Can the Pentagon keep pace on biometrics?

Biometrics are critical to the Defense Department's global intelligence-collection efforts. U.S. soldiers in Afghanistan, for example, take iris scans of field subjects and send the data to a DOD-wide database, where it is checked against a list of suspected terrorists.

Biometrics technology and its applications for security are at a crucial juncture, experts say. The private sector is driving rapid improvements in the algorithms that determine the accuracy and speed of facial and iris scans, while DOD is gradually deploying a biometrics database whose accuracy and cybersecurity need improving, according to a DOD auditor.

For DOD to reap the benefits of this promising field in the coming years, it must address those shortcomings and find a way to use commercial technology to feed information into the database, according to practitioners and observers.

Along those lines, Undersecretary of Defense for Intelligence Michael Vickers recently listed biometrics as among a handful of technological challenges facing DOD and the intelligence community.

Roger Mason, a former senior adviser to the director of national intelligence and a biometrics expert, said that although law enforcement agencies have used fingerprinting for decades, the anonymity that is possible on the Internet has made biometrics intelligence more difficult in recent years.

"The challenge that [Vickers] is referring to is that when you think about the ubiquity that biometrics now plays in all of our lives and combine that with the way that we interact with the Internet in terms of our personas, the challenge of anonymity and the challenge of trying to detect other identities becomes much more difficult," said Mason, who is now a senior vice president at science and technology nonprofit Noblis.

Mobilizing a DOD database

The Army's Program Executive Office for Enterprise Information Systems is in charge of a DOD-wide biometrics database that has been in the works for half a decade. The Automated Biometric Identification System is a central repository for biometrics data from various combatant commands and military services. The system can process as many as 30,000 daily submissions and hold as many as 18 million records, according to PEO EIS.

For example, a soldier on patrol in Afghanistan uses a device known as the Biometrics Automated Toolset to collect biometrics. Its hardware, called the Secure Electronic Enrollment Kit II, automatically captures and formats fingerprints and iris and facial images, and has a keyboard for soldiers to type in biographical information about the subject. The handheld device connects to a central workstation that links up with any of the several dozen servers across Afghanistan for storing biometrics data.

The data is then sent to the ABIS database in West Virginia for correlation. The FBI and the departments of State and Homeland Security, among other agencies, use ABIS to identify biometrics matches for criminal cases and people on intelligence watchlists of suspected terrorists.

ABIS, in short, is a giant initiative for collecting and sharing data, and its efficacy depends on the quality of the technology on which the system is built.

The Army deployed its latest version (ABIS 1.2) in October 2014. It has demonstrated increased throughput and capacity, and offered an opportunity to refresh the system's hardware, said Col. Sandy Vann-Olejasz, DOD biometrics program manager at PEO EIS. Full deployment of the system will occur no later than the first quarter of fiscal 2016, she added.

The Army launched the initial version of ABIS (1.0) in January 2009, and DOD issued acquisition guidelines for ABIS 1.2 in January 2011, but the system was not deployed until three and half years later. Along the way, there were at least four failed attempts to deploy ABIS 1.2, according to a fiscal 2013 review by DOD's director of operational test and evaluation (OT&E). In one botched attempt, the two versions of the database failed to operate in tandem.

Vann-Olejasz said ABIS 1.2 overcame an important hurdle by requiring less manual labor to get a positive identification on biometrics samples than a previous version of the repository. ABIS filters biometrics samples as either an automated match or not. Anything in between must be scrutinized by a biometrics examiner, a process Vann-Olejasz said was slow and laborious.

Better algorithms explain ABIS 1.2's improved accuracy, which in turn gives the Army's experts more time to analyze the sample matches and incorporate them into intelligence reports. But there is still plenty of room for improvement. OT&E's fiscal 2014 review of ABIS said the database had significant cybersecurity vulnerabilities, and ABIS 1.0 and 1.2 were not fully consistent in matching individuals to a watchlist of suspected terrorists.

The private sector and nonprofit research and development organizations, meanwhile, are trying to meet DOD's demand for faster and more accurate processing of biometrics data. Mason said he has challenged his colleagues to develop algorithms that can accurately process 1 billion facial scans per second, a goal he expects his researchers to hit by the end of this year.

Although iris scans are considered the most accurate of the three main categories of biometrics, their intrusiveness and relatively high cost have slowed adoption, said Mark Clifton, vice president of the Products and Services Division at SRI International, an R&D nonprofit. He added that the U.S. military is using SRI's technology to scan the irises, faces and fingerprints of entrants to military bases but declined to specify which bases are using the technology or the quantity of products sold.

Another challenge is to develop iris scanning that can be done more remotely. Clifton said his organization has recently demonstrated iris-scanning capabilities from more than 30 yards with a stationary subject, but "unfortunately, it took nearly telescope-size optics to get that, so it's not that practical." The Pentagon is still a few years away from deploying any sort of midrange iris-scanning technology, he added.

The ABIS requirements do not call for remote iris or facial scanning, Vann-Olejasz said, but that could change with an ongoing Army-run "analysis of alternatives" review of acquisition options for biometrics. The review will help the Army determine "the next capability gap that we need to close with this technology," she said, adding that the review should be finished by year's end.

Speed vs. accuracy

Much of the ABIS software and hardware is commercial rather than custom-built for the military, Vann-Olejasz said. Of the algorithms being honed by industry, those underpinning iris and facial scans have seen the most improvement recently, whereas fingerprint algorithms have hit a plateau of sorts, she added.

Mason said the key for defense and intelligence officials will be to better integrate the three nodes of data -- iris, fingerprint and facial imaging -- to develop a more composite "pattern of life" profile of a person.

There is also a trade-off between speed and accuracy when it comes to processing facial images. The industry products that will be "the most valuable to the [intelligence community] in the future are the ones that are going to be able to push the axis on" speed and accuracy, he said.

As with many IT advances, the next step might be a move to mobile devices. Clifton said that in the medium term he expects iris scanning to be commercially available on mobile devices for identity verification.

As for ABIS, its underlying technology will inevitably need updating. The current version "will only take us so far due to software obsolescence and potentially hardware things," Vann-Olejasz said. The ongoing review of acquisition strategy for ABIS will determine whether a new approach is needed or "whether or not we will continue to, if you will, bolt on to the DOD ABIS architecture and framework," she added.