Identity Cards in the UK Dr Edgar A. Whitley [email protected] Reader in Information Systems Information Systems Group, Department of Management London.

Identity Cards in the UK

Dr Edgar A. [email protected]

Reader in Information SystemsInformation Systems Group, Department of

ManagementLondon School of Economics and Political Science

Research coordinator: LSE Identity Projecthttp://identityproject.lse.ac.uk

Identity Cards in the UK

Where have we been? Where are we going?

Timeline to current situation

First World War

• Register of population 15-65• Prelude to military and industrial

conscription• Loss of interest when Register

reported 1,413,900 men in England and Wales were still available for National Service

Second World War

• Second National Register– Co-ordinating national service, national

security and administration of rationing• 1950 Clarence Willcock stopped by

police and asked to show ID card• Lord Goddard: “to demand a card from

all and sundry … is wholly unreasonable”

• 39 agencies were using card for various purposes when it was abandoned

2002 Efficient public services

• “After the terrorist atrocities in the United States on 11 September 2001, I was asked whether the Government was considering introducing identity cards. I said at the time that any debate about identity cards should not centre exclusively on issues of national security. Far more important are the issues of citizenship and entitlement to services and it is in this context that I would like to see the debate unfold.” David Blunkett

Consultation

• On plans to create an ‘entitlement card’ that allows citizens to gain access to public services

• Substantial commitment to some form of identity card, a term the public preferred to the term ‘entitlement card’

2004: The Bill Version 1

• Identity Cards Bill published 29 November

• Ran out of time in Parliament and effectively fell in March 2005

2005: Labour Manifesto

• “We will introduce ID cards, including biometric data like fingerprints, backed up by a national register and rolling out initially on a voluntary basis as people renew their passports”

Design of the scheme

• National Identity Register• Use of biometrics: face, finger, iris• Online verification: done everywhere• Audit trail of verifications• Use by and payment from the

private sector• Paid for by the public

Multiple purposes

• Must prevent identity theft• Must prevent terrorism• Must be in accordance with

international obligations• Must be designed by the Home

Office• Must enable e-government and

access to government services

2005: The Bill version 2

• Reintroduced after General Election

• First reading May 2005

The LSE Identity Project Main report: 27 June 2005

• Evaluated the impact of identity cards on national security, organized crime and terrorism; policing; race, discrimination and immigration; and identity fraud.

• Reviewed the use of biometrics, the security and safety of the National Identity Register as well as international obligations on identity documents and the legal environment in the UK.

• Considered issues of public trust and the government IT environment in the UK

• Presented an alternative blueprint for identity management in the UK

LSE analysis not popular

• “Some of the figures banded around about cost are absolutely absurd”- Tony Blair

• Mr Clarke said it was “technically incompetent” and contained figures that were “simply mad”. He accused the LSE of running a campaign against ID cards. - Times Editorial, July 3, 2005

After Parliamentary debate

• Legislation is passed March 2006– Scheme virtually identical to 2002 model– Amendment on cost reporting (s37 report)

• New agency: UK Identity and Passport Service launched on April 1st 2006

• James Hall (ex Accenture) appointed Chief Executive October 2006

Formal reviews

OGC Gateway reviews

• Gateway Review 0: June 2003 • Gateway Review 0 (strategic

assessment): January 2004• Gateway Review 1 (business

justification): July 2005 • Gateway Review 0 (strategic

assessment): January 2006 • Gateway Review 2 (procurement

strategy): April 2006

KPMG

• Cost Methodology and Cost Review– Outline Business Case Review

• Extract published 7 November 2005– “We conclude that the methodology

used to cost the ID Cards proposals is robust and appropriate for this stage of development”

Parliamentary comment

• “We are not saying that we can go from what we have now to a database covering 60-odd million people overnight, hoping and praying that the IT and the procurement will work and that everything will be successful. We have learned the lessons of the past, and this project has to be rolled out on a phased basis” Tony McNulty 18 October 2005

• “Projects such as this will always face such challenges and opinions in the field of technology will differ. However, the body of representations within industry, existing project experience and research by established experts in the field of biometrics and database technology indicate that we are right to proceed with our plans at this stage” Baroness Scotland 31 October 2005

• “The scheme has been through a series of gateway reviews, and … that directly builds on experience learned from past failures. Some of the people involved in the process have been involved in other major public and private sector procurement. … Obviously, they have clearly learned the lessons and know exactly what they are doing now” Andy Burnham 13 February 2006

• “I cannot comment on a hypothetical problem. I am not anticipating something major that would completely delay or derail the programme. I would like to reassure the committee that nothing is more important than getting this right” Joan Ryan 14 June 2006

Procurement process starts immediately …

Leaked emails: Sunday Times 9 July 2006

• “Also even if everything went perfectly (which it will not) it is very debatable (given performance of Govt ICT projects) whether whatever TNIR [The National Identity Register] turns out to be (and that is a worry in itself) can be procured, delivered, tested and rolled out in just over two years and whether the resources exist within Govt and industry to run two overlapping procurements”

Continued

• “What benchmark in the Home Office do we have that suggests that this is even remotely feasible? I conclude that we are setting ourselves up to fail” Email from David Foord, OGC Sent 8 June 2006

• “I am not anticipating something major that would completely delay or derail the programme” Joan Ryan 14 June 2006

• “I conclude that we are setting ourselves up to fail” David Foord 9 June 2006

More reviews

• John Reid: Full scale review of all Home Office operations

• “In December, the Government will be publishing plans for the introduction of the National Identity Scheme which will provide more detail on the contribution which existing assets could make to the delivery of the scheme”

Sir James Crosby

• Chancellor appoints Sir James Crosby to lead Public Private Forum on Identity– Reports back April 2007

• James Hall: IPS procurement will start “next summer”

A radical redesign?

• “The review identified that there may be existing technical infrastructure and systems that could be used as the basis for reducing the delivery and cost risks associated with the identity card project”

• “I did not mean to imply that a solution might involve stringing a number of legacy databases together. That has never been part of this proposition. We have always said that our requirements are for a data repository that could be populated one record at a time” Katherine Courtney

• “A change in the way in which the scheme is to be phased in would require considerable reworking of the current identity cards business plan and procurement strategy. This would create further delay in the programme and so could add to costs” Baroness Scotland

Biometrics

Testing biometric technology

• “The goal of the …Trial was to test the processes and record customer experience and attitude during the recording and verification of facial, iris and fingerprint biometrics, rather than test or develop the biometric technology itself—it was not a technology trial. We will be undertaking further trials and testing in due course but do not have any immediate plans for further trials at this stage”

• “We anticipate piloting the recording of fingerprints as a second biometric from volunteers in late 2007. This prepares the UK to match mandated EU standards for both fingerprint and facial biometrics for Schengen area passports”

Biometrics in s37 report

• Discussion of expanding fingerprinting

• No explicit mention of iris scanning

Likely future problems

Departmental buy-in

HMRC

• has, in consultation with the identity cards programme, developed its current best estimate of the costs and benefits of using the ID cards scheme to enhance its services and these have been incorporated into the business case

DWP

• has, in consultation with the identity cards programme, developed its current best estimate of the cost of using the ID cards scheme to support the services which it oversees and these costs have been incorporated into the business case

• “They are not running to us with cheques” – Andy Burnham

• Public sector buy-in as part of Sir James Crosby’s Public Private Forum on Identity Management

Verifications

• Cost of verification– Base case £0.57– Least appealing £2.00

Biometric or PIN verification?

• “Biometrics are being used to more strongly tie a verified identity to an individual. In this way, biometrics can be used along with an ID card to verify that identity against the record held for that card. Other forms of authentication, such as PIN numbers and passwords can be stolen along with a card so are much weaker at linking a person to an identity” Andy Burnham

Liability

• Society will depend on the integrity of the system– to establish the eligibility of each party

to conduct a transaction– to assign the limitations of liability in

the event of a failure

• Government proposals are currently ‘unclear’ on this point

Security issues

Security issues

• Flash and go verifications

• Confidence in the security and integrity of the system– August 2006: Office staff in the Home

Office had breached the security of the passport database. Such problems would not arise with the identity cards database as this would be a ‘completely different’ system

Scope shift

• 2005 International obligations– “US visa waiver scheme requirements

for passports to contain a facial biometric from October 2006”

– “EU mandate of both facial biometrics (August 2008) and fingerprints (2009) for Member States’ passports within the Schengen area”

• 2005 Terrorism– John Humphries: If we'd had ID cards, it

would have made no difference yesterday (July 7 2005), would it?

– Charles Clarke: I doubt it. I doubt it would have made a difference, and I've never argued and don't argue that ID cards would prevent any particular act.

• 2005 November: Identity fraud– Up from £1.3 billion in 2002 to £1.7

billion in 2006– Including £400 million “not included in

the 2002 study– ”The figures reveal that, rather than

shooting up, losses from credit and debit card ID theft fell by 7% during the six months to June 30—from £16.1m to £15m” November 2006

• 2006 November: Illegal immigration– Companies are expected to verify the

legal status of employees and can face large fines for employing illegal workers

– 23 prosecutions under the Asylum and Immigration Act between 1999 and 2003

– Home Office used a firm that supplied five illegal immigrants who worked as cleaners at the Immigration and Nationality Directorate

• 2006 November: ‘Modernity’– “We need ID cards to secure our

borders and ease modern life. … The case for ID cards is a case not about liberty but about the modern world”

– Intellectually, technological determinism seemed to us to reduce the intimate intertwining of society and technology to a simple cause–and–effect sequence

Multiple purposes revisited

• Must help prevent identity theft• Must help prevent terrorism• Must be in accordance with some

international obligations• Must be designed by the Home

Office• Must enable e-government and

access to government services

It is currently planned that the first identity cards for UK citizens will be issued

from 2009

Further information:

http://identityproject.lse.ac.uk