 |
LeaveThemKidsAlone.com ©
LTKA © against schools fingerprinting our children |
| Read what the BBC said about this issue Please tell a friend |
|
LeaveThemKidsAlone.com ©
LTKA © against schools fingerprinting our children |
| Read what the BBC said about this issue Please tell a friend |
>> Vital questions you need to ask your children's school about fingerprinting <<
|
|
WARNING: Some computer security experts feel that in the future it will be possible for the information stored on school biometric systems to be used to steal your child's identity |
MANUFACTURERS' CLAIMS ARE NOT STATEMENTS OF FACT
We feel that it is important that teachers know that the claims made by manufacturers of biometric systems supplied to schools are not uncontroversial. The claims are presented by the manufacturers and their sales representatives as statements of fact, but this is not the case and many experts disagree.
In fact, in a very worrying development German researchers claim they have now succeeded in extracting full fingerprint scans from cheap scanners such as the ones used in schools. See the last section of this article for details. If your pupils' biometric data, which cannot ever be changed like a PIN, were to leak into the public domain as the result of such a breach, your school would not only compromise their future ability to have a passport, ID card, or to access their bank account, but you would face the possibility of litigation and multiple claims for substantial damages. If your school is already using, or considering installing, a biometric system, we strongly recommend that you seek the opinion of an independent data security consultant and arrange comprehensive insurance cover for such an event which would place both a considerable financial and time burden on the school. It would be the school and not the LEA, DfES or manufacturers that would bear the full brunt of any legal challenge in such an event.
You may be interested to read the document on school biometrics by computer security expert Andrew Clymer, a computer security expert (8 years with Cisco Systems, Visa, Fidelity, Merrill Lynch, etc).Andrew contacted LTKA with further observations following an article in the October 2006 issue of Education Executive, where Shaun Oakes, operations director of UK Biometrics Ltd, makes the unsubstantiated claim that "nobody can hack their way into the system".
Andrew replied as follows:
There are some basic principles that all real security experts recognise
1) Given sufficient time nothing is unhackable
Typically security measures are put in place such that the estimated time required to crack the security makes the data redundant. In this case however we are talking about a lifetime, and once broken there is no possibility to change the underlying data to force it to be redundant (such as changing a PIN, credit card number etc). This is very different to military plans, financial statements etc
2) Can this data be kept secure for a person's lifetime?
For me it comes always back to point 1 above; I have a piece of data that I need to keep secure for a lifetime. Can I seriously make a bet today that the information will remain secure for a lifetime? I don't believe any IT security person would be able to make such a guarantee, and especially in these cases on a shoestring budget.
3) Claims that a full fingerprint is stored are irrelevant
The fact that the fingerprinting system does not store the actual print as a picture is irrelevant. The fact that it is able to compare an input against this number and determine a match is the critical issue. It does not seem beyond the bounds of possibility that by understanding what the critical points are you should be able to manufacture a print that exhibits these points. Proving if this is possible today or not is irrelevant, the burden of proof has to be on them that it couldn't be done in a lifetime, and that's impossible.
4) Brute force attack is NOT the typical way in
[Manufacturers] hide behind the issue of 128 bit encryption, and sure if you were to try every single combination using conventional computing today there would no chance.
However, hackers don't do this; you find a way through by having some understanding of the data being encrypted, and the processes behind it. The German Enigma machine was a classic case of this. During the WWII there is no way we could break the German codes based on trying every combination (brute force). We had to think out of the box and by understanding what the data was and other environmental issues we were able to reduce the number of computations required and could crack it.
Quantum computing is something that is on the time line for the next 30 years (article from New Scientist), this blows away even the 128 bit encryption; in the same way that 56 bit has been with conventional computing. (The 1976 state-of-the-art 64-bit Data Encryption Standard, DES, developed by the National Institute of Standards and Technology in the US, can now be cracked on today's supercomputers.) Attempting to guess future technology capabilities for the next 5 years is damn hard let alone a lifetime.
5) Data can never be totally erased without destroying a hard drive
Something you should be aware of its virtually impossible to completely erase a hard drive it needs to be physically destroyed; thus putting further pressure on schools on how to dispose of such systems. A forensic science course at University purchased a pile of hard drives off ebay and then used variety of tools to extract the data from used blank drives. In a sample of 20 drives they found a sex offender, two schools' pupils databases, and a customer list from a mobile phone shop.
