by Robin Carton

In 2007, the Superintendent of Schools in Taunton, Massachusetts proposed using fingerprint scans to identify students purchasing school lunches. Under the “Lunch Bytes” program, schools would scan two fingerprints from each student. The scans would then be tagged with an identification number and linked to a meal account. As students pass through the lunch line, a tap of their finger on a reader would bring up their account. A school employee would then enter the cost of the lunch the student had purchased and deduct that amount from their account.

Administrators argued that the scans would speed up lunch lines and help children avoid the stigma attached to receiving free or reduced lunches. The Superintendent also indicated that the fingerprint scans could have subsequent uses beyond speeding up the cafeteria line, including monitoring the eating habits of each child, counting attendance, checking books out of the library and streamlining school transportation procedures. The Taunton School Committee then approved the proposal without discussion.

Parents learned of the school system's decision to use fingerprint-generated identifiers when the Taunton Gazette printed an article about a new mandatory student identification program for all children in the targeted schools—regardless of whether they ate school lunches. Outraged parents raised concerns about invasion of privacy and the potential for identity theft. Given that retail chains and supermarkets have not been able to protect their customer data bases, parents did not believe that the school system would be able to keep their children's information safe.

To counter this program, parents organized a vigorous campaign entitled “Ban the Scan.” For five months, they appeared at School Committee meetings, lobbied legislators, and educated other parents about the uses and potential abuses involved in biometric scanning.
According to the Taunton Gazette, parent Patti Crossman said:

…I cannot accept being told that I do not have a choice of whether or not my child is bio-scanned. …I understand this is being portrayed as a means of getting the lunch lines to move faster because the kids only get 18 minutes to eat their lunch, but wouldn't it make more sense to extend their lunch period? …And if it is used for attendance, will I be able to say no to scanning? I feel very strongly that unless we stop this whole program now, it will become something we cannot stop in the future.

Biometrics is the science that uses physical or behavioral characteristics to verify a person's identity. Characteristics can include fingerprints, iris scans or facial recognition. Airports, grocery stores and other retail outlets currently use this technology. According to Anne Marie Dunphy, vice president of identiMetrics, a biometric technology provider to school systems, fingerprint scanners are already used in many school districts to check out books, “take attendance and speed up lines in cafeterias.”

Proponents of biometrics claim that fears about the technology are over-rated. With fingerprint scanning, for instance, proponents state that the fingerprints themselves are never stored. Instead, a scanner plots points on a fingerprint and converts them to an encrypted number. This number is then used to identify a student. According to these proponents, the fingerprint itself cannot be retrieved because the only image that exists is composed of dots.

LeaveThem KidsAlone.com (LTKA), an organization in the United Kingdom that opposes biometric scanning, notes that “schools that introduce fingerprinting usually try to reassure parents by saying … it is not possible to reconstruct an image of a fingerprint from what is stored.”
However, LTKA responds that systems store fingerprint templates which are essentially equivalent to fingerprints. Such templates conform to international standards to ensure that biometric templates from different manufacturers are compatible and identifiable by various readers, including police, security forces and governments.

In addition, LKTA states that:

A fingerprint, and the template derived from it, cannot ever be changed. In the future, fingerprint templates will be used to authenticate passports, bank accounts, etc. Thus, biometric templates are extremely valuable and need to be kept in a highly secure environment. In addition, fingerprint templates can be used to rapidly link different databases and to build up a disturbingly accurate profile of an individual without their knowledge or consent. The US government's official National Science & Technology Council says you can reconstruct a fingerprint image from a fingerprint template. Government security experts have successfully hacked the fingerprint scanners used in schools. Schools cannot possibly provide the level of security necessary to protect children's data. A school might not even be aware that children's data had been compromised until it was far too late.

And according to Kim Cameron, the chief architect of identity and access in Microsoft's Connected Systems Division, the safety claims by schools are a fallacy: “People have to be stark, raving mad to use conventional biometrics to improve the efficiency of a children's lunch line.”
Cameron adds on www.identityblog.com, “If you want to find out who owns a fingerprint, just convert the fingerprint to a template and do a search for the template in one of these databases. Call the template a binary number if you want to. The point is that all you need to save in the database is the number. Later, when you come across a 'fingerprint of interest' you just convert it to a number and search for it. Law enforcement can use this information—and so can criminals.”

Sarah Wunsch, an attorney with the ACLU of Massachusetts, worked with parents to convince Taunton's superintendent of schools to abandon his plans to install the “Lunch Bytes” program. In a letter to the superintendent, she noted, “Used properly, biometric data might help to improve security-but the last thing we should do is teach parents and their children, starting from a young age, to be casual about turning over biometric data for the sake of convenience.” She went on to state that while she appreciated “the school system's desire to speed up the lunch line and to avoid stigma for students receiving free or reduced lunches… there are legitimate and serious privacy concerns created by this system.”

Carol Rose, executive director of the ACLU of Massachusetts, states that, “Again and again today, through security breaches such as the massive loss of consumer data at the TJX companies, we see the dangers of identity theft. We should carefully examine programs that could further erode people's privacy, whether that is through fingerprinting, surveillance systems, or collections of personal data. The data captured and stored by these systems can be an attractive target for theft and misuse, and once security has been breached, it may be impossible to go back. We should proceed with caution.”

In April, the Taunton School Committee voted to cancel the “Lunch Bytes” program. Richard Faulkner, a Taunton School Committee member said at the vote, “There's no absolute, secure system in this country yet. Biometric information could be stolen, and it could be a long time before schools and banks know that it's gone.”
In response to concerns raised about this technology, some states have begun to implement laws regarding the use of biometric systems in schools. While some states require parental consent before implementation, others ban their use altogether. School districts in cities including Boulder, Colorado, and Irvine, California, have rejected fingerprint-scanning programs as well.

Parents and consumers need to be vigilant because, as LTKA points out, personal identification numbers may be changed following an identify theft, but fingerprints cannot.

---

Robin Carton directs the Grantmaking Program at RESIST and is a parent of two children in the Massachusetts public schools. She wrote this article in consultation with Sarah Wunsch at the American Civil Liberties Union of Massachusetts. A state by state list detailing the use of biometrics in schools can be found at www.banthescan.com.