Everything you never wanted to know about the UK ID card

What will you pay? No, really pay?

David Blunkett has recently been pushing contorted piece of reasoning whereby he establishes that the cost of an ID card is in fact £4, rather than the large sums he will be charging. This implausible pitch hinges on the claim that most of the money would have to be spent in order to modernise the passport system anyway, but it kind of misses the point even if you were to accept that. If it is the state as a whole that requires something, then it is the state as whole that pays, and the money comes back through general taxation, right? Chancellor Gordon Brown refused to pay for it out of general taxation, as he does regarding much else, but if it had been an absolute necessity, then he couldn't have refused. Kick and scream for a long time, yes, but refuse, no.

So one has one's doubts, and if one counter-argues that it's really the people travelling and driving who need the modernisations and should therefore pay, one still has to explain the others. The people who currently have to pay absolutely nothing for an ID card because they don't need to have one will have to pay their £4 in the form of a £35 payment in order to get an ID card. Of course, it's not compulsory. Until it is.

And we could point to the essential weirdness of arriving at a situation where everybody in the country has to pay individually for something they have no choice but to buy. Isn't that a tax? And if it's not, then what's the point of taxes? Couldn't we just abolish them all and pay for everything by name? This hypothecation madness is however more properly a matter for New Labour's conscience than it is for The Register (capital T, emphasis), so we'll move on to the £3.1bn.

You can, with the aid of the tried and tested UK government IT project algorithm, double this and add ten per cent for luck. Some people already have, and we wouldn't put money on them being wrong. But what you cannot do is say why it will cost £3.1bn (or at least £3.1bn, if you insist). The home Office has been solemnly saying 3.1 for months now, but has not said how it arrived at this figure. This makes it remarkably difficult to assess whether it's going to be money well spent or not. As Ross Anderson said (along with much else worth reading) in his evidence to the Home Affairs Committee, " If the thing remains covered by Official Secrets to the point that even Parliament does not know which path the Home Office is intending to take, then that is bad news."

We now have an indication of the path the Home Office intends to take, but we do not have cost breakdowns and we have not been presented with alternatives, ranging from simple modernisation of the passport system up to universal ID megaproject, with relevant estimates. We are supposed to be being consulted, but we have not been given sufficient justification for the rejection of the lesser options to be able to make an informed judgment on the adoption of the maximalist one.

It's difficult to conceive that any system at the minimal end of the scale could possibly cost as much as £3.1bn. If it's the case that passports need to be upgraded in order to conform to the US requirement for ICAO standard biometrics, then it is simply necessary that it have a facial biometric. Although the European Commission envisages the harmonisation of ID documents in the EU using biometrics, and intends fingerprint to fulfill the main role here, it has not ordered the introduction of ID cards where they don't exist. Nor need fingerprints be on passports, visa and ID documents for third country nationals immediately. Says the Commission: "...it could be considered that in their implementation Member States should have more flexibility. The facial image should be introduced as the first biometric identifier for reasons of interoperability. The introduction of the compulsory fingerprints need not necessarily happen at the same time, as it has not been decided whether the VIS [Visa Information System] will include biometric data from its very beginning."

So if the Commission's drive for a "coherent approach" stands, then we will have facial biometric and fingerprint on passports, but we don't have to put both of them in yet. We could anticipate the Commission in order to save expenditure on future revisions, but we could possibly do as Canada has so far - leave space for the print, pending a final decision and/or (in Canada's case) a satisfactory agreement with the US.

So what would this cost? You would have to allow for the new passport production processes, and you'd need to spend money on sufficient biometric reader systems to support passport applications. The total would most certainly not be £3.1 billion. But ah, you say, you'd also need the readers at entry and exit points, the central database and the network connecting it all. This is quite possibly the conclusion the Home Office has jumped to, but it ain't necessarily the right conclusion.

The equipment you need is determined by what it is that you propose to do with the system. The current requirement is for passports with a facial biometric, but there is no requirement for you to actually read that biometric. And actually, those countries which intend to read facial biometrics with a view to learning something useful from them will give up fairly swiftly, for reasons explained above; the United States' current collection of mugshots at entry points speaks of some kind of cryogenic mindset, collecting the database in the hope that scientific advancement will eventually cure it. Here, we could perfectly well have toed the ICAO line by including facial and just carrying on identifying people by looking at the picture.

We could certainly (and being us, we surely would) keep the biometric data on a central database for reference, but there's absolutely no need for us to actually access this database from checking points. We could, perfectly validly, view the biometric simply as a strengthening of the integrity of the document, and use a combination of visual appearance, supporting information and common sense to tie the bearer to the document. This is not as strong as the theoretical strength of the £3.1bn system we're not sure will actually work, but it's considerably stronger than what we have, and could be seen as a highly cost-effective reform of the passport system. And, as various scenarios put forward above indicate, it is via the strengthening of the document that the bulk of the general gains of the system can be achieved. Some countries, incidentally, take this position to the extent that they throw away the biometric after it's been included in the document. The biometric in the document ties the individual to the document, so you don't need to store the biometric any more, right?