Biometric access control pilot project adding more airports

March 6, 2009
Standards project tests biometric procedures for category X and I airports

An industry-led effort to create a framework that will allow different ways for the nation's airports to adopt standards for biometric enabled access control for their employees is in the early phases of a pilot project that includes six airports with three more on the way.

Six airports are currently participating in the Biometric Airport Security Identification Consortium (BASIC) pilot begun last spring and all are in the first or second phase of the four phase effort, Lori Beckman, an aviation security consultant and the coordinator of the BASIC pilot projects, tells TR2.

Those participants represent a mix of category X and I airports. A category III airport is currently going through the approval process to joint the pilot and two other airports, one a category II and the other a category IV, have stepped up to participate, she says.

Having a range of airports participate, particularly from large to small, will help uncover the various challenges that exist in creating a common framework for biometric enabled access control and also help set forth best practices that may apply to some airports and not to others, Beckman says.

"These are the early adopters who are going to share their expertise and learning with the broader community and they're doing it consistently," Carter Morris, the head of Transportation Security Policy at the American Association of Airport Executives, the trade group that represents airports, tells TR2.

The airport categories refer to Transportation Security Administration classification system in which basically the category X airports have the largest number of passenger boardings and the category IV airports the least.

BASIC was established last spring by operators of some airports and AAAE to stave off a potentially one-sided effort by TSA to force a rulemaking on

airports related to biometric enabled access control (TR2, April 4, 2008).

Instead, the airports wanted to get out in front on the issue, working in partnership with TSA, to build on the technologies and practices with access control that they already have, Beckman says.

Airports have been working access control for their employees and others such as the airlines, for over 20 years.

"So what we're able to do is leverage decades of expertise in credentialing and access control at commercial service airports to a new higher bar without reinventing the wheel," Morris says. "We need to leverage training mechanisms, accountability mechanisms, even some of the contractual and legal relationships between the airports and the tenants to make sure that's right. So that's why having it as an airport driven program makes a lot of sense and gets biometrics going a lot sooner and makes for a good cooperative approach with TSA."

Existing Biometric Access Control

Some airports already have biometric enabled access control to one degree or another. A survey conducted by AAAE last year of airports received 56 responses, with 39 percent saying they either have or plan to use biometrics. Of that 39 percent, 73 percent use or plan to use fingerprints, 19 percent use or plan to use hand geometry, and the remainder some other modality.

Phase one of the project is concerned with how biographic information of employees is shared with the government. In the second phase BASIC and TSA are working out how to exchange the reference biometric, in this case the fingerprints taken from employees for background checks that will be conducted by the government.

The third phase will deal with technical interoperability. For example, if employees at one airport, such as mechanics, have to work at another airport, how will their access control be handled? Beckman says that in this example a echanic that is flown to a smaller airport to work on an aircraft is typically escorted around. In the future, that mechanic will go to the badging office and submit a fingerprint and the local airport will be able to quickly know if that person has been cleared or not, she says. That doesn't mean the mechanic will necessarily be allowed to get through an access control door, she adds.

In the fourth phase airports will integrate biometrics into their access control system. Current plans for biometric enabled access control allow for various modalities to be used, such as fingerprints, hand geometry or something else. At some smaller airports it may not make sense to have biometrics on the door and instead mobile readers could be used, Beckman says.

"It's not one size fits all," she says.

There are no firm dates for the airports getting through all the phases, Beckman says. AAAE's Morris says that unlike a typical government pilot project that ends and is analyzed for how to proceed next, under BASIC the participating airports will be implementing biometrics for access control as part of their standard operating procedures and will share their expertise with other airports.

Beckman also says that given the poor economy and how it may impact each airport differently also plays into how much time one airport or another is devoting to biometric access control.

Indeed, Portland International Airport, which is one of the six airports that is in the initial phases of BASIC, has budgeted to complete its project in three years. However, given the more difficult financial environment and the need to juggle other big projects the airport's BASIC effort may be stretched further, Mark Crosby, the chief public safety officer for the Port of Portland, tells TR2.

When the airport moves into the third phase of BASIC is when the big investment will have to be made to switch out the cards and readers, Crosby says.

Portland International's employee access control system currently is based on a credential that has a magnetic stripe and a PIN, Crosby says.

Biometrics are coming, he says. "It's a natural evolution of access control."

Portland hasn't decided yet which biometric modality it will use for access control, Crosby says. The airport may also switch its credential to a proximity card as well, he notes.