MorphoWave

2021-2022

Jun 8

Earlier this semester, I noticed something strange at the SRC. My friend and I had met, as we do most evenings, outside the SRC for our usual workout. As we walked through the lobby, my friend passed her hand through a black plastic slot in a strange-looking machine, and the student worker at the front desk nodded her through while I waited for my OneCard to be swiped. When I asked her about it, she told me it was a new feature offered by the SRC and OneCard office called MorphoWave, which scanned all of your fingerprints and allowed you to bypass OneCard swipes or forgo bringing your OneCard to the gym altogether.

As someone who has been turned away from the gym on many occasions because I have forgotten my OneCard, I was intrigued. As a student suspicious of my University’s dedication to protecting my private information, I was less than thrilled.

I asked my friend if she felt comfortable with UNC storing her biometric data, and whether she thought they would share that information with the police if she were ever in trouble. She laughed and responded that she had no plans to break any laws anytime soon, so it was probably a moot point. This answer seemed to satisfy her, so I didn’t press the point, but I was left unsettled. How many students fully understood the gravity of their choice to give the University access to this information?

I decided to find out for myself. Posing as a student interested in MorphoWave but hesitant due to the novelty and opacity of the technology (a position I suppose is technically true) I reached out to the OneCard office. (Note: it is exceedingly difficult to find information on any UNC website about MorphoWave, so I had to ask the OneCard office directly for information on the program.) I sent the following letter:

Good morning!

I'm interested in enrolling in MorphoWave, the new touchless technology that allows me to enter the UNC gyms without having to scan my OneCard. I was directed by the SRC staff and website to contact the OneCard office to schedule an appointment to add this information to my OneCard account. I'm interested in enrolling, but I was hoping to get a little more information about how my biometric data would be stored and how long the University would keep this information on file, as well as who would have access to this information before it is deleted or otherwise disposed of (presumably sometime after/when my OneCard access around campus expires.)

Could you please provide me with this information so I can decide if opting into this system is right for me? It would make my life a lot easier, but I want a little more information before I enroll.

Thank you so much,

Anna Fiore

And I received this reply:

Good morning,

Thank you for your email. I have enclosed some information on the process for you to review. If you decide that you would like to sign up, then you are welcome to come by the office anytime during our office hours. Please bring your One Card with you.

All the best,

[Helpful OneCard Office Employee]

[insert pdf here]

As you can see, this is not much information. However, it is important to note three things:

The data is stored on the Morphowave device itself, in an “AES 128 encrypted database” This is a form of encryption that transforms information 10 times to convert plaintext into ciphertext. If you would like an idea of what that means for your security, it is “approved by the National Security Agency (NSA) to protect secret but not top-secret government information.”
The OneCard office did not actually answer the majority of my questions. Although that pdf lets you know that “images, once translated to templates, are discarded and not saved,” this refers to the images that MorphoWave captures to match your fingerprints to the template they keep on file. There is no mention of how long that information is stored once it is encrypted, nor what the “proprietary templates” and “proprietary algorithm” are.
There are asterisks that presumably signal there is more information or a caveat after the assertion “Fingerprint images are not stored at enrollment or matching stations.**” The OneCard office did not share this further information with me.

Although I could have directly inquired further, I wanted to see what information the OneCard office would provide a student who asks for more information about their biometric security, which is already a step up in inquisition from all of the friends I have spoken to who opted into the program. I inquired further by doing my own research into MorphoWave and IDEMIA, its parent company, as well as potential data breaches associated with their company and legal liability for organizations that improperly store biometric data.

My problem is not necessarily with the technology itself, or the security of the biometric storage (although these are a concern given law enforcement’s ability to use biometric data in criminal proceedings and security concerns following Russia’s increased hacking efforts following US resistance to the invasion of Ukraine) but is instead rooted in the tendency of UNC to encourage students to be comfortable with higher levels of surveillance. Some of this is rooted in pandemic security, but much of this is the University’s tendency to manufacture consent for increased surveillance and decreased privacy for students.

This aspect of MorphoWave is more troubling than the physical intrusion of the technology, primarily because MorphoWave still operates on an opt-in system and does appear to use relatively secure technology. MorphoWave is emblematic of the University’s intrusion on the rights of students, not just physically but psychologically. Just like the mask-monitoring stations at the entrances of libraries and dining halls, they do not necessarily intrude themselves, but instead make students accept intrusions into their privacy as daily, normal, and even necessary. The University keeps pushing the ticket, testing our boundaries, and seeing how much they can get away with before we rebuke their advances. I believe the time to intercept is now, while our privacy is still relatively intact. Don’t opt in to MorphoWave. Email your Deans and the Director of Student Life and Leadership, and complain about the daily intrusions on your privacy. Establish boundaries with the University for yourself and the students that come after you.

Sources:

UNC Rec website on MorphoWave: https://campusrec.unc.edu/members-services/morphowave/

IDEMIA’s information:

Security concerns:

Legal issues, including a stat that improperly stored biometric data costs the company $1,000/person/day:

FutureSecurityPrivacy

Anna Fiore

Anna Fiore is a senior studying Philosophy, Peace War and Defense, and History. She is currently working on an honors thesis that explores the ethics of paternalism and radical thought. She enjoys hiking, painting, and spending time with her friends, who she is lucky enough to live with for her final year at Carolina.

MorphoWave

(Oppression) Olympics Winter 2022: A Blasian Woman’s Manifesto

The Ethics of Male Makeup

Parr Center Undergraduate Fellowship Program