This article appears in eGov monitor Weekly

1 September 2003

Does the UK need a national biometric ID system?

Oliver Letwin MP, Shadow Home SecretaryOliver Letwin MP, Shadow Home Secretary
This is an issue which clearly deserves transparency and well-informed public debate. I hope that if the Government are intending to conduct a pilot project for ID cards they will have the good sense to describe the project fully and openly and let us all know how it is being evaluated. This way we can all learn whatever lessons it has to teach us in a rational fashion.

If it is true that legislation intended for passports is being used for this purpose, that is a disturbing indication that the required transparency is not the order of the day.

 
Simon Hughes MP, Liberal Democrat Home Affairs SpokesmanSimon Hughes MP, Liberal Democrat Home Affairs Spokesman
The UK suffers from passport fraud on a huge scale, and anything which can make passports more secure is welcome in principle. But it is entirely misleading for the Home Office to pretend this has nothing to do with identity cards. It is a small step from a smart passport to a smart ID card.

Last summer Labour committed itself to an open and transparent debate on identity cards. Seven months after the consultation period ended we are still waiting for them to publish the public's responses.

We need to see all the public responses, then we need to see the Government's reply. Only after a full and public debate should there be any decision about whether to go ahead.

 
Richard Barrington, eGovernment Director, Sun MicrosystemsRichard Barrington, eGovernment Director, Sun Microsystems
We are generally supportive of the initiaitves and our research shows that the majority of people are in favour of some form of identification, however, the physical logistics of trying to make it work are very difficult indeed.

I know what it takes for us at Sun to put a picture on a card for employee identification, so collecting biometric data from the whole population is a non-starter. It may work in a tightly controlled environment but will not work over the national population given the requirements to initialy identify the individual then collect the metric, process then store the data then critically access the data/image at the point of need....

The initiatives need to be thought through far more carefully and perhaps the Home Office might consider the outcomes of various local initiatives such as the 'Cornish Key'.

 
Conn Crawford, Chair of the Smart Card Networking Forum Conn Crawford, Chair of the Smart Card Networking Forum
The Politicians may have the answer - national security; illegal immigration; deterrence of crime are three possibilities but it would be unfortunate if biometrics were trumpeted as a solution to these mega-issues. Biometrics can only be a fraction of such solutions, and may not deliver even that.

The use of Biometrics does offer improvements on Password and Pin as tokens for authentication. But what might we be authenticating against - a National Identity Record? How would the individual member of the public be persuaded to sign-up for this? Surely not for less tangible benefits such as 'national security' or protection from Illegal Immigration.

Where would the biometric be stored? A national biometric 'repository' sounds challenging and presents an obvious target. Biometrics stored locally on SmartCard or sim and used for authentication in tandem with PKI might be less aggressive towards personal privacy. However, card technology is only now advanced to the point where an "on-card-match" can be achieved in 3-5 seconds (about the same time as Windows PKI, I'm told) so there has to be some doubt at the moment as to public acceptance - solutions have to be more convenient!

If standard and processes to collect and distribute Biometrics to licensed operators such as Local Authorities - perhaps the LAs could build functionality around them and help develop some more tangible benefits. Why local authorities? Because they have been managing 'registrations' from cradle to grave for years; because they are co-ordinating efforts to join up services locally and the idea of local accountability (within a strong national framework) may appeal to the user.

A further note of caution, however; Identity management is of critical significance to all forms of e-commerce and eGovernment but we need to make room for applications which do not depend on establishing a legal identity - there are many circumstances when the role of the applicant is as important as the identity of the individual and where it will be sufficient to authenticate the role, which has more to do with context and environment than personal characteristics. It would be sad to see investigations in these areas overwhelmed by a focus on a "National ID", however supported.

Is summary, I guess my view is that Biometrics are an important part of the future but we're not quite ready for them yet, neither technically nor operationally. A good start in a dialogue would be to dispense with any pre-conceptions about what a 'National' solution would look like.

 
Oliver Tattan, CEO of biometric identity management company DaonOliver Tattan, CEO of biometric identity management company Daon
I welcome the initiative by the Home Office to use biometrics for visas. Solutions using biometrics are secure and foolproof while maintaining privacy. In the roll out of this solution it will be important to ensure that a scalable, totally secure, robust identity management infrastructure lies at the heart of the solution to guarantee that it continues to perform in the long term.
 
Simon Davies, Director, Privacy International and Visiting Fellow, department of information systems, London School of EconomicsSimon Davies, Director, Privacy International and Visiting Fellow, Department of Information Systems, London School of Economics
Would I trust this government with my fingerscan or iris print? Not a chance in hell. The Home Office and the health services, to name but two offenders, are world masters of function creep. Whatever assurances over personal rights that have been given in the past have systematically been eroded. Protections once assured, are quickly compromised. Limitations of use and disclosure are dissolved at the first opportunity. I am ashamed to conclude that the UK government has become pathologically hostile to privacy and data protection.

Of equal concern to me is the endemic inability of this government to manage large scale IT projects. Readers of this publication will doubtless nod in agreement. When we talk of the fusion of flesh and machine my anxiety rises exponentially. The fallout from IT failure in a large scale biometric system is potentially devastating to the day-to-day functioning of individuals.

This question boils down to a matter of trust. The government quite clearly does not trust the citizen, and the citizen is transparently distrustful of government. Recent history has entrenched this sorry situation. If government wishes to pursue a path of perfect identity and traceability, it should keep in mind that the public will demand the same from public officials and departments.

 
Carol Calta, Director Vertical Markets – Public Sector, at Global Services provider, DamovoCarol Calta, Director Vertical Markets – Public Sector, at Global Services provider, Damovo
"Biometrics is not only a good thing for the Home Office, it is imperative in order to maintain participation within the US visa waiver program. The biggest challenge the UK has in implementing biometrics is not about the actual technology, which is already in use in multiple sites such as London City Airport. The challenge is how it will be presented to the public and how public opinion will form final approval, or disapproval. There is a clear difference between privacy and security. Privacy is assured by legislation. Security enables the enforcement of that legislation. It is essential that the UK Government takes a strong leading role in the handling of biometrics implementation which will in effect ensure UK citizen’s rights."

*