Iris and Retinal Scans

About Iris and Retinal Scans

Iris and retinal scanning are both “ocular-based” biometric technologies, meaning they use characteristics of the eye to identify individuals. The two technologies are slightly different. The iris is a thin, circular structure on the exterior of the eye that controls the amount of light that reaches the retina and is responsible for controlling the color and exterior appearance of the eye (M2SYS Technologies). Iris scans are captured using a digital photography. The retina however is a structure of neural cells at the back of the eye that receives light from the iris in the form of an image (e.g. see fig. 1). Retinal scans are capture the pattern of the retinal blood vessels using infrared light. Iris scans are much more frequently used than retinal scans and are today one of the most accurate and widely used biometric technologies.

Fig. 1. Diagram of a mammalian eye from "Mammalian Eye." Wikipedia. Wikimedia Foundation, 30 July 2014. Web. 24 Nov. 2014.

Technical Details

The uniqueness of both iris and retinal blood vessels patterns make them excellent candidates for use as biometric identifiers. They differ even among identical twins. Though it has been developed more recently than other biometrics, iris recognition is considered to be the most accurate biometric technology on the market (Healthcare Scene). Iris scanning provides “astronomic confidence levels,” allowing “huge databases to be searched exhaustively, without diluting the odds to unacceptable levels as a consequence of allowing so many opportunities for [a false match]" (Jain, Bolle, and Pankanti 112).

Iris scans use a high resolution camera including near-infrared light highlights to capture a photograph of the iris pattern. Mathematical algorithms are then fitted to the picture to determine the identity of an individual (MacRumors). Iris scans are typically conducted from three to ten inches away (M2SYS Technologies). Just behind the retina there is a mat of vessels called the choroidal vasculature. The term “retinal scan” is a bit of a misnomer, as the technology actually uses infrared light to record the blood vessel patterns of the choroidal vasculature (Jain, Bolle, and Pankanti 125). Retinal scanners use a harmless laser to scan the vessels in the back of the eye (Healthcare Scene). In order to use a retinal scanner users must place their eye into a microscope-like device, as eyes must be very close for patterns to be read. Iris scanners are considered to be less invasive than retinal scans, and are therefore much more frequently used.

Advancements in technology are beginning to counter some of the initial constraints to using iris recognition technology. Cameras can implement several features to ensure that a real iris is being scanned and not a photograph, video, or other copy. Some scanners release a bright burst of light and track pupil to iris diameter ratio to ensure pupil dilation. Others invoke the less invasive method of tracking eyelid movements (Jain, Bolle, and Pankanti 112). The independent research center SRI International even claims to have invented Iris on the Move® Biometric Identification technology that can read irises at a distance and while subjects are moving (SRI International).

Applications

Iris scans are one of the fastest growing biometric technologies. They are used as a form of government identification in Mexico, Argentina, and India (Robinson). Mexico became the first country to use iris scans on ID cards in 2011, enrolling over 28 million minors in a two-year pilot program. They extended mandatory registration to adults in 2013 (The Telegraph). India is in the process of collecting biometric information on each of their 1.2 billion citizens including iris and fingerprint scans and facial recognition technology. Currently registering biometric information is not mandatory, however the program has been heavily criticized for mounting pressure on India’s poor (Rengamani 110, Electronic Frontier Foundation, TechPresident).

There are also broad uses for iris recognition technology in the United States. The Department of Defense has used iris scans for over a decade in Iraq and Afghanistan to detect known terrorists. In addition, the Federal Bureau of Investigation (FBI) is currently working on incrementally replacing their Integrated Automated Fingerprint Identification System (IAFIS) with a new Next Generation Identification (NGI) system which will include iris scans. Currently, the IAFIS is the largest biometric database in the world. Fingerprints are entered into the database through criminal arrests or employment background checks and the US-VISIT program. The database is used to identify individuals in criminal investigations (FBI, Wikipedia). The Next Generation Identification system will include a database of iris data

Increasingly, iris recognition technology is also increasingly being used for commercial applications. At the Amsterdam Airport in Schiphol, travelers can opt for an iris scan as an alternative to carrying a passport (e.g. see fig. 2).

Fig. 2: Clover, Juli. "Iris Scanning: The Newest Addition to Apple's Biometric Roadmap?" MacRumors. 21 Jan. 2014. Web. 24 Nov. 2014.

After acquiring AuthenTec in 2012 and utilizing fingerprint scanning technology in the most recent versions on the iPhone, Apple has continued to hire employees with biometrics expertise. There is talk that future versions of the iPhone will include retinal scanning technology in the front-facing camera of the phone (MacRumors). Other companies are similarly interested. Samsung Vice President Lee Young-hee commented on iris recognition technology in a recent interview, “Many people are fanatical about iris recognition technology. We are studying the possibility but can’t really say whether we will have it or not on the S5” (MacRumors).

Ethical Evaluation

Deontology

When evaluated from a deontological perspective, iris recognition technology raises several ethical issues. The first of these is privacy. Indexical data such as a password, social security number, or credit card number can be changed if accessed by an unauthorized person. In contrast, iris and retinal patterns are permanent and cannot reasonably be altered without extensive surgery. Due to the permanent nature of iris and retinal patterns, identity theft is more of a concern. The risk of identity theft increases with the storage of iris data in large databases (Alterman 144, Electronic Frontier Foundation). Iris technology may also lead to social exclusion. Some studies have shown that iris recognition technology is difficult for certain groups to use (Wickins 48). Women wearing heavy eye makeup or people with facial disfigurement and blindness may not be able to use the technology (Wickins 49).

Utilitarianism

Support for biometrics increased significantly after the events on September 11, 2011 (Alterman 148). The majority of arguments in favor of biometric identification such as the FBI’s Next Generation Identification system state that it is worth it to compromise the convenience of the individual for national security. Iris recognition technology helps to increase national security as it is a more efficient and reliable means of identification than systems currently in place. With advent of technologies such as SRI International’s distance iris reader Iris on the Move, there is the potential for picking known criminals and terrorists out of a crowd with a high level of accuracy.

From a utilitarian standpoint, the ends of biometrics justify the means. It is worth sacrificing the rights of the individual for the collective.

Policy Recommendations

We believe a happy medium can be found between using iris scans to increase security and compromising individual freedoms. Thus iris scans may be used for identification but not authentication. It is appropriate for iris scans to be collected and used for identification of criminals such as proposed in the FBI's Next Generation Identification system, an extension of our current use for fingerprinting. For sensitive matters however, such as use at customs or at the DMV, citizens should be required to present a photo identification or passport in addition to the use of an iris scan. Iris recognition technology should never be used independently as a means of identification.

To further protect privacy, all commercial uses of iris identification technology must be accompanied by a comprehensive Terms of Use policy. Additionally, companies may not provide any economic incentive for enrollment in iris recognition technology. In order to prevent situations where users may make a hasty decision to enroll in iris recognition technology without first considering the privacy implications, we also recommend that there be a wait time between enrollment and start of use.

Iris recognition technology should be used over retinal scans whenever possible, as retinal scans are significantly more invasive.