Drew's Blog. The dots in .co.uk

Drew Wagar's Weblog.

« Has anyone else... | Main | ID Cards and the NIR... »

Monday October 10, 2005

ID Cards and the NIR Part 1 - Introduction

This is a big subject, but it won't come as much of a surprise that Sun has an interest in the ID(Identity) Card and the NIR(National Identity Register) from a technology solutions provider perspective, our expertise in both of these subject areas speaks for itself.

Whilst the greater part of this project will be in the process, training, distribution and production of the Cards, and the operation of the NIR itself, the technology to be employed bears examination, as many issues involved are not immediately straightforward or apparent. Also the technology employed will have a sizable effect on politics, privacy, citizen adoption and security. Where this effects exist, I will point them out.

Thus, I intend to write a series of articles examining the technology based on information in the public domain about the requirements of the ID Card and NIR System, in light of the fact the real requirements don't as yet exist! (Ref6)

-=-=-=-=-=-=-=-=-=-=-=-=-=-

Introduction

Lets examine the Bill(Ref1) itself as a starting point.

There appear to be 4 key areas.

1. An enrollment service, enabling the government to enrole citizens to a high degree of assurance. This includes biometric information; Iris recognition and fingerprints appear to be in vogue at the moment. Enrollment will be in person, i.e. face to face. This is likely to be the most common point of fraud or compromise based on evidence from other ID Card schemes.

2. The construction of a National Identity Register (NIR) which will be a "new, highly secure database holding basic personal information"(Ref1). As No2ID(Ref4) points out, that's "51 pieces of basic personal information" ;-), some of which is current, some historical. Entry to this NIR is subject to the enrolement above. Interesting that the word database is used by everyone involved, it's unlikely to be a 'database' in practice. ;-)

3. A Card, which contains none, some or all of the information on the NIR. The quantity of the data on the card will trade off with the cost of the card. It could range from a simple unique code, all the way to 4megs+ of data on the citizen, including photos and biometrics.

4. A verification service which allows a citizen to connect their card with the NIR. This verification will occur at a number of levels, right from 'Card is Valid' right up to 'Holder is entitled to this service'. This section has major implications for the architecture of the system, we will see this later on.

Alongside this are three other major themes regarding the card and its operation.

1. It's an Identity Card. Well Doh! Importantly, it includes a biometric check capability. The government points out that biometrics are absolutely unique (Ref3), which is true; However it fails to mention that biometric checking does not enjoy quite the same level of confidence. The LSE report(ref2) makes much mention of this. With 30-60 million people registered, even a checking accuracy of 99.9% isn't that great.

2. It's an Entitlement Card. It was infact called an entitlement card up until 2003, but this has been replaced with 'Identity Card' due to pressure from the House of Lords. There has always been a tacit implication that to verify entitlement you must have established identity. Nobody, atleast in print, seems to have realised this is not the case. Buying a train ticket entitles you to travel, yet contains no information about your identity. Likewise, access to the NHS does not actually require you to be identified, merely entitled. A simple point, but drastically important from a privacy perspective. The entitlement and identity information could still be present on the one card, but it doesn't have to be accessed together or associated with each other.

3. It generates an audit trail.

This is an interesting area. Whilst the audit is not written into the bill per se, it is inferred by the inclusion of historical data being stored on the Card/NIR, implying updates to the NIR and/or card. (Eg. Previous addresses, any use of the Card for application, modification or confirmation). The Government appears to require an audit trail of card usage. What they will do with this is a matter of extreme speculation, all the way from nothing at all, to the complete orwellian state.

All of these themes affect the types of architecture that might be presented. In my next article I will analyse these.

Links and references

1. The Bill itself...
http://www.publications.parliament.uk/pa/cm200506/cmbills/049/06049.i-ii.html

2. The LSE Report which caused a ruckus in the press over the price of the 'Card'...
http://www.lse.ac.uk/collections/pressAndInformationOffice/newsAndEvents/archives/2005/IDCard_FinalReport.htm

3. Why you should have an ID Card, courtesy of the Home Office
http://www.homeoffice.gov.uk/passports-and-immigration/id-cards/why-we-need-id-cards/
A bit disappointing really. No detail on 'how' some of the assertions they make will be realised. Also interesting that they file this under 'Passport and Immigration' on their website.

4. Why you shouldn't have an ID Card, courtesy of No2ID
http://www.no2id.com/IDSchemes/whyNot.php
A vocal and well organised group who are "opposed to the government's planned ID card and National Identity Register." Does include some robust arguments worthy of attention and their 'interviews' with various ministers are most amusing.

5. Identity Press Coverage, courtesy of The Register.
http://www.theregister.co.uk/security/identity/
Needs little introduction from me. Well informed journos, now there's a thing!

6. "The very model of a modern labour minister" - A bit of fun, particularly if you like Gilbert and Sullivan; Like me.
http://eclectech.co.uk/clarkeidcards.php

( Oct 10 2005, 04:59:31 PM BST / Oct 10 2005, 03:37:25 PM BST ) Permalink Comments [0]
Trackback: http://blogs.sun.com/Drew/entry/id_cards_and_the_nir

Trackback URL: http://blogs.sun.com/Drew/entry/id_cards_and_the_nir

Comments: