Biometrics Add a Unique Layer of Security to Access Control

Rebecca Douglas
Published in: 

San Francisco International has used biometrics to limit field-side access since the early 1990s.

Once merely a fictional prop for sci-fi shows and spy movies, biometric devices that authenticate employees by their fingerprints or hand geometry are standard equipment at some U.S. airports.

Although the Transportation Security Administration doesn't mandate them, it nthusiastically champions their use. "We strongly encourage biometrics and other advance technology measures," says TSA spokesperson Ann Davis.

Dennis Treece, director of corporate security for the Massachusetts Port Authority (Massport), considers high-tech biometric units "exceptional security tools."

"The technology is mature enough that airports no longer have to wonder if they work," Treece says. "Industry standards for false acceptance and false rejection rates are less than 1%. That means they let the right people in and keep the wrong people out. Now, it's more a question of cost, maintenance and where to use them."

At Indy

Indianapolis International Airport recently added fingerprint scanners to supplement access control in two key areas of its new terminal. Units are being phased in gradually as employees become accustomed to the new technology.

"They are another powerful tool in our arsenal," says Robert Spitler, director of security for the Indianapolis Airport Authority. "We can use them to turn the security heat up or down as needed."

System designer Ross & Baruzzini considers Indy's biometric readers the "top tier" of authentication in a highly effective multi-layer system.

"It goes beyond badges and pinpad codes to verify that people trying to get in are, in fact, who they claim to be," explains David McGhee, assistant practice leader of Security Engineering.

Ross & Baruzzini recommended fingerprint units (Bioscrypt PIV Stations) rather than other biometrics such as voice recognition or eye scans based on input from sources within the airport industry and experience using the equipment for clients in other sectors.

The equipment's size was also a key factor. "Hand geometry readers were too big for the physical footprint we had available," notes McGhee. "We needed smaller equipment for ADA (Americans with Disabilities Act) requirements and cart clearances."

Iris scanners, he notes, were eliminated from consideration for slower throughput.

"We wanted to be cutting edge," says Spitler, "but we also needed to be confident in the equipment's reliability."

Photo Credit: Scott Rae, Massport

"False positives are extremely rare with biometric readers," stresses McGheee. "False negatives are more likely, but usually because something is on the employee's finger, or it has been injured."

Although the index finger is usually used, other fingers are scanned as backups to minimize false negatives.

Employees using biometrics at Indy have not expressed concern regarding privacy issues. "They're used to a high level of scrutiny," explains Spitler. "Plus, the scan of their fingerprints is encrypted and converted into an algorithm before it's loaded onto their smartcard. The format isn't meaningful outside the airport."

Passengers who take note of the readers located in public areas are "awed" at Indy's state-of-the-art equipment. "The 'wow factor' goes a long way," says Spitler.

Out East

Security technology manufacturers deluged officials at Boston Logan International after the 9/11 attacks in 2001, and facial recognition biometric units were selected for technical trials. Massport, which manages and operates the high-profile airport, concluded that facial recognition wasn't the right biometric application for Logan.

"It's impressive technology that can operate from quite a distance," notes Treece. "But without pictures of terrorists to match against, it wouldn't do us much good."

Logan did, however, invest in finger scanners as part of a $30 million access control upgrade in 2005. Hand geometry readers were also installed at its corporate headquarters in late 2003. Units that measure vascular characteristics, specifically patterns of veins on the back of the hand, are currently being discussed.

Some airports counseled Massport to wait for specific TSA standards before installing biometric equipment. Convinced of the technology's benefits, it pressed ahead - a move that proved strategic given the current lack of such standards.

"We kept them apprised of what we were doing," recalls Treece, noting that the risk of getting stuck with equipment at odds with subsequent standards was low.

Fingerprint scanners from Bioscrypt were added at roughly 600 doors leading from public to secure areas. Jetway doors, hatches to the roof, rooms with baggage belts leading out to aircraft and other sensitive areas are now protected with a three-factor system. "It requires something you have, an ID badge; something you know, a pin code; and who you are," Treece explains.

The third biometric level is the toughest, he notes, because faking someone else's fingerprints is very difficult - despite how it looks in movies.

"We've never had a single incident where an unauthorized person got through an access point with biometrics," Treece reports.

Logan's equipment is also performing well on the flipside: granting prompt access to properly authorized employees. Biometric industry standards call for verification transaction times of less than six seconds, but Treece estimates it usually takes units at Logan three seconds or less to scan an employee's finger, compare it to the data on file and open the access door.

In addition, Massport has encountered few "enrollment failures" at Logan. "I've seen estimates that 5% of the general population doesn't have enough distinguishing characteristics in their fingerprints to ensure a positive match," reports Treece. "But we've experienced failure to enroll rates well below the industry standard of less than 3%."

Providing employees with ample notice about enrollment and assuring them that scans don't hurt was critical, he notes.

Facts & Figures

Project: Biometric Scanner Installation

Locations: Boston Logan Int'l, Indianapolis Int'l, San Francisco Int'l

Equipment at BOS: Bioscrypt, Amag Systems

Equipment at IND: Bioscrypt

Equipment at SFO: Ingersoll Rand

Cost: Varies; see article for specifics

How They Work: Biometric readers verify employee identity by measuring unique characteristics such as fingerprints or hand geometry and comparing them to scans on file

Key Benefit: Adds high-tech layer of security to access control

Secondary Use: Verifies time and attendance of hourly employees

"It was important to demystify the process," he recalls. "People were nervous about it at first. But they got comfortable as soon as they saw how quickly and easily it works."

At its corporate headquarters, Massport supplies hand wipes at reader stations to quell possible hygiene concerns.

Another vital precursor, says Treece, was assuring airport officials that glitches with the biometric readers wouldn't cause employees to be late for work.

On the contrary, Logan actually uses biometrics (a single digitized fingerprint) to record time and attendance of hourly employees. "It's more effective than a timeclock," explains Treece, "because it prevents 'buddy punching' - one employee clocking in for someone who isn't really there."

Some of the units measure vascular characteristics, specifically the pattern of veins on the back of employees' hands.

Hand geometry units by Amag Systems were selected for outdoor access control, Treece notes, because they can be outfitted with protective covers and are less sensitive to inclement weather than fingerprint scanners.

"Also, equipment that doesn't require two hands to operate is best," notes Treece. "Otherwise employees have to put down whatever they're carrying to get through."

Fingerprint units using ultrasound technology that penetrates to soft tissue were considered for placement outside ramp areas because of their ability to read through dirt and grease on fingers. Incompatibility with Logan's access control software, however, eliminated them as an option.

Officials were initially drawn to the accuracy of iris scan technology, but higher per unit costs and employees' general reticence about having their eyes scanned ruled it out.

Retinal scanners were similarly eliminated from consideration because retinas change with age and injury. "It's important to measure a characteristic that's unique and unlikely to change," explains Treece.

Massport has been so pleased with the performance of fingerprint and hand scanners at Boston Logan, it is installing units at Hanscom Field in Bedford. It's also considering deploying biometric equipment at other properties under its purview, which include seaports and a two-level toll bridge.

In the West

San Francisco International (SFO) is among the most experienced U.S. airports when it comes to biometrics. It has been using hand geometry units to control field-side access for 16 to 17 years, reports director of community affairs Mike McCarron.

"Lou Turpen, airport director at the time, saw it as the wave of the future," explains McCarron. "When it was time to upgrade security, they went to a whole new level."

The "new level" included approximately $2 million of biometrics - specifically 100+ hand geometry readers from Ingersoll Rand. Another 50 to 60 biometric readers were added when the international terminal was built in 2000. Still more are scheduled for installation during the remodel of Terminal 2 that's expected to be complete in two years. These days, each reader costs about $5,000, notes McCarron.

With roughly 15,000 badged employees, biometrics help limit access to specific subsections of the overall employee pool. Carriers working in Terminal 1, for instance, are only registered to clear relevant access points in Terminal 1.

Like Logan, SFO also uses biometric devices to verify employee attendance. That application, however, required more tweaking than the access control placements. "It's been an ongoing learning process," notes McCarron.

Cameras and turnstiles have been added to some employee check-in areas to prevent "tailgaiting" - employees with expired or forgotten badges attempting to pass through with a properly badged employee.

High Satisfaction

At Massport, Treece continually monitors reports of attempts to "fool" biometric devices throughout the world and consequently considers a breech of Logan's very unlikely.

"Even if someone somehow managed to steal a badge and find out a pinpad code, it would be even tougher to get past the biometric equipment," he explains. "Most are in public places or areas where other employees are waiting to use the same reader. They wouldn't be able to use a fake finger or any other elaborate method to alter their fingerprint without drawing attention to themselves."

Spitler and McCarron are similarly confident in the biometrics at their respective airports. All three unanimously recommend biometrics for consideration at other airports.


FREE Whitepaper

PAVIX: Proven Winner for All Airport Concrete Infrastructure

PAVIX: Proven Winner for All Airport Concrete Infrastructure

International Chem-Crete Corporation (ICC) manufactures and sells PAVIX, a unique line of crystalline waterproofing products that penetrate into the surface of cured concrete to fill and seal pores and capillary voids, creating a long lasting protective zone within the concrete substrate.

Once concrete is treated, water is prevented from penetrating through this protective zone and causing associated damage, such as freeze-thaw cracking, reinforcing steel corrosion, chloride ion penetration, and ASR related cracking.

This white paper discusses how the PAVIX CCC100 technology works and its applications.



Featured Video

Featured Video

# # #

# # #