Everything you never wanted to know about the UK ID card

Name, rank, serial number...

  • alert
  • submit to reddit

Internet Security Threat Report 2014

What will you pay? No, really pay?

David Blunkett has recently been pushing contorted piece of reasoning whereby he establishes that the cost of an ID card is in fact £4, rather than the large sums he will be charging. This implausible pitch hinges on the claim that most of the money would have to be spent in order to modernise the passport system anyway, but it kind of misses the point even if you were to accept that. If it is the state as a whole that requires something, then it is the state as whole that pays, and the money comes back through general taxation, right? Chancellor Gordon Brown refused to pay for it out of general taxation, as he does regarding much else, but if it had been an absolute necessity, then he couldn't have refused. Kick and scream for a long time, yes, but refuse, no.

So one has one's doubts, and if one counter-argues that it's really the people travelling and driving who need the modernisations and should therefore pay, one still has to explain the others. The people who currently have to pay absolutely nothing for an ID card because they don't need to have one will have to pay their £4 in the form of a £35 payment in order to get an ID card. Of course, it's not compulsory. Until it is.

And we could point to the essential weirdness of arriving at a situation where everybody in the country has to pay individually for something they have no choice but to buy. Isn't that a tax? And if it's not, then what's the point of taxes? Couldn't we just abolish them all and pay for everything by name? This hypothecation madness is however more properly a matter for New Labour's conscience than it is for The Register (capital T, emphasis), so we'll move on to the £3.1bn.

You can, with the aid of the tried and tested UK government IT project algorithm, double this and add ten per cent for luck. Some people already have, and we wouldn't put money on them being wrong. But what you cannot do is say why it will cost £3.1bn (or at least £3.1bn, if you insist). The home Office has been solemnly saying 3.1 for months now, but has not said how it arrived at this figure. This makes it remarkably difficult to assess whether it's going to be money well spent or not. As Ross Anderson said (along with much else worth reading) in his evidence to the Home Affairs Committee, " If the thing remains covered by Official Secrets to the point that even Parliament does not know which path the Home Office is intending to take, then that is bad news."

We now have an indication of the path the Home Office intends to take, but we do not have cost breakdowns and we have not been presented with alternatives, ranging from simple modernisation of the passport system up to universal ID megaproject, with relevant estimates. We are supposed to be being consulted, but we have not been given sufficient justification for the rejection of the lesser options to be able to make an informed judgment on the adoption of the maximalist one.

It's difficult to conceive that any system at the minimal end of the scale could possibly cost as much as £3.1bn. If it's the case that passports need to be upgraded in order to conform to the US requirement for ICAO standard biometrics, then it is simply necessary that it have a facial biometric. Although the European Commission envisages the harmonisation of ID documents in the EU using biometrics, and intends fingerprint to fulfill the main role here, it has not ordered the introduction of ID cards where they don't exist. Nor need fingerprints be on passports, visa and ID documents for third country nationals immediately. Says the Commission: "...it could be considered that in their implementation Member States should have more flexibility. The facial image should be introduced as the first biometric identifier for reasons of interoperability. The introduction of the compulsory fingerprints need not necessarily happen at the same time, as it has not been decided whether the VIS [Visa Information System] will include biometric data from its very beginning."

So if the Commission's drive for a "coherent approach" stands, then we will have facial biometric and fingerprint on passports, but we don't have to put both of them in yet. We could anticipate the Commission in order to save expenditure on future revisions, but we could possibly do as Canada has so far - leave space for the print, pending a final decision and/or (in Canada's case) a satisfactory agreement with the US.

So what would this cost? You would have to allow for the new passport production processes, and you'd need to spend money on sufficient biometric reader systems to support passport applications. The total would most certainly not be £3.1 billion. But ah, you say, you'd also need the readers at entry and exit points, the central database and the network connecting it all. This is quite possibly the conclusion the Home Office has jumped to, but it ain't necessarily the right conclusion.

The equipment you need is determined by what it is that you propose to do with the system. The current requirement is for passports with a facial biometric, but there is no requirement for you to actually read that biometric. And actually, those countries which intend to read facial biometrics with a view to learning something useful from them will give up fairly swiftly, for reasons explained above; the United States' current collection of mugshots at entry points speaks of some kind of cryogenic mindset, collecting the database in the hope that scientific advancement will eventually cure it. Here, we could perfectly well have toed the ICAO line by including facial and just carrying on identifying people by looking at the picture.

We could certainly (and being us, we surely would) keep the biometric data on a central database for reference, but there's absolutely no need for us to actually access this database from checking points. We could, perfectly validly, view the biometric simply as a strengthening of the integrity of the document, and use a combination of visual appearance, supporting information and common sense to tie the bearer to the document. This is not as strong as the theoretical strength of the £3.1bn system we're not sure will actually work, but it's considerably stronger than what we have, and could be seen as a highly cost-effective reform of the passport system. And, as various scenarios put forward above indicate, it is via the strengthening of the document that the bulk of the general gains of the system can be achieved. Some countries, incidentally, take this position to the extent that they throw away the biometric after it's been included in the document. The biometric in the document ties the individual to the document, so you don't need to store the biometric any more, right?

Providing a secure and efficient Helpdesk

Next page: Summary

More from The Register

next story
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story


Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.