The Myth of Fingerprints

Taking biometric data from our children is a bad move. Storing it insecurely is courting disaster

I'm a big fan of technology-led cop dramas - and the more outlandish the kit they use, the better I like it. CSI, for instance, is stuffed silly with it, from virtual autopsy machines to iPod-deployed body heat detectors and translucent computer monitors wider than a Hummer.

Actually, this series has actually been pretty useful viewing over the years. I now know that if I'm ever unlucky enough to discover the remains of the nanny stuffed into a shoebox in my walk-in closet, all I need do is find is a 'partial' of a fingerprint somewhere in the building or grounds to clear my name. That's because the police will be able to take a grab of it at the scene on a pocket scanner, upload it to a lab database in downtown Miami and, in a flurry of algorithms, the true culprit's unshaven mug will appear. Case closed.

If I am a school librarian in, say, downtown Solihull, I can now enjoy this kind of technology too. For instance, I may spot a felon from Year Five sauntering out with a copy of The Very Hungry Caterpillar in large-print board book format. My suspicions may be aroused so I casually ask him to slip his thumb into the school's new fingerprinting device. Sweating profusely, he claims to be Melissa Davies from Reception. I am not convinced. And presto - in a flurry of algorithms the clunky Dell bears me out. He is lying through his teeth! He has no clearance whatever for the Foundation section. He hasn't touched a board book since March 17, 2004. He's not even a girl. Case closed.

Mere screenplay material? You'd hope so. But the boundaries of drama and reality are becoming blurred together for an increasing number of schools in the UK who are introducing biometric fingerprinting for children, another soft pad down the road towards state omniscience, and a move with which many teachers - who in any other area would be staunch advocates of children's rights - are far too compliant.

Prints and the Revolution

There are standard arguments for adopting such systems. Fingerprinting can do away with the need for hard cash in the canteen, monitor attendance and replace the arduousness of registration. It's quick, because all you need is a paw at the door. It's generally reliable, unless you have an unusually high number of amputees in your geography group.

But there is a dark side - and it's not just that this information is often being taken from children without the knowledge or consent of their parents. It's about the nature of this transaction - what we are teaching our kids to accept as the norm. And about what the future may hold if we continue passively down this road.

No-one would argue that technology is not important in schools, and giving our children the best in every field, including that of IT, is a way to show we value them. But fingerprinting oversteps the mark and demonstrates precisely the opposite. It is actually a betrayal.

Britons are becoming increasingly blasé about trading information for convenience. We Facebook and Twitter the minutiae of our lives, manage our finances with an increasingly thin umbilical between ourselves and those who hold our money, and reveal our habits, preferences and pecadillos as we shop online. Strange that in a society where basic common trust has been eroded to zero, we are still ready to put an unwavering faith in technology to protect us, despite bugs, breaches and human balls-ups consistently demonstrating just how flimsy it is.

Until recently, certain things have remained sacrosanct. One's DNA - our individual hallmark. One's fingerprint - a manifestation of that individuality. But no longer.

Many teachers appear to have the idea that obtaining and keeping fingerprint information is no more onerous than holding medical notes or progress records, or allowing children to upload homework to the school's gallery. But there's a world of difference. If a child logs into their school site with a screen-name like badass666 and a four-digit password that's one thing: such information is almost valueless to a third party. But a fingerprint, or a unique numeric value derived from it, is about as personal a record as you can get. Thus the transaction we are teaching our kids to make is entirely disproportionate - there is no earthly reason to believe that the exchange of individual information is worth a school dinner or a paperback. Like the biblical Esau, we are - quite literally - selling their birthright for a bowl of soup.

The truly idiotic thing is that schools are supposed to be teaching our children to stay safe in a digital world, to be responsible with their data. Yet at the same time many are insisting that pupils give up - often without any reference to parents - the most personal information they have. Isn't this identity theft by any other name?

The system crack'd

The government, and vendors of this technology, naturally argue that it is safe as houses. One principal player, VeriCool (whose grandparent company is the sixth largest defence contractor in the US, currently offering jobs at Guantanamo) flogs schools a system which 'protects identity with a unique digital signature saved as a binary algorithm and stored on a dedicated school server.' The Office of the Information Commissioner cites the Data Protection Act which requires 'appropriate security' to be in place when fingerprinting is used.

That's fine in CSI land. But reality check please. Does a school constitute a safe enough environment in which to store sensitive biometric information that will mark out a person for life? I'm not saying for a minute that staff would be careless or cavalier with such information. But show me where, within an average school, this 'appropriate security' is going to reside. On an external hard disk next to the art materials cupboard? On a PC by the staffroom window? School buildings are frequently insecure - grounds unmonitored after hours. Teachers are not IT professionals, and many rely on local authority technicians to keep their systems secure. Even the best third-party-installed security is no earthly good if someone leaves the keys lying around.

In any other sphere of life, putting even the hint of sensitive data into such an open environment would be unthinkable. Well, at least you'd guess so. Except various government departments 'mislaid' 36,989,300 items of personal data in 2007 and the MoD reportedly 'lose' one laptop every two days - hardly bastions of security themselves.

After a security breach we often hear the line that 'we are learning from these mistakes'. No-one is. We should know by now that there is only one certainty where technology is concerned: that sooner or later any secure system of human origin is destined to crack, or be cracked.

If we play dice with our children's biometric information - that information which is right now so confidently deemed by the OIC as 'extremely unlikely to be reverse-engineered' - the day will inevitably come when it will be spewed out on the open market.

And on that day, our children will have every right to point the finger at us.

© 2009 Paperhorse LLP All rights reserved

Back to Articles