The truth about biometric systems used in schools (using verifiable references)

The following is an extract from a document produced by the US government's official National Science & Technology Council's (NSTC) Subcommittee on Biometrics, and it appears to contradict claims that fingerprint images cannot be reconstructed from fingerprint templates.

You can download the full document at http://www.smart.gov/iab/documents/FAQ16August2005.pdf (cut and paste this link into your browser or click this link to read a text version).

At the BlackHat security conference in Europe in 2006, a security expert Mikko Kiviharju, employed by the Finnish government, reported on how they had successfully hacked and recovered fingerprints from a Digital Persona finger print scanner. "The optical nature of the scanner seems to allow duplicated fingers with little effort." A similar model, from the same manufacturer, is used in one leading school library system at more than 3,500 primary schools. The library system distributor has not seen fit to make users aware of this, though Microsoft warns against using this product as a security device. "The Fingerprint Reader should not be used for protecting sensitive data such as financial information, or for accessing corporate networks."

Information theft is quite unlike traditional forms of theft as the owner can still be in possession of the information without any knowledge that any other illegal party has a copy. So a school would not necessarily even be aware that children's data had been compromised by a hacker until it was far too late.

But the most easily identifiable form of theft is when a computer containing biometric data is actually stolen from school premises. Yet in the following example, neither the school in question nor the manufacturer gave any thought to 260 children's missing biometric data when their PC was stolen. See: http://www.microlib.co.uk/caseStudiesPDF/AshGrangeJunior.pdf (cut and paste this link into your browser.)

"The service provided by [name of manufacturer] has been excellent... The only issues we've had have been caused by us changing our hardware and a burglary when our main computer was stolen. [name of manufacturer] helped us to resolve them all, thank you!" Ash Grange Primary School, Aldershot, Hampshire (no concerns raised about the lost biometric data!)

In two further unrelated incidents, data recovered from a Yorkshire primary school by the Computer Forensics team at the University of Glamorgan included names of pupils and details of their school reports. While a primary school in Cambridge dumped a PC containing sensitive pupils' data on an unprotected skip during renovations in 2006.

When using such a system, parents and staff have to be aware that the fingerprints may enter the public domain, and hence end up in criminal hands where they could pose a critical, and permanent risk of identity fraud. In ten years' time or less, it is likely that passports, bank accounts and other important areas of our life will be secured by fingerprint verification. Obviously, fingerprints cannot ever be changed like a PIN number so they need to be kept secure for a child's entire lifetime.

"The level of associated risk with having a finger print in the public domain still has to be assessed which may be a different question, but I for one do not wish to take this risk with my children's fingerprints." Malcolm Melville

Even more worrying, there are international standards which allow for fingerprint templates from different manufacturers to be compatible and interchangeable. One such standard is called M1 (aka M1/02-0142 or INCITS 398 or NISTIR 6529 - the latter partially sponsored by the U.S. National Security Agency). A fingerprint template from such a system could be read by any other, including systems used by government. A more recent standard, Open AuTHentication (OATH), allows information to be "freely yet securely shared between devices, people, and networks."

One leading biometric security software developer in the US recently told LTKA that they are even trying to improve compatibility between different biometric systems: "There are already companies out there that have compatibility between AFIS and Non AFIS systems. They just don't do it well. We are working on a way to do it better."

The USA PATRIOT Act (Public Law 107-56) provides that other federal organizations work with NIST to "develop and certify a technology standard that can be used to verify the identity of persons..."

"The Common Biometric Exchange Formats Framework (CBEFF) was devised by industry and US government representatives and describes a set of data elements necessary to support biometric technologies in a common way. These data elements can be placed in a single file used to exchange biometric information between different system components or between systems. The result promotes interoperability of biometric-based application programs and systems developed by different vendors by allowing biometric data interchange."

School biometric vendors make the claim that children's data is safe because it is encrypted. At some point in time, however, the information that is encrypted becomes unencrypted in order to perform the finger print match, it might therefore be possible for a hacker to extract the data at that point.

Remember that your child's biometric data needs to be kept safe for their entire lifetime. With today's rapid advances in computer technology, no manufacturer can credibly make such a claim.

Moreover, you can never usefully re-encrypt the data to provide a higher level of security unless you are 100% sure you have the only copies of that data (eg consider data stolen for potential future use, backup media that is still kept, etc). So today's encryption has to be good for a child's lifetime, say at least another 70 years. This is something no biometric manufacturer could reasonably guarantee.

The military grade state-of-the-art Enigma code used by the German navy during World War Two was cracked in 1941; today it can even be decrypted on a standard home PC. And even the 1976 state-of-the-art 64-bit Data Encryption Standard (DES), developed by the National Institute of Standards and Technology in the US, can now be cracked on today's supercomputers.

Today's military security is tomorrow's childsplay, particularly with the distinct possibility, as reported by the New Scientist, that immensely powerful Quantum computing will become a reality by the time today's children are in their thirties. In fact, a prototype has already been demonstrated.

Such a computer would easily be able to decrypt systems used in schools by brute force. Banks could respond to this by changing PIN numbers or passwords and encryption standards, but if children's biometric data had already been leaked from insecure school computers / premises there would no possibility to protect the information.

Banks and passport offices take very great care to ensure that sensitive personal data is well protected, spending considerable sums to prevent theft or unauthorised access.

In the US, for example, there is a recognised standard - ANSI X9.84-2000 Biometrics Management and Security for the Financial Services Industry. This standard specifies the minimum security requirements for effective management of biometric data, and security for the collection, distribution, and processing of biometric data.

It specifies: (1) the security of the physical hardware used throughout the biometric life cycle; (2) the management of the biometric data across its life cycle; (3) the utilization of biometric technology for verification/identification of banking customers and employees; (4) the application of biometric technology for physical and logical access controls; (5) the encapsulation of biometric data; and (6) techniques for securely transmitting and storing biometric data. The biometric data object specified in X9.84 is compatible with CBEFF.

Schools taking children's fingerprints and storing biometric data derived from fingerprint scans do not comply with this, or other comparable standards.

If your child's biometric information is compromised because of a security lapse at their school, this could permanently compromise their future ability to prove who they are, and access services like banking, healthcare, and passport control if these require biometric ID as is currently proposed.

By using biometrics in an improper and insecure environment, schools have opened a Pandora's Box they cannot control, and this may affect our children for the rest of their lives.