In the aftermath of 9/11 and responding to growing national as well as European regulatory demands for increased security at airports, Aeroports de Paris launched a trial of several biometric systems in an effort to improve the reliability of access pass control of staff entering restricted areas.
ADP, which manages Paris airports Roissy-Charles de Gaulle and Orly, conducted operational trials with three biometric technologies: Fingerprint authentication, iris recognition and hand geometry. Face recognition was not included in the trial because of low performance identified during laboratory technical tests, notes ADP Director-Airport Security Division Jean-Louis Blanchou. The test phase lasted six months and finished at the end of 2002.
The assessment of the three chosen technologies was multidisciplinary and included a study of regulations, laboratory technical tests, operational tests and market surveys. Some 5,000 employees working on the premises of CDG and ORY, but not necessarily for ADP, participated on a voluntary basis. The airport operator opted for the biometric control system based on fingerprint technology because of "its performance, its imposture protection and its ease of use," Blanchou states. The fact that the marketplace of fingerprint recognition is widespread, mature and competitive was an additional incentive in selecting the technology, he adds.
When considering the implementation of a new technology for pass control of staff entering restricted areas, ADP wanted to meet three goals: Reliability, speed and precision. Traditionally, all personnel working in such areas of the two airports were screened and had their access rights checked by security agents who controlled the employee's airport ID and national ID cards manually. As such, the checking wasn't too different from that employed for passengers entering the terminals.
Immediately after 9/11, ADP initiated a renewal process of all airport badges. The access rights of more than 100,000 airport workers were checked and a hologram was incorporated into the revalidated badges to reinforce reliability. ADP invested eur1.8 million in the process, dedicating 90 employees and creating 40 stations to produce the badges. The operation lasted four months.
In March 2003, the airport operator went a step further and invested eur1.5 million to implement an automated badge inspection process, installing some 100 computerized checkpoints that controlled the validity of the badges against a central database in real time.
The third phase of the program was implementation of a Biocontrol system designed to prevent the use of out-of-date, lost, stolen or falsified cards as well as "not yet declared" stolen cards, and also to remove the national ID card control. Investment in the biometric solution amounted to eur1.8 million. The system offers multiple advantages, Blanchou says. "It performs a real-time checking of the validity of the airport ID against parameters like validity date, authorized areas and a blacklist. For example, the employee may have a card with a valid date but his entrance into the security restricted area may have been restricted since the card was issued. The biometric control ensures identity of the cardholder. Somebody who wants to use a stolen card can't pass the biometrics control even if the stolen card is not yet declared as stolen by the owner."
The system also helps security agents detect if the printed information on the airport badge is falsified or has the wrong photo, name or authorized areas. An additional advantage, Blanchou believes, is that the security agents now are able to divert their attention to other security operations.
There were some concerns when applying biometric technology, including worries over privacy. The provision of information to all airport employees is very important here, he says: "Our three trials helped us to explain these new technologies." ADP's Biocontrol is fully compliant with the requirements of CNIL, the French committee on privacy and personal data protection--no biometrics central database, no connection with police databases. All the biometrics data are stored in the memory chip of the airport ID and all data transfers and storage are secured. To protect against possible misuse, says Blanchou, "We have chosen fingerprint readers with a high imposture protection against fake fingers."
ADP contracted with Sagem and Omnitech to provide the technology. The digital print of an employee's two index fingers is inscribed on an RFID chip that is inserted into the badge. "We chose to use a new RFID chip (13.56 MHz, 4 kbps) because we need to store the biometric data inside the memory of the card to be compliant with the CNIL requirements," Blanchou explains. "Also, the use of a contactless card doesn't need a lot of maintenance." Each time a control station reads a card, it downloads the biometric data from the chip to make the authentication.
The biometric security solution for staff entering restricted areas has been fully implemented since August. In the early stage of the program, ADP had 17 enrollment stations. This has been reduced to six now that all of the approximately 120,000 employees at the two airports, of which fewer than 10% work for the airport operator, have been enrolled. An enrollment takes about 3 min. and only about 0.07% percent of employees can't be processed by the systems. In the first four months, from April through July last year, 90,000 workers were enrolled.
Some 106 fixed Biocontrol stations are operational at CDG and ORY and mobile control equipment is slated to become active before summer. A control takes about 4 sec., half the time it took for manual processing of the national and airport ID cards by a security agent. Up to 30,000 entries are being controlled each day and an average of 13 per day are refused.
The employees appear to be satisfied with the system. "They think it's very useful for the airports' security and they're not afraid of the use of a biometrics technology," says Blanchou. He notes that Biocontrol has practical advantages for employees because airport workers no longer have to show their national ID cards to security agents. Finding a national ID card can be a cumbersome task when wearing heavy clothing, carrying or pushing something or when the employee is in a hurry.
To ease possible worries or negative conceptions about biometric controls, ADP chose not to make usage mandatory at the beginning. Employees were allowed to enroll gradually and spontaneously for fingerprint authentication. Usage became mandatory only after almost all employees had enrolled voluntarily