Identity Cards in the UK
Dr Edgar A. Whitley
e.a.whitley@lse.ac.uk
Reader in Information Systems
Information Systems Group, Department of Management
London School of Economics and Political Science
Research coordinator: LSE Identity Project
http://identityproject.lse.ac.uk
Identity Cards in the UK
Where have we been? Where are
we going?
Timeline to current situation
First World War
• Register of population 15-65
• Prelude to military and industrial
conscription
• Loss of interest when Register reported
1,413,900 men in England and Wales were
still available for National Service
Second World War
• Second National Register
– Co-ordinating national service, national
security and administration of rationing
• 1950 Clarence Willcock stopped by police
and asked to show ID card
• Lord Goddard: “to demand a card from all
and sundry … is wholly unreasonable”
• 39 agencies were using card for various
purposes when it was abandoned
2002 Efficient public services
• “After the terrorist atrocities in the United States
on 11 September 2001, I was asked whether the
Government was considering introducing
identity cards. I said at the time that any debate
about identity cards should not centre
exclusively on issues of national security. Far
more important are the issues of citizenship and
entitlement to services and it is in this context that
I would like to see the debate unfold.” David
Blunkett
Consultation
• On plans to create an ‘entitlement card’
that allows citizens to gain access to public
services
• Substantial commitment to some form of
identity card, a term the public preferred
to the term ‘entitlement card’
2004: The Bill Version 1
• Identity Cards Bill published 29
November
• Ran out of time in Parliament and
effectively fell in March 2005
2005: Labour Manifesto
• “We will introduce ID cards, including
biometric data like fingerprints, backed up
by a national register and rolling out
initially on a voluntary basis as people
renew their passports”
Design of the scheme
• National Identity Register
• Use of biometrics: face, finger, iris
• Online verification: done everywhere
• Audit trail of verifications
• Use by and payment from the private
sector
• Paid for by the public
Multiple purposes
• Must prevent identity theft
• Must prevent terrorism
• Must be in accordance with international
obligations
• Must be designed by the Home Office
• Must enable e-government and access to
government services
2005: The Bill version 2
• Reintroduced after General Election
• First reading May 2005
The LSE Identity Project
Main report: 27 June 2005
• Evaluated the impact of identity cards on
national security, organized crime and
terrorism; policing; race, discrimination
and immigration; and identity fraud.
• Reviewed the use of biometrics, the
security and safety of the National
Identity Register as well as international
obligations on identity documents and the
legal environment in the UK.
• Considered issues of public trust and the
government IT environment in the UK
• Presented an alternative blueprint for
identity management in the UK
LSE analysis not popular
• “Some of the figures banded around about
cost are absolutely absurd”
- Tony Blair
• Mr Clarke said it was “technically
incompetent” and contained figures that
were “simply mad”. He accused the LSE
of running a campaign against ID cards. Times Editorial, July 3, 2005
After Parliamentary debate
• Legislation is passed March 2006
– Scheme virtually identical to 2002 model
– Amendment on cost reporting (s37 report)
• New agency: UK Identity and Passport
Service launched on April 1st 2006
• James Hall (ex Accenture) appointed Chief
Executive October 2006
Formal reviews
OGC Gateway reviews
• Gateway Review 0: June 2003
• Gateway Review 0 (strategic assessment):
January 2004
• Gateway Review 1 (business justification):
July 2005
• Gateway Review 0 (strategic assessment):
January 2006
• Gateway Review 2 (procurement
strategy): April 2006
KPMG
• Cost Methodology and Cost Review
– Outline Business Case Review
• Extract published 7 November 2005
– “We conclude that the methodology used to
cost the ID Cards proposals is robust and
appropriate for this stage of development”
Parliamentary comment
• “We are not saying that we can go from
what we have now to a database covering
60-odd million people overnight, hoping
and praying that the IT and the
procurement will work and that
everything will be successful. We have
learned the lessons of the past, and this project
has to be rolled out on a phased basis” Tony
McNulty 18 October 2005
• “Projects such as this will always face such
challenges and opinions in the field of
technology will differ. However, the body
of representations within industry,
existing project experience and research
by established experts in the field of
biometrics and database technology
indicate that we are right to proceed with our
plans at this stage” Baroness Scotland 31
October 2005
• “The scheme has been through a series of
gateway reviews, and … that directly
builds on experience learned from past
failures. Some of the people involved in
the process have been involved in other
major public and private sector
procurement. … Obviously, they have clearly
learned the lessons and know exactly what
they are doing now” Andy Burnham 13
February 2006
• “I cannot comment on a hypothetical
problem. I am not anticipating something
major that would completely delay or derail the
programme. I would like to reassure the
committee that nothing is more important
than getting this right” Joan Ryan 14 June
2006
Procurement process starts
immediately …
Leaked emails: Sunday Times 9
July 2006
• “Also even if everything went perfectly
(which it will not) it is very debatable
(given performance of Govt ICT projects)
whether whatever TNIR [The National
Identity Register] turns out to be (and that
is a worry in itself) can be procured,
delivered, tested and rolled out in just
over two years and whether the resources
exist within Govt and industry to run two
overlapping procurements”
Continued
• “What benchmark in the Home Office do
we have that suggests that this is even
remotely feasible? I conclude that we are
setting ourselves up to fail” Email from
David Foord, OGC Sent 8 June 2006
• “I am not anticipating something major that
would completely delay or derail the
programme” Joan Ryan 14 June 2006
• “I conclude that we are setting ourselves up to
fail” David Foord 9 June 2006
More reviews
• John Reid: Full scale review of all Home
Office operations
• “In December, the Government will be
publishing plans for the introduction of
the National Identity Scheme which will
provide more detail on the contribution
which existing assets could make to the
delivery of the scheme”
Sir James Crosby
• Chancellor appoints Sir James Crosby to
lead Public Private Forum on Identity
– Reports back April 2007
• James Hall: IPS procurement will start
“next summer”
A radical redesign?
• “The review identified that there may be
existing technical infrastructure and
systems that could be used as the basis for
reducing the delivery and cost risks
associated with the identity card project”
• “I did not mean to imply that a solution
might involve stringing a number of
legacy databases together. That has never
been part of this proposition. We have always
said that our requirements are for a data
repository that could be populated one
record at a time” Katherine Courtney
• “A change in the way in which the scheme
is to be phased in would require
considerable reworking of the current
identity cards business plan and
procurement strategy. This would create
further delay in the programme and so
could add to costs” Baroness Scotland
Biometrics
Testing biometric technology
• “The goal of the …Trial was to test the
processes and record customer experience
and attitude during the recording and
verification of facial, iris and fingerprint
biometrics, rather than test or develop the
biometric technology itself—it was not a
technology trial. We will be undertaking
further trials and testing in due course but
do not have any immediate plans for further
trials at this stage”
• “We anticipate piloting the recording of
fingerprints as a second biometric from
volunteers in late 2007. This prepares the
UK to match mandated EU standards for
both fingerprint and facial biometrics for
Schengen area passports”
Biometrics in s37 report
• Discussion of expanding fingerprinting
• No explicit mention of iris scanning
Likely future problems
Departmental buy-in
HMRC
• has, in consultation with the identity cards
programme, developed its current best
estimate of the costs and benefits of using
the ID cards scheme to enhance its
services and these have been incorporated
into the business case
DWP
• has, in consultation with the identity cards
programme, developed its current best
estimate of the cost of using the ID cards
scheme to support the services which it
oversees and these costs have been
incorporated into the business case
• “They are not running to us with cheques”
– Andy Burnham
• Public sector buy-in as part of Sir James
Crosby’s Public Private Forum on Identity
Management
Verifications
• Cost of verification
– Base case £0.57
– Least appealing £2.00
Biometric or PIN verification?
• “Biometrics are being used to more
strongly tie a verified identity to an
individual. In this way, biometrics can be
used along with an ID card to verify that
identity against the record held for that
card. Other forms of authentication, such as
PIN numbers and passwords can be stolen
along with a card so are much weaker at
linking a person to an identity” Andy
Burnham
Liability
• Society will depend on the integrity of the
system
– to establish the eligibility of each party to
conduct a transaction
– to assign the limitations of liability in the
event of a failure
• Government proposals are currently
‘unclear’ on this point
Security issues
Security issues
• Flash and go verifications
• Confidence in the security and integrity of
the system
– August 2006: Office staff in the Home Office
had breached the security of the passport
database. Such problems would not arise with
the identity cards database as this would be a
‘completely different’ system
Scope shift
• 2005 International obligations
– “US visa waiver scheme requirements for
passports to contain a facial biometric from
October 2006”
– “EU mandate of both facial biometrics
(August 2008) and fingerprints (2009) for
Member States’ passports within the Schengen
area”
• 2005 Terrorism
– John Humphries: If we'd had ID cards, it
would have made no difference yesterday
(July 7 2005), would it?
– Charles Clarke: I doubt it. I doubt it would
have made a difference, and I've never argued
and don't argue that ID cards would prevent
any particular act.
• 2005 November: Identity fraud
– Up from £1.3 billion in 2002 to £1.7 billion in
2006
– Including £400 million “not included in the
2002 study
– ”The figures reveal that, rather than shooting
up, losses from credit and debit card ID theft
fell by 7% during the six months to June 30—
from £16.1m to £15m” November 2006
• 2006 November: Illegal immigration
– Companies are expected to verify the legal
status of employees and can face large fines
for employing illegal workers
– 23 prosecutions under the Asylum and
Immigration Act between 1999 and 2003
– Home Office used a firm that supplied five
illegal immigrants who worked as cleaners at
the Immigration and Nationality Directorate
• 2006 November: ‘Modernity’
– “We need ID cards to secure our borders and
ease modern life. … The case for ID cards is a
case not about liberty but about the modern
world”
– Intellectually, technological determinism
seemed to us to reduce the intimate
intertwining of society and technology to a
simple cause–and–effect sequence
Multiple purposes revisited
• Must help prevent identity theft
• Must help prevent terrorism
• Must be in accordance with some
international obligations
• Must be designed by the Home Office
• Must enable e-government and access to
government services
It is currently planned that the
first identity cards for UK
citizens will be issued from 2009
Further information:
http://identityproject.lse.ac.uk