Is it safe to use students' thumbprints to pay for lunch?

Fifth-grader Quinlan Bobeczko didn't fumble around for a meal card, a smartphone app or cash when it came time to pay for his lunch at Harrison Street Elementary School.

Like the other children at the Geneva school, Quinlan stepped up to a cashier and placed his thumb on a scanning device smaller than a television remote control matched to a prepaid lunch account - and off he went to get his chicken tenders.

“It's good, because you don't have to carry your own money or anything like that,” Quinlan said shortly after receiving his meal in the bustling gymnasium that doubles as a lunchroom. “It's just there. Your thumb is easy, because you just have to put your thumb on (the device).”

Harrison Street Principal Brenna Westerhoff also is a fan of the system.

“As a parent, I love it,” she said.

Convenience and speed are cited as among the advantages of the biometric system popularized by Geneva-based PushCoin Inc. at a small but growing number of suburban schools.

Harrison Street Elementary is part of Geneva Unit District 304, which replaced another biometric payment system with PushCoin in the 2014-15 academic year. Officials from Lake Zurich Unit District 95 and East Maine Elementary District 63 in Des Plaines cited District 304's positive experience with PushCoin in hiring the company in February and March, respectively.

District 63 intends to start gradually replacing meal cards with the thumb scan option this month, spokeswoman Janet Spector Bishop said. District 95 board President Doug Goldberg said the biometrics will be available to replace student identification or cash to pay for food starting in 2016-17.

Goldberg said facets of everyday life already can involve biometrics, such as logging on to a personal computer.

“I will tell you that many of the kids aren't very good about keeping track of their ID cards,” Goldberg said. “And so moving to biometrics was felt to be sort of the next generation of that individual, unique ID. We'll record their thumbprints, there will be thumbprint readers at all the cash registers, and they'll simply come by and - bang - hit their thumbprint. It makes it faster and, also, there's a lot less opportunity for any kind of misuse or fraud when they're using biometrics.”

Maybe so, but the concept is raising concerns for a leading civil-rights organization and child psychology experts who say it's an intrusion of a child's privacy and further conditions them that it's OK to give up personal information.

“We're getting so used to giving up data about ourselves,” said Laura Kastner, a professor specializing in child psychology.

How it works

PushCoin Chief Executive Officer Anna Lisznianski, a District 304 parent, said biometrics help schools trying to manage lunch periods as short as 25 minutes for hundreds of students pouring into a cafeteria.

“With more busy parents relying on schools to provide meals to their children, more and more schools seek a balanced solution to crowded cafeterias,” Lisznianski said.

Parents connect to an online account that's deducted as their children use the touch identification for lunch purchases. If parents choose to have the highest level of information emailed to them about their children's lunches, they'll get an email immediately after a transaction showing how much was spent on lunch, what was purchased, calorie counts and other nutrition facts.

Lisznianski said PushCoin is more secure than traditional biometric systems because it does not store or transmit fingerprint patterns received from students. Instead, the biometric sample is immediately converted to a short, digital code.

PushCoin deletes thumb-scan data 120 days after its last use, including backups, she said. Information for withdrawn or graduating pupils is removed immediately.

Cashiers are trained to pay attention to a student photo that appears on a screen after the thumb scan, Lisznianski said, because the low-quality fingerprint images that go into the system means there likely will be a false positive match with at least one of 1,000 random users.

Districts generally pay a per-transaction fee not to exceed 1.5 percent of lunch sales to PushCoin. The company provides the scanners, monitors, stands and other equipment for the school cafeterias at no additional cost.

Parents may opt out of having their children use the thumbprint scan to buy lunch at enrollment time, and payment cards can be issued to families not using the system, said District 304's technology network manager, Victoria Fladung.

Other schools on board with PushCoin's thumbprint system are Wheaton Academy, DeKalb Unit District 428 and River Bend Unit District 2 in Fulton.

Less privacy?

Despite the security assurances, Ed Yohnka, a Chicago-based American Civil Liberties Union spokesman, said parents should question the idea of their children paying for a school lunch with a thumbprint scan.

Yohnka said the ability of law enforcement to subpoena fingerprint images from a vendor, such as PushCoin, is one potential drawback. He said such an instance could occur if police are trying to learn whether a student was involved in a crime.

Also, encouraging students to use their thumbs to buy lunch is not a good long-term lesson for them regarding the importance of privacy, security and protecting personally identifiable information, he said.

“I think it undermines the notion of really thinking about the importance of your biometrics as a matter of privacy,” Yohnka said. “I think in this age, when so much is available and so much is accessible online about us and there is all of this information that floats out there, to begin to include in this one's biometrics, it really does raise some legitimate concerns.”

Sharing Yohnka's concerns are Lake Forest College Associate Professor Naomi Wentworth, who also specializes in child psychology, and Kastner, a University of Washington clinical professor in the psychology department and the department of psychiatry and behavioral sciences.

“At some point, Big Brother is going to have a lot of information on us and where is that going to go?” Kastner said. “And that's just for parents to consider. But from a kid point of view, they have no idea what they're giving up and, once again, the slippery slope in what's called habituation.”

Wentworth said parents need to explain in detail to children a decision to allow their thumbprint images to be stored for use in a school lunchroom, or why they choose not to do it.

Kastner, a lecturer and author whose latest book is “Getting to Calm - The Early Years,” said she's unsure whether most parents know what they're giving up if they allow a child's fingerprint to be used for school transactions they can't control in the cyber universe. She urged parents to be activists and research the fingerprint technology because it may not be in their children's best interest to allow it.

“If we make it easy to use in the lunchroom, it's going to be easy to use on the laptop or whatever,” Kastner said.

The concept is not new and it's used elsewhere in the country, Yohnka said. The ACLU is not aware of widespread use of biometric systems in Chicago-area schools, he said, but it has raised privacy concerns in other cities.

He noted public resistance to a suburban government agency's attempt to use biometrics occurred as far back as 2005. That's when privacy and confidentiality concerns arose in a controversy over Naperville Public Library's plan to require computer users to log in using a fingertip scan. Officials dropped the system, citing software compatibility problems.

Lisznianski disputed the idea of privacy invasion and said her company's system was designed with security in mind. For example, she said, law enforcement agencies would not find the fingerprint images collected by her company to be valuable because they purposely are not detailed.

Fladung said District 304 parents have not raised privacy questions and just a few of the system's roughly 6,000 students don't use the touch ID.