Identification of an individual. Problems and lack of solution

Given:

A large financial company is developing an information system. One of the tasks sounds like: “Visitor identification by the provided data set”. As part of the task, a separate subtask is singled out: “The formulation of the necessary and sufficient data set for identifying an individual”. An additional requirement was not to use synthetic information (identification numbers, contract numbers ...)

Decision:

The solution to the subtask seemed pretty trivial to everyone. Name, passport, date of birth - what else do you need? And then the nuances began. Full name - is not a constant parameter of the object to an individual, the girl got married and hello. Date of birth is a good option, but there are problems with uniqueness. The passport, alas, also periodically changes, and there is no legal possibility to oblige the client to notify the company about a change of passport and / or other identification parameter, unfortunately, developers and lawyers. Then went pure brainstorming.

The list of considered parameters in the end was the following:

• Full name
• Date of Birth
• Place of Birth
• Floor
• Passport ID
• Numbers of all passports in the chain issued
• TIN
• Papillary lines
• Characteristic face map

Well, absolutely exotic

• Retina drawing
• DNA analysis

It should be noted that the number of clients of the company was quite large and some of them could afford a lot of the pleasures currently available, for example, plastic surgery, various options for gene therapy and others like it.
')
A little historical excursion. Imagine now that such a miracle comes, which has given you a lot of money to manage, and the following dialogue takes place:

• Client: And you return me all my money back.
• You: Easy. What do you say your name is?
• Client: Ivanova Avinaisa Faridovna. (Suppose that, although, of course, this is not the name that sounded at all)
• You: (Vigorously tapping the name in the system) Hmm. There is no such letter in our word. And your passport can be?
• Client: Of course you can, and draws your passport.
• You: (Klats-klats-klats) And there is no such passport. Do you remember your inn?
• Client: Of course I remember, only yesterday they gave me.
• You: (Klats-Klats) And we have your TIN too. And please attach a finger to the scanner.
• Client: Please.
• You: (listening to the pi-and-and-i puzzling of the next loop of the identification system) And we don’t have your prints either.

Well, it seems, there is no court. Thanks to everybody, you're free. It was not there. The client scandals, swears, demands money. Well, that the manager was intelligent. Understood. Previously, the visitor was, well, let's say, Afanasy Fyodorovich Ivanov. Full plastic, sex change, gene correction of something there, double change of passport. ALL identification data is sent at low speed FIG. Only the date of birth remains. But, as already mentioned, it is not very unique.
Well, in concluding this retreat, the information system opposed an attempt to change the gender of an individual in the tables, a client in the contract, an attempt to issue money from one account through the account of another contract, and so on. The sword dance was for three days. Unfortunately, the case is quite real, and as an IT specialist with more than decent experience, I unfortunately cannot imagine the methods of solving this problem.

Returning to the solution of the subtask. Having examined this example, we came to the weighting mechanism of identification, when each of the parameters has its own weight, and the system gives only an estimate of the probability with which the incoming visitor is a particular client. And that decision is not the one that the manager takes directly. I must say that we did not manage to solve the problem on the days allotted for this, we spent nearly three days. But all the tests at the customer system passed. And change of a floor, and change of age, and loss of the passport, and even loss of memory. True, for the latter case, I had to put the DNA analyzer. I must note that the practice of using express DNA analyzer has greatly changed our views on this miracle technology. Probably, if you take a blood test, a mucous scraping and thirty-three more tests, the accuracy will increase dramatically, but under normal conditions - three nines, this is not the result you expect, and the supplier didn’t promise anything more. And the speed of analysis is not impressive.

Total:

In the real world, a person can change, under certain conditions, any identification parameter. This needs to be remembered.

Accordingly, the system should be able to either change any of these parameters, or provide a mechanism for resolving the resulting contradiction in some other way.

Accurate visitor identification is not possible in principle. When using these or other technologies, only a sufficiently high probability of identification can be achieved.

You need to remember the costs and the likely losses. If you do not buy a pie because of a failure of identification, then you don’t even need a fingerprint scanner, and if you are talking about tens of millions of the right money, then the DNA analyzer will not be superfluous.

Good luck to all in the coming year and more non-obvious problems.

Supplement .

I called the customer, found out about the numbers of previously issued passports. Israelis, Saudis and someone else do not have such marks. Services are provided to non-residents.