Sunday, February 04, 2007

How biometric fingerprint scanners work

After yesterday's post I thought it might be good to look at how the technology works for those of you that are interested.

I have had a few 'comments' on my blog highlighting me to the fact it is not an actual fingerprint that is stored but an algorithm, which I was well aware of anyway, but for those of you who are as hazy as I was initially, on how biometric data is taken from a fingerprint, please use the below links.

A great website that gives a fairly detailed but easily understandable view on most types of biometrics is http://perso.orange.fr/fingerchip/index.htm by Jean-Francois Mainguet.

It details here on the characteristics of fingerprints and this page deals with how points on the fingerprint are converted into an algorithm number string.

When I had contact with Micro Librarian Systems (MLS) that supplied my children's primary school with the biometric fingerprint scanner 18 months ago, they sent me this document detailing the technology that they employed - Enterprise Security Architecture for Biometric User Authentication Systems developed by Digital Persona.

Could it be argued that the points on a fingerprint stored in an algorithm can determine race and ethnicity? - I don't know...

Are the images of a children's fingerprint removed from a school computor when they are initially scanned? - Truely deleting data or temporary files from a hard drive does not merely involve pressing "delete". Temporary files may be stored for a time scale also...

Research needs to be done exploring these (and other) issues relating to children and biometric technology.

Children as young as 3 years old are having their biometric data taken and stored on school/nursery databases here in the UK and, as with all techonogies, there is the remote possibly that their (biometric) data could be compromised in decades to come.

We need to make informed decisions now about how we as a society proceed with children and biometric technology.

6 comments:

Eric said...

I got interested in this topic precisely because a friend asked me how to verify that our neighborhood school had destroyed her son's fingerprint data after it had been collected without her permission.

The longer answer is here: Destroying fingerprints. There's a point I make in that posting which I think is especially relevant here:

"it's not just about the fingerprints stored on the system. Every time someone presses their finger onto a reader, another image of their print is taken and processed. In the case of our lunch lines, that's a regularly scheduled, completely predictable stream of fingerprints. The need to secure that data is not just the first time it's collected, but every time it is used as well. That's a very long term commitment to security. Moreover, that data needs to be protected for the entire lifespan of the student because that student cannot ever change their fingerprints. Is our school district insured against financial consequences of loosing that data?" Are we insured against the loss of that data not just now but at any time during that student's lifetime?

Pippa King said...

Thanks Eric, your comments and links are a valuable resource.

Anonymous said...

we have just been informed by our daughters school biometric fingerprints will be in use starting tomorrow we have had no consultation process and the head stay even if your child stays for packed lunch they have to have there photo and fingerprint done can they do this ?

Pippa said...

No - Certainly if you are in the UK this is not the case. Your daughter is absolutely entitled to eat at school without this level of personal intrusion.

If you have any concerns please get in touch with the UK Data Commissioner's Office (links on my blog) or contact the UK based Action on Rights for Children www.arch-ed.org

I don't know the full facts legally in the USA but if you are USA based, EFF or ACLU should be able to give you the details of your childs rights, again details of these organisations on my blog right hand side column.

I have heard of this happening in the UK with children that have packed lunches where biometric vending machines are in schools - so all children can use them - but the UK Data Commissioner has stated that alternative methods of registering for such systems should be made as an alternative. i.e. PIN number

What a dilema for you as parents. I would be interested in how this progresses - Good luck, it's not pleasant as a parent to challenge the school.

If you want to email direct:
pippa "dot" owee "at" yahoo "dot co "dot uk

Hope all goes well.

Anonymous said...

Hi thanks for the reply, but the school has taken my daughters photo and fingerprint today even though I have protested to the school and phoned the Leeds Education authority and our local Mayor and newspaper. This is so not right. Janet

Pippa said...

That's outrageous! It could be advisable to take some legal advice on this.

Insist that your daughters biometric data is removed immediately, get confirmation of this in writing from the school.

If the school had taken a photo knowing that you objected they would be in clear breach of the law.

I also suggest you contact our UK Information Commissioner, http://www.ico.gov.uk/complaints.aspx to complain strongly.

Also the person ultimately and legally responsible for the action of teachers is the Head of Governors, I'm sure he/she may be interested to know how the staff they have appointed are, by their actions, putting him/her in a very difficult position.

The Yorkshire Post is sympathetic to this issue so contacting them could be fruitful.

Good luck - please let me know how this goes.