Hmmm, am I still not a number?
The Government last week confirmed that the UK's planned ID card is intended to operate as a 'passport lite' (http://www.theregister.co.uk/2005/07/08/id_card_as_passport/) that could be used for travel within the European Union, and signalled that Home Office thinking may be moving towards the use of a PIN as a common mechanism for verification. The card's operation as a passport, said Under Secretary of State Andy Burnham, dictates that it will need to use ICAO standard RFID contactless reader technology, while use of chip and PIN would allow it to be compatible with banking and retail systems.
That means, he said, that it could function both as a contact and contactless card. PIN would also provide some measure of protection for internet transactions, but on its own, no more than that of a credit card. Nor is it immediately obvious what kind of transaction an ID card holder might want or need to conduct via the national chip and PIN infrastructure. There are however possible advantages for the Government in using the commercial chip and PIN network, not least of these being that audit trails would be far more extensive, providing a far more detailed picture of the user's movements.
The Government's view that the passport lite aspect of the card requires that it have a contactless capability however has interesting ramifications.
ID cards are already used for identification at border crossings in Europe, and the UK Presidency called for common standards (http://www.theregister.co.uk/2005/07/13/uk_eu_id_proposal/) on ID cards within Europe just days after taking office. The UK's call for common standards to "ensure that data stored on Identity Cards is appropriately protected but can be read by other Member States" is however some distance from receiving proposals for, and deciding on, those standards.
Nor is it clear that contactless ID card readers to ICAO standards will be accepted across the whole EU, that Member States have the intention of using such readers, or whether it is even feasible to use them on a Europe-wide basis. Statewatch reports (http://www.statewatch.org/news/2005/jul/09eu-passports-id-cards.htm) (while also challenging the legality of the EU's ID card moves) that governments have been sent a questionnaire asking what checks and equipment they intend to install at borders, and whether they intend to carry out one-to-one or one-to-many checks.
The primary purpose of these readers, if they're installed at all, will be to check passports, and if appropriate common standards for ID cards are agreed then it may make sense for member states which use contactless readers to check passports to also use them for checking ID cards. This isn't quite what one might understand from Burnham's claim that current plans to use ID cards for European travel mean that "the card will need to meet standards established by the International Civil Aviation Organisation (ICAO), which require the card to be contactless in order to be considered a valid travel document."
As the European Union can (and does) decide what can be used as a "valid travel document" within its own borders, and is the body responsible for doing the considering here, one wonders what ICAO has to do with the matter. Designating national ID cards as travel documents could of course be part of a cunning plan to get around the legal difficulties Statewatch puts forward.
At the moment, however, the UK has decided on an interface standard for its own ID card scheme based on the assumption that there will be a standard EU ID card, that this will be a standard passport lite, and that it will conform to an international contactless passport standard that is readable globally. Having decided on this standard, it will then make obvious sense for the UK to use ICAO-standard contactless technology for readers within the UK as well.
The security implications of this have been well trampled in respect of passport use, but if - as the Government hopes - ID cards are used widely within the UK, the potential for security breaches will obviously be greatly increased. As indeed will other opportunities. Wouldn't it be handy if, say, the local housing office knew exactly who you were the moment you walked through the door, and had your file on screen ready by the time you reached the counter? No? Perhaps not...
Because of the nature of the technology, there will be a risk whenever the card is being used for identification, rather than solely when it is being 'officially' read via its contactless capability. For most purposes this capability is unlikely to be needed.Burnham says that the forms of verification currently being considered are "card, PIN and biometric identification", i.e. whether the picture matches the face, whether the bearer can enter the PIN and whether the biometrics of the person match either those on the card (local check) or the National Identity Register (online check). These forms of verification are being discussed with "various organisations who would be potential users", and the discussions cover "what performance is acceptable".
The discussions have not yet reached a conclusion, but it seems perfectly possible that the Home Office's vaunted scheme, protected by magic biometric technology, will in most cases operate as picture ID or a pin-protected card, which are the options least likely to add to cost and inconvenience to interested organisations.
In those cases where a biometric check is used, the Home Office has been considering measures that could be employed to combat spoofed biometrics. Burnham didn't give an answer on the use of contact lenses to fool iris recognition, but said that methods to deal with faked fingerprints could include "selecting a random finger for verification, from those available, rather than using only one fingerprint on all occasions. This also gives flexibility around issues arising from short term damage to fingers, such as a cut." This interesting idea, one notes, would inevitably add greatly to delays, confusion and failure rates at border checkpoints, and prove discouraging to commercial organisations considering using the more secure (allegedly...) biometric check.
One of the bodies the Home Office is consulting on biometric security issues is GCHQ's Communications and Electronic Security Group. We note that this organisation's FAQ (http://www.cesg.gov.uk/site/about/index.cfm?menuSelected=7&displayPage=7#applications) currently includes this categorical statement: "There are currently no approved biometrics applications, and we do not expect any to be available in the near future as none of the technologies have yet, in our view, reached the stage where we would be happy with them as the sole access control mechanism." Have they told the Home Office?
While they're about it, they might care to discuss the use of single identification numbers, where the Home Office's views seem somewhat underdeveloped. Asked what assessment of the risks posed by the use of a single national identity number had been made, Burnham replied that an "extensive risk assessment of the use of a single identifying number has been conducted by experienced fraud and security experts. This has resulted in the selection of a new single identifying number that is unrelated to any number issued by the Government at the present time." So, the Government has assessed that existing identity number systems are too broken to use, and decided to invent a new, universal one instead.
It's worth noting that the Home Office's answers on issues of verification and security almost all lead to "the integrity of the National Identity Register" as a backstop. Thus, the "performance of one particular identifier or technology [which might be used in verification] is not the key determinant" because during enrolment a false match on one particular biometric "would be resolved by other biometric matches or by inconsistencies with the information held about the applicant and the record against which it had been matched." Which appears to indicate that the primary concern is for the data held by the Government to be solid, with the security offered to the user (which is surely the user's primary concern) coming a distant second or third. Similarly, supervision of enrolment would "reduce" (sic) the likelihood of fake biometrics being successful, and details of how the Government proposes to stop this becoming a simple key to ID fraud cannot be provided "in order to protect the integrity of the National Identity Register."
Effectively, it's a system which by design puts all of its eggs in one basket, and is dependent on that basket being made impregnable via measures which the Government will never reveal or discuss. Trust us...
Costings update
On which subject, the Home Office has published its promised rebuttal of the London School of Economics' report on ID cards. The Home Office document (available here) (http://uk.sitestat.com/homeoffice/homeoffice/s?docs4.Response_LSE_Alternative_Blueprint&ns_type=pdf&ns_url=http://www.homeoffice.gov.uk/docs4/Response_LSE_Alternative_Blueprint.pdf) has a very brief section on costings, which largely boils down to claims that the LSE used the wrong figures, and that the Home Office has access to other figures (which it still won't share with us) that justify its own costings entirely.
As William Heath points out (http://www.idealgovernment.com/index.php/weblog/comments/506/) at Ideal Government, "How the assumptions work comes down to whether you trust the Home Office, its intentions, and its manner of doing business. Of course the Home Office has a self-image of itself as the good guys being hampered by a tedious liberties lobby in its fight against evil. It trusts itself. But it hasn't won many friends during all this process. The cause did seem to win Tony Blair as a convert. And there's a cluster of businesses hoping for patronage. But I've yet to hear of anyone won over by the arguments as put by the Home Office."
It's doubtful whether the Home Office rebuttal merits a rebuttal rebuttal, but now the wretched thing exists we face the tedious prospect of Ministers confidently claiming that the LSE study has now been thoroughly discredited. The LSE is preparing its response, but has told Kable (http://www.kablenet.com/kd.nsf/Frontpage/C58B389902899D6C80257046004D1037?OpenDocument) that the Home Office document contains substantial material errors and appears ot contain false assumptions about the LSE's alternative blueprint.--
dp
Posted
7/26/2005.
Comments:
Aravis says @ 6:50 pm
