Govt. biometrics use still raises privacy concerns

WASHINGTON--Is the idea of widespread biometric data collection still too spooky to win over the American public?

At some level, it's already becoming commonplace: California and some other states demand fingerprints from driver's license holders. The Verified Identity Pass program includes iris scans, as does the U.K's border control system. And prisoners have their blood forcibly drawn for a DNA sample.

But more widespread use of biometrics, especially by the government, raises substantial privacy concerns that may alarm many Americans and prove difficult to resolve, panelists at a conference here said Tuesday.

"How would I transact business, if I knew someone was following me everywhere and watching me?" asked Scott Hastings, president of the IT consulting firm Deep Water Point, who previously worked in the federal government for 23 years. "We need to grab hold of that and decide how that's going to modify our behavior."

Hastings sat on a panel at a forum on identity management hosted by the Information Technology Association of America.

"Will there be underground transactions? Will it affect our economy?" he asked. "When people (become aware of) the electronic footprints they leave behind, there will be a reaction."

The increasing sophistication of identity management has had clear benefits, Hastings said. He noted how the rollout of the Department of Homeland Security's immigration and border management system--United States Visitor and Immigrant Status Indicator Technology--has virtually erased the once-prominent problem of document fraud at U.S. borders. The US-VISIT program, implemented in 2003, involves the collection of biometric data such as fingerprints to monitor for criminals and terrorists at the borders.

US-VISIT is the world's first large-scale biometrics program, according to director Robert Mocny. He said the program has stopped 2,400 criminals based on biometrics alone.

The program is currently transitioning from collecting two fingerprints to a 10-fingerprint standard. Mocny said US-VISIT is also pursuing other forms of biometric identification, such as iris-scanning technology.

"The biggest challenge since day 1 with any service has been the privacy and security aspect of it," said Chase Garwood, chief information officer of US-VISIT. He said the program extends to non-U.S. citizens many of the same protections afforded to citizens.

Protecting Americans' privacy at other borders presents an additional challenge, pointed out Mary Dixon, director of the defense manpower data center for the Defense Department.

Governments in Japan, Australia, the European Union, and other places have begun collecting biometric data at their respective borders as well. The United Arab Emirates has been utilizing iris scans for some time, Mocny said.

"As biometrics increases worldwide, consistent standards are essential," Mocny said. "We can transform the way the world travels."

He said that in order to make the collection of identifiable information palatable for consumers, it has to be noninvasive and familiar to people.

Some panelists suggested that younger generations are more accepting of handing over their personal information, but Dixon took issue with that point.

"They might share" their information online, she said, "but it's their decision whom they share with--they don't want the federal government collecting all of their information."

Conor White, chief technology officer of security systems vendor Daon, said consumers are growing more comfortable with the use of biometrics on an everyday basis, as evidenced by products like the Registered Travelers card, which identifies travelers who pose a minimal security risk.

"People are doing it because they recognize the security and convenience trade-off," he said.

CNET's Declan McCullagh contributed to this report.