Secret back-door could transmit fingerprint data to police/government databases

We have to ask ourselves why, out of all the thousands of schools that have fingerprinted their pupils, not one (as far as I am aware) has asked parental permission to do so. "I would have thought that asking permission would have been the first thing head teachers (or any reasonable person) would think of doing. What instructions did the Government give to schools? I would be very interested if anyone have any information about this.

The Information Commissioner states that, since fingerprints are not actually stored on the system, parental knowledge and consent are not required. This is quite an incredible position. If the fingerprint data on the computer is sufficient to identify an individual - who cares if an image of the fingerprint is stored or not ? - it makes no difference.

Teachers have been told that the fingerprint data is "a code", "a bar code" or "a number". It is actually 300 bytes of data that forms a map of the minutiae (significant points) of a child's fingerprint.

See: http://www.microlib.co.uk/news/press_releases/IDK%20Press%20Release%203rd%20July%202006.pdf#search=%22Identikit%20300%20byte%22 (cut & paste this link into your browser) for a description of this by Micro Librarian Systems Ltd - the suppliers of Junior Librarian and Eclipse products.

In addition, although the data is encrypted, the Government has the power to demand encryption keys from the system supplier, so that is not an obstacle to them.

What guarantee is there that the Library systems actually operate, and will continue to operate in the way that teachers and parents have been led to believe they do? The computers containing the fingerprint data will mostlly be connected to the Internet, so that software updates can be installed. How can we really be sure that there is no existing back-door mechanism that will automatically transmit fingerprint data or images to police/government databases?

Can we be certain that the government will never commission a software update that will introduce a back-door mechanism at some time in the future? The schools would probably be unaware of this happening until it is too late (if at all). Since the current systems have been introduced without parental knowledge or consent, why should the government keep us informed of any subsequent changes to the systems?

Once the fingerprints are in the hands of the government, they will never be deleted and could be compared against prints found at crime scenes, in the same way that Tony Blair has publicly stated will happen with fingerprints on the National Identity Register. Automatic fingerprint matching is inherently imperfect, crime scene prints have a worryingly large chance of being incorrectly matched with an those of an innocent person. See paragraph 170 of this publication for details of false match rates.

If a child has never touched a fingerprint scanner, there is zero probability of being incorrectly investigated for a crime. Once a child has touched a scanner he or she will be at the mercy of the matching algorithm for the rest of their lives.

Brian Drury, IT Security consultant