Friction and emerging threats: two items to consider when implementing multifactor authentication

For my long-time readers, here’s a quiz. Read the four statements below and take a guess as to which one of these statements best reflects my views.

  1. With recent accuracy improvements, facial identification is the only identification method that you will ever need in the future.
  2. Possession of a driver’s license is sufficient to prove identity.
  3. Fingerprints are the tried and true authentication method; you don’t need anything else.
  4. Passwords are dead.

Readers, this was a trick question. I don’t agree with ANY of these statements. It is possible to subvert facial identification methods. Your twin can steal your driver’s license. Fingerprints can be subverted also. And passwords have their place.

If you’ve read my writings for any length of time, you know that I believe that any single authentication factor is not a reliable method of authenticating someone. Multifactor authentication, in which you use more than one of the five authentication factors, is a much stronger method. It’s possible to spoof any single authentication factor (a gummi fingerprint, a fake driver’s license, etc.), but it’s much harder to spoof multiple factors.

No, they don’t have ridges. By Thomas Rosenau – Own work, CC BY-SA 2.5, https://commons.wikimedia.org/w/index.php?curid=685011

Please note that I am referring to multiple FACTORS, not multiple TYPES OF BIOMETRICS (for example, authenticating finger and face and declaring victory). All biometrics fit within the “something you are” category, and it’s much better to combine this factor with one or more of the other four: something you know, something you have, something you do, and somewhere you are. Or perhaps use two factors other than biometrics. The important thing is that you use multiple factors.

What of the vendor that only offers one type of biometric authentication? Or the vendor that only offers biometric authentication? Or the vendor that only processes secure documents? Or the one with really strong password protection schemes? Well, in my humble opinion these vendors need to partner with other vendors who support other authentication factors, to ensure delivery of a robust solution.

Julie Pattison-Gordon made many of these points in a recent GovTech article, “Cyber Refresher: Understanding Multifactor Authentication.” But she made two additional points that are worth mentioning.

Friction and authentication

The first point that Pattison-Gordon makes is the following:

Agencies may need to consider how their selection of authentication methods creates or avoids friction for employees.

Friction, in which a task becomes hard to perform, is bad.

Not sure how Jack feels now that the Lakers are, um, subpar. By May be found at the following website: http://www.impawards.com/2003/anger_management.html, Fair use, https://en.wikipedia.org/w/index.php?curid=11893883

Some authentication methods have, or can have, more friction than others. For example, some password implementations require use of characters from the Roman, Greek, and Cyrillic alphabets and require you to change your password daily. (I exaggerate only slightly.) Older iris readers required you to put your head directly against the reader, like if you were at an opthamologist’s office. Even today, most fingerprint readers require you to touch your finger against a platen. (There are exceptions.)

But why worry about friction? After all, if someone’s required to perform some type of authentication, they’re going to do it regardless of how hard it is.

Oh no they’re not:

Speaking during a panel last month, Delaware Chief Security Officer Solomon Adote said that workers who find MFA processes too cumbersome may adopt unsafe workarounds, such as storing official files on personal devices to let them skip login procedures entirely.

This is worse than an abandoned shopping cart, since it’s the abandonment of an entire security infrastructure. When security is too cumbersome, the result is little or no security at all.

I feel safe now. By IMP Awards, Fair use, https://en.wikipedia.org/w/index.php?curid=42298113

It is possible to improve all authentication methods to reduce friction. Strong yet easy passwords that you don’t have to change all the time. “On the move” capture of all sorts of biometrics, including fingerprints, faces, and irises. The ability to read information on secure documents without sliding them through a card reader (yet incorporating protections against unauthorized reading of the data).

Trust me – frictionless will make people happier and will cause them to use your security methods without objection.

Emerging threats and authentication

Pattison-Gordon makes a second point:

Organizations must also weigh the cyber threats facing each type of authentication, as malicious actors continue evolving their strategies.

No authentication method is foolproof, and every authentication method attracts one or more threats. I’ve mentioned some in passing in this post, such as “gummi fingerprints” in which someone creates a fake fingerprint with the ridge detail from a true fingerprint. Pattison-Gordon mentions another threat, SIM swapping.

There are ways to deal with these two threats. For example, if a gummi fingerprint is literally a piece of non-organic material, there are various methods of liveness detection (tempreature, heartbeat detection, skin features) that can identify the fingerprint as fake.

However, this does not solve the problem, since some day some fraudster will create a fake fingerprint that appears to have human skin, a temperature, a detectable heartbeat, and everything else that a real fingerprint will have.

Security is a constant war between the fraudsters who develop a hack, the cybersecurity folks who develop a block to the hack, and the fraudsters that develop a new hack that avoids the block to the previous hack. No authentication method is foolproof.

This is one of the benefits of multifactor authentication. When this is used, then the fraudster needs to hack something you are AND something you know AND something you have AND something you do AND somewhere you are. MFA hacking is not impossible, but it is much, much more difficult than hacking a single factor.

And you also have to keep up with the latest hacks and continue to research. Don’t quit researching an authentication method just because it seems great now.

(A couple of you may know why I said that.)

Retabulating the work that Bredemarket has done for clients (as of February 16, 2022)

My biometric/identity collateral wasn’t the only thing that I updated yesterday.

As part of my preparation for yesterday evening’s Ontario IDEA Exchange meeting, I took the time to update my “local” brochure. (Because local is important: see the first of my three goals for 2022.) This brochure includes a section that discusses the types and numbers of pieces that I have prepared for clients, including the number of case studies, the number of RFx responses, and so forth.

Those numbers hadn’t been updated since last September.

Before going to the meeting, I wanted to make sure my “local” brochure had the latest numbers.

I’ll go ahead and share them with you. This covers the projects that Bredemarket has completed for clients over the last 18 months, as of February 16, 2022:

  • Fourteen (14) case studies
  • Eight (8) articles (blog posts)
  • Three (3) service offering descriptions
  • Three (3) white papers
  • Nine (9) RFx responses
  • Four (4) sole source responses
  • Six (6) proposal templates
  • One (1) technical leave behind
  • Two (2) biometric analyses
Inland Empire B2B Content Services from Bredemarket.

As it turns out, I didn’t hand out my local brochure to anyone at last night’s IDEA Exchange. (It was a small crowd, most of whom I already knew.)

But at least I’ve tabulated the numbers.

Now I just have to update all of my NON local collateral…

Does your biometric/identity firm need proposal or content marketing services?

I really need to update my own website more frequently.

About a year ago, I created a web page and an accompanying brochure entitled “Bredemarket and Identity Firms.” I’ve updated the web page a time or two in the last year, but until a few minutes ago both the web page and the brochure were significantly out of date, and didn’t include some of the projects that I’ve worked on during the past few months.

You can view the updated web page or download the updated brochure (at the end of this post) if you like, but I’ll create a frictionless experience for you by reproducing (repurposing) the list of ALL of Bredemarket’s biometric/identity projects as of today. (And there are more projects in work that I haven’t listed yet.)

By Zhe Wang, Paul C. Quinn, James W. Tanaka, Xiaoyang Yu, Yu-Hao P. Sun, Jiangang Liu, Olivier Pascalis, Liezhong Ge and Kang Lee – https://www.frontiersin.org/articles/10.3389/fpsyg.2015.00559/full, CC BY 4.0, https://commons.wikimedia.org/w/index.php?curid=96233011

If I can perform similar services for your biometric/identity firm, contact me.

How can Bredemarket help identity firms?

Here are a few examples of services that I have provided to identity firms under the Bredemarket banner as a biometric proposal writing expert, a biometric content marketing expert, an identity content marketing expert (biometrics alone is not enough), and an expert in other areas of identity/biometric writing.

  • Proposal Writing: Created five proposal letter templates to let a biometric firm’s sales staff propose two products to five separate markets. After completing the first three templates, I received this unsolicited testimonial:

“I just wanted to truly say thank you for putting these templates together. I worked on this…last week and it was extremely simple to use and I thought really provided a professional advantage and tool to give the customer….TRULY THANK YOU!”

  • More Proposal Writing: Responded to three Requests for Information (RFIs) for two biometric firms, positioning the firms for future work from government agencies.
  • Even More Proposal Writing: Assisted a biometric firm in responding to multiple Requests for Proposal (RFPs) and sole source letters.
  • And more…: Created a proposal letter template for a biometric firm.
  • And still more…: Created a Microsoft Word-based response library for a biometric firm.
  • Proposal Analyzing: Monitored the social media activity of a biometric firm’s competition and created responsive proposal text to position the firm against its competition.
  • Proposal Editing: Assisted a biometric firm in the final stages of an RFP response, editing its proposal both before and after its Gold Team review.
  • Strategic Marketing: Updated customer counts and technical data for a secure document firm.
  • More Strategic Marketing: Assisted a leading biometric vendor in analyzing its NIST FRVT 1:1 and 1:N results, providing both public information the firm could share with its clients, and private information for the firm’s internal use.
  • Online Marketing: Analyzed a biometric website and its social media channels, looking for broken links, outdated information, synchronization errors, and other problems, and provided a report to the firm upon completion.
  • More Online Marketing: Wrote three service descriptions for a biometric consulting firm.
  • Online Writing: Interviewed customers and wrote case study text for 14 case studies a biometric firm.
  • More Online Writing: Wrote blog posts for multiple biometric firms. After all, I am the identity/biometric blog expert.
Bredemarket and Identity Firms (February 16, 2022)Download

The cost of abandoned shopping carts is measurable

People in the biometric and banking industries like to use the word “frictionless.” It refers to the ability to make tasks such as building access and online purchases as easy as possible. When you make a purchase as hard as possible, it’s referred to as “friction.”

And we’ve all encountered friction online.

By Scooooly – Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=47265558

(Type the TWO words?)

Provided that the transaction is secure, a frictionless transaction is preferable to a friction one. If you introduce too much friction into an operation, then the person trying to access a building or the person trying to complete an online transaction will give up. In the finance world, the online transaction is “abandoned,” sometimes after the potential buyer has already selected what they want to purchase. The end result is referred to in the industry as an abandoned shopping cart.

By Tim Reckmann from Hamm, Deutschland – Einkaufswagen, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=83154898

(And no, I don’t know the German for “abandoned,” but whatever it is, you can pair it with “Einkaufswagen” and come up with a really long description.)

At one point in my corporate career, I was looking at (virtual) abandoned shopping carts, and trying to figure out how digital identity mechanisms could reduce the number of abandoned shopping carts for online transactions. Any reduction would naturally translate to increased sales and increased profits for the online vendor.

Well, at this point in my post-corporate career, I was able to look at abandoned shopping carts from another perspective.

I abandoned a shopping cart this morning.

Not because of a horrendous CAPTCHA.

I abandoned it because the vendor wasn’t there.

Check

When I started Bredemarket in 2020, one of the things that I did was open a business banking account. The process was a little complex because of raging COVID, since I had to submit all of my relevant documents online. (I also looked at THAT issue during my corporate years.)

As I finished setting up the account, my bank provided me with an offer for business checks. The offer was relatively expensive and didn’t include that many checks, but I didn’t care about that because I didn’t need that many checks anyway. In fact, after thinking about it, I decided that I didn’t need ANY checks. My business was just starting, and I couldn’t really afford to throw away money on extravagances such as bank checks.

And I got by for a while, until February 2022. I was considering a particular purchase from a small nonprofit, and I noticed that this small nonprofit didn’t take credit cards, or Zelle, or PayPal, or Venmo. (Or Bitcoin.) This nonprofit accepted payment in…checks.

So I decided that after a year, it’s time that Bredemarket had its own checks like all the cool companies have. I didn’t need that many, but obviously I was going to need one or two or a few.

So I logged in to my bank’s website to order some checks.

Now why would I log into the bank’s website to buy something that I knew was expensive? Again, the frictionless experience. It was worth some money to me to just go directly to my bank and order the expensive item, rather than having to hunt around for some other service and order the less expensive item. After all, my bank had all my information right there, so ordering checks through the bank should be a breeze, right?

Not exactly.

After logging in to my bank account nd searching through several places on the website, I finally found out that I could order checks. Not online on the bank’s own website, but via an 800 number belonging to the bank’s third party check printing partner.

So I called the 800 number…and was disconnected.

So I called the 800 number again.

(For those playing along at home, take a moment and count the number of instances of friction that I have encountered so far in making this purchase that I thought was going to be really really frictionless. There will be more instances as we go along.)

Now telephone customer service centers are wonderful things. (I should know, I just finished a job for a client that included a discussion of a telephone customer service center, and the CSC was a wonderful thing.) While I know of people who despite phone trees, they have the advantage of getting you help as soon as possible. And once you’re routed to the proper department, even if you’re not immediately helped, the phone trees often tell you either how many people are ahead of you in line, or approximately how long it will take before someone helps you. (The REALLY good phone trees take your number and call you back, so you don’t have to sit on hole.)

My bank doesn’t have a good phone tree.

I think I answered one or two simple questions at most, and then learned that all of their representatives were busy. I didn’t learn how many people were ahead of me in line. I didn’t learn how long it would take to answer my call. Instead, I was fed promotional stuff about some streamling TV special of some sort. I didn’t pay attention to the details, because I was thinking to myself:

John, why are you sitting on hold to buy expensive bank checks?

So I abandoned my shopping cart before I even had a chance to put anything into it.

Checkmate

I then went to the website of one of the major warehouse stores (the one that ISN’T based in Arkansas) where I had a personal membership, easily found the link in the business services section where I could order checks online, went to the warehouse store’s check vendor, and (in a fairly frictionless fashion) ordered checks for Bredemarket. The most typing that I did was to input my bank account routing information and account number, and input my warehouse membership number to get the warehouse discount. (My business address is saved in my browser. It’s not a huge security risk to do this.)

I immediately received two emails.

  • One was from the check vendor, with information about my order, including the items ordered, the anticipated delivery date, and a link to track the status of my order. (It’s in production.)
  • The other was from my bank, informing me that an online purchase had just been made from my bank account.

Unfortunately for the bank, it probably doesn’t have the advanced analytics to link that purchase from a check printing company to my unanswered phone call to the bank’s own check printing company a few minutes prior.

Because if the bank was able to put two and two together, it would realize that the money I paid to that check printing company could have gone to the bank’s check printing company instead.

But how to measure?

There’s one interesting wrinkle in the measurement of this abandoned shopping cart.

I never got to the point of receiving a price quote from the bank’s check printer, but from my hazy recollections from 2020, I think that the price that I paid for checks today was roughly half what the bank’s check printer would have charged me. (And I got more checks, but since I probably won’t use them all, that isn’t really a factor.)

So the warehouse’s check printer made a sale of $x, while the bank’s check printer lost a sale of roughly twice that amount, or $2x.

And I have an additional $x in my pocket which I wouldn’t have had if the bank’s check printer had answered its phone before I had second thoughts.

So what am I going to do with that $x?

Well, there’s that nonprofit, I guess…

Why isn’t there a Pharmaceutical Justice League?

In case you missed it, Blake Hall of ID.me recently shared an article by Stewart Baker about “The Flawed Claims About Bias in Facial Recognition.”

As many of you know, there have been many claims about bias in facial recognition, which have even led to the formation of an Algorithmic Justice League.

By Jason Fabok and Alex Sinclair / DC Comics – [1], Fair use, https://en.wikipedia.org/w/index.php?curid=54168863

Whoops, wrong Justice League. But you get the idea. “Gender Shades” and stuff like that, which I’ve written about before.

Back to Hall’s article, which makes a number of excellent points about bias in facial recognition, including the studies performed by NIST (referenced later in this post), but I loved one comparison that Baker wrote about.

So technical improvements may narrow but not entirely eliminate disparities in face recognition. Even if that’s true, however, treating those disparities as a moral issue still leads us astray. To see how, consider pharmaceuticals. The world is full of drugs that work a bit better or worse in men than in women. Those drugs aren’t banned as the evil sexist work of pharma bros. If the gender differential is modest, doctors may simply ignore the difference, or they may recommend a different dose for women. And even when the differential impact is devastating—such as a drug that helps men but causes birth defects when taken by pregnant women—no one wastes time condemning those drugs for their bias. Instead, they’re treated like any other flawed tool, minimizing their risks by using a variety of protocols from prescription requirements to black box warnings. 

From https://www.lawfareblog.com/flawed-claims-about-bias-facial-recognition

As an (tangential) example of this, I recently read an article entitled “To begin addressing racial bias in medicine, start with the skin.” This article does not argue that we should ban dermatology because conditions are more often misdiagnosed in people with darker skin. Instead, the article argues that we should improve dermatology to reduce these biases.

In the same manner, the biometric industry and stakeholder should strive to minimize bias in facial recognition and other biometrics, not ban it. See NIST’s study (NISTIR 8280, PDF) in this regard, referenced in Baker’s article.

In addition to what Baker said, let me again note that when judging the use of facial recognition, it should be compared against the alternatives. While I believe that alternatives should be offered, even passwords, consider that automated facial recognition supported by trained examiner review is much more accurate than witness (mis)identification. I don’t think we want to solely rely on that.

Because falsely imprisoning someone due to non-algorithmic witness misidentification is as bad as kryptonite.

By Apparent scan made by the original uploader User:Kryptoman., Fair use, https://en.wikipedia.org/w/index.php?curid=11736865

Tech5: Updating my contactless fingerprint capture post from October 2021

I’ve worked in the general area of contactless fingerprint capture for years, initially while working for a NIST CRADA partner. While most of the NIST CRADA partners are still pursuing contactless fingerprint technology, there are also new entrants.

In the pre-COVID days, the primary advantage of contactless fingerprint capture was speed. As I noted in an October 2021 post:

Actually this effort launched before that, as there were efforts in 2004 and following years to capture a complete set of fingerprints within 15 seconds; those efforts led, among other things, to the smartphone software we are seeing today.

From https://bredemarket.com/2021/10/04/contactless-fingerprint-scanning-almost-software-at-connectid/

By 2016, several companies had entered into cooperative research and development agreements with NIST to develop contactless fingerprint capture software, either for dedicated devices or for smartphones. Most of those early CRADA participants are still around today, albeit under different names.

Of the CRADA partners, MorphoTrak is now IDEMIA, Diamond Fortress is now Telos ID, Hoyos Labs is now Veridium, AOS is no longer in operation, and 3M’s biometric holdings are now part of Thales. Slide 10 from the NIST presentation posted at https://www.nist.gov/system/files/documents/2016/12/14/iai_2016-nist_contactless_fingerprints-distro-20160811.pdf

I’ve previously written posts about two of these CRADA partners, Telos ID (previously Diamond Fortress) and Sciometrics (the supplier for Integrated Biometrics).

But these aren’t the only players in the contactless fingerprint market. There are always new entrants in a market where there is opportunity.

A month before I wrote my post about Integrated Biometrics/Sciometrics’ SlapShot, a company called Tech5 released its own product.

T5-AirSnap Finger uses a smartphone’s built-in camera to perform finger detection, enhancement, image processing and scaling, generating images that can be transmitted for identity verification or registration within seconds, according to the announcement. The resulting images are suitable for use with standard AFIS solutions, and comparison against legacy datasets…

From https://www.biometricupdate.com/202109/tech5-contactless-fingerprint-biometrics-for-mobile-devices-unveiled

This particular article quoted Tech5 Co-founder/CEO Machiel van der Harst. A subsequent article quoted Tech5 Co-Founder/CTO Rahul Parthe. Both co-founders previously worked for L-1 Identity Solutions (now part of IDEMIA).

Parthe has noted the importance of smartphone-based contactless fingerprint capture:

“We all carry these awesome computers in our hands,” Parthe explains. “It’s a perfectly packaged hardware device that is ideal for any capture technology. Smartphones are powerful compute devices on the edge, with a nice integrated camera with auto-focus and flash. And now phones also come with multiple cameras which can help with better focus and depth estimation. This allows the users to take photos of their fingers and the software takes care of the rest. I’d just like to point out here that we’re talking about using the phone’s camera to capture biometrics and using a smartphone to take the place of a dedicated reader. We’re not talking about the in-built fingerprint acquisition we’re all familiar with on many devices which is the means of accessing the device itself.”

From https://www.biometricupdate.com/202202/contactless-fingerprinting-maturation-allows-the-unification-of-biometric-capture-using-smartphones

I’ve made a similar point before. While dedicated devices may not completely disappear, multi-purpose devices that we already have are the preferable way to go.

For more information about T5-AirSnap Finger, visit this page.

Tech5’s results for NIST’s Proprietary Fingerprint Template (PFT) Evaluation III, possibly using an algorithm similar to that in T5-AirSnap Finger, are detailed here.

About THAT Reuters article

I intentionally chose an obscure title for this post.

I could have entitled the post “Ricardo Montalban.” Just because.

In a more relevant way, I could have entitled the post “Former IDEMIA employee weighs in on Advent’s possible sale of the company.” That would have got some clicks, to be sure.

But it would have misled the reader, because the reader would have gotten the idea that I have some expertise in corporate acquisitions, and an abillity to predict them.

And as past history has shown, I do not have any such expertise.

  • In 2000, I was completely and totally surprised when I learned that Printrak wanted to sell itself to Motorola. I didn’t have a clue that any such thing was going to happen.
  • In 2008, I was reading online late one evening and was completely and totally surprised when I learned that Motorola wanted to sell off half of Printrak to the French company Safran, the Sagem Morpho folks. Yes, Motorola was in trouble, but I didn’t have any idea that we would be sold off.
  • Years later, I was kinda sorta surprised when Safran decided that it wanted to get rid of its entire identity and security business, and was completely and totally surprised when the buyer was an American investment firm that owned Oberthur Technologies.

So my record on really understanding these acquisitions is pretty low.

With that caveat, I’ll go ahead and use a really eye-catching SUBtitle. Better late than never.

Former IDEMIA employee weighs in on Advent’s possible sale of the company

Impressive, isn’t it?

But before proceeding, I should let you know about THAT Reuters article that I referenced in the real post title.

On Friday, Reuters published an exclusive article entitled “Advent gears up for $4.6 bln sale of French biometrics firm IDEMIA – sources.”

So who is Advent?

Advent (actually, Advent International) is the American investment firm that I mentioned earlier. As an investment firm, its purpose in life is to buy businesses, improve them, and sell them for a profit.

Back in 2011, Advent bought Oberthur Technologies with this intent. To that end, Advent announced in 2015 that Oberthur Technologies planned an Initial Public Offering. Within a month, those plans were shelved. Advent determined that an Oberthur IPO wouldn’t do so well.

So Advent began thinking about ways to make Oberthur more attractive.

At the same time, Safran was trying to decide what to do with its identity and security business. The purchase of Printrak was just a blip in Safran’s plans, as it acquired L-1 Identity Solutions (renamed MorphoTrust) and other businesses. But Safran is not an identity and security company. It’s a “de plane” company.

By ABC Television – eBay itemphoto frontphoto back, Public Domain, https://commons.wikimedia.org/w/index.php?curid=20143137

And Safran is also a defense company to protect France and other countries from evil forces.

By TrekCore: [1], Fair use, https://en.wikipedia.org/w/index.php?curid=24107020

The identity part of the business was clearly the odd one out. Heck, rich Corinthian leather would have fit better into the Safran product line.

By dave_7 – originally posted to Flickr as Chrysler Cordoba, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=6890171

OK, I’ll stop now.

Anyway, in the end Advent announced in 2016 that it had entered into an agreement to negotiate the purchase of Safran’s identity and security business. The purchase was completed on May 31, 2017, and Advent combined Oberthur (OT) and the portion of Safran (Morpho) into OT-Morpho, which was quickly renamed IDEMIA.

I was an employee of IDEMIA at the time, and I don’t think I’m spilling any company secrets if I reveal that Advent wanted IDEMIA to do really really well, so that it could make a profit on the two acquisitions. I wasn’t at the highest executive level that was setting the high-level strategy, but I was often working on initiatives to help realize Advent’s profitability goal.

The possibility of an IDEMIA IPO or sale receded somewhat in early 2020. Among other things, COVID adversely affected two of IDEMIA’s core businesses in the United States, TSA PreCheck (nobody was flying) and driver’s licenses (the DMV offices were all closed).

Back to THAT Reuters article

Fast forward to 2022 and Reuters’ exclusive revelations.

Advent International is looking to sell its French biometrics and fingerprint identification firm IDEMIA in a deal worth up to $4.6 billion as it seeks to capitalise on growing demand for cybersecurity assets in Europe, two sources told Reuters.

The U.S. buyout fund is reviewing a series of options to sell IDEMIA, including a possible break-up of the company which was formed in 2016 by combining Safran’s identity and security business with Oberthur Technologies, the sources said.

From https://www.reuters.com/business/exclusive-advent-gears-up-46-bln-sale-french-biometrics-firm-idemia-sources-2022-02-04/

As you, the wise reader, know, Reuters goofed here.

IDEMIA was NOT formed in 2016. The formation of IDEMIA was ANNOUNCED in 2016, but the deal wasn’t actually COMPLETED until 2017. Hey, at least Biometric Update got it right.

Anyway, if you read either Reuters or Biometric Update, you’ll learn that nothing is going to happen immediately (France is holding an election in April, and the composition of the new government could impact any sale), and that the possible split-up may separate the part of the business that sells to governments from the part that sells to commercial firms.

Of course, the big question about any sale of IDEMIA would be the identity of the buyer. Would Advent try (again) to issue an IPO, or would Advent look for one or more existing companies to purchase IDEMIA?

Both Reuters and Biometric Updare speculate that Thales could be a potential buyer. While Safran was slimming down to concentrate on its aircraft business, Thales has been beefing to to diversify its business, most notably in its purchase of Gemalto. (As people in my industry know, that purchase provided Thales with the technology of the old Cogent Systems.)

However, there are two possible issues with a Thales purchase of all or part of IDEMIA.

  • Antitrust issues. Automated fingerprint identification systems isn’t the only product that Thales and IDEMIA have in common. For example, both companies provide driver’s licenses in the United States. As any Thales purchase of IDEMIA is considered by the United States, France, and dozens of other countries, the deal could be opposed on antitrust grounds. This can be mitigated by limiting what Thales can buy, but it could complicate matters.
  • Thales is French. Some of the driver’s license and biometric technology that IDEMIA sells was developed in the United States, and is used by many government agencies, including the Federal Bureau of Investigation and the Department of Homeland Security. At present, while IDEMIA is headquartered in France, it is primarily owned by Americans, so there’s a teeny bit of comfort in that. But what if a French firm were to own IDEMIA? The horror! (Many years ago, when Cogent Systems first sold itself, it intentionally chose a U.S. buyer, 3M, for this very reason.) Never mind that the U.S. government has been using French (and Japanese) technology for years, and that some very specific arrangements have been set up to mitigate the risks of foreign ownership. Some Senator or another is guaranteed to raise a big stink if U.S. government institutions are dependent upon a French company.

So perhaps Thales could buy all or part of IDEMIA, or perhaps it may pass. But if Thales passes, are there any U.S.-owned companies that may have an interest in IDEMIA’s technology?

Because of my biometric bias, the first thing that I would consider would be American companies that are active in the biometric market. However, many of the U.S. companies are small, and don’t have a few billion dollars lying around to buy IDEMIA. So don’t look for Aware, Clearview AI, Paravision, Rank One Computing, or the like to be a buyer.

There are of course much bigger U.S. firms in high tech that have dipped their fingers into the biometrics market. Amazon, Apple, Facebook, Google, and Microsoft all come to mind. However, those same customers that are of prime concern to U.S. Senators are also or prime concern to the employees of some of those firms, who don’t want their employers to do business with the “evil” Department of Homeland Security or even the “evil” local police departments that should all be defunded. (Amazon quit selling Rekognition to police agencies, for example.) Even Apple, which is developing its own digital driver’s license technology, is probably reluctant to own IDEMIA.

But there’s one tech company that intrigues me as possibly having an interest in IDEMIA.

Oracle.

It’s big enough to make the purchase, certainly likes to make acquisitions, and has no hesitation about working with government agencies.

ANY government agency.

After all, the name “Oracle” came from a database project that Ellison worked on before founding the company with the same name.

His client was the Central Intelligence Agency.

If you’ve paid attention to this article, then you already know that since I have speculated that Oracle could purchase IDEMIA, that puts the chances of Oracle actually purchasing IDEMIA at zero.

And for all we know, Reuters’ two sources might be unreliable, or something else might happen (another COVID variant?) that could cause Advent to hold on to IDEMIA for a few more years.

So we’ll have to see what happens.

The Māori relationship between digital identity and collective identity

I live in the United States in a fairly industrialized society with a heavy focus on individual rights, and a (general) preference toward a focus on the brain and body rather than the soul.

This view shapes how I approach a number of topics, including biometrics and digital identity. For example, if my biometrics are encoded on a physical card or in some type of digital representation, I merely think of this as a way to individually identify myself from other individuals.

Frank Hersey of Biometric Update notes that my attitude is not universal. Hersey cites an article in New Zealand’s Gisborne Herald entitled “Maori experts call for closer involvement in creation of taonga.”

Yes, taonga. As you can see, the Maori people have their own language. (And their own views on the individual, society, and identity.) While there is no direct translation of “taonga” to English, the word has been described to mean a treasured possession.

A woman with tā moko. By Mike van Dalen – https://www.flickr.com/photos/134607247@N08/21538822496/, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=46534088

I don’t know about you, but when I look at the ridges on the tips of my fingers, “treasured possession” is not the first thought that comes to mind.

And that’s the problem.

Maori data experts say there has been a lack of undertsanding about te ao Māori (Māori world view) and data sovereignty principles by the Government in the process of making two new data laws.

From https://www.gisborneherald.co.nz/local-news/20220128/taking-charge-of-data/

The Gisborne Herald quotes Dr. Warren Williams regarding how the two data laws (The Digital Identity Services Trust Framework and The Consumer Data Right) could affect the Maori.

Data is a taonga (treasured possession) for me. It is something to be cherished, protected and cared for. And with that comes responsibility….

Māori want to be able to protect our data. We want to have real ownership of our data. We want to understand where it has been stored.

Where there is physical storage of data, can we access that? Or those who hold our data, are they looking after it in a way that is respectful?

Sovereignty is not just ownership but also how it’s cared for, how it’s looked after, how it’s shared. If I say I give you permission to share data about myself to a certain group, sometimes the holder of that data can refuse because it’s private.

From https://www.gisborneherald.co.nz/local-news/20220128/taking-charge-of-data/

This data perspective is literally foreign to many government bureaucrats and policy advocates in North America, the European Union, and other more industrialized societies. Can you imagine someone in Brussels, Belgium or Springfield, Illinois talking about being “respectful” while “caring” for data?

So now let’s move to another Maori word, “tikanga,” which leads us to discuss a profound difference between Western individual perspectives and Maori collective perspectives. This was discussed in that great cultural publication Computerworld, in its description of the “Tikanga in Technology” project.

The project’s focus is on how tikanga Māori (customary protocols) and Mātauranga Māori (indigenous knowledge) inform “the construction of digital identities and relational responsibilities to data.  … The world is undergoing disruptive change as rapid advances in data linkage and powerful digital technologies converge. For Indigenous peoples, these innovations are a double-edged sword, creating vast potential for improved well-being as well as major risks of group exploitation and harm. The current narrow focus on individual data rights and protection is failing us. We need a profoundly different approach—one that recognises collective identities and allows data to be understood through a wider set of ontological realities.”

From https://www.computerworld.com/article/3575393/indigenous-data-sovereignty-and-how-maori-are-leading-the-way.html

Even in our society, identification is not a completely individualistic activity. One common example is how an individual’s DNA can be used to identify a relative who may have engaged in criminal activity, or who may have been a victim of an untimely death (criminal or otherwise). We as a society are struggling with the ramifications of this, and trying to balance the need to satisfy a public good with the need for privacy, including how I can inadvertently (or purposely) reveal something that may violate the privacy of another person.

Another example is when the needs of a biometric modality such as facial recognition are affected by religious or societal needs that cause people to shield that particular biometric. Religious mandates in certain groups to veil one’s face have recently been joined by medical mandates in certain groups to mask one’s face, causing uproars and changes in the biometric world.

Sometimes, the biometric rules adjust, such as Apple’s allowance to use a different identification method (such as something you know) when a face is obscured.

Sometimes, the biometric rules don’t adjust, and your local driver’s license bureau declares, “if you shield your face, you can’t get an identification card.”

The Maori are taking this concern with the collective (vs. the individual) a step further, with their concern about “group exploitation and harm.”

So how do these views of the collective impact people such as myself, who toss out phrases such as “identification of individuals” from decades of habit?

Who said something about marketing channels that lack content?

Good evening, loyal readers. Although I’ve tested your loyalty lately.

This is my first post on the Bredemarket blog since December 24.

As in nearly a month ago.

Now who was it that said “If your marketing channels lack content, your potential customers may not know that you exist”?

Oh, yeah. That was me.

So what happened? Why haven’t I been posting anything here in nearly a month?

Well, business picked up considerably, and I haven’t had the spare time to conceive and write new blog posts.

(Incidentally, it turns out that the “(non-identity) proposal consulting contract” that I referenced in my December 10 post will extend beyond Tuesday, January 25. The end customer granted an extension to the proposal due date, and we’re taking advantage of the extension.)

And I already have two new projects lined up, as well as some continuing work.

Now I just have to figure out a way to continue my own marketing efforts.

Because as someone once said, “If your channels lack content, your potential customers may forget about you. And that’s NOT good for business.”

Perhaps I should hire myself to create content for myself. That would result in some interesting entries in my accounting system. And would I issue a 1099 to myself?

The “market” is closed until Monday

The market is closed.

By FuriousGeorge1 from (optional) – Flickr, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=2488362

Bredemarket just took care of some final items, and is now on vacation/holiday.

Well, until Monday. Proposal work is proposal work.

But until then, I hope those who celebrate Christmas have a happy one, and those who don’t have a happy weekend.