Feeds

Everything you never wanted to know about the UK ID card

Name, rank, serial number...

  • alert
  • submit to reddit

3 Big data security analytics techniques

Security and usability

We can't comment on the security of the system at this juncture, but we can run down its sins against security good practice fairly readily. Experts who've given evidence to the Home Affairs Committee ID card enquiry so far have tended to fall into two camps on the scheme. The critics argue that placing all your eggs in one basket is stupid, while the apologists/supporters say that in principle the system can be made secure. If you're not immediately with the critics on this one, consider how the apologists react when pressed. They accept that by placing a great deal of reliance on one card, ID, database or whatever you are inevitably increasing the stakes, but say that in principle the system can be made to function, and can be secure. Pressed further they then concede that we can never guarantee anything 100 per cent.

Security experts would be largely with the critics on this one - single points of failure are bad. The proposed ID system, however, has numerous of these, at least conceptually. If you actually need your ID card as the pivotal ID around which your life revolves, allowing you to use government services, financial services, buy stuff, then you're snookered if it breaks. Or if the network breaks. Or the Register.

We also need to be concerned about what happens if the card (or the ID without the card) is stolen or compromised. Now, in principle this ought to be impossible or very hard, because the system is dependent on your particular biometric signature. But we've already noted government suggestions of areas where this would not be read, and we've suggested that not checking the biometric or not checking against the central database will be fairly common. So the theft value of the card will depend on how much of value can be obtained using it without tripping a strong biometric check. The more it is used for daily transactions, the higher this value will be.

David Blunkett has claimed the system "will make identity theft and multiple identity impossible, not nearly impossible, impossible." Clearly this is untrue, but we need to assess the extent of its untruthfulness; aside from situations where ID theft is enabled by the security systems not actually being used, what about the possibility of the card, or the system, being compromised? Currently it is clearly harder to forge a biometric passport than it is a conventional one, but as biometric passports do not yet exist, why should forgers try to forge one? How much of the difficulty is because of it actually being harder, as opposed to there not having been any motivation for anybody to develop the skills yet? Clearly we can't yet be sure, but you can see the likely dangers. Traditional avenues such as switching the picture and changing the details may still be viable (although surely a bit more complicated) in instances where the biometric isn't read, and altering the biometric itself (clearly harder until it's cracked - then it's easy) could be useful if there's no network check, or depending on the procedures implemented around that check (see Passport Control, above). And there's also the job of making sure any invisible data tallies up - but never say never, it's at least as theoretically possible as the system is theoretically invulnerable, and if it is cracked, the Home Office has a very expensive security update rollout on its hands.

The alternative to this is a more distributed, defence-in-depth, horses-for-courses approach where you use different strengths of ID, different cards and different systems where appropriate. A mugshot and a bearer who looks like she might be 12 is enough for a child's weekly season ticket, surely, while (despite howls to the contrary about identity fraud) a piece of plastic and a PIN is good enough to get a bank to give you money. Would the banks like a 100 per cent secure system? Certainly. Will the banks accept a system that eliminates fraud while turning away significant numbers of genuine customers? Not a chance. What they've got now is their current best compromise, and the ID system is not going to change that. Similarly, although the state of the NHS and National Insurance ID systems is lamentable, that is not entirely caused by the UK public sector being historically crap at implementing IT projects. It is in no small measure due to the fact that it really doesn't matter much. Certainly there's a fraud component in there, but it's an acceptable one from the point of view of the particular system, otherwise the system would have reacted by doing something about it. A rational estimate of the annual cost of 'health tourism', for example, is £200m out of a total budget of £70bn. From the system's point of view there is absolutely no point in it diverting resources from its primary objectives in order to tackle a problem that small.

Other government ID systems can be positioned at different points along the scale. National Insurance should obviously be concerned about the use of fraudulently obtained numbers to get benefits, but hasn't a great deal of reason to worry about the status of a user provided they're working and paying in the money. Inland Revenue has more reason to be concerned about tying the number to real people in order to avoid tax frauds, and so on. There are varying levels of need in terms of identification, and it doesn't necessarily make sense to try to fulfill them all by attempting to devise a single, bulletproof ID system. And in the case of benefit fraud, although the Department of Work and Pensions has estimated total losses at £2bn, or £7bn, or vast numbers in between, it confesses it reckons ID-related benefit fraud amounts to a whole £50m.

High performance access to file storage

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
Sorry London, Europe's top tech city is Munich
New 'Atlas of ICT Activity' finds innovation isn't happening at Silicon Roundabout
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.