Sunday, September 03, 2006

Walt Disney World fingerprints visitors

Disney is now fingerprinting visitors to Walt Disney World as part of its ticket-fraud prevention scheme. They're not being very transparent about it, either: there are no signs posted about the data collection or retention, and Disney's official line is that they're not collecting fingerprints, just mathematical representations of same.

But those mathematical representations are exactly what you need if you want to join up two fingerprint databases, like Disney's and the NSA's -- while the NSA may store photos of fingerprints, they work with hashes of them, using those mathematical representations to compare and sort prints. Saying that you only store the mathematical representations of a fingerprint is like saying that you only store the mathematical representations of a JPEG, not the actual paint, canvas and frame that it depicts. It's true, but it sure doesn't mean that you haven't captured something important.

Now that our national immune system has begun to attack us in a terrible anaphylactic spasm -- indiscriminate NSA wiretaps, meaningless TSA security theater, secret aviation rules and no-fly lists, "free speech zones," suspension of habeas corpus and all the rest -- it's absolutely irresponsible to gather this kind of information and leave it where the savage toddlers of the national security apparat might find it and wreak havoc with it.

For me, the worst part of this is that it conditions us to get used to being treated like crooks. If you were asked for a fingerprint when you bought a doughnut, you'd rightly leave the store. Why should an amusement park get a walk?

For years, Disney has recorded onto tickets the geometry and shape of visitors’ fingers to prevent ticket fraud or resale, as an alternative to time-consuming photo identification checks.

By the end of September, all of the geometry readers at Disney’s four Orlando theme parks, which attract tens of millions of visitors each year, will be replaced with machines that scan fingerprint information, according to industry experts familiar with the technology...

However, the use of this technology has riled privacy advocates, who believe Disney has not fully disclosed the purpose of its new system. There are no signs posted at the entrance detailing what information is being collected and how it is being used. Attendants at the entrance will explain the system, if asked.

But Disney's Prunty downplayed privacy issues, saying the scanned information is stored "independent of all of our other systems," and "the system purges it 30 days after the ticket expires or is fully utilized." Visitors who object to the readers can provide photo identification instead – although the option is not advertised at the park entrance...

Coney fears Disney could share the fingerprint information. "If they maintain that data, it can be used for anything," Coney said. "If law enforcement shows up, they can gain access to it." Disney's privacy policy says that it may disclose personal information when doing so can help "protect your safety or security."

Link