Updates coming... new developments

Since I started this blog over 10 years ago the state of surveillance, monitoring and application of biometric technology used in schools on our children, the next generation, has increased beyond imagination.  Okay, there may be arguments that his 'improves' their education, enables better educational analysis, reduce admin time/costs, etc... but personally, I've not seen a dramatic increase in the next generations intellectual ability or schools being more affluent because of technology.  Certainly here in the UK we currently have a national funding crisis in education. 

Credit: https://www.pinterest.co.uk
/pin/68539225552401806/

It is a different education that is needed for today's kids.  Access to information is greater to an individual than ever before.  Knowing and retaining information in this age maybe is not a necessity as much as it was.  Moreover how to apply that knowledge in this ever changing society perhaps is a skill children should learn.  Discernment, where one's digital footprint is left and the data left again one's digital identity should also be considered.  How, who and what may be assumed by a children's online activities on the Internet - and within a school network - is a burgeoning area that needs urgent consideration, especially for those it could potentially affect in decades to come. 

With governments, private education tech companies and private companies running schools having access to individual educational data from the age of 2 years old (in the UK) to 19 and beyond gives an enormous potential for profiling.  I could write about this for an age, as these are all points that have been raised with the proliferation of technology in education for the past decade plus.

What to do?  I have been absent somewhat from blogging here as the transfer of biometric technology tested used on children in the UK has now widened into the rest of society.  My concern is when the state uses biometric technology without consent, much as schools did from 2001 - 2013 in the UK.  I set up a sister blog a couple of years ago to keep the two developments of biometric technology, schools / wider society, separate - see my State of Surveillance website.

However, there is now an issue of facial recognition creeping into US and Chinese schools for a variety of reasons.  Here in England and Wales (not Scotland or Northern Ireland) facial recognition is not viably an option for schools with under 18 year olds, as per the consent required under the Protection of Freedoms Act 2012.   The argument for the use of biometrics in schools - whether  fingerprint or facial recognition - is basically unproven, as other, less invasive, less 'valuable', means of identification will suffice.   This is an issue I intend to raise again here.

So, hopefully, (in a rather large nutshell) I've explained my absence and fully intend at least once a week to start again back here.   T'will be nice to get back to it!

Updated Advice for schools on using pupil's Biometrics

Last Month the Department for Education issued an updated advice for schools taking and processing students biometric data.

This useful advice is also a 'must' read for students and parents so they are fully aware of their rights of access to services should they choose NOT to participate in a biometric system.

A recent survey, carried out by DefendDigitalMe, revealed that:

"Over a third (38%) [of parents] of those who said their child’s school uses biometric technology said they were not offered a choice of whether to use this system or not and 50% have not been informed how long the fingerprints or other biometric data are retained for, or when they will be destroyed — despite the Protection of Freedoms Act 2012 requiring parental consent, and an alternative to be on offer, showing that practical guidance is needed to help schools understand how to implement the legislation."

This shows that there is still clearly a lack of understanding by schools of their legislative obligations to parents and students with regards to biometric data storage, processing and their consent.

Please do have a read of the above advice, any of the information here and make an informed choice about your/your children's biometric data.

Who exactly supplies schools with biometric databases?

Think again when you are told that school biometric systems cannot exchange information or be compatible with other databases or that no one else has access to your child's biometric data. 

Northrop Grunman, a leading global security company that runs the UK Police fingerprint and DNA database and "works with governments, the Armed Forces, civil agencies and private sector companies around the world" also supplies biometric systems for children in schools. 

"AD&S provides biometric machines for companies ranging from defense contractors like Northrop Grumman Corp. to a small Atlanta airliner to more than 40 schools districts."  Mississippi Business Journal 14 June 2013

It is of no matter that this story comes from the US. Our UK government has no idea of the biometric technology used in UK schools, how secure it is or who supplies it. No checks are carried out at all, we know this through Freedom of Information requests.

So when you are asked for written consent for a school to store and process your child's fingerprint identifier (this becomes law in September 2013 in the UK) just bear in mind what you are giving up and to whom you may giving it to.  

Oh yes, we do have a Data Protection Act but we also have a situation where potentially police may have access to your child's biometric data too in UK schools - without parents knowledge.  There are protocols to follow I'm sure but here in the UK we do not have a great track record on storing data we do not need and then being fair in destroying it.  We only have to look at the UK Police National DNA database IDENT1 for that. 

"The DNA of thousands of innocent children is being taken by police and stored on the national database, campaigners say on Monday, citing new figures.  Police have taken the DNA of 120,000 children in the last two years" The Guardian 20th May 2013

Parental consent now a legal requirement in UK

In May 2012 the Protection of Freedoms Act was given Royal Assent and passed into law in the UK.  Chapter 2 of the Act, clauses 26-28, deals with consent when processing a child's biometric data:

Chapter 2 Protection of biometric information of children in schools etc.
26. Requirement to notify and obtain consent before processing biometric information
27 Exceptions and further provision about consent and notification
28. Interpretation

The salient points of the Act are: 

• Each parent of the child should be notified by the relevant authority that they are planning to process their child's biometrics and notified that they are able to object.  
• In order for a school to process children's biometrics at least one parent must consent and no parent has withdrawn consent. This needs to be in writing.
• The child can object to the processing of their biometrics regardless of parents consent.
• The child is under 18 years old.

The requirement for parental consent as defined in this Act becomes enforceable In September 2013.

The UK is the first country in the world to address the issues of informing parents and requiring their consent when their children’s biometrics are being taken, stored and processed by a school or any such institution.

Further scrutiny will be needed to see how enforceable this law is and how 'informed' parental consent is.  Informed consent is a complex issue.  If the biometric vendor, as the sole supplier of information via the school to the parent, is the sole source of information that the school gives to the parent, fully informed consent could be questionable.

It is interesting to note that not one academic, educationalist, industry developer have given their support for children using biometrics, in fact many experts have have voiced their concerns.  Only biometric vendors and schools seems to think biometrics use without parental consent with children is acceptable.  I know whose advice I'd take.

It's a good job that if parents Google "Biometrics in Schools" then this blog appears on Google's first results page.  Parents should also check out the Leave them Kids Alone website.

Children's Biometrics in the House of Lords

The Protection of Freedoms Bill had it's second reading in the House of Lords last week and some peers spoke in a positive manner about gaining consent of parents before schools take and process children's biometrics.

Lord Henley -

"it is right that parents should be asked to make an informed decision about whether to accede to the processing of such information. It is also proper that pupils should have a say."

The Lord Bishop of Bristol -

"I back the protection of biometric information on children in schools, with parental consent being required for processing information"

Lord Kennedy of Southwark -

 "Proposals regarding the express parental consent for the use of children's fingerprints are welcome"

The Association of School and College Leaders (ASCL) tweeted that "Pleased to see Lord Lucas supporting ASCL's objections to restricting biometrics in schools in yday's Lord's debate. http://t.co/TlxwoxxR"

As the ASCL rightly state there was one peer, Lord Lucas, who indeed spoke of the section on biometrics in school as a "daffy overreaction".  (daffy?)  Lord Lucas also commented that biometrics in schools...

"...have great benefits. They improve safety. They improve privacy. They greatly improve efficiency."

If biometrics in schools do have such above beneficial effects what has the ASCL or Lord Lucas to be frightened about gaining parental consent.  Surely given the above claims, parents should willingly embrace this technology and thereby give consent.  Schools gain consent for all manner of activities, it is a process they are familiar with.

I would be interested to see validation of Lord Lucas's claims.  Claims that remind me of the previous Labour Government waffle justifying using childrens biometrics in schools for mundane tasks, and of course, claims made by companies selling access, registration and security systems to schools.

Protection of Freedoms Bill: Committee Stage Report Bill

The Protection of Freedom Bill Research paper RP11/54 after discussion in the House of Commons:

"Biometric information - The provisions on the protection of biometric information in relation to children were not amended in Public Bill Committee. Several amendments were discussed but none was successful. Members probed the Government on issues relating to parental consent and safeguards on the use and retention of children’s biometric data. While supporting the principle of consulting parents, the Opposition was concerned about schools being able to manage their affairs effectively."

Okay to fingerprint kids - but teachers won't use biometrics

Unbelievable!  Headteachers moaning about gaining parental consent for processing childrens biometrics in schools when their own teachers won't use biometrics because teachers "consider giving fingerprints as an infringement of their civil liberties" ......Oh? So that's one rule for the kids and another rule for the teachers?

Headteachers have been glittered by the biometric sales industry, spent millions of pounds of our taxpayers money on biometric systems and have been glibly fingerprinting and processing our children biometrics, quite often without parents even knowing about it.  All the Freedom Bill is doing is requiring Headteachers to take responsibility for their decisions to use this technology with children.

MP Jim Shannon in the House of Commons debate on this issue on March 1st, makes the point that it is "clear that parents must and should have a complete veto on the collection and storage of their children's genetic make-up"

And the Government's take on the financial impact is that it is "likely to have some financial impact on schools (administration and provision of alternative systems), however this is balanced against the non-financial benefit of protecting the civil liberties of children in schools and colleges"

Hear, hear - and what Headteacher would want to compromise the civil liberties of children in their care?

Freedom Bill

Thursday 13 January 2011 - Children Fingerprinting

Question - Asked by Lord Taylor of Warwick (Lords Hansard text from 13th Jan 2011)

To ask Her Majesty's Government whether they will end the compulsory fingerprinting of children at school without parental permission.[HL5389]

The Parliamentary Under-Secretary of State for Schools (Lord Hill of Oareford): The Government intend to introduce legislation in the Freedom Bill to ensure that no children's biometric data are taken in schools or colleges without parental permission.

Hansard Link here: http://www.publications.parliament.uk/pa/ld201011/ldhansrd/text/110113w0001.htm#11011367000056

Misinformation and no consent - still!

Again and again the same old cr*p is spouted by schools to parents about it's not a fingerprint that's taken so don't worry.

Obviously they have not done their research and believe whatever spiel the biometric sales persons are giving them. Here's what Education Bradford say about Junior Librarian, which according to them, is recommended by the Department for Children, Schools and Families.

"Publicity material from the manufacturers states: "No image of the fingerprint itself is ever stored and the unique number that is generated during registration can never be used to recreate an image of the original scan.""

These biometric readers have not been scrutinized by the government, as Jim Knight MP admits himself, or any independent experts here in the UK [unless any of the biometric vendors can inform otherwise or offer a system for scrutiny] - however the above statement, by Junior Librarian, can be challenged as US universities have reverse engineered fingerprints from such systems.

Along the line somewhere the complete truth isn't being aired.

On top of the misinformation given to parents, and despite advice from the government and the Information Commissioner on the practice of using biometric technology with children, schools are still taking biometric fingerprints from children without informing parents.

Parents, in Keithley, when the school had taken childrens biometric fingerprints without consent were concerned enough to contact the police and Ofsted.

Little Lever School, Bolton and Long Lee School, Keithley are the recent culprits have committed the two offences of giving misleading information and not consulting parents.

So the recent government advice is working well then...

Wanted - Smith and Browns Fingerprints

Just caught this on the Privacy International site - fingerprints of Smith and Brown "wanted".

It reads:

GUILTY of reckless endangerment of our personal security by storing our fingerprints on a central ID database and risking another catastrophic data breach.

GUILTY of willful intent to undermine our right to own and control our biometrics.

etc, etc...

The fingerprints of Wolfgang Schauble, Germany's interior minister, who believes strongly in the collection of "citizens' unique physical characteristics as a means of preventing terrorism" has already been got. Look out Smith and Brown.

What's good for the goose is good for the gander surely...

Jim Knight - what does he actually do??

With amazing consistency Jim Knight ducks and dives out of all responsibilty for his department to take stock of the fingerprinting of children in UK schools.

I'm wondering what he actually does in his role as Minister of State for Schools and Learners,(DfCSF) ?

Annette Brooke [LibDem]: To ask the Secretary of State for Children, Schools and Families if he will commission a review of the academic literature on the reversibility of biometric templates to recreate fingerprints.

Jim Knight: The Department has no plans to commission a review of the academic literature on the reversibility of biometric templates to recreate fingerprints. Becta is responsible for monitoring this and other aspects of technology in schools and will take appropriate action as it considers necessary. Becta published guidance on the use of biometric technology in July 2007.

Annette Brooke [LibDem]: To ask the Secretary of State for Children, Schools and Families if he will commission an independent assessment of the security of biometric systems used in schools (a) in libraries, (b) in canteens and (c) for registration.

Jim Knight: The Department has no plans to commission an assessment of the security systems used in schools (a) in libraries, (b) in canteens and (c) for registration. Becta is responsible for monitoring this and other aspects of technology in schools and will take appropriate action as it considers necessary. Becta published guidance on the use of biometric technology in July 2007.

Bob Spink [Cons]: To ask the Secretary of State for Children, Schools and Families how many schools in Essex fingerprint pupils; and if he will make a statement.

Jim Knight: The Department is not aware of any schools in Essex which fingerprint pupils. Some schools may use biometric technology systems involving the recording of some fingerprint characteristics. The Department does not routinely keep records of such schools since the decision to introduce biometric technology is for each school to make.

Stop Fingerprinting children in schools? at Prime Minister's Questions but no Prime Ministers Answers, unsurprisingly...

Prime Minister's Questions - Wednesday 6th Feb 2007

The 100% complete dodging round the issue of fingerprint systems in school by the PM yesterday is self explanitory below.

Mr. Nick Clegg (Sheffield, Hallam) (LD): This week’s bugging controversy should not come as a surprise to the Prime Minister. After all, it is this Government who have turned the British public into the most spied upon on the planet: 1,000 surveillance requests every day; 1 million innocent people on the Government’s DNA database; and 5,000 schools now fingerprinting our children at school. Is that what the Prime Minister meant when he spoke so stirringly a few months ago about the great British tradition of liberty?

The Prime Minister: I take it that the right hon. Gentleman and the Liberal authorities support CCTV. I take it that they support the intercept action that is taken when it is necessary for national security. I take it that he accepts that only 1,500 intercepts have been commissioned by Ministers as a result of urgent security needs. Does he accept these things or not?

Mr. Clegg: The Prime Minister seems to see no limits. He is creating a surveillance state. Why has he consistently refused requests for more power to be given to the Information Commissioner? Why does he not do what is already done in Scotland and remove the DNA of innocent people from the database? Why will he not act immediately to stop the scandalous fingerprinting of our children at school?

The Prime Minister: People in this country are reassured by the presence of CCTV; I hope that the right hon. Gentleman is not proposing to remove it. That is one very important part of the investigatory and surveillance powers that we give the police to carry out their work. I would hope that the right hon. Gentleman would look at the Regulation of Investigatory Powers Act 2000 and see the protections that have been put in place where there is surveillance and where there are intercepts. They include authorisation by a senior officer, the right to appeal to an independent tribunal, and a commissioner for surveillance who looks at matters and reports annually. We are taking the steps to protect the liberties of the citizens; I hope that the right hon. Gentleman will support that.

Biometric industry see BECTA's guidance as a "green light"

Apparently industry welcomes "the findings of BECTA’s new report entitled Guidance on Biometrics in Schools , which highlighted the positive role biometric technology can play in reducing bullying, theft, truancy and costs in schools."

Really? Reducing bullying, theft and costs? There is no evidence to support this in the public domain.

One biometric vendor states “BECTA’s report effectively provides the green light to continue the roll out of Biometric solutions in schools. The report makes a clear statement that fingerprints cannot be recreated from the string of numbers stored in the database..."

So whilst parents, human rights groups and concerned Members of Parliament are not happy about the BECTA guidance the industry have taken it as a "green light". The parent consultation touched on in the document is simply NOT happening and the notion that BECTA, the DCSF (DfES) and Labour Education Dept hold on to that fingerprints cannot be reconstructed is simply incorrect.

What are we actually paying these people for?

A simple Google of "reconstructing fingerprints" bring up papers that have been written on this or blogs (moi, listed no.3!) that can point civil servants and politicians in the general direction on this subject. It's not rocket science.

It is apparent that there is a concerning lack of research in BECTA's "guidance" which appears to have unsubstantiated claims and inaccurate statements in. Is it right for this to be the basis of an industry that is able to legally take biometric data from children as young a 4 without consulting parents?

The people that this report should have advantaged - our children in schools.

The people this reports advantages - biometric companies supplying to schools.

UK world famous for sneakily fingerprinting chlidren in schools

It's nice to know that here in the UK we are world famous for something - schools fingerprinting children without parents knowledge.

The US and now Australia are hot on our heels though, but with only 2 companies here in the UK in 2005, to over 20 companies now selling biometric systems to schools (bought by our taxes) for food, books, registration, access, cash registers, vending machines - that's some growth in the market.

This is not about the security of pupils dinner money and stolen library books. It is simply about hard cash and profit for the biometric market by fingerprinting children in school as young as 4 without parents even being aware. Adults in the UK do not use biometric systems on the scale that it is used in schools.

The Dubai XPress has this article.

"The so-called "child-tracking" scheme has been lamented by parents who argue that school authorities should take prior permission and an "acceptance note" to fingerprint their child because the data collected from children under the age of 12 without parental consent contravenes the Data Protection Act 1998.

The Labour Government, who wants to go ahead with a national ID plan also faces a backlash from nearly 85 members of parliament who differ on this monitoring practice. Though the government rests its case on defending the method with the sole purpose of social security and thwarting child abuse, civil liberties groups call it an act of violation of privacy."

Reconstructing fingerprint images from templates

This is for everyone who thinks fingerprints cannot be reverse engineered from biometric systems, and especially for Jim Knight MP, the Labour Minister for Schools and Learners, who offered up the below incorrect information in a parliamentary debate in July this year with Greg Mulholland MP:

"Secondly, as I stated earlier, it is not possible to recreate a fingerprint using the numbers that are stored. The algorithm generates a unique number, producing no information of any use to identity thieves. I shall quote from a statement from the Information Commissioner’s Office—a thoroughly independent source—that says in the third paragraph:

“Full fingerprint images are not stored and cannot be generated (‘reverse engineered’) from the template.”

I hope that that is clear to all those listening, because it is an important reassurance on the points that the hon. Gentleman has made." ...absolutely crystal Jim.


1. Original fingerprint scan

2. Stored fingerprint template

3. Print reconstructed from template

From:
From Template to Image: Reconstructing
Fingerprints from Minutiae Points

Arun Ross, Member, IEEE, Jidnya Shah, and Anil K. Jain, Fellow, IEEE

April 2007

(as shown on the Leave Them Kids Alone site)

Reverse-engineering digital fingerprints

One important point, that has been reiterated time and time again by biometric vendors, Jim Knight and the ICO, is that the biometric systems in schools cannot reverse-engineer a fingerprint.

This does not seem to be the case according to Kim Cameron's recent weblog, Architect of Identity and Access in the Connected Systems Division at Microsoft, entitled "Paper argues biometric templates can be reversed". It shows that reverse-engineering a digital fingerprint may just be possible. He cites this paper "Can images be generated from biometric templates" by Andy Adler, University of Ottawa, 2003.

Also see these Research discussions at West Virginia University from 2005 "We show that minutiae information can reveal substantial details such as the orientation field and the class of the associated fingerprint that can potentially be used to reconstruct the original fingerprint image."

Both of these papers are not too recent and since then one would presume that the technologies in this field have advanced.

However, even thought the possible reconstruction of a fingerprint seems relevant to the argument of biometric technology in schools, ownership and possible 'loss' of ones digital fingerprint is still very relevant... who has access to it, the systems it is on, how it can be used (or abused). These are the points that should be seriously considered by children (and parents) as they unwittingly give up their biometric data for systems in schools which are non essential for purchasing food or accessing library books.

UK non statutory guidelines issued....

Non statutory (non legally binding) guidelines were issued yesterday by the British Educational Communications and Technology Agency, BECTA, regarding biometrics in schools, nicely coinciding with the House of Commons Adjournment debate on the subject.

'Guidence on the use of Biometric systems in schools' from BECTA and 'The use of biometrics in schools' came from the Information Commissioner's office, ICO, yesterday.

Balanced points of view are required to make informed judgements.

From the BECTA advice: 6 ...Schools should also reassure parents and pupils that they will not pass the data on to any third parties.

But are parents and pupils aware that the UK Police can access school biometric databases without parental permission if a crime can be solved? See Q50 and Q51 and subsequent answers from David Smith, the Deputy Information Commissioner, at the House of Common Home Affairs Committee "A SURVEILLANCE SOCIETY?" (May 2007).

Police "fingerprint" databases are not just ink fingerprints on sheets of paper with people peering at them with magnifying glasses when a crime needs to be solved - Police now use algorithmic fingerprint databases (Automated Fingerprint Identification Systems - AFIS) as detailed in the above mentioned ICO document third paragraph, just like the ones used in schools. These algorithms, via M1, can be interchangeable between differing systems.

Quote from the front page of the ICO advice: "Fingerprints are not essential to the applications but unlike swipe cards they cannot be lost"

This from a primary school using thumb scans (top right, second column): "The only issues we’ve had have been caused by us changing our hardware and a burglary when our main computer was stolen. [The biometric provider] helped us to resolve them all," (Perhaps biometric data was 'lost' here?)

Non legal advice - nothing resolved.

House of Commons Adjournment Debate

There was a House of Commons Adjournment debate Monday 23rd July with Greg Mulholland, Lib Dem Shadow Education Spokesperson, leading the debate and Jim Knight, Labour Minister from the Department of children, schools and families, answering.

At long last debate time in parliament has been given over to the taking of children's biometric data without parental consent.

The debate can been seen here, it is the last item to be debated and can be found at 06.35.25 on the slider.

Luckily for Jim Knight, in order to answer Greg Mulhollands points and not to loose face, he had to have some advice from the ICO and BECTA - well and what do you know... after nearly a year of waiting for advice, the long awaited guidance from BECTA and the ICO just happened to be issued today.

Phew that was lucky for Jim Knight - what were the odds against that then?!!

Guidelines arriving "shortly"

Jim Knight responded yesterday, in the Dept of Education's usual true concise manner in this matter, to a very simple question put to him by Sarah Teather, Lib Dem MP Shadow Education Secretary, regarding the use of fingerprint technology in schools:

From Handsard June 4th 2007

Sarah Teather: To ask the Secretary of State for Education and Skills when he expects to publish guidance to schools on the use of biometric technologies.

Jim Knight: The Department aims to publish guidance to schools on the use of biometric technologies shortly.

This to me doesn't look like a factual answer - not the type of answer that would get brownie points in a SATs test.

Anyway, to try to understand a School Minister's speak let us refer to Rogets Thesaurus, no doubt used in Jim Knights Deptartment's schools nationwide. So, Rogets Thesaurus's definition for "shortly" is "right away".

All this said, when the guidelines are issued they are not statutory and unfortunately schools do not need to heed or read them.

Guidelines for schools elusive

This from The Sun : "Last night [June 3rd 2007] Schools Minister Jim Knight agreed to draw up strict guidelines"

He also agreed to this in February this year, from Hansard 5 Feb 2007:

Jim Knight: "The Department is working with the British Educational Communications and Technology Agency which is revising its current guidance on data protection to include specific guidance on biometric technology. Becta aims to make the guidance available on its website by the end of March 2007 after consultation with the Office of the Information Commissioner."


So the Department of Education has been working on guidelines since February, delayed publication to March, then May and still Jim Knight is working on guidelines......mmm, there are a number of possibilities here:

1. Either the guidelines are going to be issued in the form of a trilogy, due to length of time taken to write, and will appear not just on BECTA's website but also on Amazon.

2. There are no guidelines being written.

3. There were guidelines but Jim Knight's dog chewed them up, honest.

4. It's a legal nightmare and the Department of Education, the ICO and BECTA are simply not issuing them yet due to legal complications.