The Politics and Technology of Identity Why is

The Politics and Technology of Identity: Why is it so difficult to establish a UK identity policy? Department of IS University of Melbourne April 23 2007 Presenter: Professor Leslie Willcocks The London School of Economics on behalf of the ISIG LSE Identity Project - Gus Hosein, Edgar Whitley, Simon Davies and Ian Angell

2002 Efficient public services “After the terrorist atrocities in the United States on 11 September 2001, I was asked whether the Government was considering introducing identity cards. I said at the time that any debate about identity cards should not centre exclusively on issues of national security. Far more important are the issues of citizenship and entitlement to services and it is in this context that I would like to see the debate unfold. ” David Blunkett

2005: Labour Manifesto “We will introduce ID cards, including biometric data like fingerprints, backed up by a national register and rolling out initially on a voluntary basis as people renew their passports”

Design of the scheme National Identity Register Use of biometrics: face, finger, iris Online verification: done everywhere Audit trail of verifications Use by and payment from the private sector Paid for by the public

Multiple purposes Must prevent identity theft Must prevent terrorism Must be in accordance with international obligations Must be designed by the Home Office Must enable e-government and access to government services ----Painting yourself into a corner?

Powers Legal Registration Identification Compulsion Power to Disclose Power to Compel Documentation Penalties Biographical Data Biometrics National Identity Register Card ID Number Recipients Private & Public Sector Data Systems Biometrics Disclosures

2005: The Bill version 2 Reintroduced after General Election First reading May 2005

The Government is introducing an ID card but it isn’t sure why.

Reason 1: Combating terrorism. A third of all terrorists use multiple identities.

Reason 2: Efficient Public Services. Create an ‘entitlement card’ that allows us to gain access to public services.

Reason 3: International Obligations. • International obligations to create ‘biometric passports’. Blame America. • “US visa waiver scheme requirements for passports to contain a facial biometric from October 2006” • ID Cards are everywhere in the world. • “EU mandate of both facial biometrics (August 2008) and fingerprints (2009) for Member States’ passports within the Schengen area”

Reason 4: Identity Theft. Identity theft costs the UK economy £ 1. 3 bn GBP per year.

Reason 5: Imperative. Technology and global politics are converging in a way that permits and requires the creation of such a system. "The next few years are going to see effectively a visa and passport revolution across the EU and the developed world. We have the chance to use this opportunity to get ahead in this change and the move, therefore, to biometric passports makes identity cards an idea whose time has come. " - Tony Blair, June 26, 2005

Reason 6: Terrorism. Greatest civil liberty of all is the ability to go to work without being blown up.

Reason 7: Identity Theft. Identity theft costs the UK economy 1. 3 bn GBP per year. 1. 7 bn!!

Reason 8: Terrorism.

Reason 9: Illegal immigration (Nov. 2006) § Companies are expected to verify the legal status of employees and can face large fines for employing illegal workers § 23 prosecutions under the Asylum and Immigration Act between 1999 and 2003 § Home Office used a firm that supplied five illegal immigrants who worked as cleaners at the Immigration and Nationality Directorate

Reason 10: 'Modernity' "The real issue here is not privacy or cost, it is modernity. We face some new problems. Biometric technology offers new solutions. But, in addition, we can already glimpse what else might be possible. " - Tony Blair's monthly press conference, 6 November 2006

The LSE Report no. 1

So many questions. . . 1. What are these 'international obligations'? 2. What are other countries doing? 3. What are the implications of the Home Office designing the system? 4. Does the 'technology' 'work'? 5. Are the government’s claims precise? 6. How will this affect policing? 7. Are there alternative structures and technologies?

The LSE Identity Project Main report: 27 June 2005 1. Evaluated the impact of identity cards on national security, organized crime and terrorism; policing; race, discrimination and immigration; and identity fraud. 2. Reviewed the use of biometrics, the security and safety of the National Identity Register as well as international obligations on identity documents and the legal environment in the UK 3. Considered issues of public trust and the government IT environment in the UK 4. Presented an alternative blueprint for identity management in the UK

LSE Identity Project 1. Technologies are challenging, e. g. biometrics. 2. Home Office design is risky and complex. 3. International obligations are mythical. 4. Legal problems remain significant. 5. Government track-record on IT projects is problematic. 6. Costs are likely to be higher than predicted. 7. Alternative designs exist - centralised v. decentralised.

LSE analysis not admired popular. . . 1. “Some of the figures bandied around about cost are absolutely absurd” - Tony Blair 2. Mr Clarke said it was “technically incompetent” and contained figures that were “simply mad”. He accused the LSE of running a campaign against ID cards. Behind the scenes the Home Office has been pressuring the university to withdraw the study in a way that Sir Howard Davies, its director, has described as “bullying and intimidating behaviour”. So there you have it. Our elected government lies and it bullies. - Times Editorial, July 3, 2005 -

After Parliamentary Debate debate • Legislation is passed March 2006 § Scheme virtually identical to 2002 model § Amendment on cost reporting (s 37 report) • New agency: UK Identity and Passport Service launched on April 1 st 2006 • James Hall (ex Accenture) appointed Chief Executive October 2006

Formal Reviews 2003 -2006

OGC Gateway reviews • Gateway Review 0: June 2003 • Gateway Review 0 (strategic assessment): January 2004 • Gateway Review 1 (business justification): July 2005 • Gateway Review 0 (strategic assessment): January 2006 • Gateway Review 2 (procurement strategy): April 2006

KPMG • Cost Methodology and Cost Review § Outline Business Case Review • Extract published 7 November 2005 § “We conclude that the methodology used to cost the ID Cards proposals is robust and appropriate for this stage of development”

Parliamentary comment “We are not saying that we can go from what we have now to a database covering 60 -odd million people overnight, hoping and praying that the IT and the procurement will work and that everything will be successful. We have learned the lessons of the past, and this project has to be rolled out on a phased basis” Tony Mc. Nulty 18 October 2005

“Projects such as this will always face such challenges and opinions in the field of technology will differ. However, the body of representations within industry, existing project experience and research by established experts in the field of biometrics and database technology indicate that we are right to proceed with our plans at this stage” Baroness Scotland 31 October 2005

“The scheme has been through a series of gateway reviews, and … that directly builds on experience learned from past failures. Some of the people involved in the process have been involved in other major public and private sector procurement. … Obviously, they have clearly learned the lessons and know exactly what they are doing now” Andy Burnham 13 February 2006

“I cannot comment on a hypothetical problem. I am not anticipating something major that would completely delay or derail the programme. I would like to reassure the committee that nothing is more important than getting this right” Joan Ryan 14 June 2006

Procurement process to start immediately …

But Leaked emails…. . Sunday Times 9 July 2006 “Also even if everything went perfectly (which it will not) it is very debatable (given performance of Govt ICT projects) whether whatever TNIR [The National Identity Register] turns out to be (and that is a worry in itself) can be procured, delivered, tested and rolled out in just over two years and whether the resources exist within Govt and industry to run two overlapping procurements”

Proved Damaging…. “What benchmark in the Home Office do we have that suggests that this is even remotely feasible? I conclude that we are setting ourselves up to fail” Email from David Foord, OGC Sent 8 June 2006

And a Ministerial Change. . . reviews New Home Office Minister John Reid: Full scale review of all Home Office operations “In December, the Government will be publishing plans for the introduction of the National Identity Scheme which will provide more detail on the contribution which existing assets could make to the delivery of the scheme”

Leads to Sir James Crosby Chancellor appoints Sir James Crosby to lead Public Private Forum on Identity § Reports back April 2007 James Hall: IPS procurement will start “next summer” (2008)

Time For A Review A Radical Redesign?

“The review identified that there may be existing technical infrastructure and systems that could be used as the basis for reducing the delivery and cost risks associated with the identity card project” “I did not mean to imply that a solution might involve stringing a number of legacy databases together. That has never been part of this proposition. We have always said that our requirements are for a data repository that could be populated one record at a time” Katherine Courtney

“A change in the way in which the scheme is to be phased in would require considerable reworking of the current identity cards business plan and procurement strategy. This would create further delay in the programme and so could add to costs” Baroness Scotland

Looking Back - Some Issues (1) Biometrics

Testing biometric technology “The goal of the …Trial was to test the processes and record customer experience and attitude during the recording and verification of facial, iris and fingerprint biometrics, rather than test or develop the biometric technology itself—it was not a technology trial. We will be undertaking further trials and testing in due course but do not have any immediate plans for further trials at this stage” “We anticipate piloting the recording of fingerprints as a second biometric from volunteers in late 2007. This prepares the UK to match mandated EU standards for both fingerprint and facial biometrics for Schengen area passports”

Biometrics in s 37 report • Discussion of expanding fingerprinting • No explicit mention of iris scanning

Some Issues (2) Verifications

Cost of verification § Base case £ 0. 57 § Least appealing £ 2. 00

Biometric or PIN verification? “Biometrics are being used to more strongly tie a verified identity to an individual. In this way, biometrics can be used along with an ID card to verify that identity against the record held for that card. Other forms of authentication, such as PIN numbers and passwords can be stolen along with a card so are much weaker at linking a person to an identity” Andy Burnham

Some Issues (3) Liability

1. Society will depend on the integrity of the system § to establish the eligibility of each party to conduct a transaction § to assign the limitations of liability in the event of a failure 2. Government proposals are currently ‘unclear’ on this point

Some Issues (4) Security

We Were Not Alone. . . “Putting a comprehensive set of personal data in one place produces a honeypot effect - a highly attractive and richly rewarding target for criminals. The system was “something that no technologist would ever recommend. ” “I have concerns with the current architecture and the way it looks at aggregating so much personal information and biometrics in a single place. There are better ways of doing this. Even the biometrics industry says it is better to have biometrics stored locally. ” - Jerry Fishenden, NTO Microsoft UK

"A national ID card for the UK is overly ambitious, extremely expensive and will not be a panacea against terrorism or fraud, although it will make a company like mine very happy. " - Roberto Tavano, biometrics specialist for Unisys

“The Bill's provision for the retention of extensive personal information relating to all or large sections of the population may be insufficiently targeted to be justified as proportionate to the statutory aims and may lead to disproportionate interference with Article 8 rights. " - Joint Committee on Human Rights

“Perhaps in the past the Government in its enthusiasm oversold the advantages of ID cards. We did suggest or at least implied that they may well be a panacea for ID fraud, benefit fraud, terrorism and entitlement, and access to public services. ” - Tony Mc. Nulty, Home Office Minister, July/August 2005

But they ignored it anyway. . . "The creation of the National Identity Scheme, employing cutting edge biometric technology, will provide the nation with a safe and secure means of confirming identity in everyday life. It will also enable us to crack down on abuse of our free public services by those not entitled to them. " - Andy Burnham, Safeguarding Your Identity: IPS Sets Out Ten Year Plans, April 21, 2006.

"We have been looking at this for many years, actually several years before I joined the programme as a matter of fact. Before the policy decisions in principle were even taken, quite a lot of feasibility analysis went forward. . Those studies came back showing that the technical risks to a programme like this were medium risks and were manageable and actually the important thing to focus on was of course the business risks and making sure that we are getting the business process right and all the other factors around how you identify a person and register their identity, and then confirm it. " - Katherine Courtney before Parliament’s Science and Technology Committee, March 22, 2006.

"I find that answer, with the greatest respect, absolutely astounding. Two weeks ago, the Committee was in the United States talking to the Department of Homeland Security who said exactly the opposite to what you have said. - Chairman of the Committee, Q 272, March 22, 2006

Politics or Policy? • "[T]he Government is not alone in recognising a number of factors that cast doubt on the credibility of parts of the report as well as the impartiality of the report’s core team. • The Government supports the right of such individuals or groups to express their views in open debate. However, such views do not necessarily constitute objective, rigorous academic research. • Therefore the Government maintains it was entitled to defend its proposals and to assert that the report was not as independent or accurate as was claimed by its authors. §- Home Office response to Parliamentary Science and Technology Committee, October 2006

Politics or Policy? Mr. Byrne: The hon. Gentleman would be wise not to pray in aid the LSE report. That report ignored research from the National Physical Laboratory, exaggerated the cost of verifying identity information and had some pretty basic problems with its maths. It overstated the number of people who might have problems giving biometric data by an extraordinary 1, 800 per cent, so I am not sure that is the report to pray in aid in support of the hon. Gentleman’s argument. - Parliamentary Question, February 20, 2007

Politics or Policy? "The cost argument we can certainly address pretty easily, the LSE report has been pretty comprehensively rubbished by virtually everybody - it wasn't an LSE report, it was somebody who happened to work for the LSE - we've gone through that. - Stephen Pound, MP, March 9, 2007

Conclusion Why is it so difficult to establish an identity policy? 1. Political process may not be the best way to come up with design specifications. 2. Dream of what technology will bring is hard to resolve with what technology may do. 3. Projects that entail involvement of entire population are hard to plan, harder to implement, and likely harder to induce.

1. "It is, to me at least, almost incredible that the proposal to introduce an identity register in the UK should be so extraordinarily controversial. But it is. " §- Tony Blair, August 2006 Coda: It is currently planned that the first identity cards for UK citizens will be issued from 2009

Contacts at LSE 1. I. hosein@lse. ac. uk 2. e. a. whitley@lse. ac. uk 3. http: //identityproject. lse. ac. uk