When understanding biometrics it is sometimes helpful to think of how we recognize friends and family.  We look at peoples hairstyle, body type, eye colore etc and listen to their voice to identify people from our memory. So a biometric system takes a part of a person like a fingerprint or iris scan and compares it to a database to verify the person's identity. 

When considering implementing a system we can compare it to our experience as well.  Most people have an embarrassing story to tell about misidentifying a friend or family person and saying something to a complete stranger.  We also may have sat on a bus or train and showed someone a picture of our family and looked at a picture of their family.  We describe ourselves and other people to each other to help identify someone when we're going to meet a stranger.  We also may have sat in a window of a building or on a park bench and "watched the world go by."

Again biometrics have the same abilities limitations and concerns as we see in our own experiences.  While biometrics can be very accurate in identifying people they do make mistakes.  We need to be aware of the consequences of a false positive or false negative.  Is it just that the person needs to use another form of id, or does it put them in jeopardy of jail or deportation? 

Biometrics seem to be so very accurate that we have to be aware of what happens if there is a mistake made.  It is much harder to change biometric data if someone has found a way to copy your id than it is to cancel a credit card and get a new one. 

Also we need to be aware of how the information is being shared and the consequences of sharing. In the above example we might let someone look at a picture, but would we give them a copy of that picture?  Would we write our name and address on the picture? So to with biometrics how can that information be used.  Is it just the biometric data or is their other information stored in the database?  Is it only available to law enforcement and governments or can private businesses access that inforation.  Is it shared between governments, and if so is it shared with repressive governments? 

We also need to consider how and where this type of identification is being used.  If we're sitting in a park, people can see us watching them, but what if we're in our office window on the third floor.  Our people then aware they're being watched?  With a biometric scan available from a camera, do we have the right to know when we're being scanned?  What are the boundaries?

Consider if your office used a thumbprint scanner to identify people entering the building.  If somone breaks or sprains their wrist,  the cast  might prevent them from getting an accurate scan from the system.  What back up is in place to allow the person into the building?  What if you use a fingerprint scan to access a computer and the same issue comes up.  How do you override the system to gain entry to the computer.   On a large scale if a person can't get a proper scan of a finger or eye at an airport how do we handle that case?  Do we automatically detain the person or do we fall back on to another system.  At current biometrics aren't  accurate enough to not have a fallback system, but since the system can't guarantee a hundred percent accuracy we can't make it our only identification sytem.

Biometrics can add a level of convienence to security procedures since they can be done fast and can be accurate.  We need to be aware of the level of accuracy of the scan being used, and have other systems in place for when the system fails.  We must verify the security of the databases being used and know how the information can be shared.  Finally we must know where we are being scanned  and why.  Biometrics can be used as a support to security but it is not a silver bullet.