Schneier on Security
A blog covering security and security technology.
« U.S. Government to Encrypt All Laptops |
| Ensuring the Accuracy of Electronic Voting Machines »
January 4, 2007
ID Cards to Stop Bullying
"Introducing photo ID cards will help bring an end to bullying over use of 'cash free' cards for school meals, will assist with access to school bus services and, ultimately, can be used to add security to school examinations," he said.
"SSTA members report frequently that young people are bullied into handing over their cards for school meals to others, thus leaving them without their meal entitlement.
"With non-identified cards this will remain a problem. If photo ID is introduced widely, then the problem will dramatically reduce."
He said that introducing such a system would also help prepare young people for "the realities of identity management in the 21st Century".
I agree with this:
However, Green MSP Patrick Harvie said the suggestion was troubling.
"We should be preparing young people for the reality of defending their privacy and civil liberties against ever-more intrusive government systems," he argued.
"We've heard proposals for airport-style scanners and random drug testing in schools, fingerprinting is already in place in some schools. There's a risk of creating environments which feel more like penal institutions than places of learning.
"These ID cards will do absolutely nothing to address the causes of bullying. Instead they will teach the next generation that an ID card culture is 'normal', and that they should have to prove their entitlement to services."
It's important that schools teach the right lessons, and "we're all living in a surveillance society, and we should just get used to it" is not the right lesson.
Posted on January 4, 2007 at 6:17 AM
• 54 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I presume that these cashless cards were introduced to avoid bullying in the first place?
Are photo cards being used to mask the real problem - i.e. that teachers are not spending enough time with their kids and do not to know who their charges are?
Ah, but the bullies could still do a denial of service attack - by taking the photoID cards anyway. Clearly, what would be better would be some sort of DNA database for all children in Scotland. ;p
And examinations! What? So someone nicks your ID card, so you can't sit your exams? What planet are these people from?
No doubt the cash card system was implemented to stop bullies from taking kids' lunch money. And now they are trying an improved card system to combat bullying.
The correct response to strongarm robbery is punish the criminals with fines and imprisonment. Why do they allow bullies to commit crimes with impunity?
I imagine the original purpose of the cards was to equip kids to buy school-food-and-nothing-else.
Coloured plastic disks from a vending machine formed a part of the ordering system at my school. You bought a disk first thing in the morning and the number of disks sold was the number of meals to make that day. The number of colours was finite so if you hoarded disks you could eventually use them another day.
The real answer is to do school at night, when people won't expect a meal to be served. :)
"We should be preparing young people for the reality of defending their privacy and civil liberties against ever-more intrusive government systems," he [Patrick Harvie] argued.
I couldn't agree more, and am truly amazed that a member of a parliament cares about civil rights, and even dares to endorse limitation of government powers.
What a heartening contrast to the german interior secretaries Schily, Beckstein and Schaeuble, who can't wait to store more and more biometrics and other personal data in id cards and databases, forbid encryption, record all communications and monitor all citizen movements, even within their own homes.
It seems to me as if the lessons from WW2 are forgotten as those who experienced it grow old and die.
My sad guess is that responsible and idealist politicians like Patrick Harvie will remain a minority, and just be run over by the commercial interests and powers behind today's politics.
I found his wikipedia article interesting:
My kids in middle and high school use a PIN that is verbally given to the cafeteria worker to "charge" the meal. This seems to encourage good listening skills, rather than not bullying, in order to get a free lunch. This concept doesn't work either, being my main point.
I think teaching civics would do more for fighting for our liberties.
This seems like it will train the attackers in the art of skimming and re-writing their own ID. There is still on connection between the data on the ID and the picture on the ID.
You could emboss the cards and force the clerk to type in the last 4 digits. And also pins could help but they should use scramble pads with covers which slows down the line
Subverting this is easier than hacking the card. Bullying is a people problem, not a technology problem.
Since I can't take your card from you and pass it off as my own, now what I will do is force you to use it on my behalf. Or it's still a long wait at the bus stop.
This is the age where billions are spent on stone monuments to veterans who died 60 years ago, and wounded and disabled veterans today are left swinging in the breeze when it comes to their benefits.
Same issue. Easier to look like you're getting something done by futzing around with something that's not alive than actually building a system that would help the living. Fix the PEOPLE problem.
Clearly ID cards won't stop bullying. They might (at best) stop one particular kind of bullying. What annoys me is the way people always want to believe that a technological device is going to "solve" a social problem. For more discussion, see the POSIWID blog - http://www.dontpanic-ii.org/posiwid/2007/01/...
I like the way my son's school handles this: at the beginning of the school year the cafeteria takes a picture of each student. When my son goes to get lunch, he just gives them his name. The computer pulls up his account and his photo. The lunch lady has to verify that the photo matches the child in front of her before the account is charged.
This like something out of Viz magazine. I hereby predict "National ID Cards Will Reduce Skid Marks In Nation's Underwear, says Government Minister"
If staff at point-of-sale actually looked at photos on cards, banks would put photos on credit & debit cards. This was tried by a bank in the UK a few years ago, and abandoned because nobody examined the picture any more than they examined the signature. Even pictures of the wrong gender were rarely noticed.
I guess your family name isn't Harvie. :-)
In terms of the privacy implications, there seems to me to be very little difference between the photo ID card solution and your son's school's solution. Especially since it will be likely that the photos taken for the ID cards will end up stored on some computer.
I wonder what exactly "identity management in the 21st century" (from the first quote) is? I got the impression that for the most part no-one will be *able* to manage their own identities anymore with a central government database...
In the U.K. we have a travel card system for London. It is called the Oyster card and is based on the Phillips MiFare RFID card. The entire system was apparently designed by an organisation called Transport for London (TfL) which is run by the "London Mayors Office".
The current Mayor of London (Ken Livingston) pushed through getting free transport for children and students. "Uncle Ken" is also known to be an ID and security nut / nightmare and in 2003 won "Big Brother Award in the Worst Public Servant category",
Above the age of 11 you have to use an Oyster card, which has your photo on it.
Amongst other things the card stores the last 25 journies made and can be easily interogated by a hand held scanner (which appears to have no real security system).
London Transport are trying to get the cards also used as "cash cards" for small value purchases (and other more alarming mission creep ventures).
The U.K. Transport Minister actualy endorsed an idea to use these cards as ID cards for entering and leaving school and for buying food and snacks whilst on the premises.... And also an further idea that when a child entered or left the school an SMS (mobile phone text) message be sent to the mobile phone of a "responsible adult"
Anybody see a problem with this idea...
Oh and the photo on the card is also stored in a centralised DB that numerous individuals have access to along with a record of all journies made on the card.
Anybody see a problem with this...
The Met Police have started to realise what a wonderfull resource this is as they can check to see who was (possibly) in the area when a crime is commited...
Anybody see a problem with this...
Oh and it has been sugested that the people who have access to this DB do not have to have their past checked.
Anybody see a problem with this...
And it is rumored that there is no loging of who accesses a record in the DB or when
Anybody see a problem with this...
And the people issued with the handheld readers work for indipendent transport organisations who usually subcontract "ticket inspection" to the lowest bidder. Again it is very unlikley that these "minimum wage" workers have had their backgrounds checked and again it is unlikley that an acurate record is kept of who read which cards and when....
Finally if you did not have a problem with the above if you take a look at Transport for London's Data Protection Register entry, you may wonder why exactly do they need to store such a large amount of your Personal Data like:
1) Personal Details
2) Family, Lifestyle and Social Circumstances
3) Education and Training Details
4) Racial or Ethnic Origin
5) Political Opinions
6) Religious or Other Beliefs Of A Similar Nature
7) Trade Union Membership
8) Physical or Mental Health or Condition
9) Sexual Life
Why would a Transport Organisation want these extremely sensitive Personal Data categories
Transport for London are, according to their Data Protection Register entry, apparently willing to hand over or sell this Personal Data to:
1) Traders in personal data
2) Private Investigators
3) The media
Apparently for an extra 200 UKP (400USD) a year you can have an anoynmouse card but I have been unable to confirm this....
So welcome to the London "gold fish bowl" where the London Mayor wants to sell your private life for a handfull of shekels....
Not that I think it's as it should be, but highschools are already more like penal institutions than places of learning.
I really wish high-schools were more like universities.
When I was in high school, we had a setup quite similar to this (money in an account that requires ID to access). The cashiers never checked that the pictures matched, indeed, sometimes someone would loan his/her card to a friend who forgot his money. Even 2 seconds per kid, in a school of 1800, to check the photo ID translates into a man-hour of work. When you've got 2 hours to get 1800 kids through a line, (there were actually 3 or 4 seperate cashier lines in my school) 1 man hour is quite a bit of overhead..
When will supposedly non-totalitarian governments stop bullying their subjects ...err... citizens into accepting Big Brother nanny?
Coming from a culture where national photo IDs are commonplace, with one mandatory ID given by the government and two optionals given by the police (of which one is the passport), I know for a fact that entrusting a kid his own national ID is insane. Kids constantly lose their money, pens & pencils, and even toys at school, so what's stopping them from losing the ID?
From my school years, I recall few kids who haven't lost several possessions a year at school, and they're usually more motivated to keep track of their toys than of a plastic card. We also can't ignore the risk of leaving such an important item around the opportunistic petty thieves at school. We had some, and my school wasn't in a particularly poor area.
there is no photo on an Oyster Card.
But otherwise I share some of your concerns.
Spot on!! Dinnerladies will not check every photo. Furthermore since the card will inevitably be used for multiple purposes - swipe access for example - some photos will become defaced and thus cannot be used anyway.
I can personally say that the a culture of bullyingwas endemic in Scottish schools, at least since my day.
Read "A Tale Etched in Blood and Hard Black Pencil" by Christopher Brookmyer for a scarily accurate and highly amusing portrait of a provincial Scottish School in the 70s. (caveat its largly written in lowland Scots - some o use willnie unerstan it)
Oops, I missed the point that the photo ID being discussed here is not the same as the national ID. Sorry!
What are they trying to achieve with this? Clearly it might stop stealing-for-profit, but not all bullying is stealing-for-profit, it's also stealing as denial-of-service. The ID cards will have no practical effect on the latter.
I'm not accustomed to the american school system, but I'd imagine the follow scenario not too unusual:
Peter would rather eat his own homemade lunch/buy lunch from somewhere else today and therefore gives his food coupon to his friend John.
Well that ain't gonna happen any more is it then...
"there is no photo on an Oyster Card"
Not on the ordinary adult ones, but have a look at the ones issued to children and others entitled to free or discounted travel.
Also, not all bullying is stealing of any kind (whether for-profit or denial-of-service). My experience was that most bullying was just to be mean (i.e. with no tangible payoff to the bully, only social/emotional payoffs). Stopping kids from being mean is a pretty hairy problem though.
I have a problem with this statement, "... they should have to prove their entitlement to services." If the card is pre-paid, it is not an entitlement, they paid for it. I reckon the big problem is that so many young Brits think they are 'entitled' to have so many things, and some of them are sociopathic enough to just _take_ what they want.
I know it's the cliche, but how much bullying actually entails the stealing of lunch money? AFAIK, this *never* happened in my school. Bullying certainly did occur (as I can attest first hand), but it was entirely a matter of harassment, not theft.
So in my case, this effort would certainly not have solved the problem. But as noted above, it creates an opportunity for a denial of service attack, a new means of harassing other students.
It's not widely advertised (I failed to find anything on the tfl website) but it is possible to get an unregistered, pay-as-you-go Oyster card.
It costs two pounds extra, there's no protection if it's lost or stolen and you will be 'politely encouraged' when applying for/topping up the card to supply your name and address.
I suspect that you cannot use one of these cards if you also hold an oyster photocard, so your concern for the young is still valid.
Bullying is a complex problem with no easy solution. School districts that are proactive also spend hundreds of hours per case in time counseling both bully and victims, teaching anger management and conflict resolution courses, and working with parents to curtail domestic issues at home.
While I see privacy issues and the promotion of the "ID card culture" as definite problems, I believe the most serious issue here is that schools are trying to sidestep a very serious, and sometimes deadly, social issue by throwing ID cards (that cost $2 each to produce in bulk) at the problem.
Some UK pupils receive free school meals. This is a means tested benefit, dependent on the parents income, and is therefore an entitlement.
It's likely that one of the justifications for move over to the original swipe card system was to prevent these pupils from being discriminated against.
At my school, receivers of free school meals had to present a coloured cardboard ticket in lieu of payment. Whilst this did allow the poorer pupils to be identified, it also meant that the ticket could be sold on, at a discount, to a school friend. I could then go down to the local Fish & Chip shop for some proper food...
Bullying is about control.
The bully wants to lord of his minions.
The Government is just taking back what it rightfully sees as it's own perogative.
It is kind of ironic, isn't it?
The bullies will simply force someone to buy food, then hand it over to them.
This is a similar unexpected consequence of better car locks and alarms. The car thieves can more easily carjack: they force the driver from the car and take it. The crime changes from one of car theft to some type of robbery, usually armed.
"The correct response to strongarm robbery is punish the criminals with fines and imprisonment. Why do they allow bullies to commit crimes with impunity?"
Good God, Roy! Are you living in the dark ages? We don't punish criminals and bullies in the UK these days, they have their human rights, dontcha know? Besides, it's *society's* fault that they're such thoroughly nasty people. Obviously, we've all failed them, so it's the poor bullies and criminals who are the real victims - and who should be compensated according to the crime they've committed - and the victims who deserve to be punished.
I hope they come down on them hard - there's simply too many victims these days. String 'em up, that's what I say!
Probably cheaper just to serve meals for free...
"Instead they will teach the next generation that an ID card culture is 'normal', and that they should have to prove their entitlement to services."
Indeed. I felt the same way about the fingerprint ID proposals for school lunches in the US.
However, after reflecting on this a while, I've come to the opposite conclusion. The identity systems will be swallowed by a majority who follow without question but it is also likely to generate a new class of attackers who will learn from an early age how to skirt identity systems and sell their services in a bully market...
I guess that will be a great step, as this will reduce the ragging that takes place and that even sometimes lead to drastic results of some of the talented individuals.
"it is possible to get an unregistered, pay-as-you-go Oyster card"
Yes you can but as far as I can tell it's only for "Pay-as-you-go" travel not for monthly or annual season or concesionary cards.
I was told (confidentialy) it was possible to get an annual all zones card without having to register your details, but the assumption was you where going to "pass it around your family" etc which was why it would cost the extra 200UKP.
I did find out a couple of years ago it was possible to confuse the system by first getting a "Pay-as-you-go" Oyster card by paying the then 3GBP deposit at a corner shop, and then buying an annual season ticket on it at a place like Wimbeldon where the staff are not "London Underground" but South West Trains and did not bother with trying to force you to provide your details (and supprisingly accepted a PO Box as an address).
However when the card malfunctioned it was then that I discovered that they recorded every single journy into the central DB. Apparently this is supposedly to prevent fraudulant claims from Pay-as-you-go card holders, so I guess that gives them the excuse to hold the details for at least seven years...
So I decided that it was time to dump the Oyster and go back to the old cardboard annual season ticket from one of the Rail companies in an area I do not live in. But as it has had bad opperating problems it gives you back an "inconveniance rebate" at the end of the year so it's a bit cheeper...
The bad news is that TfL have decided they will pay for all rail operators in the London area to have Oyster card barriers installed in the next couple of years (and presumably push the cards onto London bound commuters). Apparently this is going to be well in time for the London Olympics and will cost (officially 19Million) around 25Million GBP.
This will prove interesting at most rail stations around London as they are effectivly unmaned most if not all of the day so for health and safety reasons the barriers would have to be left open. Or shock horror to the bean counters actually employ people to man them...
Oh and back in 2003 Tfl started running software on it's CCTV systems to spot "odd behaviour"
It appares that the IPSOTEK software has had some additions that tie the Oyster card info from the barrier to the time sync on the CCTV footage and can now do face recognition sufficiently well to be of "real use" in "survalence capability".
Apparently it can now do Facial / Gait / Posture recognition as well, and can automaticaly track people through a transport network like the London Underground.
It has been roumored that a modified version of the IPS was used to help find the London bombers.
There is more info on the system at,
Some banks in the US offer your picture on credit/debit cards, and I often notice clerks eyes quickly checking the picture on it and my face. Many places in the states will ask for your drivers license for using a credit card (to compare faces and names).
And when there is no longer a possibility of taking a student's lunch money, all other forms of bullying will miraculously dissapear. Glory be, it's a miracle! No more swirlies, pantsing or knocking books out of the hands of chubby, red-haired or otherwise different from the crowd kids.
To say that this will bring an end bullying is like saying that security cameras will eliminate all crime. Even if you can get past the arguments about the efficacy of the means, you are still addressing only a small portion of the stated problem. Taking lunch money is but one small portion of the bullying issue, and hardly one requiring such a drastic solution.
I too have a credit card with my photo.
If they ask for my driver's license, I refuse, referring them to my photo on the credit card. In this case, they've obviously not even seen the photo.
Funny, when I was in school, the bullies were just assholes, they never seemed too concerned with my lunch money, and certainly never tried to steal it. That never seemed to stop them from bullying anyone...
As an aside, more and more our legislative bodies seem to have turned (almost completely) into fire departments (much like I view the big Pharma-coms), thriving on and striving to treat the symptoms and not really too concerned with curing the disease.
It's truly a dangerous way to run a country, however, with all the things that have happened over the last decade, I wonder if I wouldn't be *more frightened should they *start trying to 'cure the disease'... more and more it seems as though the disease is really centered in the logic these people use when coming up with their ludicrous ideas on "what's best for everyone".
I have typically been a believer in Timothy C. May's quote "...technological solutions are preferable to administrative or legislative solutions." However, in this case, the technological solution seems to fail to address its intended use adequately; nor should children have to learn to accept "Patriot"-Act / Orwellian practices as the norm. I agree with the many other posts regarding the outrageous idea that some technological measure will bring about utopian society--it's not going to happen.
bds, I stand corrected about the card. The lack of personal responsibility just gets my goat. Bullies would be better behaved if their parents took control of them. Perhaps it's just where I live in the UK, but if your kid was being bullied and you went to their parent(s), they would just threaten you and/or assault you themselves.
The same thing happened at my school. People on free lunches simply sold their tickets.
Your post reminds me of once hopping over the barriers to get on the tube. I had a valid ticket, but we all know they don't work all the time. My tube was at the platform, I was late, I went over the top. Two police officers (possibly railway police, not sure, was too busy running for train) watched my actions and let me get on the train. I wonder if I was wearing jeans and t-shirt as opposed to a suit their attitude would have been the same.
Why don't they try issuing ID cards to bullies, and requiring that any bullies scan their cards and enter a PIN into a terminal before engaging in any bullying?
Then the school can impose strict limits on how much bullying will be tolerated, and exact severe penalties for unauthorized bullying.
Here in South Florida a middle school is using biometrics to identify students instead of an ID card. No comment on the security around the biometric information that the school is storing though.
In the UK, we already have biometrics in our school using a system called VeriCool. Its purpose is to enable cashless catering and registration. Recently, the fingerprint scanners got taken away for no apparent reason. However, if one is willing to search the company name and 23c3 in google... ;)
Biometrics in schools (and many other organizations) is frightening. Administrators, executives, and sysadmins justify a rationale for gathering biometrics... usually without understanding the potential negative consequences or considering how that very personal information will be stored, secured, or safeguarded. Or by whom. Or for how long. I concur with Under My Umbrella that privacy and security -- and bullying -- are people issues, not technology issues. The vast majority of executives, educators, government officials, and technology/security professionals I've dealt with in 25 years of privacy consulting just don't get it.
Biometrics are routinely being implemented without considering what will happen to the biometric info once the person leaves the sopecific environment. In the case of school children, combine the biometrics gathered by/for school with other data routinely stored electronically, and with predictive genetic engineering, and there's a whole generation that's at very real risk of losing their identities and any shred of privacy -- before they're old enough to understand what the issues are. The potential for mass data mining from a very early age is already fuelling identity theft.
For those who think sysamins and security professionals (as distinct from privacy professionals) understand what privacy is about, think again. Case in point: An IT security professional and sysadmin of the regional health agency in Calgary, Alberta, Canada, where "a laptop containing a database of more than 1,000 children in a mental health program was swiped from the home of a counsellor involved in the [mental health] program" (Nov06). That genius's interview (which was was aired several times) included the assurance that the information on the laptop is not the sort of information any thief would be interested in. Maybe not an identity thief per se.
The information included patient history and treatment details. Names, addresses, phone numbers, parent's information, medical and psychologica/psychiatric conditions, medication, treatment, etc., etc. The patients in the database were all children under 10 years of age.
As the privacy commissioner for the province reported after investigating the incident, "Encryption technology was NOT used and any motivated individual could access the data." Imagine that laptop being into the hands of a "motivated" pedophile. As I said, many technology/security professionals just don't get it.
"If staff at point-of-sale actually looked at photos on cards, banks would put photos on credit & debit cards. This was tried by a bank in the UK a few years ago, and abandoned because nobody examined the picture any more than they examined the signature."
That was my experience (in the US) when I had a credit card with my picture on it.
"Even pictures of the wrong gender were rarely noticed." A few years ago (but definitely after all the post-9/11 security measures were supposedly in effect), a British businessman flew to Italy and returned, only noticing when he got home that his passport was still in his sock drawer and he had traveled on his wife's passport. The news story didn't supply pictures of the couple, but even if they did look alike, obviously the immigration authorities of at least two countries hadn't bothered reading even the name
Posted by: Mr W
"""Instead they will teach the next generation that an ID card culture is 'normal', and that they should have to prove their entitlement to services."""
The only entitlement in question is whether they have money for lunch. Did I miss something or should I not have to prove my entitlement to goods and services using the debit cards I have ?
"""It's important that schools teach the right lessons, and "we're all living in a surveillance society, and we should just get used to it" is not the right lesson."""
Whereas the lesson that you cannot purchase things without money is a lesson that could be useful. After all, 100% of these kids will be getting a bank ATM card in a few years and a slightly lower percentage will be getting credit cards.
Are ATMs, with their photography of users, part of this evil network of surveillence also ? Or have you just gone off the deep end once again. You are after all supposing that some surveillence is going on in regard to what kids eat for lunch.
Part of the problem with asking cashiers to check IDs or look at the photo on the card is that it doesn't pay to do so. When I've done so and refused to accept the card, I've had a pissed off customer giving me stress. If I did so on even slightly shaky grounds, the manager might not back me up. Accepting the card gives me no problem and I will probably never hear anything about it if I'm wrong.
Most minimum-wage employees want to avoid fuss, and have to deal with the fact when they tell a customer no, half the time the manager will reverse them if the customer complains enough. It's a thankless poorly paying job, and expecting them to make decisions that's going to annoy people is unrealistic.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.