Wednesday, December 15, 2010

What a mess: UK, EU, Children and Biometrics

UK gets thumbs down over school fingerprinting (Sydney Morning Herald - Australia)
BRUSSELS: The European Commission has demanded that Britain justify the widespread and routine fingerprinting of children in schools.

It said it had "significant concerns" that the policy breaks European Union privacy laws.
Here's an article that perfectly illustrates what happens when competing bureaucracies, biased or power-maximizing bureaucrats, identity management and (possibly) poor public communication collide. In fact, one seldom encounters such a archetypal example of what is an increasingly infrequent, though once common, treatment of biometrics in the news.

-The competing bureaucracies: The European Union vs. UK Schools
-The biased or power-maximizing bureaucrat: Hank Roberts "A member of the executive of the Association of Teachers and Lecturers"
-Identity Management: Fingerprint biometrics in schools
-Potentially poor public communicator: UK Schools

First, some background.

As outlined here, there are many reasons schools would like to and in fact should be encouraged to tighten up their identity management functions and biometrics can help while increasing privacy and lowering costs.
Schools spend a lot of resources in their Identity Management function: calling roll, assigning grades, managing a medical services office (school nurse), collecting health information on student athletes (physical exams), etc.

We all have an interest in how efficiently an industry that is overwhelmingly funded by tax revenues manages its resources. Schools should therefore be encouraged to adopt more effective means to accomplish the demands society places upon them and they should be commended for innovation within their industry.
To the list above should be added the library's and school lunch functions.

Secondly, not all fingerprint identity management systems are the same.

Some implementations store an image of the fingerprint and some store only the template created by the biometric algorithm. All fingerprint access control systems use a template generated from a person's fingerprint. It is not possible to "reverse engineer" a template into a complete image of the fingerprint that created it. In this limited use case it cannot fairly be said that people are fingerprinted.

Other fingerprint access control systems do store an image of the fingerprint as well as the template generated from it. In this use case, it is accurate to say that fingerprints are on file.

Thankfully, most decision makers that examine the implementation of fingerprint ID management systems in their schools become informed of the difference and since they are, for the most part, normal human beings that care about the welfare of the children under their supervision, they opt for the type of system that does not store fingerprints.

Back to the linked article.

The tension between the EU bureaucracy and institutions confined within member states is obvious and has nothing to do with biometrics, per se.

Biased and uninformed bureaucrats are occasionally addressed here and Mr. Roberts confirms his bias and willingness to paint with an overly broad brush with the following quote:
"I believe the fingerprinting of children is a totally unnecessary infringement of civil liberties," he said. "The legal situation must be looked at. This is being done surreptitiously without parents being told."
Anyone who terms the implementation of a fingerprint biometric system that stores only the template created by the biometric algorithm "fingerprinting" is either confused or or lacks respect for their audience.

"Fingerprinting" conjures up images of prison movies, the "rolled ten" and the loss of personal freedom. The fingerprinting process in the usage above is not undertaken in order to further the interests of the person providing the fingerprints. It is typically undertaken to help protect society from the person behind the fingers and carries with it a social stigma. Biometric alarmists intentionally and wrongly bring all of "fingerprinting's" social baggage and dump it onto fingerprint identity management systems. This approach is wrong-headed and emotionally charged.

One of our mottoes is relevant here: Biometrics, it's about people. Most biometric identity management deployments don't founder on technical challenges, but on social challenges. Foremost among the social challenges is communication. Biometric identity management techniques can save money and enhance privacy in schools (by, for instance, obscuring who receives a need-based subsidized meal) but they can't build consensus among public service providers and stake holders. People have to do that. Adopters of biometric identity management solutions have gotten much better at educating themselves about the technology and explaining the reasons behind their decisions.

It is exceedingly rare that these systems are implemented "surreptitiously without parents being told."

The number of Mr. Roberts's in the world seems either to be declining or they are finding fewer reporters seeking their comment. Reasoned communication is winning the day. This is good for schools, students, taxpayers and the biometrics industry. I'll leave it to others to judge whether or not it's good for unelected bureaucrats or self-appointed advocates.