Uber’s (UBER.NYSE) woes continue as London pushes their drivers towards giving biometric data

Uber (UBER.NYSE) drivers could soon have to provide biometric data to operate in London.

The City of London regulator Transport for London (TfL) has been on Uber’s case for years to increase rider-safety, and may need to touch gloves and come out swinging again if the company refuses to accept the new terms by Monday.

In 2017, Uber took TfL to court for the first time for not renewing the company’s license, which it had withheld over concerns of passenger safety and the company’s approach to reporting criminal offences.

A month prior, a Metropolitan police inspector told TfL that Uber wasn’t reporting serious crimes, which had the unfortunate consequence of an accused sex attacker getting the chance to assault a second woman.

As part of their appeal, Uber agreed to produce an assurance report twice a year, give TfL 28 notice if they decided to change their operator model, and report any criminal complaints from passengers to the police.

Uber drew considerable scrutiny in 2016 when news emerged implicating its drivers in 32 assaults in the previous year. Yet, despite the coverage, the data also revealed that during the same year there were 122 allegations against other taxi drivers in London from both legal and illegal sources.

The new conditions put Uber into a peculiar situation. If they agree and adopt it, then it sets a precedent which could spread to other jurisdictions and become normalized. The problem is detailed, and it’s a matter of whether or not the fix is both proportionate and effective for the problem.

“Whatever is required here needs to be proportionate and measured. Uber would have to think carefully about what is proportionate. They don’t want to solve the issue with TfL to then create issues with drivers. There are multiple stakeholders to keep happy,” said Jonathan Kewley, head of technology at law firm Clifford Chance.

So the question remains as to whether or not Uber is actually more dangerous than the standard, traditional taxi-cab operations.

The data is inconclusive, because it differs per region.

Here’s the standard expectation for the United States:

Uber Driver Requirements

You must be at least 21 years old

Licensed to drive in the US for at least one year, or three years if you’re under age 23

Have access to a 4-door vehicle that is 10 years old or newer (in most cities)

Many cities allow the car to be 15 years old or newer

Find for your city’s model year requirement: Type in uber.com/drive/*your-city*

In-state auto insurance with your name on the policy

In-state driver’s license

In-state license plates with current registration (commercial plates are acceptable as well)

You must have a social security number

Pass a background check and a driving record checkBut there are some places in the United States—for example, Seattle and Boston—where the standard listed above is far more than what is required to drive a taxi. Other places, however, tack on extra characteristics like regular drug tests and fingerprinting.

But will it solve the problem?

First, let’s auger down into what the problem actually is—the business model of both taxis and ride-share is inherently problematic because it involves getting into the cars of strangers, and no biometric data is going to change that.

The idea is to be able to adequately recognize the driver. Normally, once you call a ride-share, the app pushes you a notification with your driver’s identification so you can know what car you’re getting into. But what it doesn’t tell you is the quality of the character of the driver, and no upvotes or downvotes are not indications of character quality.

But at the very least, the biometrics on offer can work as a way to provide certainty that your driver is who he or she says they are. Right?

A report from NetworkWorld suggests we shouldn’t be so certain.

“First, biometric recognition systems are incredibly complex, and need to be addressed as such. Second, biometric recognition is an inherently probabilistic endeavour. Consequently, even when the technology and the system in which it is embedded are behaving as designed, there is inevitable uncertainty and risk of error.”

The two types of biometric data types TfL are going to be looking to implement are facial recognition and fingerprint scanning.

Here’s how they work:

Face recognition. Measures the unique patterns of a person’s face by comparing and analyzing facial contours. It’s used in security and law enforcement but also as a way to authenticate identity and unlock devices like smartphones and laptops.

Fingerprint scanner. Captures the unique pattern of ridges and valleys on a finger. Many smartphones and some laptops use this technology as a type of password to unlock a screen.

A driver gets in and brushes his index finger across a scanner, which follows along the contours, whorls and grooves of the individual’s fingerprint, and compares it to an existing data point in a database. The driver then lowers his visor, where a miniature camera takes a quick-scan of his face, going over its contours, before transferring those two pieces of data together into the database to be cross-referenced. If coupled with a password, it effectively utilizes multi-factor identification.

But the problem is—it can be spoofed using a 2D or a 3D image—depending on the complexity of the technology.

2D attacks use photographs, flat paper or masks, while dynamic versions use screen video replays (like on your smartphone or tablet) or several photographs in a sequence. 3D attacks are even more involved, making use of 3D prints, sculptures or masks. Dynamic versions use robots to reproduce expressions, complete with makeup, but it’s highly unlikely that anyone looking to borrow someone’s Uber is going to have a robot.

Fingerprints are the easiest to spoof. Anyone who’s watched a little CSI can do it. It involves complicity (or drunkenness) on behalf of the driver, but it involves making a dental mould of the person’s finger, which can then be used to swipe. But if the fingerprint reader is anything like those on our phones, then it will probably be broken or non-functioning 75% of the time.

Regardless, it’s a definite blow to Uber’s business model. James Farrar, a representative for Uber drivers at the Independent Workers of Great Britain union, called this licensing condition “disproportionate and discriminatory,” and that it would make London’s minicar drivers the “most surveilled” workforce in the capital.

Give it time if this works and Uber won’t be alone.

—Joseph Morton