Photo: 123rf
Testing has cleared the government's main facial recognition system of having any significant racial bias, paving the way for its mass rollout.
It is the first time that bias in the biometric algorithms that match images has been tested for among New Zealand ethnic groups.
The Identity Check system has already been in operation for almost a year at the Ministry of Social Development, where 70,000 people have used it to prove who they are.
It sees users send a photo of themselves in on their smartphone, which is matched automatically against their photo in the passport or driver's licence database.
"This is a service that we want to have widescale adoption," Tim Waldron, who leads the project at the Internal Affairs department, said.
"So to do that, I think, taking those extra steps of due diligence by doing testing against New Zealand faces of people that will actually use the system is a good safeguard,"
Facial recognition AI globally has a history of being less accurate for people with darker skin tones, though it has been on the improve.
"What we can say today is that, from that testing, there is no significant bias that's been picked up through independent testing," Waldron said.
A year ago, his developers were still struggling with an "unconfirmed risk relating to racial bias, or the level to which it may exist, in DIA's technology."
They were relying on United States tests as a basis for the early rollout by MSD.
However, even then, a Māori oversight group was expressing confidence the tech would catch up - and the new testing shows it has.
The full bias testing results will be released at the end of the month.
Australia's BixeLab did the analysis on a representative sample of 150 New Zealanders. Bixe is one of just three labs globally accredited to do such work.
"That's the start of transparency with the public and actually making sure these services perform as they become more and more commonplace," Waldron said.
The system is poised for wider rollout on the back of a development budget of just $850,000 over three years.
"We've leveraged off existing technology, we've had to kind of work smarter, rather than sort of saying we're going to build a new solution," Waldron said.
But as it grew, could Identity Check become a honeypot for hackers, a concern raised in Australia as it makes similar moves?
"The security risk changes" in that case, but so far there had been no hacks or breaches, Waldron said.
The second major hurdle overcome - ensuring people could not fool the system with the likes of fake photos - had been addressed using upgraded "liveness" tech.
New figures show people using Identity Check have succeeded 94 percent of the time, with very little variation between Māori, Pasifika and Pākehā.
"MSD have done a massive job in terms of making sure this works for their customer base," Waldron said.
"What's changed significantly is obviously the success rate ... when you're up into the 90 percents, that completely changes the value proposition."
Reports to the previous government said biometric iID verification was the gateway into multi-billions of dollars of economic growth from people being able to far more quickly and securely access public and private services - for example, by setting up a bank account without once having to approach a counter or be face-to-face with a worker.
"It's like literally any time you have to present documents" you could use Identity Check instead, Waldron said.
MSD had calculated it was saving each person who used it seven minutes, not counting the time saved not having to travel, for example to a Work and Income office.
"Absolutely" people liked it, Waldron said. "It's been very positive."
The only other organisation so far using Identity Check is Hospitality New Zealand, which ran the 2022 pilot to issue its Kiwi Access Card to young pub and clubgoers.
Related biometric facial recognition systems have been used for passports, and at airport smart gates, for years.
The bigger goal, however, has been to come up with a single system that spreads the service out while using the sort of decentralised tech that is more resistant to hackers.
Other requirements for Identity Check were for an opt-in service and that any service also had an alternative way of accessing it, such as by approaching the desk at a Work and Income office.
Identity Check was now at the point of widening its use to other agencies and businesses - say, Studylink, or banks.
"It's pretty easy to see what the business case for why an organisation might want to do that," Waldron said.
This would occur alongside adding more sources of images in databases to match against, using government-verified databases such as visa holders or firearms owners.
"Adding data sources is ... so that everybody can access the service."
Many governments are chasing the streamlined online ID goal. Australia's version is called TEx (Trust Exchange) that will use QR codes (like during Covid) as a type of "digital thumbs-up" without a person having to share any actual personal details to prove who they are.
Here, Identity Check is also a "key capability" to enable a digital driver's licence to be introduced.
Waldron said it should actually reduce data-sharing because verification was done using only the live facial image against a single match in the database - a person's photo - without having to draw on other documents or check against other data.
It would run parallel with RealMe, a somewhat less streamlined, decade-old verification service limited to getting people into government agencies.
The biometric data captured by Identity Check is processed and stored in a Datacom cloud-computing system within New Zealand. The images captured are deleted after 31 days.
