UR® Codes: Revolutionizing Biometric Identity Verification with Security and Privacy at the Forefront

With biometric solutions becoming more pertinent daily, government and law enforcement agencies constantly seek secure and practical solutions. One solution that can provide both is UR® Codes, a new method for proving identity verification developed by FaceTec.

UR Codes - allow you to prove who "You Are" - and the protocol creates a cryptographically-signed, biometrically-bound linking individuals to their physical and digital credentials. Government and law enforcement agencies can leverage this technology to enhance their identity verification processes. Since UR Codes are encoded by global QR code standards, they can be scanned with any commonly available device equipped with a camera (smartphone, laptop, kiosk), making them easy to integrate into existing systems.

To introduce UR Codes to the biometrics community, Geoff Slagle, Executive Vice President for Digital Identity at FaceTec, will present at IDGA’s Biometrics for Government & Law Enforcement event this December 10-11 in Washington, DC. Before the event, Geoff sat down with IDGA to discuss where UR Codes fit into the future of identity verification and how FaceTec ensures personal data privacy.

Can you explain how UR Codes bind an individual's physical and digital credentials? What makes this approach different from other digital identity verification systems?

What makes UR Codes unique from other identity verification approaches is their ability to prove an individual is bound to a credential issued to them. This is achieved thanks to maintaining a remarkably high match rate while only having to store a minimal amount of data in the UR code. For example, I have UR Codes printed on my business cards - small and unobtrusive - but they carry a wealth of secure and trustworthy information. We’ve managed to shrink the biometric data without losing matching accuracy, a significant accomplishment. Most systems that store images in a barcode face major limitations: Images are large, forcing the barcode to grow beyond usable dimensions, and there’s also the issue of privacy—you don’t want your image embedded in a code that can be easily accessed by machines.

With UR Codes, we’ve solved that by not storing images at all. Instead, the technology is used to process a 2D photo from the issuing authority’s database. The photo is converted into a FaceVector™. That vector is minified and placed inside the barcode, but it’s impossible to reverse-engineer or reinflate it. The only person who ultimately can benefit from it is the person for whom it was generated, namely me. This approach makes UR Codes particularly valuable for government and law enforcement because it’s far more secure than a traditional ID card.

Unlike traditional ID methods, where you trust a human to decide that a picture on a physical ID matches the person holding it, UR Codes handle this function with greater accuracy, whether remotely or in person. Many current systems rely on users holding up an ID to a camera, but how can you be sure that’s a legitimate driver's license, for example? And, even if it were, how would you know that the person in possession is the one to whom it was issued? Fraudsters exploited this during COVID, causing billions in damage because the defenses in place are essentially inadequate. With UR Codes, we can match the identity with a high degree of accuracy, and because we specialize in liveness detection, we can ensure it’s a real person on the other side. You get 3D face verification that’s proven in real-time, giving you certainty that it’s the right person conducting the transaction, even remotely.

One of the key promises of UR Codes is to promote privacy and defend against fraud, both in person and online. How do UR Codes achieve this while ensuring that personal data remains secure?

UR Codes were designed from the ground up with privacy and security in mind, a major difference compared to older systems. Many past approaches to security and privacy were reactive, only addressing issues after they had already caused problems. However, we took a proactive approach with UR Codes. One of the key ways UR Codes protect personal data is that the issuing authority - whether it's a government agency or another trusted entity - decides exactly what information is embedded in the code and ensures it’s encrypted and secure. This means that only the minimum necessary information is included, and you can be certain it comes from a legitimate source.

Further, the system allows for verification that the individual claiming to be connected to the UR Code is, in fact, that person. Remember, the personal data embedded in the code is not an image or any directly identifiable information but a face vector derived from a 3D FaceMap. This vector is minified and it cannot be reverse-engineered or used by anyone else.

In physical settings, someone can scan the UR Code and verify, using face biometrics, that the person matches the code. Online, the combination of 3D face verification and liveness detection ensures that the individual is who they say they are. This creates a highly secure and privacy-centric system that surpasses traditional identity verification methods while being extremely cost-effective. In fact, for many sectors like government and law enforcement, UR Codes are provided at no cost.

What are some of the practical steps government and law enforcement agencies need to take to implement UR Codes effectively? What are the challenges they might face?

Any identity and credential programs they manage are candidates for UR Codes. The process for running the software to generate the codes is easy to implement. Due to their ubiquity, QR codes (the standard that UR Codes leverage) are familiar to a large portion of the population, and the user experience with them is intuitive.

There don’t appear to be any significant implementation challenges. UR Codes assist in addressing a common challenge in identity verification: human error due to fatigue or inattentiveness in matching faces. Traditional methods, such as checking IDs and comparing photos, lead to mistakes, especially after long work periods. By incorporating biometric validation like 3D facial verification, UR Codes reduce the risk of errors and fraud. This advanced technology helps prevent imposter fraud, where genuine credentials are used by someone other than the rightful holder. With its ability to deliver high security and accuracy, UR Codes are a powerful solution for government and law enforcement.

What do you see as the future of digital identity verification in government? How do UR Codes fit into broader trends in biometric technologies and the shift towards decentralizing identity management?

The future of digital identity verification in government is rapidly evolving, and I believe UR Codes will play a critical role in that transformation. As we move toward more decentralized identity management, governments recognize the value of shifting away from centralized systems requiring constant validation from a central authority. UR Codes align with this trend by allowing individuals to carry their identity credentials securely and privately in a digital or physical form without needing to “phone home” to a database to verify their identity.

What makes UR Codes particularly valuable is their versatility. They can be used online and offline across various use cases, from verifying voter eligibility to authenticating government-issued credentials like driver's licenses. This ability to securely store and verify identity without needing to rely on a centralized system provides a more user-centric approach to identity management, something that's becoming more important as governments look for ways to protect citizens’ privacy while maintaining robust security measures.

Additionally, UR Codes fit into the broader trends in biometric technology by offering a more privacy-centric and decentralized model. While centralized biometric systems require individuals to trust that their data is stored and handled securely by a third party, UR Codes are a much more secure method. The biometric data embedded in a UR Code is only used for verification, making it significantly more difficult for malicious actors to exploit.

As the demand for privacy and data protection grows, we'll see more governments adopting decentralized identity solutions like this. UR Codes are positioned to be a key component in this shift. They are simple, effective, and secure while avoiding fraud and privacy concerns.

What are you hoping attendees take away from your session at the Biometrics Summit?

At the Biometrics Summit, I hope attendees walk away with an appreciation for the mission we’re undertaking at FaceTec, which is to move beyond the traditional methods of identity verification that rely on a human to look at a photo and judge someone’s identity. While there are already biometric solutions within the government, the world outside of government is vast, and many individuals interact with government systems. Whether we realize it or not, government agencies are still susceptible to fraud, just like everyone else, because humans aren’t perfect at making these identity judgments.

Our goal at FaceTec is to solve this problem equitably, ensuring that digital identity verification is not just for the privileged who carry the latest smartphones but also for those who may have nothing. We’ve built our solution with privacy and security at its core, using an approach to ensure there’s no vendor lock-in, a perpetual license, and making it essentially free to use. Everyone deserves the dignity of secure, reliable identification, whether accessing services in person or online.