IN THE PIPELINE: Fingerprints May Be Key To PC Security By Donna Fuscaldo 05/21/2002 Dow Jones News Service (Copyright (c) 2002, Dow Jones & Company, Inc.) Of DOW JONES NEWSWIRES NEW YORK -(Dow Jones)- Move aside, username and password. Semiconductor makers have jumped on the security bandwagon with a new generation of chips that can read a fingerprint to verify a computer or device user's identity. The semiconductors are about the size of a quarter, and can be used in lieu of, or in concert with, passwords. Only people whose fingerprints match those in a database can gain access to devices using the chips. At a time when security is paramount these chips are at the vanguard of a science - known as biometrics - that's designed to make database theft, hacking and other crimes far more difficult. Currently, fingerprint scanning chips are most commonly found in computer mouses and keyboards, or in stand-alone devices connected to computers. But companies like STMicroelectronics NV (STM) and privately held Veridicom Inc. believe they have a huge advantage over rival fingerprinting technologies like optical scanning and traditional ink. That's because silicon chips are always getting more compact, and can be embedded into small devices like cell phones, computer mouses, PDAs and smart cards. Chips made by STMicroelectronics and Veridicom already have found their way into laptops from MicronPC LLC, Samsung Corp., NEC Corp. (NEC) and Acer Inc. The NEC laptop, which uses the Veridicom chip, is only sold overseas at the moment, as is Samsung's notebook, which uses ST's chip. MicronPC's and Acer's can be purchased in the U.S. In the case of MicronPC, the privately held computer maker teamed up with ST to create a laptop mainly for the U.S. government's civil defense department and education department, but also geared toward small and medium size businesses. ST's product is called the TouchChip. Jay White, manager of the portable product group at MicronPC, said the company tapped ST because it was one of the only chip makers with a hardware and software application that works at the boot-up level, as opposed to once the computer is already started. MicronPC is only using the TouchChip in its TransPort G3X laptop, which it rolled out in March. But White said the company, which is a big supplier to the government, hopes to incorporate the chip across its product lines. "This is the type of feature we are making standard in the next three to six months, " White said. Standard Equipment In 10 years, predicts Brian Ruttenbur, an analyst at Morgan Keegan & Co., fingerprint chips will be standard in all computers - the way mouses are. Still, some chip companies aren't seeing their fingerprint chips make it into laptops at the moment. Infineon Technologies AG (IFX) said it believes its customers aren't incorporating its chip into laptops because if the technology fails, it will be the difference between fixing a peripheral as opposed to the entire laptop. There are other concerns. What if fingers are too oily or dry, or have cuts or abrasions? Given those conditions, chips may not be able to read fingerprints, said Anil Jain, a computer science professor at Michigan State University who studies biometrics. That could result in a false verification accept, where it recognizes someone else's fingerprint, or a false rejection. "The main problem beside cost is performance," Jain said. "That's where we are sitting on a bubble, because the systems don't perform as well as they often claim." According to the professor, the price of the chips will have to come down for the technology to be adopted by the masses. "Price serves as a differentiator since many companies are making the chip," said Jain. "Right now you can buy a biometrics laptop that has a fingerprint embedded in it for an additional cost of $100. The question is will the average customer like to spend $100 for the feature." To combat failure rates, MicronPC's White said the company requires a user to register multiple fingerprints during the installation process. He declined to comment on how much the chip costs. While ST was also mum on the current pricing of its TouchChip, Alan Kramer, who heads up the TouchChip division at ST, said the goal is to get the price in the $20 range. "Once the market takes off and there's mass production...we will have a $20 chip that's able to identify with high security, conveniently," he said. Seen As $2 Billion Industry Using a fingerprint to gain access to a computer represents the largest revenue opportunity for ST and its silicon peers as they venture into the biometrics market. The industry is estimated at about $200 million today, but should climb to $2 billion in 2006, according to the International Biometric Industry Association. Still, ST sees even more uses for its TouchChip. If the company has its way, people someday will be using it to open doors and even start cars. "Ultimately we hope to drive the technology forward to the point that it's kind of a universal key and becomes central to people's everyday lives, like watches and cell phones," said Kramer. "If we succeed in that we will have a significant market." Revenue from its TouchChip is only a tiny portion of ST's $6.36 billion total sales. But by investing in the technology today, Kramer expects the company to benefit once the market takes off. Eventually, it will "mark a major new form of silicon revenue and will become significant," he said. One of the other applications ST is eyeing with its TouchChip is for authentication services, such as digital signatures. According to Kramer, a major problem with e-commerce is fraud. "Someone may buy something and then deny they bought it. Since the whole system to prove a purchase is based on signatures, when the merchant doesn't have one they lose the revenue," he said. Indeed, Morgan Keegan's Ruttenbur said less than 1% of Internet transactions are fraudulent. With biometric devices like a fingerprint chip, credit card companies and merchants can trace a purchase back to the individual, he said. In the case of e-commerce, the fingerprint would act as a signature. The chip would not only be embedded in the computer or devices attached to the computer, but also in mobile devices like cell phones and PDAs. In fact, ST plans to start testing a mobile TouchChip product by the end of the year. The company is also rolling out a pilot in stores in the third quarter where consumers can sign a credit card slip with their fingerprint. Additionally, Kramer said ST has received interest from the medical community, which is grappling with how to securely post medical records online. Another market that is becoming viable for ST's fingerprint chip is national identity cards. The chip maker completed a pilot program with the Malaysian government last year, which was looking for a national ID card that could ensure a person's identity matches what's on the card. Using the TouchChip, the Malaysian government issued ID cards to a portion of its citizens that store a person's fingerprint on a chip embedded on the card. To accurately identify a card holder, the Malaysian police were equipped with handheld devices that not only read the fingerprints on the card but also incorporated a fingerprint chip so the police could get a real-time fingerprint and match it to the one stored on the card. Since finishing the pilot the Malaysian government has agreed to use ST's TouchChip in a national ID card that the government will issue to all of its citizens in the next six years, said ST's Kramer. Currently, 600,000 cards have been issued, with 19 million more to go. While a national identity card would raise all sorts of privacy issues in the U.S., Kramer said in the case of Malaysia, the fingerprints aren't kept on a central server but rather on the card, which limits the breaches in security and privacy. "Think of the fingerprint as the PIN," Kramer said. "If you lose the card no one else can do anything with it. With other technologies like face recognition there's a central database that the image is compared to." Currently the Malaysian government is the only one in full deployment of the TouchChip for an ID card, but Kramer said ST is currently in pilots with China and Hong Kong. -By Donna Fuscaldo, Dow Jones Newswires; 201-938-5253; donna.fuscaldo@dowjones.com Copyright © 2000 Dow Jones & Company, Inc. All Rights Reserved.