UK college's RFID chip tracking of pupils an invasion?

[rizen1]

Is UK college's RFID chip tracking of pupils an invasion of privacy?
A west Cheshire school tagging pupils' movements around the campus for years raises questions of intrusion

Wendy M Grossman
theguardian.com, Tuesday 19 November 2013 10.35 EST



An RFID tag at high magnification: certain forms can be used for tracking movements of wearers.
When is a biometric not a biometric? When it's an ultra-wideband RFID (radio frequency ID) tag which provides such detailed and continuous information about your movements that it makes logging your movements by fingerprints or card check-ins redundant – because it knows where you are to within centimetres.
It might sound useful or intrusive – or both, depending on your point of view. And one of its biggest users in the UK (outside of factories that want to trace where potentially dangerous machines are being used) has been a vocational college in West Cheshire that offers training and apprenticeships for 14 to 17-year-olds in fields such as hairdressing, forensics, and accounting.


In a trial of up to three years, ending in February 2013, pupils at West Cheshire College wore tags that allowed them to be tracked in detail throughout the college's three campuses. The tags used a new type of ultra-wideband active RFID (Radio Frequency ID) that provides a far more detailed picture of student and staff movements than anything available before.

When first asked about the trial in October, the college's PR spokesperson, Louise Lewis, would say only: "An RFID trial was conducted by the build contractors BAM and their subcontractors, however the technology was only accepted by the college for the purpose of physical asset tracking."
...More recently, the college has expanded on this, saying: "The technology was introduced with the aim of assessing how it could be used for self-marking class attendance registers, safeguarding purposes, and to improve the physical management of the buildings."

Lewis says the trial began in May 2012, when the building work was completed, and was discontinued in February 2013, when a review showed that "the technology did not enhance current systems or business operations" and the college became concerned about rising costs to maintain the system in the future.
The trial came to light owing to the efforts of Pippa King, a Hull-based campaigner who, along with others such as David Clouter, led the charge against the use of biometrics in schools for such things as registration, checking out library books, and paying for meals.
The result was the 2012 Protection of Freedoms Act, which requires schools to obtain parental consent before processing biometric information, and which became law in October 2013. It does not, however, cover RFID. In the US, the December 2012 shootings in Sandy Hook, New Jersey, are inspiring increased security in many schools. RFID Journal reports, for example, on which the Belleville school district in New Jersey is spending $2m to implement an extensive security system throughout its schools, including cameras with built-in analytic software, armed officers, a new phone system, active RFID tracking, and panic buttons for teachers.

In the UK, the only known prior use of RFID in schools was in 2007, when the Edenthorpe school, near Doncaster, trialled embedding RFID chips in school badges on uniforms, with the aim of "accurate and speedy pupil registration, child security, and to aid […] reporting systems covering rowdy pupils". The resulting outcry forced the school to abandon the idea.
WCC's system seems to have passed entirely unnoticed until King spotted it. The story, as revealed through Freedom of Information requests made by King, available at WhatDoTheyKnow.com and other documents she has uncovered, is that in 2009 WCC began revamping its three campuses. The contractor, BAM Construction, subcontracted Honeywell Building Solutions to install an integrated building management system including security management - access control and what is described in Honeywell's presentation about the project (PDF) as "people/asset location and management". Honeywell called in Zebra Systems. Students were issued with tags, along with other smart cards to pay for transport and retail goods in the local mall, when the campuses began reopening in 2010.


In 2012, the college's building services area manager, Kevin Francis, gave a presentation at the RFID Journal Live conference in Florida. Here is where things get peculiar. As King asked additional questions, the college became increasingly reluctant to answer, and finally dubbed her "vexatious" and therefore no longer entitled to answers under the FoIA.
King appealed to the information commissioner's office, which responded by overruling the "vexatious" charge and instructing the college it had to respond. In the meantime, however, King had found and archived other material, such as the Zebra Systems press release about the WCC system and a promotional video recording in which Francis discusses the system and its purposes. These have since disappeared off the net, along with an RFID Journal article in which Francis discussed the system in some detail (although a Spanish translation remains). When King reposted the video on YouTube and Vimeo, it was promptly taken down under the aegis of copyright infringement.

In this cache of material, Francis said the school implemented the system in order to better understand how the students used the redeveloped campuses, to improve its ability to ensure everyone is safely evacuated in case of an emergency, and to ensure it can provide accurate student and staff counts for financial management. Tags were issued to 500 faculty members and the college's 5,500 full-time students. Perhaps not just them; the parent of a 14-year-old boy who attended the college on day release has told King he was issued with a tag but had no idea what it was.


RFID Journal quotes Francis as comparing the costs of active RFID favourably to those of alternatives and praising the system's functionality: "We can search for individual [students or staff]. And we can look at them in groups, such as peer groups." Francis, like others connected with commissioning the system, has since left the college.
The technology involved, UWB active RFID, is truly fascinating and deserves far greater attention all on its own.
Unlike the more familiar passive RFID chips used in Oyster cards and passports, where a reader must send a signal for the chip to be able to send its data, active RFID chips broadcast a burst of radio waves at programmed intervals – anything from multiple times a second to once every four or five minutes – and carrying up to several hundred metres. Compatible readers collect this data and process it.

According to John De Wit, Zebra Systems' director for Europe, the Middle East and Africa, "The choice of active RFID as a tracking mechanism comes down to speed and accuracy." The more frequent the pulses, the more complete a view of the item's movements. Accordingly, compared to location systems using GPS, mobile network masts, or nearby Wi-Fi, the resolution offered by UWB active RFID is much finer. GPS and mobile phones can locate you at an address; active RFID can pinpoint you to within inches. For uses such as automotive assembly lines, this is helpful.

"Most tools tightening up nuts and bolts are wireless controlled," says De Wit. "They are computers, and communicate over wireless to load up certain profiles." A tool is programmed to tighten a bolt at precisely the right torque for the specific location in a car, and it's disabled if it's moved to the wrong work area.
"What's driving it is primarily quality control and, second, loss of tools." In the case of locating people, these systems are being used by sports teams to study their players' movements, and in cattle herds in Germany to spot emerging illness. De Wit was not at Zebra when the WCC trial took place, but he confirmed that it took place and believes the driving reason was safety.
"UWB is a weird technology," says Rupert Goodwins, the former editor of ZDNet UK, who remembers seeing early versions of it under the name "pulse radio" at Sheffield in the 1980s and Georgia Tech in the late 1990s.
"It's been used as through-the-wall radar in the past." Twenty years ago, "Georgia Tech had things that could monitor respiration, tell your gender over 500 metres through walls – without a tag, just using UWB as a radar system. They said they reckoned soon they would be able to get the resolution up to tell what people were saying by the scatter off their vocal cords." He adds, "I was expecting it to be much more commercially significant than it turned out to be."


To Goodwins, therefore, King's concerns about privacy invasion seem quite valid. "UWB has a lot of potential for that sort of thing, especially if you have a tag that can respond. You can get a lot more information out of the system."

King is especially concerned because the story is exposing unforeseen gaps in the Protection of Freedoms Act.

"The last thing I want to do, having successfully gotten parental consent for schools to take biometric information from children, is to have to start from scratch again with active RFID tracking," she says.

What did the college tell its staff and students about the tags? Was there any discussion or debate about privacy? Did the system have any benefits? The college has declined to answer questions like these. It's almost as if it would far rather we didn't know about the trial at all.
Is UK college's RFID chip tracking of pupils an invasion of privacy? | Technology | theguardian.com