Biometric ID for first responders could help police and firefighters better respond to emergencies. Those authentication technologies, however, come with risks and challenges, according to a new draft report from NIST.

In “Using Mobile Device Biometrics for Authenticating First Responders,” NIST’s National Cybersecurity Center of Excellence says that as more public safety organizations (PSOs) adopt smartphones and tablets, authentication requirements meant to safeguard sensitive information — such as entering a complex password — can hinder access.

“Many PSOs are looking towards mobile biometric solutions to authenticate their users efficiently,” NIST says. “Before adopting these solutions, PSOs must make informed risk decisions on their use and deployment.”

Latex gloves can make use of fingerprint biometric authentication impossible, while medical and firefighting masks hinder use of facial recognition

One potential challenge to biometric ID deployments for first responders involves the specialized equipment they use while rescuing people and performing other emergency duties. As the report puts it, those workers often must “wear various forms of personal protective equipment (PPE) that may reduce the effectiveness of biometric authentication methods or preclude their use entirely.”

Biometric ID for first responders not without pain points

For instance, latex gloves can make use of fingerprint biometric authentication impossible, while medical and firefighting masks hinder use of facial recognition. “PPE requirements for a given public safety user population must be considered when selecting biometric authentication methods,” the report says. “Accumulated dirt or other materials on fingers may also complicate fingerprint image capture.”

The report goes on to advise that first responders “adopting biometric authentication should identify and implement backup authentication factors such as memorized secrets that can be used when operational considerations preclude the use of biometrics. Most commercial mobile devices enable users to enter a PIN or password in lieu of using a biometric to unlock the device, for example.”

Another consideration concerns shift work and sharing of biometric-enabled devices — common among police, firefighters and emergency medical technicians. Sharing, of course, can present security and privacy concerns, but the NIST report offers some possible solutions.
For instance, “Google’s multi-user support provides biometric device unlock for all users,” the NIST report notes. “However, since the entire biometric system is implemented on the device, each user must individually enroll their biometric information on the device. Biometrics cannot be provisioned to the device using a mobile device management (MDM) system.”

Additionally, Google’s Android supports ephemeral user profiles, which the report describes as “temporary user profiles that are added to the device and then deleted when the device is rebooted or switched to a different user profile. An MDM system could dynamically provision an ephemeral user profile along with any required apps and credentials to a shared device to support any number of users, circumventing the limited number of user profiles commonly supported on devices.”

Even so, integration of such capabilities into devices is not yet complete, NIST said.

Biometric ID future for first responders

The report strikes a cautiously optimistic tone when it comes to ongoing progress in biometric ID for first responders — for instance, via wearable technology and ever more sensitive facial recognition gear that can take more accurate three-dimensional measurements of users’ faces. Voice, gait, hand geometry and keystroke biometrics also could help with first responder ID and authentication in the coming years — though, the report cautions, much research and testing remains to be done.

“Another approach is to use fused biometrics—collect and use multiple biometrics,” the report adds. “Many biometric fusion schemes have been and continue to be developed and tested. The challenge for fused biometrics is learning what traits to fuse, when to fuse the traits, and how to fuse the traits to achieve the best overall results.”