Some time ago I wrote to David Blunkett at the Home Office in an attempt to find out some more information about the identity cards scheme he is apparently determined to foist off on us. You can read a copy of my original letter (PDF format).
A little while ago I received a reply (slightly to my surprise, given my previous experience writing to Blunkett....)
Apart from poor grammar and the slightly staggering misspelling of my name at the beginning, the reply was mostly notable for not answering any of the interesting questions; early in the text is this disclaimer:
Most of the question [sic.] that you raise relate to the detailed management and administration of a possible entitlement / identity card scheme. These arrangements have not been decided yet and therefore there is only limited information that I can provide to you.
Anyway, here goes:
``How much will the card cost?''
No answer; instead, I am told that,
There is a range of possible costs depending on the sophistication of the card (i.e. whether it is a smartcard and if so how `smart' it would be). No decisions have been taken on any possible fee structure or the price of the card.
(The reference to a `fee structure' is interesting; everything I'd seen so far referred to a single price for the thing.)
``What will happen to members of the public who cannot afford to buy the card?''
People on low income may be given a card, or invited to pay by instalments, which seems fair enough.
``Can you give an example of a recent terrorist incident in a country without compulsory identity cards which would likely have been averted if cards had been available there?''
No answer at all to the most important question I asked.
``The use of biometric information for authentication is fraught with difficulties. In particular, it is impossible to revoke or issue new biometric information. How will the use of biometric information on the new cards address these problems?''
No answer. Question probably not understood.
``Some physically disabled people will not be able to use the biometric features in the card. How will the Government ensure that such people do not suffer from additional discrimination as a result of the proposed scheme?''
While I am assured that,
The Government would not exclude people who were unable to provide biometric information because of a medical condition.
no news on other forms of discrimination. (E.g., imagine that the cards store iris photographs with the intention that iris recognition is used for `authentication'. Now suppose that you're blind. Should you expect not to be able to use your bank's auto-teller because you can't be `authenticated' in this way?)
``Recent Government IT projects such as the National Air Traffic System and the system Individual Learning Accounts system have overrun and suffered serious failures. In the latter case there was substantial fraud. How will the Government ensure that the identity card computer system does not suffer from either cost overruns or security problems?''
This, perhaps, was an unfair question. I wouldn't have expected the Home Office to answer,
We fully expect the supporting IT systems for the entitlement card to sink into a morass of fraud, delays and misdesign. We envisage nominating a junior Minister to resign in disgrace once the amount of money wasted becomes publicly known.
-- instead, I got the much less entertaining
The Government will ensure that lessons are learned from past IT projects. Building on the existing passport and driving licence systems would help to reduce risks.
So that's alright then.
``One reason given for implementing an identity card system is that the United States would prefer us to have one for the convenience of their customs service. Will the data on the identity cards be available to governments outside the United Kingdom, and if so, how will those governments' use of it be governed by the relevant legislation on Data Protection?''
The answer here,
The Government will ensure that any entitlement card scheme will operate in accordance with the eight principles set out in the Data Protection Act 1988. The consultation paper goes into detail on how a scheme would comply with all eight principles.
The relevant principle is,
The Eighth Principle: Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
-- but note that `national security' can override these protections, and the United States government is likely to take the position that its use of identity card data is to ensure `national security'. So basically we will have no protection.
``Current practice in the United States shows that giving individuals an identifying number such as a `Social Security Number' has made identity fraud extremely simple, since all that is needed to assume another person's identity in a transaction is knowledge of the identifying number. Any centralised identity card scheme must, obviously, incorporate such an identifying number. Will this number be visible on the outside of the card or be disclosed to third parties under any circumstances?''
``Will the scheme use `smart cards' which incorporate a cryptographic key-pair? If so, will the Government have knowledge of each card's private key?''
The answer here suggests a misunderstanding of the question:
The information stored on any electronic chip attached to the card would be a sub-set of the core personal information also held on the central register and displayed on the card.... The Government would look to provide a way for card-holders to view the information stored on the chip provided this could be done securely for example via a PIN number or by matching the card-holder's biometric information.
I suppose these answers are about what you'd expect if the design of the scheme really is in its infancy. This wouldn't be the first time that the claims made by politicians for a technology preceded the actual implementation of that technology by a wide margin. The absence of an answer to (3) in particular only confirms my belief that the Government doesn't actually know what identity cards will be useful for, but thinks that they will be useful for something or other.