Iris Recognition Immigration Systems

1. Iris Recognition Immigration Systems • A Presentation by: Quad KingŠ • Management Information Systems • The University of Nottingham • March 26, 2012

2. Is Biometrics the Future or Now?

3. Presentation Outline • Unique approach - Recent UK case study on Iris Recognition Immigration Systems • Analyze the IRIS project using different aspects of MIS theory • Consider multiple topics of IT Project failure within the module • Developed our project failure framework for IRIS • Comparisons with similar biometric projects • The future of border control in the UK

4. What is IRIS? • Iris Recognition Immigration System (IRIS) is an initiative to provide automated clearance through UK immigration for certain frequent travelers. • It works by photographing a registered passenger's iris patterns and storing the information in a database together with their passport details • IRIS relies on biometric technology to authenticateidentity and is part of the e-borders initiative of the UK Government.

5. Testing Phase of IRIS • Trial run began in 2002 of the EyeTicketJetStreamsystem • The trial allowed a total of 2,000 frequent travellers from North American to London Heathrow Airport to enrol their IrisCodes and thereby to bypass Immigration control upon arrival, passing instead through an automated iris recognition gate. • The trial was deemed fully successful and led eventually to a large-scale system deployed by the UK Home Office, called IRIS centralized database of enrolled IrisCodes.

6. Without “C’ing” a ‘Q’??

7. Launch of IRIS • When the then immigration minister, Des Browne, unveiled IRIS in 2004, he claimed it would provide a ‘watertight’ check of identities as well as cutting queues • It was initially targeted frequent flyers - resident in the UK who regularly travel here and wanted to avoid lengthy queues. • They had to undergo a free 15-minute registration to record the unique pattern of their iris every two years. • The Iris system is understood to have cost a total of £4million to run, on top of its development price of £4.9million. • The contract was given to a French firm, Sagem.

8. ..Politics has ruined my good looks….  … Labour Home Secretary Charles Clarke tries out one of the new scanners in 2005 as they were hailed by Ministers as a key weapon in the fight against terrorism and fraud.

9. Where is IRIS? • Enrolment takes place in the airport departure lounge where an Immigration Officer assesses eligibility and enrolls qualifying persons. Those who qualify to participate in the scheme have both their eyes photographed in order to capture their iris patterns. This data is then stored securely alongside their personal details. • As of June 2010, IRIS wasavailable at: • Birmingham Terminal 1 • Manchester Terminals 1 and 2 • Gatwick Terminals North and South • Heathrow Terminals 1, 2, 3, 4 and 5.

10. Advantages of IRIS • Method of authentication - Uses Morphogenesis (at 7th months) giving the uniqueness of the iris • Randomness in irises - very difficult to forge • Not very intrusive - no direct contact between the subject and the camera technology • Non-invasive - does not use any laser technology (simple video technology) • Easily enrolling people with glasses or contact lenses • Scalability and speed • No need for other forms of I.D • ‘Accurateness’ - error rates being very low, highly reliable system

11. Accuracy of IRIS (Daugman, 2004)

12. Disadvantages of IRIS • Very small organ to scan from a distance - moving target, eyelid and eyelashes can be obscured • Poses challenges to individuals: blind or have cataracts • Needs correct amount of illumination for accurate image • Moreover: problem with reflective surfaces • Only monochrome format - the limitations of greyscale difficult to distinguish the darker iris colourations • Cooperation from subjects to enrol in the system • Inadequate training of users at the initial enrolment period will cause problems • Frustrated users will not help make the system any easier to use – “Communication plays major part in successful systems” • System, power, network and software failures • Additional pressure database is properly secured

14. 16th February 2012 • “Iris eye scanners at two airports scrapped” Daily Mirror • “UK Border Agency puts multimillion-pound system under review after Manchester and Birmingham airports scrap the technology” Guardian • “Eye scanners at England airports turned off” BBC News • “£9million down the drain as airports SCRAP iris passport scanners which were meant to speed up queues... because they are SLOWER than manual checks” Daily Mail • “Hailed as the way of cutting immigration queues at airports the Iris machines have been a source of frustration for passengers for years” Daily Telegraph

15. Why do IT projects fail?

16. Causes of IT Project Failures • POOR DEVELOPMENT PRACTICES- such as poor testing of program, making incorrect assumptions with regard to system requirements • END USER OR ENTITY PROBLEMS- These are failures caused primarily by errors on the part of either the end user or the entity that are using requesting the system. • IMPLEMENTATION OR HARDWARE ERRORS- caused by hardware faults, for example, damaged hardware or badly designed hardware • A STRICT TESTING POLICY FOR THE MODLIFIED SOFTWARE- In a report on the Ballista project undertaken at Carnegie Mellon University it is reported that “more than half of software defects and system failures may be attributed to problems with exception handling.” (Perry, 1989)

17. Causes of IT Project Failures • INFREQUENT CONSULTATION BETWEEN RELEVANT PARTIES AND THE SYSTEM - the open interchange of information encourages people to highlight any problem areas with which they are concerned • MANAGEMENT OF THE IMPLEMENTATION- Costs?Time?Technical shortfalls?Failure to obtain anticipated benefits? • On average, private sector projects are underestimated by one-half in terms of budget and time required to deliver the complete system promised in the system plan (Dowcro, 2002) • USER INVOLVEMENT** • PROJECT ESCALATION** • STRATEGIC ALLIGNMENT** • POLITICAL INFLUENCE**

18. USER INVOLVEMENT “Computerized systems are more likely to have problems if they are ambitious and complex, and if they fail to engage their users or understand their needs.” Shaw et al. (2009)

19. User involvement • POOR USER INTERFACE - A poor user interface may cause significant problems for users of the system and thus greatly increase the likelihood of system failure • INADEQUATE USER TRAINING/ERROR-training is one of the factors highlighted by (Choe, 1996) which will reduce chaos in implementing computer systems • END USER OR ENTITY PROBLEMS- These are failures caused primarily by errors on either the end user or the entity that are using the system, such as: • Providing incorrect specification for the system, • Not providing training for the end user.

20. Lack of User Involvement - IRIS • As the Iris eye scanner has a poor interfaceand the lack of training to end user, many travellers used the scannersincorrectly • Due to improper signs and lack of awareness of IRIS, travellers not registered for IRIS would sometime queue up for the eye scanners • Some staff were not properly trained, therefore could not show travellers how to use the eye scanners and other staff were frustrated from at having to repeat instructions

21. What is Project Escalation? • “The continued commitment of resources in face of negative information” (Keil, 1995) • Study found that 35% projects not abandoned until implementation stage of life cycle (Ewusi-mensah & Przasnyski, ’91) • Managers are doing as poor job of terminating projects which are likely to fail • Did IRIS experience project escalation?

22. Factors of Project Escalation - IRIS • Project Factors – IRIS was prone to escalation when large potential payoff – high potential time & cost savings. • Psychological Factors - IRIS managers convince themselves things don’t look that bad - investment increased (emotion, over-attachmentcausing negative feedback to be discounted, impulse to continue at all costs) • Social Factors – Social norms – other airports have been successful • Organizational Factors – Strong political influence surrounding project launch – (Once project commenced head of UKBA thought there was no turning back so it doesn’t look bad.)

23. Political Influence • “Political decision makers tend to believe that ICT is the ideal solution to any policy problem” (Leydesdorff, 2007). • A minister who takes decisions without seeking adequate advice runs the risk that the project becomes unrealistic from the start. • The political environment is highly dynamic. Political changes with considerable consequences for the project could lead to a reconsideration of the project. IRIS was introduced by Labour and closed down by the Conservatives. • Also, it is not uncommon for a project deadline to be the outcome of a political debate or the statement of an ambition instead of a realistic planning result.

24. Strategic Alignment What is Alignment? • “Applying IT in an appropriate and timely way and in harmony with business strategies, goals and needs.” (Luftman & Brier, 1999) • Why is Alignment of an IT project important? • The outcome of a project is directly related to alignment. Even a good IT systemmay not be beneficial to an organisation if it is misalignedwith business goals and needs • What happens when IT Projects are misaligned? • It leads to the IT project failing • Health Secretary Andrew Lansley : "Labour's IT programme let down the NHS and wasted taxpayers' money by imposing a top-down IT system on the local NHS, which didn't fit their needs.”

25. Strategic Alignment - IRIS • One of the IRIS goals was reduce queues in immigration, allowing travellers to pass border control quicker and safer – but for many travellers this wasn’t true as it took longer than manual checks • Did the project link with other departments? (i.e. lack of advertising) – The system required registration, but without advertising this isimpossible • Did they look at the long-term alignment of the project in regards to costs? - IRIS was very expensive to run, yet was free to register

29. Case Study: Netherlands Iris Recognition Scanner at Schiphol Airport (Amsterdam, NL)

30. Case Study: Netherlands • Privium is the name of the exclusive programme for frequent and/or business travellers who wish to use its fast and safe automated border passage at Amsterdam’s Schiphol Airport, by means of a biometric pass that employs iris recognition • According to Privium, border passage with iris scan can take between 10 and 15 seconds. • There are currently around 50,000 members • Unlike the UK IRIS system, membership to Privium requires yearly subscription fee • Basic membership costs 119 Euros per Year • The Biometric data of your Iris is stored on a Privium membership card rather than a central database.

31. Case Study: UAE Travellers are screened against a watch-list of expellees, or persons deemed to be a security risk, before being allowed to enter the Emirates

32. Case Study: UAE • Iris recognition border-crossing in the UAE is the largest deployment of iris recognition today. • Known as the Expellee Tracking and Border Security Iris System • Verification - the purpose and objectives of iris deployment is entirely different to the British IRIS program and the Dutch Privium. • As the UAE has around 5.4 million residents, which about 85% are foreign nationals on work permits. • This means border-crossing volume of migrant workers whose homeland roots are elsewhere is very high (some 12,000 per day). Therefore, their security concerns and priorities in regards to border security are very different to other nations. • Along with a manual passport check, iris recognition is used so that arriving passengers may be screened against a watch-list database recording the irises of persons deemed dangerous, or of expellees excluded from entering a country. • Today this iris watch-list contains 1.2 million Iris- Codes from persons of 156 nationalities. • All travellers seeking visa entry into the UAE via any port have their iris images acquired by cameras • Tens of thousands of persons have been caught trying to re-enter the UAE under false identities, who are turned away but who often make repeated attempts, and the UAE Ministry of Interior hails the system as a huge success

33. Case Study: Success Factors Netherlands UAE • Project strategically aligned with its objectives • Top Management Support • User Involvement • Project strategically aligned with its objectives • Membership Fees • Top Management Support • User Involvement

34. IRIS Replacement: ePassport Gates • ePassport gates introduced in 2009 has recently been announced as the successor of IRIS • Some Airports already have e-gates in place where people with new biometric chip passports from the EEA can use – this does not require registration – people with the passports can use these gates • The gates are used by scannning the passport and looking into a camera and facial recognition technology is used to compare the person to the picture in the passport chip • New registrations and renewals for IRIS have been halted at several airports – partly, at least, because of staff shortages – and the government acknowledges that its future is under review. The uncertainty comes amid a political scandal over the loosening of border checks at airports over the busy summer period to reduce long waiting times (Warrel& Jacobs, 2011). • The government says this is part of “a broader strategy of automation at the border” which has seen resources shifted towards machines which automatically read the new generation of biometric passports. • Plans for e-gates to allow non-EU nationals to register for the gates are also in place, were hoping to bring it out soon and before the Olympics- But the plans have been delayed

35. Conclusions • The systemno longer fits border-automation strategy in the UK  moving forward. • IRIS was replaced to accommodate EU e-Passports holders, whose passports hold an electronic copy of their face photographic. • As innovative as the technology was in 2004, it is now woefully out-of-date. Iris technology has moved on leaps-and-bounds in the 8 years since • The initial investment undoubtedly has long since been written off, and the technology needs a refresh. • The initial deployment was meant to be limited, and the contract has undoubtedly been extended numerous times. A complete and extensive technology refresh (as is required) • Management Failure? The business model was never well thought out. It is completely funded by the UK government and can be used completely free of charge.

36. Thank you

37. References • Leydesdorff (2007) “Why government ICT projects run into problems”. EefjeLeydesdorff and Thomas Wijsman. The Netherlands Court of Audit. p.16. • Daily Mail (2012) “£9million iris recognition scheme introduced to slash queues at airports is scrapped”. Mail Online. 17th February 2012. • Jarvis (2007) “Personal Identification by the Iris of the Eye”. Angela Jarvis. Forensic-Evidence.com. • Ross (2010) “IRIS recognition: The Path Forward”. Arun Ross. West Virginia University. IEEE Xplore. Published by the IEEE Computer Society. • Daugman (2004) “IRIS Recognition Border-Crossing System in the UAE”. John Daugman. University of Cambridge. Reproduced from International Airport Review, Issue 2, 2004. • Warrel & Jacobs (2011)“Airport IRIS scanning system is scaled back”. Helen Warrell and Rose Jacobs. Ft.com. November 15th 2011. • BBC (2006) “Heathrow eye scan checks extended”. Accessed from http://news.bbc.co.uk/1/hi/england/london/4792206.stm as at 26th February 2012.

38. References • Perry (1989)“Handbook of Diagnosing and Solving Computer Problems”, William Perry. TAB Professional and Reference Books1989. pp.105 – 106. • Travis (1999). “Asylum system hit by IT black hole”. Alan Travis. The Guardian. November 1st 1999, pp.7 • Dowcro(2002). “Why System Fail?”. Ben Dowcro. Accessed from: http://www.benmeadowcroft.com/reports/systemfailure as at 19th March 2012. • Espiner(2012) “UK airports to drop £9.1m eye-scanning tech”. Tom Espiner. Zdnet UK. Published 17th February 2012. • Sasse(2007) “Red-Eye Blink, Bendy Shuffle, and the Yuck Factor: A User Experience of Biometric Airport Systems”. M. ANGELA SASSE University College London. Published by the IEEE Computer Society. • A.K. Jain, A. Ross, and S. Pankanti (2006), “Biometrics: A Tool for Information Security,” IEEE Trans. Information Forensics and Security, vol. 1, June 2006, pp. 125–143. • Keil, M., (1995) “Pulling the plug: Software project Management and the Problem of Project Esculation,”, MIS Quaterly.

39. References • Shaw, I., Bell, M., Sinclair, I., Sloper, P., Mitchell, W., Dyson, Rafferty, J. (2009). An exemplary scheme? An evaluation of the integrated children’s system. British Journal of Social Work, 39, 613-626. • Ewusimensah, K., & Przasnyski, Z. H. (1991), “On information systems project abandonment - An exploratory study of organizational practices” MIS Quarterly, 15(1), 67-6.8 • Luftman, J and Brier, T. (1999). “Achieving and Sustaining Business-IT Alignment” California Management Review. Vol.42(1), pp.109-122 • Choe, J.M. The relationships among performance of accounting information systems, influence factors, and evolution level of information systems. Journal of Management Information Systems, 12, 4 (Spring 1996), 215–239