Friday, May 28, 2010

The Politics of Biometrics: A Shibboleth

Telegraph.co.uk - Children, 4, 'to be fingerprinted to borrow school books from library'

Anyone who terms the implementation of a fingerprint biometric system as described in this article as designed to help libraries serve their customers more efficiently "the fingerprinting of children" is either confused or or lacks respect for their audience.

"Fingerprinting" conjures up images of prison movies, the "rolled ten" and the loss of personal freedom. The fingerprinting process in the usage above is not undertaken in order to further the interests of the person providing the fingerprints. It is typically undertaken to help protect society from the person behind the fingers and carries with it a social stigma. Biometric alarmists intentionally and wrongly bring all of "fingerprinting's" social baggage and dump it onto fingerprint identity management systems.

Besides being misleading, the use of the term "fingerprinting" isn't technically accurate in this case, either. As with the fingerprints we all leave everywhere everyday, the only fingerprint that exists in the system described in the article will reside on the surface of the sensor and only until the next person uses it. According to Lesley Isherwood, the school headmaster, neither the fingerprint nor the image of the fingerprint is stored in a database.

What happens is this: A person places their finger on a sensor. The sensor reads the fingerprint and software turns the fingerprint into a unique number. For the software to work, the same finger has to be converted into the same number every time. It's the numbers that are stored, not images of the fingerprint.

This approach makes sense for a lot of reasons. First and foremost you can't lose data you don't have and no school administrator (risk averse lot that they rightfully are) wants to explain how they lost a bunch of kids' biometric information. Also, in a software environment, numbers are easier to work with than images. Moreover, most adults are rightfully protective of the innocence of children and are pretty conservative when making choices on their behalf.

Of course, an article with the headline: Children, 4, 'to be fingerprinted to borrow school books from library' is bound to have some choice quotes from a Biometric Alarmist:
“This is quite clearly appalling,” said Phil Booth, national coordinator of NO2ID, a privacy campaign group.
To be fair to NO2ID, judging by their web presence, Mr. Booth would appear to be one of the group's more committed members. The group itself seems to be pretty moderate in trying to raise issues of individual liberty and its relationship to the state in the context of digital identity management in a country (the UK) famous for its government surveillance systems. Nevertheless, the school library's system is far from self-evidently appalling. Thankfully, Mr. Booth provides some guidance for those who need some help becoming appalled.
“For such a trivial issue as taking out of library books the taking of fingerprints is way over the top and wrong.
If the taking out of library books is trivial, why not just close the library? And please don't take the child's fingerprints, she'll need those to get lunch.
“It conditions children to hand over sensitive personal information.”
No it doesn't; It conditions children that they must identify themselves to an organization in exchange for enjoying the services that organization offers. The fingerprint authentication is a substitute for a signature or an item with an attached bar code and it's not particularly sensitive.

A signature (which many 4-year-old's are unable to provide) is perhaps more sensitive than a number representing a fingerprint. Just think of the risks under the old signature-card-in-the-book-cover regime. Anyone who ever checked out a book after you could potentially forge your signature.

The use of ID cards with bar codes, an alternate identification method used by libraries, also poses a risk to the child's sensitive information in the event the cards become lost.

I do agree that children (adolescents and, alas, adults too) need quite a lot of guidance in keeping their privacy. See facebook, sexting, You Tube, etc. Something in the society is definitely conditioning young people to treat their privacy in ways that are shocking to some, but I don't think elementary school libraries are the culprit.
“The money for such a system could be spent on actual school resources. How about some more books for the library instead?"
A penny saved is a penny earned. Books are no different. One might hope that the identification system in use will prevent more books from being lost over time. It would then be up to the school to decide how to invest the savings. With the reduced risk of loss, perhaps they will buy more books. Rather than replacing lost volumes the library might even expand the number of titles they are able to offer.
“This needs to be rolled back or stopped. I would argue there is no justification for such a scheme.
There is obvious justification for such a scheme:
  1. It gives the library the ability to more efficiently serve its stakeholders by reducing transactions costs.
  2. It eliminates the necessity of a token (card). It is expensive to replace lost cards. Lost cards may be used by others. Those who have lost their cards will borrow others'. Children lose things.
  3. Reduced loss of library books, leading to a better library.
  4. It is a system that is so easy that, apparently, even 4-year-old's can use it.
Perhaps Mr. Booth means that the justifications are insufficient to overcome his objections. I would be very interested to hear his argument in more detail than is given in the article.