Updates coming... new developments

Since I started this blog over 10 years ago the state of surveillance, monitoring and application of biometric technology used in schools on our children, the next generation, has increased beyond imagination.  Okay, there may be arguments that his 'improves' their education, enables better educational analysis, reduce admin time/costs, etc... but personally, I've not seen a dramatic increase in the next generations intellectual ability or schools being more affluent because of technology.  Certainly here in the UK we currently have a national funding crisis in education. 

Credit: https://www.pinterest.co.uk
/pin/68539225552401806/

It is a different education that is needed for today's kids.  Access to information is greater to an individual than ever before.  Knowing and retaining information in this age maybe is not a necessity as much as it was.  Moreover how to apply that knowledge in this ever changing society perhaps is a skill children should learn.  Discernment, where one's digital footprint is left and the data left again one's digital identity should also be considered.  How, who and what may be assumed by a children's online activities on the Internet - and within a school network - is a burgeoning area that needs urgent consideration, especially for those it could potentially affect in decades to come. 

With governments, private education tech companies and private companies running schools having access to individual educational data from the age of 2 years old (in the UK) to 19 and beyond gives an enormous potential for profiling.  I could write about this for an age, as these are all points that have been raised with the proliferation of technology in education for the past decade plus.

What to do?  I have been absent somewhat from blogging here as the transfer of biometric technology tested used on children in the UK has now widened into the rest of society.  My concern is when the state uses biometric technology without consent, much as schools did from 2001 - 2013 in the UK.  I set up a sister blog a couple of years ago to keep the two developments of biometric technology, schools / wider society, separate - see my State of Surveillance website.

However, there is now an issue of facial recognition creeping into US and Chinese schools for a variety of reasons.  Here in England and Wales (not Scotland or Northern Ireland) facial recognition is not viably an option for schools with under 18 year olds, as per the consent required under the Protection of Freedoms Act 2012.   The argument for the use of biometrics in schools - whether  fingerprint or facial recognition - is basically unproven, as other, less invasive, less 'valuable', means of identification will suffice.   This is an issue I intend to raise again here.

So, hopefully, (in a rather large nutshell) I've explained my absence and fully intend at least once a week to start again back here.   T'will be nice to get back to it!

Updated Advice for schools on using pupil's Biometrics

Last Month the Department for Education issued an updated advice for schools taking and processing students biometric data.

This useful advice is also a 'must' read for students and parents so they are fully aware of their rights of access to services should they choose NOT to participate in a biometric system.

A recent survey, carried out by DefendDigitalMe, revealed that:

"Over a third (38%) [of parents] of those who said their child’s school uses biometric technology said they were not offered a choice of whether to use this system or not and 50% have not been informed how long the fingerprints or other biometric data are retained for, or when they will be destroyed — despite the Protection of Freedoms Act 2012 requiring parental consent, and an alternative to be on offer, showing that practical guidance is needed to help schools understand how to implement the legislation."

This shows that there is still clearly a lack of understanding by schools of their legislative obligations to parents and students with regards to biometric data storage, processing and their consent.

Please do have a read of the above advice, any of the information here and make an informed choice about your/your children's biometric data.

Are parental concerns with fingerprint biometrics 'techno panic'

Photo courtesy of Berkshireeagle.com

As North Adams School in Massachusetts plans to use fingerprint biometrics to improve lunch line efficiency, some parents are understandably concerned about how using a biometric system erodes their children's privacy.  Most of the articles on North Adams School adopting biometrics seek to reassure parents and readers that its not a database of fingerprints but just a number string.  The reality is that that number string is the biometric identifier derived from the fingerprint and that personal biometric, digital identifier is capable of being transferred across databases.

Here in the UK personal biometric identification used in schools has the potential to be accessed by the UK Police or other agencies, without the knowledge of the child or the parent.  I'm not sure if this is also the case in Massachusetts but it would be a question I would ask if I were a parent there.

In a FindBiometrics article "Massachusetts Lunch Lines Go Biometric Despite Parental Concerns" they state that:

"The parental outrage revolves around worries that the biometric templates used to authorize the buying of food will lead to the storage of a child’s physical characteristics. This is a common fear in large scale deployments of biometric technology, but in this case it doesn’t hold up. identiMetrics fingerprint scanners don’t store full fingerprints"

Erm... it does store a child's physical characteristics in a digital format, otherwise it wouldn't be a biometric system.

The article then goes on to quote the International Biometrics and Identification Association calling the recent ban of biometrics in schools in Florida as "techno panic". Well I guess they would.  The industry have business to loose if all states decided to ban the unproportionate use of biometric technology for a faster moving lunch line or improved credit control.

Also with four other schools in the area rolling out biometrics the iBerkshire.com reports that:

"Parents are informed of how the technology works and to give them the option not to participate — both of which North Adams as done, although some parents are saying they should have been asked permission first, not after the fact."

This inadequate version of somehow gaining assumed consent from parents, and those that do not consent by having to opt out, failed miserably here in the UK.  As a consequence legislation was brought in to gain clear, informed consent from both parents, also if the child does not consent this overrides the parent's consent.  This legislation, contained in the Protection of Freedoms Act 2012, was brought about after privacy groups and parents lobbied parliament from 2006-2010 with the law being applicable from September 2013.

And yes, biometric authentication can be used to track your child.  A child's digital transactions can build up a highly personal profile in school of what they eat, read, attendance, movement around a campus, revealing a very personal footprint of how a child's life is lead in the education system.  Any system is able to do this I suppose, like a swipe card or pin, but because a child's biometrics are easier to use, i.e. you can't loose a finger, this type of authenticating seems the simplest most efficient option for schools, employing the technology for a whole range of purposes.  Put plainly, it is profiling - but at what cost to the child's privacy?

Children today will, in all probability, need to authenticate themselves biometrically in future for travel (as we do now) banking, access to state benefits, pension, purchasing food and national ID.  This is happening in other countries.

A child's biometric identity needs absolutely not be compromised.  The only way to do this it to limit a child's exposure to the technology - not to participate in such biometric systems for mundane purposes in schools.

Defiant 13 year old - "stand up for what they believe in, even if it means standing alone"

Melody, 13, protesting the
 United Kingdom's policy of
 obtaining biometric data
 from minors at school.
Photo: Kirstie

After reading about a 13 year old's plucky stance objecting to her school using a biometric fingerprint system last week, by wearing an Anonymous Mask, it gave me some hope that having a choice in this matter is filtering through to children.  Children that do not want to be part of a biometric system ultimately have the last say on this - if they do not want to participate their decision overrides consent given by their parents (though in this case the parent did not consent).

The school involved in this, should have made clear to the students that they have a choice in this.  The Department of Education's template letter for schools to send to parents states:

'Even if you have consented, your child can object or refuse at any time to their biometric information being taken/used. [His/her] objection does not need to be in writing. We would appreciate it if you could discuss this with your child and explain to them that they can object to this if they wish.'

Not knowing the name of the school Melody attends, the student who objected, I am not able to ask the school or check their website, to see if they made this fact known to students or their parents.  Maybe they didn't judging by Melody's comments to the Digital Journal. 

"Many didn't want their fingerprints taken, but on the day when the fingerprinting was to take place, there was only me and a friend. And she has now had her fingerprints taken."

The next statement made by Melody is quite concerning:

"The dinner lady got my finger and tried to move it onto the scanner even while I was wearing my mask, I had already explained I'm not doing it and didn't have my mum's consent [to be fingerprinted]. I just pulled my hand away and refused again."

Really?  Isn't that assault, an adult trying to move a child's finger onto a scanner when they have already expressed their legal right to refuse?  This is highly irregular and indicates the staff have no idea of the child's rights in law as contained in the Protection of Freedoms Act 2012, Chapter 2, 26 (5) which reads:

But if, at any time, the child— 

(a) refuses to participate in, or continue to participate in, anything that involves the processing of the child’s biometric information, or 

(b) otherwise objects to the processing of that information,  

the relevant authority must ensure that the information is not processed, irrespective of any consent given by a parent of the child under subsection 

Good for Melody that she held out from this intimidation.  She knows her rights and that of her parents and is exercising them.  If only more children had this conviction maybe biometric technology would not be viable in schools.  As it seems that schools are not telling students they have this right, then in a compliant environment which school is, students are going to feel compelled to conform and give up their biometric identifier if they do not know they have the right to say 'no'.  As Melody's Mum stated in the Digital Journal's article, "You can either be part of the solution or remain part of the problem".   Parents can be "part of the solution" and not consent to this and so can the students - if they are given that choice by the knowledge they too can refuse.

Let's hope the message Melody sends out by her opting out inspires other children to do the same.

When Melody was asked what do you think will happen next and a message to give, she replied:

"In all honesty, I don't know. But I hope my actions have encouraged my generation to stand up for what they believe in, even if it means standing alone... We shouldn't be scared of giving our opinion or not following the rules."

Words of wisdom and strength of heart coming from a 13 year old.  We should take stock of what this teenager is saying here.  There is incidious surveillance creeping into schools which is slowly desensitising the next generation into a Big Brother state, so it is heartening to see that Melody has refused to use by wearing an Anonymous mask conveying her opinion on "taking children's privacy away." 

Blacon High School - prompt? transparent?

After an unanswered Freedom of Information request from the 13th February earlier this year Blacon High School advised today that an internal review of their failure to comply with the Freedom of Information Act 2000 is due back 25th April.  They are taking the maximum time to respond allowed under the law.

Advice from the Information Commissioners's Office (ICO) with regards to responding to a Freedom of Information request -"Your main obligation under the Act is to respond to requests promptly, with a time limit acting as the longest time you can take."

13 February until 25 April... prompt?  Blacon High School didn't even respond to the initial Freedom of Information request and do not have a Freedom of Information Publication scheme on their website.

Advice from the ICO, "The publication scheme covers information you have already decided you can give out. People should be able to access this information directly on the web, or receive it promptly and automatically whenever they ask."  - One has been asked for.

Also from ICO "The Act is designed to increase transparency. Members of the public should be able to routinely access information that is in the public interest and is safe to disclose."

Mmm... transparent and being "able to routinely access information"  has certainly not been the experience with this Freedom of Information request. 

'No choice' biometrics? Only up to 31st August 2013

Haberdashers' Aske's Boys School

As reported in the Mail, it seems the modus operandi remains the same in private schools as it does in state schools. Give parents less than a week to 'opt out' of their child's biometric fingerprint data being taken, in this case 4 days, then fingerprint the kids.  

Parents do not always get emails, letters or even think to look at the schools website or even expect the school to assume consent in order for a parent to withdraw consent and in this case one pupil said that his parent had "zero idea" and that the school had given the pupils "no choice" to have 'their fingerprints taken'.

Schools do not assume consent for school trips or photographs being taken of children. Why then assume parents have already consented for the school to take, store and process a child's biometric data?  Surely schools should know that, in less than 6 months, this contentious issue of consent is becoming enforceable law in September 2013.

That's not cricket Haberdashers' Aske's Boys School is it now?

Very sensible advice from a parent whose son attends the school:  "The Times has reported that Paul Jessop, who has a son at the school, said:

'The use of biometrics can be very convenient but it relies on the security of the systems used. Without real assurances about this security, I could not recommend that any parent allow their child’s fingerprints to be used for something as trivial as paying for lunch.'

Wise words indeed and a statement that has been reiterated by Microsoft's Kim Cameron below.  Other parents may want to seriously consider Paul Jessop's above words of advice as the following experts and academics have all expressed concerns about children's biometrics being used in schools.  
_______________________________________

Kim Cameron (Microsoft's Chief Architect of Access) has been blogging some more on this issue about the minutes of a school board meeting in Florida... here.
Kim Cameron has this to say:

"It drives me nuts that people can just open their mouths and say anything they want about biometrics... without any regard for the facts. There should really be fines for this type of thing - rather like we have for people who pretend they're a brain surgeon and then cut peoples' heads open."
http://pippaking.blogspot.co.uk/2007/05/kim-cameron-microsoft-has-been-blogging.html
_______________________________________

This post here from him (Kim Cameron) states: 

"The more I learn from Alex Stoianov about the advantages of Biometric Encryption, the more I understand how dangerous the use of conventional biometric templates really is. I had not understood that the templates were a reliable unique identifier reusable across databases and even across template schemes without a fresh biometric sample. 

People have to be stark, raving mad to use conventional biometrics to improve the efficiency of a children’s lunch line."

When this comes from Kim Cameron, alarm bells should be ringing loud and clear for those schools using this technology and for apathetic government departments letting this go ahead completely unregulated.
http://pippaking.blogspot.co.uk/2007/04/people-have-to-be-stark-raving-mad-to.html
_______________________________________

Fred Bellamy, a Phoenix Attorney who specializes in Technology Law went on to say that "fingerprinting children is an invasion of privacy".

“Once the data are captured no matter what kind of promises the vendor may make there is a serious risk, and I think the parents have every reason to be concerned about how this data will ultimately be used.” 
http://pippaking.blogspot.co.uk/2008/01/in-and-out.html
_______________________________________

"Head teacher Gillian James said in an explanatory letter to parents that the system would store a number based on a fingerprint reading. No fingerprint images would be stored". - Not exactly true, what is stored is an fingerprint algorithmic 'image' that our UK police can access and use without parents and pupils knowledge (Deputy Information Commissioner Q50 & Q51). 

I wish teachers would stop spouting the vendors and the governments "It's not a fingerprint...." speil and educate themselves.
http://pippaking.blogspot.co.uk/2007/10/technology-for-technologys-sake.html
_______________________________________
Experts and academics that have voiced concerns about biometric technology in schools:

Kim Cameron, Microsoft's Identity Architect
Andrew Clymer, senior identity management security expert (more than 8 years at Cisco Systems, working with Visa, Fidelity, Merrill Lynch, etc - providing them with a secure network environment)
Paul Squires, Identity Solutions Architect at Enline plc
Bruce Schneier, a respected US writer and lecturer on issues surrounding security and privacy, who has testified before Congress and authored eight books and dozens of articles and academic papers.
Ralf Bendrath, privacy, security and internet researcher
Dr Sandra Leaton Gray, Director of Studies, Sociology of Education, Homerton College, Cambridge
Professor Emerita Leone Burton, University of Birmingham, visiting research fellow, Cambridge University
Patricia Deubel, PhD, adjunct faculty member in the graduate School of Education at Capella University
Dr James Atherton, learningandteaching.info
Jon Crowcroft, Marconi Professor of Communications Systems, University of Cambridge
Terrance Boult, University of Colorado
Eugene Schultz, Ph.D., CISM, CISSP, CTO of High Tower Software
David French , 30 plus years in IT, Wellington NZ
Brian Drury, IT security consultant, UK
Brian Honan, independent security consultant based in Dublin, Ireland
Dom Devitto, information Security consultant, UK
Rufus Evison MA (Cantab), senior IT consultant and company director, UK
An unnamed Police Fingerprint Officer (15+ years' experience)
Stephen Groesz, a partner with the law firm Bindmans
The Austrian Supreme Court
The States of Michigan, Illinios and Iowa (so far, others are likely to follow)
Tony Delaney, The Assistant Irish Data Protection Commissioner
Roderick Woo, Justice of the Peace at the Hong Kong Office of the Privacy Commissioner
George Radwanski, Privacy Commissioner of Canada
Ann Cavoukian, The Privacy Commissioner of Ontario
Fred Bellamy, a Phoenix Attorney who specializes in Technology Law
Damian Green MP, Conservative Home Affairs spokesman
The Rt Hon David Davis MP, Conservative Shadow Home Secretary
Nick Gibb MP, Conservative Shadow Minister For Schools
Baroness Carnegy, Conservative
Sarah Teather MP, LibDem Shadow Education Secretary
Greg Mulholland MP, Lib Dem Schools spokesperson
Baroness Walmsley, LibDem
Baroness Howe, Crossbencher
83 other MPs from all parties who have signed Early Day Motion 686 (frontbenchers do not usually sign EDMs)
More than 1500 parents who voted last summer [2006] in an online poll against kiddyprinting without parental consent. 93% opposed fingerprinting without consent. 

http://pippaking.blogspot.co.uk/2007/10/technology-for-technologys-sake.html

Biometrics at Blacon

Blacon High School, West Cheshire, UK, implemented a fingerprint biometric catering system in June last year, 2012.

A letter was sent out Tuesday 12th June telling parents that the system would be going 'live' the following Thursday of the next week, 21st June.  With Blacon High School taking the children's biometrics on Monday 18th June.

That gave parents just 3 - 4 working days to read the letter (we parents do not always read letters the day we get them), do some research into biometrics in schools (which throws up a myriad of issues) and contact the school if they did "not want your child to be included in the system".

Mmmm... a hurried state of affairs here it seems.  Blacon High School's speedy communication in relation to biometric registration is very similar to how other schools have operated.

In most instances of parents contacting this blog and the Leave Them Kids Alone site, this type of hurried biometric implementation has also been experienced.  One could argue that this method allows less time for parental objection, so that a higher, more covert, proportion of pupil biometric take up is ensured.

Certainly in my experience more than 3 working days notice is commonly given for normal school activities, dates to be put in diaries, to allow consent for school trips, food tasting, swimming, collection of monies, vaccinations, sports days, etc.

Not so in this instance.

Understandably some parents and the wider community were shocked at the notion of schools taking, storing and processing their children's biometrics - and at Blacon High School's speedy implementation of the fingerprint biometric system.

This resulted in articles and letters in the local papers with parents contacting political parties for support and accountability.  Parents have taken legal advice, set up a Facebook Group "Refuse to use" and are contacting the wider community to spead awareness and gather support against the biometric system.

Apart from all the privacy and civil liberties issues surrounding children submitting their biometrics for school functions, as this blog has detailed before, the question has to be asked:

Why would a school with 449 pupils (see 6th March  2012 Ofsted Inspection) buy a biometric system in 2012 when come September 2013 all UK schools have to by law, as detailed in the Protection of Freedoms Act 2012, collect one parental signature per child to enable the school to take and process a child's biometrics?

Why is there no mention of the new biometric system on Blacon High School's website or their Data Protection Register entry?  See the Information Commissioner's Office quote about the register "The main purpose of the public register is transparency and openness".

Not only does Blacon High School have to collect one parent's signature in order to collect a child's biometric data but the school has to be seen to make an effort to contact both parents.  In Blacon High School's case 998 parents for the new cashless catering system and the school need to also have in place a duplicate, alternative system for those parents and children who do not consent.

How efficient is that a spend of our UK tax payers monies?  Two systems.  A bad school management decision? Who is accountable?

On a lighter note...

What is betting that Blacon High School give parents more than 3 - 4 working days to give their written consent in order for the school to run their newly purchased biometric system?   If one child's biometric data resides on Blacon High School's biometric system without a signed parental consent form come September 1st 2013, the school will be breaking the law,

I suspect there may be a few eyes watching how Blacon High School complies with the forthcoming enforceable legislation over the coming months.  I think more to come on this.

Parent pressure in Maryland USA scrap school palm scanners

Parent pressure in Carroll, Maryland, has persuaded the school district to scrap controversial palm scanners in 10 schools after parents "said the system violated their children's privacy".

John Whitehead, president of the Rutherford Institute and a constitutional lawyer asked School Superintendent Stephen Guthrie to review using an opt-in process, as Whitehead said "with private information and kids, I much prefer an opt-in" and here in the UK our parliamentarians agree in this.  

This opt-out form of gaining consent was used in the UK and has been much criticized. Opt-in consent enacted into law May 2012 becomes enforceable September 2013.

Stephen Guthrie made this rather surprising statement "We felt the scans fell under normal school process."   Really?  Is it 'normal' for schools to take a child's biometric marker in exchange for food?  Adults do not do that in society so why on earth would it be a "normal school process" to introduce a system, alien to the society outside a school, that normalises such a disproportionate use of biometrics - with children? 

As with all biometric systems sold to teachers, a solution is pitched to speed up lunch lines, streamline operations and cut costs.  Teachers being told it's normal technology to use in schools.  Normal for whom? 

Surely if these teachers in schools actually sat back and really thought about it... really? ...fingerprinting kids for lunch?  Infra-red palm scanning for food?  Is it really worth trading a child's personal biometrics to shave a few dollars off a budget?  

Children have rights, and society's morals, ethics and civil liberties outside school must permeate to within a school too.  Thankfully these parents enabled this to happen.