Seattle-Based Lender Provides $300,000 To Jump-Start Expansion Strategy, As Company Looks To Increase Footprint Within Casino Industry And Other Verticals
LAS VEGAS, NV: On Tuesday, Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company focused on creating products that link the physical to the digital in order to prevent crime and track criminals and their associates, announced that it had secured an initial round of growth capital from revenue-based financier, Lighter Capital.
“We’re pretty excited about this round,” said Biometrica CEO Wyly Wade. “We are cash flow positive. We have grown more than 20% over the past year and are looking at a more than 25% growth rate over the next 12-18 months, which isn’t always the case in the tech industry for what are effectively early stage companies. We have more than 200 steady B2B customers, including several Fortune 500 companies. We weren’t looking for a large investment at the moment, but we needed some capital to provide impetus to our development strategy. The $300,000 first round of investment from Lighter Capital was a great place to start.”
A unique combination of venture capital and traditional debt, revenue-based financing (RBF) is typically made to growing businesses but always on the basis of strong operational history and recurring revenue. According to Lighter Capital’s Jon Prentice, Biometrica was an ideal candidate for revenue-based financing.
“It made sense to provide capital to Biometrica,” said Prentice. “They’ve shown stability and a positive growth trajectory. We all know that the security industry, especially in the physical-meets-digital world, is poised for exponential growth. Biometrica already has an industry leading solution and is very well-positioned to expand beyond casino and gaming to other verticals.”
Lighter Capital stated that most companies it finances typically returned for more than one tranche as they grew — the average Lighter Capital client receives 1.7 financings.
Last week, Biometrica announced the release of a new version of SSIN, their fully encrypted Security & Surveillance Information Network, the release included a potential game-changer, a secure, convenient mobile application, that will allow authorized users access to convenient, near real-time facial recognition (FR) scans and receive feedback on suspicious individuals or groups that enter their properties.
Over the next few months, the company will release other enhanced features that will give subscribers the ability to run operational real-time FR scans against a law enforcement-verified database of criminals — a database that includes known thieves, drug and human traffickers, sex offenders, gang members, murderers, terrorists and white-collar criminals.
About Biometrica
Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.
To this purpose, the company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above.
Private Investigator License # 1295 [Nevada PILB]
About Lighter Capital
Headquartered in Seattle, Lighter Capital is an online revenue-based lender focused on providing technology companies up to $2 million in growth capital. They have provided more than $35,000,000 in growth capital to more than 100 companies in the six years since inception, with the average loan size being $250,000.
In a rapidly evolving, technology-driven environment, where the IoT is a way of life, the incoming administration faces a number of new challenges, especially from a security perspective. Here are 5 major issues that would need to be tackled.
I. Linking The Physical To The Digital, Using Some Form Of Biometric ID In The United States
Why is this necessary?
In a connected world, where digital meets physical on a constant basis, and cyber-physical systems abound, we’ve got to be able to confirm that someone is who they say they are, both in the physical world and the virtual one.
Whether it’s Customs and Border Protection, or the U.S. military, we’re starting to see some sort of biometric identity requirement being either made available for use, or required. In the case of military, a manual even details the operational use of biometrics across branches, for purposes of checking identification, and confirming you are who you say you are in order to prevent the misuse of things like physical access cards to get you into sensitive facilities.
According to the manual: “Integrating biometrics capabilities enables commanders to focus on joint and combined operations by helping to identify adversaries, allies, and neutral persons while degrading threat networks. Operators currently collect facial images, fingerprints, iris images, deoxyribonucleic acid (DNA) samples, palm prints, voice samples and associated contextual data (i.e. elements of biographic data and situational information) from individuals encountered during operations.”
At the civilian level, programs like TSA Pre✓®, CLEAR, and others are essentially trying to do the same — trying to create purpose-built IDs that they try and expand out, to establish you are who you say you are, and make the process quick and effective.
How would we do it?
There’s a general understanding at various levels of the government that sooner or later, they would have to put in place and accept some sort of biometrics-based applicable national identity system. What that could be is up in the air — but the logical step would be a truly authenticated driver’s license at the state level, which you then sync at the back end through data sharing and a data clearing house.
What the government would almost certainly have to do is pass a REAL ID II of some sort, take REAL ID’s basis — the post 9/11 commission review concept that established minimum security standards for state-issued driver’s licenses — and essentially add biometrics to it. What it would do is ensure there’s deduplication of that data across states in some kind of decentralized way, so we still maintain the sovereignty of our states.
II: Create A Process For Using That Data Across Multiple Functions Across The Government
Why is it necessary?
To create a system of accountability, ensure that the right benefits are going to the right person, and avoid the misuse or wastage of resources. This really should be a logical next step after the establishment of a nationally implementable biometrics-driven identity system. We’ve got a lot of data from other countries, which indicates that implementing biometric IDs for social protection programs, for instance, dramatically improves accountability and auditing, drives down corruption, and produces efficacy in those programs.
I’d really think that should be the way ahead, whether you’re allowing access to a nuclear facility, or implementing Medicare and Medicaid payment distributions.
Identity is the basis for receiving access to benefits for a social protection program, regardless of whether it’s for a defined benefits program or some other means of receiving assistance or aid. If you can’t identify the person you’re providing a service or a welfare check to, how do you confirm the check went to the right person?
You could, for instance, go to an ATM, or you local grocery store or 7/11. But instead of swiping an ATM card, you’d put in an assigned number, or swipe your enhanced license, or scan a barcode on your phone, and then authenticate that by also scanning your fingerprint — that second step is a biometric authentication and there are algorithms that ensure that it is a “live” authentication, that you’re alive.
For now, that fingerprint, in many machines that have biometric readers, matches up to a 12-digit number in the system. In the case of something like a REAL ID II, it would be matched to a fingerprint in the system. This would replace a PIN. For everyone that says it’s not practical, I’d ask you to look at India’s Universal ID system, Aadhaar, which has now enrolled more than one billion people — that’s thrice the population of the U.S. And do remember that this has been made possible in a country where the GDP per capita (accounting for Purchasing Power Parity) is about $6,100/year, as compared to the U.S.’s $56,100. Through Aadhaar, you now have remote, rural villages in India where people’s lives have changed dramatically, because of the ability to access state benefits they previously did not receive for one reason or the other.
III. Updating Our Critical infrastructure, And Securing It, Keeping In Mind It’s Now All Connected
Why Is It necessary?
In a different age, when a lot of our electric grids, highways, dams, transportation systems were being built, each was its own little silo. They weren’t connected in any real sense. In the world we’re hurtling toward, roads will be talking to the street lights, and solar powered cells in the road’s gravel will be charging our autonomous vehicles as they move, the possibilities in our future Smart Cities are endless. You’re already seeing that, we use more and more sensors everyday with traffic lights, intelligent crosswalks, cars that have driverless brake assist systems, or a Smart Grid that allows for two-way communication. It doesn’t make sense looking at spending a trillion dollars on upgrading or updating existing systems, and not keeping in mind that those systems will now be connected in a very fundamental sense, and those connections and networks will feed off each other; that there will be inter-dependability for purposes of functionality.
By putting in place best practices across critical systems. One of the things we have failed to do is roll out just in time manufacturing at the infrastructure development level. In almost all of our major systems, whether computers or cars, we do some form of just in time or lean manufacturing. With infrastructure, it’s different. For instance, we typically end up having a whole bunch of supplies dumped at one end of a road, and those supplies are then worked into the road or roadbed. We’ve got to be able to create a system of tracking those goods, and requesting them on a need-to basis.
I should also mention how a biometric ID helps here. We’re going to be spending a lot of money. Whenever you have a large influx of cash on projects, you should, especially in a world where technology makes things possible, be able to verify identities and resources, create lists of people on projects, and put in place attribute-based access controls that create an audit trail of who accessed what resource and when. It’s not very hard to get hold of a physical card or key to gain access. It’s far more difficult to duplicate a live biometric identity.
Now for the other security aspect of building connected systems: All the connected or networked systems that talk to each other, or feed off each other, need to be able to communicate back to somewhere, to some kind of command center. This means that all those points are opportunities for attacking the whole, or part of that whole. It doesn’t necessarily have to be a cyber attack, though that is obviously a major focus, it could also be a physical attack — you physically enter a place and then cause disruption to the system virtually from the inside. We have to protect our critical infrastructure.
This also means doing things like large amounts of grid modernization. While the central security lines and the backbone of the power distribution center here in the U.S. is very intelligent, or becoming very intelligent, there is a lot of rural power distribution that isn’t necessarily there as yet. It’s expensive to wire large stretches of areas where there aren’t too many people, and there are places where we still struggle with things like bi-directional power. That is a problem area for interconnected systems, and it needs to be tackled.
IV. Creating A Sustainable Social Protection Policy, Keeping In Mind The Changes Technology Will Bring
Why is it necessary?
Technology brings with it great benefits, but it also brings forth new challenges, and planning for them is absolutely critical. We are entering an age when more and more jobs will become automated. We’re entering an era where we might well be eliminating jobs faster than we create them.
There will be a pivotal point soon, when autonomization will inevitably lead to a form of structural unemployment, a situation in which the demand for labor will be exceeded by the supply of labor. And as many studies have found, a higher rate of unemployment has a direct correlation to higher crime, and therefore, an insecure, more vulnerable economy.
Let’s look at a rather interesting example. We have an unfulfilled job need right now in the United States for about 25,000 for-hire long haul, over road truckers. Given the new air quality standards agreed to, and the shortage of workers or job seekers, the over road trucking industry will likely go through a process of autonomization fairly soon. And this might not be too far away.
In October 2016, a self-driving truck, designed by the Uber-owned company Otto, successfully completed a 120-mile beer run between Fort Collins and Colorado Springs. In September 2016, Uber also launched the first of what it says will be a fleet of self-driven cars in Pittsburgh.
In this great piece by Wired magazine, the author writes that Uber or Otto don’t want to put any drivers out of work, and that the truck currently operate onlys “on the highway, where it doesn’t have to deal with tricky variables like jaywalking pedestrians, four-way stops, or kids on bicycles.”
However, this is already a monumental change. At the same time, according to 2014 data, trucking is the most common job in the United States in 29 states. An estimated 80 percent of all communities in the US rely exclusively on trucks to deliver fuel, clothing, medicine, and other consumer goods, even as trucks move about 70% of the nation’s weight by freight. This makes for a tense future, and one that needs us to plan ahead.
How would we do it?
Over the next four to eight years, we need to set the framework and foundation for how social programs will carry and support a declining number of jobs and a changing job environment, primarily because of the autonomization of processes and jobs, including in manufacturing, the No. 1 employer (by industry), in the U.S. We aren’t Japan, which has a shrinking population. The U.S’s problems are different.
There’s been some experimentation in countries like Canada with a guaranteed basic income. Ontario is introducing a pilot project to see if it could work, and the province of Prince Edward Island just passed a resolution to establish what they call UBI, or Universal Basic Income. We’re going to have to figure out a way to modernize our systems to retrain and repurpose them for periods of unemployment for people. While we have programs that work in silos, we don’t have anything that’s sustainable.
The idea would be that this would replace other forms of welfare assistance, not including healthcare, but while I’m not certain what healthcare policies lie ahead, something like RSBY, the biometric-driven health insurance program India implemented, originally for the bottom two quintiles, would probably be one way.
V. Implementing A National Cybersecurity Mission In Tandem With Physical Security
Why is it necessary?
This goes back to something I’d talked about in October. “There’s No Such Thing As Cyber, If You Don’t Protect The Physical.” It’s as simple as that. As a collective, we are dealing with cybersecurity monolithically, as something that has to be dealt with in isolation, not as part of security as a whole. It’s a problem if we live in these silos. Not just because of the Internet of Things and cyber-physical systems per se, but also because if I, as a hacker on a mission, can walk into your data center, there’s pretty much nothing you can do to stop me getting into your system.
Think of the large scale disruption that would cause to our critical infrastructure, like the power grids, if a criminal, or a foreign power, could gain access. But it’s not just that. As I’d written in June, as technology rapidly changes our world, “we have understood that it’s not just utilities or manufacturing facilities, or military or civilian bases that can be electronically invaded. From smart locks for homes to remote keys for cars, from pre-op pods in hospitals to intelligent buildings and other M2M (machine to machine) technology, as everything in our own lives is customized digitally, how easy would it be for someone to invade your life?” We’ve got to protect the physical as much as the cyber aspect of systems.
How would we do it?
We would need to put in place processes through which we could verify credentials — use biometrics to start with. We would also have to have what are called pinch point admissions, instead of multiple points of entry to a sensitive facility, which would allow credentials to be verified. We would need to validate all vendors, to prevent both the impersonation of a real vendor or the misuse of vendor credentials. We would have to make sure we implement physical access protocols to devices, and finally, any organization dealing with networked systems, especially sensitive data, would need to be able to vet and trust its staff. You’re not going to be able to do much about someone wanting to do mischief on the inside once they’re on the inside and have unfettered access to your systems.
It’s not an overnight process, but we have to try and ensure we’re taking the right path to building a more secure future. And we do not really have the luxury of choice.
(Wyly Wade is CEO of Biometrica Systems, Inc. He was part of the original team that built India’s one billion-plus, biometrics-driven universal identity project, Aadhaar)
Enhanced functionalities of the new, fully encrypted Security & Surveillance Information Network will give clients the ability to run facial recognition scans on suspicious persons from anywhere on a property or beyond
LAS VEGAS, NV: On Tuesday, Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company focused on creating products that link the physical to the digital in order to prevent crime and track criminals and their associates, announced the release of a new version of SSIN, their fully encrypted Security & Surveillance Information Network.
The immediate new functionalities include a secure, convenient mobile application, which would, with a couple of clicks, allow any subscriber with access to the mobile app the ability to run an immediate scan on a suspicious known or unknown person, anywhere on their property, and receive feedback on that person or persons in operational real time.
Over the next few months, other enhanced features will also give subscribers the ability to run operational real-time facial recognition scans of any individuals on their property against a law enforcement-verified database of criminals — a database that includes known thieves, drug and human traffickers, sex offenders, gang members, murderers, terrorists and white-collar criminals.
“The functionalities of the new SSIN, part of our overall VisualCasino 7 release, is pretty revolutionary by any standard, not just in the surveillance and security industry,” said Biometrica CEO Wyly Wade. “This might be the first time a private company has taken Department of Defense-developed Facial Recognition software, which can be run against a large, law enforcement and intelligence agencies-sourced database of criminals, and attached that to mobile devices for private customer use. A mobile platform is critical to being able to track suspicious activity as it happens, instead of only doing forensic, post-facto analysis.”
According to the FBI’s violent crime database, there are currently approximately 33,000 violent street gangs, outlaw motorcycle gangs, and prison gangs, with about 1.4 million active members criminally active in the U.S. and Puerto Rico. The 2015 National Gang Report said that almost half the prison facilities reported that prison gangs joined domestic extremist groups. And an FBI release last month stated that their anti-trafficking sting operations, part of “Operation Cross Country,” were focused specifically on hotels, casinos and truck stops.
“While the tracking criminals part of it is obviously more glamorous to most people, one of the areas where this will be very handy is to our Non-Bank Financial Institution (NBFI) customers,” said Biometrica CFO Nigel White. “They have an imperative to fulfill Know Your Customer requirements on an everyday basis. By helping them have access to faces and backgrounders of known white-collar felons in the system, this will support their KYC and Anti-Money Laundering obligations.”
According to the company’s Vice President of Business Development, Kevin Parker, the new SSIN release is the first of several updates and upgrades to be announced over the next three months, as part of the transition from VisualCasino 6 to VisualCasino7. “In the seven years since we released VC 6, technology has changed dramatically,” said Parker. “That change is reflected in our new applications and functionalities. The mobile access is a game-changer, but there’s more coming, so watch this space.”
About Biometrica
Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.
To this purpose, the company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above.
Private Investigator License # 1295 [Nevada PILB]
In six short years, Aadhaar, India’s biometrics-based unique identification project, has enrolled more than 1.07 billion people. This has allowed hundreds of millions that did not have access to benefits, access to the formal systems that provide those benefits.
In a freewheeling interview, Dr. Pramod Varma, Aadhaar’s Chief Architect, and CTO of EkStep, a not-for-profit that uses technology to reimagine learning opportunities for every child, spoke to Biometrica’s Kadambari M. Wade on why it was necessary to have an independent biometrics-linked platform. He also spoke on matters of privacy, tracking, Voter IDs, and more.
Why Aadhaar? What was the philosophy behind India opting for a biometric universal identity system?
Dr. Pramod K. Varma, the Chief Architect of India’s Aadhaar.
Dr. Varma: There is a bit of history here. India, in one sense, was rather primitive, as compared to a developed country, when it came to something like a birth registry system, which is something you pretty much take for granted in a country like the U.S. Births are almost always registered. You’re then given a Social Security Number, and you start the process of building a profile for an individual. India didn’t have that. Even now, in states like Uttar Pradesh [which borders India’s capital, New Delhi], about 40% of births are not registered.
One situation therefore, was that India didn’t even have some basics, like births and schooling, covered. At the same time, India also had ambitious social protection programs, what you call direct benefit programs, and the allocation for those kept growing in our budgets. It was a huge burden. We were looking at the government needing to reach about 90-93% of 1.3 billion people.
Are you saying that 90-93% of India’s one billion-plus population depends on the government for assistance?
Yes, it’s a huge number — 90 percent or more of Indians depend on some form of state subsidy or assistance. About 600 million people are covered through various forms of benefits, whether for jobs, pensions, scholarships, etc. In 2014 for example, India was spending three hundred thousand crore, or about 2.45 percent of the GDP, on direct subsidies. At current conversion rates, that’s probably about $45 billion in U.S. dollars, every year, on direct subsidies. These were not indirect subsidies like government schools, or infrastructure like roads.
So this was direct living assistance?
Yes, in one form or the other. At the same time, imagine this: When your foundation for doing a lot of these things, like a birth registry or a national identity of sorts, doesn’t exist, and you’re still spending this kind of money, what happens to accountability? There was no mechanism to even measure or understand whether the right people were getting the right assistance, and what we called “leakage” kept increasing. In many programs, the leakage was as high as 50 percent-plus.
That seems exceedingly high.
Yes, in the 1980s, then Prime Minister Rajiv Gandhi said that only 10 percent of subsidies actually went to the people it was expected to go to, with leakage being at about 90 percent. Most studies authoritatively put that figure at around 40 percent. Forty percent of $45 billion means about $20 billion a year was being leaked, which also meant the people that were supposed to be getting this money or grants of some sort were not getting it.
But it was going somewhere.
Yes, it clearly was. There were two primary drivers behind the idea to opt for a UID (unique identifier). The first was providing an identity in general that allowed a person to have a verifiable identity. The second was giving them the ability, through using that identity, to access the formal system, whether that was banking, credit, healthcare, each of which required some kind of ID, and ensuring the efficiency of the subsidy regime. India couldn’t spend anymore, so eliminating the leakage was going to be a huge relief.
So it was believed that a unique identity could completely unlock the system.
Yes, and it was a powerful revelation. What was different was how it was implemented. After Nandan Nilekani took over, the solution became more future looking.
Why biometric identity?
It goes back to my earlier point. Nothing existed. When half the country hadn’t a clue when they were born, or there was no real record of their birth, there was no clean way to create a unique identity. How did you ensure that? The only way we could determine that the same individual was the same individual was through biometrics.
You’ve lived here, in the United States. We’ve just had the general elections and in the lead-up, there was a lot of debate on Voter IDs. How would you define an election system with and without biometrics?
This is an interesting question, and there are two ways to look at this. In the first, you create a purpose-driven solution, one that solves a particular problem completely. If you believe there is a real problem with identifying genuine voters during the elections, and you want to solve that problem, you could clean up a flawed system using a biometric authentication system. You would create an ID in an election system, and then anyone voting has to have that ID authenticated. But that is a solution-driven play, not applicable to anything else.
Could you elaborate?
In India’s case, going back to your question, the need, going forward, to have a biometric authentication may or may not be there, as the identity itself, through Aadhaar, is biometric. So layering a system like an election system on top of an existing identity system, and allowing the election system to take advantage of a preexisting biometric identity, is different from what a country like the U.S. would have to do, if they wished to create an authenticable election system that is based on biometric identity.
And that is because we do not have an underlying digital biometric identity here in the U.S.?
Yes, exactly. You’d have to build an election system as a black box of its own solution. It’s like the Affordable Care Act. You built it from scratch and the identity part of it is internal to it. It’s a solution play. In India, we wouldn’t have to do something like that. In India, through Aadhaar, each person is biometrically unique and because a digitally authenticable platform exists as an independent identity platform for more than a billion people, getting an election system on top of that becomes a very thin application of that identity.
The election system would then be a separate system sitting on top of the ID system?
Any purpose-driven system would. In the case of elections, that particular layered system will then have who can vote, the rules of who can vote, where can you vote, when can you vote. That’s all part of the election layer, not part of the identity layer, and therein lies the major difference. In the U.S., I would assume that if you had to do a biometrics-linked election system, you’d pretty much have to do it as a full stack solution. It cannot be reused anywhere else. In India, because identity is a platform by itself, and an independent one, you can layer other systems, independent of each other, on top of it. So a healthcare system or a banking system can use that same biometric identity. But the biometric identity system doesn’t qualify citizenship. It only qualifies you are who you say you are.
Why can’t an electoral ID system be utilized anywhere else? You’re saying that in India, because you created an independent digital identity platform first, it can then be used for different layers, whether for banking, healthcare, direct benefits, or voting. But if you create a system for electoral identity, why can’t you use that to provide direct benefits?
As an architect, I would think this would go into exactly the same situation as say, social security. Social security, originally, was not meant to be an identity system. It was a benefits system. It has, de facto, become an identity system, sort of. As an architect, I would think differently. If you want a reusable element, then the reusable layer, your identity, should be agnostic to the domain-specific rules or the functional rules of the platform you’re using it for.
So you’re saying your identity system needs to be platform and purpose agnostic?
Yes, you can obviously use election, or ensuring direct benefits, as applications or a need to get the US to use biometric identity. But you still have to have the identity layer separated out, with a different authority horizontally owning the identity, and not put identity under say, the Home Ministry in India, or the Department of Homeland Security in the U.S., or the election guys. If you do that, and tie it into citizenship, the banking guys, for instance, would find it very hard to use that ID, as would healthcare systems, because each of those layers have their own restrictions.
What you’re saying is that ID systems created for specific purposes, like elections, are restricted in scope because that purpose might not suit some other application. And you need an independent identity authority because not everybody that has or needs a bank account can vote. And if an identity platform is only given to those that can vote, it cannot then be used to authenticate non-voters wanting to get a bank account and fulfill KYC norms?
I’m saying exactly that. An election system is very purpose driven. Purpose driven systems are not intended for reuse or repurpose for other purposes. The moment you create a special purpose vehicle, to think that you can generalize it and say, “OK, by the way, because we have it we could use it for this, this and this,” isn’t how technology-driven identity systems work. You’ll end up with a clunky design, and a lack of clarity in ownership, and severe systemic issues. The people who manage elections have a different purpose in life. Their objective is not to manage an identity system for the country.
How early can you get biometrics that can be authenticated for children? Here, for instance, a social security number, which was initially issued only after the age of 14, can now be applied for along with the birth certificate.
We have enrolled 1.07 billion enrolled in our India program in the five-and-a-half years since we’ve begun. We’ve scaled extremely fast. While we do provide an identity number at birth, we do not bother capturing biometrics at that point. Babies’ fingers are too tiny, and their fingerprints would not appear clearly on top of the glass plate on which digital capture has to happen, even though their biometrics have evolved. They evolve in-utero, and you have well formed irises and fingerprint patterns in the womb. We did a lot of proofs of concept and realized we had to get through the terrible twos before we could practically make this work. To get a child to sit around and get workable biometrics wasn’t practical. So we decided those biometrics could be captured at age five.
What do you do when you give an Aadhaar number at birth or pre-age five?
We insist that one of the parents, or a guardian with a biometric identity — keeping in mind that we have children that are orphans and so on — has to vouch for the child and be linked to that child’s identity till the age of five, at which time they are delinked from the parent or guardian in the system. The system is so minimalistic that we do not capture the parent or guardian in the system beyond that age. There are just four attributes — name, date of birth, gender and proof of address at the time. Which goes back to your original question, why can’t a Voter ID be used for other things. Our ID doesn’t detail your relationships, religion, job profile, dependents or anything else. Any other attributes would have to be built into whatever layer you build separately on top of the identity system, be it banking or healthcare or social benefits. The federated model is very important.
If someone is homeless, and you require an address, what do they provide?
The homeless part wasn’t hard. When we conducted camps in homeless shelters, they, for the most, provided that shelter’s address as their address. Now whether they moved around or not, they wanted to settle or not, that was their choice. The idea was to give them the ability, whenever they chose, to get back into the formal system, whether it was to avail of healthcare benefits, or banking, or whatever. At that point, they also have the option to update that address, as control is given back to the identity holder. You can change your name in the system, like after marriage if you so wish, or you can change your gender, there are no strings attached to this.
You’ve mentioned purpose-driven layers a couple of times, and stressed that a biometric identity is only to prove you are who you say you are, and does nothing else. So are you saying that in India, despite more than a billion people having UIDs, for being in the voter registry, you’d need a separate ID. It would be an additional layer?
Absolutely, it has different requirements, which is why the federated and layered model of entitlement has to be understood. Identity is an independent orthogonal topic, necessary when you’re born or living someplace. You need an identity so you can identify yourself to gain access to a system. But whether you’re allowed to drive, or get healthcare, or get a food subsidy or money from the government, is an independent registry. Now of course, they will be linked to the unique identity system, so you won’t get two food coupons, or two votes. So it’s used to prevent duplication or misuse, and to authenticate you as a unique person. But someone would have to verify their eligibility for an entitlement system separately.
That answers my question on how you separate identity and electoral requirement!
Exactly. It depends on the purpose. If you say my purpose is to solve electoral or digital voting, and has nothing to do with creating a digital identity for other purposes, then you could create an all-inclusive digital system for voters and not bother using it for anything else. But you should never ever say, “I’ll build an electoral voting system using biometrics and somehow reuse that for other purposes.” It would become extremely difficult.
So you can’t map a unique ID to being a citizen, as opposed to being ineligible to vote? You can only create a UID, and layer it with anything else.
Yes, a UID is in essence, a starting point. A UID, here in India, has taken on the hard work of ensuring that this person is unique, biometrically, and has established a way to authenticate that virtually, or digitally, across the country. Suppose I walk into a bank and open a bank account. I can verify I am who I say I am digitally, through my UID, but then I also need to prove that I meet whatever banking eligibility is required by the banking system. For a driver’s license, you can prove your ID, but you still need to prove you can drive. And you still need to prove you are not just who you are, but also that you are a citizen, to vote.
My biometric ID just tells me I am me. A secondary system tells me that if I am me, I am a citizen and meet the criteria needed to be allowed to be vote. Interesting, because in the U.S., in many states, you can now register to vote at your local DMV while filling in your driver’s license form. The form really depends on you being truthful.
Yes. And by the way, as an architect, I’m actually cringing at the thought of why a driver’s license form or process has anything about elections mentioned on it. It is extremely silly. Why depend on someone’s conscience? All a driver’s license needs to do is to ask you is to show an identity that proves you are who you say you are, and then ask you to take a driving test. With UID, it simplifies the process of identity, and ensures you can’t get two licenses.
In India, if your UID doesn’t tell you anything about a person apart from whether they are who they claim to be, and are unique, how do you tackle, for instance, perceived national security problems? Undocumented refugees from Afghanistan or Tibet, or other undocumented migrants from Bangladesh, or Nepal, who could, hypothetically, get a UID, and from thereon, enter the formal system?
I’d like to be clear on this. A UID is not a mechanism to stop cross-border movement. It isn’t a mechanism to solve world hunger, or education issues. But it is necessary to have an identity. If you don’t have it as a system, how do you know who lives here? The idea behind UID is to establish a system that doesn’t currently exist, one that can be built upon. So can there be people here already that should not legally have been here that would get UIDs because they are residents? Probably.
And it’s okay because the system is forward-looking?
If we didn’t build the system now, we wouldn’t have the option, 10 years from now, when we have everyone that’s already here in the system, to have a process of viable verification system in place. At that point, we can look at only providing UIDs at birth or when someone gets a valid visa. We can then hope to have something like a citizen’s registry. Hopefully, one day, you can have a better birth registry, have a better idea of travelers, or migrants, to put in place better national security. If you don’t put in a system now though, what would you build on? The good thing is that when the system starts getting cleaner, when the citizenship registry starts forming, when the travel registry starts forming, India will be able to tighten the ID system, or the layered systems, such as social benefits programs or others.
One of the criticisms of things like Voter ID requirements, or having an identity card, is that it discriminates against people from lower economic groups, because of the difficulty in getting it.
Why is it difficult to get? It shouldn’t be.
If you have to get an ID, it’s half a day’s job, at the very least, as you need to go to a government office, typically open during business hours. For the daily wager, he or she doesn’t have that half a day to spare. It takes away part of a living wage.
If there is a mandate to get an identity, you have to have appropriate laws to protect people and then incentivize them to actually get that ID. The process of getting a biometric identity should be an once-in-a-lifetime event, and you can do that by ensuring that anyone that takes time off work to get that ID is compensated adequately. Frankly, I think the U.S. has been taken over by private systems, and yet, has also been taken over by the creamy layer’s paranoia about privacy. People are ok giving up privacy for convenience, but are paranoid about it otherwise. Unless there’s some give, you will probably not have a government-driven universal identity system like in India. The unfortunate part is that privacy and anonymity through an independent biometric-driven ID is the best way to secure your other systems, but because people don’t necessarily understand how these systems work, they don’t realize it.
Could you talk about the anonymity that a truly anonymous, biometric UID system could provide? The obligation of a unique ID system is just to validate I am who I say I am. With true anonymity in a healthcare system layered on top of a UID system, I would be just a number. No one would know I have X disease. The UID in India, though, gives you a name, so it’s not completely anonymous.
Here’s what you need. Take that healthcare system that is built as a layer on top of the UID to carry your digital health records. It should, for instance, have a design mechanism that needs to verify biometric identity only once, and then have an anonymous alias used internally. It should be the same with voting systems. When you design a voting system on top of a UID system, that doesn’t mean the UID is anonymized, but that a layered voting system can ensure they do a biometric identification, discard the real identity, and actually anonymize and record the fact that you voted. Obviously the voting system has to also not record whom you voted for, so you have to anonymize that too, and a bunch of things.
So in true anonymity, you have an identity connected to your name, but when you show that identity in a layered system, you’re just a number or a unique alias?
Yes. You might want to also ask why healthcare systems should continue to store an identity? Why can’t the system store an anonymous alias? These are design questions related to how a healthcare system is built, not how an identity system is designed or built. That identity system is simply saying you are who you are. What attributes of the ID system are embedded in the healthcare system, is a question of design of healthcare systems. So the layered systems that are built on top of ID systems must ensure privacy and anonymization of information, depending on the need — a school system would be very different from a healthcare system.
I get that. So the attributes that are layered on top of any specific tags actually determine the privacy and anonymity?
Exactly. And that is where the design construct has to apply, to prevent discrimination and any inherent prejudice that might exist. Some of that might exist irrespective of a digital ID system. However, this was also why in the case of UID, it didn’t have a religion or caste attribute.
What happens if someone takes over someone’s identity, says they’ve changed their name?
That is a very detailed technical discussion, on how we’re protecting biometrics to prevent reuse or misuse. There is a certification we have built in Aadhaar, called registered devices specification, which allows devices to authenticate biometrics, check for “live-ness” and so on. Take a hypothetical, very extreme, Minority Report kind of case, say, if someone artificially imitated your iris with “live-ness. To update your ID, you would have to go to an Aadhaar touch point, where an Aadhaar operator using our own software, not available to you, needs to sign off on your update. If the operator has colluded with you on this, we’ll know when that audit trail is checked. You get a physical and digital notification and if you turn around and say you didn’t change your identity, we can trace it back to the enrolment center, the operator and the device on which it was recorded.
But you can’t build a system for the extreme exceptions, in any case …
We can’t. But I think the question we have to ask is if it happens, could we track down the problem. And we’ve done whatever is technologically possible to ensure that we can. Internally, every one of our ID records is encrypted and tamper-proof, so no database admin, no human, can see our data. A DBA can’t change what they cannot see. And finally, once the technology stops, the laws of the land kick in.
Knowing what you know now, what would you have done differently in the architecture of India’s UID?
I think it’s more process than architecture. The eKYC as a feature was thought about not in 2009, but in 2012 — we realized the importance of digital ID sharing, as opposed to a photocopy of a paper, halfway through. What I’m trying to say is that we would have done some process improvements, rather than architectural improvements. Our architecture is extremely minimalistic. All it does is give you those four attributes. Name, Address, Date of Birth and Gender. The system does not even record the purpose or location of authentication. We don’t know if X person is voting or opening a bank account. The minimal architecture ensures it works well.
If a unique identifier is the ultimate securer of privacy, in your opinion, is that the way forward for a country like the U.S.? Should you lose all privacy by providing your biometrics to an anonymous system, to gain a secure, private ID and workable systems down the line?
It’s debatable and depends on how extreme your privacy rules are. Even in the U.S., you don’t just say you have no ID when asked for some by law enforcement, or a hotel you’re checking into, or for something else. Unless you’re completely off the grid in every way and do not interact at all with society, you have some form of ID. You can’t build programs for those off the grid situations. You build it for everyone else.
Final question. What would say to people that talk of an all-knowing state, or “big brother watching you?”
I think the Indian UID program has done extremely well, allowing millions to get into a formal system and access benefits. We store no purpose of transaction or transaction details, leading to a very federated or distributed system. I think India’s UID program is a brilliant system to imitate, because of extreme minimalism of architecture and the fact that it is what’s called a zero knowledge system. The layered systems don’t speak to each other.
One of the biggest worries when our program in India began was that fear of Big Brother watching you, that the system would become this massive, all-knowing database. But look at our design, the zero knowledge system. There’s no profiling data, and zero transaction data. What else could we do to ensure privacy?
The 5 Real World Things You Really Do Have To Keep In Mind To Secure Your Virtual World: Verify Credentials, Have Pinch Point Admission, Validate Vendors, Implement Physical Access Protocols To Devices, and Be Able To Trust Your Staff
In the aftermath of the unprecedented DDoS attacks on DNS provider Dyn, by hackers using an estimated 100,000 infected devices, there’s been a dramatic interest in cyber-physical devices and the vulnerabilities of the almost omnipresent Internet of Things we now inhabit, and in keeping ourselves digitally secure: We change passwords, we have secure networks, and we put double validation processes in place for online access. We also spend a lot of money protecting the copper wire — the fiber-optic wires that come into a building and attach to the network or the Internet.
The problem, according to Biometrica CEO Wyly Wade, is that we don’t spend that same quality time protecting our doors, or actual building infrastructure. And we should. The Biometrica Blog Team (BBT) sat down with him to get an understanding of the 5 basic things you need to do in the physical world, to protect your cyber systems.
BBT: You’re starting with a basic premise, that cybersecurity measures are of little use if someone has physical access to a building.
WW: Yes, once I walk through the front door, and once I have physical access, I could, potentially, pretty much own you. Everybody is very focused on the cyber aspect of things, and typically think of cyber as being something in the cloud, or something that comes across the Internet. For the most, people think of a hacker as someone remote, or, as Mr. Trump put it, someone in Russia, China, or, “some 400lb guy sitting on his bed.” Quite frankly, that’s really not the attack surface. It is very hard to crack cryptography, and despite the attention it gets when it happens, it’s not easy to find all the weird bugs in software.
But people do it.
Yes, of course they do it, but it’s not very easy to do it. Let’s keep aside the foreign-agent-on-a-mission angle for a minute. But aside from that, it’s easier for me, as your local neighborhood hacker, to walk into a building and act like I belong there and never have a credential checked, or steal an insider’s systems access to get entry.
What happens once you have physical access to the place?
I watch. People get up and walk away from a terminal for any number of reasons, and when they’re in their offices, or comfort zones, it’s not all that difficult to casually gain access, if you look the part. I can plug into a network port. I can plug a USB key into an unmonitored computer and download something. That’s all it takes. And yes, I can pick up those credentials that give you access to an internal network, and gain access — but it’s gaining physical or other access to credentials of someone with access to a network. It’s the easier route if you’re someone with mischief on your mind or mala fide intent.
That last part, gaining some kind of access to the credentials of someone with network access is what reportedly happened in the Target case. Someone installed malware in their payments system by stealing credentials from an HVAC vendor.
That’s what’s been extensively reported, and it’s what probably happened, according to most reconstructions of the hack.
What about the OPM hack?
Well, the OPM hack was different, and more a case of bad software design. If a system is protecting our national secrets and national security, or the personally identifiable information of our people, as the case might be, it shouldn’t be possible for nation-state actors, some mysterious group somewhere, or any kind of APT (advanced persistent threat) to break in remotely and sit undetected on a system’s network for months on end. And if they get in, they shouldn’t be able to access everything, your system should be able to have workable access controls in place.
So hacking does happen, we know that.
I’m not claiming we don’t have cases when people gain illegal access by making use of vulnerable software or gaining entry through someone on the inside clicking on an email link they shouldn’t have clicked on and letting malware in, and then using that to gain access to someone else, like at Target. Those attacks make the news and they do exist. But we spend lots of money securing that stuff, just look at the number of everyday attacks that are repelled; we don’t spend a lot of money securing the simple things that we can secure. Most companies have a policy in a book someplace that talks about who has the right to be on their premises and who doesn’t. But it’s rarely ever enforced with all seriousness, largely because a cultural change that’s needed to do that enforcing.
Well, you need to have a pass or some kind of clearance to get into most government buildings.
True, for most government buildings, but not most corporate offices. And not all government buildings, especially at the local or state level that expect members of the public to come in, check your credentials as thoroughly as they should be checked, all of the time. There’s a great video on what RedTeam Security, a very interesting group of guys, a group of white hat hackers, did while breaking into a substation to access a power grid, and plugging in a plugbot, a covert device used for physical “pentesting” or penetration testing. That’s a quasi-governmental organization and they made it in.
There is technology that can fix that, including biometrics that can stop, or at least notify you when someone that is on a watchlist or a blacklist, or is unauthorized to have access, is entering the building. We don’t always use the technology available that way or think about it that way, but I think it’s changing. Still, the process should be to credential properly, and verify those credentials with a biometric marker, so that anyone that enters your premises or facility is properly identified.
Right now, the vast majority of offices here use something called a proximity card, or a proxy card, which has a little RFID chip in it. It’s relatively easy to copy one of those cards. But even if I don’t copy it, if I get hold of it, through someone being careless or anything, I can get through that door. There’s no validation that the person using it is the person authorized to carry it.
That applies to more than your office access, it should apply to hotels and retail stores to. You should know who the potential customer or patron entering your building is.
It’s not very different from the Know Your Customer needed for, say, banks or financial institutions. Historically, financial institutions in this country and elsewhere really resisted asking the “Am I who I say I am?” question. What they would do is try and validate that the social security number you provided is attached to the person that you said you were, and then asked you a standard bunch of questions about things only you would know. But if I, as an intruder, had already stolen your identity, I would already know the answers to those security questions.
But if I knew enough to take your ID, I should have some of those answers.
True, by that point, it’s relatively simple for me to take an educated guess as to what those answers are, without you actually validating you are who you say you are. That was part of the whole impetus of Aadhaar, the biometric identification program implanted by the Indian government, which now has more than a billion people enrolled in the system. It’s also part of what we’re doing in Biometrica, helping our customers, validate you are who you are and that the ID you are presenting is a valid ID.
Let’s move to another question, restricting physical access.
Most facilities should have a single point of registration of entry and exit. This doesn’t mean you don’t have emergency exists, but in the normal course, force everyone to go through pinch points, that way you have everyone walking through a particular area where you can validate their credentials, whether it’s a building, a facility, a floor or anything. You have to be able to link it all back to you are who you say you are. How easy otherwise, would it be for me to register as an HVAC guy or some kind of tech and walk into some building. It’s not hard at all, it’s all about confidence really, at that point.
It is one of the biggest issues around. If I show up and say I am X, Y, or Z, from ABC HVAC or whatever, people often say, yes, and just let you in, especially if you’re a familiar company to them. It’s not very hard to get an idea of what company services you, if you look around. What your security team or front desk should be doing, is that if someone is not already on a scheduled call to enter the building, in a notification from the building’s maintenance people, call up maintenance, and then call the company — not from a number they give you, but from an independent source, and then validate is that this person is supposed to be here. And with delivery people, from pizzas to couriers, don’t let them past a front desk, someone needs to come out or come down and get the stuff. In a lot of places, especially in the D.C. area, there is a change in the culture, and building access is more restrictive, even in non-governmental offices. But you’d still be shocked at how easy it would be to gain access.
You mentioned confidence. Doesn’t it really come down to preconceived notions, about who people think should be allowed access? Does race or ethnicity play a part?
Well, in the D.C.-Northern Virginia-Maryland area, given the diversity we have, I think it comes down more to whether you look the part. Is it easier for certain people and are there stereotypes about this that make it easier for some? Absolutely, no question, but if you look like a white thug, I guarantee you you’d be stopped.
We keep coming back to that point of physical security though.
Yes, but it’s linking it to a digital asset. There’s no such thing as cyber if you don’t control the physical environment.
What do you mean?
If you don’t control the physical access to the machines, your credentials, your mobile devices, you don’t really control the cyber aspect to that device. It means that if I am able to steal a device on your network, or I’m able to compromise, with physical access, a device that has access to your network, there’s no way for you to tell that I’m not suppose to be using that. There are lots of devices where I can plug a little thing into a wall, and it will sit there and hack your system from inside your own network, get onto your WiFi and create a tunnel back to me and my network. So even remotely, I can now act like I’m internal to your network.
It creates a digital tunnel back to you?
Yes, it then not only looks like I am a credentialed user on your network inside your system, but I’m also literally inside your system. I’m inside your four walls. And how I got there was because don’t protect your four walls.
You didn’t mention watching the insider, like the Snowden issue.
The Snowden issue, quite frankly, is a difficult, complex one. If you have a determined individual on the inside, they are going to harm you. You’re never going to stop it all. But a lot of these issues, Target, the OPM, Anthem, where it was reported that the intrusion was discovered when a network administrator finally realized his credentials were being misused, a lot of these are because of bad players taking advantage of avoidable errors. That vendor fixing an air-conditioner inside your data center should have a staff member watching at all times. How is it that when data closets are supposed to be locked and protected, people can gain access to open ports?
So port access should be monitored?
Absolutely. You have to turn off access to all ports that are not being used. The government does a pretty good job at this actually, but the private sector, not as much. If you’re issuing laptops and they don’t have a need to use a USB thumb drive, then turn off the USB ports.
How do you confirm internal misuse?
All of this is up to validating the people you hire and trust in them. But if you can’t trust or manage your employees, and have measurable metrics for that, you’d have a real problem with rolling out anything really secure. But you also have to punish employees that don’t do what they’re supposed to and don’t follow prescribed security protocols or maintain security hygiene. We’re remarkably forgiving of that, as companies. You can’t manage what you can’t measure. If you don’t have the ability to monitor and measure how people are acting, you don’t have any ability to say I’m going to fire you for that stuff, or monitor unauthorized activity. You need to take disciplinary action against people that violate your policies. Once you allow physical access to a rogue party, there’s little you can do to stop malware entering your system, except put in place processes to limit the effectiveness of that break in.
If you’re a casino in the U.S., or a casino that is part of a U.S. group, you’re almost certainly a non-bank financial institution (NBFI). You have a bunch of rules to follow, customers to know, patterns to watch out for, dollar routes to follow, and suspicious activity and customer transaction reports to file.
This also means there are a ton of confusing terms you’ve got to know: KYC, Title 31, Title 26, AML, BSA … the list goes on.
If you’ve ever wondered why you need to know these terms, or why you should care at all, take 30 seconds to register and download our a handy FREE guide, which breaks the complex into easily understandable FAQs, and helps you understand how to protect yourself, and your casino’s assets and reputation.
Here’s a sample from the guide:
How much money is laundered globally per year?
While exact numbers are obviously difficult, if not impossible, because of the nature of laundering, the United Nations Office on Drug and Crime estimates that the amount of money laundered globally in one year is 2-5% of global GDP, or $800 billion to $2 trillion in current US dollars.
In many of our conversations on money laundering and Anti-Money Laundering (AML) requirements, we keep hearing about the BSA. What is the Bank Secrecy Act about?
In 1970, the United States Congress passed the Currency and Foreign Transactions Reporting Act, now called the Bank Secrecy Act. It required financial institutions in the U.S. to help government agencies identify and prevent money laundering, with a specific focus on the recording and reporting of cash purchases of things like bank notes, checks, demand drafts etcetera (referred to as negotiable instruments) of more than $10,000 (as a daily aggregate amount). They were also required to report any suspicious activity that might be indicative of money laundering, tax evasion, or other criminal transactions or events.
What does this have to do with casinos? They’re not banks.
No, but they deal in financial transactions. Think Casino, the movie, not an establishment, which was based on a fictionalized account of the time the Italian mob, more specifically the Chicago Outfit, skimmed money from a bunch of Las Vegas casinos. Businessman and gangster Al Capone, who was finally jailed in 1931 — not for running illegal gambling rackets or prostitution rings or murder, but for tax evasion, incidentally, once led the Chicago Outfit. There’s perhaps a lesson there. In any case, several, if not most, casinos are considered non-bank financial institutions (NBFIs) under law.
What do you mean by saying “most” casinos are considered NBFIs?
According to the IRS, casinos and card clubs licensed to do business as casinos or card clubs that have Gross Annual Gaming Revenues (GAGR) of more than $1,000,000 (annual means per year), are financial institutions subject to the requirements of the Bank Secrecy Act, which is codified in part in what is known as Title 31 of the United States Code (USC). Under this, certain financial institutions and individuals (defined by the Secretary of Treasury) are required to keep records and file reports on certain types of financial transactions. Which means they have to follow all reporting procedures under Title 31, or face the consequences of failure to report suspicious activity or a pattern of suspicious activity.
Is this the issue the Sands faced a few years ago?
Yes. The U.S. government made that very clear when the Las Vegas Sands Corp., which operates the Venetian-Palazzo hotel complex in Las Vegas, the Marina Bay Sands in Singapore, and the Sands Casino Resort in Bethlehem, PA, made an agreement with the Department of Justice in August 2013, to return $47,400,300 to the United States, to end an investigation into the casino’s reported failure to alert authorities that a high-stakes gambler, who was later linked to international drug trafficking, had made several large deposits with the casino.
And what exactly had they failed to do?
Here’s what the DOJ press release from the U.S. Attorney’s Office from California’s Central District, which was handling the matter, stated: “Pursuant to an agreement signed by officials with Las Vegas Sands last night, the company will return the money to the United States within 10 days.”
(Picture above, courtesy IGA and Isle of Capri: The first riverboat casinos in the United States took off in Iowa on April 1, 1991, with the Diamond Lady launching off the shores of the city of Bettendorf in Scott County)
Twenty-five years ago, in April 1991, the U.S.’s first riverboat casinos opened for business in a rather unexpected location: Scott and Dubuque Counties, Iowa. In the 25 years since, gaming taxes have generated more than $22 billion for the state.
According to the Iowa Gaming Association, Iowa’s casinos, which hosted more than 21 million visitors last year, were collectively responsible for more than $1 billion in annual economic impact to the state. In addition to employing about 10,000 people, with an annual payroll of almost $275 million, they also awarded $57.4 million to 1,158 not-for-profit bodies in the 15 Iowa counties that have casinos, and funded 2,130 charitable grants in counties that don’t have casinos, aggregating about $8.4 million in community improvements across Iowa in 2015.
All of this together, in a state of 3.1 million people, where the annual budget is about $6 billion, makes the casino industry a considerable force for change, and an equally potent force for good.
The gaming industry in Iowa is also unique in many ways, having its beginnings in cruising riverboat casinos — the first such in the country — established after the state economy was decimated by the American farming crisis of the 1980s.
At that time, according to reports, the United States agricultural debt (which forced farmers to declare bankruptcy) “had reached $216 billion in 1984, of which $17 billion was in Iowa alone.” The reports, quoting the U.S. Department of Agriculture, estimated that in 1985, net farm income declined by 30 percent and land values were reduced by 50 percent, forcing one of three commercial-sized farms to be unable to pay their bills. Reports of federal government research at the time estimated that “farmland value dropped by nearly 60% in some parts of the Midwest between 1981 and 1985.”
The Biometrica Blog Team spoke with Iowa Gaming Association President and CEO, Wes Ehrecke, to find out more about how Iowa’s people and legislators helped turn the state’s fortunes around with a rather unique solution, gambling, and how Iowa’s proactive approach to gaming has created a thriving industry.
IGA President & CEO Wes Ehrecke.
BBT: How did it all begin for you, from banker to trade association evangelist?
W.E.: My background has actually been in association work for about 38 years. I started with the Iowa Bankers Association, representing all the banks in the state, and primarily doing their legislative work, including as a senior vice president. I then went to the Iowa Association of Electric Cooperatives, which represented rural utility cooperatives, and worked with them for a few years as their CEO, and then headed up to the Minnesota Bankers Association as their CEO, before starting up the Iowa Gaming Association, a trade group that currently represents the 19 commercial casinos in the state, from scratch.
What was your and the IGA’s role at the time this all began in 1999?
At that time, at the turn of the year 2000, we were focused on educating people around the referendum votes, part of the process of getting the authority for riverboat gaming to having legalized casino-style gaming in Iowa. The legislature wanted to have a vote every eight years in the counties that had casinos, to approve them continuing to have casinos. The opponents (of casinos) were trying to make the case that they should be voted out, so I helped organize each of those educational campaigns at the time, in each of those counties. We had these referendums passed in 2002, by an average of 73 percent.
And then eight years later, you had to have them vote again?
Yes, we had to vote again in 2010, and that time, we had them passed by an average of 78%. The yes vote in some of these counties was as high as 85-86%. It was remarkable, really, given that in any election, when 60% is considered a landslide, to have this kind of bipartisan support of civic leaders, business leaders, citizens, church leaders, and others.
Was it difficult, building this support?
It was challenging at first. We had to dispute a lot of the myths that the opponents of gaming were throwing out on crime and other issues. We brought the facts, went out and attempted a truth tour of sorts to all the media outlets, print and broadcast, and had to educate people to actually go out and vote, and turn this ballot over. A big step was when we worked with counties and legislators to have that need for a referendum every eight years removed, so that if a county had successfully passed their referendum two consecutive times, they would no longer be required to vote to get that done in the legislature. That was what our story of the early days was about, our work was focused on putting on a very proactive and positive face on the business of gaming in Iowa. And now it’s 25 years old.
You described some of the myths that were brought about by your opponents, including on crime. What kinds of myths were you fighting?
Generally speaking, opponents of gaming would repeatedly throw out what’s called the ABCs of so-called problems: Gaming Addiction, Bankruptcy and Crime. With addiction especially, there was a need to educate people that there was a lot of scientific research out there, which showed that some people would always be prone to compulsive behavior, and it wasn’t just about gaming. There’s compulsive eating, shopping, a compulsive use of credit cards, and in this case, compulsive gambling. However, as statistics and the continuing research of several years showed, even as the expanding number of casinos, the percentage of people experiencing compulsive gambling, stayed at around one percent.
Just one percent? That’s interesting …
Yes. Even with what’s called problem gambling, they talked of this being between one and two percent. So for those folks, we let it be known that we had programs in place. We have 800 Bets Off helpline, there are providers that we’re helping fund, to do gambling treatment counseling that would help these individuals get help if they so decide to, much like with any other compulsive behavior. The idea was that if someone needed help, we were able to be in a position to provide that assistance.
And that helped offset some of the criticism?
We were able to dispel negative beliefs, and point out that well over 98% of people could go to a casino for the fun and entertainment it provided, and not have a problem. They would be responsible, work with a budget, and spend their discretionary dollars earmarked for entertainment. Just as an aside, we’re competing for those entertainment dollars everyday, people do have choices in what they want to spend their dollars on.
What of bankruptcy?
It’s related, isn’t it, to that rare compulsive gambler? We proved our point through actual facts. We looked at 700 actual bankruptcy cases. People had to indicate, if they went through bankruptcy, if they were in this situation because of any gambling losses. Again, it was less than three percent that even marked them. We took those findings to the press too.
There are 19 commercial casinos in 15 counties that are collectively represented by the IGA
Crime isn’t a major problem for Iowa’s casinos, we would imagine, given that Iowa is way down the list of states that have high crime. On Law Street Media’s Crime in America 2015 listing, featuring the safest and most dangerous states to live in (based on the FBI’s violent crime data), Iowa was at No. 34, with 271 violent crimes per 100,000 people.
Yes, Iowa is pretty low down on the state crime rankings, and crime in Iowa casinos is pretty negligible. Even for bankruptcies, we were ranked forty something [Note: Iowa was ranked 37th from the top among states for bankruptcies per 1,000 people in 2014, with 1.58 per 1,000 people. Tennessee, at No. 1, had 6.22 bankruptcies per 1,000 people].
Any place you’re going to have large gatherings of people, whether it’s Disney World or anywhere else, you’d have issues. We put ourselves in that category, as we’re collectively Iowa’s largest tourist attraction, and with about 22 million visitors every year, there are bound to be incidents of some sort. But we don’t have a huge crime problem, or a violent crime problem at our casinos. With all the cameras etcetera, we get petty theft in the parking lots and things like that, but not major stuff. We had testimony to this effect from sheriffs and police departments.
What kind of testimony?
To the effect that crime in Iowa casinos is negligible. They wanted to support having very secure and safe places being premier entertainment destinations. And frankly, from our perspective, we needed them to be safe and secure places, places where people would want to go without fear or worry. We also do have our own security personnel, and police and law enforcement backup.
There are some researchers that say that for every dollar gained in revenue there are two to three dollars in problems, but we disputed that. If we’re a $1 billion in annual revenues industry, that would be a $3 billion problem. Our state’s budget is about $6 billion. So to put that in perspective, if we had a $3 billion problem, the legislature and everybody, including our citizens, would shut us down tomorrow. They voted for the casinos because they could see that none of those so-called facts were really true, and they voted by an average of 73%-78% in two different referendums in their counties to indicate that they totally supported what we were doing.
And you’ve contributed a lot to building up communities.
The charitable grants program in Iowa is rather unique in the country, awarding $65.8 million in grants last year. The casinos have a nonprofit entity, call it a license holder, which receives dollars from each casino, in each of the casino counties. To receive these dollars, these entities have their own board of directors that determine the kind of criteria of grants to provide. That’s been going on now for 25 years. Additionally, in the last 10 years, the legislature set it up that we provide all of the non-casino counties — 84 of Iowa’s 99 counties don’t have casinos — with between $11-12 million a year, or about $130,000 per year for each of these 84 counties, to also then receive funding for worthy causes. The bottom line though, is that every citizen in this state is benefiting in remarkable ways from these charitable grants.
Courtesy: IGA
It’s always been intriguing in a sense, when some people talk about gambling being sinful, because local churches in many places are funded by bingo nights, which is a very basic form of gambling.
It was one of the things we came up against, back during the early campaigns. Certain religious faiths held that gambling was wrong, so I met with lots of the religious leaders, parishioners, bishops of different faiths, and spoke with them about the benefits of charitable grants to their communities. And now they do apply for grants for things like a new roof for a church, or other community building projects. I’ve also pointed out that if you look back at how our country was formed, back in the time, back when our forefathers left England and came here, it was for the freedom of religion, freedom of speech.
Speaking of the early days of the U.S., lotteries in colonial America played a major part in funding both private and public ventures.
Yes, in infrastructure, education, churches. Some of the first armies were funded by lotteries, and I think an attempt was made to even fund Washington’s army by lottery. So we point these things out, people get it, but you have to dispel myths and inaccuracies by bringing forward the facts. Most realized how viable we are, adding value to the state’s tourism and entertainment industries, and being a valuable part of Iowa’s economy.
Iowa’s casino industry has a fascinating history. Could you give us a quick look at the beginning of it all?
Twenty-five years ago, actually 27 years ago, in 1989, Iowa, like other states in the Midwest, was coming off a major farm crisis. A couple of the counties, Dubuque and Davenport, right on the Mississippi River, bordered Illinois and Wisconsin, and were very closely tied to agricultural manufacturing. As a result, with the farm crisis, they had high unemployment. Some may recall the billboards at the time, which said “the last one out, turn out the lights.” Things were looking bleak for some of these communities. So legislators got together to try and find a workable, different solution. They were looking for something that would be a catalyst for economic development, something that would generate tourism dollars, something that would create good jobs.
And they came up with the idea of riverboat casinos?
They did. They created the idea of the riverboat, something that would bring people to the rivers, have casinos, have people cruise on the rivers, create tourism, create jobs. They passed legislation permitting this in 1989, and the first riverboat casinos, then the first in the country, were launched in April 1991. At the time, there were land-based casinos in Las Vegas, Atlantic City and I believe, in Deadwood, South Dakota. But we were the first in the country to have riverboat casinos, and that was the boom.
But they no longer cruise now?
As the thinking evolved over the last two-and-a-half decades, we were no longer required to cruise, and were allowed to have land-based casinos or riverboats that could be dockside. We now only have three riverboats, they don’t cruise anymore, they are dockside. We moved to being land-based, the kind of footprint that saw casinos grow to having hotels built around them, and many other amenities. But the point with that is that we started at our rivers, and developed from there, we were unique.
Where do the tourists come from?
We have five states that are contiguous, and other tourists come from within Iowa. If you’re 50 miles away, you’re considered a tourist, so we draw extensively from around the area. About 65% of our business, though, comes from out of state. We have some premier facilities that are no longer just riverboats. We have many amenities that we offer, hotels, we have meeting and corporate facilities, wedding facilities, space for concerts, bars, golf courses, comedy clubs, bowling alleys, fine dining restaurants, all tying in the complete entertainment experience.
How much of a say do you at the IGA, and other casinos, have in how the money is disbursed?
We, at the IGA, have none. How much say does each casino have? Pretty much none too. They provide the dollars to the nonprofit license holder entity. These entities have their own separate board of directors, they establish the criteria for the areas they want to fund, receive applications, go through the scoring and then they decide.
So they’re really helping communities decide for themselves and help themselves.
They’re also contributing to building up a community. In the communities they are in, people heading to a casino aren’t just spending there. They’re also spending in the communities around, on things like buying gas, going to restaurants, shopping. Coming on the back of the farm crisis, this has done amazing things for the state. Our casinos collectively employ about 9,500 people, a significant number of whom have been in the industry for over a decade, many have been there since the beginning, two and a half decades ago. They have put down roots and this stability has had a multiplier effect, as they’ve taken those wages and re-invested them back into the community.
You’ve also made a push for women and women leaders in the last few years.
Yes, in the last three years, we’ve tried to build up women leaders in gaming, and promote the industry as a viable career choice for women, not just on the casino floor in operations or as dealers, but also in lodging and hospitality, with restaurants, in concert and event management, finance, marketing, human resources. Some of our findings, in a poll of casino employment, were very encouraging.
More than 50% of the approximately 9,500 industry employees at commercial Iowa casinos are female. At the supervisor level and above, 40% are female, while more than 30% of our senior executives are women. We have five women on the IGA board and several COOs and CFOs at casinos are female. No other industry is even close to where we’re at, in terms of women leaders, and women. We’ve been counting on this, as it’s a way to have more women consider a career in gaming.
Those are pretty incredible numbers, and not just in Iowa.
We’re trying to better them through our annual summits on women leaders in gaming, bringing in topics and issues and training specific to women, through mentoring, and networking and creating opportunities for women to climb the corporate ladder. The other thing that I’ve been so impressed about with this industry is that they tend to want to promote talent and advancement from within, and this is reflected in the longevity of employee careers and the stability in the industry.
What are some of the challenges ahead?
Dealing with the aftermath of the economic recession of a few years ago, much like any other industry. We are also close to saturation point in the number of casinos we can have in the counties they exist in, there is competition from surrounding states that wasn’t there previously, and a certain amount of belt-tightening for the discretionary dollars people have. We of course encourage people to spend it first on food, clothing, shelter, childcare, things like that are most important. There’s some flatlining in the revenue, we’re not going to see the kind of double-digit growth there was 10 years ago. Nonetheless, these casinos are still investing and we have to keep reinventing ourselves, as an industry, to give customers what they want.
What are you looking at?
Technology is certainly an integral part of it. The younger customers, the millennial and the Gen X-er, they are used to growing up on video games, so we have to look at using technology to create a new enhanced experience for them. It’s kind of what you’re doing with Biometrica, how you as a company are evolving from where you were. This isn’t unlike where you are going! We have competition for entertainment dollars. Customer service is always an evolving process. Unemployment in Iowa is pretty low in some places, 2-3%, which is great, but it means it isn’t always easy finding people to work sometimes. But it is part of the education process.
What lies ahead for you, personally? You’ve been part of helping build something special for your state, a lasting legacy for the future — an industry that supports jobs, philanthropy, communities … What do the next few years hold?
I hope I’ll still be helping keep the casino industry in Iowa thriving, making sure no one in the legislative and regulatory arena does us harm, and trying to create proactive change that will help us build a great base for gaming for the foreseeable future. This is an ever-changing industry, which makes it challenging, but also very exciting to go to work every day. No two days that are the same here, no two challenges are the same, and I enjoy it every day.
Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital with the intention of minimizing criminality, or events that could lead to crime. The company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above.
In this conversation with Biometrica CEO Wyly Wade, who has almost certainly collected more biometrics across more countries than any single individual in the world, we get down to the basics. We look at what constitutes biometrics, what are identifiers, and how biometric identification is done and used.
BBT: What is Biometrics? Most people’s idea of biometrics comes from Hollywood, or the TSA perhaps. Your fingerprint, or your eyeball, and then some bad guy can get hold of either and steal your ID.
WW: Well, it’s not quite that. For instance, from what we understand, the capillaries in the iris and retina decompose very quickly, so it might be near impossible to do the bit in Demolition Man, where Wesley Snipes pokes out the warden’s eyeball. But yes, biometrics is all of that, and more, essentially physiological, behavioral, or characteristic markers that are almost always unique to you. It can be a marker through your fingerprints, your iris or retina, face print, DNA, but also your gait, or how you move your mouse, for instance. And then there are the soft biometrics, your height, weight, color of eye, skin color, your smell … even your butt print.
Hang on, two questions. There’s a butt print biometric? And why are some markers called soft biometrics?
There’s a technology developed by researchers out of Japan that uses people’s unique butt impressions, using things like weight and distribution etc. to control whether, say, the correct driver is sitting in a car seat. It apparently has a greater than 98% accuracy but I’m not sure it’s in commercial application yet. Historically, these were thought to be markers that distinguish you from someone else naturally, but over time, there have been obvious problems with these markers. Outside of political stereotypes, how do you really define skin color? There’s a range of skin colors. But it is a serious question.
Because those traits can be altered?
Because the computer is making an assumption about you, and is defining you as a color, an approximate height, an approximate weight, whether you’re wearing a blue shirt or short skirt, whatever.
We thought biometrics couldn’t be changed?
Well, they can. Environmental, medical, and other factors contribute to some change, but here’s the real problem. You may have a really good algorithm for identifying people, like DNA. I can identify you down to one one-trillionth of an individual, but there’s no database to compare that to, so I have to start afresh, to build that and gather all the data.
What do you mean by that?
How do you compare it? If I take your DNA, what am I comparing it to, to identify you?
How do they catch criminals, in that case?
If you leave DNA at someplace and you already have DNA in the system. So you’re effectively caught twice.
Credit: brian0918™ (Own work) [Public domain], via Wikimedia Commons The structure of part of a DNA double helix.Which means your DNA has to be caught once at the crime scene, and once when you’re caught?
No actually, look at it the other way. If You’re already a criminal, we extract and store your DNA in the system. Then if we find your DNA someplace, we run it against the DNAs in the system, and it’s a match, we say, “got you! That same criminal we released two months ago is this person.” Doing one-to-one matching is easy. I’m comparing you to this sample. But going back in the history of time and saying, “I found this DNA, let me go back and find out who that is,” is far more difficult.
It does sound like it is.
It is, since you do not have a large database to compare it against, you’re only able to confirm that the suspect you have in custody is the same that left the DNA at the crime scene. We are a long way from having a DNA system to solve crimes, instead, the technology really validates the hard work of law enforcement, it does not replace it. That’s also why things like facial recognition are more accepted in the security and surveillance world, or to provide access controls.
Wouldn’t you also need a pre-existing database for facial recognition? If you don’t have somebody in the system, who are you matching a face to?
True, but because of the way the world has changed, we have pictures of most of the people we’d be looking for somewhere on the internet. Here’s an example. In the United States, we may convict, for a felony at a federal level, say, a million people a year. That means, by law, a million people have to give up a DNA sample. That means, if I commit a crime, and I’m not one of those million people being caught, the likelihood of someone getting hold of a valid sample of my DNA and then going and getting and finding an accurate match is highly unlikely. But if you have a picture of me, and you go out and try and find me in some system, there’s a much higher likelihood of you finding me even if I’m not a convicted felon. There’s no DNA fingerprint in the world that has my DNA. At least, none that I know of, yet.
Why is facial recognition so suspect in so many people’s eyes?
Because it’s non-contact, that is, you don’t know when it’s being captured. With a fingerprint, someone has to take your finger, press it down on something to record it, so you almost always know when it’s being captured.
Is that why a certain section of people don’t think much of facial recognition identification?
I think that also has to do with what a lot of privacy advocates wrap themselves around. We have to understand that most of our context, as a company, for most of the areas we work in, there’s little or no expectation of privacy.
Because we’re catching criminals?
It’s not even just that. When you’re walking down a public street, there’s no expectation of privacy, not in a cellphone camera era, not when social media is ubiquitous. And how often have we also voluntarily given up privacy for safety or security, or even convenience — to speed up a process, any kind of process?
There’s a lot of suspicion about facial recognition and surveillance. Big Brother, a dystopian world, or an Orwellian one.
That suspicion isn’t specific to facial recognition by itself. That really has to do with biometrics and surveillance in general. This comes down to the responsible use of available technologies by both private and public sector institutions.
But facial recognition seems to be the face of all the controversy perhaps.
Not really, in the Minority Reportfilm, it was the iris. It had nothing to do with facial recognition as such. I think face rec is under the microscope because people understand it a little bit more. But the confidence rating on iris is far higher than facial recognition. It’s just that the database for irises is much smaller today, even with Aadhaar in India (the world’s largest biometric database), even with the experiments that have been done, border controls etc. But just to clarify something when it comes to Biometrica, and the work we do, we don’t collect bad data.
What does that mean exactly?
We don’t collect pictures of random people to keep them in our system. If you don’t already exist in our law enforcement-verified database as a felon, someone who’s been arrested, someone that’s on a wanted list, or someone that is an “undesirable” — having already created a major safety, security or legal problem at one of our customers’ private properties, we don’t store your picture. That would only clutter up our system, and constitutes bad practice, and bad data.
We mentioned the movies earlier. Because of the movies, or TV shows, many people think we can just grab faces off video feeds, like a group of people walking in a hallway, and know who all those people are immediately. Is that true?
You could, but this has limited effectiveness, largely because of bandwidth and processing power. Additionally, the best performing examples of this have had a very limited gallery size — thousands, not millions, and we are a long way from billions. You don’t recognize off video per se. Video feeds are and always have been a series of photographs, for the most part at 30 frames a second. You’d still have to run the best of those frames through the system. If that group of people are all individually registered in your system, there is a possibility you can identify most of them. I wouldn’t say you can identify all of them, because it does depend on how they are registered, what quality of images you have, how many images you have in the system of them, etcetera.
So by common definition, you can identify in video streams?
You’re still identifying and matching against frames. But as FR technology and the technology used in cameras themselves evolve, it does give you the ability to make far better identifications, far more quickly. Which still means your frames have to be matched against a database. I believe the TSA ran a test a few years ago in which they could identify 60% of people in a group in a very controlled environment.
But environments are not controlled.
Correct. That’s why you can give a confidence rating, saying this person X might be this person X. But it’s extremely difficult to say this person X is absolutely this person X. It doesn’t matter if you’re talking about DNA, fingerprints, iris or facial recognition. What you’re getting is a confidence level, that this person is this person.
Isn’t DNA more “confident” than facial recognition?
It is. But it’s still a confidence rating though. There are things that we can do environmentally, medically, to change someone’s DNA. If you have your DNA from 20 years ago, and are exposed to those environmental or medical factors that lead to changes in the DNA, there’s a good chance your DNA wouldn’t be a perfect match. There would be points that match though, and there would be a high enough confidence rating that you are a match to the you of 20 years ago, because those points in common would be so strong. But if you took exactly those two matches, there would also be differences if you’ve been exposed to those environmental or medical factors that cause changes in DNA.
Coming back to what Biometrica does, is it all about bridging the physical and digital to catch criminals?
It’s not just catching criminals actually. We get down quickly to that, which is obviously important. But there’s much more. Take casinos, for instance, and we work with more than 200, have an obligation as Non-bank financial institutions (NBFIs) to follow KYCs, or Know Your Customer norms (also called the Customer Identification Program) by law. Because of the U.S. Bank Secrecy Act, and the Basel Accords, they have to be able to identify the people walking into their casinos, try and know whether they’re politically enhanced persons, high net worth individuals, gang members, sex offenders, money launderers, prostitutes and escorts, among other things.
Do they do it?
Some do and some don’t. And that’s part of the difference today — it’s a very different world from 50 years ago. Historically, inside many casinos, it was all about plausible deniability. If you didn’t specifically know someone, you couldn’t identify that that someone was known to be a bad player, or wanted for something by law.
But once they became non-bank financial institutions, they can’t make that argument anymore.
Yes, they have to know. It’s also covered under the USA Patriot Act. You can’t have plausible deniability anymore, much like a bank can’t. You have to be able to say that that person that walked in is a gang member. And if they identify him as being someone other than he says he is, they have to submit a suspicious activity report for false information.
I do think there is a big shift that is coming in biometrics. Historically, the way biometrics worked, you got that confidence rating because of something called a template. So let’s say with faces, the technology measures points between certain artifacts in your face, and builds a template based off that. It’s the same with fingerprints, where you have a fingerprint template. I think what’s going to happen though, as machine learning, as AI (Artificial Intelligence) and hive computing or swarm intelligence develop, you’re going to see some very different kinds of biometrics, and how they’re used. You’re already starting to see some stuff come out of Japan and Germany, being able to say that this person is hostile and this person isn’t. That this person is willing to pick a fight and this person isn’t.
Credit: From Unanimous.AI, via YouTube. For more, go to http://unanimous.ai/unu2/
Like the “PreCrime” (mostly written as “pre-crime” now) in Minority Report?
Well, quite frankly, I wouldn’t go there. I hate the word pre-crime, and the connotations it has. In the case mentioned above, the research being developed, it will tell you if someone is, say, angry enough to start a fight, or things like that.
Based on facial recognition?
Based off your body.
And you think that’s how our technology will change in the future?
I think that’s where a lot of the science is headed, and a lot of the tech is going, trying to answer questions like “Can I define that this person is being hostile?” “Can I determine…” helped by science and machine learning. It’s facial makeup, it’s heat, it’s where that heat is distributed on the body and many more factors. It’s if you’re walking fast with your head down past everyone and by the way, there’s a small square in the lower part of your back that happens to be cooler than the rest of your body temperature, maybe that’s a gun.
How is that not Big Brother?
We are in Big Brother, if you want to call it that. But look around at the society we live in. Look at London’s cameras, look at your malls; look at cellphone cameras or social media. Look at you letting Facebook suggest tagging your friends and family, or using Amazon or any online retailer and knowing it monitors your preferences. It’s not just because of terrorism, or safety, it’s also convenience. You opt for it.
Things still happen, even in places like London.
In London, things still happen because you create so much data, and have so many cameras, but there’s no one to watch them all. You can go back forensically, and say something happened at this place by looking at that video feed, but nobody’s watching all this stuff on an ongoing basis. Speaking for ourselves though, we’re focused on just the bad guys, we’re not interested in anyone else, unless they’re associated with the bad guy.
Enhanced features will give casino, hotel, retail, law enforcement and other clients the ability to run encrypted facial recognition scans against huge database of felons
Las Vegas, NV: Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company focused on creating products that link the physical to the digital in order to prevent crime and track criminals and their associates, announced on Thursday that exactly sixty days from now, on Nov. 8, 2016, they would release a new version of SSIN, their Security & Surveillance Information Network.
The full-encrypted SSIN, in tandem with a series of new and updated tools coming from the Biometrica stable in November, would give casino, hotel, retail, regulatory and law enforcement clients the ability to run facial recognition scans of any individual or group on their properties and match them against a law enforcement verified database of criminals numbering in the millions, including more than one million registered sex offenders.
Source: NAGIA Survey Data, courtesy fbi.gov
“Look at the numbers,” said Biometrica CEO, Wyly Wade. “According to the FBI’s violent crime statistics, there are about 33,000 violent street gangs, outlaw motorcycle gangs, and prison gangs, with about 1.4 million active members criminally active in the U.S. and Puerto Rico today. From 2007 to early 2015, more than 1,400 cases of human trafficking in hotels and motels have been reported to the National Human Trafficking Resource Center (NHTRC), and these numbers are believed to be understated and under-reported.”
He added, “The 2015 National Gang Report, based on surveys and statistics from federal, state, local and tribal law enforcement over the past two years, noted that almost half the prison facilities reported that prison gangs joined domestic extremist groups. Given all this, shouldn’t you know who that person on your property is, both from a security and safety standpoint? We believe the answer is yes.”
An October 2015 FBI release on Operation Cross Country, as their ongoing anti-trafficking initiative is called, stated that the sting operations they conducted to recover children, were focused specifically on hotels, casinos and truck-stops.
Biometrica CFO Nigel White added that some of the new features being released in November were being introduced with “business liability” in mind. “While you should know who a visitor to your property is in any case, organizations that run casinos are also required, for the most, to follow Know Your Customer norms, and keep Title 31 Anti-Money Laundering requirements in mind. Our tools will help them do that.”
According to the company’s Vice President of Business Development, Kevin Parker, the crux of the matter was in having usable information handy. “You should know if there’s a convicted pedophile on your property — you might allow him near the table games, but not near the children’s play area. If you run someone’s driver’s license at your hotel when they check in, it would be helpful to know if he or she was wanted for murder or trafficking drugs in another state. If you’re running a bar, or club, you’d want to know if your bartender over-served a known five-time drunk driver, or if someone caught on camera for an incident was actually a member of a violent street gang, wanted for human trafficking.”
Wade said that Biometrica’s new features would provide enhanced functions and solutions that would enable clients to link the physical to the digital to pinpoint criminals in real time or close to real time, and/or track them in quick time after an incident.
“We will deliver the ability to link an individual at a table game, front desk, or bar to all their known arrest data, including sex offender, DUI conviction, drug or other felon data. A customer will be able to tell if someone is a violent gang member, a person on a terror watchlist or a criminal on a wanted list at a national level. And then, through SSIN and Biometrica’s Fusion Center, our global security and surveillance hub, we will also provide clients with the ability to transmit that data to other people within an organization or region, or across the country and beyond, over our encrypted, peer-to-peer network.”
Over the next two months, the company will provide more information on the enhanced and new tools being released this November.
About Biometrica
Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.
To this purpose, the company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above.
INTRODUCTION: Last week, we ran Part I of a conversation on what safety, security and surveillance would look like in a dramatically different world of intelligent buildings and omnipresent cyber-physical systems. In Part II, Paul Doherty, the quite intriguing Memphis-based President & CEO of TDG [The Digit Group, Inc.] and co-founder of the AEC Hackathon, who travels from China to Saudi Arabia to Australia implementing Smart City solutions, talks to Biometrica on going beyond the concept of the “surveillance state,” and security specifics in a world where architecture and engineering meet — and sometimes, collide with — technology on every front.
Last week, you spoke about the Jeddah Tower, where you’re doing a whole bunch of innovative security protocols. Is that really a replicable model for regular hotels or retail spaces?
In the case of the Kingdom Tower [now called the Jeddah Tower], we were blessed to have a lot of leeway in the ability to implement a lot of disruptive tools and solutions. Even when you’re on the owner’s side of the table, like we have been, you’re right, you’re not going to do a single hotel, it would be cost prohibitive, but that’s only for the moment. It’s how the implementation of technology always is at first. As more competition comes in, as things evolve, the price of that innovative technology is going to fall.
But we’re changing the business model, and really “Uberizing” and “Airbnbing” the construction industry. We’re being disruptive. We’re not just contracted to do a design and then hand it off to a builder, who then hands it off to a manager like a facility manager, who, again, works for a city manager or the like.
And that helps?
Well, because we’re responsible for safety in a project of this size, we can actually now specify that our own contractors are responsible for the work, the swinging of the hammers, the laying of the cables, and running solutions for things, including, importantly, approaching matters by viewing a building as an organism, rather than as a machine.
TDG partner, Pierre Lo, and Paul Doherty (left) looking over a model of the Guangzhou Knowledge City in Guangzhou, China.
You mean you look at building a building as an organism, as opposed to a machine? Why is the machine analogy an issue, how is it relevant?
I think that’s been the big problem over the past 150-200 years. We’ve looked at building projects as machines — and even in architectural school I was always taught to look at the building as a machine. The idea behind it was control — so we’re controlling nature to be at man’s beck and call, telling ourselves, let’s leverage it just like a slave. And by doing that, we’ve done such a good job of it, haven’t we? We’ve created pollution, we’ve created terrible global issues that we have to live with, and actually, the layout of cities is awful.
They are quite awful, and rather unplanned, if you think about it.
Since we’ve really screwed it up, we have to think again. Especially in certain matters, where it’s very relevant. What happens, for instance, when we really have to have a security or safety feature that has to be intertwined so it is transparent to the process, so that people don’t think they’re living in an armed camp?
What you’re saying is, that need for not giving the impression of being an armed camp, or in a surveillance state of some kind, is why future builders need the security and safety features of a building, and the building itself not to be a separate part of the environment, like a machine, but to be a functional part of its surroundings?
Yes, that goes back to our whole idea of saying, “Okay, if the building isn’t a machine, what is it?” We’re looking at it instead as a component, a node that is part of a much bigger ecosystem, which lives and breathes, that actually has a conversation with nature, instead of trying to control it. And when you start to think of it that way, there are different ways in which you can take things like sensors and other similar tools, which, in fact, are immediately available, and try to focus them on the management of that safety and security, and getting ahead of certain events through preemptive analysis.
And the analytics part of it is critical?
Yes, the analytics part of it is key. We have to understand how the tracking of a physical human being happens, and if you’re living within an organism, now things start to get interesting. First, think of the building as a machine. You’d have to go to the equivalent of a router or the mainframe of a city [to get information]. What happens when the mainframe is distributed? What happens when the security is not inside of an operation center, or the security system goes down and you need information in real time? Now, instead of that, what happens if we examine a bio-mimicry way of looking at nature, and start to see what security features already exist in nature, and how does nature put those things in place? We realize it’s actually a combination of topography, vegetation, and the animal kingdom, and it all tends to balance itself out in the end.
You have a circle of life deal going here.
Yes, even certain things eating other things or things that can harm you. Look at it this way. If you’re in a forest, it has built in protections, to protect itself. So what we need to do is replicate those in our urban environments, and there’s your balance. You cannot go too far with security when you make people feel threatened, even though the threat may be real or imagined.
Look at what the TSA does to people. You go in with the preconceived notion that something’s going to happen and it’s going to be wrong. What a way to live! We have to rethink this, especially when it comes to living spaces. When security becomes transparent to the process, when people start to trust that “nature will take care of it,” the implementation in a city of safety and security will take care of itself, now we have a different kind of conversation and can start to get out from underneath this idea of terrorism.
Let’s just back up a bit here. What you’re saying is that in well-planned urban spaces of the future, because security and safety features will be merged seamlessly with the ecosystem, they will be omniscient in a sense, and help us, as a society, deal with issues like terrorism?
Terrorism is also a way of control, isn’t it? It’s a state of fear, both real and imagined because of things that happen. No one wants to get hurt or killed, and that results in our having these controlling, intrusive systems in place. When you start to move into this new world of safety and security, you have to keep in mind that how that [safety and security] gets done is not as interesting as being transparent enough that people feel comfortable with the process of it being done.
You’re saying the fact of those processes being transparent will help us feel safer?
I really don’t want this to turn into what Hollywood or the gaming industry says what the future of cities will look like.
Devastated, and in a perennial state of urban warfare?
Yes, a dystopian police state where everything is very scary and dark. We don’t want that.
What’s fascinating is that we’ve talked at some length, in Part I of this conversation, and now, about transparency. What do you tell the privacy advocates, most of whom are completely fixated on the invasion of privacy?
They’re on the wrong side of history. It’s not me saying it! Just look around. There’s an emancipation that happens when people start to trust that things are okay, that’s when the breakthrough technologies will keep on coming. Like this new technology [Note: “invisible operating systems, mentioned in Part I] — it’s like hide and seek, if you can’t see it, you can’t hack it.
That’s the virtual world. What of the physical world?
That’s where the physical world needs to be smarter. Architects, engineers and contractors, people that are building environments, they have to understand that when these bad guys can’t break in as easily into the cyber world, they’re going to return to try and break into the physical world.
Right now, the entire security of most companies, governments, even individuals, is to build firewalls to protect your document or your transmission. That’s what stuff like Norton AntiVirus etcetera do — they create walls to make sure your information is not attacked from the outside. What we’ve seen over the past few years, through Wikileaks, through [Edward] Snowden, and those types of folks, is that inherently, your data wants to be free, and it will find its way out. So you’re in a two-front war with security. You have to worry about people breaking in, but more importantly, you have to worry about your internal stuff breaking out.
You’re asking people to change the way they think!
Not really. John Seely Brown [Former Director of Xerox Palo Alto Research Center] wrote a book in which he said, if the data wants to break out, you can’t stop it. It’s a natural occurrence. It’s like oxygen. Yes, you can put it into a package, but it will find its way out again, because that’s how it inherently is. But when we have tools that say it’s okay for it to be oxygen and out there, because it’s protected, or we have sensors out there that say, it’s bad air, or this is good air, so let’s start to take a look at what that really means, it changes things.
So the privacy issue then doesn’t exist, in a sense.
It takes on a different aspect. People are worried, for instance, about their data being corrupted from the outside, someone swiping their identity. But what happens when the data that’s inside of you wants to get out? It’s a double-edged sword and we’re only just starting to realize it. When people are more concerned about privacy they should really be having a different conversation. I can follow you on Facebook for a week and learn whatever I want to learn about you because you’re giving it away.
True. And it’s not just Facebook or Twitter, or LinkedIn, or other social media, it’s also through sites like Amazon, because of the convenience.
Exactly. You’re happy to put your card on Amazon and keep it there, because it’s convenient, and you trust them, and it makes life easier for you.
Here’s a question about a company like Biometrica, where we look at security and surveillance in both the physical and digital worlds. We spot a thief or a suspicious character, grab his photo from the surveillance stream, create a file on a known or unknown subject, put it in our database, send it out on our SSIN, the Security and Surveillance Information Network, on a one-to-one level, one-to-many level, or put it out globally on a network, or build a Blacklist etc. Now someone looking at it might call it a surveillance state. But what we’re really doing is using the data to create a system where we can help you anticipate threats, and track events or incidents as and when they happen. How would that, or the nature of what we now do, change in a Smart City environment or ecosystem?
I’m not sure things would change, as such, and I don’t think that’s needed. I think what would happen is that certain tools could be augmented as technology begins to take better control of its interaction with the physical world. Here’s an instance. I think if Biometrica had been implemented with the federal government, I think a major situation, like the one at the Washington, D.C. Navy Yard a few years ago, or others, could have been resolved better perhaps, and almost certainly quicker.
Think about it. A phone call comes in, there’s an active shooter and he’s killing people. They don’t have an immediate description for this person. Several different law enforcement units were deployed, some had uniforms on, others didn’t, there was a lot of confusion. Everyone had their guns drawn and they were all pointing at each other, the perpetrator was someone with access to a “secure” building. Now with Biometrica, imagine this. Cyber-physical systems start to do things better and faster than human beings.
Here’s one scenario: If your technology had been implemented down there, you’d have had eyeballs for the CCTVs, you would have had control over what’s called lockdown lockout, which is a process that most buildings have, where you can send signals out to doorways and they can lock automatically and unlock, it’s used for crowd control. If you want to push people away from a dangerous situation, you keep certain doors locked, until they find an open one and they flood out.
It’s like putting a tourniquet on a bleeding vein or artery — you put temporary pressure on it to divert flow elsewhere. Now, imagine the situation where a phone call comes in, that there’s an active shooter. But even before that phone call comes in, let’s say the building also has this technology called ShotSpotter Technology, or some other gunshot detection technology, and it “hears” a gunshot. Immediately, the CCTV cameras you have data access to start looking out for that perpetrator.
And that real time data access is what matters?
Gunman taking aim with an AK-47.
It means that you can get a lock on him through your “eyes in the sky.” You, and therefore, other people, have access to what he’s doing, as he’s doing it. Let’s say he runs east, toward Building Two. In our scenario, he’s going into a doorway that has two doors, an outside one, then an airlock, and a secondary one leading inside. You don’t lock him out, because you need to catch him. So you let him in, but suddenly, the secondary door gets locked, as does the outside one. Once he’s inside, the building senses him, and he’s trapped in that airlock.
So, hypothetically, even before that 911 call is finished, that entire process could be over in under a few seconds. So now, when the police or other law enforcement bodies come in, it’s resolved, rather than being a standoff, a search-in-the-dark operation, and potentially having people in law enforcement be killed. But again, it’s a process of getting smart and having that trust that we have these processes and protocols for certain situations in place.
The situation you’re talking about requires a building system to be quite advanced. What happens in existing buildings?
Some building systems may not be very sophisticated, but perhaps that could be built into the building code, as a baseline. Building codes evolve, and things are put into place at different times. What’s the cost of not doing it to safety and security of the people that live and work in it? Building codes need all kinds of things. Like crash bars on doors in emergency exits that need to swing outward. All buildings in the United States need to have that. So why not add an extra layer? It’s really now about political will.
![Credit: brian0918™ (Own work) [Public domain], via Wikimedia Commons The structure of part of a DNA double helix.](https://b4321094.assetcdn.net/2.0/4321094/wp-content/uploads/2020/04/DNA-173x300-1.gif?lossy=2&strip=1&webp=1)
