It’s hard to conceive of a time in human history when we didn’t need secure entry into buildings. The key, from the carved wooden stick to the ubiquitous metal implement to the more modern keycard and even more progressive passcode, has served that purpose for eons. Over the last few years, however, high-tech change has been afoot in the world of access control, with the use of biometrics as a “virtual key” in the built environment becoming more prevalent. Biometrics is a multifaceted technology that utilizes physiological and behavioral characteristics to verify an individual’s identity, and that verification, along with access software, can literally open doors. As biometrics continues to evolve, so will the options for building access control. It seems the traditional key, in its metallic form and even in its plastic card incarnation, is destined to go the way of typewriters when personal computers came on the scene. But unlike the transition from typewriters to PCs, there are a host of issues to be taken into consideration when considering throwing away the key in favor of biometrics.
Like so many other technologies, biometrics saw a boost in usage during the pandemic when touchless access evolved as a tool in the fight to lower the spread of COVID-19. Since then, the reliance on biometrics for controlling entry into buildings as well as entry into rooms within buildings has gone on an upward trajectory. A 2023 survey of 1,000 U.S. workers familiar with emerging technology found that 58 percent of the respondents asserted that biometrics is already widely used in business today, in one modality or another. And there are many modalities.
The Key’s Many Potential Replacements
Biometrics is divided into two categories: physiological and behavioral. It’s the physiological segment of biometrics that is most employed in the workplace today. Touchless fingerprint scanners and facial recognition systems rely on AI algorithms to detect the unique features of a person’s face and can be found at a notable number of premier office towers across the country. Manhattan’s Paramount Building at 1501 Broadway, an 880,000-square-foot 1920s-era high-rise that underwent a $50 million renovation in 2018, is just one of many New York City office buildings that utilize a facial recognition system for access control. Vornado announced in 2020 that it would expand the application of facial recognition throughout its building portfolio, which includes ownership and/or management interests in approximately 20 million square feet of Manhattan office properties.
Outside of New York City, real estate investment firm Jetall Companies, owner of a notable portfolio of office properties in metropolitan Houston, has installed facial recognition and retina scanning technology at its largest properties. The stuff of futuristic movies of yore—doors swinging open upon some unseen and unheard command—is now a reality.
Not all biometric technologies are created equal. According to a recent research paper fingerprint scanning and facial recognition get high scores for convenience and fall into the moderate-cost and low-cost categories. Iris scanning is only moderately convenient and comes with a high price tag. Retina scanning has the highest barriers to adoption as it has a low convenience score and high costs.
The list of physiological biometric authentication methods is extensive, and with changes in technology, they will become more prevalent in the real estate market. Other physiological traits that can be analyzed for authentication purposes include the palm/hand, veins, ear, and heartbeat. Amazon revealed Amazon One Enterprise in late November 2023, making the palm-based identity they use in their stores accessible to other businesses. Amazon One Enterprise provides users with what the company describes as an easy-to-use authentication platform that allows for quick, convenient, and contactless access to buildings as well as restricted data records. Based on both palm and vein imagery, the system outperforms other existing forms of biometric access control by providing an accuracy rate of more than 99.99 percent.
While the assessment of physiological traits leads the way in biometric-based access control in real estate today, behavioral identification is around the corner. Behavioral biometrics relies on the evaluation of an individual’s actions and habits. Voice recognition falls into his category, as does gait and signature recognition. It may not seem so far-fetched to be able to gain access via one’s signature or even by saying “hello” to a virtual security guard, but doors will open for us based on the way we walk, which still seems pretty far off. Because these identification methods are difficult to integrate into other systems and do not easily accommodate demand growth, they’re unlikely to be widely utilized for access control anytime soon. Of course, advances in technology usually make the impractical more practical and the expensive more cost-effective.
Multimodal biometrics—the use of more than one biometric modality for access and security—is not uncommon. The opportunities in biometric access control are numerous, and their use as a means of access control in the commercial real estate industry will only grow as technological advances render many of the modalities more practical and less costly. But practicality and expense aren’t the only impediments to greater reliance on biometrics in access control.
Whoa, Not So Fast
The general public has been exposed to biometrics in daily life for more than a decade, thanks in no small part to the cell phone. It was in 2013 when Apple released the iPhone 5, the first cell phone to provide users the option of fingerprint access through touch identification. Four years later, in 2017, iPhone X users were able to access their phones through facial identification. Biometrics is used in various industries, primarily for security purposes. Many countries around the world, including the U.S., Canada, and most European countries, issue e-passports in addition to the traditional passport, and a great percentage of e-passports are embedded with invisible, electronically stored fingerprints. Still, while biometrics continues to pervade our lives, a notable contingent of the population is reluctant to embrace the form of identification when it comes to access beyond their personal devices.
The trust factor comes into play, as do security concerns, even though employers in any number of industries have been utilizing fingerprint scanning as time clocks for years. “I do think that there’s a point where people start to get nervous about biometrics, just with where is that data going, who’s controlling that data, who is reading my fingerprints or listening to my voice,” noted Caroline Gadaleta, property manager with JLL. “I’ve spoken just anecdotally to people around New York City who are uncomfortable with facial recognition, so I can’t imagine they would be okay with any kind of biometric data being out there.”
Biometric identifiers can be perceived as too invasive. Some people may be absolutely fine with the U.S. Government having their fingerprint for a passport or the Department of Motor Vehicles for a driver’s license, but those same people may be uneasy with sharing their personal physiological information or behavioral traits for storage in an employer’s computer system. In terms of personal information, the question arises of how much is too much. “What I would say is that you’re better off giving people the choice,” Gadaleta added. “Some people are still not comfortable with it.”
As is the case with the advent of many new technologies, the law has not been keeping pace with the use of biometrics. There is no dedicated federal law regarding the private use of biometrics information, yet there is a small footprint of such legislation at the state level. As of mid-2023, only the states of Illinois, Texas, and Washington had dedicated biometric privacy laws on the books regarding the private collection and use of biometric information. The Biometric Information Privacy Act (BIPA), enacted in 2008 by the state of Illinois, regulates private companies’ collection, use, and storage of biometric information, and the law has strict guidelines pertaining to individuals’ notification and consent. BIPA is widely considered the most rigid of biometric laws and has emerged as a guidepost for those wary of violating privacy in any state.
A survey of filed complaints under BIPA since 2018 is a great indicator of biometrics’ rapid growth in the workplace. According to a Bloomberg Law Dockets survey, in 2022, there were two such federally filed BIPA complaints involving technology other than fingerprint time clocks. The following year, however, marked an unmistakable change. In only the first half of 2023, Bloomberg found that the number of such filings had skyrocketed, with 36 percent of all employment-related complaints focusing on voice and facial recognition. To put a face on the issue, so to speak, Meta, the parent company of Facebook, settled a class-action lawsuit involving allegations of Facebook’s violations of biometric privacy laws in 2023. The settlement was for $725 million. Biometric laws are being written, and legal precedent is being set. Many states already cover biometrics issues under general consumer privacy laws, and other states are working on biometrics-specific legislation. It is also on the federal government’s radar.
Challenges like privacy issues, security concerns, and costs will not keep biometrics from becoming the norm in building access control. “Landlords are seeming to be in favor of this idea of the seamless flow of people into [and within] the building, minimizing the barriers to entry basically, but keeping security top of mind,” Gadaleta said. It remains to be seen if the commercial real estate world will eschew the easily lost or stolen key, keycard, badge, and fob altogether in favor of biometrics-centric access in the not-too-distant future. The superior convenience, control, and security that biometrics-based access provides could prove too hard for building owners to resist. For all its faults, including its invasive nature and potential for personal violations, biometrics is the future of access control. Humans will always need keys, but one day those keys might be part of our body.