The year 2005 has seen the European pharmaceutical environment become an even more complex combination of political and technical tensions. 

At the political level, the European Commission has been trying to stimulate innovation and to promote an enterprise culture, in the face of persistent major divergences among EU member states about the right way for Europe to respond to the new pressures of globalization. These discussions have repeatedly degenerated into polarized views about whether Europe should focus on protecting the jobs it has, or on creating new ones—and are still, towards the end of the year, totally unresolved. 

Although pharmaceuticals is demonstrably one of the most successful of Europe's industrial sectors and continues to create high-quality jobs, it is a victim of this strategic confusion. Thus the commission's announcement of a new industrial strategy for Europe, angled towards innovation and enterprise, ran straight into heavy fire from French President Jacques Chirac, determined to demonstrate to his electorate that he was going to make no concessions to a policy that did not pay as much attention to job protection as job creation.  

Similarly, the ambitious earlier drafts of new commission strategies specifically for pharmaceuticals and biotechnology had to be watered down to a shadow of their initial aims to avoid offending sensitivities in key member states. As a result, both of these supposedly major plans turned out to be very little more than repetitions of earlier formulae adorned with lavish expressions of pious hope and empty rhetoric. 

At the technical level, 2005 has been a challenging year for the European Medicines Agency in London. Its main responsibility remains unchanged: the protection and promotion of public and animal health, through the evaluation and supervision of medicines for human and veterinary use. The Agency continues to coordinate the evaluation and supervision of medicinal products throughout the EU, bringing together the scientific resources of the 25 EU member states in a network of 42 national competent authorities, and it has maintained its close cooperation with international partners.  			

The Agency marked its 10th anniversary in operation during the year, and saw the full entry into force of new legislation that is shaping its future development. At the same time it is having to cope with the emergence of new medical technologies and therapies; the increasing globalization of the pharmaceutical industry and its regulatory environment; the competitiveness of Europe's biotechnology, pharmaceutical, and health care industries; and the increased expectations of society on information access, communication, and transparency. At the last official count, it had about 360 staff members,  and a network of some 3500 European experts underpins its scientific work and committees. 

Particular attention has been given to reinforcing the safety of medicines, accelerating the availability of medicines to EU patients, and creating the right environment to stimulate research. These initiatives include implementation of the concept of risk management plans, expansion of the scope of medicines to be authorized through the EU's centralized procedure, and the establishment of accelerated assessment, conditional authorization, and compassionate use procedures, as well as procedures for authorization of biosimilar and generic products.  

Similarly, and also at technical level, there is also continual expansion in the range of activities that the pharmaceutical unit in the commission covers. It continues to cover its classic areas of responsibility for health-related matters, such as marketing authorizations, clinical trials, blood- and plasma-derived medicines, vaccines, and good manufacturing practice. It retains a strong role in economic affairs too, overseeing competition policy, transparency of pricing and reimbursement, parallel imports, and penalties for noncompliance with EU rules. But it has had to take on additional or intensified tasks, ranging from orphan drugs and pediatric medicines to pharmacovigilance and international harmonization and cooperation, and from counterfeit medicines, pharmacogenetics, and human tissue engineering to making preparations for the accession of future member states to the EU. 

At the same time, the staffing situation in the commission remains imperfect. There are only some 20 officials in the unit, and even a year after it lost its senior official (she was transferred to the private staff of European Commission President Jose Manuel Barroso), a permanent head of unit is still to be confirmed, and it remains under the leadership of only an acting head.  

is a freelance journalist who specializes in European health affairs. He is based in Brussels, Belgium.

THE EUROPEAN AGENCY FOR THE EVALUATION OF MEDICINAL PRODUCTS

7 Westferry Circus, Canary Wharf, London E14 4HB, +44 20 7418 8400 (extensions below), fax +44 20 7418 8416

Head of Sector, Document Management and Publishing

Head of Sector, Meetings  and Conferences

Unit for the Pre-authorisation Evaluation of Medicines for Human Use

Head of Sector, Scientific Advice and Orphan Drugs

Head of Sector, Safety and Efficacy of Medicines

Deputy Head of Sector, Safety and Efficacy of Medicines

Articles

Resources

Political and technical tensions in the EU.

European Regulatory Agencies

's annual listing of FDA offices and top officials, and it's probably out of date already. Even before the September resignation of Food and Drug Administration Commissioner Lester Crawford, FDA experienced a number of important organizational and personnel changes during the past year. Crawford revised his office following his confirmation by the Senate in July. At the same time, the Center for Drug Evaluation and Research (CDER) reorganized its offices that oversee new drug research proposals and applications. The result is a lot of new names in 

's FDA and CDER listings, as well as new telephone numbers following the move of key CDER offices to FDA's new White Oak, MD, campus. 

In July, Crawford clarified the responsibilities of his top deputies. Janet Woodcock became permanent deputy commissioner for operations and chief operating officer, ending speculation that she might return to CDER at some point. Steven Galson thus became the official head of CDER after serving on an acting basis for more than a year. Murray Lumpkin was named deputy commissioner for international and special programs, overseeing FDA international activities, pediatric drugs, combination products and other initiatives such as approving AIDS therapies for overseas sales. Crawford elevated Associate Commissioner for Legislation, Patrick Ronan, to be his chief staff officer and liaison with the Department of Health and Human Services (HHS). And the commissioner brought back policy analyst Scott Gottlieb as deputy commissioner for medical and scientific affairs, replacing Amit Sachdev, who left FDA in March to head the policy staff at the Biotechnology Industry Organization. These four deputies provide the main hope for continuity and stability following the unexpected appointment in September of National Cancer Institute (NCI) director Andrew von Eschenbach as acting FDA commissioner.  

In addition, during the past year FDA gained a new chief counsel and new directors for its planning and management offices. There is a new associate commissioner heading the Office of Regulatory Affairs (ORA), which oversees the agency's field force that inspects research sites and manufacturing facilities. ORA Director Margaret Glavin has named new deputies and is moving to develop a more risk-based inspection approach; this strategy reflects her office's declining resources and expanding responsibilities for monitoring more imported food and medical products and more production sites in the United States and overseas.  

Then, of course, there's continuing fall-out from FDA's nondecision on the morning-after pill, Plan B. Susan Wood, director of FDA's Office of Women's Health, quit her job in protest of FDA allowing politics to supersede science in putting off the approval of Barr Pharmaceuticals' application to switch this widely used pill to nonprescription status. After promising Senate leaders that FDA would make a decision on Plan B by September 1, Crawford announced in late August that he once again was delaying action in order to further examine the political and regulatory issues. This appeared a fairly blatant cave-in to pressure from conservative political leaders who fear that easy access to the medicine will encourage teen sex. Crawford and HHS secretary Michael Leavitt lost considerable credibility on Capitol Hill and throughout FDA and the biomedical research community. FDA reviewers and scientists insisted that all evidence showed that the drug is effective and can be used safely for its intended purpose; denial instead undermines the agency's reputation for basing regulatory decisions on sound scientific evidence and reflects unusually high involvement of top FDA officials in the decisions, according to a GAO report. 

After further missteps, Crawford appointed Teresa Toigo to head the women's office on an acting basis; she remains assistant commissioner for special health issues, which serves as FDA's liaison with patient groups, particularly those for AIDS and cancer. One high-profile task is to assess how well clinical trial sponsors post notices of active clinical studies, an issue that underlies current initiatives to expand public information on clinical trials and eventual study results. 

People close to FDA management do not believe that the Plan B debacle was the immediate cause of Crawford's resignation, but failure to resolve the issue makes it nearly impossible for FDA to secure a permanent commissioner under the current political regime. Perhaps the most positive action von Eschenbach could take to gain credibility as acting commissioner is to bite the bullet and approve Plan B's application. All parties have had a chance to comment on Crawford's delay proposal; while the White House and many Republicans may be furious, fast action would take the issue off the table before next year's elections and enable FDA to move on with its important business.  

Resolution of the Plan B crisis would be a relief to CDER Director Galson, who had the unhappy task of killing Barr's initial OTC application in 2004. This past year he has been busy overseeing major changes at the drug center and putting out drug safety fires. He now has a permanent deputy, Douglas Throckmorton, to assist in the process; one of Throckmorton's early assignments is to chair the Center's new Drug Safety Oversight Board.  

The Office of New Drugs (OND) continued to reorganize, expanding from five to six drug evaluation offices in order to better balance the staffs that review drug applications and to further integrate oversight of biotech therapies into the review structure. Major changes involve establishing an Office of Antimicrobial Products (replaces ODE IV) to handle applications for anti-infectives and anti-virals, plus special programs on drug shortages, drug resistance and special pathogens. A new Office of Oncology Products was established with divisions to oversee drug and biotech cancer therapies plus medical imaging products. And an Office for Nonprescription Products reflects increased focus on OTC drugs. The reorganization involved shifting a number of review divisions to different offices and assigning applications for biotech therapies to appropriate drug review divisions; only biotech oncology products have their own division (

CDER's Division of Scientific Investigations, in the Office of Medical Policy, continues to conduct inspections of clinical study sites and institutional review boards. This group's task is to ensure that researchers comply with regulations and that data submitted in applications meets standards. DSI's Human Subject Protection Team also reflects the agency's increased focus on assuring that investigators follow all procedures to protect the rights and privacy of clinical trial participants.  

Next March, this group will move to CDER's Office of Compliance, which manages all other field inspections for new drugs and previously was DSI's home. The move will free up OMP to play a larger role in CDER's efforts to encourage new clinical trial methodologies as part of the Critical Path Initiative.  

CDER's Office of Pharmaceutical Science (OPS), which examines the chemistry, manufacturing and controls sections of new drug applications (NDAs), is also undergoing considerable change. OPS's newly named Office of New Drug Quality Assessment now has four divisions: three to review the CMC sections of NDAs and a fourth to assess postmarket manufacturing supplements, which continue to increase at a rapid rate. OPS's Office of Generic Drugs retains its current structure but is revising its review process to better manage a fast-growing number of abbreviated NDAs, and the Office of Biotechnology Products continues to examine the manufacturing sections of applications for biological therapeutics.  

Continued focus on how FDA monitors postmarketing drug safety also has prompted changes in CDER's Office of Pharmacoepidemiology and Statistical Science (OPSS). After a nearly two-year search, Galson finally announced in October the selection of a CDER staffer to direct the Office of Drug Safety (ODS): Gerald Dal Pan, who had headed ODS' Division of Surveillance, Research and Communication Support for two years. Galson indicated that Dal Pan will report directly to him in an effort to raise the stature and visibility of this much-discussed FDA operation.  

The long delay in appointing a top drug safety officer has been cited as a sign of FDA's inability to adequately monitor and communicate drug safety problems. Naming an FDA staffer to the job and keeping ODS within CDER is not likely to quiet all these complaints. Galson emphasized that CDER already devotes 50% of its resources to drug safety, including aspects of premarket testing and application review, as well as postapproval monitoring, but critics continue to clamor for more.  

An important task for Dal Pan will be to reshape ODS to improve its ability to assess safety signals from adverse event reports and health data bases and to weigh signs of concern against the benefits of new and marketed therapies. ODS divisions oversee FDA's MedWatch adverse event reporting system, the development of medication guides for high-risk products and research on postmarketing safety issues. Epidemiologists evaluate Phase IV study protocols and postmarketing surveillance tools to support risk management strategies for certain products. One group reviews proposed drug names and labels to identify the potential for medication errors related to name confusion, both pre- and postapproval. ODS has become more active in examining outside epidemiological data able to indicate possible safety problems and is working more with international regulatory bodies to assess safety issues globally.  

In announcing Dal Pan's appointment in his annual "state of  CDER" address, Galson promised further agency reorganization to improve CDER's ability to asses drug safety issues and to communicate risk concerns more consistently. Galson also highlighted the need for CDER to "fully participate" in FDA's Critical Path Initiative and "improve regulatory and drug development science." The key challenge for FDA leadership will be to accomplish these tasks in the face of tighter resources created by continued budget reductions. 

View from Washington

While veteran officials keep the agency running, changes continue at FDA's new drug review and safety oversight offices.

Search for Stability at FDA

Deputy Director and Director, Office of  International Activities

Director, Division of Compliance Oversight

Director, Division of Education and Development

Director, Division of Policy and Assurances

				 Irene Stith-Coleman (240) 453-8138  			

				 Andrew von Eschenbach*  (301) 827-3310 			

Deputy Commissioner for International and Special Programs

Deputy Commissioner for Medical and Scientific Affairs

Chief Staff Officer and Associate Commissioner for Legislation

				 Sheldon Bradshaw  (301) 827-1137 			

Senior Associate Commissioner for Policy, Planning

Associate Commissioner for External Relations

Associate Commissioner, Office of International Programs

Associate Commissioner for Crisis Management

Assistant Commissioner for Counterterrorism Policy

Assistant Commissioner for Special Health Issues 

A comprehensive listing of U.S. departments and offices that includes the telephone numbers of directors, commissioners, and advisors.

U.S. Departments and Offices

Over the past five years, there has been a largely unnoticed, yet dramatic, shift in the use of ex-U.S.–based investigative sites. Major pharmaceutical and biotechnology companies have been placing an increasing proportion of their clinical trials at offshore locations throughout eastern Europe, Latin America, and parts of Asia. Indeed, some sponsors report that they now routinely place a majority of their clinical trials among ex-U.S.–based investigative sites. This shift has major implications not only for U.S.-based investigative sites but also for sponsors and CROs looking to optimize their relationships with an increasingly global network of investigators.

It is widely accepted that conducting trials overseas is far less expensive, and there is a healthy supply of well-trained physicians there eager to serve as investigators and study coordinators. Drug shipment issues have largely been overcome, and the adoption of eClinical technology solutions has helped to address operating support issues that used to bottleneck overseas projects. 

Most importantly, the abundance of treatment-naïve patients abroad has translated into speedier clinical trial recruitment and improved retention rates. In the developing world, vast numbers of patients suffer from diseases ranging from the familiar to the exotic. These patients are often eager to enroll in clinical trials at the request of their physicians and eager to gain access to free medical care, tests, and complimentary therapies that they otherwise could not afford. 

In an analysis of 1572 filings with the Food and Drug Administration (FDA), the Tufts Center for the Study of Drug Development has found that the majority of investigative sites still hail from the United States, but the geographic mix is in rapid flux. A decade ago, for FDA-regulated studies, less than one in ten investigative sites was ex-U.S.; in 2004, one out of three sites was ex-U.S. The Tufts Center also found that, whereas the overall number of principal investigators within the United States has been growing by 8% annually since the late 1990s, the number of ex-U.S. principal investigators has been growing by more than 20% annually during that same time period. Since 2001, the number of new domestic investigators has been declining by 11% each year. 

Major pharmaceutical companies have already tipped the balance in favor of ex-U.S. investigative sites, or they are planning to do so within the next couple of years. Wyeth, for example, reports that it now does more than half of its clinical trials among ex-U.S.–based investigative sites. This year, nearly 60% of all investigative sites recruited by Novartis were ex-U.S. sites. Midsized P&G Pharmaceuticals, now conducting more than one-third of its trials among ex-U.S. sites, says that it is routinely looking to place trials overseas, often as replacements for traditionally U.S.-based investigators. 

GlaxoSmithKline said that it conducted 29% of its clinical trials abroad last year and hopes to increase that figure to 50% by the end of 2006. "We have a robust Phase II pipeline," said Rick Koenig of GlaxoSmithKline. "The challenge is to move those compounds to Phase III and on to market in an expeditious way. We find that conducting trials in developing nations is less expensive and faster than in either the United States or western Europe. In some instances, the difference is as much as tenfold. We need sites that do strong quality work, and we can find them in places outside of traditional markets," said Koenig. 

Merck is conducting significantly more studies internationally than in the past. More than 40% of its investigative sites are based outside the United States, according to Jorge Guerra, MD, executive director of clinical research operations. Merck's ex-U.S. clinical research is now being conducted predominantly in central and eastern Europe, Latin America, Australia, New Zealand, and, increasingly, the Asia-Pacific region. Korea, which until recently allowed only postmarketing studies, is the latest addition. "In the aggregate, studies conducted in 60 countries outside the United States are only slightly less expensive to do than inside the United States," said Guerra. "Personnel costs in Latin America are definitely lower," he added, "but the savings are offset by higher shipping and courier expenses." 

"In general, ex-U.S. sites tend to enroll their first patient later compared to U.S. sites because of regulatory agencies and the slower ethics review committee approval process," said Guerra. "However, in our experience, ex-U.S. sites tend to recruit faster so that total enrollment targets are met either simultaneously or ahead of U.S. sites. It also seems that rescue operations—including adding more sites and intensifying patient recruitment—are needed more often for U.S. than for ex-U.S. studies." 

As clinical trial volume and scope continue to rise, an increasingly global community of investigative sites appears ready to meet drug development capacity needs. For U.S.-based investigative sites, this trend signals that competition for clinical trials will intensify domestically. Research sponsors have already been turning to more sophisticated criteria (e.g., historical performance metrics and details on access to specific patient populations) in order to justify the higher relative costs of U.S.-based clinical investigators. 

Competition among ex-U.S. investigators is also intensifying. As these sites take on more operating infrastructure, they will need to sustain a larger stream of clinical trial activity. Clinical research managers representing different global regions within biopharmaceutical companies must compete with their own colleagues to gain and sustain a larger share of their organization's finite clinical trial work. At this time, eastern Europe and Latin America tend to be the favored regions. 

Growing use of ex-U.S.–based investigative sites is also expected to increase outsourcing to contract service providers that are well positioned within markets abroad and offering significantly lower operating expenses. Given the added complexity of simultaneously conducting clinical trials internationally, several sponsors report a heavier reliance on CROs to meet more aggressive development timelines. 

Wyeth, for example, reports that it is using a global monitoring committee to keep up-to-date with international regulatory and customs requirements. "If necessary, supplies are shipped early, stored in a virtual warehouse, and then transferred to trial sites," said Ira Spector, vice president of clinical trial operations. "A handful of large CROs are selected for their field monitoring expertise in specific countries and must be willing to accept Wyeth's SOPs, systems, and technology so data are easily comparable," he added. Wyeth's goal is to initiate 80% of global sites within eight weeks of study start-up. 

Merck, long known as an organization that has opted for minimal use of CROs to manage its portfolio of development projects, is now seeking to outsource its global studies to capable CROs. "Rather than rely on our own in-house resources, we want to pick up the pace through using CROs," explained Guerra. 

The shift toward increasing use of ex-U.S. sites will likely attract public scrutiny and eventually—with mounting political pressure—restrictions from the FDA. Media and policy-makers have already identified this trend as a potentially explosive issue, one that will fuel the fire of an already damaged and eroded relationship with the public. Despite data suggesting that regardless of where clinical trials are conducted the U.S. market typically gains early access to new medical innovations, the media tends to depict the growing prevalence of ex-U.S.–based investigative sites as profit-motivated and exploitive of vulnerable global markets. It is critical for research sponsors to proactively educate the public and policy-makers about the full rationale behind broad-based global development programs. 

New drug approval in the United States requires that sponsors submit an application containing substantial evidence of effectiveness based on the results of adequate and well-controlled studies. There are a few cases where a new drug has been approved for the U.S. market based on data from well-controlled studies conducted solely by investigative sites abroad. 

With regard to the exact mix of U.S.-based and ex-U.S.–based investigative sites, the FDA remains elusive. There is no minimum number of U.S. patients required in a New Drug Application. Sponsors may design and conduct their studies in any manner provided that they demonstrate, via prospectively planned analyses, that the ex-U.S. patients are similar to U.S. patients both in terms of pretreatment disease characteristics and treatment outcomes. Now and in the near future, sponsors and the FDA will continue to evaluate their studies for their applicability to patient populations and medical care settings in the United States. 

Select disease-specific affinity groups may vie to keep some clinical trials within the United States, given the wide variations in diet, life style, and health care consumption. Diseases most sensitive to these variations include age-related illnesses such as Alzheimer's, Parkinson's, and ALS and gastro-intestinal, CNS, and endocrine disorders. 

At this time, sponsors are confident that the FDA will not reign-in on the shift toward the high use of ex-U.S. investigative sites. Even the most avid off-shoring enthusiasts foresee some limits to the trend in the future. Characteristic of several sponsors, Merck's Guerra said he can't imagine that Americans will ever constitute less than 40% of the total number of trial participants given the size of the U.S. market. For the time being, the only restrictions placed on the rapid, largely unnoticed shift toward placing clinical trials outside the United States will likely be those that the industry self-imposes. 

 MS, MBA is a Senior Research Fellow at the Tufts CSDD and Chairmanof CISCRP, both located in Boston, MA, email: 

Clinical Trial Insights

A growing trend in the industry has many pharmaceutical companies looking to manage the changing mix of global clinical trial locations.

A Swift Predominance of Ex-U.S. Sites

When it comes to technology trends, extrapolating along a straight line rarely works. These trends frequently follow very different curves. Some ignite rapidly, consuming all available "oxygen" (witness the iPod explosion), while others smolder for years before catching fire. Smoldering is certainly the best description for the adoption of biometrics —the use of anatomic, physiologic, and/or psychometric measures for identifying and authenticating individuals for access to a computer system. However, recent issues of identity theft, border security, sensitive data center access, and the possibilities of point of sale purchases with one touch (eliminating credit cards, signing, etc.) have brought biometrics to the attention of the general public.

The logon to a computer system requires authentication. It is akin to the process you use to allow someone into your home. After the knock on the door, you will often look or listen to the person at the door to see if you know them. This is single-factor authentication based on something the person IS—that is, an unchangeable physical characteristic of that person. If it is someone you don't know, you will use two-factor authentication—usually a photo ID from a recognized authority, where you look at something they HAVE plus something they ARE (their match to the photo).  Secure authentication requires two factors from something you ARE, HAVE, or KNOW. The obvious example of the latter is a username (UN) or a password (PW). The discerning will see that UN/PW is marginally two factors (since the UN is commonly not well-controlled). 

The simplest example of a biometric is replacing your standard username/pass- word with a fingerprint to log onto your computer or network. The use of a fingerprint for authentication isn't some futuristic thing; I log onto my computer every day using nothing more than a fingerprint. However, biometric authentication certainly isn't in wide-spread use today for either home or corporate computing.  

Back in the early to mid-90's, biometric authentication was a major buzz in technology circles. Simple yet expensive biometric devices like fingerprint readers had been in use for years, and many newer approaches were being developed.  Some of these included iris and retina scanning, palm prints, sophisticated fingerprint detection with heat/electrical conduction (to prevent the "severed finger" security risk), voiceprints (for telephone authentication), handwriting (various measures of letter shape, pressure, and velocity), facial recognition, and others. These devices were being displayed at various computer trade shows, and it seemed likely that they would become a standard part of computer workstations.  

In fact, 21 CFR Part 11 (the FDA Electronic Record, Electronic Signature regulations) allowed biometric authentication as a method of single-factor authentication, in apparent anticipation of widespread adoption of the technology. Now, over eight years later the use of biometrics is only incrementally more common than it was back then. The beginnings of an apparent technology trend just didn't continue at the predicted or observed pace. This may change in the foreseeable future, but to begin with let's explore some of the reasons that we aren't all using the technology today. 

To understand biometrics, we must start with an explanation of the technology, and some key definitions. Biometric identification fundamentally requires a device that can measure a unique characteristic of an individual; for our example we will use the fingerprint for logging onto a computer. In some future era when we can do "on the spot" DNA typing, this may well become the gold standard. Today, alas, we are confined to more mundane methods such as fingerprints. The device analyzes the whirls and ridges from the individual's finger and converts key features into a digital representation. Obviously, the device must be capable of identifying the key features in the setting of many variables such as the exact positioning of the finger on the device and the presence of cuts and dirt smudges. Once digitized, the reader must match the digital data to a database of previously authenticated fingerprints. This data may reside within the device itself (not the most secure option), on the local computer, or in some central server. Once a match is confirmed, the software sends the message to the system or application logging the user on. 

This very simple account of one-factor biometric authentication raises several key issues, each of which is worth discussing in some detail.  

The first set of issues revolves around the accuracy of the device; how well does the device recognize the fingerprint? Can it be easily fooled by an imposter? Is it likely to stubbornly resist logging on a legitimate user? If it can be easily fooled, is a fingerprint alone sufficient for security? These answers differ, depending upon the intended use of the biometric system. 

The first concept to understand is the false positive (FP) rate (what percent of imposters will be recognized) and false negative (FN) rate (what percent of legitimate user attempts will fail). Different devices will have fundamentally different FP and FN rates, based on the nature and maturity of the technology. In addition, consumer-oriented devices will have higher FP/FN rates than more ironclad corporate devices. 

There are two major reasons for using biometrics—convenience and security.  For the average home user it isn't necessary to have ironclad security. The data on a home computer may be sensitive, but anyone with access to the computer is unlikely to have the ability, the time or the stamina to break the standard security measures that protect that data. In this setting, it is probably sufficient to use a UN/PW authentication (as long as the PW isn't posted on sticky notes), or a single biometric device. My home computer uses a $35 fingerprint reader so that my wife and kids can logon easily without posting a PW sticky note. It is for convenience and light security. The device has no perceptible FP rate to me, and a low FN rate. 

The second reason for using biometrics is for rigorous security. In this case, a two-factor authentication should be used. In addition, the biometric FP rate must be extremely low. Two-factor authentications in this setting could include a PIN code or password (what you ARE and what you KNOW), or a token of some sort along with the biometric information (what you HAVE and what you ARE). This type of security is certainly appropriate for intelligence work, but wouldn't be overkill for logins to networks where critical, secret, or financial data reside—which is most corporate networks these days. If you have doubts, check Microsoft's Web site for their fingerprint reader where it says "the Fingerprint Reader should not be used for protecting sensitive data such as financial information or for accessing corporate networks." They understand that even a 0.1% or 0.01% FP rate still means that 1/1000 or 1/10,000 people could potentially be authenticated as somebody else. Microsoft doesn't  believe that this level of protection is sufficient to protect sensitive and valuable assets. Adding a simple PIN would dramatically improve the security by making their authentication process a two-factor process. 

The next issues raised are around the security of the overall system. Can someone entirely circumvent the fingerprint by simply copying the digital stream from the device or the authentication message from the software to the system? Can the fingerprint information on the computer itself be compromised and changed to allow illegitimate access? These are all good questions that depend on the quality, integrity, and robustness of the software supporting the system. There are two weak links in any biometric authentication scheme—how the device talks to the software and how the software talks to the operating system or program that it is authenticating to.  

The device must communicate digital information about the fingerprint to the software that controls the authentication.  It is possible for a "bad guy" to intercept the data stream from a legitimate logon and simply reproduce it to logon to the system without ANY authentication. A "defense-level" authentication application would encrypt this data with a session-based encryption key, or would have various mechanisms to prevent the cloning of the device stream. A consumer device might have none of these.   

The second issue is how the software talks to the operating system and/or program. In a secure setting, the authentication software would interact directly without the need to use the UN/PW at all. This requires fancy programming at the operating system or application program level. A less secure consumer style system might simply store the UN/PW (hopefully in encrypted form) and pass it to the system or application when requested. 

				Local biometric authentication on an individual computer requires the installation and support of a program, and creation of a biometric template (for matching to an individual logon attempt) for each individual who uses the system. This local administration can be a major headache for an IT department in a large corporation. Of course, some of this burden can be removed by using authentication software that resides on a central server. Centralized administration, of course, has its own issues. For example, a user couldn't login within the biometric method unless they were connected to the central server. In addition, authentication to a single computer has one or only a few fingerprints to compare a "challenge" fingerprint to. A central server may have thousands, increasing the likelihood of a false positive. Of course, this is offset by the use of higher quality fingerprint readers, and the use of smart cards that can hold fingerprint data. Finally, many people have significant concerns about privacy issues with centralized biometric data. It is important to note that most biometric fingerprint software doesn't store an image of the actual print, but rather some digital measurements from the print itself in an encrypted format.			

Despite all the issues, biometric authentication is on the rise again. In fact, an advertisement fell out of my morning paper today with a huge fingerprint; IBM is pushing a new series of laptops with built in fingerprint authentication. More and more individuals and companies will consider putting biometric method for authentication in place at home and at workstations. It is likely that you will see biometric devices soon in stores and banks. A significant milestone will be the long-awaited release of the new Vista Microsoft operating system (with a previous code name of Longhorn), which will have built-in support for biometrics.  

If you find yourself considering whether biometric authentication may be valuable for you or your company, you should consider the sensitivity of the data you are protecting, the risk of compromise, and the right balance of security and cost-effectiveness for your particular circumstance. It is no different than buying a front door lock for your home. 

 MD, PhD, is the founder and chairman of Phase Forward, 880 Winter Street,Waltham, MA 02451, (888) 703-1122, 

Technology Viewpoint

Despite accuracy and security concerns, biometrics are gaining in popularity.

Applied Clinical Trials-12-01-2005

European Regulatory Agencies

Search for Stability at FDA

U.S. Departments and Offices

A Swift Predominance of Ex-U.S. Sites

Biometrics Comes of Age