Security experts say you need to protect your children’s biometric info.
You may see it at your child’s school, or online—a notice about setting up a child’s safety kit to help find your child in case of abduction.
But before you hand over your kids’ fingerprints and Social Security number, be warned—you could be creating more danger for your children, experts say.
The Identity Theft Resource Center put out an alert for parents, advising them to watch out for companies collecting kids’ biometric info in the name of security.
“If you, or your child’s school/daycare/afterschool program decide to use one of these third parties for Child ID Kit services, don’t assume that due diligence was done,” the ITRC site said. “It is up to you to look into that third party’s practices.”
Those practices could affect your children for the rest of their lives.
“Parents should always be skeptical of any organization asking to share your child’s most sensitive personal data online for any reason,” said Heather Dahl, CEO of CynjaTech, a technology firm that develops security and privacy applications for families. “Your child’s future will be at risk.”
Creating your kit
Some law enforcement and child advocacy agencies recommend parents have a child ID kit in case the worst happens, according to ITRC.
“As a parent, I see a definitive need to have biometric data available in the event of an emergency,” said Travis Smith, senior security research engineer at cybersecurity company Tripwire.
But what do you really need to put in that kit?
“If the parents decide to give data to a third party, they should consult with their local law enforcement to determine what information would be required to assist in the event of an abduction,” Smith told Archer News. “Any information requested by the third party not recommended by law enforcement should be scrutinized before being released.”
A recent picture and good description are crucial in case your child goes missing, the ITRC said, but sensitive documents are not.
“Information such as Social Security number, a passport number or a copy of a birth certificate will not assist in the search for a missing child,” the site said. “There is no need for this information to be included in a Child ID Kit.”
Fingerprints
You may want to include your child’s fingerprints in your kit. But they should stay with you, not with the company, the warning said.
In fact, the ITRC said if a company offers to collect and store your kids’ fingerprints or DNA, that’s a red flag.
“Biometric information is very sensitive and should be in the custody of parents,” the ITRC said. “Do not allow the company to retain a copy of this information.”
“Most of this data such as fingerprints are best kept in the security of your own home or an old-fashioned safe where they can be quickly accessed and shared with law enforcement in an emergency,” said Dahl.
Convenience?
Some child ID kit companies may tell you it is faster and more convenient to have them store the data. They may use scare tactics or high pressure sales tactics hinting that you are a bad parent if you do not use their program, the ITRC warning said.
But you do not want to make your child a more convenient victim for criminals.
“The primary danger is having someone steal your child’s identity, which is why it’s important only to provide the information necessary to aide in an investigation,” Smith said.
Child identity theft is considered to be one of the fastest-growing crimes, said Dahl.
“Kids’ identities are stolen over 50 times more than those of adults,” she said to Archer News. “We’re often so focused protecting our kids from so many threats in the real world, we forget that in cyberspace bad guys are stealing children’s identities to open credit cards, apply for loans, rent homes and even receive health care.”
“Bad guys make money by selling and reselling the same child’s identity over and over,” she added. “And they get away with it because parents don’t think about monitoring their son or daughter’s identity.”
“Why is this important?” Dahl asked. “Children could potentially lose out on future jobs, internships and loans that require a clean background check or credit report—all because they were victims of identity theft as kids.”
Biometrics
Losing your children’s Social Security number to thieves is problematic, but losing their fingerprints or DNA could be even worse.
“Since biometric data doesn’t change over a person’s life, it’s in the realm of possibility that the data can be used against them later in life as adults,” Smith said.
“In the future, biometric data will function as your kids’ passwords,” said Chase Cunningham, threat intelligence analyst and co-author with Dahl of The Cynja cybersecurity book series for children. “If it gets stolen, they are going to have an uphill climb to get their data back.”
“It is paramount to protect that data for the next generation,” he added. “Think about how hard our lives would be if all of our generation’s passwords and authentication data had been compromised before we ever opened our first account online.”
Red flags
You will want to watch out for companies offering to digitize your child’s biometric data and put it on a key-chain thumb drive, according to the ITRC warning.
“Carrying a copy of your child’s fingerprints on you at all times is not a best practice and is not endorsed by child safety professionals,” the alert said.
Some companies claim that they are endorsed by a law enforcement agency or that all of their proceeds go to a charity. But the alert recommended that some claims are false, and you should check with the agency or charity directly.
Security
You will also want to ask the company about how it protects children’s biometric information, cybersecurity experts advised.
“What security does the company have in place and what are they doing to insure that your child’s data stays safe?” said Cunningham.
“Ask if the data will be encrypted not only during the transfer process, but while it is stored,” Dahl said. “Ask about their policy in the case of a data breach. How soon will you be notified? Will they offer any compensation to help you remediate damages caused by the breach?”
“Where do they store the data?” she added. “What country’s laws will govern your child’s data? And when you no longer want to do business with this company, what is their policy on destroying your child’s data?”
“Never give away something you wouldn’t be willing to lose if they get breached,” said Cunningham. “Odds are it’ll happen.”
Out of business
The company may tell you it has excellent security practices. And it may actually follow the practices it claims to have. But if the company goes under, your child’s data may be in limbo.
“As far as going out of business, the major risk is liquidation of assets,” Smith said.
The company may sell off its computers—with your child’s biometric data on them.
“If data is stored unencrypted anywhere on their machines, the buyer of the hard drives has an opportunity to retrieve the data,” Smith said.
“The only hope customers have is that the company going out of business is encrypting the data and follows best practices to securely wipe any drives sold or donated after the business shuts its doors,” he said.
Decision time?
You will want to ask yourself some questions, too, experts say.
“Parents should be asking themselves—what is the net benefit of having a third party hold onto the biometric data of their children?” said Smith, adding that he could store the same data on a thumb drive at his house or somewhere like a safe deposit box at a local bank.
“The risk of storing the data online must outweigh the benefit of having that data readily available from a web browser or your mobile phone,” he said. “I know what my answer is, but that’s a question every parent must make themselves.”
“The question a parent has to ask themselves, would you just hand over your child’s biometric data to someone walking down the street?” said Dahl. “A company with a website is basically a stranger walking down the street in real life.”
Your child’s kit
The ITRC offers guidance on how to find a kit that doesn’t add to your child’s risk.
“Kits offered by credible organizations provide instructions so parents can update the kits themselves and keep them in a secure location in their home,” the alert said. It suggested the free kit from the National Center for Missing and Exploited Children, and the free FBI Child ID Kit available at the App Store for iPhone users.
If you feel you must digitize your child’s biometric data, Dahl said you need to do research.
“Get to know the company who is offering children’s identity kits like you would any person who you trust with your child in the physical world,” she said.
“But personally, I still wouldn’t provide my biometric data,” she added.
“The quick ‘convenience’ of having my family’s most sensitive data available is not worth the risk of having my family’s entire digital life destroyed when I can keep all of our data in the security of our home for easy retrieval,” Dahl said.