Iris Scans: Security Breakthrough Or Privacy Invasion?

Plan X: DARPA's Revolutionary Cyber Security Platform

Imagine if you could be identified with certainty from 40 feet away by anyone with a special camera and your iris scan in a database. Carnegie Mellon researchers at the Cylab Biometrics Center have invented a device that can do that. It should definitely have criminals feeling nervous, but maybe we should all be nervous.

First the good news. According to SRI International, a spinoff of Stanford Research Institute, iris scans are 1,000 times more accurate than fingerprint scans. We're already using handheld iris scanners in high security situations. The new Carnegie Mellon device will work up to 40 feet away -- even in a mirror -- so, for example, a police officer making a traffic stop can safely identify a potentially dangerous suspect before he even exits his vehicle.

The whole system works with fewer false positives than fingerprints, and it's effective at the same general range as facial recognition. (Facial recognition famously failed during the Boston bombings because no pictures were close enough.) Here it is in action:

Here's the bad news. At 40 feet away, the government could now (or soon, because this version looks like it needs some focus time and for you to sit still a bit) scan crowds of people for "irises of interest" and literally troll a city street for "the bad guys." Even the most security-minded person probably feels a little strange about that, especially when you consider that irises can be scanned passively.

For now, this isn't a major threat because if your iris has never been scanned, no one can identify you. The FBI has at least 104 million fingerprints in its database -- 70 million of which are from criminals. It has no known iris database, though it has experimented with the idea.

[ Not everything that helps the government has a dark side. Read 4 DARPA Projects We Love. ]

What if you scanned a city street daily? You may not be able to identify whom all the irises belong to, but you could say, "The same iris, which we now call Iris 543-X, walks by here at roughly the same time every day." The assumption, then, is that Iris 543-X belongs to someone who lives or works in the area. As thousands of irises are scanned and stored, eventually a giant database could be created to track the movements of every iris that walks in front of a camera. Eventually, you're going to identify Iris 543-X, especially if Iris 543-X can be cross-matched to facial recognition software or other forensic databases.

Pretty soon, with a handful of cameras in the right areas, the numer of irises captured and stored could easily surpass the 140 fingerprints in the FBI's database. Sounds scarier now, right?

Now imagine using it in retail to track shoppers to offer them "deals," or in education to track students in the name of security. The opportunities are endless, as are the chances to violate someone's privacy and civil liberties.

This is a perfect example of a technology that can save lives if used sparingly, and cost us great freedom if used too much. Who makes the decision how much to use it? Not us.

Are iris scans a wonder weapon against crime and terrorism or a way for the government to invade our privacy and track all of our movements? What do you think? Tell us in the comments section below.

[Did you miss any of the InformationWeek Conference in Las Vegas last month? Don't worry: We have you covered. Check out what our speakers had to say and see tweets from the show. Let's keep the conversation going.]