Florida has legislation pending that would outright ban the collection of biometric data in its public school system. Senate Bill 188, sponsored by Sen. Dorothy Hukill, R-Port Orange, sailed through the Sunshine State’s legislature and appears headed to Gov. Rick Scott’s desk for his signature.
Florida isn’t alone in its concern over biometric data. Maryland looked at the issue last year with legislation specifically aimed at public schools in Carroll County. Senate Bill 855, would have prohibited schools from further use of palm scanners that were being used in cafeterias. Unlike the Florida measure, however, the Maryland legislation died with an unfavorable report by the Ways & Means Committee.
Janice Kephart, CEO of the Secure Identity & Biometrics Association. Image via Twitter/Janice Kephart |
Kephart was adamant that Hukill’s concern about potential identity theft through biometric information is misplaced and chalked it up to not understanding how the technology works. Kephart explained that biometric technology vendors already abide by standards that separate a person’s print with their identifiable information into separate databases. She said the outline of fingerprints aren’t stored like an image – they’re turned into a set of series of numbers that can’t be reverse engineered.
So in Kephart’s opinion, all a state needs to do is draft legislation that specifically states that no images of a person’s print or iris are to be stored in a database. That way the chances of a hacker being able to steal biometric data and link it to a person is minimal. She noted that schools already store the personal information students in databases anyway and that information – not the biometric scan – is what identity thieves really want.
“Even if [a biometric database] gets hacked into, what’s anybody going to do with hundreds of thousands of numbers – nothing,” Kephart said. “You can’t do anything with that information. So in almost every way, its way more protected than any credit card number ever could be.”
Experts Concerned
Critics aren’t as confident as Kephart, however. Brian Bandey, an attorney and expert on computer and Internet law in the UK, felt the complexities involved in legislating biometric protections aren’t so cut and dried. In an email to Government Technology, Bandey explained that the law has always recognized how vulnerable children are, and any legislation would have to take that into account.“Such a law would be seeking to control and protect ultra-sensitive personally identifiable information permanently attaching to the personhood of individuals from their childhood,” Bandey said. “If such a law was easy to construct – I take the view that it was being drafted to too low a standard.”
Bandey added that he felt Florida’s legislation banning biometrics in schools was “totally appropriate.”
The UK has experienced its own set of biometric growing pains in recent years. Fingerprinting of students was a big issue in the country this year, as some children’s prints were taken without parental consent.
Bandey noted, however, that biometric data in the UK is subject to UK and EU Data Protection Law and human rights laws. He added that parents – and children themselves – now have an indefeasible right to withhold consent to biometric data collection in schools.
Kevin Townsend, original founder of ITsecurity.com and a freelance writer in the UK, isn’t convinced biometric technology’s security is as robust as Kephart claims. In a March 29 blog post, he pointed out that a biometric template can still be compromised, and it’s a more difficult and expensive proposition to change it, as opposed to changing a password.
In addition, Townsend also raises the point that biometrics in schools potentially gives public-sector leaders the ability to track the whereabouts of students. For example, if a student needs a fingerprint scan in the cafeteria, then to enter classrooms, or board a bus, a system can theoretically keep tabs on where they are at all times.
“The problem with introducing biometrics into schools is that we are breeding a generation that will be comfortable with and fully accepting of total government surveillance,” Townsend wrote. “And that is something we need to prevent now rather than redress when it’s too late.”
Potential Trendsetter
Kephart was critical of the Florida biometric industry’s lack of involvement on the bill and felt Hukill was mistaken if she thinks taking away biometrics was going to protect children from identity theft. Kephart explained that by requiring kids to use ID cards, the chances of them losing those cards with all their personal information is much more dangerous.In addition, Kephart was worried that if Gov. Scott signs SB 188, it will set a dangerous precedent for other states to follow suit on an approach that’s based on fear, not science. She chided legislative staff in Florida for not getting more information on biometrics before evaluating the bill.
“Nobody in Florida decided to do due diligence on this,” Kephart said. “No one clearly went out and asked how biometric technology actually works … nobody asked the question. It was just basic public servant due diligence that they didn’t do and there’s really no excuse for that.”
Government Technology contacted Hukill’s office multiple times seeking comment on SB 188 and the research done on biometric technology, but the messages weren’t returned by press time.
Bandey, however, wasn’t shy in sharing his opinion on the legislation.
“There is a worldwide trend, and if the Florida position encourages other states to legally ban the collection of biometric data of minors – good,” he said.
