warmwell.com website


Uk.gov database 'rationalisation', the ID scheme way

By John Lettice (john.lettice at theregister.co.uk)
Published Friday 29th October 2004 17:01 GMT

Among the Home Office "concessions" on ID cards hailed (with quite remarkable promptness) this week by Home Affairs Committee chairman John Denham MP (Lab) was "the rationalisation of current database proposals and the dropping of the Citizen Information Project." Denham appears however to have been in error in cheering the demise of the CIP on behalf of his Committee, for just 24 hours later Treasury Chief Secretary Paul Boateng issued a written statement to Parliament indicating the CIP is actually being reworked to use the national ID register.

Or vice versa? According to Boateng's statement: "The CIP team has investigated the costs and benefits of a range of potential options for delivering a population register. It has recommended that proposals for a national identity register (NIR), as part of the Government's proposals for ID cards, mean that if ID cards were to become compulsory then it may be more cost effective to deliver these benefits through the NIR, rather than develop a separate register. The Government has accepted this recommendation."

The CIP has been going through the works via the Office of National Statistics (http://www.theregister.co.uk/2003/08/05/uk_birth_certificates_to_morph/) as a sort of cuddlier cousin to the ID scheme. The modernisation of births, marriages, deaths and the like led government thoughts to turn to what kind of additional related services could be offered to the citizen, with these ideas being fairly neatly encapsulated in the concept of the "through life record". As the white paper Civil Registration: Vital Change tells us "the creation of a central database of registration records provides the opportunity to make improvements..." Which is all well and good until alongside this particular register of names addresses and sundry details about the population there arrives another register with, as the Home Affairs Committee report put it, "a very large degree of overlap".

In its response on Wednesday the Home Office did not say 'dropping' - it did say: "The Government believes that the NIR has the longer term potential to fulfil some of the functions envisaged for the national population register. In the light of developments to the NIR, CIP is no longer actively exploring options to improve the quality and effectiveness of existing registers, including the possible use of personal reference numbers." So the CIP is no longer developing its own population register as the electronic implementation of births, marriages and deaths, and the National Identity Register becomes that population register, with the CIP going ahead, but now hinging on the NIR.

Which you might view as more of an expansion of the ID scheme than a concession, as such. Alongside the specific CIP complaint, Home Affairs expressed its concern over the growing number of government databases in general. "We believe that the Government must tackle this proliferation of databases, examining in each case whether the number, identifier or database is needed, what its relationship to other existing or planned databases, how data will be shared or verified and other relevant issues. For this action to be effective, it must be co-ordinated at the highest levels of the Civil Service... an identity card should enable access to all Government databases, so that there would be no need for more than one government-issued card."

In its response the Home Office appears to indicate that the CIP-NIR approach could present a model for other services, saying "we believe that the identity card will provide an opportunity for more joined up Government by providing a consistent and standard business key for future systems evolution." Which represents a strengthening rather than a weakening of the ID scheme. Here however the Committee was effectively arguing for a strengthening, and as David Blunkett envisages the ID card and register as becoming the key to everything, this is precisely the kind of "concession" he wants to make. It does rationalise (as Denham put it) current government database proposals in the sense that it makes them dependent on the NIR. The databases themselves will continue to proliferate though.

It's possible that shoehorning CIP functionality into the ID scheme may cause some delay to the ID scheme bill itself. Spy Blog points out (http://www.spy.org.uk/spyblog/archives/000482.html) that if the CIP stage 2 feasibility study plans aren't to come (as Boateng said) before Ministers until June 2005, they might knock the ID bill back beyond the next election. It's possible the CIP study might be accelerated, but Gordon Brown's Treasury might on the other hand not view it as a top priority. Or worse. Spy also notes that the change will mean incorporating children under 16 in the NIR, and raises the issue of the Children's Bill. This sets up another universal database, of children this time, and will operate with a number of other databases, including the NHS one and Connexions.

In its Home Affairs response the Home Office said that the "National Programme for IT (NPfIT) is putting into place an infrastructure of card readers across the NHS, which will facilitate the checking of cards" and that in the case of the Connexions card readers, which are issued free to schools and colleges, there may be "cost savings to be realised for identity cards by exploiting the existing infrastructure." So some more opportunities for rationalisation here, no doubt. Related stories

Copyright 2004


The Great 'standalone' ID card Swindle

By John Lettice (john.lettice at theregister.co.uk) Published Sunday 31st October 2004 09:58 GMT

The Home Office pulled off quite a coup last week. It contrived to duck or ignore a series of criticisms of its ID card scheme, and announced minor changes which in some cases could actually be seen as strengthening it. Meanwhile, a good section of the press was sent chasing off with the biggest non-concession of the lot - the abandonment of the combined identity card.

Presuming this was not entirely accidental, someone, surely, deserves a knighthood. Several national papers, together with the BBC, led into the story by saying that plans to combine identity card with passports and driving licences had been dropped, with the change coming "in response to MPs who said the plans were badly thought out" (BBC). Home Office research was then cited as saying the majority of the public preferred that the ID card should be a separate document. The Home Office announcement had said that the scheme would involve: "A single, universal ID card for all UK nationals, to be issued alongside passports. This will simplify the operation of the scheme, and reflects public support for a universal card."

We have no idea how much of the synchronicity in the coverage can be attributed to the journalist's notorious herd instinct and how to much to actual herding, but we can say that none of the news organisations can have anyone involved in the coverage with sufficient knowledge of the scheme to spot that this was a dud story. Which under the circumstances we think is pretty damn shabby.

So here, for the record, is why it is a dud. The Home Office has at no time announced firm plans for a combined card. The notion of a single magic card that does everything has certainly been kicked around at various points, and if you asked, you'd probably find that a significant proportion of the general public thought this was what they were likely to get, but the practicalities dictate that such a beast can't be shipped in the foreseeable future. Both the Home Affairs Committee and the Home Office were well aware of this and made no secret of their awareness, as we can confirm by referring to the Committee report the "concessions" were made in response to.

On driving licences it tells us (under EU and ICAO standards, 14) that in the EU, driving licences are governed by directives of 1991 and 1996 which set out their format. "UK driving licences comply with these directives which rules out the possibility, for example, of a combined passport, driving licence and identity card." Stephen Harrison, of the Home Office's ID card policy unit, is quoted as saying "... we would hope to pursue arguments... over time you try to bring the standards together, but I could not say that this is going to be a short term development."

So prior to the development of common formats in Brussels, we have no converged document here. The report reinforces this with a few practicalities: "However neither passports nor driving licences can, for the time being, be reduced to cards, since the first will need space to record visas and the second endorsements. In addition, there are no plans to issue passport identity cards at British posts abroad, so British citizens resident overseas will continue to use passport booklets. Using passports and driving licences as identity cards may also give rise to difficulties, such as, for example, an individual trying to access a public service while their passport identity card is waiting for a visa at a foreign consulate."

What this means is that while it would be possible for a UK ID card to be used as a travel document in areas prepared to recognise it (as is currently the case within the EU for other EU ID cards), travel elsewhere would need a more conventional passport document. The document itself would need to conform to ICAO standards, which presents issues in addition to simple format. It would be technically feasible for the passport to include ID card functionality, but such a scenario would be subject to the caveats expressed above by the Home Affairs Committee, and if the bearer did not also have an ID card then they would have to use their passport as the card all the time. Having two documents is, and has always been, more logical and more convenient.

Public demand

About that research data that said most people would prefer a separate card - what was the actual question? Well, there's an interesting one. It was: "There are various ways that you will be able to get an identity card - it could be issued as a card when you renew your passport, it could be incorporated into the card version of your driving licence, or it could be issued as a separate document. Which of these would you prefer?." Most respondents, as the Home Office is so keen to tell us, preferred it to be issued as a separate document.

You have no doubt noticed that having a single combined card was not actually an option placed before the surveyed public. You may also have noticed have the option that most people preferred is not necessarily the option the Home Office is actually delivering. It does look rather more like it is being "issued as a card when you renew your passport", does it not? Weirdly, the write-up of the survey results (the edited one we're allowed to see, which is tagged "management summary for the UK general public"*) tells us this was the least popular option.

The market research professionals still with us (those who haven't gone for a few sedatives and a lie-down) will confirm that whoever worded this question was either grossly incompetent or was quite deliberately attempting to manage the response in a preferred direction. We'd go for incompetent, given that they've wound up doing the least popular thing anyway, and that it includes an option (incorporated in driving licence) which is currently impossible.

The real decision

Despite all this the Home Office really is acting on an issue that was covered by the Home Affairs Committee enquiry, but it's not an issue of form or packaging - it's about standards and deadlines. The Committee expressed its doubts here as follows: "The type of card to be used is a decision of the same order of importance as the architecture of the database, since it has consequences for issues such as how the card will be used and the number of readers and the infrastructure needed... Some choices, such as the nature of the chip, seem to follow a decision to use the passport as an identity card (and therefore follow ICAO) rather than an independent assessment of what would be the most appropriate for an identity card."

The Committee here is concerned about what it perceived as a close coupling of the ICAO international passport standard to the ID card, and this concern is not entirely surprising, given that our having to implement the passport changes was an early Blunkett justification for going ahead with ID cards as well. But the needs of the two kinds of document differ.

ICAO requires a facial image as biometric, with fingerprint as an optional second biometric, while practicalities and technology dictate that fingerprint is the most viable biometric for a national ID card. ICAO also recommends a contactless chip to be used for storage of the biometric data, so following ICAO would to an extent dictate the nature of the readers to be used. US tests of this technology for its own biometric passports are already highlighting security holes (Bruce Schneier explains why it's a thoroughly bad idea here (http://www.schneier.com/crypto-gram-0410.html#3)), and there should clearly be questions about the sense of using it in a system with readers deployed in very large numbers.

The Home Office appears not yet to have decided on the chip and reader technology to be used by ID cards, but by decoupling passports and ID, the latter will "not necessarily be based on ICAO standards" (Home Office response to Home Affairs). But: "There are efficiency savings in collecting biometrics to a single common standard for multiple documents, which may mean that we will use widely-agreed international standards." The decoupling, however, allows it much more flexibility than would otherwise be the case.

The US deadline for requiring biometric passports has been subject to some postponements, and may be postponed again if the US continues to run into problems with its own passports, but the Home Office needs to try to meet it when it actually arrives, so one of the advantages of decoupling ID cards is that passports can move faster. The response to Home Affairs, for example, says: "The United Kingdom Passport Service will start to issue passports with a facial image held in a chip from late 2005 onwards." This sounds ambitious, but if it happened then the UK would just about meet an autumn 2005 deadline.

Europe recently added fingerprint (http://www.theregister.co.uk/2004/10/25/eu_adds_passport_fingerprints/) as the second compulsory biometric identifier for European standard passports, but these will become mandatory after three years, as opposed to the 18 months for facial, and it's not therefore so urgent to include them in the earlier passports. Fingerprints can however be collected at the same time as the facial image for the passport, so the government will be able to start building on its database as soon as it implements chipped passports.

The first passports will surely ship without having an ID card issued "alongside" it. Which sounds pretty much like the situation you could have reasonably anticipated prior to the Home Office announcement. There are also reasons why it may not be sensible to push ahead with the specification and implementation of the ID card itself too quickly. Having dealt with passports, Europe's Justice and Home Affairs Council now intends to look at standards for European ID cards, so there will be standards from Europe to take account of within a few years.

But the point is not what shape, size or pretty colour you'd like the bit of plastic to be, or when you get it; the point is that the Home Office gets your biometric details onto its databases as soon as possible so that it can match you against them. If passports can be put out sooner, well, that data can be collected sooner too.
Is it or isn't it?

If we're to be entirely accurate we should note that the Home Office is giving itself the flexibility to decouple cards from passports, rather than irrevocably splitting the two. They, and other identity documents, may show some divergence in the short term, but in the longer term the drive to "use widely-agreed international standards" will exert a pull in the opposite direction. At the moment, however, the change of plans leaves a legal question dangling - could you still use your new style passport as an identity card?

No, that is not a silly question. Allow us to explain. Depending on the chip technology and the readers used for the ID card system, it may not be physically possible for a passport to be used with it, but it could still be perfectly feasible for the passport to be an identity card-type document, which could be verified by other means. The passport could contain all of the information necessary for it to be 'an ID card inside', and it could be legally designated as such by the Home Secretary. The draft ID scheme bill currently gives the Home Secretary the power to designate a wide range of existing documents as legal identity documents, and these are listed as:

  • a passport identity card (valid for travel and issued to British citizens);

  • a driving licence photocard;

  • a residence permit card for foreign nationals;

  • a special residence permit (or 'registration certificate') card for European Economic Area (EEA) nationals;

  • a 'plain' identity card available for those who do not qualify for or do not wish to have one of the other cards.

    This section of the draft bill treats identity cards as a "family" of compatible documents, the underlying thinking being that existing classes of document could be upgraded and co-opted, ultimately adding up into a pervasive, universal ID scheme with the last one, the 'plain' card, being brought in to swat the last few holdouts. But if the government is now pushing the notion of a separate ID card to the forefront, the thinking, and this section of the bill, should surely change. Although the Home Affairs Committee report notes this section, the Home Office's response does not appear to cover it. So will, as per plan A, the passport be an identity document, or won't it?

    You could ask the same question about the driving licence. Currently, the licence itself is considered sufficient for you to establish your identity when challenged, but once you can use an identity card to establish your identity, will it still be? And if it is (which it should be, because a driving licence system that isn't verifiable against the NIR isn't going to do anything towards weeding out dubious licences from the database), then to what extent is it a more general identity document? There's more than a little of angels and pinheads to these questions, but they perhaps serve to illustrate the pie in the sky nature of the 'standalone ID card' notion. You currently have many differing identity documents of differing strength. Once you have a 'standalone' ID card, you still will, and at the moment it looks rather like the government is making a pig's ear of defining a coherent framework to tie them all together.