PRACTITIONER’S ID AND COVID-19: NOTE OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES1 DECEMBER 2020 Context Across the globe, countries have leveraged foundational identification (ID) systems2 as part of their COVID-19 pandemic response and to transition to online service delivery. Where inclusive and trusted ID systems with near universal coverage are already in place, governments have used these to streamline or automate the registration or targeting process for emergency social assistance. In Chile, the government made payments worth US$60 under the “Bono COVID-19” initiative directly to the bank accounts of 2.7 million vulnerable people—predominately informal workers. These payments were made possible by the national ID-linked basic bank account “Cuenta Rut.” People have also been able to verify their eligibility online using their unique ID number and date of birth. Furthermore, where ID systems provide a means of digital authentication, countries are better able to continue delivering services remotely and online; in India, for example, the government launched an emergency cash transfer with the objective of providing three monthly payments to 200 million women. The government managed to rapidly deliver the payments to the bank accounts of beneficiaries because these accounts were linked to their Aadhaar (ID) number.3 At the same time, the pandemic has disrupted core services, including the normal operation and use of ID systems. Physical distancing and self-isolation requirements—among other measures to prevent the spread of the virus—have reduced or shut down many operations across the public 1 This note was prepared by Julian Najles and Sanjith Sundaram as part of the World Bank Group’s Identification for Devel- opment (ID4D) initiative that uses global knowledge and expertise across sectors to help countries realize the transfor- mational potential of digital identification systems to achieve the Sustainable Development Goals. It was made possible through the generous support of the partners of the ID4D Multi-Donor Trust Fund. This note benefited greatly from the inputs and reviews of World Bank Group staff, including Jerome Buchler, Julia Clark, Marie Eichholtzer, Victoria Esquivel Korsiak, Jonathan Marskell, Anna Metz, Anita Mittal, and Christopher Tullis, and was prepared under the supervision of Vyjayanti Desai. In addition, this note would not have been possible without the insights and feedback provided by Luis Bolanos (Costa Rica), Daniela Rodriguez (Ecuador), Linda Amaya (El Salvador), Claudia Araya (Chile), Melissa Espinal (Honduras), and Luis Felipe Murcia Guerrero (Colombia). 2 Foundational ID systems are those intended to provide general-purpose identification to the broad population, and typ- ically include national ID and civil registration systems, and population registered. For more, see the ID4D Practitioner’s Guide at https://id4d.worldbank.org/guide. 3 World Bank (2020a). and private sectors. Many governments have only allowed locally defined essential services (e.g., health services, law enforcement, grocery stores, etc.) to continue operating, often with additional restrictions such as limits on the number of people and on opening hours. For example, evidence from across the world shows that the number of births, deaths, and other vital events being registered has dropped.4 These low levels of birth registration have the potential to create a generation of ‘invisible’ children, while low levels of death registration undermine efforts to understand the full extent of the deaths caused by COVID-19. In light of these challenges, many countries have adopted strategies to restart registration and authentication services—or to accelerate the development of ID systems for use in remote service delivery—with safety measures in place to reduce the risk of virus transmission. This note provides examples of these safety measures and protocols and practices from seven countries,5 with the goal of sharing knowledge and experiences. It does not aim to provide recommendations or endorsements. Countries are encouraged to consult their local health authorities for official guidance on protocols and standards in their context, including parameters to guide decisions on whether to continue operations. Typology of Hygiene Measures for Identification Systems Countries have developed or considered a variety of strategies to mitigate the risks during enrollment and use of ID systems. These can be grouped into three main categories: 1. Developing guidelines and protocols on safety at registration centers and cleaning of equipment that is handled, such as biometric capture devices (i.e., changes in business processes); 2. Exploring contactless devices for biometric enrollment and authentication; and 3. Exploring options for remote enrollment (i.e., devices that can capture biometric and biographic data without physical presence at an office or center). Based on ongoing experiences in seven countries with COVID-19 guidelines, this note focuses on the first category and presents key considerations for implementing safety and hygiene measures for ID registration and use. It explores emerging norms and standards, including the development of new procedures to increase safety at registration sites and cleaning biometric equipment. All measures adopted should be made in consultation with public health experts and be appropriate to the local context, including requirements for the specific devices being used in the case of biometrics. The second two categories (contactless devices and remote enrollment) are also being explored by some countries. However, these measures are still in very nascent stages and thus far there is not enough evidence that they are reliable, accurate, and ready for widespread adoption for national-scale identification systems. The annex provides an early analysis on the maturity of contactless fingerprint recognition, risks and challenges that could emerge, and issues that need to be considered in its adoption. 4 United Nations Legal Identity Task Force (2020b). 5 Costa Rica, Chile, Ecuador, Honduras, India, Colombia and El Salvador. 2 id4d.worldbank.org Developing Safety Protocols Governments and international organizations6 have been defining policies and recommendations to ensure that ID- related activities, including registration and authentication, follow local health authorities’ guidelines to limit the spread of the pandemic. This includes defining how to go back to work, the number of people allowed at a time at offices and registration sites, site cleaning protocols, the adoption of alternative methods for performing registration and authentication, and measures to ensure that critical ID-related services are inclusive of vulnerable groups. While the precise measures adopted will vary significantly by local context, countries could consider the following topics when drafting safety protocols: 1. Adapting or limiting services: Countries have established concrete and clear protocols on how to provide services during the emergency (e.g., ID registration and authentication, and if applicable, birth, marriage, and death registration). These may include treatment and handling of supporting documents, collection of biometric data (e.g., fingerprint, facial, and iris) and usage of authentication methods that involve physical contact with devices (i.e., should these be suspended during the emergency? Is it possible to use alternative methods that limit physical contact?). In addition, guidelines include which noncontact services are available and how to access them (e.g., online services, online and telephone appointments). For instance, El Salvador allows individuals to make appointment by phone, and Colombia has enabled 1:1 facial recognition to authenticate people when they come to collect ID cards to avoid touching devices. After finding that most of the time during registration is spent collecting demographic data, the Philippines, as part of the launch of the Philippines Identification System (PhilSys), has instituted a multi-step approach to enrollment, collecting demographic data first by home visits before later collection of biometrics at registration centers. Setting specific appointment times for registration also provides local governments with predictability to reduce crowd sizes and adhere to social distancing requirements. 2. Extending or waiving expiration dates and registration deadlines: Countries can establish policies to extend the validity of identity credentials or waive their expiration to reduce contact while allowing individuals to continue using credentials. For example, in March 2020, Chile extended the validity of the ID for one year for foreigners and until October 2021 for nationals. 3. Procedures for suspected positive cases of COVID-19 among operators or enrollees at offices or other enrollment sites: Refers to guidelines on response, reporting, and coordination with local authorities on suspected cases of COVID-19. El Salvador, for example, has established that suspected cases must be immediately reported to the Ministry of Health and must be isolated in a room to reduce contact until medical personnel assess the case. 4. Communication plans during the emergency: Countries can establish channels for communication and defined messages for workers and applicants inside and outside offices for each phase of the emergency. For instance, El Salvador’s protocol includes an internal communication campaign to inform workers and applicants about the measures adopted. In addition, it mandates operators to receive training to ensure compliance with hygiene measures. 5. Procedures for mobile registration campaigns: Registrations through mobile campaigns are critical for providing services to vulnerable individuals and communities who cannot physically access registration offices (e.g., elderly people, persons with disabilities, and women with small children). Performing registration campaigns outside of offices using mobile kits requires the same or potentially more safety measures, particularly when entering people’s homes. Countries have established dedicated procedures for registration, cleaning devices, and protecting operators and users during these mobile kits-based registrations. For instance, Costa Rica and Chile have designed dedicated procedures to conduct mobile registration campaigns while ensuring people and operators’ safety. Likewise, the Philippines has tried to use outdoor spaces (e.g., covered basketball courts) as registration centers, in 6 See, for example, the guidelines released by the UN Legal Identity Task Force, available at https://unstats.un.org/legal-identity-agenda/docu- ments/COVID-19-Guidelines.pdf ID AND COVID-19: OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES 3 order to allow for more air circulation. On the contrary, Colombia has opted to suspend mobile campaigns during the emergency. 6. Prioritizing vulnerable populations and urgent cases in offices: Countries can establish procedures to prioritize services and registrations to reduce contact time and exposure in offices of vulnerable population including, elderly, persons with disabilities, women with small children, or other populations at higher risk from COVID-19, or in urgent need. Increasing Safety at Registration Sites As part of the policies and protocols discussed above, governments have developed guidelines to keep registration sites clean and disinfected and to protect people—both staff and members of the public—while providing services, in coordination with local public health authorities. This includes adopting new health measures and altering procedures for various activities to follow health guidelines, including opening schedules, controlling the number of people allowed at a time at offices and registration sites, cleaning and hygiene protocols, and alternative methods for performing registration and authentication. Many of these measures are similar to procedures at other public or government spaces, while others are adapted specifically to the ID context. All guidelines reviewed for this note have included, at a minimum, the following measures: 1. Social distancing: Basic measures include increasing physical distance between operators and particularly between operators and enrollees, and for people waiting to receive services (e.g., see photo 1 below). Some ID offices (e.g., Ecuador) have created physical barriers between operators and enrollees (e.g., glasses or plexiglass shields). Photo 1: Registration line in Honduras Credit: Honduran National Registry of Individuals. 2. Reduced operating hours: ID offices have reduced working hours to lower exposure of the staff, focusing only on urgent cases to avoid crowds. Some countries have done this gradually according to the phase of the emergency declared. For instance, Chile reduced working hours to protect people and operators, and has been extending hours according to the phase of the emergency. 4 id4d.worldbank.org 3. Maximum number of people allowed indoor at a time per office/site: Similarly, countries have taken measures to reduce exposure of the staff and enrollees by limiting the number of people inside offices or registration points. The number varies depending on the offices capacity and the number of operators in each office. Once the capacity is met, people wait outside, maintaining a physical distance to avoid crowds inside the room. For example, India mandates that only one person requiring services can enter the office at a time. 4. Registration based on online or telephone appointments: Countries have established online or telephone appointments to reduce exposure for staff and individuals. For instance, in Colombia, individuals are required to book an online appointment before attending the office to perform a registration. In the Philippines, enumerators who are visiting the homes of priority registrants (heads of low-income households) to collect demographic data are also setting up appointments for biometric capture and validation of supporting documents. 5. Cleaning office space and surfaces: Countries have defined a maximum time between cleaning rounds (e.g., every three hours), the type of products to be used (e.g., cleaners containing at least 70 percent alcohol, hypochlorite, ammonium compounds), surfaces to be disinfected (e.g., tables, chairs, floors, glasses, plexiglass shields), and the installation of hand sanitizers in offices. For example, Honduras established that each operator is responsible to clean their workspace at least three times per day. In the Philippines, operators must clean biometric capture devices and any other equipment touched by applicants (e.g., a chair) after every applicant. 6. Requiring Personal Protective Equipment (PPE): Countries have established the type and quality of PPE that should be provided to workers (e.g., masks, face shields, gloves, shoe protectors) and if it will be mandatory for users. All the countries analyzed have mandatory PPE for operators and users. Photo 2: At-home visit to collect demographic data in the Philippines Credit: Philippines Statistics Authority (PSA). 7. Promote behavior to reduce transmission: Countries have promoted behaviors such as handwashing, circulating in the office (e.g., minimal distance in elevators), covering one’s mouth when sneezing or coughing, avoiding face touching, contactless greetings (e.g., avoid kisses and shaking hands), usage of masks and PPE, and good ventilation systems. In this regard, international guidance from the World Health Organization (WHO)7 and local guidance from the Ministry of Health should be observed. Ecuador, for example, recommends workers to avoid shaking hands and sharing food in work spaces. 7 WHO advice to the public on the coronavirus disease (COVID-19) pandemic is available at https://www.who.int/emergencies/diseases/nov- el-coronavirus-2019/advice-for-public. ID AND COVID-19: OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES 5 Safe Use and Cleaning of Biometric Devices Biometric technology that requires physical contact to use—e.g., common fingerprint or iris scanners—requires special precautions to sterilize the equipment. In addition, some countries have opted to temporarily suspend the use of biometric devices to capture fingerprints or irises for registration and/or authentication (e.g., the United States, India, Egypt, and Syria). For countries that continue to use the technology, the following section presents some general guidance on using and cleaning biometric devices based on current practices and vendors’ recommendations; however, authorities should contact the device vendor for precise and accurate recommendations—especially in terms of the conditions of their warranty, as the use of particular chemicals may void that—and develop guidance in cooperation with the Ministry of Health. Best practices when using biometric devices Overall, good practices include the following: 1. If an individual is visibly sick or with symptoms, have them come back another time for biometric data capture, if possible. Report the case to local authorities. 2. Require or encourage individuals to wash and/or sanitize their hands with alcohol-based products before and after touching a device. 3. If an individual is being assisted by an operator to have their biometrics captured and the operator is touching the individual in any way, the operator should wear gloves (latex or polyethylene are recommended instead of cloth, wool, or similar breathable material). 4. The areas around the fingerprint scanners or other biometric devices should also be sanitized. 5. It is recommended that the scanner be cleaned before and after each registration using solutions recommended by the vendor. Cleaning devices The appropriate method for cleaning and sanitizing biometric devices depends on the modality (e.g., fingerprints, iris), type of device (e.g., fingerprint, iris, or pad devices), and the vendor. Certain practices (e.g., applying specific types of chemicals) may void a vendor’s warranty. In most cases, the basic steps to clean a fingerprint device are: 1. Power off the device. 2. If using a wipe, wipe the equipment housing the device first and then clean the sensor surface or the platen (i.e., the surface where enrollees place their fingers on a fingerprint scanner) and/or other parts of the device that are in contact with the skin. If using a spray, spray on a microfiber cloth and then use the cloth to wipe the surface and device. (Some vendors recommend spraying directly onto a device or platen; others do not recommend use of a microfiber cloth due to contamination risks. Specific guidance should be requested from relevant vendors.) 3. After sanitizing the surface of the device that comes into contact with skin, allow time for the sanitizing product to evaporate (some vendors indicate around four minutes). Alternatively, if it is recommended by the vendor, a clean microfiber cloth may be used to dry the touch surface. 4. If the sanitizing product does not evaporate, clean the excess moisture using a dry microfiber (soft) cloth. 5. Connect the device to the power source again. 6 id4d.worldbank.org Some biometric devices use a removable silicone membrane on the top. If this is the case, it should be replaced after a certain number of captures (some vendors recommend doing it after 8,000 captures). Guidance on how to replace the membrane should be provided by specific vendors (see Bibliography for some examples). Additional considerations Recommendations to clean and handle devices vary widely depending on technology and the vendor. When establishing cleaning guidelines, countries should consider the following: • Some vendors indicate that using certain liquids (e.g., alcohol-based) would void the device warranty. • Some vendors sell their own cleaning products for their equipment. Operators can check with vendors for specific guidance on the type of product to procure for cleaning. • Some vendors advise to not rub or press the surface of fingerprint devices with any abrasive material, including paper. • If devices were disconnected for a long period due to a lockdown, device settings should be checked before reopening offices to avoid mistakes in registration (e.g., recording the incorrect date). Likewise, batteries should be checked if devices have not been used. If any problem is encountered, a picture of the device should be taken before sending it to the vendor. • Since devices must be clean and dry before and after each registration, this can delay registration times, and service standards or targets should be adjusted accordingly. Conclusion Foundational ID systems are critical infrastructure for service delivery, development planning, and recovery during the COVID-19 pandemic and future emergencies. As highlighted by the United Nations,8 it is therefore important that countries develop plans to ensure the reasonable continuation of ID and civil registration services in case of both acute and prolonged emergencies. The experience from the countries listed in this note provides a starting point for developing such contingency plans and safety protocols to protect people during ID registration and when using ID to access services. At all times, countries should work with local health authorities and relevant experts to design their own strategies, analyze the risks, make decisions, and define measures that protect the safety of staff and the public. 8 United Nations Legal Identity Task Force (2020b). ID AND COVID-19: OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES 7 Bibliography Aratek addresses the COVID-19 Pandemic. https://www.aratek.co/aratek-addresses-the-covid-19-pandemic/ Atick, Joseph. 2020. The Impact of COVID-19 on Identity Management: A collective perspective. https://www. id4africa.com/2020/files/Webinar_Executive_Summary_EN.pdf Bayometric How to Disinfect Fingerprint Scanner: Keep Coronavirus Off the Fingerprint Sensor Surface. https://www. bayometric.com/keep-coronavirus-off-the-fingerprint-sensor-surface/ Civil Registry and Identification Service. 2020. Plan operativo Corona virus—COVID 19. Civil Registry and Identification Service. 2020. Protocolo N° 3 Contingencia COVID-19. Colombian National Civil Registry. 2020. Circular 55, Apertura de servicios de registro civil e identificación. https://www.registraduria.gov.co/Esquema-de-Servicios-29290.html Colombian National Civil Registry. 2020. Protocolo De Bioseguridad Para La Prevención De Transmisión de la COVID-19. https://www.registrocivil.gob.ec/wp-content/uploads/downloads/2020/05/PROTOCOLO-PARA-LA-RE ANUDACIO%CC%81N-DE-LOS-SERVICIOS-CGS-u%CC%81ltimo-1-4-signed.pdf Dataworks plus. 2020. Best Practices for Sanitizing Scanners to Protect Against COVID-19. https://www.pachiefs.org/ assets/docs/CentralBookingTrainingDocuments/Best%20Practices%20for%20Sa nitizing%20Scanners%20to%20 Protect%20Against%20COVID.pdf El Salvador Congress. 2020. Resolucion 599. https://www.transparencia.gob.sv/institutions/indes/ documents/357291/download General Directorate for Civil Registration, Identification and Certification. 2020. Protocolo de reanudación de los servicios de la Dirección General de Registro Civil, Identificación y Cedulación. https://www.registrocivil.gob.ec/wp-content/uploads/downloads/2020/05/PROTOCOLO-PARA-LA-RE ANUDACIO%CC%81N-DE-LOS-SERVICIOS-CGS-u%CC%81ltimo-1-4-signed.pdf General Directorate for Civil Registration, Identification and Certification. 2020. Resolución 29. https://www. registrocivil.gob.ec/wp-content/uploads/downloads/2020/03/Resoluci%C3%B3n-No.-029-D IGERCIC-CGAJ-DPyN- 2020-Ampliacion-vigencia-de-cedula.pdf General Directorate for Civil Registration, Identification and Certification. 2020. Disposiciones generales de Prevención y protección. HID, Cleaning and disinfecting fingerprint devices. https://www.hidglobal.com/sites/default/files/resource_files/cid- bio-fingerprint-devices-cleaning-guide-en.pdf How to clean and disinfect a secugen fingerprint reader. https://secugen.com/support/how-to-clean/ https://www. hidglobal.com/sites/default/files/resource_files/cid-bio-fingerprint-devices-cleaning-guide-en.pdf Integrated Biometric. 2020. Cleaning & Sanitizing IB Fingerprint Scanners. https://integratedbiometrics.com/wp-content/uploads/2020/03/IB_Cleaning-Sanitizing-Scanners_ENG.pdf Muhlbauer. 2020. Protocolos y medidas sanitarias para la prestación del servicio de registro, emisión y entrega de DUI, ante la emergencia por COVID-19. National Registry of Persons. 2020. Protocolo de Bioseguridad por motivo de la pandemia COVID-19. 8 id4d.worldbank.org The Netherland National Office for Identity data. 2020. Frequently asked questions and answers. https://www.rvig.nl/documenten/publicaties/2020/03/18/faq-voor-gemeenten-i.v.m.-coronavirus-COVID-19 Procare support. How do I clean the fingerprint reader? https://procaresupport.com/how-do-i-clean-the-fingerprint- reader/ Secure Outcomes Inc. 2020. Suggestions regarding the disinfection of fingerprint scanners. https:// secureoutcomesinconsideation c.com/2020/03/25/suggestions-regarding-the-disinfection offingerprint-scanners/ Start link. 2020. How to disinfect scanner in COVID-19 outbreak? https://www.starlinkindia.com/blog/how-to- disinfect-fingerprint-scanner-in-COVID-19-outbreak/ Unique Identification Authority of India. 2020. Corona Advisory. Available at: https://uidai.gov.in//images/resource/ Corona_Advisory_03_2020.pdf United Nations Legal Identity Task Force. 2020a. Maintaining Civil Registration and Vital Statistics during the COVID-19 pandemic. https://unstats.un.org/legal-identity-agenda/documents/COVID-19-Guidelines.pdf United Nations Legal Identity Task Force, United Nations Statistics Division. 2020b. Civil registration: Maintaining international standards in emergencies. https://unstats.un.org/legal-identity-agenda/documents/CR-ER.pdf World Bank. 2020a. Social Protection and Jobs Responses to COVID-19: A Real-Time Review of Country Measures available at http://documents1.worldbank.org/curated/en/454671594649637530/pdf/Social-Protection-and-Jobs- Responses-to-COVID-19-A-Real-Time-Review-of-Country-Measures-July-10-2020.pdf World Bank. 2020b. Terms of Reference for Data Collection, Development Impact Evaluation (DIME). 2020. Internal publication. ZKTeco. How to clean your fingerprint sensor https://zktecousa.com/how-to-clean-your-fingerprint-sensor/ ID AND COVID-19: OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES 9 Annex 1: Country Overview All countries examined for this note have drafted and implemented policies and protocols to adapt registration procedures in the context of the COVID-19 pandemic, as presented in Table 1. Most of them are implementing clear guidelines to clean devices before and after each registration or authentication, and only one is using contactless technology for authentication when collecting ID cards. The following chart summarizes the findings from guidelines analyzed. For examples of guidelines developed by specific countries, see the Bibliography section. Table 1: Analysis of countries’ hygiene measures and procedural changes in response to the COVID-19 pandemic Changes in Frequency of authentication Extension of ID Country device cleaning Measures to avoid crowds procedures cards validity Costa Rica Not specified Not specified No Yes Chile Before and after Online appointments + No Yes each registration limited number of (uses match- individuals per office on-card authentication) Ecuador After each Online appointments No Yes registration and + limited number of authentication individuals per office Honduras At least 3 times Limited number of No Yes—the extension per day individuals per office was already in place before COVID-19 India Before and after Limited number of Yes Not applicable each registration individuals per office (some states banned biometric authentication) Colombia Before and after Online appointments Yes Not applicable each registration + limited number of individuals per office (facial No expiration date authorization on the card in person used instead of fingerprint to collect ID cards) El Salvador Before and after Online and telephone No Yes each registration appointments + limited number of individuals per office 10 id4d.worldbank.org Annex 2: Contactless Fingerprinting Technologies The pandemic has increased global interest in contactless biometric technologies. This includes well-established contactless biometric technologies such as voice, iris, and face recognition, as well as contactless fingerprinting technology, which is relatively new.9 While conventional fingerprint scanners require physical contact between a person’s fingers and the scanner, contactless fingerprinting relies on acquisition methodologies that do not require any physical contact with the sensor. This technology has therefore been considered by a number of countries as a possible solution to use fingerprint recognition in the context of the COVID-19 pandemic, due to the following characteristics: • Potential for better hygiene; no physical contact with the device during capture • Possibility of large area image acquisitions • Less vulnerable to fingerprint smudging or slippages • Possibility of a software-based solution (i.e., using a smartphone camera, for example, instead of a specialized device) However, despite these potential benefits, it is not yet clear that contactless fingerprinting technology is ready for use in a national-scale, foundational ID system as a replacement for conventional methods. This annex describes some of the challenges of contactless fingerprinting technology, as well as the results of a recent study evaluating its performance relative to contact-based devices. Challenges compared to conventional acquisition methods The lack of standards for contactless fingerprint technology is the primary burden for adoption. Due to the scale of applications and system requirements, adopting technologies without existing standards could lead to unpredictable outcomes, including performance issues, interoperability concerns, and vendor lock-in. Furthermore—and partly as a result of the lack of standards—there are additional concerns or considerations with contactless fingerprinting, compared with conventional contact-based technology: • Accuracy: While there are commercial deployments in place, there are not enough studies on achievable accuracy levels on a larger population with sufficient diversity in demographics, ethnicity, or age groups—factors that typically account for significant variations in performance within and across countries. • 3D vs. 2D: All contact-based fingerprint capture devices use a flatbed surface for the capture. As the fingerprint is pressed against a flat surface or platen, the three-dimensional finger is converted into a two-dimensional object, clearly distinguishing the features (unique ridges and valleys) of the fingerprint. A “close to the truth” measurement of features is possible through this method. In case of a contactless acquisition, a finger is not pressed against a surface and the image is captured based on the illumination on this 3D object. Photographs of the 3D object are converted to a 2D model (3D to 2D rendering) to extract the fingerprint features, and this step is the primary source of errors causing compromises. Contact capture yields a first-order representation of the image, while contactless yields a higher-order representation due to the image processing applied to the source photograph. Also, the illumination may not be uniform, and the capture quality is a direct function of this. • Interoperability: All conventional biometric applications are designed to handle images from the 2D capture 9 Contactless fingerprinting is possible through a variety of technologies. Some require purpose-built hardware, while some support regular mobile phone cameras for fingerprint image acquisitions. ID AND COVID-19: OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES 11 explained above. There are limited available studies on the interoperability aspects of fingerprints acquired through contactless methods working against conventional systems and databases. For example: How effectively a contactless fingerprint can be used for uniqueness checks/deduplication using a conven- tional Automated Biometric Identification System (ABIS). How the quality checks and 1:1 matching can be performed using legacy biometric software development kits and 2D fingerprint records in the databases. • Steady hands/blurred images: During contactless fingerprint capture using a mobile application, both the phone and the hands are moving, often resulting in blurred images. Contactless fingerprint acquisition usually requires steady hands and could create issues while capturing fingerprint data of older people. • Platform and hardware dependencies: All mobile cameras do not work the same way. There are variables associated with cameras that define capture mechanisms and quality (for example, sensor size, pixel size, aperture, focal length, image stabilization, etc.). Contactless capture applications need to make sure that the operating system and camera interoperability are well tested. The light source (flash) also plays a significant role in the quality of acquisition. • Vendor lock-in: There is no mature open standards for this technology, which makes a relative analysis and selection of solutions difficult. Lack of a standard for formats and interoperability might lead to proprietary solutions and therefore potential vendor lock-in. Significant performance variations are expected between solutions, often forcing the user to stick to one tested product on the same data set. • Longer acquisition times: Contactless technologies take more time to acquire a fingerprint image. The camera specifications, the movement of the object (fingerprint), lighting conditions, etc., contribute to this issue. A longer timeframe can also lead to higher failure to acquire rates. • A narrower range of liveness detection mechanisms: Traditional fingerprint technologies have multiple ways of detecting liveliness of the fingerprint placed on the sensor. Different technologies have different ways of handling this. They also behave distinctively when the same spoof artifact, such as silicon, latex, or wood glue, is placed on the sensor. Touch-based devices have extensive ways of validating liveliness, including measurement of perspiration patterns, subsurface skin features, temperature, and capacitance. Software-based contactless biometric technologies have a narrower range of liveness detection mechanisms, and their efficacy and attack resistance are not yet proven or well understood. NIST—Interoperability Assessment 2019 In 2020, the United States’ National Institute of Standards and Technology (NIST) released a summary of the findings of a study conducted on six commercially available touchless solutions, comparing them with conventional devices.10 This was a contactless-to-contact interoperability assessment evaluating the interoperability of contactless representations with older contact print impressions. In addition, the study tested the hypothesis that multiple finger matching can significantly improve contactless fingerprint matching error performance. During the study, fingerprints from 200 volunteers were collected and tested against six state-of-the-art contactless solutions (four mobile applications and two hardware-based solutions) and two conventional touch devices (for reference). The contactless solutions tested applied proprietary transformation techniques to generate 2D images as outputs of the 3D capture process. These 2D images were then used with conventional matchers against 2D reference images captured using contact scanners. Later, error rates were evaluated at two operating thresholds. Overall, the study found significant variation between solutions, given the early stage of this technology. Some of the observations were: 10 See https://www.nist.gov/news-events/news/2020/05/nist-study-measures-performance-accuracy-contactless-fingerprintin g-tech 12 id4d.worldbank.org 1. Single fingerprint scanning demonstrated low identification rates (True Positive Identification Rate11—ranging from 20 percent to 80 percent across solutions). 2. Only one hardware-based solution could consistently showcase identification rates of 90 percent or above with various multiple finger combinations. 3. Low False Positive Identification Rates:12 All contactless solutions produced low false positive rates, seldom indicating a match between one person’s scan and another person’s print record. Note that the NIST study was a 1:N identification exercise, applicable to enrollment use cases where the goal is to assure the new record's uniqueness by matching against all the existing records in the system. These results therefore may not extend to 1:1 exercises, which are applicable to authentication use cases where the goal is to match biometric data against a single record to prove that someone is the person they claim to be. Conclusion As articulated above, multiple issues need to be addressed before contactless fingerprinting technologies can be deployed at a large scale with the same performance as conventional methods. The accuracy levels demonstrated by the NIST study are not sufficient to be ready for a typical foundational ID system, particularly for initial “enrollment” or “registration” (1:N) use cases. The study was done on a homogeneous data set, without any demographic, ethnic, or age variations, which means that accuracy levels could be lower in real world scenarios than the laboratory results indicate. Although NIST is currently working on a follow-up analysis and framing detailed procedures for the testing, the results show that performance could vary significantly between solutions and that there is no common benchmark available until a standard for this technology is established. It is also important to note that the study did not evaluate contactless- to-contactless performance (images captured using a contactless device to reference images that were also captured using a contactless device)—these data are essential for attempting any usage of the contactless technology for enrollments on the scale of a nationwide ID system. 11 In the context of registration, a lower True Positive Identification Rate (TPIR) typically means that there are higher chances of a potential match being missed, resulting in duplicate identities being issued, causing significant concerns. 12 During registration, a low False Positive Identification Rate (FPIR) indicates that the chances of a wrongly identified match are minimum, thus reducing the burden on any manual verification systems deployed for reassuring the identification results. However, the larger problem is when the identification system cannot report a potential match. ID AND COVID-19: OVERVIEW OF COUNTRY EXAMPLES IN SAFETY PROTOCOLS AND PRACTICES 13 About ID4D The World Bank Group’s Identification for Development (ID4D) Initiative uses global knowledge and expertise across sectors to help countries realize the transformational potential of digital identification systems to achieve the Sustainable Development Goals. It operates across the World Bank Group with global practices and units working on digital development, social protection, health, financial inclusion, governance, gender, and legal, among others. The mission of ID4D is to enable all people to access services and exercise their rights by increasing the number of people who have an official form of identification. ID4D makes this happen through its three pillars of work: thought leadership and analytics to generate evidence and fill knowledge gaps; global platforms and convening to amplify good practices, collaborate, and raise awareness; and country and regional engagement to provide financial and technical assistance for the implementation of robust, inclusive, and responsible digital identification systems that are integrated with civil registration. The work of ID4D is made possible with support from the World Bank Group, Bill & Melinda Gates Foundation, Omidyar Network, the UK government, the French government, and the Australian government. To find out more about ID4D, visit id4d.worldbank.org. To participate in the conversation on social media, use the hashtag #ID4D. 14 id4d.worldbank.org