Identity Cards in the UK

1
Identity Cards in the UK

• Dr Edgar A. Whitley
• e.a.whitley_at_lse.ac.uk
• Reader in Information Systems
• Information Systems Group, Department of
  Management
• London School of Economics and Political Science
• Research coordinator LSE Identity Project
• http//identityproject.lse.ac.uk

2
Identity Cards in the UK

• Where have we been? Where are we going?

3
Timeline to current situation
4
First World War

• Register of population 15-65
• Prelude to military and industrial conscription
• Loss of interest when Register reported 1,413,900
  men in England and Wales were still available for
  National Service

5
Second World War

• Second National Register
• Co-ordinating national service, national security
  and administration of rationing
• 1950 Clarence Willcock stopped by police and
  asked to show ID card
• Lord Goddard to demand a card from all and
  sundry is wholly unreasonable
• 39 agencies were using card for various purposes
  when it was abandoned

6
2002 Efficient public services

• After the terrorist atrocities in the United
  States on 11 September 2001, I was asked whether
  the Government was considering introducing
  identity cards. I said at the time that any
  debate about identity cards should not centre
  exclusively on issues of national security. Far
  more important are the issues of citizenship and
  entitlement to services and it is in this context
  that I would like to see the debate unfold.
  David Blunkett

7
Consultation

• On plans to create an entitlement card that
  allows citizens to gain access to public services
• Substantial commitment to some form of identity
  card, a term the public preferred to the term
  entitlement card

8
2004 The Bill Version 1

• Identity Cards Bill published 29 November
• Ran out of time in Parliament and effectively
  fell in March 2005

9
2005 Labour Manifesto

• We will introduce ID cards, including biometric
  data like fingerprints, backed up by a national
  register and rolling out initially on a voluntary
  basis as people renew their passports

10
Design of the scheme

• National Identity Register
• Use of biometrics face, finger, iris
• Online verification done everywhere
• Audit trail of verifications
• Use by and payment from the private sector
• Paid for by the public

11
Multiple purposes

• Must prevent identity theft
• Must prevent terrorism
• Must be in accordance with international
  obligations
• Must be designed by the Home Office
• Must enable e-government and access to government
  services

12
2005 The Bill version 2

• Reintroduced after General Election
• First reading May 2005

13
The LSE Identity Project Main report 27 June
2005

• Evaluated the impact of identity cards on
  national security, organized crime and terrorism
  policing race, discrimination and immigration
  and identity fraud.
• Reviewed the use of biometrics, the security and
  safety of the National Identity Register as well
  as international obligations on identity
  documents and the legal environment in the UK.

14

• Considered issues of public trust and the
  government IT environment in the UK
• Presented an alternative blueprint for identity
  management in the UK

15
LSE analysis not popular

• Some of the figures banded around about cost are
  absolutely absurd- Tony Blair
• Mr Clarke said it was technically incompetent
  and contained figures that were simply mad. He
  accused the LSE of running a campaign against ID
  cards. - Times Editorial, July 3, 2005

16
After Parliamentary debate

• Legislation is passed March 2006
• Scheme virtually identical to 2002 model
• Amendment on cost reporting (s37 report)
• New agency UK Identity and Passport Service
  launched on April 1st 2006
• James Hall (ex Accenture) appointed Chief
  Executive October 2006

17
Formal reviews
18
OGC Gateway reviews

• Gateway Review 0 June 2003
• Gateway Review 0 (strategic assessment) January
  2004
• Gateway Review 1 (business justification) July
  2005
• Gateway Review 0 (strategic assessment) January
  2006
• Gateway Review 2 (procurement strategy) April
  2006

19
KPMG

• Cost Methodology and Cost Review
• Outline Business Case Review
• Extract published 7 November 2005
• We conclude that the methodology used to cost
  the ID Cards proposals is robust and appropriate
  for this stage of development

20
Parliamentary comment

• We are not saying that we can go from what we
  have now to a database covering 60-odd million
  people overnight, hoping and praying that the IT
  and the procurement will work and that everything
  will be successful. We have learned the lessons
  of the past, and this project has to be rolled
  out on a phased basis Tony McNulty 18 October
  2005

21

• Projects such as this will always face such
  challenges and opinions in the field of
  technology will differ. However, the body of
  representations within industry, existing project
  experience and research by established experts in
  the field of biometrics and database technology
  indicate that we are right to proceed with our
  plans at this stage Baroness Scotland 31 October
  2005

22

• The scheme has been through a series of gateway
  reviews, and that directly builds on experience
  learned from past failures. Some of the people
  involved in the process have been involved in
  other major public and private sector
  procurement. Obviously, they have clearly
  learned the lessons and know exactly what they
  are doing now Andy Burnham 13 February 2006

23

• I cannot comment on a hypothetical problem. I am
  not anticipating something major that would
  completely delay or derail the programme. I would
  like to reassure the committee that nothing is
  more important than getting this right Joan Ryan
  14 June 2006

24
Procurement process starts immediately
25
Leaked emails Sunday Times 9 July 2006

• Also even if everything went perfectly (which it
  will not) it is very debatable (given performance
  of Govt ICT projects) whether whatever TNIR The
  National Identity Register turns out to be (and
  that is a worry in itself) can be procured,
  delivered, tested and rolled out in just over two
  years and whether the resources exist within Govt
  and industry to run two overlapping procurements
  

26
Continued

• What benchmark in the Home Office do we have
  that suggests that this is even remotely
  feasible? I conclude that we are setting
  ourselves up to fail Email from David Foord, OGC
  Sent 8 June 2006

27

• I am not anticipating something major that would
  completely delay or derail the programme Joan
  Ryan 14 June 2006
• I conclude that we are setting ourselves up to
  fail David Foord 9 June 2006

28
More reviews

• John Reid Full scale review of all Home Office
  operations
• In December, the Government will be publishing
  plans for the introduction of the National
  Identity Scheme which will provide more detail on
  the contribution which existing assets could make
  to the delivery of the scheme

29
Sir James Crosby

• Chancellor appoints Sir James Crosby to lead
  Public Private Forum on Identity
• Reports back April 2007
• James Hall IPS procurement will start next
  summer

30
A radical redesign?
31

• The review identified that there may be existing
  technical infrastructure and systems that could
  be used as the basis for reducing the delivery
  and cost risks associated with the identity card
  project

32

• I did not mean to imply that a solution might
  involve stringing a number of legacy databases
  together. That has never been part of this
  proposition. We have always said that our
  requirements are for a data repository that could
  be populated one record at a time Katherine
  Courtney

33

• A change in the way in which the scheme is to be
  phased in would require considerable reworking of
  the current identity cards business plan and
  procurement strategy. This would create further
  delay in the programme and so could add to costs
  Baroness Scotland

34
Biometrics
35
Testing biometric technology

• The goal of the Trial was to test the processes
  and record customer experience and attitude
  during the recording and verification of facial,
  iris and fingerprint biometrics, rather than test
  or develop the biometric technology itselfit was
  not a technology trial. We will be undertaking
  further trials and testing in due course but do
  not have any immediate plans for further trials
  at this stage

36

• We anticipate piloting the recording of
  fingerprints as a second biometric from
  volunteers in late 2007. This prepares the UK to
  match mandated EU standards for both fingerprint
  and facial biometrics for Schengen area
  passports

37
Biometrics in s37 report

• Discussion of expanding fingerprinting
• No explicit mention of iris scanning

38
Likely future problems
39
Departmental buy-in
40
HMRC

• has, in consultation with the identity cards
  programme, developed its current best estimate of
  the costs and benefits of using the ID cards
  scheme to enhance its services and these have
  been incorporated into the business case

41
DWP

• has, in consultation with the identity cards
  programme, developed its current best estimate of
  the cost of using the ID cards scheme to support
  the services which it oversees and these costs
  have been incorporated into the business case

42

• They are not running to us with cheques Andy
  Burnham
• Public sector buy-in as part of Sir James
  Crosbys Public Private Forum on Identity
  Management

43
Verifications
44

• Cost of verification
• Base case 0.57
• Least appealing 2.00

45
Biometric or PIN verification?

• Biometrics are being used to more strongly tie a
  verified identity to an individual. In this way,
  biometrics can be used along with an ID card to
  verify that identity against the record held for
  that card. Other forms of authentication, such as
  PIN numbers and passwords can be stolen along
  with a card so are much weaker at linking a
  person to an identity Andy Burnham

46
Liability
47

• Society will depend on the integrity of the
  system
• to establish the eligibility of each party to
  conduct a transaction
• to assign the limitations of liability in the
  event of a failure
• Government proposals are currently unclear on
  this point

48
Security issues
49
Security issues

• Flash and go verifications
• Confidence in the security and integrity of the
  system
• August 2006 Office staff in the Home Office had
  breached the security of the passport database.
  Such problems would not arise with the identity
  cards database as this would be a completely
  different system

50
Scope shift
51

• 2005 International obligations
• US visa waiver scheme requirements for passports
  to contain a facial biometric from October 2006
• EU mandate of both facial biometrics (August
  2008) and fingerprints (2009) for Member States
  passports within the Schengen area

52

• 2005 Terrorism
• John Humphries If we'd had ID cards, it would
  have made no difference yesterday (July 7 2005),
  would it?
• Charles Clarke I doubt it. I doubt it would have
  made a difference, and I've never argued and
  don't argue that ID cards would prevent any
  particular act.

53

• 2005 November Identity fraud
• Up from 1.3 billion in 2002 to 1.7 billion in
  2006
• Including 400 million not included in the 2002
  study
• The figures reveal that, rather than shooting
  up, losses from credit and debit card ID theft
  fell by 7 during the six months to June 30from
  16.1m to 15m November 2006

54

• 2006 November Illegal immigration
• Companies are expected to verify the legal status
  of employees and can face large fines for
  employing illegal workers
• 23 prosecutions under the Asylum and Immigration
  Act between 1999 and 2003
• Home Office used a firm that supplied five
  illegal immigrants who worked as cleaners at the
  Immigration and Nationality Directorate

55

• 2006 November Modernity
• We need ID cards to secure our borders and ease
  modern life. The case for ID cards is a case
  not about liberty but about the modern world
• Intellectually, technological determinism seemed
  to us to reduce the intimate intertwining of
  society and technology to a simple
  causeandeffect sequence

56
Multiple purposes revisited

• Must help prevent identity theft
• Must help prevent terrorism
• Must be in accordance with some international
  obligations
• Must be designed by the Home Office
• Must enable e-government and access to government
  services

57
It is currently planned that the first identity
cards for UK citizens will be issued from 2009
58
Further information

• http//identityproject.lse.ac.uk