The bigger picture on how many children are 'experiencing' biometrics in schools 2013

Good that Big Brother Watch's 'Biometrics in Schools' report highlighted schools in the UK taking children's biometrics, though unfortunate that their figures are somewhat diluted as they are based on an alarmingly low response rate to their Freedom of Information Requests (FOIR).

Having a 39% response rate, 1255 replies from FOIRs sent  to 3,218 schools, is worrying as:
A) accurate data cannot be gleaned from it and
B) as schools are increasingly corporatised, does this suggest they see themselves as unaccountable?

But let's face it, if you were a school receiving a FOIR from Big Brother Watch about if/how your school uses children's biometrics you would be inclined not to answer, as legally every answer given under FOIR is "to the world", i.e. public.  Potentially embarrassing.

So if 40% of schools are using children's biometrics, as Big Brother Watch's FOIR response suggests, then when applied to the wider school population of 8.2 million, in England, this means that 3,280,000 children have their biometrics on school databases.  Interesting.  A figure not reported in the media.

But what about the remaining 60% of schools that did not reply to Big Brother Watch's FOIR?

In 2010 I asked 500 schools similar questions about their use of biometric systems for the then Protection of Freedoms Bill committee sitting in Parliament (now an Act of Parliament) and got replies from 47% of schools.  Because the data I had was not accurate enough to submit to the committee, not having got a near 100% replies, I rang round the schools that had not replied.

Two thirds of the secondary schools that did not reply were using biometric systems, so for example, in Liverpool's secondary schools the initial figure I got from the 47% FOIR response rate indicated that only 25% of schools used biometrics.   After ringing round the remaining schools this figure rose significantly to 72% of Liverpool's secondary schools using biometrics.

So does this mean we can apply the same criteria to the 61% of schools that declined to answer Big Brother Watch's FOIR?  In which case we would be looking at over 6.5 million children using their biometrics England's school population of 8.2 million.  A significantly larger figure than is being quoted in the media.

However, the demographic trend is that biometric systems are mostly used in secondary schools.  'Fingerprinting' primary age school children is not quite yet seen as acceptable, having had bad press in the past decade.  Whereas biometric systems in secondary schools are easier to stomach as children of secondary school age could use the technology routinely on their phone, PS and Xbox, etc.

As there are 8.2 million children in England's schools, with schools having children (from Reception, age 4/5, to Year 11, age 15/16) for 12 years, there are approximately 680,000 children per year group.  Perhaps more importantly, there is a need to look at the percentage of children having experienced biometric systems before they left school, i.e. looking at the secondary schools population where biometric technology is predominantly concentrated.  There is potentially a very high level of children passing through this age group experiencing using their biometrics in a school environment, normalising biometric use for fairly mundane transactions

It would only need two or year groups (or even one year of using a biometric system in a school) to accustom a child to the technology.  This may only mean that 1.3 million children have been using biometric systems in secondary schools but a near 100% experience of every child leaving school having experienced the technology.

So I guess the question could be better asked "How many children leaving school have experienced using biometric systems?"

Though still, the sheer numbers of children that have their biometric data on systems in schools, that possibly may be compromised in the future, is still a very valid point.

Thank you Big Brother Watch for highlighting the issue, as it is always good to have this topic in the news, but perhaps in the future more targeted research should be undertaken.

Quality of biometric normalisation does not necessarily lie in quantity of users - a nicely aimed, targeted demographic suffices.

Devices now read fingerpints up to 6 metres away

Back in 2011 it was reported in Odd Gadgets that devices could read fingerprints from 6 feet (2 metres) away.  No more placing a finger on a scanner, reducing the risk of sharing harmful bugs and bacteria no doubt.

In 2012 the biometric technology by the same company can "effectively scan fingerprints through photographic capture from as far as six meters.

Though the AIRprint is technically capable of a six-meter scan, according to Ange the standard distance this device works is between two and six feet. As previously reported in BiometricUpdate.com, the AIRprint uses only one finger, but enhancements are being made to meet the standard for commercial use, which is the use of four fingers."

Biometrics in Schools briefing

Over on the excellent Action on Rights for Children's (ARCH) website is a overview on the use of 'Biometrics in Schools' for the past 10 years in the UK.

A snippet from the report details the lengths biometric vendors are going to, to market biometric technologies specifically at teachers and parents:

"Some companies have engaged PR firms in order to promote their systems. Livewire PR, for example, were engaged by ‘Vericool’ to provide ‘crisis management’ for its registration system and describes its tactics as follows:

* Ensured that all news releases included implementation advice from the Department for Children Schools and Families (DCSF) – a guideline developed in association with VeriCool - [Interesting to know the DCSF was working with the commercial biometric industry to develope guidelines, presumably separate to the guidance issued by BECTA.  Was this ethical given that evidence suggests the DCSF failed to take advice from elsewhere?]

* Used ‘superfan schools’ to highlight the positive benefits of biometrics in education.

* Secured coverage on new school installations within the local media in a drive to educate parents about biometrics and dispel any myths surrounding fingertip technology.

* Commenced executive profiling programme for VeriCool spokespeople to educate teachers and parents about the benefits of biometrics."

Reconstructing fingerprint images from templates

This is for everyone who thinks fingerprints cannot be reverse engineered from biometric systems, and especially for Jim Knight MP, the Labour Minister for Schools and Learners, who offered up the below incorrect information in a parliamentary debate in July this year with Greg Mulholland MP:

"Secondly, as I stated earlier, it is not possible to recreate a fingerprint using the numbers that are stored. The algorithm generates a unique number, producing no information of any use to identity thieves. I shall quote from a statement from the Information Commissioner’s Office—a thoroughly independent source—that says in the third paragraph:

“Full fingerprint images are not stored and cannot be generated (‘reverse engineered’) from the template.”

I hope that that is clear to all those listening, because it is an important reassurance on the points that the hon. Gentleman has made." ...absolutely crystal Jim.


1. Original fingerprint scan

2. Stored fingerprint template

3. Print reconstructed from template

From:
From Template to Image: Reconstructing
Fingerprints from Minutiae Points

Arun Ross, Member, IEEE, Jidnya Shah, and Anil K. Jain, Fellow, IEEE

April 2007

(as shown on the Leave Them Kids Alone site)

Schools dinners drop by 250,000

The number of secondary school children taking school meals has dropped by 250,000 in the past two years.

The Local Authority Caterers Association (LACA) National School Meals Survey have some interesting statistics:

In Primary Schools the number eligible for free school meals has dropped from 17.3% to 15.9% and the uptake from 14.2% to 13.1%.

In Secondary Schools the number eligible for free school meals dropped from 14.4% to 13.1% and the uptake from 10.6% to 9.6%.

The service is under immense pressure and already being seen by many private contractors as a non-viable operation.

LACA’s concern is that this may well be the case too for public sector caterers. It is not inconceivable that local authorities would consider abandoning the [food] service as budgets are unable to sustain the costs involved with the introduction of the New School Food Standards, particularly if Secondary students can continue to obtain, on the way to school and in break times, the food and drink items banned in school.

Why on earth would a school buy a biometric cashless system when clearly this is an area NOT to invest in at present, but manufacturers claims that such systems boost school meal uptake fly in the face of these recent LACA figures.

Reverse-engineering digital fingerprints

One important point, that has been reiterated time and time again by biometric vendors, Jim Knight and the ICO, is that the biometric systems in schools cannot reverse-engineer a fingerprint.

This does not seem to be the case according to Kim Cameron's recent weblog, Architect of Identity and Access in the Connected Systems Division at Microsoft, entitled "Paper argues biometric templates can be reversed". It shows that reverse-engineering a digital fingerprint may just be possible. He cites this paper "Can images be generated from biometric templates" by Andy Adler, University of Ottawa, 2003.

Also see these Research discussions at West Virginia University from 2005 "We show that minutiae information can reveal substantial details such as the orientation field and the class of the associated fingerprint that can potentially be used to reconstruct the original fingerprint image."

Both of these papers are not too recent and since then one would presume that the technologies in this field have advanced.

However, even thought the possible reconstruction of a fingerprint seems relevant to the argument of biometric technology in schools, ownership and possible 'loss' of ones digital fingerprint is still very relevant... who has access to it, the systems it is on, how it can be used (or abused). These are the points that should be seriously considered by children (and parents) as they unwittingly give up their biometric data for systems in schools which are non essential for purchasing food or accessing library books.

The Royal Academy of Engineering on biometric technology

The Royal Academy of Engineering published a report last month titled 'Dilemmas of Privacy and Surveillance Challenges of Technological Change'.

The subject of biometric technology is dealt with on page 23 of the report:

The more biometric identification is used and the larger the database of biometric information, the greater the likelihood of false matches between a person’s biometric information and records on databases become.

This could result in people being under suspicion of serious crime if their fingerprints are falsely matched with those on a database of fingerprints found at crime scenes.

A police officer in Scotland (Shirley McKie) lost her job because her fingerprints were incorrectly identified as being present in a crime scene that she should not have entered. If systems which use biometrics as a means of identification are regarded as failure proof, then innocent individuals will suffer.

Shirley McKie's father, Iain, posted a recent comment to this blog. They, unfortunately, have had first hand experience of how devastating it can be when biometric identification fails.

Evidence to support claims needed

"I have not been able to find a single piece of published research which suggests that the use of biometrics in schools promotes healthy eating or impoves reading skills amongst children. I am concerned that these reasons are being given as a justification for fingerprinting children. There is absolutely no evidence for such claims."

Dr Sandra Leaton Gray, Director of Studies, Sociology of Education, Homerton College, Cambridge, 20 Feb 2007, quoted here.

As biometric data logging systems have been in some schools for 5-6 years there should be enough evidence now to research whether the claims that made are actually true, so that when quotes such as the ones below are spouted by Local Education Authorities and companies selling the technology to schools, there is evidence to back up claims made.

If the claims are true then prices of up to over £20,000, in one school, should require a cost analysis looking at whether the benefits of the system can be justified against the cost.

If there is no evidence to support claims, then research should at least be done to see whether or not using these systems in school actually does benefit our children.

If there is factual evidence/independant research to support claims made then I, along with government ministers, academics and parents, would be interested in reading it.

"Council bosses are working on a county-wide roll-out [Lancashire] of a scheme which uses electronic scanners to allow pupils to pay for their lunch using their fingers...Council officials say it will make children healthier"

"Mr Sanderson [Education director] that the system had increased book borrowing and reduced theft"

"More time devoted to teaching - every day and for every student!"

"It will help to prevent bullying, by ensuring that students no longer need to carry cash to school"

Schools that have scrapped or are opposed to biometrics

Over on the Leave Them Kids Alone site two pages have been added listing schools that will not use biometric technology and those that have used it and scrapped it.

There are four schools in the UK currently that have scrapped fingerprinting/iris scanning, the most recent being yesterday, and biometrics were tried in school(s) in Dundee then dropped. Concerns were over the controversy and because allegedly the technology didn't work efficiently.

One school in China and one in Hong Kong have tried the fingerprint technology and consequently scrapped it amongst privacy concerns with two schools in the US rejecting biometrics.

The figures are tiny in comparison to the numbers of children with their biometric information on databases in schools but reading some of the comments on LTKA's site, from teachers and staff in schools that will not have biometric scanners installed, re-enforces the issue that using biometrics in schools is proving contentious.

Fingerprint characteristics are able to determine race and ethnicity

Biometric fingerprint technology uses points on the fingerprint that translate into a large number string, algorithm, and that the fingerprint itself is not stored. Although on some systems used in schools an image of a fingerprint does appear on screen when initially scanned.

One can get tied up in the technicalities of the systems, as using biometrics with children poses a whole host of issues.

However fingerprint characteristics can help determine race and ethnicity. Presumably therefore classing fingerprints as "sensitive data" under the UK Data Protection Act as stated in Part 1, Section 2 (a)

"sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject

To collect sensitive data you are legally obliged to obtain specific written consent from the data subject unless you have a legal reason to collect the data. Individuals must be given sufficient information to ensure that they understand what is involved in the research and what will happen to their data.

This article that states it is possible that fingerprints can place race types:

Our society has given the genetic trait of skin colour the special privilege of being the dividing line between human races. But fingerprint types, blood types, or any one of the other 25 per cent of genes that vary among humans could just as logically be used.

A racial world based on fingerprint types, for example, would place most Europeans and Africans in the "Loops" race; Mongolians and Australian aborigines would be proud members of the "Whorls".

And more evidence here too:

...other researchers found rough correlations between fingerprint pattern type and ethnicity, heredity and even some health factors. These correlations, especially the ethnic ones, have proven robust and still hold up today

...the perceived “emptiness” and harmlessness of fingerprint patterns is a social achievement, not a natural fact.

BECTA - "care needs to be taken to consider the concerns of parents in this area"

BECTA, the British Educational Communications and Technology Agency's newsletter - Tech News September 2006 - has a section starting on page 11 of their newsletter discussing biometric technology in schools.

BECTA, according to the governments responses to Tom Watson Labour MP and Greg Mulholland Liberal Democrat MP, are consulting with the Information Commissioners Office in drawing up guidelines using biomeric systems in schools for the DfES.

This is what BECTA have to say about biometrics used in schools:

"Authentication systems beyond the common username/password approach are becoming more popular, but as fast as devices and solutions come on the market there are fresh concerns raised about the operations of schemes including issues of privacy and anonymity."

Privacy and anonymity are areas that concern children's rights and privacy groups as well. Child privacy and anonymity needs to be exhausively discussed with such groups that can offer specialist advice in this area before any guidelines are drafted. Hopefully BECTA will pursue their concerns in the right way.

"Some commentators have suggested that traditional registration is not simply about marking attendance; and that teachers carrying out this task can learn more about a pupil during this time than simply if they are present or not."

"A minority of schools are already investing in these systems and it is likely more will try and automate mundane tasks to free up teacher time and improve administration. However, care needs to be taken to consider the concerns of parents in this area."

A school should respect consideration of any concerns that parents may have. It is the right (and lawful) way to proceed. The only way to do this is to alert parents to the practice that schools are using their child's biometric data and gain their informed written consent.

BECTA's concerns are ones that are shared by parents, privacy/rights watchdogs, MP's and others. These concerns surely now must lead to some serious debate time to air these issues and get some regulation into a market that is currently uncontrolled.

Children's attitudes to fingerprinting in schools

Some research has been done, as part of a larger ICT project, on childrens perceptions of biometrics in schools.

The Trustguide, a collaborative research project between BT Group Chief Technology Office Research and Venturing and HP Labs, is part funded by the DTI Sciencewise programme.
The research seeks to build on the previous government sponsored Foresight project concerned with where responsibilities lie in making our future ICT-enabled world safer.

On page 77 of the Trustguide, published in October this year, it states:

In addition, in some of the groups we discovered that their school used fingerprinting to take books out of the library. Once again, there seemed to be little consideration for the potential infringement to privacy or civil rights this posed:

“Yeah, it's ok because you want a book.”

“Yeah, because the police could actually get your fingerprint up if they really needed it.”

“It's acceptable because the police can find you if you did something wrong, and there's fingerprints there, you can actually find out who's fingerprint it was, because it might be on the system.”

“It's only on the school records, so, it's only in school.”

“I think it would help in at least trying to identify criminals, or something. If you had all schoolchildren's fingerprints already on record. ”

We asked children how long the school kept their fingerprint records and found that most had not even considered this question and showed little concern:

“I think they keep them for a certain amount of time, a couple of years or something, but I've no idea. I think it's wiped off.”

We considered why this apathy existed. It seemed that none of the attendees were thinking beyond the immediate scenario or what they had been told from ‘trusted’ sources (i.e. their parents, their teachers, or the community policeman). They felt that they could not challenge this viewpoint, or present any alternative views. While beyond the scope of the Trustguide project, this does pose some interesting theories regarding the ‘tipping point’ where children move from being passive learners to actively challenging authority. We saw no evidence of this within our discussions so must conclude it comes, if at all, in later teenaged years.

I think the last paragraph sums up why some parents and civil rights groups are alarmed by biometric technology in schools. Children do learn from trusted sources and don't always challenge why they are being asked to do something.

Adult opinion of the use of biometrics for surveillance are under "Use of biometric data" (page29). It states that:

There were high levels of scepticism and negativity around the use of biometrics and some biometric data was seen as far more controversial than other forms. (page31)

Our discussion around biometric data resulted in some fairly heated debate about why it is necessary to be identified with increasing levels of accuracy, by whom, and indeed, the need to be identified at all, in an increasing array of diverse situations. Much of the discussion focused on the opinion, held by many, that they can already identify themselves via a variety of means. (page32)

Many adults are wary of the use of biometrics for themselves, as the report states. So why is it acceptable for our children in schools to use the technology when we, adults, are skeptical of it?

German research fools biometric systems

I recently found this in the LTKA website. It's research that was done in 2002 by the Fraunhofer Research Institute in collaboration with the German Federal Institute for Information Technology Security.

It is a lengthy article but worth reading. It details a variety of easy ways to fool biometric scanners and the simple ways that the systems could be hacked - see www.heise.de/ct/english/02/11/114/

A quote near the end of the article reads:

"With the aid of data packets gathered by eavesdropping and some lines of Perl script we were able to reconstruct complete fingerprints"

Clarification on whether the systems fooled are the ones used in UK schools URGENTLY needs checking. Thankfully my children's fingerprints aren't on any systems - what a relief!