Biometric identification is a statistical process. Variations in conditions between enrolment and acquisition as well as bodily changes (temporary or permanent) mean that there is never a 100% match. For a password or a PIN, the answer given is either exactly the same as the one that has been stored, or it is not – the smallest deviation is a reason for refusal; for a biometric, there is no clear line between a match and a non-match. Whether a match exists depends therefore not only on the two data sets to be compared, but also on what margin of error is deemed tolerable. A 90% probability of a match may or may not be considered acceptable, depending on the implementation of the biometric in question and the application security requirements.
As a consequence of this statistical nature, biometric systems are never 100% accurate. There are two kinds of possible errors: false matches, and false non-matches. A false match occurs when an acquired template is erroneously matched to a template stored from enrolment, although the two templates are from two different persons. A false non-match occurs when an acquired template is not judged to match the template stored from enrolment, although both are from the same person. These error rates vary from one biometric technology to another, and they depend very much on the setting of the threshold above which a “match” is calculated: a 99% threshold will have more false non-matches and fewer false matches than a 98% threshold, and so on.
Any biometric application must therefore provide a fallback procedure to deal with these errors. Fallback procedures are equally necessary to deal with people who have difficulties to provide a sample of any given biometric. This can be permanently, e.g. for sight-impaired people using an iris recognition system; or it may be temporarily, e.g. for an individual with a bandaged face using a face recognition system. The percentage of the population giving rise to a variety of such problems may be small but significant. Therefore, fallback procedures will need sufficiently flexible human involvement to handle the variety of potential problems.
A second point worth mentioning is that the biological data themselves, the so-called samples, need not actually be stored in the biometric identification systems. Iris pictures, fingerprints and faces are converted via mathematical algorithms and stored into fixed format files so-called templates. The use of biometric algorithms facilitates the statistically constant matching of the features extracted during acquisition. Whilst the algorithms are different for each technology, this procedure is usually non-reversible, i.e. it is not possible from a template to recreate the sample which was its source. Another advantage of the use of algorithms to create templates is that a new and different template can be produced if the previously produced template has been stolen and is abused by a third party, even though the biometric characteristics of the body themselves are not revocable - your fingerprint remains your fingerprint, even if someone else has obtained a copy of it.
Biometric features include various subsets of body characteristics, but not all such subsets are suitable for identification purposes. For example, a photograph of one particular body part (the face) is sufficient for many purposes, while a photograph of other body parts (say, elbows or feet) is useless. The evaluation whether a particular body characteristic is suitable for biometric use can be done on the following seven criteria:
One must bear in mind that the degree to which each criterion must be fulfilled by a biometric depends clearly on the application for which it is used. A border control check must be done in a few seconds; a criminal investigation can take months. A convenience application, say highway tolls, may accept a significant error rate; a banking system will require a much lower one. It is therefore necessary to look at the purposes for which biometrics can be used.