reveals an extraordinary amount of private information about you, including family background, medical history, predisposition for disease, and possibly even behavioral tendencies and sexual orientation. Once the federal government collects a DNA sample—no matter which agency does the collection—the sample is sent to the FBI for storage, and the extracted profile is incorporated into the FBI’s massive CODIS database, which already contains over 10.5 million “offender” profiles. It is next to impossible to have your DNA expunged from the database once it’s already in there, and once it’s in CODIS it is subject to repeated warrantless searches from all levels of state and federal law enforcement.

For the short term, DHS’s DNA collection program may be quite limited. ICE has redacted most concrete information about the timetable for implementation, but it is not clear that DHS has begun collecting any DNA. The documents ICE released indicate some agency infighting between the DOJ (which requires the DNA collection) and DHS (which considers this requirement to be an expensive unfunded mandate), and it is not clear if the two agencies have yet worked this out.

DHS also appears to recognize the political costs of collecting DNA from people outside the criminal justice system. In a March 22, 2010 letter from DHS Secretary Napolitano to Attorney General Holder, Napolitano sought an exemption to DNA collection from juveniles under 18. Hidden text within one of the documents1 recognizes that collecting DNA from juveniles could increase “ICE’s exposure to criticism” and notes:

[t]here is a high likelihood that ICE would face litigation and other opposition from community and nongovernmental organizations (NGOs) if ICE were to sample all juvenile detainees.

Further, it appears DHS is trying to avoid publicizing the roll out. Hidden text on another page of the documents notes that “OCR and OPA [ICE's Office of Congressional Relations and Office of Public Affairs] intend to respond to inquiries, rather than making announcements of the DNA sampling pilot program.”

DHS’s stalling is good for privacy in the short run. However, given the hard line the DOJ has taken in past court cases challenging DNA collection, the expansion of DNA collection from an ever-broader array of Americans and immigrants appears imminent.

Follow these link to view documents from ICE:

• ICE DNA Collection Documents – pages 1-92
• ICE DNA Collection Documents – pages 93-201
• ICE DNA Collection Documents – pages 202-297
• ICE DNA Collection Documents – pages 298-353

Read more