What is Biostore – how does it work?
BioStore is a central database which stores the information which identifies pupils uniquely to each of the applications used within the school. It requires each pupil to register only once, usually by placing a finger on a scanner, although other identification methods are available.
Why use BioStore’s biometric system instead of other existing identification methods?
BioStore’s centralised system speeds up the registration process – each student need only register once, no matter how many applications requiring identification are in place in the school.
With a biometric system, students cannot borrow or steal credentials from each other, reducing the opportunities for bullying.
Queues are reduced, because the identification of students is speeded up. Students need no longer carry cards, remember PIN numbers, or use cash to buy a meal.
Biometric systems save time and money for both school and pupils because the need to replace lost cards and forgotten passwords is eliminated.
How secure is the stored data? What would happen if somebody stole the data in some form?
The database is protected by a licence key, which means that the database and any backup of its contents can only be accessed on licensed hardware. The licensed hardware is stored in the school's own secure facility, so that the encrypted data is only available to the registered licensee. Even if a school's security were to be compromised and a backup of the database stolen, the encrypted data would still be unreadable, even by another school.
Does Biostore record images of fingers?
No. It is the policy of Biostore never to store images of fingers anywhere on their system. Only mathematical representations of certain points of interest are recorded, typically between ten and forty depending on the characteristics of the finger. This information is encrypted and is called a template. This data is extremely secure in its encrypted form but even if it were not encrypted it is impossible to recreate the original image of the finger from this data.
Is it possible to recreate a fingerprint from the data stored by BioStore?
No. The BioStore system only stores a short string of encrypted numbers – too few numbers to provide enough detail for the original print to be reconstructed.
A simple way to think about how the system works is to consider an ordnance survey map of a given area. Imagine marking all the points where roads cross over rivers and where railway tracks cross roads, then record the coordinates of these crossing points. Use this information to examine a set of, say, 100 maps, and compare each map with the recorded information. The original ordnance map will be identifiable with some degree of certainty. However, using only the recorded coordinates it would be impossible to recreate the original map with any accuracy - more than 99.99% of the information on the original map will have been discarded, leaving only the few recorded points. Even these points cannot be recreated because only a simple description of each has been kept.
Can my child's finger biometrics be used by the police or a court of law?
No. BioStore does not store an image of their finger. The recorded templates are comprised of a set of numbers which represent each person. This set of numbers will be unique within populations of hundreds, or a few thousand, people. However, in the wider population the system is not accurate enough for the templates to be usable for forensic matching with any degree of certainty. A court of law would never be able to use this information as evidence.
No. The finger template stored in the database is merely a string of encrypted numbers. If this string of numbers were to be removed from the database, it would be useless, because it cannot be recognised as a fingerprint. A finger scanner checks for a real finger – it does not recognise a string of numbers, unlike a bank machine, which will accept a bank card from anybody who happens to know the PIN number.
I have heard that Biostore is a central database. Where is the information kept?
The Biostore database is stored on the school or organisation's own computer.
Alternative identification methods, such as smart cards and name and photo look-up, are always available in BioStore systems. Pupils unable to provide biometric data can opt to use one of these methods, as can any pupil who prefers not to use biometrics.
If I object to my child's finger biometrics being taken, what will happen?
The school will issue any pupil who wishes to opt out of the biometric system with an alternative method of identification. BioStore recognises a number of identification methods, including smartcards, PIN numbers, passwords and name and photo lookup.
What is False Acceptance and False Reject?
These terms refer to how accurate and reliable the system is in correctly identifying people. False Acceptance occurs when a person is wrongly identified as someone else. A False Reject occurs when a person's own finger is not recognised.