Biometrics
:
A New Mean of Surveillance
and Migration Control
Belhira Kajevic
Supervisor: Tommie Sjöberg Examinator: Philip Muus Malmö University
IMER 41-80 2006-06-02
Abstract
We live in an era of advanced technological innovations and it is therefore difficult to attain a proper overview of the different surveillance techniques deployed for the purpose of enhancing bureaucratic administration. The intend of this paper is to disseminate one of the new technologies on the market: the biometric technology that is an identification and verification system based on measurements of biological traits. Different approaches are used to explore and investigate the social structures, technological functions and political justifications for their validity and role in the implementation of the biometric technology. The paper also provides an overview of the different areas of political and social management that are affected by the implementation of the biometric techniques.
The principal aim of this work is to examine how the implementation of the biometric techniques will affect privacy for all people, taking both information privacy and personal integrity into consideration. The secondary question deals with migration management, as the current implementation mainly involves travel documents. It focuses on the consequences of the so-called war on terror and its call for prevention of terrorism and irregular migration. The dilemma between national security and the right to privacy, public good and private interest, and the realms of state and individual rights are also discussed and analysed.
Hence, the framework and the fundamental structure of this thesis are based on three core issues pertinent to the implementation of biometrics in the EU: threats posed on the right to privacy, securitization of migration, and intensification of surveillance and state control. The findings are concentrated on identifying the threats posed on right to privacy and the way this right is compromised, and the consequences of practices and policies in the field of migration that are discriminatory and exclusive. Lastly, through the use of different theories, this paper examines why state seeks technological control over individuals and why individuals comply with state control and surveillance.
Acknowledgements
First of all, a big thanks to Tommie Sjöberg, my supervisor, for the vote of confidence, guidance, support and endless proofreading. Above all, thank you for the immense kindness you have shown me.
My thanks to Philip Muus, for taking the time and helping me organise my ideas on the initial stage of this work.
To Demosthenic Chatzoglakis, who generously contributed his free time and helped me gather relevant material and understand the theoretical framework. I bow for your energy, passion and commitment.
Finally, I am especially grateful to my sister, Zinaida Kajevic, for reviewing this paper and making suggestions for improvement. Your intelligence and worldview have proven to be an unexhaustive source of inspiration time and time again. Thank you.
Table of Content
l Introduction ... 2 1.1Aim ... 3 1.1.1 Limitations ... 4 1.2 Method ... 5 1.2.1 Research Design ... 81.3 Operationalisation and the Concepts ... 10
1.4 Previous Research ... 11
1.5 Material ... 12
2.1 What is Biometrics? ... 15
2.2 The Technology of Biometrics ... 16
2.3 Advantages and disadvantages ... 17
2.4 Summary ... 19
3.1 The European Union and its Investment in Biometrics ... 21
3.2 Summary ... 24
4.1 War on Terror ... 27
4.1.1 Intensification of Biometric Technologies as Means of Surveillance ... 28
4.1.2 The Permanent State of Emergency ... 30
4.2 Securitization of Migration ... 32
4.2.1”Fortress Europe” ... 33
4.2.2 Irregular Migration ... 35
4.2.3 Discrimination and Exclusion ... 36
4.3 Summary ... 38
5.1 What Does Right to Privacy Mean? ... 41
5.1.1 Problematization of Privacy ... 41
5.1.2 Information Privacy ... 43
5.2 Threats to Privacy ... 43
5.3 Summary ... 47
6.1 Theory ... 50
6.1.1 The Political Technology of Individuals ... 51
6.2.1 “We Are Bearers of Our Own Surveillance” ... 55
1. Introduction
Globalisation is a complex international system in which migration has a central roll. Even though movement is a prerequisite the globalisation process, there are vast amount of instances established for regulating this movement of people, merchandises, capital, etc. As globalisation creates a new modern state with contacts, communication and linkages that transcends societies and state borders, it also poses new threats that need assessment and regulation. To gain control over the direction and amount of movement is an essential aspect of both security and capitalism.
In view of the world that is taking on a different shape through this grand process of globalisation, states and societies are contemplating the problems and difficulties this process is causing to societies and figuring how to best address them. For most countries this process has meant that the screen has been taken off from the rest of the world through the means of information and communication technologies. Issues like those of international terrorism, international crime and illegal migration are no longer speculative threats. The fear of terrorist attacks awakened by the attacks on the twin towers in New York on the 11th September 2001
has been particularly effective in paving the way to a new line of politics in Western countries. This politics operates under the banner of “national security”.
Strangely enough, as technological devices are what has facilitated and continues to facilitate the process of globalisation, the answer to the problems seems to lay in the technology of biometrics, a new identification and verification system based on measurements of the physical characteristics. This technology has managed to gain credibility in a very short period of time, and without major public discussions at least in Sweden. The European Union, in a similar manner as the forerunner Unites States, has shown keen interest in this technology and some of the member states have already made arrangements for its implementation.1 The ambition is to enhance the overall security through surveillance of movement and identification and verification systems.
In spite of the regulatory framework in the filed of migration that exists today, such as visa systems, border control etc., the state’s quest for equilibrium in migration is an eternal battle. The strived balance appears unreachable, only partly due to people fleeing from internal conflicts, famines, poverty and persecution, who are not able to take timing, racism, business cycles, issues of demand and supply, preference in cultural background etc into consideration. Yet, migration control is an outspoken goal and the biometrics as a method of securitization of migration is now recognized.
One of the concerns in regard to the implementation of technological devices is that its purpose is to serve those who control it. In the case of biometrics, the EU is one of the main stakeholders and investors. “The social practices and processes which constitute the research cannot be understood independently of the society from which they derive. Modern science and technology are therefore political."2 The biometric technology cannot be taken out of its context, it is a political tool designed and developed for the purpose of controlling and surveying movement of people. It derives from the Western part of the world and is developed to first and foremost protect the interest of that part of the world.
If we look at this issue from Another point of view, we can see that the risks posed on integrity, privacy and autonomy are of a pressing character. There are extensive plans on implementations of biometric technology within foreseeable future. This instalment is bound to have implications on migration as well as on personal privacy. For the EU, the issue of security has been and remains one of the main assignments to deal with. Migration control is another. The biometrics appears to be the instrument able of solving both.
The most remarkable aspect of it all is the lack of public awareness in regard to the development that is slowly taking form. No attentiveness to or perception of the risks. No discussions.
1.1 Aim
Since the biometric techniques are a rather new phenomenon and new acquaintance for me as well, I have chosen to primarily focus on the main problem area of this technology. The main aim question has an overarching character and most parts are highly pertinent to the field of International Migration and Ethnic Relation (IMER). The reason for this, and also my justification for in some ways exceeding the field of IMER, is that the biometric technology has not yet been fully disseminated for all its repercussions. The greatest implication of the implementation of biometrics appears at this stage of its development to be its impediment on personal integrity and privacy. Therefore the aim question is: How will the implementation of biometrics affect privacy for all people?
The second question concerns migration, seeing that it is the field where the main deployment if biometrics is occurring right now: What effects will the deployment of the biometrics have on migration management?
The third question deals with the dilemma that runs throughout this paper that juxtaposes security and the right to privacy, i.e. the interest of the state versus individual 2 Shiva, Vandana. 1995, p. 5
rights: How can we solve the dilemma between “public good” and individual rights?
1.1.1 Limitations
My acquaintance with biometrics has, until recently, stretched only to the information published by the International Organization for Migration, one of the leading organizations within the field of international migration. It is therefore difficult to set boundaries at the outset and to know what information is research-relevant.
One of the main problems I encountered in the beginning of this study was to specify the unit of analysis. Even though this study relies on the information about the implementation of biometrics as its basis, my primary concern is the restrictions that this implementation might come to pose on personal liberty. There are both private and public stakeholders striving to install a global biometric system, making it even more urgent to circumscribe this subject within a frame early on. Therefore I have decided to focus the research on the geographic and political area of the European Union and deal mainly with the motives behind the development of implementation policies. After formulating the thesis question, it was clear that the unit of analysis was the biometrics within the EU. It is important to note that the work will focus on the EU as a whole and not go into the comparative differences among its Member States. The differences are of course visible, important and have a lot to do with political tradition and culture of the separate Member States and the way governments implement the EU law into their national law. However, for this work it is more important to illustrate an overall development rather than go into political and legislative details of each and every Member State. The first section of the work will be focused on examining the initiatives on which the biometric technology is brought to use, and the second on the ethical and political implications of this technology on integrity and civil liberty.
Except for the general introduction of the biometric techniques, the detailed technological explanations and illustrations will be left out. This is mainly due to the disciplinary alignment of this study, as a social scientific perspective favours the political and social elaborations to the technical explanations.
I am aware that the choice of the single case research method, as well as the angle of approach, has influenced the collection of material and choice of analysis. Even though the advantages of biometric will be presented, my intention is to stress the risks with this technology. Hence, this alignment reflects on my intentions with this study and shows my critical approach to the subject. This predetermined perspective shows that the focus will be on the risks of this programme and the critical position of the researcher i.e. me. This will bear
an effect on the conclusion, and the end result is that this work will not be able to comprise all aspects of the biometric technology, only the ones embraced by the questions stated in the aim.
1.2 Method
This study started off with the idea of exploring the case of the implementation of biometric technology. My plan was to go behind the current public policies and look into the events that have led us to the stage our society is today. Even though the original idea was not to do a case study research but use the biometrics only at the exploratory stage of this work, the working plan for this study showed to fit within a framework of a single case study. It consists of a descriptive, an exploratory and an explanatory segment - even though there are no sharp boundaries between them. For the record, the case is the implementation of biometric techniques as means of control and surveillance and its bearing on the society at large.
A case study, or the central tendency among all types of case studies, is work that tries to illuminate decisions, processes, programmes, individuals, organisations or events. My objective in the case of biometric is to find out on which grounds the decision on implementation of biometrics was taken, to which extent will they be deployed and what the outcome might be for our society. Technical definition of a case study is that it is “an empirical inquiry that
• investigates a contemporary phenomenon within its real-life context, especially when
• the boundaries between phenomenon and context are not clearly evident.” 3 In other words, the biometrics is becoming an observable fact but the reasons for its extensive penetration in the contemporary society are not clear.
Another reason for choosing to form this study as a case study research is because it has a distinctive place in evaluation research. The “most important is to explain the presumed causal links in real-life interventions that are too complex for the survey or experimental strategies. In evaluation language, the explanations would link program implementation with program effects”4. Hence the context of the implementation of the biometric techniques and its effects are central issues in this paper.
A prerequisite for a case study is to have a valid rationale for choosing to conduct a case study i.e. why a case study is the appropriate method. In this study, I claim that the case of the biometrics in the EU is a revelatory case. The biometrics is a contemporary issue and 3Yin, Robert K. 2003, p. 13
yet not fully disseminated for its repercussions. We have not yet been introduced to the consequences this technology and its impact on our society. We, who live in the Western world, are witnessing the raise in surveillance cameras, we even have them in schoolyards. We have increased our insight in technological achievements and what can be done with cell phones, DNA, personal security numbers, surveillance of Internet usage etc. Yet we somehow accept these technological advancements, with the benefits clearly illuminated, without deeper reflections on the risks involved. The faith the public appears to have in central management seems to stretch even to the implementation of biometrics, a profound identification and surveillance system. Hence, my justification for formation of this study as a single case study is that the biometrics is a revelatory case, in both how politics are carried out today and the threat it poses on personal liberty.
This study deals with the “global nature of a program”5, the biometrics identification and verification system, and therefore falls under the category of a holistic single case design. In this case, the unit of analysis is the global nature of the biometric programme and its effects on society. This holistic design is applicable when there are no logical subunits identified, calling only for one unit of analysis, or when the relevant theory is itself of a holistic nature. A typical problem in these cases is usually the high level of abstraction, lacking clear measurement of data6, which also is the case in this work. The alternative is to have an embedded case study, which presupposes several different units or subunits of analysis. Since the boundaries of this study are already defined, and since there are no logical subunit or subunits defined, this approach is not of interest.
Important critique on the usage of case studies, or using a case study as a starting point, is the provision for scientific generalisation. The claim is that a single case study cannot provide for theoretical generalisations in other cases, or to populations or universes, an issue very important in constructing external validity.7 What it can do is to provide for theoretical propositions.8 In other words, one cannot generalise from one case to another, but a case study can prove rationality when done in the context of a methodology and theoretical framework. Since the biometric implementation programme is extensive, in a geographical, political and ethical sense, it is applicable to theoretical proposition as well as to illustrate a broader development that is taking place in our societies. In this sense it can provide a general picture of political and social development even if it might not be able of granting generalisations for other case studies. Also, there is a problem with having a technological device and its 5 Ibid. p. 43
6 Ibid. p. 45
7 Svenning, Conny. 2000, p. 61 8 Yin, Robert K. 2003, p. 10
implementation as a case study, and that is that the beginning or the end points are hard to define.9 This too is an issue in this study, where an end point is lacking because the biometrics is not yet fully implemented.
I am entering this work with premises of my own, both concerning the risks and the objectives behind the implementation. According to several researchers, and I share this opinion, some degree of subjectivity is inescapable.10 It is our understanding and interests that guide us into choosing a subject, the direction and perspective. Our interpretations and views are most likely reflected in our language, analysis of material, choice of method etc, i.e. we are unable to escape our own discourses, Foucault? My sceptic approach, reflected in the aim question, shows that I have a negative view on the implementation of biometric techniques. In spite of this, an effort will be made to avoid preconceived notions and partiality. Hopefully this will provide the reader a possibility to critically judge if and how my assumptions, political views and prejudices have too much bearing on the collection of material, analysis or conclusion. My conscious openness to contrary findings than those I have envisioned should be reflected in this work. I am hoping that my awareness will contribute to a more careful approach to the subject and rash conclusions.
The thesis question of this work cannot be answered by statistics or illustrations of biometrics but requires an investigation of the structures that allow and even call for this line of development. The choice of thesis subject and aim has subsequently led me to the choice of qualitative method. The purpose of the qualitative method is to capture a central issue rather than, as the quantitative method, sum up different parts. It demands close reading of a text in order to discover the content.11 Since the concern is to unveil structures and causes, this method appears much more suitable than the alternative.
For the sake of clarity, since there are multiple strategies overlapping in this work, I have decided to identify and list them. The first has been already mentioned while the other two will be presented in the following subchapter of method;
Approach to material: Qualitative Method Theoretical perspective: Critical Realism
Mode of linking theory and research: Abduction/Retroduction
1.2.1 Research Design
I will here give an outline of the paper, designed to serve as an orientation tool. The research 9 Ibid. p. 23
10 Svenning, Conny. 2000, p. 12 11 Esaiasson, Peter. 2004, p. 233
design has four components important for setting up a case study; the study question, the unit of analysis, the liking of the data to the aim and the criteria for interpreting the material.12 The study question and the unit of analysis are already presented in the subchapters of introduction i.e. aim respectively limitations. The remaining two components are found in the text that follows.
The method I have decided to use in linking the research or data to the purpose of this paper is known as abduction, called retroduction in critical realism. Please take note that it is the conventional way of writing a paper, this is separate from induction and deduction. Its mode is not to observe a specific social issue and frame the resultant data into an appropriate theory, or select a theory prior to research with the aim to either prove or refute the theory.13 Therefore, to avoid any misunderstandings, the order of things will be done in the mode of abduction, that has an interesting case as its starting point and the research that follows is concerned with how and why an event or a programme came to be. It is meant to, as a tool of critical realism, investigate the underlying causes to an empirical phenomenon, event or correlation.14 Hence, I have chosen the biometrics as the case for observation, its causes and motives for analysis, and possible consequences of its implementation for the final discussion. The main reason for choosing this mode is because it provides a space for concerns and common sense foresight.
The criterion for interpreting the findings in this paper, or its theoretical framework, is based on critical realism. Case study research demands a theoretical understanding that precedes the collection of data and the theories found at this stage of work appeared as too leading to be used as a theoretical tool for analysis of material and, as stated before, I have already ruled out the mode of deduction. The perspective of critical realism appeared more adequate for this purpose. Critical realism is part of the tradition of realism, a concept that belongs to the social school of thought. The latter is based on the idea that there are underlying structures and mechanisms in social relations, and the task of social researchers is to uncover them so that we can understand why we have the policies and practices we have. It must go beyond observations and collections of data, to explanations through theoretical framework that will reveal the latent structures.15
Similar to realism, critical realism argues for deep explanations of empirical events. In this context, the case of biometrics is the starting point for an analysis of why and how these techniques are being implemented in our societies. Critical realism claims that the world we 12 Yin, Robert K. 2003, p. 21
13 May, Tim. 1997, p. 30
14 Gijselinckx, Caroline. 2003, p. 5 15 May, Tim. 1997, p. 12
live in is not just the world we can observe (empiricism), the world we can think of (rationalism), or the world we can talk about (idealism).16 According to critical realism, for this paper to conceptualise the causes behind the implementation of biometrics it must dig into the nature of reality, a nature by virtue of which things are possible. By doing so, we can both conceptualise the actualisations as well as distinguish tendencies.17
I have chosen this theory to serve as my guide through the reconstruction of the process that has led biometrics to the stage it is in today. The theory appeals very much to my own view on research and human capacity to interpret the world we live in. This theory will be used as a theoretical perspective, a tool of guidance throughout my research and writing. It should be reflected in the way I carry out my investigation, explain the current EU policies, the choice of theory and the final analysis.
A critique of this perspective would be that it contains a paradoxical element, as it on the other hand claims that the essential truth can be reached through thorough unveiling of overlapping layers and on the other hand poses the axiom that we can only know the world through interpretation i.e. never really know it for what it is but only for what we make of it. The “real world” that is out there exists in our minds through interpretations only and the logical conclusion would be to that research and science are just methods and not “the truth“.
A part of this thesis is to shed light on the existent and possible implication, an intent that can be perceived as futuristic and even prophetical. This should not pose doubts about the reliability of this study, because the results will be based on actual and likely applications of biometrics in the future and realistically probable implications.
Due to the exploratory nature of this paper is, there is no apparent or natural theory at this stage. If the final finding of this paper turns out to be in adequate conformity with an already existing theory, such linkage will be made after the final research chapter.
The last point I want to make here concerns that aim of this paper. Half way through my research, I discovered that large amount of the information on the implementation of biometrics dealt with securitization of migration. This issue, presented in the chapter 4.1, Securitization of Migration, is highly relevant for this paper as it is both a justification of the implementation and one of the underlying causes. Still, for the sake of clarity because the chapter is quite extensive, it is important to stress once again that the overriding aim is to show how the implementation of biometrics will affect privacy and why we allow it. One could just as well have written a paper on the relation between biometrics and migration, but in this work the main issue remains to be the privacy for the general public. The reason for choosing privacy as the subject matter in the case of biometrics is because it will provide a 16 Gijselinckx, Caroline. 2003, p. 5
more comprehensive study on both biometric techniques and the overall societal development in this day and age. In other words, the overall aim falls under the general category of social science, while a section of this paper deals exclusively with migration issues and proves this papers relevance to the field of International Migration and Ethnic Relations.
1.3 Operationalisation and the Concepts
The explanations of key terms and concepts used in this study are used in the same manner as in the source material, in cases where definitions were available. The definitions of the biometric terms are mainly obtained from the International Association for Biometrics.18 In other cases, mainly in the theoretical discussion, I will use definitions as defined in the field of International Migration and Ethnic Relations.
Operationalisation is a practical tool of method, a way of breaking down and explaining the most important concept so that they can be applied empirically. The concepts will be defined and explained in manner that is adapted to the way they will be used in this work. The correlation and mutual agreement between theory and empirical material is what defines the degree of validity. Another aspect of validity is to examine the concepts’ relevance to the aim question and put them into operationalisation.19 The relevant concepts for this study that need elaboration at this stage are privacy and surveillance as they are used continuously throughout this work.
Privacy: There is no satisfactory definition of privacy or autonomy. Both have been said to encompass one’s rights to be free of unwarranted governmental intrusion into fundamental or intimate matters. These matters are said to include one’s right to repose from unwanted noises and odours, one’s right to sanctuary from public and private surveillance, one’s right to limit disclose of matters deemed private or personal, one’s right to the integrity of one’s personality etc. These terms are even sometimes said to include religion, education, property, marriage, procreation, sex, sexual orientation, reputation, dress and demeanour, bodily integrity and familiar relationships. A definition of these concepts in reference to their subjects matter is not perceived as successful due to their comprehensive nature.20 To focus on their presupposition seems as a more appropriate approach. Privacy is a concept on the creation of a private realm immune to public observation while autonomy is more intended upon publicity and self-expression and less respectful of the dichotomy of public and private. I intent to use the term privacy, but it might come to cover areas that are traditionally related 18 http://www.iafb.org.uk
19 Svenning, Conny. 2000, p. 62 20 Mindle B. Grant. 1989, p. 575
to the realm of autonomy. There are three areas of privacy; territorial, personal (of the body) and informational (of information about oneself).21
Surveillance: It involves observation, recording and categorization of information about people, processes and institutions. It calls for the collection of information, its storage, examination and, as a rule, its transmission. It is a distinguishing feature of modernity and modern organisation. Surveillance in itself is a production of knowledge about and the supervision of people. Over the years surveillance has become increasingly systematic and embedded in everyday life, particularly as state and supra-state agencies and corporations have strengthened and consolidated their positions. Surveillance is such a routine matter that it often escapes our attention, making our phone calls, pay by debit cards, enter buildings with our cards and PINs etc.22 The biometric techniques will be used in a similar matter, as means of surveillance that will eventually because so routinized that they will escape our attention. At this point in work, we need to understand that surveillance, unlike the vision presented in “1984” by George Orwell, has become more dispersed due technological capacities and globalisation. Gilles Deleuze and Felix Guattari offer another view on surveillance than the common centralized understanding. They suggest that surveillance is growing more and more like a creeping plant rather that a central tree trunk with spreading branches.23 Although the issue of central storage remains a troubling aspect of privacy protection, this way of looking at the ever increasing surveillance appears much more appropriate in our time and age.
1.4 Previous Research
The range of available research on this subject varies depending on the scientific perspective. Technical research on this technology is much more developed than the ethical or political research. The biometric technology is principally a contemporary matter and at the infancy stage of its development. Most of the information that can be found is presented in various scientific journals. For this paper, the journals “Biometric Technology Today” and “Science, Technology and Human Value” have been invaluable.
I will only briefly present leading work done hitherto in the field of biometrics, including the work of different prominent international organisations and different scientists. In this study, the research and studies carried out by the International Organisation for Migration have been both relevant and useful in the chapter dealing with securitization of migration and privacy. There is a difference between scientific research and the research 21 Ball, Kirstie and Frank Webster. 2003, p. 13
22 Ibid. p. 1 23 Ibid. p. 20
conducted by international organisations. The aspect of dependency on the donors, interests and goals, and diplomacy connected to the work of organisations bears influence on their perspective. Therefore the work done directly at the initiative and under the supervision of such organisations and organs is in my opinion, not as liable as the work carried out by independent scientists and agencies.
The most part of the work done by NGO‘s stresses the risks linked to biometrics. Although their contributions do not seem to be highly esteemed by governmental institutions, they have some influence on the public. The critique of this technology is best received when carried out by universities and research centres. The European Commission has deployed several taskforces and projects for evaluation of biometrics, for example the BITE project (biometric identification technology ethics) and the European Biometrics Portal.24
Concerning the biometric technology, its implementation, technological advantages and disadvantages, issues like these are best presented by Julian Ashbourn in his two books Biometrics: Advanced Identity Verification: The Complete Guide, 2002 and Practical Biometrics: From Aspiration to Implementation, 2004 and by Ruud M. Bolle in diverse scientific journals. In the field of IMER, specifically on securitization of migration within the European Union, Controlling Frontiers: Free Movement Into and Within Europe, 2005, by Bigo Didier and Elspeth Guild is one of the better books I have read in the field of International Migration. It does not deal specifically with the biometric techniques but with its introduction, other border control mechanism, immigration policies, role of the state and internal security.
The book edited by Kirstie Ball and Frank Webster, The Intensification of Surveillance: Crime, Terrorism and Welfare in the Information Age, 2003, which is used quite extensively throughout this study, gives good illustrations of the pace and scale in development of technological surveillance in the aftermath of 11 September 2001.
1.5 Material
The material used in this paper is derived from both primary and secondary sources. Even though the latter predominate throughout the paper, on the issue of biometrics and its implication on the right to privacy secondary sources were less available that primary. The primary sources are reports from the EU Commission, the EU news, speeches and the information from reliable URL25 sources. The material on the issues concerning EU matters 24 http://www.europeanbiometrics.info
are mainly gathered from EurActiv.com26, an independent media portal completely dedicated to EU affairs, news, policy positions and actors, and European Biometrics Portal, a project initiated by and belonging to the European Commission. These are used as far as presenting the EU and its official policies. I am also aware of the fact that not all information is accessible due to matters such as national security, diplomatic considerations etc. This means that there is inaccessible information and standpoints that I will not be able to find on the EU’s URL. It is precisely here the theoretical framework of critical realism comes in and tries to dig up and present all the reasons, official and unofficial, the EU has for the implementing biometrics techniques. Still, there might be sections of the “truth” within the politics on biometric techniques that will not be made available in this paper.
The shortage in secondary sources can be explained by the contemporary nature of the biometric implementation program. The main sources have been scientific articles, journals and technical papers that actually compose the foundation on which this research is based. I have also used books, newspaper articles and surveys conducted by the different agencies and research centres. Unfortunately, the access to relevant material has been limited, as the supply of literature here in Sweden on contemporary biometrics and its impact on personal integrity and privacy is restricted. I therefore relied on the work of international scientists and writers. This might be questioned, as the unit of analysis is the biometrics in the EU, but scientific work is scientific work, regardless of the researcher’s nationality. The technology of biometrics is based on the same principles as are its implications, both in the EU and the US. For those reasons, I do not see this issue posing any substantial doubts on the choice of material.
2. Introduction to Biometrics
The biometric technology is at its introductory stage, but the extent to which it is planned to be implemented is broad. This technology is a surveillance and tracing system, unlike any that has been attempted to implement before. A brief overview of the technology and different techniques is needed for the research that will follow. To be able to understand how this technology might come to influence the society one needs to know the technological principles, how it operates and in which way these techniques will be applied. This chapter will therefore include a brief introduction of the term, the techniques and their advantages and disadvantages.
2.1 What is Biometrics?
According to the International Biometric Society27 the terms "Biometrics" and "Biometry" have been used since early in the 20th century to refer to the field of development of statistical and mathematical methods applicable to data analysis problems in the biological sciences. Its main task has been the analysis of data from agricultural field experiments, human clinical trials evaluating the relative effectiveness of competing therapies for disease, or for the analysis of data from environmental studies on the effects of air or water pollution on the appearance of human disease in a region or country. According to the International Biometric Society, it is only in the recent years that the term "Biometrics" is used to refer to the emerging field of technology devoted to identification of individuals using biological traits, such as those based on retinal or iris scanning, fingerprints and face recognition.
In spite of the change in popular usage of the term, resurrection is not a word applicable to biometric identification and verification. On the contrary, the roots of biometrics go back to the ancient Egypt, where biometrics as physical and behavioural traits were deployed in identification of the sometimes 100,000 men working on the pyramids. The name along with private notes on specific features was how the men were identified for payment. So, this is in no way a new method of identification as is commonly believed today.28 In the 19th century the head of the French police force, Joseph Fouché, kept political intelligence
files. During this period, the criminals were identified by anatomical measures in France, a period when progress was made in the field known as judiciary anthropometry that deals with the measurement of different elements of the human body including weight, height, limb 27http://www.tibs.org/DefinitionofBiometrics.htm
circumference and skin thickness. 29
In the United Kingdom, already in 1915, passports were issued with sometimes very personal descriptions of the holder. It entailed descriptions of the person's shape of face, his/hers complexion and features for example nose: large, forehead: broad, eyes: small. The passport also contained a photo and a signature.30 A biometric, as defined by the International Association for Biometrics31, is a measurable, physical characteristic or personal behavioural trait used to recognise the identity, or verify the claimed identity of an enrolee.
2.2 The Technology of Biometrics
Currently, the most popular techniques are the ones are based on physical characteristics as fingerprint ridge pattern, hand geometry, retinal recognition, facial recognition, and also behavioural characteristics such as voice verification and signature stoke pattern. There are also currently less used techniques of authentication such as vain checking of patterns in hand and wrist, gait recognition, iris scanning, earlobe analysis, sweat pores, chemical composition of body odour and brain waives.32 This means that this field has a realistic potential of developing even further, and additional techniques will surface in time.
A biometric authentication is a pattern recognition system and consists of four stages; enrolment, storage, acquisition and matching. The first step in this process is when a sample of live phenomena, or the raw biometric data, is sensed and digitised. It is known as the process of enrolment. The second step concerns search for and extraction of significant ”landmarks”. In the third stage, the biometrics trait is converted into a reference template, constructed of these ”landmarks” and compacted into an electronic representation of this biometric sample. This template is stored with additional information of the individual such as name, place of birth etc., in a memory of a biometric device or database, to represent the biometrics of that particular individual. This database can either be centralised or distributed as smart cards. The final step is the authentication process is the actual testing of an individual’s identity. This is carried out when the stored template is matched against the new one derived from current signal input. The end result of this final stage is YES when the two templates are a match and a NO when they are substantially different. The decisions are made on the score or the degree of the required similarity, either a similarity or dissimilarity measure. This calculation is often programmed as a threshold ratio, and takes variables like 29 Ashbourn, Julian. 2002, p. 6
30http://www.passport.gov.uk/_history/history_03.asp 31http://www.iafb.org.uk
lighting and geometric into account. The two samples, the new input and the reference template, will almost never match precisely. 33
The final process in authentication is in undertaken in two ways, verification and identification. Verification, also called ”one-to-one” transaction, is when the user claims an identity and provides information, such as name, reference number or password, to call up a reference template from a database. The user then supplies the biometric device live sample that is matched against the template one has claimed to be one’s own. There is also alternative verification, and that is when the reference template is stored on a portable token, for example a chip card, ready to be compared with live sample provided by the user. In more simple terms, the system is supplied with two sets of information and asked to compare the two according to its predetermined matching threshold. The majority of the biometrics systems work with verification. Identification, so called “one-to-many” transaction, is when the user is not required to leave any information other than the live biometric. In this case, the system is given a biometric and asked to identify the person.34 Technologically, to verify a claimed identity is much easier than to identify an unknown person.
In summary, the biometric technology can be deployed in three ways: to verify that an individual is who he/she claims to be, to discover the identity of the unknown, or to check people against a watch-list.
2.3 Advantages and disadvantages
One of the main advantages of biometrics is its longevity in linking an identity to a particular body. The biometric, i.e. the characteristic or behavioural trait, cannot be separated, borrowed, revoked, lost or stolen from its owner in the same way as can be done with ID cards or keys. Many types of authentication prove only that the person posses the token or knowledge that is requires. The biometrics, on the other hand, proves that an identity matches a person, it is the unique within the universal, a permanent imprint of an individual.
The problem we are facing today in the field of user authentication is the accessibility to forgery of ID (identification) cards, acquirement of secret PINs (personal identification numbers) or passwords, web transactions and payments etc. Also passwords or PINs confirm only knowledge, not its rightful owner or their presence. The lack of secure authentication methods in commercial environments is threatening. The biometric method is believed to be highly effective in immigration control and illegal working, control of airports, in protecting people from identity fraud, to enable easier access to public services such as banking and 33 Bolle, Ruud M. 2002, p. 2732
disrupt the use of false or multiple identities by organized criminals or those involved in terrorist activity.35
There is also the aspect of simplicity that is appealing, where your own accounts are opened by you placing your hand on a scanning scene or using your voice. There is no need to remember a password or a code, automatically resulting in a reduction of errors and frauds. It means that the system provides simplicity, security and efficacy.
In the password systems there is no such thing as acceptance of false password or variations in the PIN, but only the right or wrong number. In biometric systems, the data picked up from biometric samples will vary. Since the identifications occur on different occasions, the biometric systems must be more flexible and allow for variation. It is therefore that the biometric devices are designed to take different variables into account. The biometric system cannot say with one hundred percent accuracy that this is a right person, only if it is a match or not. 36Adding the human error aspect into equation, as the machines are operated and maintained by personnel, we have an additional source of mistakes and inaccuracy.
The biometrics suffers from inherent biometric-specific threats, mainly due to its demand for flexibility. The threats are related to the use of digital signals and attack on the client or the server.37 The first one refers to the error rate of the pattern recognition system, whose performance is tied to the quality of the signal input and enrolled biometric signals and the basic characteristics of the algorithms i.e. the steps the engine takes when calculating and testing for match.38
The second threat refers to the possibility of resubmission of a recorded signal that is replayed to the system. It is categorized in “client attack and “server attack“. The “client attack” is when a biometric replay of an individual is used to assume someone else‘s identity. The ”server attack” is considered to be more serious, a threat of an imposer that poses like a real user of the server, as it aims at the server.39 This calls for an impostor to obtain either valid biometric sample or template. In theory one can bypass the system by using, for example, a copy of a valid fingerprint image or a recorded audio signal from a speaker. Fraud is therefore not eliminated as a possibility. Computers that collect and evaluate the biometric information are vulnerable to the same type of fraud and manipulation as other computers. The information can be accessed and erased, altered or copied.40
There are also severe technical problems, published in an evaluation report carried out 35 Bigo, Didier and Elspeth Guild. 2005, p. 213
36 Bolle, Ruud M. 2002, p. 2731 37 Ibid. 2732
38 Ibid. p. 2732
39 Bolle, Ruud M. 2002, p. 2735 40 Feldman, Robin. 2003, p. 664
by the Dutch government, the department of the Ministry of the Interior and Kingdom Relations41. For example, they found that there was a forty five percent higher chance for people wearing spectacles to get an error message on the facial verification than for those not wearing them, due to the reflections from spectacles. Also, facial expressions were found to have implications for the recognition, and the accuracy fell with the age of the facial image. Moreover, the report showed that the quality of children’s fingerprints and facial images was very low and that is virtually impossible to obtain valid biometrics from children under the age of four. The positive discovery was that hobbies and occupations did not contribute to a lower quality of the fingerprint.42
There are social issues related to the biometric techniques that were identified by the European project BioSec. One is the concern of “function creep”, which is when the biometric techniques introduced for one purpose become extended to other purposes that were not agreed upon at the time of their implementation.43 Another issue that was highlighted was that the biometric techniques are to some extent invasive of the user’s privacy. Once acquired, the biometrics can be use for purposes unknown to the enrolee. The biometrics are stored in databases and disposed of either government agencies or private firms, and the concern is that this information on citizens and non-citizens might be shared with law enforcement, commercial organization or hacked into and used for criminal purposes. There is already information on consumers and consumer behaviour that is being stored, and all additional information awakens concern. There is also a public suspiciousness about having central storage with information on associated with individuals, to this day mainly focused on the maintenance of medial and criminal records. These records are also stored in databases that can be used and misused in various ways and shared between different organizations.44
2.4 Summary
As pointed out earlier, the longevity of the biometric is particularly appealing in the authentication process and the fact that a biometric cannot be changed. Today one can easily change password, PIN or even keys, but with the biometrics it is quite the opposite. At the same time as it is hard to forge a biometric feature (it is hard to put a false fingerprint or make the retina look like somebody else’s) it is quite easy to forge once the reference template has been copied or stolen, as we can send in photos of those we claim we are or scan their signatures and use them again and again. The main problem is that once it is stolen, it is stolen 41 2be or not 2be. 2005, Evaluation Report: Biometrics Trial.
42 Ibid.
43 Biometrics at the Frontiers: Assessing the Impact on Society. European Commission. 2005. 44 Bolle, Ruud M. 2002, p. 2736
for life. A person has just that many fingers, irises and only one face. Hence, one of the biggest public fears is the potential misuse of the personal biometric data.
Even though the principle on which the biometric technology is based is in no way new, the development and the spread of the technology in the recent years has been proceeding in a very rapid pace. While the technology is very appealing from the security standpoint, and the most reliable and accurate form of identification and verification, there are serious considerations and concerns that this technology raises. No biometric technology is hundred percent accurate and it suffers from biometric-specific threats. It poses a threat to privacy, raises concerns about its use in tracking and surveillance and possible misuse of the centrally stored information on individuals. As good as the biometric technology is, we do know that no system is foolproof.
3. The Contemporary Situation
Before going into the motives for the implementation of biometrics, I will shortly present the current state of affairs in the field of biometrics. This chapter is meant to serve as a presentation but also as the background material. Besides a general description of the biometric programmes today, it includes actions taken by the EU and its aspirations in this field, the control mechanism that are being installed in the EU within the different dimensions of migration and the existing directives on the data protection. It is therefore that this chapter is quite technical.
Up to now, biometrics is being utilized in a wide variety of applications. In prison systems it has been used for physical access control for both staff and inmates, and now also for visitors. Border control is another field where various techniques have been set in place, including hand geometry, fingerprints, iris recognition and facial recognition. Biometrics in the bank systems, if not yet fully incorporated in the main stream, have shown to be effective in several cases in conjunction with ATMs (automatic teller machines) and different services. The technology is being used in voting systems and in computer and network access control, if so far only to a limited extent. Another area of success has been public services in conjunction with health cards and drivers licenses, where this trend is expected to continue.45
The progress made within the field of biometric identification during the past decade has not been due to development in technology but largely related to the awakening of the governments to the possibilities of biometrics. The governments’ main focus have been national ID cards that include a biometric template, passports that incorporate a biometric and wider scale commercial applications that include banking, mobile commence and on-line personal identity verification.46
The change that has occurred, with governments taking increasingly greater interest and control of this technology, is quite important for this study. The result is that this technology is now heading towards a global spread. This work recognizes this fact and tries to take this into consideration as much as possible, while principally dealing with the political development taking place in the EU. The following subchapter will provide an overview of the EU’s progress in this field.
3.1 The European Union and its Investment in Biometrics
45 Ashbourn, Julian. 2004, p. 4 46 Ibid. p. 4
“There has been increasing momentum in the region [i.e. the EU] towards implementing biometrics, particularly given that biometric identifiers are now being introduced in passports and other ID documents in line with international requirements.”47 Even though the implementation of biometrics has the ambition to become a global project and establish a worldwide standard, there is currently a large difference in progression that appear to be linked to the national economies. According to the ICAO (International Civil Aviation Organisation)48, that is a specialized UN agency for establishing international standards within the technical fields of aviation, 188 states have agreed to issue MRPs (machine-readable passports) no later than 1 April 2010. This is a part of the world-wide harmonization of the biometrics identification in machine readable travel documents and seen as a new standard essential for meeting global objectives, for minimizing border crossing formalities and as a safeguard against acts of unlawful interference.49
But for now, there are approximately forty nations planning to introduce biometric e-passports by the end of 2006. Twenty-five out of these countries are from the EU. The deadlines for these countries were set by the Council to August 2006 for introducing a digital facial image on new passports, and to February 2008 with the requirement to include multimode biometric system, i.e. both facial and fingerprint information.50
There are doubts to the legal basis of this regulation on EU passports, as Article 18 of the EU Nice Treaty states that the Commission’s powers to act to promote freedom of movement shall not apply to provisions on passports, identity cards or residence permits. The Nice treaty is an extension of the Schengen Agreement and does not include Ireland, UK, Iceland, Norway or Switzerland.51
The EU does not currently hold jurisdiction over the issuance of national ID cards, but some Member States are promoting biometric ID cards and their wish for these to become interoperable across the EU. There are five countries [France, Germany, United Kingdom, Italy and Spain] that have already agreed to make these cards compatible and readable for the systems in use. These countries are now in process of including the other members that according to The Hague programme52 have to develop a minimum-security standard for eID (electronic identification) cards including biometrics. There is also a standing proposal from the current UK Presidency of the Council of the European Union for all ID cards in the EU to 47 Part One: National ID-Europe. 2005, p. 10
48www.icao.int
49 Rapport dated 7 July 2005, PIO 07/05 / www.icao.int 50 Biometric Passports planned by 40 nations. 2005, p. 5 51 Biometrics and secure travel documents. 2005, p. 5
52 Endorsed by the European Council in November 2004, fixes the priorities for an area of freedom, security and
include biometrics in driving licenses. The argument is that this internationally coherent biometric data will increase security in all forms of movement.53
Besides the progress made in the field of passports and possibly even in national ID cards, a decision was taken to incorporate biometrics into visas and residence permits for third country nationals. The first proposal for the inclusion of biometric data chips on visas and residence permits for non-EU nationals came already in November 2003 and was seen as very important step for delivering more secure travel documents. The EU Commission adopted this regulation, as well as the one on harmonizing security standards for EU passports, in February 2004. Technical difficulties have postponed the process as it was found that if more than one chip was introduced into one single document the data would not be readable. Hence, if the third countries would insert the biometric chips into their passports, the biometric visa chip would cancel out the working of both. This problem will be solved by putting the biometric data directly into the central Visa Information System (VIS), instead of issuing them on visas. This system is planned to become operational by 2007.54
In line with the progress of implementation of biometrics, there are also measures taken by the EU to ensure data protection. The European Commission’s 6th Framework
Programme is co-funding a research project called the BioSec. This project was started in 2003 with the purpose to consolidate and progress current research on biometric technology as well as to consider operational and user centered concerns. It recognizes the importance of usability, acceptance, data protection and business cases, but sees biometrics as key technology for ensuring security of personal data.55
There are also directives that give general protection on the use of personal data. One of the main documents is the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data from 1981, which states that the freedom of information should be supported regardless of frontiers. There is also the Data Protection Directive that focuses on accuracy, relevance and lawfulness in obtainment and processing of personal data. In 1995 the EU, with its then fifteen states, approved the European Data Protection Directive that guaranteed all citizens in the European Union the right to personal data protection. Hereafter, personal data, from medical records, employment data, credit files etc. was to be protected from unauthorized use anywhere in the world. Starting in 1998, it gave authority to pass judgments on privacy protection with the ability to stop transfers of the EU citizen’s data to countries where the same protection was not guaranteed.56 The 53 Part One: National ID-Europe. 2005, p. 11
54 Biometrics and secure travel documents. 2005, p. 6 55 Sanchez, Orestez. 2005, p. 9
fundamental right to data privacy became enshrined in the EU Charter of Fundamental Rights in 2000, and then integrated into the European Constitution in June 2004.57 However, it is admitted that the biometric technology is outsipping the existing legislation. Therefore, besides the already mentioned BioSec project, there is also the European BITE project (Biometric Identification Technology Ethics) coordinated by the CSSC (Centre for Science Society and Citizenship) under the Italian Ministry of Education, University and Research. This project is set up to examine the ethical issues and implications of the biometric techniques and raise public debate. The project has already expressed concern about the technology and the difficulties some groups, such as immigrants, might have in proving their identities.58
3.2 Summary
The current EU directives on data protection are recognized as inadequate protection tools for the implications of the biometric technology. It is important to stress that the national legislation has not been examined or the differences in coverage. Nonetheless, it is the EU that sets the standards for the biometrics within its regional entities, and should be the one that provides satisfactory safeguards for the EU citizens as well as for non-citizens that will be affected by the new policies.
The number of biometric devices in use in Europe has increased from 8,550 in 1996 to more than 150,000 in 2004 and the biometric industries are expected to more than triple in the next two years. The biometric seems to be heading towards a dramatic growth in the next few years, but public discussion of their benefits and drawbacks has been lamentably lacking.59 It is usually so that once the law is passed the public debate ends here in Europe. Since the public was mute even before the approval of biometrics occurred, it certainly does not seem that thorough discussions on the rights of people and obligations of the state can be expected to burst out subsequently to its implementation.
Studies have actually shown that there is a high level of approval of biometrics among Europeans today. The concerns the citizens have deal mainly with whether or not this technology will be physically harmful or unhygienic. On the other hand, the studies show that the trust is limited and that specific knowledge about the biometric technology is almost non existent.60 Even though the trust is limited, the lack of public struggle to ensure the protection of its rights points otherwise. There is a trust in regulators otherwise there would be a greater 57 Ibid. p. 2
58 Biometric industry debates ethics. 2005, p. 12 59 Prepare to be scanned. 2003, p. 7
effort from the civil society to enlighten the public and control the current political development. The lack of specific knowledge shows also that there is a lack of in depth public debate on the national level. This indicates that the decisions made on the central EU level do not reach or involve the public to the same extent as the ones made on the national level. This is what the anti-EU activists expressed early on to be one of their main concerns. The trust in the legal systems and democratic regimes has contributed to a deficit in public scepticism and scrutiny that is healthy for societies. It is exactly these structures that allow the states to violate the rights of people.
In the discussions on the implementation of biometrics the main reason for introducing its implementation was claimed to be the international demands on state control over identification and means of identification of individuals. For the state to enforce order it must hold monopoly over the legitimate crossing of borders by people i.e. by issuing secure travel document.
Whether or not the biometrics were on the agenda before the attacks on the World Trade Centre in New York on September 11, 2001, it was after the attacks that the biometric technologies became the cornerstone of the post September 11 security measures.61 In the same manner as the US, the EU is now also seeking to improve the security of travel documents in the fight against terrorism, organized crime and illegal immigration.62 The next chapter will examine and explore the causes for the implementation of biometrics in the EU.
61 Bigo, Didier and Elspeth Guild. 2005, p. 210 62 Biometrics and secure travel documents. 2005, p. 6
4. The Justifications for the Implementation of Biometrics
This chapter is to consider the stated motives behind the implementation of biometrics, i.e. to investigate the context in which the decisions on implementation of biometric technology have taken place. The main reason that has been promulgated from the side of the governments for implementation of the biometrics is to make travel documents and borders more secure. When it comes to borders and border control, it almost always refers to questions of migration, terrorism and security.63 The idea is that by controlling borders, the threat of infiltration of terrorist cells and irregular immigration will be controlled as well. These two security issues are seen as the driving forces behind the large-scale implementations and in the following subchapters their role will be examined and presented as far as their relevance for the aim of this paper goes. The task of this chapter is to display the reasons that sustain the idea of implementation of biometrics and to illuminate the context that has made it possible for biometrics to become accepted as a mean of control and surveillance in the field of migration and movement as well as in some spheres of professional and private sectors.
One exception that I will make in the dismantlement of the motives behind the implementation of biometrics concerns general security in the Information and Communication Technologies (ICTs). Since this issue is quite far from the field of IMER, I will only give a brief introduction of its domain and relevance to the implementation of biometrics. The key importance of this field lays in the user authentication, as an issue that it growing more urgent in our globalized societies. The potential areas for application of biometrics identification systems include bank automatic machines, protected access to premises or assets, law enforcement, government intelligence, entitlement verification, entry systems to buildings, access to computer systems, birth certificates, licences etc.64
In the networked Information Society the physical identity is increasingly being replaced or supplemented by its digital equivalent.65 There is a belief that the application of biometrics will enhance information security and combat all kinds of fraud, including social security fraud. Even though the cost of biometric documents is likely to override the cost of the fraud and outweigh the savings from prevented fraud, it does not appear to be able to shake the determination to enhance and further the performance of biometrics in the field of IT. 66
63 Bigo, Didier and Elspeth Guild. 2005, p. 215
64 European Convention on Security and Detection, 16-18 May 1995, p. 244
65 Biometrics at the Frontiers: Assessing the impact on Society. Published: 2005-06-01 66 Biometric technology under fire. EurActive. Published 17 June 2005
The implementation of biometrics in Information and Communication Technologies is highly relevant to the concerns related to privacy protection and therefore to the aim of this paper. I already have, mainly in the second chapter, and will continue to incorporate issues of security and ICT throughout this paper. The reason for excluding further elaboration is because this field deals mainly with commercial and public services sector and is therefore less important to my perspective than the two official motives presented by governments for the current implementation of biometrics in travel documents.
The causes of the emerging implementation of biometrics that will be looked at fit into the field of IMER. The paper will investigate the impact of the event on 9/11 with the intention to illuminate the correlation between the event and the development of biometrics. The other question is the securitization of migration. Since these causes are interrelated they will both be presented in the following subchapters.
4.1 War on Terror
International terrorism is, due to the cross border dimensions, a subject of international migration.67 It touches a number of matters directly affecting migration policy, including: border integrity, national security, integration, ethnic/multicultural affairs and citizenship.68 According to the International Organization for Migration terrorist activities have, just as goods, capital and services, a supra-national dynamics beyond the reach of many national law enforcement agencies. The definition of terrorism according to International Migration Law is “any act intended to cause death or serious bodily injury to a civilian, or any other person not taking an active part in the hostilities in a situation of armed conflict, when the purpose of such act, by its nature and context, is to intimidate population, or to compel a government or an international organization to do or abstain from doing an act”.69 Migration policies are thus seen as a regulatory toolkit in regard to who comes in and out of a country, and therefore can act against international terrorism. The standpoint of the IOM is that while immigration policies may not be the most effective tools for countering terrorism, they are important in addressing international terrorism, especially in applying better law enforcement and intelligence.70 The organization stresses the need for appropriate systems for information sharing and deployment of biometrics as increasing certainty in the identification of the individual.
67 International Terrorism and Migration. 2003, p. 2 68 Ibid. p. 3
69 Glossary on Migration. 2004. International Migration Law. 70 International Terrorism and Migration. 2003, p. 3
