Until last year, Experchem Laboratories relied on paper for keeping track of employees’ hours. It was a cumbersome system, says Mike Wiffen, information technology co-ordinator for the Toronto analytical testing laboratory. So last year Experchem went looking for something better.
“We wanted something that would keep track of people’s hours for payroll purposes and also keep track of who’s on site at any given time,” Wiffen says.
The system that Experchem installed in November and put into full operation at the beginning of January lets employees clock in and out by waving an electronic fob close to a reader and then placing a fingertip on an electronic fingerprint reader.
It’s one example of the growing use of biometrics – primarily fingerprints but also in some cases the entire hand, or face recognition or eye scans – for human resources applications such as time and attendance and access control.
“Five or six years ago, biometrics was out there but I guess it required more education,” says Ed Van Hooydonk, director of business development at the Canadian branch of Mitrefinch, the British producer of employee management technology that provided Experchem’s system. “What we’re seeing now is about 50 per cent of the business we bring in has some biometric component with it.”
Colin Soutar, chief technology officer at Bioscrypt, a prominent Canadian producer of biometrics technology, says time and attendance systems are the biggest market for the biometric identity-verification modules his company produces for other manufacturers – including Mitrefinch – to incorporate in their products.
“There’s a fairly tangible and immediate return in investment that our customers are seeing,” Soutar says.
That benefit comes partly from eliminating time-consuming paperwork, as Experchem did, but having employees’ comings and goings recorded automatically rather than entered manually on time sheets.
Other technology, like smart cards, could achieve that benefit too. But biometrics has another benefit in time-and-attendance applications: It eliminates the time-honoured practice of “buddy punching.” That’s where one employee takes another’s card and clocks in or out on his or her behalf, covering up for a late arrival or allowing the second person to make a fraudulent overtime claim.
Wiffen says buddy punching isn’t a problem at Experchem today since the company is still fairly small, but he regards the biometric technology as “future-proofing” against the day when it might become an issue.
Another advantage over a card system, he says, is that cards are easy to forget or lose. “It’s easy to forget a card. It’s hard to forget your finger.” The proximity fobs Experchem uses in conjunction with fingerprint readers can be kept attached to a key ring, so they’re harder to forget than a card.
Some systems use only a biometric identifier, with no card, fob or identification number. Many use a combination, though, and Soutar says there are a couple of reasons for this. First, two-factor authentication is inherently more secure. Second, identifying a person by matching a fingerprint against a database becomes too cumbersome with more than about 500 users.
Some systems use only a biometric identifier, with no card, fob or identification number. Many use a combination, though, and Soutar says there are a couple of reasons for this. First, two-factor authentication is inherently more secure. Second, identifying a person by matching a fingerprint against a database becomes too cumbersome with more than about 500 users.
The system at Experchem first identifies the employee from information on the fob, Wiffen says, and then checks the fingerprint to make sure the person carrying the fob is who he or she claims to be.
The third reason for combining biometrics with another identification method like a card is that the data necessary to verify the biometric scan – such as a fingerprint – can be stored on the card or fob itself and the reader doesn’t have to be connected over a network to a central database, Soutar explains.
Wiffen says Experchem’s system has proved quite reliable. It occasionally rejects a fingerprint, he says, but the biggest problem has turned out to be with employees sometimes holding the electronic fob too close to the reader for too long, causing the device to read it twice and reject the second reading because of a built-in requirement for a delay between readings.
Van Hooydonk says Mitrefinch finds its systems deliver 95 to 98 per cent accuracy, depending on the environment. Manufacturing environments where employees’ hands are more likely to be dirty or worn cause the most problems, he says. The Mitrefinch system can adjust tolerances for individual employees to help deal with these problems, he adds.
Fingerprints are the most common biometric used for human resources applications, says Soutar, but Bioscrypt is also interested in face recognition, which has the advantage of not requiring actual contact – a benefit in certain cases such as medical applications where people might be wearing gloves, or for identifying people in vehicles. Van Hooydonk says hand geometry is used in some time and attendance and access control systems, and he recently saw one access control system that identified people by scanning their eyes.
Though biometrics sometimes raise privacy concerns, Wiffen says he hasn’t heard about any concerns among Experchem employees. “In fact a lot of people liked having the system in, because they don’t have to write down their overtime hours,” he says.
Soutar says Bioscrypt’s system doesn’t store complete fingerprints – only enough data to identify an individual finger – so there is no risk that employees’ fingerprints could be reconstructed from the data and used for purposes such as identity theft. The technology Bioscrypt sells for human resources uses is also different from and incompatible with that used by law enforcement agencies, he adds, so even if data were handed over without employees’ knowledge it would not be useful in those systems.
However, companies using such systems need to adhere to privacy laws and take care to inform their employees how they intend to use the data and assure them that it won’t be used for other purposes, Soutar says.
Comment: [email protected]
