Biometrics in K-12: Ban or Buy? (Part 1)

• By Patricia Deubel
• 04/18/07

Biometrics are creeping into nearly every market in our society. The technology is used in forensics, government and law enforcement, healthcare systems, the military, business enterprises, and now in education to authenticate transactions, control entry into various facilities, monitor time and attendance, secure access to laptops, PCs, and networks, and more.

According to Anne Marie Dunphy, Chief Financial Officer of IdentiMetric, fingerprint recognition is by far the most developed of the biometric technologies, and represents 85 percent of the biometrics market ("Ask the Experts," 2006). However, after reading The Truth about Biometric Devices in Schools (Johns, March 27, 2007), I began to wonder if fingerprint scanning is really needed in a school lunch program and why biometrics, in general, might be needed anywhere within the K-12 setting. Aren't there more cost-effective ways to provide services for our young people and ensure privacy and security?

Parents, students, and civil liberties groups have legitimate concerns about biometrics.

My quest into the nature of this emerging technology revealed that before you decide to ban its use or buy into biometrics, you need to have an understanding of three aspects of biometrics:

• The technology itself and applications available;
• Knowledge of key issues and concerns that have been raised; and
• A keen eye for vendor claims coupled with a sound business plan of action that leads to a security solution you really need.

So, stay with me for a three-part look at this topic.

Initial considerations
I've taught in small towns, mid-sized and large urban districts and in more than one state. I'll be honest with you about my initial reaction to the article that prompted this investigation: "Use biometrics for food service to speed up a lunch line? Give me a break." Biometrics don't really save time, do they? The cafeteria staff can only put food on a plate so fast. Students take a while to make up their mind about what they want to order. And what's wrong with teaching students some responsibility?  If they lose their lunch money or school debit card, well ... sometimes the cafeteria staff had that peanut butter sandwich and carton of milk available. I recall the days when there was a teacher or paraprofessional or volunteer in the cafeteria to monitor the lunch line so that bullying and cutting in line would not occur. Sometimes there were fights in the cafeteria. Certainly this was a greater security issue. 

I thought that waiting for students to properly scan their finger on a reader might actually slow down mass-entry into the school.  What's wrong with the good administrator and his/her teaching staff greeting students at the main door and classroom doors in the morning and during the day and knowing who the students are? (I hear you; you can't know everyone.) What's wrong with locking all doors except for the main entrance after the school day begins, so you can get out via any door for safety reasons, but not back in except via that main entrance?  Visitors must enter through only one door and report to the main office for a visitor's pass.

I thought of other security measures we took in those buildings in which I taught. We had paraprofessionals who walked the halls and security guards. The year we installed surveillance cameras inside and outside of the school was a wake up call. Those dogs that were brought in sometimes to sniff out drugs really bothered me. I recall ID badges for students and staff, the classroom we converted for a city policeman to take up residence in the building each day, and the patrol cars that regularly circled the building during peak hours of student movement. In our initial attempt to secure data, staff and students used passwords for computer access.

Then the tragedy of September 11 (AKA 9-11) happened, and biometrics gained in popularity. My European relatives and visitors to the United States now need their fingerprints and picture taken to gain entry. These are high security measures. So, biometrics in schools seemed to be a questionable and costly solution for security--like technology looking for another home. 

What are biometrics?
Biometrics are measurable physical and behavioral characteristics that can be used for verification or identification of an individual. Physical biometrics are gathered from analyzing fingertip patterns; measuring facial characteristics or the shape of a hand; and analyzing features of the iris or retina in an eye, vein patterns, and DNA for genetic makeup. Body odors, ear lobes, sweat pores, and lips have also been investigated to characterize individuals. Behavioral biometrics include vocal behavior, signature dynamics, keystrokes, and a person's gait (Biometrics 101, n.d.).

How does the technology work?

Biometrics rely on pattern recognition systems. Most are based on collecting a set of minutiae or points from an individual, determined by location, orientation, and minutia type associated with the biometric (Jain, 2004). Hardware, application software, and a reader or scanning device are needed to capture biometric data, convert it to digital form, and then store it as a template in a database to be used for comparisons to future captures from those devices.

Data from fingerprints and hand geometry appear to be the most commonly collected in schools, and a couple of school districts have experimented with iris recognition. Fingerprint technology relies on capturing a set of minutiae from "where a friction ridge begins, terminates, or splits into two or more ridges" (Biometrics Glossary, n.d.). The latest hand geometry technology relies on capturing 3D images of the size and shape of the hand. Templates are made from measurements such as length, width, thickness, and surface area (Ingersoll Rand Recognition Systems, FAQ, 2006). Iris recognition works by capturing an image of the iris from an individual glancing into the aperture of a digital camera from about three to 10 inches away. The iris is analyzed for its unique patterns, which are then converted into a 512 byte code (The Point Group, n.d.).

Sagem Morpho Inc. briefly describes the biometric scanning process used in its MorphoTouch product. Five pictures, worth viewing, quickly illustrate how the numeric template (fig. 1) is created from the scanned fingerprint image. One or two fingers, generally the index finger of each hand, are pressed flat on the scanning surface to capture points from the center of the finger, as opposed to capturing points from all of a finger by rolling it from nail to nail. For children under 18 the image is standardized and resized before processing. Up to 40 or so uniquely identifying points from the swirls and arcs of the scanned finger(s) are captured, then the original image is discarded. The captured points are converted to numbers ("just like a social security number") and stored as a template to be later used for verifying or identifying an individual stored in the database. The original fingerprint image can't be recreated from this template. The company notes differences between this type of fingerprint scanning and that used for forensic and criminal investigations to help ensure parents and students that the biometric templates are not like those required by law enforcement agencies for identification purposes.

The process of verification involves authenticating a claimed identity (you are who you say you are), a direct one to one approach comparing the verification template, and a recapture of the fingerprint, to the enrollment template, the one created the first time. Identification is a one to many approach to find out who someone is by submitting a biometric sample and comparing it to all the stored templates in the database (Biometrics Glossary, n.d.). Each time a scan is made, the template created differs from the one captured and stored the first time. The minutiae collected also depend on the nature of the sensor on the reader.

The point is, when the templates are compared, the system determines if a sufficient number of matches exist to verify or identify. That's the challenge, and that's where where error rates come in. The performance relies on the database, which depends on the quality of the original images captured and how well each original template was created. The condition of a finger (e.g., cuts and bruises, too wet or dry, too cold or hot) affects the quality. False accepts (i.e., verifying an imposter), false rejects (i.e., failing to verify a legitimate individual), and failure to enroll are primary concerns (Jain, 2004).

A vast number of algorithms are on the market for vendors to use for coding minutiae (National Science and Technology Council, Subcommittee on Biometrics [NSTC], 2006). "[C]ritical performance parameters including the accuracy, the processing speed, and the size of database" also differ from vendor to vendor (SDKK Secure Design, n.d., para. 3). Vendors will say their products capture fewer minutiae than a law enforcement agency might require. I suspect this is to market their products as secure for schools. So biometric products in schools need to provide a basic security level, which for most purposes is to verify an individual. Schools don't need to capture all 10 fingerprints electronically nor scan all of a fingerprint for maximum minutiae, as the FBI specifies (CJIS Electronic Fingerprint Transmission Specification, 2005, Appendix J).

Applications in Schools
There is no shortage of companies offering biometric solutions to schools. You can't ignore vendor marketing strategies to get biometrics into schools, nor the research being conducted on its feasibility for school use.

IdentiMetrics associates its Identifi readers with seamless integration into software for a lunch program, nurse's office, and library, as well as for monitoring time and attendance and providing secure access to classrooms and the building itself.

Dell has biometric devices to control access to networked and stand-alone computers and laptops for highest security needs.

Mobile wireless fingerprint scanners, such as Atsonic's SweetFINGER, can be integrated into a bus tracking system to monitor students who enter and exit school busses.

M2SYS has a Bio-Plugin solution to add an extra layer of security to Windows-based PowerSchool, which is a school information management system. Its fingerprint recognition system, Bio-SnapON, can be used with PowerSchool's cafeteria module, PowerLunch. M2SYS states that Bio-SnapON can be instantly integrated with any third party software package. The solution can be used to complement or replace any external barcode or magstripe device with biometric identification and to substitute a fingerprint for an application user name and password or store fingerprint data on a smart card.

M2SYS also has Windows-based Bio-Tracker to track locations, identify members, and monitor entry/exit. The application "allows administrators to input a person's contact information, capture a digital photograph, and enroll his/her fingerprints.... Once a person has been registered, his/her picture and profile data can be instantly displayed from any networked PC using a single fingerprint scan."

Hand readers are considerably more expensive than fingerprint readers, about $,2500 each compared to about $90 to $100, respectively (Kiernan, 2005). Nevertheless, The Academy of Appleton (WI), a private preK-12 school, chose to combine PINs and hand scanning using hand readers from Recognition Systems to secure school entry ("Wisconsin school goes with Biometric", 2004).

As part of a National Institute of Justice (NIJ) study, Hewlett-Packard collaborated with Eyemetric Identity Systems and others to enable Freehold Borough School District (NJ) to experiment with iris recognition to control school entry. LG IrisAccess 3000, iris camera and software, from LG Electronics is being used on a voluntary basis with school employees, parents, guardians, and visitors. Non-participants can ring a doorbell and wait to be admitted. A prior NIJ study had been conducted in Plumsted Township School District (NJ). The NIJ has found that iris recognition combined with the buzzer system can be effective to control access during the school day, if coupled with other, less expensive measures (HP News Release, 2006).

Conclusion
Having a basic understanding of biometric technology and knowing where you might use it are just beginning steps in deciding if you should ban or use it. As the NSTC Subcommittee on Biometrics (2006) pointed out, "Fingerprints have a generally broad acceptance with the general public and ... will be utilized in new systems for evolving applications that require a reliable biometric" (p. 7). You are even going to find biometrics being used in vending machines to control access to age-sensitive products for consumption or that soft drink you want to buy. But, schools are not the general public, and by now you probably are thinking about privacy, health risks, data abuse, religious and cultural concerns, standardization in the industry, and that "Big Brother" biggy--tracking. Come back. Those issues are addressed in part 2.

Resources

• Atsonic
• Dell
• IndentiMetrics
• LG Electronics, Iris Technology Division
• M2SYS
• National Institute for Standards in Technology
• PowerSchool
• Recognition Systems
• Sagem Morpho

References

Ask the Experts: Talking with IdentiMetrics' CFO Anne Marie Dunphy about practical and cost-effective ways of implementing biometric solutions. (2006, August). Retrieved March 28, 2007

Biometrics 101 (n.d.) Retrieved March 30, 2007, from U.S. Army Biometrics Task Force website

Biometrics Glossary (n.d.). Retrieved March 30, 2007, from U.S. Army Biometrics Task Force website

Criminal Justice Information Services (CJIS) Electronic Fingerprint Transmission Specification. (2005, May 2). Department of Justice Federal Bureau of Investigation, Criminal Justice Information Services Division. Retrieved April 3, 2007

HP News Release (2006, January 23). HP powers iris recognition security system designed to improve school and student safety. Retrieved April 4, 2007

Ingersoll Rand Recognition Systems (2006). Frequently asked questions. Retrieved April 6, 2007

Jain, A. K. (2004, November). Biometric authentication: How do I know who you are? Carnegie Mellon University Distinguished Lecture Series. Retrieved April 5, 2007, from Michigan State University, Biometrics Research

Johns, M. (2007, March 27). The Truth about Biometric Devices in Schools. Retrieved March 28, 2007, from PRWeb Press Release Newswire

Kiernan, V. (2005, December 2). Show your hand, not your ID. The Chronicle of Higher Education, 52(15), A28-A30. Retrieved April 4, 2007

National Science and Technology Council, Subcommittee on Biometrics (2006). Fingerprint Recognition. Retrieved April 2, 2007

SDKK Secure Design (n.d.). International Standards--Interoperability. Retrieved April 3, 2007

The Point Group (n.d.). The child project: A primer on Iris recognition technology. Retrieved April 7, 2007

Wisconsin school goes with Biometric HandReader to secure campus. (2004, October 26). RFID News. Retrieved April 2, 2007

:: READ MORE OPINIONS and VIEWPOINTS ::

About the author: Patricia Deubel has a Ph.D. in computing technology in education, and is currently an adjunct faculty member in the graduate School of Education at Capella University and an education consultant. She is also the developer of Computing Technology for Math Excellence at http://www.ct4me.net.

Have any additional questions? Want to share your story? Want to pass along a news tip? Contact Dave Nagel, executive editor, at [email protected].