Singapore in world first for facial verification

A woman absorbed by her mobile phone in front of the Singapore skyline

Singapore will be the first country in the world to use facial verification in its national identity scheme.

The biometric check will give Singaporeans secure access to both private and government services.

The government's technology agency says it will be "fundamental" to the country's digital economy.

It has been trialled with a bank and is now being rolled out nationwide. It not only identifies a person but ensures they are genuinely present.

"You have to make sure that the person is genuinely present when they authenticate, that you're not looking at a photograph or a video or a replayed recording or a deepfake," said Andrew Bud, founder and chief executive of iProov, the UK company that is providing the technology.

The technology will be integrated with the country's digital identity scheme SingPass and allows access to government services.

"This is the first time that cloud-based face verification has been used to secure the identity of people who are using a national digital identity scheme," said Mr Bud.

Verification or recognition?

Both facial recognition and facial verification depend on scanning a subject's face, and matching it with an image in an existing database to establish their identity.

The key difference is that verification requires the explicit consent of the user, and the user gets something in return, such as access to their phone or their bank's smartphone app.

Facial recognition technology, by contrast, might scan the face of everyone in a train station, and alert the authorities if a wanted criminal walks past a camera.

"Face recognition has all sorts of social implications. Face verification is extremely benign," said Mr Bud.

Privacy advocates, however, contend that consent is a low threshold when dealing with sensitive biometric data.

"Consent does not work when there is an imbalance of power between controllers and data subjects, such as the one observed in citizen-state relationships," said Ioannis Kouvakas, legal officer with London-based Privacy International.

Business or government?

In the US and China, tech companies have jumped on the facial verification bandwagon.

For example, a range of banking apps support Apple Face ID or Google's Face Unlock for verification, and China's Alibaba has a Smile to Pay app.

Many governments are already using facial verification too, but few have considered attaching the technology to a national ID.

In some cases that's because they don't have a national ID at all. In the US, for example, most people use state-issued drivers' licences as their main form of identification.

China hasn't attempted to link facial verification to its national ID, but last year enacted rules forcing customers to have their faces scanned when they buy a new mobile phone, so that they could be checked against the ID provided.

Nevertheless, facial verification is already widespread in airports, and many government departments are using it, including the UK Home Office and National Health Service and the US Department of Homeland Security.

How will it be used?

Singapore's technology is already in use at kiosks in branches of Singapore's tax office, and one major Singapore bank, DBS, allows customers to use it to open an online bank account.

It is also likely to be used for verification at secure areas in ports and to ensure that students take their own tests.

It will be available to any business that wants it, and meets the government's requirements.

"We don't really restrict how this digital face verification can be used, as long as it complies with our requirements," said Kwok Quek Sin, senior director of national digital identity at GovTech Singapore.

"And the basic requirement is that it is done with consent and with the awareness of the individual."

GovTech Singapore thinks the technology will be good for businesses, because they can use it without having to build the infrastructure themselves.

Additionally, Mr Kwok said, it is better for privacy because companies won't need to collect any biometric data.

In fact, they would only see a score indicating how close the scan is to the image the government has on file.