Just three years ago, facial and iris biometric scanners looked like James Bond film props but were cumbersome to set up and functioned poorly without ideal lighting and camera placement. Even worse, their software often interfered with other applications.

Although problems linger, biometrics has been improving rapidly. It can't yet replace human judgment, but it can replace the password.

The iris of the human eye develops before birth through a process called chaotic morphogenesis, and no two irises are the same. Even identical twins have four distinct irises, which is what makes iris scanning a sure method of authentication.

The GCN Lab used the $239 Authenticam, made by Panasonic Security and Digital Imaging Co., to test iris- and facial-recognition software. The setup was actually two cameras, one atop the other. The upper camera, originally developed by Iridian Technologies Inc., performed iris recognition only. We coupled the second camera, similar to a standard Webcam, to Visionics Corp. facial-recognition software.

Iridian's KnoWho iris-recognition software, which costs $25 to $75 per user license, encodes a captured image of the iris for subsequent matching and verification. The KnoWho version we tested came with $49.95 SafLink 2000 biometric administration software from SafLink Corp.

Private ID, a second Iridian app, came bundled with the Panasonic Authenticam. Private ID captures the iris image for KnoWho. The Iridian products gave the most effective biometric security among the products we reviewed. They never misidentified a user and couldn't be tricked by environmental changes.

The Panasonic Authenticam had three light-emitting diodes at the bottom that projected safe infrared beams, allowing iris recognition to proceed at any level of ambient light. In the windowless lab, even with lights off, we could enroll users on a Pentium 4 PC with the Iridian software installed.

Our testers found iris verification a little awkward at first, but once they got used to it, they thought it worked as fast as fingerprint log-ins.

Iris enrollment took two steps. First, each user placed an eye in front of the camera lens and watched for a yellow dot to appear. Next the user moved away to about 18 to 22 inches from the Authenticam, at which point the yellow dot turned green.

Once that color transformation occurred, the user had to remain still while the software finished the enrollment.

Private ID and KnoWho worked fairly fast. Once an iris pattern was captured, enrollment took little more than a second -- one second slower than most fingerprint readers but hardly a noticeable difference.

Visionics' FaceIt calculated a digital identity code for each user by measuring 14 out of 80 possible landmarks -- facial features such as eyes, lips and nose. Such calculations should be unaffected by new facial hair or haircuts.

We had problems at first making the lighting consistent enough for FaceIt. If the camera moved, all the users had to be re-enrolled. The more often they enrolled, however, the more consistently FaceIt could identify them.

The software costs up to $30,000 for a three-camera system using FaceIt Argus, which is for large areas such as airports. A desktop version bundled with SafLink 2000 costs less than $50 per user.

Facial-recognition technology, unlike iris identification, can be fooled by similar measurements -- for example, faces of twins have nearly the same measurements.

AcSys Biometrics Corp. put what it calls holographic/quantum neural technology into its AcSys Face Recognition System Entry software to determine a user's most noticeable characteristics.

Unlike Visionics' FaceIt, which looked for facial landmarks, AcSys's engine compared the entire face in three dimensions against 20,000 images in a database. From the similarities and differences, it interpreted what made one face different from others.

Accuracy was affected by the environment, just as with the Visionics software. The lighting for AcSys's product had to be consistent.

If users re-enrolled under different lighting, FRS Entry could learn to recognize them in both environments. But that was time-consuming because the new images had to be transplanted into the users' profiles.

FRS Entry, unlike FaceIt, recorded a new image each time it verified a user. All the images went into the user's database template. A user who, for example, grew long hair would continue to be recognized.

As with the Visionics software, the more pictures of the user, the better. The longer we used FRS Entry, the better it got at distinguishing people who looked somewhat alike.

But once again, if a face could fool a human guard, it could fool FRS Entry.

In a one-to-many setting for identifying a face in a crowd, FRS Entry wrongly identified PostNewsweek Tech Media President David Greene as Editorial Vice President Thomas R. Temin. (PostNewsweek Tech Media is a unit of The Washington Post Co., which owns this newspaper.)

Its error was probably caused by an office lighting change. But as the software gathered more images of both men into its database, it learned to distinguish them even when Temin wore Greene's glasses.

Although AcSys designed FRS Entry for people to enter secure locations and not as a log-in tool, the same recognition engine is available in a stand-alone product.

AcSys FRS Entry requires a high-end camera and a dedicated, fast PC. The complex pricing structure depends on the number of users, physical infrastructure and number of doors monitored.

The company gave us a rough estimate of $10,000 per door, or $1,500 per user up to 99 users, not counting installation or hardware.

Facial-recognition technologies are still immature. But once they better adapt to lighting changes, we believe they stand a good chance of replacing quite a few security guards.

At the moment, iris scanning is more reliable than facial recognition, though that could change. Database storage and processing power requirements for facial recognition probably will remain higher than for iris scanning as both technologies mature.

To respond, e-mail editor@gcn.com or visit the Government Computer News Web site at http://www.gcn.com.

Reported By Government Computer News, http://www.gcn.com

10:18 CST