CARIBOU, Maine – A Maine civil rights group has criticized the Caribou school district and a biometric education technology company for their handling of a failed contract, saying that both entities did not clearly lay out plans for protecting student data.
In January, Caribou High School Principal Jamie Selfridge announced that the school would begin using a biometric finger scanner from Pennsylvania-based identiMetrics to track student attendance data more efficiently. Regional School Unit 39, which covers Caribou and Stockholm, reversed that decision in February after parents raised concerns about data privacy and the American Civil Liberties Union of Maine requested all communications between district leaders and identiMetrics.
This week, ACLU of Maine published on its website over 200 pages of documents related to the contract outlining what it sees as unclear guidance from identiMetrics on how to protect students’ private information. In its report, the ACLU states that the proposed contract “explicitly contemplates the idea of the company possessing” student information “without any explanation of why, how it would store the data, if it could sell this data.”
Biometrics typically refers to technology that identifies human features to unlock devices, including facial, eye or fingerprint recognition. While biometric data is more difficult to breach than passwords and identification cards, it’s impossible to change that data after a cybersecurity hack, according to the World Economic Forum.
For that reason, the ACLU wanted to know more about identiMetrics.
“Any time [biometric] information is collected, it must have strong security protections,” said ACLU of Maine Communications Director Samuel Crankshaw. “The risk of identity theft, stalking and other harms increase when companies store data for longer periods of time.”
The ACLU criticized RSU 39 for considering spending $5,135 for installing the biometric scanner software and $2,460 to maintain the software subscription annually starting in the second year. They also expressed disappointment that the district would not consider a non-biometric way of recording attendance.
RSU 39 superintendent Jane McCall said that district teachers already use a non-biometric website called PowerSchool for attendance.
In the proposed contract between the biometrics company and RSU 39, identiMetrics CEO Raymond J. Fry states that his company would follow all federal and state laws aimed at protecting student data and would not have sold or controlled student data. In RSU 39’s proposed privacy policy, all students’ records would be disposed of after they graduate.
“Students’ IDs are stored behind the school [computers’] firewalls and nothing is stored in the cloud,” Fry said. “We follow the same laws that protect students’ grades and health information.”
Launched in 2002 and based in Jenkintown, PA, identiMetrics was founded by Anne Marie Dunphy, a former teacher and investment banker, and Fry, a former school principal.
The company has contracts with several thousand school districts in 48 states, which Fry declined to identify Wednesday due to privacy concerns. None of those schools have seen their student data breached, Fry said.
Materials that identiMetrics provided to RSU 39 throughout 2023 and early 2024 state that biometric finger scanning machines are not fingerprinting machines, the latter of which police departments typically use.
Instead, students scan their left and right index fingers on a pad attached to a biometric scanner. The machine does not store the entire fingerprint but identifies a few key features, such as sweat pores or a spot where lines intersect, and creates a single ID for each student, Fry said.
“It stores the students’ first and last name, middle initial and ID number that they already use for their school records,” Fry said.
When he worked as a school principal, Fry often saw students lose their paper identification cards or struggle to find them in the cafeteria, which held up long lines. Students who showed up late in the morning also had to wait if one staff member was in charge of giving them handwritten hall passes, Fry noted.
“The best solution was to make the lines go faster,” Fry said. “Many of our schools [who use identiMetrics] are smaller districts who are short staffed. The [finger-scanned] IDs are sent directly to the cafeteria workers in one and a half seconds.”
Had Caribou High School purchased identiMetrics software, not every student would have had their fingers scanned each morning, McCall said. With nearly 450 students, doing so would have slowed down students as they headed to classes.
Teachers already use PowerSchool to record class attendance throughout the day, which Fry said is compatible with a biometric finger scanner. Since the district’s internet firewalls already protect PowerSchool, that made administrators confident that identiMetrics would not compromise student data, McCall said.
Caribou High wanted to add identiMetrics primarily to better track junior and senior students who are allowed to leave campus during their lunch period. If students were late in the morning, the finger scanner could have made tracking tardies more efficient for staff and helped students get to class faster, McCall noted.
“Our teachers would have continued taking the usual attendance through PowerSchool,” McCall said.
McCall said she does not anticipate the district considering biometric software in the near future due to parents’ concerns and many parents’ choice to opt their children out of the scanning. Administrators have not communicated with identiMetrics since choosing not to purchase their software, McCall noted.
In their statement, the ACLU of Maine criticized identiMetrics for giving school administrators advice on how to respond to parents’ concerns. Fry said it is typical for the company to explain biometric software to people less familiar with using the software in schools.
