Shoppers let their fingers do the buying

By Helen Jung

Associated Press

SEATTLE – Christopher Conrad cuts off telemarketers on the phone, regularly reminds direct-mail associations to keep him off their lists and diligently opts out of mass e-mail lists.

But the Seattle commercial photographer didn’t hesitate to give his fingerprint, credit card information and phone number to a company he had never heard of before.

Conrad is one of the 2,000-plus customers of the West Seattle Thriftway grocery store who signed up in a pilot program run by Oakland, Calif.-based Indivos Corp. that links customers’ fingerprints with their credit or debit cards and allows them to pay for groceries by simply running a finger over a scanner.

“I always leave my wallet in the car or forget it in another pair of pants,” Conrad said. “It doesn’t feel so much like an invasion of privacy, but is more like a convenience.”

Like it or not – and many don’t – technology that links your fingerprint with a credit card or bank account is making deep strides into everyday purchases with businesses from Thriftway in Seattle to three Kroger stores in Texas.

But privacy advocates and others are questioning whether the lure of convenience outweighs the vulnerabilities of the technology and fears of privacy intrusion.

“With most of these applications there’s an interesting starting point, and then there are new applications and pretty soon you have full force Big Brother watching over you,” said Marc Rotenberg, executive director of the Washington, D.C.-based Electronic Privacy Information Center, a public-interest research group.

And currently, there are no federal laws regarding selling of fingerprint databases and information, both privacy and fingerprint companies say. “There could be some abuses,” Rotenberg added.

But Thriftway’s pilot program has proved popular from its May 1 adoption, said store owner Paul Kapioski.

“A lot of them walked right in the door and said where is it, let me sign up,” said Kapioski. He said representatives from other grocery stores have come in to look at the program.

It’s already in Texas, at some Kroger Co. grocery stores, which use technology from an Indivos rival, Biometrics Access Corp. Ron Smith, Biometrics Access chief executive, says it is helping Kroger cut down on check fraud.

Kroger owns QFC, which recently created an uproar locally by offering discounts to customers who sign up for its advantage card.

At Thriftway, customers scan one finger five times, to get an accurate image, which is then digitized and stored in Indivos’ database. The customer also registers a bank account, credit card, debit card or even food-stamp account and a seven-digit number, like a phone number, which will be used to help pinpoint that fingerprint’s location among the thousands in the database.

Then, customers can simply scan their finger at checkout counters and enter the seven-digit number. That scanner picks up 10 or 12 points at random, compresses that down to a 300-byte package, shoots that to the database in Oakland, compares them against the fingerprint in the database and sends back verification.

A display prompts customers to select which account they wish to use and then to enter the transaction amount, which is then verified by the clerk.

In practice, it’s not a huge time savings over credit-card transactions. The customer still needs to punch in the seven-digit number as well as key in approval for the purchase. And they still have to sign a receipt for credit card transactions or enter another personal identification number for a debit card purchase.

Some customers said they didn’t like the idea giving away something as personal as a fingerprint. The fear was that even if the database is kept by a private business and not linked to buying habits, it might not always reside with that company.

“To me it’s the same thing as the government having your fingerprints,” said Jennie Helms, a West Seattle Thriftway shopper. “They don’t need to know what I buy.”

But besides privacy, some researchers have already shown that fingerprint readers are hardly spoof-proof, said James Wayman, former director of the U.S. National Biometric Test Center and now a biometric identification researcher at San Jose State University, in an e-mail.

Recently, a cryptography researcher in Japan created a fingerprint mold out of gelatin and succeeded in fooling fingerprint scanners four out of five times, according to reports, a success which Wayman called “very old news.”

But while acknowledging that all technology is ultimately vulnerable, the fingerprint companies’ executives said everyday would-be thieves don’t have the means, much less access to a viable fingerprint, to crack one of their fingerprint sensors.

Meanwhile, others worry that companies will sell the database of information to marketers. Indivos chief executive Phil Gioia said his company signed a contract with Thriftway not to sell that information to marketing companies.

The technology brings up issues such as who owns the fingerprint, said Lee Tien, senior staff attorney for the San Francisco-based Electronic Frontier Foundation. But there’s bound to be more unknowns that customers, companies and technology companies are going to have to negotiate in a sticky area that lacks federal laws.

“This is effectively going to raise a lot of novel legal issues,” he said.

Even Gioia recognizes that many issues are yet to be settled. For example, Indivos could some day be acquired by a credit-card issuing bank, handing over ownership of the fingerprint database to that financial institution, but “that’s in the future … we haven’t nailed that down.”