Biometric systems 100% safe?

Nunnery Wood High School in Worcester is planning to use children's fingerprints for logging pupils in and out of school and for cashless catering systems.

The system is on trial at the moment with a view to it being fully implemented in 12 months but there are concerns from parents, one parent, Angie Wilkes, stated that:

“Biometric data, when included on UK passports, was hacked within two weeks by Lukas Grunwald, a consultant with a German security company, using a piece of software costing £105,”

You can understand her concerns, yet the school insisted that "the system is 100 per cent safe" - mmm... no system is 100% safe.

"Headteacher Alun Williams said the school had taken advice from government agency Becta, and had carried out rigorous research. " If the Head has done rigorous research he will know that the systems are not 100% safe.

As far as BECTA carrying out rigorous research on biometric systems in schools - they simply haven't. Their advice given July 2007 was given with no research into these systems whatsoever, I know that as a fact as the Freedom of Information Act was used to see what research they had done - zilch.

So for all you Head Teachers out there thinking that BECTA know about these systems, think again.

Biometric industry see BECTA's guidance as a "green light"

Apparently industry welcomes "the findings of BECTA’s new report entitled Guidance on Biometrics in Schools , which highlighted the positive role biometric technology can play in reducing bullying, theft, truancy and costs in schools."

Really? Reducing bullying, theft and costs? There is no evidence to support this in the public domain.

One biometric vendor states “BECTA’s report effectively provides the green light to continue the roll out of Biometric solutions in schools. The report makes a clear statement that fingerprints cannot be recreated from the string of numbers stored in the database..."

So whilst parents, human rights groups and concerned Members of Parliament are not happy about the BECTA guidance the industry have taken it as a "green light". The parent consultation touched on in the document is simply NOT happening and the notion that BECTA, the DCSF (DfES) and Labour Education Dept hold on to that fingerprints cannot be reconstructed is simply incorrect.

What are we actually paying these people for?

A simple Google of "reconstructing fingerprints" bring up papers that have been written on this or blogs (moi, listed no.3!) that can point civil servants and politicians in the general direction on this subject. It's not rocket science.

It is apparent that there is a concerning lack of research in BECTA's "guidance" which appears to have unsubstantiated claims and inaccurate statements in. Is it right for this to be the basis of an industry that is able to legally take biometric data from children as young a 4 without consulting parents?

The people that this report should have advantaged - our children in schools.

The people this reports advantages - biometric companies supplying to schools.

Guidelines for schools elusive

This from The Sun : "Last night [June 3rd 2007] Schools Minister Jim Knight agreed to draw up strict guidelines"

He also agreed to this in February this year, from Hansard 5 Feb 2007:

Jim Knight: "The Department is working with the British Educational Communications and Technology Agency which is revising its current guidance on data protection to include specific guidance on biometric technology. Becta aims to make the guidance available on its website by the end of March 2007 after consultation with the Office of the Information Commissioner."


So the Department of Education has been working on guidelines since February, delayed publication to March, then May and still Jim Knight is working on guidelines......mmm, there are a number of possibilities here:

1. Either the guidelines are going to be issued in the form of a trilogy, due to length of time taken to write, and will appear not just on BECTA's website but also on Amazon.

2. There are no guidelines being written.

3. There were guidelines but Jim Knight's dog chewed them up, honest.

4. It's a legal nightmare and the Department of Education, the ICO and BECTA are simply not issuing them yet due to legal complications.

Where is the guidance?

Well maybe I'm being tough, it's only 1 day late.

For any of you that want to search BECTA's website for the guidance that has been long promised by the Government due out end March 2007, then put back to May 4th until after the local elections (because biometric technology and it's little known, unregulated, haphazard use with children in schools mostly without parents knowledge, is presumably a big enough "bat" for opposition to use to affect voters decisions?), just type the below in to Google:

site:http://www.becta.org.uk biometric - here's Google's result for this,

or

site:http://www.becta.org.uk fingerprint - and this search result here.

Lots of 'products' listed but no guidance for teachers on this yet... if anyone finds any please let me know!

Guidance out in May

I was advised yesterday, by the Department of Education, that guidance for schools and PFI bidders incorporating biometric systems in schools is now due to be released after the local elections on May 3rd 2007.

The guidance will be released on BECTA's website.

Regulation deadline has not been met by Government for millions of children's biometrics held on school PC's

Both the Liberal Democrats and Conservatives are vocalising their serious concerns about using biometric fingerprint scanners in schools (see blog side bar of parliamentary questions asked), and experts such as Kim Cameron express worries about this practise.

Even BECTA recognises the "concerns of parents" and internationally Roderick Woo, Justice of the Peace at the Hong Kong Office of the Privacy Commissioner, states about the use of biometrics in schools:

"I considered the consent of the staff and pupils rather dubious, because primary school's consent in law cannot be valid and there's undue influence. If the school says, 'give up your fingerprint', there's no way of negotiating.

"Also it's not a good way to teach our children how to give privacy rights the consideration they deserve,"

The Irish Data Commissiors Office has this guidance issued and warns schools about the danger of legal action, "claim for damages from a student", if they don't implement a detailed Privacy Impact Assessment.

There are laws in the USA regulating this technology and children.

But when schools send letters like this school in Doncaster did to parents, and another example over on Tarique Naseem's blog something is radically wrong.

What is going on when we parents have to sign slips for our child's image to be taken but yet when it comes to their bodily biometric data lying on a school PC - no consent, no even letting us know, no nothing!

Why, when ALL the above people and more are expressing serious concerns with fingerprinting children in schools, is the government not moving on the promised guidelines,as stated from 10 Downing Street , it said it would issue at the end of March?

School PCs storing up to nearly 6 million children's biometrics?

The Independent have this article about schools fingerprinting children.

"Almost six million children at 17,000 schools could have their fingerprints taken, intensifying fears of the growth of a "surveillance society" where personal information is gathered from cradle to grave."

With just over 9 million school children in the UK this amounts to nearly two thirds of the school population that could have their biometrics stored on a school PC without the school having to ask for parental consent.

The DfES were planning to issue guidelines on this practise at the end of March via the BECTA -British Educational Communications and Technology Agency's - website (who are an NGO). Non have been forthcoming so far.

See the following BECTA site searches for 'fingerprint' and 'biometric'. If anyone can find any guidelines there please let me know.

Best Practice?

On 9th February this year another advisory statement was issued by the Information Commissioner's Office (ICO) telling schools how to erase children's biometric data from school computers by using professional data cleansing companies, quoted here in the last paragraph of this article:

"...under the data protection act schools must also dispose of the data using professional data cleansing companies once the child has left or if it no longer of use."

Why isn't there a concise page advising schools on how to handle children's biometrics on the ICO's website after 6 years of biometric technology in schools?

Granted the ICO is now working with BECTA and the DfES to issue guidelines, to put on BECTA's website, so the above 'data cleansing' advice will presumably be in the guidelines.

Currently LEA's, schools, governors and parents have dribs and drabs fed by ICO's spokespersons to various media outlets for them to deem what the 'best practice' in schools is with regards to biometric fingerprint technology.

In the recent case of a school scrapping a biometrics, children's biometric data was on the school computer system for over a year unused before it was deleted, and probably when the school did destroy the biometric records they didn't use a data cleansing company - but how would they to know what to do?

"The thumbprint system has not been used for more than a year...and the numerical records of the thumbprints were destroyed last week."

Government to "issue" guidelines via the BECTA website

Labour's Education Department are going to 'issue' guidelines via the British Educational Communications and Technology Agency's website (BECTA) at the end of March 2007 about the use of biometric technology in schools.

No guidance is going direct to teachers, parents or governors, but just placed on a NGO's website - not even a government run site.

No consultation or attempt to hear concerns or issues surrounding this technology is being sought other than the Information Commissioners Office.

A very disappointing show from Labours Education Dept and the DfES, but I have to say not a surprise.

Detail here by the BBC.

N.B. - Just a quick point to note, that in recent media a number of 3500 schools is being banded about (approx. 700,000 children) that are using this technology. This figure is from one manufacturer of a library system and is from from this article in the Daily Mail and is over 6 months old. The market has expanded quite considerably since then with over 15+ companies offering biometirics to schools. No one knows to what extent this is in our education system, these out of date figures are sadly all we have to go on.

So 6 months on I'm presuming the figure now is probably well over 1 million children with their biometric data on schools computors.

BECTA - "care needs to be taken to consider the concerns of parents in this area"

BECTA, the British Educational Communications and Technology Agency's newsletter - Tech News September 2006 - has a section starting on page 11 of their newsletter discussing biometric technology in schools.

BECTA, according to the governments responses to Tom Watson Labour MP and Greg Mulholland Liberal Democrat MP, are consulting with the Information Commissioners Office in drawing up guidelines using biomeric systems in schools for the DfES.

This is what BECTA have to say about biometrics used in schools:

"Authentication systems beyond the common username/password approach are becoming more popular, but as fast as devices and solutions come on the market there are fresh concerns raised about the operations of schemes including issues of privacy and anonymity."

Privacy and anonymity are areas that concern children's rights and privacy groups as well. Child privacy and anonymity needs to be exhausively discussed with such groups that can offer specialist advice in this area before any guidelines are drafted. Hopefully BECTA will pursue their concerns in the right way.

"Some commentators have suggested that traditional registration is not simply about marking attendance; and that teachers carrying out this task can learn more about a pupil during this time than simply if they are present or not."

"A minority of schools are already investing in these systems and it is likely more will try and automate mundane tasks to free up teacher time and improve administration. However, care needs to be taken to consider the concerns of parents in this area."

A school should respect consideration of any concerns that parents may have. It is the right (and lawful) way to proceed. The only way to do this is to alert parents to the practice that schools are using their child's biometric data and gain their informed written consent.

BECTA's concerns are ones that are shared by parents, privacy/rights watchdogs, MP's and others. These concerns surely now must lead to some serious debate time to air these issues and get some regulation into a market that is currently uncontrolled.