December, 1997

James L. Wayman
Biometric Identification Research Director
College of Engineering
San Jose State University
Prepared under FHWA CONTRACT DTFH61-95-C-00165

In October, 1995, the Federal Highway Administration (FHWA) contracted with San Jose State University to develop biometric identification standards for possible use with the Commercial Driver's Licensing Information System (CDLIS). This project was in response to the 1988 Congressional mandate of the Truck and Bus Safety and Regulatory Reform Act (TBSRRA) (Public Law 100-690, Section 9105) for the development of "minimum uniform standards for a biometric identification system to ensure identification of operators of commercial motor vehicles." It follows significant earlier FHWA studies of biometrics, including a 1990 project by the California Department of Motor Vehicles and the Orkand Corporation which investigated the use of fingerprinting and retinal scanning for identifying commercial drivers. The intent of the 1988 legislation was to promote enforcement of the "one-driver, one-license, one-record" provision of the 1986 Commercial Motor Vehicle Safety Act (CMVSA). It is our intent that the acceptance of this report will place the Secretary of Transportation in immediate compliance with the 1988 TBSRRA legislation mandating biometric standards development for the identification of commercial drivers. It is not the role of this study to advocate the creation of a biometric system implementing these standards for use in the identification of commercial drivers.

Based on our analysis of the House Committee on Surface Transportation Hearings (September, 1987) which lead to the introduction and passage of P.L. 100-690, Section 9105, we believe that the primary intent of Congress was to provide a method of enforcement of the provision in the CMVSA prohibiting the holding of multiple commercial licenses by a single driver. We believe that a secondary intent may have been the detection of counterfeit licenses. In the 9 years since the passage of the TBSRRA, a new problem, that of the fraudulent issuance of a single license to multiple drivers, has surfaced. We believe that a biometric system for the identification of commercial drivers could be an effective means of addressing all of these problems.

We do not believe that Section 9105 limits the development of standards to a predetermined biometric technology, nor do we believe Section 9105 extends to any application beyond commercial drivers licensing. Consequently, this study considered all commercially available biometric technologies for application only to the identification of commercial motor vehicle operators.

The work plan consisted of the following:

1. Review the legislative and research history of this project;
2. Review all currently available biometric identification methods;
3. Review and revise, as necessary, the 1988 Multi-State Steering Committee functional requirements;
4. Establish a methodology for selecting a technology;
5. Select candidate technologies;
6. Determine, for candidate technologies, which standards exist and which need to be developed;
7. Propose standards for the candidate technologies;
8. Outline a biometric identification system for use with commercial drivers;
9. Perform a rudimentary benefit-cost analysis on the proposed system.

0.4 Technology Selection

We determined that any candidate technology must meet three criteria:

1) be claimed by vendors to support all of the required applications.

2) have been used previously in a similar large-scale application for which an independent performance/cost audit is available indicating that the revised functional requirements can be met.

3) be available from multiple vendors supporting a single image collection, compression and storage standard.

We found that the only technology currently meeting all three of these requirements is electronic fingerprinting. We anticipate no change in this situation over the next decade. We believe electronic fingerprinting to be a fully mature technology, capable of meeting the revised AAMVA functional requirements. Further , we find no technical justification for combining fingerprinting with any other biometric technology

Standards are required if a biometric identification system is to operate between states or on a national level. Three standards developed by the Federal Bureau of Investigation (FBI), the American National Standards Institute (ANSI) and the National Institute of Standards and Technology (NIST) currently apply to the use of fingerprinting in large-scale identification applications: the ANSI/NIST Data Format for the Interchange of Fingerprint Information; the FBI's Integrated Automatic Fingerprint Identification System (IAFIS) Image Quality Specification for Scanners; and the FBI's Wavelet Scalar Quantization (WSQ) Gray-scale Fingerprint Image Compression Specification.

These standards were created for "forensic" (criminal investigation) Automatic Fingerprint Identification Systems (AFIS) and, although forming an extremely useful point of departure, cannot be adopted for our use with commercial drivers without extensive review. The primary purpose of forensic systems is to allow the matching of partial "latent" prints, as left at a crime scene, with previously sampled prints from a criminal population, usually rolled onto inked "ten-print" cards. The emphasis is toward identifying every possible candidate print, even if intervention by human experts is required.

In "civilian" (non-forensic) applications, the emphasis is on identifying matches without human intervention and only when the evidence is conclusive, even at the cost of occasionally missing a possible candidate. Only full prints acquired from one or two fingers placed directly on an electronic imaging scanner, not latents, are used, and human intervention occurs only when the computer match on all prints is so conclusive as to constitute evidence of willful fraud.

There are at least four standards required for the application of fingerprinting to commercial drivers:

1. Finger selection
2. Image quality
3. Compression method and ratio
4. Data format

If one application of the biometric system is to be "roadside" identification of the commercial driver, the fingerprint must either be placed on the driver's licensing document or be available using "real-time" electronic transfer from a centralized database. We believe that the placement of the biometric on the licensing document is not secure against professional counterfeiting, even if encryption is used. Consequently, "roadside" applications will require "roadside" data transmission capability. Interstate applications of "roadside" identification will require the development of a fifth standard, one for "feature extraction."

This report only proposes to the Federal Highway Administration reasonable standards such that the Secretary of Transportation will be in compliance with Section 9105 of the TBSRRA. We suggest that the adoption of such standards be done by the American Association of Motor Vehicle Administrators (AAMVA) through their "best practices" procedures, with any modifications as required.

In May of 1997, seven states collected fingerprints for actual or possible use in their driver's licensing programs. California, Alabama and Hawaii collected right thumbprints. Florida collected left thumbprints. Texas collected both thumbs. Colorado used the right forefinger. Georgia collected both forefingers. As of this writing (October, 1997), both Florida and Alabama have suspended their fingerprint collection efforts.

While it is clear from our study that large-scale identification systems require two fingers, there is no clear choice of which fingers should be used. Thumbs are larger and contain more information. Forefingers are easier to present (ergonomically) and are slightly more varied across the population. We have no scientifically-based information regarding error rate differences among fingers.

Some people, those in social service work for instance, have suggested that the act of fingerprinting a thumb carries a connotation of criminality. For this reason, social service systems universally use forefingers. For technical reasons related to expected false match error rate as discussed in this report, the CDLIS application will require two prints to avoid "candidate lists" (false matches) when matching fingerprints across the current database of 8.5 million licensed commercial drivers. Such candidate lists require human intervention in the decision process and can severely impact the throughput rate of an identification system. Our recommendation is that AAMVA should determine, based on current state use, whether the standard should be for both thumbs or both forefingers.

The Criminal Justice Information Services "Interim IAFIS Fingerprint Image Quality Specifications for Scanners," CJIS-RS-0010v4, Appendix G, (included in this report as Appendix G) specifies requirements for signal-to-noise ratio, gray scale resolution and histogram, modulation transfer function and geometric distortion for fingerprint images scanned into an AFIS. Notably missing from Appendix G are standards for image resolution and size. The resolution standard of 500 pixels per inch is actually included in the ANSI/NIST "Data Format for the Interchange of Fingerprint Information" standard, included in this report as Appendix I. There is no size standard.