Fingerprint technology elicits privacy concerns

Helen Jung

Monday, June 3, 2002 | 9:51 a.m.

SEATTLE -- Christopher Conrad cuts off telemarketers on the phone, regularly reminds direct-mail associations to keep him off their lists and diligently opts out of mass e-mail lists.

But the Seattle commercial photographer didn't hesitate to give his fingerprint, credit card information and phone number to a company he had never heard of.

Conrad is one of the 2,000-plus customers of a Thriftway grocery store in West Seattle who signed up in a pilot program run by Oakland, Calif.-based Indivos Corp. that links customers' fingerprints with their credit or debit cards, allowing them to buy groceries by simply running a finger over a scanner.

"I always leave my wallet in the car or forget it in another pair of pants," Conrad said. "It doesn't feel so much like an invasion of privacy, but is more like a convenience."

Technology that links your fingerprint with a credit card or bank account is making strides into everyday purchases, with businesses from Thriftway in Seattle to three Kroger stores in Texas.

But privacy advocates and others are questioning whether the lure of convenience outweighs the vulnerabilities of the technology and fears of privacy intrusion.

"With most of these applications there's an interesting starting point, and then there are new applications and pretty soon you have full force Big Brother watching over you," said Marc Rotenberg, executive director of the Washington, D.C.-based Electronic Privacy Information Center, a public-interest research group.

And currently, there are no federal laws regarding the selling of fingerprint databases and information.

"There could be some abuses," Rotenberg said.

Thriftway's pilot program has nevertheless proved popular from its May 1 adoption, said store owner Paul Kapioski.

"A lot of them walked right in the door and said 'where is it, let me sign up' ," said Kapioski. He said representatives from other grocery stores in the area have come in to look at the program. "I think it's the way it's going to be here in a couple of years. We may be the first, but you'll see it around here."

It's already in Texas, at some Kroger Co. stores, which use technology from an Indivos rival, Biometrics Access Corp.

Ron Smith, Biometrics Access chief executive, says it is helping Kroger also cut down on check fraud.

And McDonald's in Fresno, Calif., used Indivos' technology for a brief pilot program but decided to discontinue it, said spokeswoman Lisa Howard. McDonald's is exploring other cashless electronic payment alternatives, such as radio transponder wands.

At the Thriftway, customers scan one finger five times, to get an accurate image, which is then digitized and stored in Indivos' database. The customer also registers a bank account, credit card, debit card or even food-stamp account and a seven-digit number, like a phone number which will be used to help pinpoint that fingerprint's location among the thousands in the database.

Then, customers can simply scan their finger at checkout counters and enter the seven-digit number. The scanner picks up 10 or 12 points on the finger at random, compresses that down to a 300-byte package and shoots it over an encrypted connection to the database in Oakland for comparison with the stored fingerprint.

In practice, it's not a huge time savings over credit-card transactions. The customer still needs to punch in the seven-digit number as well as key in approval for the purchase. And they still have to sign a receipt for credit card transactions or enter another personal identification number for a debit card purchase.

Some customers said they didn't like giving away something as personal as a fingerprint. They fear that even if the database is kept by a private business and not linked to buying habits, it might not always reside with that company.

"To me it's the same thing as the government having your fingerprints," said Jennie Helms, a West Seattle Thriftway shopper. "They don't need to know what I buy."

Security is also a concern.

While well-designed fingerprint-based systems are not easily fooled, some researchers have already shown that fingerprint readers are hardly spoof-proof, said James Wayman, former director of the U.S. National Biometric Test Center and now a biometric identification researcher at San Jose State University.

Recently, a cryptography researcher in Japan created a fingerprint mold out of gelatin and succeeded in fooling fingerprint scanners four out of five times. A paper detailing his work was presented to the International Society for Optical Engineering.

The fingerprint companies' executives acknowledged that all technology is ultimately vulnerable. But they said would-be thieves don't have the means, much less access to a viable fingerprint, to crack one of their sensors.

And what of worries that companies might sell the fingerprint/information database to marketers?

Indivos chief executive Phil Gioia said his company signed a contract with Thriftway not to sell that information to marketing companies. But Lee Tien, senior staff attorney for the San Francisco-based Electronic Frontier Foundation, says the technology raises such novel and sticky legal issues as who owns the actual fingerprint.

Even Gioia recognizes that much remains uncharted.

For example, if Indivos were to some day be acquired by a credit-card issuing bank that institution would gain ownership of the fingerprint database. Gioia's response: "that's in the future ... we haven't nailed that down."