The Eyes Have It: Body Scans at the ATM

HOUSTON, TX – Jordan Pearce, an 18-year-old freshman at Rice University, stood in front of a cash machine, stared straight ahead and moments later pocketed $40 and walked away. Only, Pearce didn’t have an ATM card.

Instead, says the Washington Post, he simply allowed the camera mounted in the top of the cash machine to examine his iris – the colored part of the eye – and check its characteristics against an earlier scan stored in Bank United’s iris database. Once the match was made, Pearce was free to use the machine. He needed neither ATM card nor identification number: “They told me about it when I was making a deposit,” Pearce said. “It sounded pretty cool.”

The cash machines at Bank United, Texas’s largest financial institution, have pushed the science of biometrics – identifying people by their unique physical characteristics – to a new frontier, transforming what began as a James Bond fantasy into everyday commerce. According to the Post, Bank United’s use of iris scanning, which is harmless to the eye, represents the first time a large private company has attempted to use biometrics as a consumer tool.

Whether it’s iris scanning, fingerprints, voice prints, hand geometry, face geometry or signature authentication, biometrics are rapidly becoming a cheaper, easier and more secure way to conduct business, the paper reported.

What consumers think about it is not yet clear. A customer poll by Nationwide Building Society, a British savings and loan that began using iris scanning last year, found that 94 percent of customers were comfortable with the system and that 91 percent preferred it to PINs or signatures.

But efforts in 1997 to put a biometric on Alabama driver’s licenses had to be abandoned when outraged motorists refused to surrender their fingerprints. And while young techno-zealots like Pearce are easy sells on iris scanning, older customers tend to hang back: “They think it’s great, but there’s a lag time to get used to it,” Bank United assistant branch manager Gabriel Q. Ngo told the Post.

Then, said the paper, there are depositors like Steven J. Tutt, 42, a chiropractor who likes the convenience of iris scanning at his Bank United branch in Dallas but confessed that “there was a little bit of fear about who can have my iris pattern.”

An uneasiness toward yielding information about one’s body has prompted outright rejection of biometrics among some, but libertarians of all ideological stripes have questioned biometrics’ potential danger to citizens’ Fourth Amendment right to privacy.

“Who’s entitled to gather this information?” asked Barry Steinhardt, Associate Director of the American Civil Liberties Union asked the paper. “Can there be a secondary use? What is the form of consent, and is it truly voluntary? What security is there against theft? The paramount problem is that the technology has been developing at light-speed, while the law has developed not at all.”

The biometrics industry is concerned enough about what it calls the “Big Brother Factor” to have designed a set of principles for companies to follow to avoid the misuse of biometric information. According to the Post, their association has also urged adoption of legal standards to restrict public institutions’ use of the data.

John Woodward, a privacy attorney and adviser to the Biometric Industry Association, acknowledges that the use of biometrics contributes “to the feeling we have no privacy,” that “the government could call up the central computer, punch in your name and find out where you’ve been today.”

There need to be safeguards, he told the paper, including laws restricting the movement of biometric databases. “If you think of them as mailing lists, you don’t want them to be sold to other companies,” Woodward said.

Also to be avoided, Woodward said, is “function creep,” the idea that if the city welfare agency is using biometrics to keep track of its caseload, it should not be letting the city tax assessor or the state supreme court track people using it.

But for now, the ACLU’s Steinhardt told the Post, “we enter the brave new world without any rules. There are no legal controls over how biometrics can be used – whether the information can be sold, whether it can be turned over to law enforcement without a warrant.”

Steinhardt believes the biometrics industry will have to be regulated, because “in the absence of any regulation, we’re in a position where industry says ‘trust us.'”