NO2ID

My wife works at a secondary school that is planning to introduce a fingerprint based "cashless catering" system for lunches - and it won't just apply to pupils but staff too!!

She is strongly opposed to this sort of thing - but does not feel confident enough to argue the case with the school management. If it was my child's school I would be straight down there for a meeting with the headmaster myself - but I can hardly go down there to speak on behalf of my wife who is an employee.

What can I do?

The daft thing is they already have a card-based "cashless catering" system for lunches. I guess the company that they bought this from has persuaded them to "upgrade" to a biometric version.

Swipe card facilities for those who wish to opt out are plug and play compatible with biometric systems, it's as simple as that. The cost amounts to just a few pounds and just pence for the cards themselves.

There comes a time when people sometimes have to stand up and be counted, it's no use being timid. It makes one wonder why so many headteachers are pursuing biometric systems with such zeal. Read the stories on LTKA to see what happens when parents or pupils express objections.

Is your wife in a teaching union? Where do the unions stand on this?

Keep us informed of events at your wife's school as they unfold.

I'd start by getting your wife to ask a few questions:

What justification is the school giving for introducing fingerprinting? If bullying and theft is the stated reason, is it - for example - going to ban all cash from school premises? If health is mentioned, insist that independent evidence be provided to back up any such claims.

Is it providing alternatives for those who don't wish to provide biometrics? (It has no legal right to compel biometric enrolment, but it may have an obligation to provide dinners.)

What is the total cost of the system? (Not just the initial purchase of equipment and installation, but all maintenance, upgrades, training, etc.)

How long is the school tied in to the contract?

Which named suppliers did the school get to bid for the system? (If just one, how can it be sure it got best value?)

Did the school receive any 'incentives' to purchase the system?

Has a proper cost/benefit analysis been done? How are the benefits to be quantified, and will they be measured on an ongoing basis once the system is in place?

Has a business case been presented to the governors? What other things could the money have been spent on?

Were pupils and parents consulted before the decision was made to introduce the system? Were they consulted at all?

Has written parental consent for fingerprinting been sought and, where appropriate, pupils' consent? If not, why not?

What physical security measures are being put in place to protect the data - e.g. where is the PC/server located, does it have any USB ports or a CD writer?

What procedural security measures are being put in place - e.g. who will have permission to use the machine, is access managed by password or fingerprint, when and how is data wiped?

[N.B. Ignore the whole "the system doesn't store actual fingerprints" line - it's just marketing. Ditto encryption of the fingerprint templates. What you want to know is is ALL the data encrypted? I assume there'll be bank details in a cash replacement system and, arguably, health information (i.e. what a child has eaten) which qualifies as 'sensitive personal data' and must, under the Data Protection Act, be treated especially carefully...]

--

If couched as a series of questions (though maybe not all of them at once!) your wife may not have to argue a case as such - she'll simply be asking the school's management to justify its decision/actions. It'll either have the answers, or it won't.

Ignoring a bunch of quite reasonable questions, or failing to provide satisfactory answers would put the management on the back foot.

Hopefully then your wife will have gained confidence and could gather some support - "Why aren't we getting proper answers?" can be a good way to rally people - to take things further.

And of course once she has the answer (all or some) to Phil's questions and the school intends to proceed i'm sure she will be able to find some local paper willing to publish a story about it

I think something was missed here (excepting Folland):

This seems to be a new twist. What possible justification is there to demand biometric information from a member of staff so they can get some lunch? They are not subject to any of the supposed "reasons" that pupils are "encouraged" to comply; Jimmy Snotnose in 4B doesn't beat them up and nick their lunch money every morning break.

No staff member is going to accept being told what they can and cannot eat by an employer (the fact that they'll cheerily follow Jamie Oliver is beside the point). They certainly won't like having their eating habits monitored for excess cakeage.

I wonder if your wife has done her research on the types of biometrics used in most schools. When our local preschool mentioned the possible implementation of biometric finger scanners, I was very concerned. After some in-depth research into the topic, I was put at ease. The type of scanners used in schools don't take or store any sort of "fingerprint" in their systems. It simply changes a few key markers into a form algorithm only recognizable by the system that created it. It cannot be used or re-verse analyzed to produce anything that would lead to the identification or verification of that person. Plus, I found that biometric scanners are more secure than using PINs or ID cards. But don't rely on me. There is a wealth of reputable information on the web and through third-party research firms around the world. Your wife's fears are not simply not grounded in anything but fear of "big brother", as were mine, and now I am a fledgling convert...

justwonderin - we are not against fingerprinting in schools because we worry that the data may be unsafe or can be converted back to the fingerprint. We are against it because it is conditioning a whole generation of UK citizens to think that it is OK to hand your fingerprints over to any authority figure who asks!

Vendors of biometric authentication systems often say that. It doesn't make it true. For example, see Andy Adler's paper Can images be regenerated from biometric templates?, presented at Biometrics Consortium Conference 2003. Washington, D.C., USA, Sept. 22-24, 2003.


That would possibly be true, if it were possible to obtain knowledge of a PIN by copying it from a glass. But it isn't. It is far easier to copy fingerprints than memories.


The phrases "reputable information" and "on the web" do not sit comfortably with each other. Can you direct us to any peer-reviewed publications that you studied while researching this topic?

Ooh it be all bright and shiny!

Not true - there is research (e.g. cited above) indicating that "reverse construction" of at least partial fingerprint data from stored markers may be possible.



Why on earth does an adult woman need a more "secure" way to pay £3.50 for a school lunch than just pulling some cash out of her purse? In particular, why does she need to use a system that allows her employers to store data on what she eats?



The only "firms" conducting research in this area are those with a commerical interest in the adoption of biometric technologies.



A convert to unnecessary and intrusive use of biometric identification and data retention.

There are real things to fear here...

e.g. you could be hauled off to a police station for questioning because a partially reconstructed fingerprint derived from your biometric record matched a scene of crime print.

Or you might receive lower priority NHS treatment (or more expensive health insurance) because the data recorded on your food choices suggested an "unhealthy" diet.

They might seem far fetched now - but stuff like this is on the cards.