Robin Wilton's esoterica

There's a BBC news article today describing plans to introduce mobile, on-the-spot checks of fingerprint biometrics using a hand-held police reader (linked to a national database of 7.5 million biometric records).

Towards the end of the article, there's a helpful graphic describing just how fingerprint recognition works... the fingerprint is analysed for "minutiae"... characteristic features such as the point at which two whorls intersect, or the peak of a particular curve. That data is turned into a set of co-ordinate plots which can be compared against stored values. It all sounds very plausible and relatively straightforward, and the National Policing Improvement Agency describes existing trials as a "stunning success".

Strangely, it's also at odds with what I have repeatedly been told about the way in which the National Identity Scheme will store fingerprint biometrics. I have asked, in the past, why it's necessary for ID cards to hold a facsimile image of the holder's fingerprints (in other words, one which could if necessary be examined by a human and compared with a scan on the spot). I suggested that holding facsimile images on the card is unnecessary and introduces risk.

I have suggested that it's unnecessary because a digest of the data, or a record of the co-ordinate plots of the minutiae, ought to be just as reliable; it introduces risk because it creates the possibility that an attacker could read the facsimile off the card and forge (any or all of) the holder's fingerprints, thus potentially creating a false suggestion the holder had been present.

The answer I have had is that the cards must store a facsimile, not a digest or derived record, because the process of converting a scanned image into a digest is too likely to introduce differences from one scan to the next.

Frankly, I don't know whether this, or the NPIA's endorsement of their trialled technology is the truth - but it seems to me that they cannot both be.

In early September, it was reported that US Special Forces had mounted a ground attack from Afghanistan across the border into and into Pakistan. According to the reports, a couple of dozen people were killed in the attack, some of them civilians. Pakistan's political reaction was apparently touch enough to convince the White House not to launch further ground attacks.

However, according to this article in the New York Times, the policy has been replaced with one based on the increased use of Unmanned Aerial Vehicles (UAVs, or 'drones'). Apparently 5 such strikes were launched in the first 28 weeks of 2008, but in the eleven or so weeks since then, there have been 18 UAV strikes. The same article describes the unpredictable results of some of these missions, including civilian casualties and missed targets, and notes that UAV strikes can never achieve the other goal of capturing Al Qaeda members and interrogating them for information about their leaders.

You may remember some of the earlier reports of UAV use, such as this incident in 2002 in Yemen, in which 6 suspected al Qaeda operatives were summarily executed in a rocket attack on their vehicle. For more technical and political context, see this page on the GlobalSecurity.org website.

What caught my eye in the current story, though, was the reported reaction of Pakistani officials, who have apparently described these attacks as a "less objectionable violation of Pakistani sovereignty" than ground assault. Talk about 'shades of grey'...