As the use of selfie-based biometric authentication has continued its rapid ascent over the past couple of years, FaceTec has emerged as a leading pioneer in this area. With its Face Authentication solution, FaceTec became the first company to attain Level 1 and then Level 2 certification in iBeta’s Presentation Attack Detection evaluation – the most well known test of anti-spoofing technology – and five months ago put serious money on the line with a spoof bounty program, promising tens of thousands of dollars to any hackers who could trick FaceTec’s AI security software with a spoof artifact. So far, none have succeeded.
Now, the company is looking to perhaps the most important application of its sophisticated biometric technology yet: online voting. FaceTec established a key new partnership with Canadian mobile voting startup Neuvote in 2019, and the company is now preparing for a potentially huge expansion in this area as governments around the world look to facilitate social distancing during elections this year.
Naturally, this was the major subject of discussion in a new interview between Mobile ID World Editor in Chief Peter Counter and FaceTec CEO Kevin Alan Tussy. The two begin by addressing the need for biometrics in electronic voting and move onto what biometric enrolment looks like for voters, the importance of liveness detection, and the risks of not shifting to mobile voting for this year’s presidential election in the US.
Peter Counter, Editor in Chief, Mobile ID World: In light of the current global pandemic, congress has suggested a shift to remote voting. Why must biometrics be a part of this implementation?
Kevin Alan Tussy, CEO, FaceTec: Confidence and Security. If we are going to enable remote, unsupervised voting, then we must be extremely confident that the attack surface is secure, making sure that only the authorized voter has access to their ballot.
FaceTec’s state-of-the-art biometrics will ensure that. But, we have to realize that typical biometrics only compare two or more digital representations of human traits. For secure remote voter authentication, just “comparing traits” isn’t enough. We must also concurrently measure “life,” and to do that, we need Liveness Detection.
Mobile ID World : We know there are significant challenges with e-voting as it has been implemented in the past. How can biometrics solve those challenges in a digital remote voting scenario?
FaceTec: First, we need to know that the correct person is voting, so we’ll compare the user’s newly collected 3D FaceMap with the government’s on-file 2D photos of the individual they are purporting to be. Then we’ll verify that the 3D FaceMap was collected directly from the live, physically-present user – and not from a spoof artifact – with a Liveness check.
Liveness Detection is truly the first principle of secure biometrics, and it’s the lack of Certified Liveness that has allowed digital fraud to become so rampant. Simply put, Liveness Detection stops bots and imposters from posing as someone they are not, and it ends identity fraud. We are, right now, witnessing a revolution in remote authentication brought on by our secure Liveness Detection AI. Now, organizations can have extremely high confidence that you have verified your identity, even while sitting on your couch, and perhaps even more so than when you went into a bank branch, or even signed with a notary.
And soon you’ll soon know that your rideshare driver is exactly who they say they are, and that potential date you’re chatting up is not a catfish. By closing the loopholes and shedding light on the grey areas that fraudsters work inside, we can prevent victimization and increase confidence in all of our online systems.
Mobile ID World : Voting is a complicated process, and making it remote is a significant undertaking. What is the citizen experience to mobile voting with biometrics, from enrollment to voting?
FaceTec: Voting is complex, but mostly because of the logistics required to manage millions of people at thousands of locations, all on the same day. If you can bypass all the physical challenges, and do it digitally from voters’ own devices, then it’s a lot more manageable, efficient and cost effective.
Especially during this health crisis, requiring people to visit polling places is problematic. So we need to provide a more efficient way to achieve the same result, and we can do that by swapping each piece of the current system for a digital counterpart.
So, the “Polling Place” would be an app you download, and the workers overseeing the process are replaced by encryption, Liveness Detection and Face Matching AI on secure servers. We’ll have similar voting software to what we have now, and the votes will still be anonymized, secured and counted; that all remains the same. It’s just that the ballots are now on voter’s smart devices not in the voting booth. The entire process looks like this:
- A voter downloads the election app or visits the website.
- They enter a unique identifier, like their driver’s license number.
- The camera on the voter’s device is used to take a two-second video selfie.
- A 3D FaceMap is created from this video interaction, encrypted and sent to the server.
- The voter’s 3D FaceMap is checked for Liveness to ensure they are not a “spoof.”
- The system looks up their unique number in the Government database, (like the DMV database), and compares the new 3D FaceMap to the ID photos on file.
- If the 3D FaceMap and the 2D DMV photos match, the votes on the ballot are counted.
- For additional security, the Unique Identifier of the voter is run through encryption making it “hashed”, and the hash is stored on the server.
- If a voter wants to be assured their vote was counted, they can re-enter their PII, it is re-hashed and if there is a hash match in the database, then we know the vote was counted. The stored hash also prevents them from voting multiple times in the same election, but stores each voter’s vote anonymously.
The system can use the existing election software that counts and anonymizes votes, like Microsoft’s ElectionGuard, which is currently being integrated by our partner, Neuvote, who plan to bring the combined system to voters in Canada and the United States. Additionally, by adding immutable blockchain technology we can be even more confident that the votes are being cast and counted correctly.
The fact is, with 3D Face Authentication the entire ballot system can now be remote and still be more secure than in-person voting, and for more in-depth information please visit the educational website www.RemoteVoting.com.
Mobile ID World : It seems obvious that liveness detection is a crucial component to mobile voting (and in all biometric authentication systems), but what are the specific risks that certified liveness detection can mitigate in voting, specifically?
FaceTec: Trustworthy Liveness Detection really was the missing key that has now unlocked all remote authentication use cases, and in voting it’s critical because it doesn’t just defend a user’s account; it defends the election itself.
The risk that Liveness Detection mitigates is distrust in the remote election process. When voters prove their own Liveness and their identities, they will know that each of the other voters has done the same, and, as long as the other components of the voting system are audited, that the results can be trusted.
We take the responsibility of guarding remote voting very seriously and would not be suggesting that our technology can fulfill this need if we had not tested it and did not have many years of real-world experience from our hundreds of customers and their millions of users.
Unique in the biometrics industry – to ensure up-to-date security – FaceTec maintains an open-ended $75,000 spoof bounty program. If a hacker could thoroughly spoof our Liveness Detection, they would be paid a $75,000 bounty. However, after over 13,000 spoof attempts against our bounty program since October 2019, not a single artifact has fooled our AI. Seeing that election campaigns and PACs typically spend between $5-50 per vote in US elections, we don’t see spoofing our iBeta/NIST Certified Liveness Detection as being a feasible way to tamper with an election.
Mobile ID World: This might sound dramatic, but we are living in dramatic times. Given the American elections scheduled for this year, what is at risk if the shift to mobile voting isn’t taken?
FaceTec: I think that really depends on the virus. It now looks like the curve is flattening, but if people are still sick in November or there has been a resurgence, and the public literally cannot go to the polls, then I don’t know what is going to happen. But there’s still time to implement a secure remote voting system for the elections in November, and FaceTec and its Partners are standing ready to help make that happen when called upon.
We already enable well over a million new users a month to securely create new bank, transportation, insurance, social media and dating accounts remotely from their phones, and give tens-of-millions more the ability to authenticate themselves with their 3D faces for account access. So, we know our tech can be rolled out securely and can be fully audited before, during, and after any election in which it’s used.
The critical importance of Liveness has been evident to us at FaceTec from the start, but to most of the biometrics industry, it’s only become important in hindsight. And there is real risk to thinking all Liveness Detection is equally secure: it’s not. FaceTec was the first-ever to pass the iBeta Presentation Attack Detection [PAD] testing and is the only company that can call its tech “Certified by NIST/NVLAP lab iBeta.” There is a reason for this; we never manipulate a testing agency and lobby to reduce the number of attempts or artifacts in a test. We strongly believe that gaming third-party testing is disingenuous, and this is not the time to be hawking half-baked security solutions.
Unfortunately, the Dunning-Kruger effect is hard at work in this industry, and for all the vendors reading this who “don’t know” if their solution is half-baked, just release a spoof bounty program and you’ll find out. Open it to everyone in the world like we did, with no lock-out periods, and in a web browser where the camera feed is most vulnerable. If your tech can’t defend a white-hat bounty program, how can you pretend it can secure real users against real attackers?
The other significant difference between our technology and others in the market, besides our Liveness, is that we have true 3D Face Matching. Similar to what Apple uses in Face ID, our 3D FaceMaps contain about 100x more data than 2D photos or video frames. This rich 3D data provides excellent performance for all human skin tones and is how last June we achieved 1:1 & 1:N Face Matching that was 660 percent better than the NIST FRVT algo on the MUGSHOT dataset, and why this year we will be announcing a three-fold increase in accuracy over last year. Simply put, our 3D Matching and 3D:2D Matching is untouchable for any of the 2D tech in the market. And while they inch up in accuracy by a fraction of a percent each year, we have extended our lead to 1900 percent over the best of the best 2D vendors in just 9 months.
To discuss these topics, educate customers, the media, and the public about biometric security and bring transparency to vendor’s exaggerated security claims, we launched www.Liveness.com and www.SpoofBounty.com. I encourage all of the readers of FindBiometrics to visit these sites and reach out to us with any questions or comments.
Mobile ID World: That’s a heavy and clear challenge for the industry, but when the stakes are this high, I think it’s warranted. Kevin, thank you for taking the time to talk to me about this topic. Here’s wishing you good health and safety.
FaceTec: Thank you Peter, we live and breathe biometric security at FaceTec, and appreciate the opportunity to share our perspective with your readership.
(Originally posted on FindBiometrics)
Follow Us