Reverse-engineering digital fingerprints

One important point, that has been reiterated time and time again by biometric vendors, Jim Knight and the ICO, is that the biometric systems in schools cannot reverse-engineer a fingerprint.

This does not seem to be the case according to Kim Cameron's recent weblog, Architect of Identity and Access in the Connected Systems Division at Microsoft, entitled "Paper argues biometric templates can be reversed". It shows that reverse-engineering a digital fingerprint may just be possible. He cites this paper "Can images be generated from biometric templates" by Andy Adler, University of Ottawa, 2003.

Also see these Research discussions at West Virginia University from 2005 "We show that minutiae information can reveal substantial details such as the orientation field and the class of the associated fingerprint that can potentially be used to reconstruct the original fingerprint image."

Both of these papers are not too recent and since then one would presume that the technologies in this field have advanced.

However, even thought the possible reconstruction of a fingerprint seems relevant to the argument of biometric technology in schools, ownership and possible 'loss' of ones digital fingerprint is still very relevant... who has access to it, the systems it is on, how it can be used (or abused). These are the points that should be seriously considered by children (and parents) as they unwittingly give up their biometric data for systems in schools which are non essential for purchasing food or accessing library books.

UK non statutory guidelines issued....

Non statutory (non legally binding) guidelines were issued yesterday by the British Educational Communications and Technology Agency, BECTA, regarding biometrics in schools, nicely coinciding with the House of Commons Adjournment debate on the subject.

'Guidence on the use of Biometric systems in schools' from BECTA and 'The use of biometrics in schools' came from the Information Commissioner's office, ICO, yesterday.

Balanced points of view are required to make informed judgements.

From the BECTA advice: 6 ...Schools should also reassure parents and pupils that they will not pass the data on to any third parties.

But are parents and pupils aware that the UK Police can access school biometric databases without parental permission if a crime can be solved? See Q50 and Q51 and subsequent answers from David Smith, the Deputy Information Commissioner, at the House of Common Home Affairs Committee "A SURVEILLANCE SOCIETY?" (May 2007).

Police "fingerprint" databases are not just ink fingerprints on sheets of paper with people peering at them with magnifying glasses when a crime needs to be solved - Police now use algorithmic fingerprint databases (Automated Fingerprint Identification Systems - AFIS) as detailed in the above mentioned ICO document third paragraph, just like the ones used in schools. These algorithms, via M1, can be interchangeable between differing systems.

Quote from the front page of the ICO advice: "Fingerprints are not essential to the applications but unlike swipe cards they cannot be lost"

This from a primary school using thumb scans (top right, second column): "The only issues we’ve had have been caused by us changing our hardware and a burglary when our main computer was stolen. [The biometric provider] helped us to resolve them all," (Perhaps biometric data was 'lost' here?)

Non legal advice - nothing resolved.

House of Commons Adjournment Debate

There was a House of Commons Adjournment debate Monday 23rd July with Greg Mulholland, Lib Dem Shadow Education Spokesperson, leading the debate and Jim Knight, Labour Minister from the Department of children, schools and families, answering.

At long last debate time in parliament has been given over to the taking of children's biometric data without parental consent.

The debate can been seen here, it is the last item to be debated and can be found at 06.35.25 on the slider.

Luckily for Jim Knight, in order to answer Greg Mulhollands points and not to loose face, he had to have some advice from the ICO and BECTA - well and what do you know... after nearly a year of waiting for advice, the long awaited guidance from BECTA and the ICO just happened to be issued today.

Phew that was lucky for Jim Knight - what were the odds against that then?!!

Illinios Act, USA, HB 1559

Act HB 1559 in Illinios, USA, regarding biometrics in schools should take effect 1st August 2007.
(If the above link is broken for HB1559 scroll down on the right column to 'Legal/Law' on this blog for the link)

Irish workers refuse to use biometric system

Workers at The Abbey Theatre in Dublin have refused to give up their personal biometric data for a biometric system that "concerns the health and safety of the Abbey’s 100 full-time staff working in the buildings at various times across the course of the morning, day and night."

How can giving up your personal biometric data improve your health and safety working in a theatre? The biometric system is in it's first phase with the second phase being rolled out monitoring time and attendance according to the Sunday Business Post.

If adult workers are not happy with using such systems - why is it used with children without gaining parental permission or even letting parents know?

There are obviously concerns amongst the adult population about the uses of such technology and the level of personal data we as adults wish to give up, yet as a society we are creating a "do as I say not as I do" situation with biometrics in schools and children's privacy rights.

Back on the job!

Not posted for a while, the recent flooding has disrupted our city with a 5th of all homes affected, schools shut, council services not operating to the full, events cancelled then rescheduled... we had 4 inches of water come through out front room ceiling, came in through the outside brick pointing as the guttering didn't cope with the monsoon like rain, buckets and tarpaulin saved the day -
but we got off lightly in comparison to some.

So... back to work!

Schools using biometrics for lunch recently, Kirkley High School in Lowestoft, Norfolk:
“The cashless catering system gives us the ability to influence where they eat and what they eat." said Headteacher, John Clinton

Also Bristol City academy is to scan students' fingerprints to allow them to get their lunch. The £20,000 (!) scheme will be launched at the City Academy - the first to be built in the city - from September.

One parent, Clare Stephenson stated,"I am staggered that no consultation has been made with parents about this and it is being pushed through in time for the new school term,"

Schools have the right to collect biometric data in the UK with out parents permission

Independent Sunday 17th June

"Ministers will issue guidance telling schools they have the right to collect biometric data and install fingerprint scanners."

"It is understood that schools will not have to gain written permission from each parent before their child's fingerprints are taken."

"Schools will be able to place fingerprint scanners at the entrances to classrooms, the school gates and even in cafeterias."

Quite unbelievable. Doesn't the government take world leading experts seriously on this matter? Obviously not. This 'guidance' should make interesting reading when/if it is ever issued.

See the England Expects blog for more comment on this.

Biometric guidance for schools due before end June

This from correspondence received today from the Information Commissioner's Office (ICO):

"I believe the DfES are expecting the Becta guidance to be published before the end of June.

The ICO will be issuing its own statement on the issue at the same time. This will express fairly briefly our view on the use of fingerprint templates in schools."

Father bans schools from fingerpring his child

The Oxford Mail reported last week that Ben Emlyn-Jones, who's 12 year old daughter was to be fingerprinted St Gregory the Great School in Cowley for a library fingerprint system, has refused permission for the school to take her biometric data.

He refused to allow his daughter's fingerprints to be taken and was also concerned that the school had not contacted parents.

He added: "It is as if they know it is wrong and have done it secretly, hoping no-one finds out."

On this occasion this parent was lucky to find out that the schools were planning to do this. Many parents do not find out until after their children's biometric fingerprint have already been stored on their school's PC.

If you have any doubts about fingerprinting children in schools the Leave Them Kids Alone website has a page devoted to questions to ask your school about this.

Local Council issues guidelines to schools

Portsmouth City Council are the first council in the UK to issue guidelines to their schools regarding using biometric fingerprint technology with pupils.

Titled "Finger scanning technology in schools", the full guidance can be found here.

The concerns expressed have in the main focused on 2 main issues:

• That parental consent might not be obtained in a consistent way.
• That the supporting data might in some way enter the criminal justice system to the disadvantage of the children involved.

The guidance has seven points for schools act on, highlighting a school's legal obligations surrounding this technology.

Well done to Portsmouth Council and in particular Councillor Luke Stubbs who was instrumental in this guidance being written.

Guidelines arriving "shortly"

Jim Knight responded yesterday, in the Dept of Education's usual true concise manner in this matter, to a very simple question put to him by Sarah Teather, Lib Dem MP Shadow Education Secretary, regarding the use of fingerprint technology in schools:

From Handsard June 4th 2007

Sarah Teather: To ask the Secretary of State for Education and Skills when he expects to publish guidance to schools on the use of biometric technologies.

Jim Knight: The Department aims to publish guidance to schools on the use of biometric technologies shortly.

This to me doesn't look like a factual answer - not the type of answer that would get brownie points in a SATs test.

Anyway, to try to understand a School Minister's speak let us refer to Rogets Thesaurus, no doubt used in Jim Knights Deptartment's schools nationwide. So, Rogets Thesaurus's definition for "shortly" is "right away".

All this said, when the guidelines are issued they are not statutory and unfortunately schools do not need to heed or read them.

Guidelines for schools elusive

This from The Sun : "Last night [June 3rd 2007] Schools Minister Jim Knight agreed to draw up strict guidelines"

He also agreed to this in February this year, from Hansard 5 Feb 2007:

Jim Knight: "The Department is working with the British Educational Communications and Technology Agency which is revising its current guidance on data protection to include specific guidance on biometric technology. Becta aims to make the guidance available on its website by the end of March 2007 after consultation with the Office of the Information Commissioner."


So the Department of Education has been working on guidelines since February, delayed publication to March, then May and still Jim Knight is working on guidelines......mmm, there are a number of possibilities here:

1. Either the guidelines are going to be issued in the form of a trilogy, due to length of time taken to write, and will appear not just on BECTA's website but also on Amazon.

2. There are no guidelines being written.

3. There were guidelines but Jim Knight's dog chewed them up, honest.

4. It's a legal nightmare and the Department of Education, the ICO and BECTA are simply not issuing them yet due to legal complications.

LEA's have no idea of the level of biometrics in schools

The Liberal Democrats have highlighted fingerprinting children in schools without parental consent.

Only a quarter of LEAs had details about the use of fingerprinting in schools; the Government has refused to issue guidance on the issue and has no idea how many children are being fingerprinted.

Education authorities did not have information regarding whether parental consent had been obtained in four-fifths of the schools that collect fingerprinting.

The Lib Dems highlighted 285 schools that are definitely fingerprinting children.

This Leave Them Kids Alone page lists the schools that are. If you're a parent go and check it out, you might find that your children are using their biometrics and have been doing for years without your knowledge.