Feeds

Everything you never wanted to know about the UK ID card

Name, rank, serial number...

  • alert
  • submit to reddit

Remote control for virtualized desktops

Security and usability

We can't comment on the security of the system at this juncture, but we can run down its sins against security good practice fairly readily. Experts who've given evidence to the Home Affairs Committee ID card enquiry so far have tended to fall into two camps on the scheme. The critics argue that placing all your eggs in one basket is stupid, while the apologists/supporters say that in principle the system can be made secure. If you're not immediately with the critics on this one, consider how the apologists react when pressed. They accept that by placing a great deal of reliance on one card, ID, database or whatever you are inevitably increasing the stakes, but say that in principle the system can be made to function, and can be secure. Pressed further they then concede that we can never guarantee anything 100 per cent.

Security experts would be largely with the critics on this one - single points of failure are bad. The proposed ID system, however, has numerous of these, at least conceptually. If you actually need your ID card as the pivotal ID around which your life revolves, allowing you to use government services, financial services, buy stuff, then you're snookered if it breaks. Or if the network breaks. Or the Register.

We also need to be concerned about what happens if the card (or the ID without the card) is stolen or compromised. Now, in principle this ought to be impossible or very hard, because the system is dependent on your particular biometric signature. But we've already noted government suggestions of areas where this would not be read, and we've suggested that not checking the biometric or not checking against the central database will be fairly common. So the theft value of the card will depend on how much of value can be obtained using it without tripping a strong biometric check. The more it is used for daily transactions, the higher this value will be.

David Blunkett has claimed the system "will make identity theft and multiple identity impossible, not nearly impossible, impossible." Clearly this is untrue, but we need to assess the extent of its untruthfulness; aside from situations where ID theft is enabled by the security systems not actually being used, what about the possibility of the card, or the system, being compromised? Currently it is clearly harder to forge a biometric passport than it is a conventional one, but as biometric passports do not yet exist, why should forgers try to forge one? How much of the difficulty is because of it actually being harder, as opposed to there not having been any motivation for anybody to develop the skills yet? Clearly we can't yet be sure, but you can see the likely dangers. Traditional avenues such as switching the picture and changing the details may still be viable (although surely a bit more complicated) in instances where the biometric isn't read, and altering the biometric itself (clearly harder until it's cracked - then it's easy) could be useful if there's no network check, or depending on the procedures implemented around that check (see Passport Control, above). And there's also the job of making sure any invisible data tallies up - but never say never, it's at least as theoretically possible as the system is theoretically invulnerable, and if it is cracked, the Home Office has a very expensive security update rollout on its hands.

The alternative to this is a more distributed, defence-in-depth, horses-for-courses approach where you use different strengths of ID, different cards and different systems where appropriate. A mugshot and a bearer who looks like she might be 12 is enough for a child's weekly season ticket, surely, while (despite howls to the contrary about identity fraud) a piece of plastic and a PIN is good enough to get a bank to give you money. Would the banks like a 100 per cent secure system? Certainly. Will the banks accept a system that eliminates fraud while turning away significant numbers of genuine customers? Not a chance. What they've got now is their current best compromise, and the ID system is not going to change that. Similarly, although the state of the NHS and National Insurance ID systems is lamentable, that is not entirely caused by the UK public sector being historically crap at implementing IT projects. It is in no small measure due to the fact that it really doesn't matter much. Certainly there's a fraud component in there, but it's an acceptable one from the point of view of the particular system, otherwise the system would have reacted by doing something about it. A rational estimate of the annual cost of 'health tourism', for example, is £200m out of a total budget of £70bn. From the system's point of view there is absolutely no point in it diverting resources from its primary objectives in order to tackle a problem that small.

Other government ID systems can be positioned at different points along the scale. National Insurance should obviously be concerned about the use of fraudulently obtained numbers to get benefits, but hasn't a great deal of reason to worry about the status of a user provided they're working and paying in the money. Inland Revenue has more reason to be concerned about tying the number to real people in order to avoid tax frauds, and so on. There are varying levels of need in terms of identification, and it doesn't necessarily make sense to try to fulfill them all by attempting to devise a single, bulletproof ID system. And in the case of benefit fraud, although the Department of Work and Pensions has estimated total losses at £2bn, or £7bn, or vast numbers in between, it confesses it reckons ID-related benefit fraud amounts to a whole £50m.

Internet Security Threat Report 2014

More from The Register

next story
Bladerunner sequel might actually be good. Harrison Ford is in it
Go ahead, you're all clear, kid... Sorry, wrong film
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Forget Hillary, HP's ex CARLY FIORINA 'wants to be next US Prez'
Former CEO has political ambitions again, according to Washington DC sources
prev story

Whitepapers

Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.