The Politics and
Technology of Identity:
Why is it so difficult to
establish a UK identity policy?
Department of IS University of Melbourne
April 23 2007
Presenter:
Professor Leslie Willcocks
The London School of Economics
on behalf of the ISIG LSE Identity Project
- Gus Hosein, Edgar Whitley, Simon Davies
and Ian Angell
2002 Efficient public services
“After the terrorist atrocities in the United States
on 11 September 2001, I was asked
whether the Government was considering
introducing identity cards. I said at the time
that any debate about identity cards should
not centre exclusively on issues of national
security. Far more important are the issues
of citizenship and entitlement to services
and it is in this context that I would like to
see the debate unfold.” David Blunkett
2005: Labour Manifesto
“We will introduce ID cards, including biometric
data like fingerprints, backed up by a
national register and rolling out initially on a
voluntary basis as people renew their
passports”
Design of the scheme
National Identity Register
Use of biometrics: face, finger, iris
Online verification: done everywhere
Audit trail of verifications
Use by and payment from the private sector
Paid for by the public
Multiple purposes
Must prevent identity theft
Must prevent terrorism
Must be in accordance with international
obligations
Must be designed by the Home Office
Must enable e-government and access to
government services
----Painting yourself into a corner?
Registration
Powers
Legal
Identification Compulsion
Power to Disclose
Power to Compel
Documentation
Penalties
Biographical
Biometrics
Data
National Identity Register
Card
ID Number
Recipients
Private & Public Sector Data Systems
Biometrics
Disclosures
2005: The Bill version 2
Reintroduced after General Election
First reading May 2005
The Government is introducing an ID card
but it isn’t sure why.
Reason 1: Combating terrorism.
A third of all terrorists use multiple identities.
Reason 2: Efficient Public Services.
Create an ‘entitlement card’ that allows us to
gain access to public services.
Reason 3: International Obligations.
•International obligations to create ‘biometric passports’.
Blame America.
•“US visa waiver scheme requirements for passports to
contain a facial biometric from October 2006”
•ID Cards are everywhere in the world.
•“EU mandate of both facial biometrics (August 2008) and
fingerprints (2009) for Member States’ passports within
the Schengen area”
Reason 4: Identity Theft.
Identity theft costs the UK economy £1.3 bn GBP per year.
Reason 5: Imperative.
Technology and global politics are converging in a way
that permits and requires the creation of such a system.
"The next few years are going to see effectively a visa and
passport revolution across the EU and the developed
world.
We have the chance to use this opportunity to get ahead
in this change and the move, therefore, to biometric
passports makes identity cards an idea whose time has
come."
- Tony Blair, June 26, 2005
Reason 6: Terrorism.
Greatest civil liberty of all is the ability to go to work
without being blown up.
Reason 7: Identity Theft.
Identity theft costs the UK economy 1.3bn GBP per year.
1.7bn!!
Reason 8: Terrorism.
Reason 9: Illegal immigration (Nov.2006)
 Companies are expected to verify the
legal status of employees and can face
large fines for employing illegal workers
 23 prosecutions under the Asylum and
Immigration Act between 1999 and 2003
 Home Office used a firm that supplied
five illegal immigrants who worked as
cleaners at the Immigration and
Nationality Directorate
Reason 10: 'Modernity'
"The real issue here is not privacy or cost, it is
modernity. We face some new problems. Biometric
technology offers new solutions. But, in addition, we
can already glimpse what else might be possible."
- Tony Blair's monthly press conference, 6 November 2006
The LSE Report no. 1
So many questions...
1.What are these 'international obligations'?
2.What are other countries doing?
3.What are the implications of the Home Office
designing the system?
4.Does the 'technology' 'work'?
5.Are the government’s claims precise?
6.How will this affect policing?
7.Are there alternative structures and technologies?
The LSE Identity Project
Main report: 27 June 2005
1.
Evaluated the impact of identity cards on national
security, organized crime and terrorism; policing;
race, discrimination and immigration; and identity
fraud.
2.
Reviewed the use of biometrics, the security and
safety of the National Identity Register as well as
international obligations on identity documents and
the legal environment in the UK
3.
Considered issues of public trust and the
government IT environment in the UK
4.
Presented an alternative blueprint for identity
management in the UK
LSE Identity Project
1.Technologies are challenging, e.g. biometrics.
2.Home Office design is risky and complex.
3.International obligations are mythical.
4.Legal problems remain significant.
5.Government track-record on IT projects is
problematic.
6.Costs are likely to be higher than predicted.
7.Alternative designs exist - centralised v.
decentralised.
LSE analysis not admired
popular...
1.
“Some of the figures bandied around about cost are
absolutely absurd”
- Tony Blair
2.
Mr Clarke said it was “technically incompetent” and
contained figures that were “simply mad”. He
accused the LSE of running a campaign against ID
cards. Behind the scenes the Home Office has
been pressuring the university to withdraw the
study in a way that Sir Howard Davies, its director,
has described as “bullying and intimidating
behaviour”. So there you have it. Our elected
government lies and it bullies.
- Times Editorial, July 3, 2005 -
After Parliamentary Debate
debate
•
Legislation is passed March 2006
 Scheme virtually identical to 2002 model
 Amendment on cost reporting (s37
report)
•
New agency: UK Identity and Passport
Service launched on April 1st 2006
•
James Hall (ex Accenture) appointed Chief
Executive October 2006
Formal Reviews 2003-2006
OGC Gateway reviews
•
Gateway Review 0: June 2003
•
Gateway Review 0 (strategic assessment):
January 2004
•
Gateway Review 1 (business justification):
July 2005
•
Gateway Review 0 (strategic assessment):
January 2006
•
Gateway Review 2 (procurement strategy):
April 2006
KPMG
•
Cost Methodology and Cost Review
 Outline Business Case Review
•
Extract published 7 November 2005
 “We conclude that the methodology used
to cost the ID Cards proposals is robust
and appropriate for this stage of
development”
Parliamentary comment
“We are not saying that we can go from what
we have now to a database covering 60odd million people overnight, hoping and
praying that the IT and the procurement will
work and that everything will be successful.
We have learned the lessons of the past,
and this project has to be rolled out on a
phased basis” Tony McNulty 18 October
2005
“Projects such as this will always face such
challenges and opinions in the field of
technology will differ. However, the body of
representations within industry, existing
project experience and research by
established experts in the field of biometrics
and database technology indicate that we
are right to proceed with our plans at
this stage” Baroness Scotland 31 October
2005
“The scheme has been through a series of
gateway reviews, and … that directly builds
on experience learned from past failures.
Some of the people involved in the process
have been involved in other major public
and private sector procurement. …
Obviously, they have clearly learned the
lessons and know exactly what they are
doing now” Andy Burnham 13 February
2006
“I cannot comment on a hypothetical
problem. I am not anticipating something
major that would completely delay or
derail the programme. I would like to
reassure the committee that nothing is more
important than getting this right” Joan Ryan
14 June 2006
Procurement process to start
immediately …
But Leaked emails…..
Sunday Times 9 July 2006
“Also even if everything went perfectly
(which it will not) it is very debatable (given
performance of Govt ICT projects) whether
whatever TNIR [The National Identity
Register] turns out to be (and that is a worry
in itself) can be procured, delivered, tested
and rolled out in just over two years and
whether the resources exist within Govt and
industry to run two overlapping
procurements”
Proved Damaging….
“What benchmark in the Home Office do we
have that suggests that this is even
remotely feasible? I conclude that we are
setting ourselves up to fail” Email from
David Foord, OGC Sent 8 June 2006
And a Ministerial Change...
reviews
New Home Office Minister John Reid: Full
scale review of all Home Office operations
“In December, the Government will be
publishing plans for the introduction of the
National Identity Scheme which will provide
more detail on the contribution which
existing assets could make to the delivery of
the scheme”
Leads to Sir James Crosby
Chancellor appoints Sir James Crosby to lead
Public Private Forum on Identity
 Reports back April 2007
James Hall: IPS procurement will start “next
summer” (2008)
Time For A Review
A Radical Redesign?
“The review identified that there may be existing
technical infrastructure and systems that could be
used as the basis for reducing the delivery and cost
risks associated with the identity card project”
“I did not mean to imply that a solution might
involve stringing a number of legacy databases
together. That has never been part of this
proposition. We have always said that our
requirements are for a data repository that could be
populated one record at a time” Katherine Courtney
“A change in the way in which the scheme is to be
phased in would require considerable reworking of
the current identity cards business plan and
procurement strategy. This would create further
delay in the programme and so could add to costs”
Baroness Scotland
Looking Back - Some Issues (1)
Biometrics
Testing biometric technology
“The goal of the …Trial was to test the processes
and record customer experience and attitude during
the recording and verification of facial, iris and
fingerprint biometrics, rather than test or develop
the biometric technology itself—it was not a
technology trial. We will be undertaking further trials
and testing in due course but do not have any
immediate plans for further trials at this stage”
“We anticipate piloting the recording of fingerprints
as a second biometric from volunteers in late 2007.
This prepares the UK to match mandated EU
standards for both fingerprint and facial biometrics
for Schengen area passports”
Biometrics in s37 report
•
Discussion of expanding fingerprinting
•
No explicit mention of iris scanning
Some Issues (2)
Verifications
Cost of verification

Base case £0.57

Least appealing £2.00
Biometric or PIN verification?
“Biometrics are being used to more strongly tie
a verified identity to an individual. In this
way, biometrics can be used along with an
ID card to verify that identity against the
record held for that card. Other forms of
authentication, such as PIN numbers and
passwords can be stolen along with a card
so are much weaker at linking a person to
an identity” Andy Burnham
Some Issues (3)
Liability
1. Society will depend on the integrity of the
system
 to establish the eligibility of each party to
conduct a transaction
 to assign the limitations of liability in the
event of a failure
2. Government proposals are currently
‘unclear’ on this point
Some Issues (4)
Security
We Were Not Alone...
“Putting a comprehensive set of personal data in one
place produces a honeypot effect - a highly attractive and
richly rewarding target for criminals.
The system was “something that no technologist would
ever recommend.”
“I have concerns with the current architecture and the way
it looks at aggregating so much personal information and
biometrics in a single place. There are better ways of
doing this. Even the biometrics industry says it is better to
have biometrics stored locally.”
- Jerry Fishenden, NTO Microsoft UK
"A national ID card for the UK is overly ambitious,
extremely expensive and will not be a panacea against
terrorism or fraud, although it will make a company like
mine very happy."
- Roberto Tavano, biometrics specialist for Unisys
“The Bill's provision for the retention of extensive personal
information relating to all or large sections of the
population may be insufficiently targeted to be justified as
proportionate to the statutory aims and may lead to
disproportionate interference with Article 8 rights."
- Joint Committee on Human Rights
“Perhaps in the past the Government in its enthusiasm oversold
the advantages of ID cards. We did suggest or at least implied
that they may well be a panacea for ID fraud, benefit fraud,
terrorism and entitlement, and access to public services.”
- Tony McNulty, Home Office Minister, July/August 2005
But they ignored it anyway...
"The creation of the National Identity Scheme,
employing cutting edge biometric technology, will
provide the nation with a safe and secure means of
confirming identity in everyday life. It will also enable us
to crack down on abuse of our free public services by
those not entitled to them."
- Andy Burnham, Safeguarding Your Identity: IPS
Sets Out Ten Year Plans, April 21, 2006.
"We have been looking at this for many years, actually
several years before I joined the programme as a matter
of fact. Before the policy decisions in principle were even
taken, quite a lot of feasibility analysis went forward. ...
Those studies came back showing that the technical risks
to a programme like this were medium risks and were
manageable and actually the important thing to focus on
was of course the business risks and making sure that we
are getting the business process right and all the other
factors around how you identify a person and register their
identity, and then confirm it."
- Katherine Courtney before Parliament’s Science and
Technology Committee, March 22, 2006.
"I find that answer, with the greatest respect, absolutely
astounding. Two weeks ago, the Committee was in the
United States talking to the Department of Homeland
Security who said exactly the opposite to what you have
said.
- Chairman of the Committee, Q272, March 22, 2006
Politics or Policy?
•"[T]he Government is not alone in recognising a
number of factors that cast doubt on the credibility of
parts of the report as well as the impartiality of the
report’s core team.
•The Government supports the right of such individuals
or groups to express their views in open debate.
However, such views do not necessarily constitute
objective, rigorous academic research.
•Therefore the Government maintains it was entitled to
defend its proposals and to assert that the report was
not as independent or accurate as was claimed by its
authors.
- Home Office response to Parliamentary Science
and Technology Committee, October 2006
Politics or Policy?
Mr. Byrne: The hon. Gentleman would be wise not to
pray in aid the LSE report. That report ignored research
from the National Physical Laboratory, exaggerated the
cost of verifying identity information and had some
pretty basic problems with its maths. It overstated the
number of people who might have problems giving
biometric data by an extraordinary 1,800 per cent, so I
am not sure that that is the report to pray in aid in
support of the hon.Gentleman’s argument.
- Parliamentary Question, February 20, 2007
Politics or Policy?
"The cost argument we can certainly address pretty
easily, the LSE report has been pretty comprehensively
rubbished by virtually everybody - it wasn't an LSE
report, it was somebody who happened to work for the
LSE - we've gone through that.
- Stephen Pound, MP, March 9, 2007
Conclusion
Why is it so difficult to
establish an identity policy?
1. Political process may not be the best way to come
up with design specifications.
2. Dream of what technology will bring is hard to
resolve with what technology may do.
3. Projects that entail involvement of entire population
are hard to plan, harder to implement, and likely
harder to induce.
1."It is, to me at least, almost incredible that the proposal
to introduce an identity register in the UK should be so
extraordinarily controversial. But it is."
- Tony Blair, August 2006
Coda: It is currently planned that the first identity cards
for UK citizens will be issued from 2009
Contacts at LSE
1. I.hosein@lse.ac.uk
2. e.a.whitley@lse.ac.uk
3. http://identityproject.lse.ac.uk