A parent's communication with school implementing biometrics

This month a concerned parent wrote to her child's school after finding out the school was planning to implement a biometric system.  She has kindly allowed the communications to be published so other parents wanting to use any of the information, the Freedom of Information request or the letter, sent to the school can see some questions to ask and points to consider.

Freedom of Information request sent to a school implementing a biometric system and a Letter raising concerns and links to aspects for the school to consider.

The law changes here in the UK.  Come September 2013 schools must have the written signature of one parent and the consent of the child in order to process a students biometric data. 

In light of this the UK Department of Education published these guidelines and template letters for schools to use in light of the pending leglislation:
Protection of Biometric Information of Children in Schools.
Government response to the consultation on draft advice on protection of information of children in schools

Solving problems and proving claims

There is no doubt that biometrics are here to stay and I'm no Luddite about that.  The general use of biometrics in UK society has been introduced to us all via our children, that it 'if' we are even aware they are using the technology.

In my opninion this has been grossly mishandled by the biometric industry.  The perception could be that it has been introduced it by stealth, aided by laws in the UK that have enabled this situation to happen.   In EU countries where Data Protection laws are more stringent, childrens biometrics are very rarely processed in schools.

Claims about biometric technology cannot be scrutenised to any great extent as schools and the previous government's apathy on the subject has not enabled any research to be done.  Hence assertions made by industry and schools in defence of the use of biometrics in schools needs to be questioned. 

Quoting from ASCL's General Secretary Brian Lightman:

"It [biometrics] means that students eligible for free school meals can take them up without being stigmatised"   So does a pin number system or alternative touch system.  No 'expensive' cards necessarily needed.  If a school can get pupils to pass exams then it can surely get a pupil to remember a pin number.

"...and parents know their children are not buying lunch at the chip shop."   Use a pin number system or alternative touch system.

"These systems prevent fraud and, with dinner money, intimidation and theft by other pupils." 
Use a pin number system or alternative touch system.  I've heard many an argument that using biometrics reduces bullying, such a claim indeed.  Bullying exists in schools, therefore the school should deal with different bullying situations and teach children what is and what is not acceptable behavior, in all circumstances.

"Systems using cards are more expensive to install, more open to abuse and not as effective as cards are often lost, stolen or simply left at home."  Use a pin number system or alternative touch system.

However, it could be argued that there are more benefits to the pupils than the administration of a school of having a card system. I.e. to encourage pupils to look after their identity, be aware where it is, how they have used it, see possible consequences if their identity card is lost, etc, none of which biometrics can really offer in the same way at the moment.

If the introduction use of biometrics had been made in the adult market in the UK we could possibly teach our chidlren how to manage the use of our biometrics, learn to keep track of where we have left our biometrics, who can access our biometric data and the data held against it, possible interoperability of biometric databases and where biometric data might end up, etc.   We are unable to do this and I would interested to know if schools are doing this - my guess is they are not.

"The information could not be used to identify a student outside of the school, by the police or any other outside organisation."  How does he know that for sure?  As the ASCL and the biometric industry have close links maybe he got told that by them?

The reality is that there is software that enables Automated Fingerprint Identification Systems (AFIS) to communicate with each other so the possibility is there - see this link. Have any checks been carried out to see if his statement is correct? - no.

“Schools and colleges have invested heavily in this technology"  You bet they have Brian. Here's Staffordshire County Council spending up to £4 million pounds on it.

And lastly...

“Biometrics in schools are a problem for a small number of pressure groups, not for parents."   I'm a parent and the Leave Them Kids Alone website was set up by a concerned parent too.

In fact, as far as I know, any website dealing specifically with the civil liberties issues raised by using biometrics in schools, have been set up and run by parents. Oh, and the reason why privacy groups have brought up the matter of schools fingerprinting children without our knowledge, is mainly because we parents have contacted them.

Figures, damned figures and statistics

Following on from the previous post we are looking at the 'joint' article published on the 15th April by the Association of School and College Leaders (ASCL) and Planet Biometrics.


"Figures come from Biostore, the main supplier of identity management systems to secondary schools. Its client base includes over 1000 secondary schools, and it estimates that well over 1 million students use its finger based biometrics daily. Biostore’s work with schools shows that 2 users per 1000 decline to use biometrics. A 99.8% uptake of a voluntary process reflects the views of most of the public on this subject"


Both articles quote the above which is by the company Biostore who sell school biometric management systems.  They understandably have a commercial interest to state that biometrics have a high take up in schools.  It is taken from their written submission to the Freedom Bill.

• Did parents specifically sign for consent?
• Was it a parental opt out scenario, 'implied consent'?
• Did the parents even know that their children were using their biometrics?
• Is the 99.8% figure an indication of the uptake of children in a compliant school environment or an indication from fully informed parents and specifically gaining written consent?

Without knowing the answers to these questions the above statement is ambiguous and figures quoted should be questioned.  For Biostore to then assume that the 99.8% uptake in schools reflects the general populations view on this is, in my opinion, rather hopeful.


I can only speak from experience, where in my sons primary school when parents were specifically asked by letter to sign to consent to the school using biometrics, approximately 20% of parents did not consent for their childrens biometrics to be processed.  The school biometric system is now not in use.


Interestingly there are 3722 secondary schools in the UK (excluding Northern Ireland) with 3,560,384 pupils.  If Biostore's "client base includes over 1000 secondary schools, and it estimates that well over 1 million students use its finger based biometrics daily" taking the figures literally at 1000 schools that means Biostore, at the very least, has 28% of the total schools biometric market.


Both articles quote that there is evidence that "30% of secondary schools have biometric systems".


Are we then to believe that one company, Biostore, has 93% of the high school market share...? 

Okay to fingerprint kids - but teachers won't use biometrics

Unbelievable!  Headteachers moaning about gaining parental consent for processing childrens biometrics in schools when their own teachers won't use biometrics because teachers "consider giving fingerprints as an infringement of their civil liberties" ......Oh? So that's one rule for the kids and another rule for the teachers?

Headteachers have been glittered by the biometric sales industry, spent millions of pounds of our taxpayers money on biometric systems and have been glibly fingerprinting and processing our children biometrics, quite often without parents even knowing about it.  All the Freedom Bill is doing is requiring Headteachers to take responsibility for their decisions to use this technology with children.

MP Jim Shannon in the House of Commons debate on this issue on March 1st, makes the point that it is "clear that parents must and should have a complete veto on the collection and storage of their children's genetic make-up"

And the Government's take on the financial impact is that it is "likely to have some financial impact on schools (administration and provision of alternative systems), however this is balanced against the non-financial benefit of protecting the civil liberties of children in schools and colleges"

Hear, hear - and what Headteacher would want to compromise the civil liberties of children in their care?

Liverpool councillors sever all ties with biometric technology in schools

This from the Liverpool Echo:

"A meeting of the full council will be asked to express its formal “opposition to the fingerprinting of children by schools” and a ban on any local authority-led promotion of its use save for a criminal investigation.

Picton ward councillor Andrew Makinson who is behind the motion said the £20,000 average cost of installing it could be better spent on school staff.

He said government mishaps with personal information was proof all systems were vulnerable.

Council leader Warren Bradley stressed it had always been down to individual schools to adopt the technology.

He added: “It would be wrong to implement a policy and support something which could potentially be of detriment to the protection of our children.”"

More schools - same misinformation

Although I haven't posted here for quite a while I've been busy behind the scenes gathering some information using the Freedom of Information Act from various bodies with some interesting results on how the governments advice for schools using biometrics was constructed and we've also had some interest from the media on the subject of biometrics in schools. So although not "bloggingly vocal" - still at it!

So what has been happening?....

Seems that the media coverage over the past month or so has been constant with parents voicing their concerns across the country.

This video from the BBC site http://news.bbc.co.uk/1/hi/wales/7502790.stm about Caldicott Comprehensive School, Newport, Wales, where parents are protesting about fingerprint systems. The school hasn't consulted with parents at all.

Chipping Campden comprehensive in Gloucestershire, where the actor Chris Jury's child attends, is rolling out biometrics for catering and registration, as the Telegraph and Cotswold Journal reports. The Coltswold Journal states that:

"He was responding to a letter she circulated to her pupils' parents announcing biometric machines would be installed at the school." and rightly so - is this the schools idea of consultation? Telling the parents is an arrogant way of assuming consent from parents (or children for that matter).

Abbey College, Ramsey in Cambridgeshire are introducing a fingerprint cashless catering. According to the Hunts Post:

"The school has assured parents that no one has access to the information and that the data can "never be viewed as anything other than a string of numbers and letters".

Obviously the company selling the biometric system to the school hasn't informed them about research done in the United States on how fingerprints can be recovered from such systems.

As the government nor academics in the UK have not had access to any systems that are sold to schools to test whether the schools statement is true, judgement can only be taken on the basis of work that has been done in the States on this.

Abbey College school also state that "no one has access to the information" - wrong. The police can have access if they believe that it will help solve a crime. This is what the Deputy Information Commissioner, David Smith, had to say on this in May 2007 with regard to school biometric systems (see Q50 and Q51):

"The police [can] make an access request. The school looks at: "Would we breach the Data Protection Act if we respond to the police?" If they can say that not giving the information would be likely to prejudice prevention or detection of crime and does not say a level of crime, or the apprehension or prosecution of an offender, then they can give that information without breaching the Act. A low level of crime would justify that"

So think again when a school states that no one can access information.

And £30,000 is being spent in Nequay's Tretherras School in Cornwall on biometric cashless catering, with a further £1500 spent each year on the license to have the technology.

Apart from the issues of consent, who can access to information and the possible re-engineering of fingerprints the additional issue of cost is huge.

When my children were nearly fingerprinted 3 years ago , at 6 & 7 years old, there were two companies selling biometric fingerprint systems - now there are nearly 20 companies in the market place here in the UK - a market that is ultimately driven by our tax payers money. We are funding this biometric market.

£25,000 biometric cashless system bought - based on "commonly perceived benefits"

At the end of January Sophie McKeand's child's school told parents they were "introducing a "cashless catering system", where children will pay for their school dinners using either a fingerprint identification system or a pin number". This is in Flintshire, Wales.

Sophie rightly objected "to have such important and sensitive biometric data being taken from children for a matter as trivial as buying lunch is absolutely absurd."

Since then Sophie has been busy finding out, via the Freedom of Information Act, just how much these systems cost (using our tax money), where the funding is coming from, who made the decision to implement such systems, etc. - interesting reading indeed.

Her Freedom of Information questions and answers, for Flintshire County Council, are on the "Biometrics in Schools" forum over on the NO2ID site.

Here are a few questions and answers:

3. What is the FULL, TOTAL AND FINAL cost of this system in Alun School?

A3.The full cost of the system in the Alun School is as follows:

PCS Systems £20,905.00
Software £ 1,062.32
Installation £ 1,162.50
Server £ 283.14
Printer etc. £ 574.00
Writing/Electrics £ 1,162.50

TOTAL £25,149.46 [this is cost for one school]

1. I wish to be provided with ALL cost / benefit analysis that have been completed concerning anything whatsoever to do with implementing these cashless systems in Flintshire schools. Not just for Mold Alun but for all schools in Flintshire as stated in the quote from the first letter from Alun School, above. This includes all equipment, maintenance and IT services.

A1. The Council holds no information regarding a cost/benefit analysis. [What?]
The commonly perceived benefits however, are that..... then follows some drivel about reducing bullying and enabling children to eat before afternoon registration, up take of free meals increased, blah, blah.

So, lets get this right...

...the council spends 25K of our money on a biometric/pin cashless catering system purely based on "commonly perceived benefits" - with no cost/benefit analysis to justify such expenditure?

IMHO this sounds like jawdropping negligence.

Flintshire County Council sound like they've been sold a line. "Commonly perceived benefits" that are backed up with absolutely no academic or government literature, but I guess probably literature from sales persons.

It would seem that the implementation of the systems (that were originally proposed to be run throughout all Flintshire Schools, which would be around £250,000 of taxpayers money) has not been a completely open and transparent process, as reported today:

"Cllr Ray Dodd said he shared some of Miss McKeand's concerns. "I am surprised that this biometric system has been introduced in a school already without any consultation with elected councillors.

The education department said there has been extensive consultation, I have not been able to establish any consultation with county councillors,"

Parents to be consulted about biometric systems in Sussex school

Warden Park School in Cuckfield, Sussex, could be using childrens fingerprints for paying for school lunches:

"The biometric technology could be introduced at the school as early as June if parents support the proposals.

Using pupils' fingerprints in schools has been criticised by many MPs, including Sussex Conservatives Nick Gibb and Tim Loughton, who fear sensitive information about children could fall into the wrong hands.

Mr Loughton, MP for East Worthing and Shoreham, has said it is another step towards a surveillance society."

At least the school is going to consult with parents but according to headteacher Steve Johnson hundreds of schools in the region now used the technology.

If Warden Park School make their decision in favour of the technology a Freedom of Information Act Request could be in order to determine:

Our public money cost. Cost/benefit analysis. (One such system sold to a school in Leeds, according to the Headteacher on BBC Radio 4 "You and Yours" programme, cost £14,000 - after a Freedom of Information request this turned out to be over £27,000 - only a slight misrepresentation of 13K of our money!)

Where/which budget the money to purchase system is coming from.

The extent of parental consultation.

How this technology can "reduce bullying" i.e. related bullying figures re: catering before installation.

How many instances of "children stealing other pupils' dinner money" happened before biometric catering system installed.

A spokesperson from the company hoping to sell the system to the school stated that the "guidelines from the Department for Children, Schools and Families made it clear data could not be passed to any third party organisations" - erm... not quite true, see Q50 & 51 in parliament.

"Generation ID: lessons in kiddyprinting"

Redpepper have this excellent article on "kiddyprinting" in schools.

"The innocuous term ‘kiddyprinting’ refers to the controversial practice of routinely fingerprinting schoolchildren. Many parents are unaware of it because they have not been asked for their explicit consent, or in many cases even notified that it is taking place."

Suffolk schools fingerprinting for food

Stowmarket High school has started using children's fingerprints for meals, not mentioned on their website, along with Kirkley High, again not mentioned on their website either.

This from the Stowmarket Headteacher Keith Penn: “I have no concerns about any infringement of civil liberties in this instance and am not concerned about this issue." - what at all?

He should be concerned as Action on Rights for Children, Liberty, Privacy International, NO2ID, parent run site Leave Them Kids Alone and a host international experts have concerns - and in the USA Electronic Frontiers Foundation and American Civil Liberties Union have concerns as well.

Well he is only a headteacher and obviously has no experience of children's rights (although maybe he should have, being in charge of a fair few hundred of them).

Maybe these heads of schools should do some research into this issue of using children's biometric data for routine activities that, supposedly helps the schools administrative function.

See Mark Crossley's blog, editor of the Suffolk Free Press on this.

"Thumbs down" - another parent's blog

Another parent has set a blog up called "Thumbs down"

"At the end of 2007 I received a letter from my daughter’s school informing me that the school library was to be run on a biometric system.

I was appalled. This blog charts my attempt to have them reverse the policy.

I hope it is short."

So do I. My children's school seem now to be using a barcode system now instead of the biometric scanner they purchased in 2005 for library use, so good luck!

Canadian students object to biometic access - for gym access

The University of Northern British Columbia has installed biometric scanners "controlling access to the sports centre" [why?] 300 students have signed an online petition opposing it.

"Graduate student Gabrielle Wint-Rose wasn't sure why her gym needs such personal data, and said the invasiveness of the system should have been considered and students consulted before installing the system.

"It was a really shocking experience. It really wakes you up. You realize you walk into this facility and the only way to access is through finger scanning and all of sudden you're in this moment where you have no choice. What do you do?" said Wint-Rose on Wednesday.

Lindsay Stinson told CBC News she was upset she had to register her fingerprint and give personal information before she could work out at her university's new gym."

Proportionality in this must be considered. Who would want to monitor or possibly profile students exercise information? Does the university own the gym or do they lease it out to a private company? Where does the students data go?

Want to exercise = give personal biometric data? (would suggest boycotting gym and jogging instead, cheaper and non intrusive)

Students in Canada have (absolutely) more awareness than UK primary school pupils, 4 years old, that are now using fingerprint biometric systems here, and in the USA, without parental consent/knowledge.

With the Canadian students being older and having awareness of their personal data, they consequently raise valid privacy issues:

"Wint-Rose said she is concerned about what happens to the biometric information and who controls it.

"The northern sports centre has my information. I have no way of getting that back. I don't know how it's being collected, where it's being stored, who has access to this information," said Wint-Rose."

The following is a published paper by the Candian Information and Privacy Commissioner in March 2007:

Biometric Encryption: A Positive-Sum Technology that Achieves Strong Authentication, Security AND Privacy

by
Ann Cavoukian, Ph.D. Information and Privacy Commissioner/Ontario &
Alex Stoianov, Ph.D. Biometrics Scientist

Biometrics enable Australian schools to monitor students "more closely"

In Australia, New South Wales, the children's biometric market is taking off. The all in one scheme monitors eating habits, movements around school and children's reading habits.

Rooty Hill High School has ordered 14 scanners, which are expected to be used to scan students as they enter the canteen, library and some classrooms.

The school's principal Christine Cawsey said it would allow the school to monitor the students more closely. [why?]

But president of the NSW Council for Civil Liberties Cameron Murphy said the scanning system was "intrusive" and suggested those using the system were branding students as lawbreakers.

"It's a clear breach of their privacy and it's treating school kids like they're criminals," Mr Murphy told The Daily Telegraph last night. "It's absolutely absurd.

"If the fingerprinting doesn't work, what's next? Putting ankle bracelets on students?"

Academy Attendance manufactures the electronic attendance systems, which are expected to be rolled out to at least half a dozen other schools next year.

The Federation of Parents and Citizens Associations said they were not consulted about the new technology.

"This is a step too far ... we would have liked to have expressed an opinion to ensure that all the checks and balances were there," federation president Di Giblin said.

Reconstructing fingerprint images from templates

This is for everyone who thinks fingerprints cannot be reverse engineered from biometric systems, and especially for Jim Knight MP, the Labour Minister for Schools and Learners, who offered up the below incorrect information in a parliamentary debate in July this year with Greg Mulholland MP:

"Secondly, as I stated earlier, it is not possible to recreate a fingerprint using the numbers that are stored. The algorithm generates a unique number, producing no information of any use to identity thieves. I shall quote from a statement from the Information Commissioner’s Office—a thoroughly independent source—that says in the third paragraph:

“Full fingerprint images are not stored and cannot be generated (‘reverse engineered’) from the template.”

I hope that that is clear to all those listening, because it is an important reassurance on the points that the hon. Gentleman has made." ...absolutely crystal Jim.


1. Original fingerprint scan

2. Stored fingerprint template

3. Print reconstructed from template

From:
From Template to Image: Reconstructing
Fingerprints from Minutiae Points

Arun Ross, Member, IEEE, Jidnya Shah, and Anil K. Jain, Fellow, IEEE

April 2007

(as shown on the Leave Them Kids Alone site)

A bit of cancer with your chips?...but only with a fingerprint

Rantings of a New Yorker has had a few comments to make recently on the new fingerprint and RFID chipped world that our children experience in school:

RFID Chips Wanted in British School Children’s Uniforms
There’s a New Jacket in Town, and It’s Keeping Track of Your Children
Parents Upset at Scanning Children’s Fingerprints so They Can Eat Lunch

Ooooh and here's one that parents and pupils of Hungerhill School, Doncaster, UK might want to read - RFID Implants Linked to Cancer

Thanks Rantings and Slashdot too :)

Leeds pupils speak out

Over on Taz's blog the ongoing annoyance and concerns of pupils and parents at Morley High School, run by Education Leeds, continues, with much debate...

"i am a student at morley high school and now see why no letters were sent out, the ironic thing about this system is that in our school it dosent even work as expected because if multiple students use there fingerprints at the same time the orders get mixed up and so many people have to pay for things they havent even purchased ...and the head teacher is reported to be one of the best in the local area" mmm.... in some peoples views maybe not so "best"

Such systems can cost up to £25,000. When biometric systems do not educationally benefit children (depending from who's point of view), just think how better this 25K and the annual running costs of the system could be better spent on our children's education.

Outraged parents start their own blog

A while ago I posted Leeds pupils bullied to give up their prints - here is the email in full on the Leave Them Kids Alone site. It makes for uncomfortable reading.

So now the parents whose children go to Morley High School in Leeds have started their own blog, http://morleyparents.blogspot.com/.

Here they voice their concerns on how the new biometric fingerprint system has been implemented allegedly leaving pupils who refuse to be fingerprinted without hot meals and children who don't use the canteen being photographed fingerprinted - read the blog for more.

Parents voice their concerns

The Daily Mail reports today on growing concerns amongst parents about the practise of "fingerprinting" children in schools for food, books and access.

One parent has already taken legal advice after his child's school took biometric fingerprint from his child without even informing him.

"...a Suffolk filmmaker called Jonathan Adams, are considering legal action to stop schools in their tracks. "Litigation may be the only way forward," he says. "We fear they are in breach of the Human Rights Act, the Data Protection Act and the European Commission laws that safeguard the child.

"We have sought initial advice from lawyers."

This from David Clouter of Leave Them Kids Alone, (which as a parent I completely agree with),
"Schools send out consent slips for just about anything, from allowing popcorn during cinema trips to whether we can take pictures of the school play at the end of term," Mr Clouter says, "but they didn't plan to ask the parents about taking their children's fingerprints."

Fiona Elliot a parent in Doncaster, who was quoted in the article, had this letter from her children's primary schools which stated: " We have no legal requirement to ask for permission [from parents before 'fingerprinting' children] as we will not be breaching any data protection regulations"

...and the next sentance is quite unbelievable, "and also letters of permission are not always returned" (!)

I agree with Fiona, "If some choose to write this off as alarmist, she doesn't care", neither do I.

House of Commons Adjournment Debate

There was a House of Commons Adjournment debate Monday 23rd July with Greg Mulholland, Lib Dem Shadow Education Spokesperson, leading the debate and Jim Knight, Labour Minister from the Department of children, schools and families, answering.

At long last debate time in parliament has been given over to the taking of children's biometric data without parental consent.

The debate can been seen here, it is the last item to be debated and can be found at 06.35.25 on the slider.

Luckily for Jim Knight, in order to answer Greg Mulhollands points and not to loose face, he had to have some advice from the ICO and BECTA - well and what do you know... after nearly a year of waiting for advice, the long awaited guidance from BECTA and the ICO just happened to be issued today.

Phew that was lucky for Jim Knight - what were the odds against that then?!!

"Issues and Standardization"

There is another well written article, "Issues and Standardization" by Patricia Duebel in The Journal where she tackles the issues surrounding consent, privacy and industry standardization, making separate, isolated biometric databases compatible with each other.

This is part 2 of three articles. The last article will "look at vendor claims and a sound business plan of action that leads to a security solution you really need."

There are many issues involving this technology with children and as with any tool, biometrics used in the right circumstances can be used to good effect. However schools, currently both in the UK and US, really don't have much 'informed' information to go off than biometric vendor claims. In this respect Patricia's articles are a valuable read for both parents, students and school districts considering this technology, covering a wide range of aspects on this issue, backed up with independent references.

"After getting an understanding of the technology, its potential and the issues surrounding its use, will you allow your district to be swayed by vendor claims? The important question is: "Do you require a reliable biometric solution, or is it just something that would be nice to have?" Don't put the cart before the horse. You're not ready yet to decide. You need a business plan of action, but that's for next time." (page 4, last paragraph).