Florida Gov signs legislation to ban biometrics in schools & SIBA's reaction

Florida Gov Rick Scott

Florida Governor Rick Scott signed SB188 on May 12th 2014 which banned biometrics in schools. Groundbreaking legislation, the first of its kind globally.

This now sets a precedent for other like minded states to follow in the same vein.  Governor Scott signed the legislation, as a part of a number of measures to "prevent unnecessary collection of data from our students", to more free up Florida's commitment to the controversial Common Core education initiative.

In the meantime the newly formed Security Identity and Biometrics Association (SIBA), born out of Washington DC in February 2014 (coincidentally in the month the Florida legislature voted overwhelmingly in support of the biometric ban), is very keen to see a halt to schools banning biometrics.

So much so, they have devoted a sizable proportion of their website detailing how SIBA plans to  produce four Fact Sheets, under a promotion named KickStart, to be aimed presumably at schools "to dispel myths; advance positive legislative solutions; report on school uses, successes and challenges; and support schools and their vendors seeking positive change for their communities" costing $2,500 each.  These facts sheets will be advertising the companies that sponsor the sheets.

I could write some fact sheets about biometric technology used by children in schools, with their use both in the UK and US over the past decade for considerably less money, that would be carefully referenced with facts, via citations.   So I await with baited breath to see what 'facts' these four Fact Sheets costing $10,000 will contain.  Hopefully the sheets will have independent, credible evidence to back up any facts made and I look forward to reading them - that is if SIBA publishes them on their website.

SIBA's drive to get schools on board is subtly said in a photograph on this page carrying the statement that "Schools need our help!", when in reality the education system is working absolutely fine without children authenticating themselves via a measurement of their body to eat, register or take a book from a library.

Do adults use biometric technology in order to eat?  No.  In fact there is distrust about biometrics in adult society and is there any wonder with this recent headline from Biometric Update "Canadian academics, privacy groups issue statement against mass spying".  When data protection and privacy laws are not enforceable and general unease lies with biometric technology, why is there a drive to encourage children in schools to use their biometrics?  

Some might say that it is not in the government's interest to have schools ban biometrics when really their agenda is to soften the next generation to the technology, using a compliant environment to do so?

An upcoming event SIBA are having in June 2014 is "closed door" with two speakers, Alan Bersin, Acting Assistant Secretary for policy for the US Department of Homeland Security and Vice-president for the Americas Interpol and Bob Mocny, Director in the Office of Biometric Management, part of the  US Department of Homeland Security.  It is not boding well for transparency when one of SIBA's first events is 'closed door' and the speakers are from a US government department which is widely perceived as having largely eroded the privacy of the people of the United States.

I feel, for me and others concerned about the use of biometric technology with children, SIBA looks like a US government led organisation bent on promoting biometrics in schools, worried by the recent legislation passed in Florida.  I have asked SIBA how they are funded, who their members are and where and when they were conceived as this information is not on their website.

Openness and clarity from SIBA is vitally important on this so that we, as parents, are aware of who is driving the agenda for our children to authenticate themselves with biometric identifiers for day to day services in education...  I await SIBA's answer.

Florida bans biometrics in schools, and the industry's "emerging fight" against it

It has been interesting to follow the progress of the Florida legislature to ban schools from taking and processing children's biometrics, the process of which started late last year.  It will be the first time in the USA or worldwide that biometrics have been banned in schools, when Gov Rick Scott signs the bill.  Some have argued that the UK Protection of Freedoms Act 2012 should have gone this far but instead we have that schools can only process a child's biometric data with written parental consent.  However, how parents are fully informed to make that consent still leaves the process open to spin and ambiguity surrounding the technology and its capabilities.

In Florida three bills were filed dealing with Florida schools using biometrics, during September and October 2013. With one, SB188 relating to education data privacy, being passed on April 11 2014. It reads (see lines 49-66):

(1) An agency or institution as defined in s.1002.22(1) may not:

(a) Collect, obtain, or retain information on the political affiliation, voting history, religious affiliation, or biometric information of a student or a parent or sibling of the student.  

The bill passed by 113 Yeas to 1 Nay. 

This news has been met by the biometric industry in the United States with fears it may lead to other states approving similar bills.  There are already laws in other states concerning parental consent for schools to use biometric technology but SB188 goes one step further, by banning it.

Many experts, privacy organisations and others have aired concerns over children using their biometrics in school for a variety of reasons:
     - Security of data - What does a child do if their biometric data is compromised?  How and when would that become apparent?  Leaps and bounds in technology cannot possibly foresee how this could play out in the decades to come.
     - The personal information that is held against the biometric - Reading or eating habits, who views that?

     - The sharing of biometric data and personal data stored against it - Government agencies now routinely take biometric data and upload it to other databases.

     - The subtle psychological message using this technology gives to children, that to gain access to books/knowledge, food/money, normalises the use of biometrics for mundane yet essential activities.   

Janet Kephart of the Secure Identity and Biometrics Association (SIBA), set up in February 2014, states that one of four biggest challenges of 2014 is to help clear the air in "a newly emerging fight in state legislatures whereby there is a push to ban biometrics in public schools".  

Kephart claims that, "Biometric technologies do not store identities; they store templates".  Surely template/s based on a particular person are designed to identify said person, otherwise how would the system work?  Then the next statement contradicts her earlier statement by saying, "To further assure privacy, names are kept separate from the biometric templates, encrypted, and not directly linked with the biometric data".  Yes, so they are linked then but encrypted.  Indeed, one might liken this to doublespeak?

She then, unsurprisingly, states the usual line to be seen and heard in the spiel dished out to schools in the USA and UK by biometric vendors, "...the outline of fingerprints aren’t stored like an image – they’re turned into a set of series of numbers that can’t be reverse engineered."  Yes, a set of numbers that is digitally transferable between databases.

With regards to Florida banning biometrics in schools (with SIBA only being set up two months earlier with a view to, "educate folks about the reality of biometrics, bridging the gap between Washington and the industry" , maybe SIBA was set up because of SB188?) Janet Kephart states:

“Nobody in Florida decided to do due diligence on this... [presumably she has proof of this allegation]  No one clearly went out and asked how biometric technology actually works … nobody asked the question. It was just basic public servant due diligence that they didn’t do and there’s really no excuse for that.”

Just a minute... where was the "due diligence" of the biometric industry from 2001 onwards effectively testing biometric technology on children by fingerprinting 4 year olds to get a library book out, using infrared palm scanners trialled on primary school children in 2006 so they could eat, iris scanning children for lunch lines in 2007, facial scanning kids in 2010 to stop them from turning up to school late, voice biometric planned in 2007 for students, and (partly what prompted SB188) a Florida school district iris scanning 700+ children to travel on a bus?  All without parental consent or appropiate discussion, hence the legislation in the US States and the UK.

And SIBA want to talk about due diligence?   An apology would be more fitting.

Let's tell it how it really is.  In this article is an astonishing, yet bluntly open, account of why Saudi Arabia are introducing biometrics in schools, explaining below the exact reasons for biometrics and CCTV.  Surveillance.  It is a "form of supervision", to" install a sense of discipline", to "track children", to make them "respect regulations" and gain "better productivity".  At least there is some honesty here, more than we have had from the biometric industry and government on this issue in the US and UK for the past decade.

Kevin Townsend, original founder of ITsecurity.com, puts it most succinctly in his March 2014 article - Why we must keep biometrics out of schools - definitely worth a read.