TechStuff Classic: Biometrics: Digital Fingerprinting

there's a lot to talk about, right. You know. Biometrics, of course, being the measurable biological or behavioral characteristics used for for any given individual. Yes, this is what how the FBI says, this is what the biometrics are. So, uh, you know, it's one of those things where we knew it was a huge time bick and we decided to narrow it down. So today we're specifically focusing on your fingerprints. Well,

not your fingerprints, I mean, I mean everyone's fingerprints. No, see the person sitting next to you, No, not that one, the other one, that person's fingerprints. That's that's the one we're concentrating on. So yeah, because everyone has has different fingerprints, I mean like everyone, right, and this is something that has been known for a while but then forgotten and then rediscovered. So we're going to talk about that because

it's kind of funny. So these days we think of biometrics as sort of those automated ways to verify your identity based on some sort of biological characteristic, like you know, the eye scan or the fingerprints scan or whatever. Vocal scans as well, you know, like the voice imprint. Lots

of different Hollywood versions of this. But you know, again, going into that fingerprint approach, we thought that, uh, you know, we we look at not just how we've defined it and how stuff works, but look at a whole history of fingerprinting. We're not the first podcast to do this, by the way, certainly not. Josh and Chuck of Stuff you Should Know did an episode on April called how Fingerprinting Works, and they go pretty deeply into the history

and say many pithy things. So if you would like to check that episode out, you can go to Stuff you Should Know dot com right and just stick around, because we're gonna say some pithy things too. We are going to cover some of the history kind of a quick overview, but first I thought I would read a couple of little excerpts from our article on how fingerprints scanners work, because there are a couple that I thought were really interesting from how stuff works dot Com. Neither

of us actually wrote this. Nope, Nope, I didn't write this one. This one says people have tiny ridges of skin on their fingers because this particular adaptation was extremely advantageous to the ancestors of the human species. The pattern of ridges and valleys on fingers make it easier for the hands to grip things in the same way a rubber tread pattern helps to attire grip the road. The

other function of fingerprints is a total coincidence. Like everything in the human body, these ridges form through a combination of genetic and environmental factors. The genetic code and DNA gives general orders in the way skin should form in the developing fetus, but the specific way it forms is a result of random events. The exact position of the fetus in the womb at a particular moment, and the exact composition and density of surrounding amniotic fluid decides how

every individual ridge will form. This, by the way, is how identical twins can have different fingerprints pretty cool because you know, genetically they're identical, but their fingerprints are different, still different. Interesting. So looking at this history, you might think, Okay, I've heard about fingerprinting, particularly when it applies to law enforcement. That's probably where a lot of people are familiar with it, besides the verification. Sure, sure, and uh and a couple

popular media pieces have talked recently about Um. I mean you you get things like Ripper Street or Sleepy Hollow having characters going like this new fingerprinting thing in the amaging, amazing Age of Victoria. Um, not not so much. Actually, so fingerprints people, Well, first of all, people have been aware of them for ages because we're curious folks, you know, human beings. We we were very curious and narcissistic. We like to learn stuff and we like to look at ourselves.

And how do I know that this dates back are ages and ages and ages ago because we have prehistoric depictions found in Nova Scotia and it depicted a hand with ridge patterns on the skin. Now, that does not mean that the ancient Nova Scotians were familiar with the fact that all the fingerprints were unique, and therefore no to individuals had the same ones, but at least showed that you know, yeah, they noticed them. Yeah, but the

ancient Babylonians may have actually used fingerprints to differentiate people. Um, we've found fingerprints in clay to to sign business transactions, and the ancient Chinese used inked fingerprints for both business purposes and child identification. And in the thirteen hundreds in Persia, official government documents often included fingerprints, probably to indicate they

were authorized and official. Now, according to the US Marshall's Office, which has an entire web page devoted to fingerprinting in the history of it, one government official in Persia at that time made the observation that no two fingerprints were alike, which obviously would be very important if you're making a document official or authorized. But it wasn't until the eighteen eighties that that amazing Age of Victoria previously mentioned that

we got some kind of official classification system, right. It wasn't until the modern era that we started seeing it. In uh story, it wasn't even in wide use at the beginning. It was just kind of exploratory. Dr Henry Faulds back in eighteen eighty proposed using fingerprints for identification as well as a means of classifying them. So he forwarded these ideas to a certain Charles Darwin, very important

historical figure in his own right. But Darwin at the time was towards the end of his life and felt that he did not have the necessary UH time and energy to devote to this thought. It was really interesting, however, so he forwarded the information along to a cousin of his named Francis Galton. So false would write a scientific paper about his methods and actually identified a fingerprint, ascertain the identity of the person who left that fingerprint on

bottle of alcohol. Shouldn't come as any surprise. I guess this brings us all together. It does. Then in three Mark Twain would would use this this new startling scientific information in a story. Yeah, it was in Life on the Mississippi, And in that one of the elements of that story is a murderer is identified through the use of fingerprints. And he would revisit the idea in a

book called Putting Head Wilson Putting Head. Well, so it's interesting. Now, this was before anyone was actually using UH fingerprints in any kind of criminal investigations on an official basis. It had not been science fiction, really was. It kind of was so so that was exciting. But but soon in eighteen eighty eight, Sir Francis Galton, remember the cousin to Charles Darwin, who had received information about this about ten years previous, um, began his own study of fingerprints. Yep.

He wrote a book in eighteen ninety two and put forth a formal classification system and identify the tiny characteristics used to differentiate fingerprints, which now we call Galton's details. He also observed that fingerprints don't change over the lifetime of a person, so the ones you have when you're a kid are the same ones you have when you're old. Originally wanted to kind of link fingerprints to certain types

of traits like intelligence or heredity, which is so racist. Yeah, kind of essentially, I think this was almost in an attempt And I don't know enough about Galton to say this for sure, but it seems like an attempt to justify certain societies beliefs in certain people, that kind of thing. Yeah, it wasn't necessarily so racist, but um, but it kind

of runs in that direction. Yeah, Because I mean, the idea that you could identify a person's intelligence based on their fingerprints already seems a little sketchy, and in fact, he did determined that there was no connection. There was no there were no identifier marks in a person's fingerprints that would give you any clue as to that person's intelligence or genetic background. However, he did figure out that there were a lot of differences and that people didn't

weren't likely to have the same fingerprints. Yeah, unlikely, in the order of one in sixty four billion, that's pretty unlikely. So in eight we get the first use of fingerprints in a criminal investigation on an official level. Uh one vs. Tech and I I'm sure I butchered his last name. Who was a police officer in Argentina used them in

a murder investigation. It was actually a really tragic case, but the discovery meant that he was able to solve this mystery and prove that the person that was believed to have been the murderer was in fact not the killer. So, uh, not only was it the first use, but it was

a pretty dramatic example of it. Now, between we're gonna skip to nineteen eighteen, but between the late nineteenth century and the early twentieth century he started to see fingerprints get adopted into various legal organizations all around the world. The United Kingdom and the United States were leading the way, but it was all over the place. So by nineteen eighteen you have Edmund Lekard who says that you only need twelve points of similarity between an individual's fingerprint and

a target fingerprint to serve as a positive identification. Now you may have heard about those twelve points of singularity, that this is somehow like a legal thing, that if you were able to meet those twelve points of singularity, you have the legal basis to say this person did this.

Uh not necessarily a legal definition at all. In fact, UH countries have very very different ways of saying whether or not a fingerprint is a valid match for another one, and some, like the United States, do not have a minimum number of resemblances that need to be there in order for you to call it a match. Now, usually law enforcement agencies rely on experts who give their expert opinion and therefore putting their own reputation on the line

as to whether or not something matches. And of course, now these days we rely very heavily on digital information, which with very very complex and intelligent algorithms that will that will do some really interesting like work. Yeah, and so with that, you know, the the level of a confidence grows quite a bit. So, uh, just so you know that twelve points of similarity not necessarily a legal standard.

Nineteen four that's when Congress enabled had an act that established the new division for the Federal Bureau of Investigation also known as the FBI. Uh And this division was called the Identification Division. I bet you can guess what it did. So it became kind of a centralized fingerprint

file for the entire country. So not it wasn't necessarily uh standard procedure for every law enforcement agency out there to send a copy to the FBI, But that's kind of what started to happen, so that, uh, there could be this sort of cooperation between different departments which often wouldn't have any communication with each other. Sure sure, by nineteen forty six, the FBI would have processed more than

a hundred million fingerprint cards. Yeah, not just processed, but they did that by hand, right right, and it would be two million by one, So two million physical cards with fingerprints on them. I mean, just imagine how many, like, how how much storage you need just for me, it's two. I can't even I can't even imagine it. But by the FBI introduced the Integrated Automated Fingerprint Identification System or if SO. It's the largest fingerprint database in the world

and its computer automated. It takes about twenty seven minutes for the system to comb through every single file in its database to find out if there is a potential match. During a criminal investigation, it's different. If it's a civil case, it's actually like more than an hour. But for criminal investigation, for all the criminal files that are storing this database, twenty seven minutes from the time you actually input the suspects fingerprint. I imagine that's a lot faster than whatever

in turn they sent down to the basement. Well yeah, because I mean you would have to narrow down the person quite a bit before you could ever start comparing. Right, this is a man, so cut out all the women and then go like there are seventy million of them down there. Uh yeah, that would be that would be a daunting task. So in the digital age, we can actually analyze this stuff way better than we ever could, Like you don't have to use the naked eye anymore

and try and find those little ridges and stuff. You can actually rely very heavily upon computer systems, and once we started getting those computer systems in place, they pretty soon thereafter became um commercially available. Yeah. Yeah, we had some fingerprint verification systems that have been around for a few decades now. On the consumer level, they've only been

available fairly recently. And you might be thinking, oh, yeah, yeah, the iPhone five s because it has that that fingerprint scanner where you can use that to log into your phone. That's the first smartphone to ever use that, right, Nope, no, no, there's actually a mobile device. The first mobile device that I found was a one that dated from two thousand three, the H and Boy. The name of this is phenomenal. HP names their products in such catchy ways. It's the HP I pack, I p a Q P PC pocket PC.

Oh yeah, it just rolls off the tongue. Yeah, it really is. I mean, with a name like that, how could you resist I phone my phone? So at any rate, this was the first mobile device to incorporate finger scanning technology, but it was also sort of the edge of a boom for the technology. UM it was being extended for for wide consumer use. At the time. I mean, you know,

keyboards and mice had them, laptops had them. You could buy a USB scanner for multipurpose use and encrypt everything with your fingerprint, right, you could end up creating, for example, with a copier. You could end up telling people, all right, this group of folks are authorized to make copies. Anyone who's not on this list cannot make copies. And you would walk up to make copies. And if you weren't on that list, then I guess no fun Christmas party

Shenanigans for you. But but but also opening this up to the consumer market meant that a lot of people started finding the flaws in the technology. Oh yes. In December five, clarks And University researchers announced that they could fool of the world's fingerprint scanners using an incredibly sophisticated, expensive substance. Yeah, they could just go out to toy store and buy some Plato and essentially make a copy of a fingerprint and put it on any optical scanner.

And we'll talk about the optical scanners in a little bit. And it worked really well. So that gave people some pause and thought, maybe we should come up with something besides optical scanners too, because fingerprint identification is a great idea, but if it's if it's that easy to fool, we have to find a different way of measuring it. So then there was a totally different expose on September one, two thousand and six, when our beloved MythBusters decided to

do a fingerprint scanner scam of their own. They decided to see if they could fool one, and this one was a little different. It wasn't just an optical scanner. It was supposed to also detect sweat from pores in the fingertips. Okay, so so you can't just use a lump of plato or good photograph. You have to have something that sweats has to have to otherwise it's never gonna work. So what did they do. They made a latext copy of a fingerprint and then they did a

very sophisticated thing in order to simulate sweat. Yeah, and it worked. So if you can't play dough it, lick it, I guess is the moral of that story. I think I think that that's really what we all should learn from this today. Probably so anyway, they're still seeing this kind of technology being rolled out. But it's not just an optical scanners, and even optical scanners have gotten a lot better than they were back in two thousand five.

We'll be right back with more digital fingerprinting after these short messages. All right, I had just talked about optical scanners, and those are one of the ones that are the easiest to explain and uh and fairly common even today. In fact, not my work computer, but my home computer has my home laptop has a little optical scanner. So if I want to log in, I can just swipe

my finger across it. So optical scanners use something that is found in digital cameras and camcorders called a charge coupled device or c c D. Now, essentially that's a light sensor. It's got an array of things called photo sites. Now that's light sensitive diodes, and it's works pretty much the way you would imagine. So photons, those little particles of light when they make a collision with these photo sites, it generates a little electrical signal and those can then

be compiled and converted into a digital image. And it's essentially the same process that digital cameras used to take pictures. And here's the thing though, So if I put my finger on an optical scanner, I'm actually blocking light. And unless you happen to be e T the extraterrestrial, your finger probably isn't emitting light. So how the heck is

it getting this picture? Well, it uses a flash, yeah, except in this case of flash is probably like a single l ED or for some scanners maybe an array of LEDs light emitting diodes in other words, and so that provides the light that is necessary to take this image. And uh, then the c c D creates an image of your fingertip. However, it's a little funky. It's inverted, right. The dark areas are going to represent the ridges that the raised portions of your fingertip, and the light areas

are going to represent the values. Yeah, so it's kind of like looking at a negative, a photo negative. Uh. And it makes sense because stuff that's reflecting more light is going to create a lot a bigger electrical signal, thus creating that you know, the charge couple device is going to make that into a darker portion the valleys. The light is not as much of it's going to reflect back, so you get a weaker electrical signal. That's

why it gets lighter. Uh So, if you were to scan your finger and UM and it tells you that it's a good scan, because most of these devices also have some sort of fail safe in them that will alert you if there wasn't enough enough differentiation between the dark and light parts. Right, that the same way that you're that your camera UM sometimes will take a picture

that's that's overdeveloped or underdeveloped. The same thing can happen here. Yeah, So if you wanted to, like if you most of the software has let error function built into it, so it can tell and it will ask you to scan again, right, So then you would scan again. So if it's the first time you're using it, then you would also end

up creating a profile in some way. It might not be you, it might be an administrator, but something that links the fingerprint to who you are and what access you are supposed to have will have then on subsequent uses, what will happen is that when you scan your finger it will go through its database of of identities that have fingerprints attached to them look for you. If you're there,

then it will authorize you for whatever use you're allowed. So, for instance, on my home computer, I've given myself very strict restrictions because I am not to be trusted. Uh, and so all I'm able to do is play a pirated copy of Flappy Bird. That's not true, I don't have Flappy Bird. But at any rate, you know, that's the basic You know, that's the basic procedure, right, And and so if your fingerprint is not found in that database,

you get an error. So either you have to swipe it again or or scan it again if it's not swipe. All depends on what kind of scanner you're at, or you end up saying, uh, the jig is up, you got me, I don't really belong here, and then you run away. Um. So that that's the basic thing. And what they're looking for. It's not the entire pattern of your fingertip. It's looking for for a specific minutia about it, certain types of patterns and it. And it depends on

the software that the scanner is using. Um. It might be the places where the ridges converge, um or split apart at the end, or um any any other kind of detail. It's going to be unique to you. Right. So in other words, all has to do is say, hey, there are these three points on this fingertip, uh that

are unique that that's all I'm concerned about. And if the fingerprint that scan has those three points, I know it's this person and they can be let through by constraining on the minutia, then you really cut down on all the rest of the data that's necessary to have a verification. Right, you can kind of throw everything else out and concentrate on that and right. Uh and and they're pretty good, like we said, though they can sometimes

be fooled by a really high quality picture of a fingerprint. Right, So what if you instead of looking at a picture, you were to make sure the fingerprint in some other way, such as capacitance right, Because capacitense touch screens are totally a thing. Yeah, So it's very similar to what a regular capacityans touch screen is. So you know, there are different ways of doing touch screens as well. There's somewhere

you have to use pressure. With the benefit of that is you could be wearing gloves and still work a pressure version. The downside is that when people are expected to apply pressure to delicate material, they sometimes destroy it completely, right, or it'll at least decrease the lifespan of that object by quite a bit. Capacitance, however, uses weak electric fields. So when you make contact with a screen, a touch screen,

that's using capacitance. See, you're a conductor. I don't mean that you conduct trains, Nor do I mean that you Maybe you do, Maybe you do, Maybe you do. Maybe you conduct orchestras. Maybe you conduct orchestras on a train. I don't know. But what I'm talking about, you do call us because that sounds fascinating, kind of cool. Actually, But now I'm talking about electrical conductivity. So we can conduct electricity. It's not great for us to have a

lot of it, but tiny amounts don't hurt us. Sure, And as it turns out, the ridges and valleys on your fingers conduct slightly different amounts of electricity. This blows my mind. I mean to think that the raised parts of your fingerprint and the valleys of your fingerprint are distinct enough to create a measurable difference in capacitance. You know, it's something I never would have imagined. And it's really

a sensor issue here. I mean the fact that we can create these these cells, these capacitor plate cells that are sensitive enough to tell that yeah. Technology, so what's happening is when you put your finger down on one of these capacity scanners, you are actually you're you're acting as a capacitance plate, right Your fingertip is acting is one, and you already have other ones inside the scanner itself, and it will end up creating voltages, and there will

be different differences in those voltages. The differences between the ridges and the valleys based on how far away they are from the from the cells. Yeah, so if it's a valley, it's going to be lower capacitance because the distance is greater. Capacitance is very dependent upon distance. So if you move to capacitance plates far enough apart, they will not be they will not work together. We've got a little bit more to say about biometrics, but first

let's take a quick break. It's amazing that the valleys, just by being that much further away will create a different voltage than the ridges. And then having a whole, a whole set of these cells set up next to one another, um it allows the scanner to to sort of make a digital picture of your fingerprint, but just using electricity rather than light. The data from each one is again compiled and then converted into an image of sorts. Yeah. Yeah, you can think of it as like an image made

with electricity. And this is the sort of scanner that the iPhone five S uses, so it's not an optical scanner. One of the big benefits of this technology is that it's easier to make it really compact and manatorized, which is why you could find it in things like handheld electronics. Right sure. Um. However, this technology can also be fooled um sometimes by by mold of a finger um or if someone has gone and calibrated the scanner to look

for things like like heat or a pulse. Um. You can you can use one of those movie tricks, like a gelatin or silicone mold of a finger um pasted onto a different, different finger. Yeah. My favorite version of getting past a capacitance or an optical scanner is to use the finger that's been removed from the person who had the authorization. Yeah, yeah, snipping, that's that's that's your favorite. That's my favorite out in the field. That's what you like.

We had this discussion about the born identity before we came into the podcast. This is totally true. Uh, I don't like to discuss my actual field operative kind of mentality and strategies. But yes, I do love doing that. So thermal scanners, well, this one's a little different because it's a it's a heat scanner, and again it's one of those ideas where it measures the differences in heat

between ridges and valleys. Once again, you're going to get a slightly higher temperature from the ridges than you do with the valleys. The valleys that are essentially pockets of air. There's some downside with this one. One of the problems with thermal scanners is that if you if it takes too long to do the scan, the temperature differences are going to equalize across the and I wind up get you just get a blank fingerprint, like a big blank fingerprint.

Not useful. This next one is super cool. It's ultrasonic ultrasonic sensors, so right, yeah, Well, we did a whole episode about ultrasound called How Ultrasound Works. Crazily enough that published jan if you would like to hear all about how this technology works. But um, but it's essentially echolocation. Yeah, you're sending out sound signals and then you're waiting for them to bounce back and by measuring the amount of time it took to go out and come back. You

get an idea of how far away something is. Well. That works, you know, in lots of different ways, including being able to tell a fingerprint, being able to read a fingerprint. It can go even deeper than that, exactly, it can go into tissues. So if you wanted, you could create an ultrasonic fingerprint scanner that scan not just the fingerprint itself, but the underlying veins that are in your finger which also are going to be unique to you. So that's a lot harder to fake than a fingerprint.

Like you're not going to get a really high resolution image of veins and then create a fake finger easily. It would be really difficult. I mean, but you could use your favorite application, which is removing someone's finger and say that right unless you had also built into the software to detect living tissue, because to see if blood is moving through the veins the vessels. If it's not detecting blood, it's good to say, y'all, this is messed up.

You need to send someone down right now the fingerprint scanner. Things that are bad are happening. That's exactly what the voice that uses too, I I assumed run into it in the field all the time. So yeah, I mean this is uh, you know, that's we're making light of it because to be serious about it is so squeaky, terrifying.

But at any rate, it does mean that you can build those sort of parameters, and so it's not just looking at the fingerprint and the veins underneath, but also to make sure it is truly a valid uh entry, so that they don't you know, you don't end up compromising security. Um. And there there's also I wanted to mention very briefly the difference between those static uh fingerprint scanners, especially the optical ones where you just hold your finger

down and you wait for it. It's kind of like a copier, right right, and the swipe style that you were talking about having on your home laptop exactly. So if you've ever had a laptop or any other device that has like a narrow window and you're supposed to swipe your finger across that window, the reason for that is that it's actually taking a series of quote unquote images of your finger. However the implementation is actually being used,

it's it's doing then a quick series. Machines are really fast, so they can do this without any real problem. They're looking for those minutia that we talked about before, and they're able to uh to use software to compile them. But you know, it's it's nifty having the smaller form factor because, like we said, uh, then you can miniaturize, you can put them in something like a cell phone

and also make them cheaper. Exactly. Yeah, you've got this little window and your finger moves past the window instead of the window having to be big enough to So it's it's really uh an interesting development and uh pretty cool. Also, we can mention that biometric systems, many of them, not necessarily all of them, but many of them end up translating your fingerprint in to an algorithm that or an algorithm rather does the translating that turns into a bunch

of ones and zeros, all right, right. A digitization um sometimes called a hash. It's like a personal code, like a really long pin. Yeah. So in this case, what you would say is that it's not storing an image of your fingerprint. It's not like if you were to somehow hack into the computer you would suddenly see a

on your screen a representation of your fingerprint. It would just mean that it would take the the pattern of ridges and valleys and all the night nutia convert that into this this hash, this this long string of ones and zeros, and the next time you scan it, if the if the same hash comes up, then it is a match and it says, all right, identification has been verified. But it's not actually like an actual real image of

your fingerprint. And the reason why a lot of these companies try to talk about you know this as as a big selling point is that it doesn't allow you to recreate a person's fingerprint if you were to get hold of those hash So it's not like you would say, oh, if I just put this through an image program, I suddenly get a picture of that fingerprint, you would just yeah, that's that's the way. I think that the iPhone five S and the Galaxy something something that the latest Samsung

incorporates it. And UM PayPal these days even has UM fingerprint signatures on their app, and any any device that allows you to in to scan in your fingerprint will yeah let you pay for stuff on PayPal with that signature. I'm sure we're going to see a lot of that kind of stuff incorporate with things like the NFC technology or even the low Bluetooth energy low energy bluetooth. Rather, I should say, implementations where your fingerprint instead of having

to put in a pen, you just swipe your finger. Yeah, you know, I don't know. I kind of hope that it's an additional safety feature, not a standalone safety feature, because you know, unlike a password or a pin, you can't just change your fingerprint if it gets stolen. And this hash issue add security to to the whole thing. It's harder to but I'm sure that someone if they really wanted to, could decode a hash and figure out

what that scan looks like. Yeah. Maybe, I mean, they would have to have a lot of information, but it is It is important to say that there is no security feature out there that's going to be right right, There's nothing out there, So having it as an additional tool, I agree, Lauren, that's that's the best way of looking at it. I think anytime we decide that we're going to rely on a specific implementation and that's it and we're done, we're good, then we're pretty much dooming ourselves

to getting hacked in some way down the line. And that wraps up this classic episode about biometrics. It's still a very very big topic, arguably an even bigger topic today than it was back in very complicated. There's so many things to take into consideration from security and privacy issues too. You know, the problems with authentication in some cases, ways to work around biometrics. There's a lot going on there. I will likely do more episodes kind of diving into

not just the tech but the ethics behind biometrics. If you have suggestions for topics I should cover in future episodes, let me know the best way to do that is over on Twitter. The handle is text stuff H s W and I'll talk to you again really soon. Y tex Stuff is an I Heart Radio production. For more podcasts from my Heart Radio, visit the i Heart Radio app, Apple Podcasts, or wherever you listen to your favorite shows.