Original URL: https://www.theregister.com/2006/01/23/idcard_passport_roots/

Plan B from Petty France - the other UK ID card

Or more properly, the real one?

By John Lettice

Posted in Legal, 23rd January 2006 11:12 GMT

Analysis The UK is to go ahead with a biometric-backed system of ID verification this year, whether or not the ID Cards Bill is passed by parliament. The 'Plan B', which is going ahead under the auspices of the Passport Office and which does not require parliamentary approval, was touched on by Home Office Minister Baroness Scotland during the recent House of Lords debate ID cards debate.

She described a new service, "passport validation, a commercial service that will come on stream in 2006," which is an aspect of the Passport Service's Personal Identification Project (PIP). The validation/verification service is referred to briefly in the organisation's 2005-10 business plan, and is itself a sort of prototype for the ID card scheme.

It would be likely to have greater prominence if the ID card itself were to have a final unfortunate accident on its way to the statute book, but it's striking that most of the significant components of the ID card scheme already exist or are being built within the Passport Service, to the extent that one could easily view the Passport Service's planning as representing the key strategy, while the ID card scheme is more about extension, rationalisation and legal tidying up. So maybe not so much Plan B as Plan A.

This represents something of a problem to ID scheme opponents. Because the ID Cards Bill is simply one (albeit wide-ranging and high-profile) implementation of Government policy on national identity management, killing it without also overturning the strategy would at best slow up implementation. And, probably, make it more likely that other components of implementation would be put into place without parliamentary oversight and regulation. Lop off a tentacle, and more will grow for as long as the brain lives.

Baroness Scotland's description of the extent of the Passport Office's identity-related operations emerged as she attempted to persuade peers that much of the structure of the ID cards scheme will exist anyway as a consequence of the introduction of biometric passports, and that it is therefore perfectly feasible (as the Government has been claiming) for ID cards to be introduced for only a small extra cost.

This no doubt makes some sense if you're a Home Office Minister. But if you're not, it possibly makes more sense to see it as the Home Office loading costs and features that are not necessary for biometric passports onto the Passport Office in order to establish an ID scheme. These costs and features are however real, not pretend, and many of them will be incurred even if the ID scheme does die. Some of the substantial slug of identity-related infrastructure we'd still be left with would be owned by the Passport Service, and the Government strategic planning that goes along with the establishment of this infrastructure would tend to extend it into other Government departments and into the commercial sector.

So paradoxically, although it's correct to say that the Government is loading costs into the Passport Service in order to ease the introduction of ID cards, it's also to some extent correct to say that even without the ID cards scheme substantial costs will be incurred because of the approach to biometric passport introduction that has been chosen, and because of the way the Government sees identity.

A brief explanation of PIP illustrates this. The cornerstone of the Personal Identification Project is that it changes the basis of the Passport Service's operations from document-centric to person-centric. In the past the Passport Office has kept track of passports, but the new model keeps track of people. PIP is intended to "provide the UKPS with the capability to verify the identity of passport applicants and holders by accessing commercial databases and those of other government departments, improving fraud detection and prevention by more detailed yet automated/rapid checks into applicants' attributed and biographical information. This provides an infrastructure for identity verification that can be used by other government departments via data presented by a private-sector partner" (UKPS Business plan 2005-10).

So the initial function of PIP is to use information on the 'biographical footprint' of applicants in order to check that their application is genuine. A Births Marriages and Deaths online project is also part of the picture, with the UKPS planning to follow up its co-operation with the Office of National Statistics (to frustrate "Day of the Jackal" passport fraud) with a project to "link the UKPS with ONS electronic records (subject to legislation being passed allowing ONS to provide access) which will enable online checks of births, marriages and deaths."

The commercial "passport validation service" that exists at the moment in pilot form can't go much further than confirming that a passport is genuine, but the biographical data the UKPS is starting to compile from commercial sources, new applicants and the planned personal interviews will provide a much more solid identity verification system. The Government intends that UKPS forms the basis of a new agency to run the identity cards scheme and the National Identity Register, but it can be seen that as far as passports are concerned, the NIR is already under construction.

The step change the Passport Service's operation is undergoing becomes clearer if you look at it this way - in order to issue a passport, the Passport Service clearly has to ask sufficient questions to prove fairly conclusively that the applicant exists. However, in the future the Passport Service proposes to retain the answers to these questions and to build on them, producing a biographical narrative of that individual's continuing existence, OK?

Baroness Scotland helps explain the extent to which the National Identity Register already exists: "We have called the central new database 'the register', but noble Lords will be familiar with the fact that the Passport Office currently has a database. When we include the biometric data that will come from facial recognition and fingerprints, that information will have to be contained on that database. As a result of the demands made on the service, we have now piloted passport validation, a commercial service that will come on stream in 2006. It is demand-led because, even under the current legislation, there has been a demand for that from the business community.

"All of those items are coming anyway, and the passport service will have to provide for them. So if we look at the differences between the service that will be provided now and that which we anticipate will be necessary to be provided in the long term, the differences are not great. I will list them. A database of basic personal information and biometrics exists, and that will continue. An identity document that stores information, including biometrics, is already provided. The ability for banks and other organisations to validate identity documents with consent exists now in pilot form. Disclosure to the police and other agencies of data held on the passport database happens already, and this would include the equivalent audit usage data.

"So what is new? The production of cards as well as passports is new. We do not currently record changes of address, but we propose to do so in the future. The IT infrastructure will be slightly bigger; and the scheme will be enforced; that is, civil penalties, mainly post-compulsion."

You can see the inexorable logic when it's put like that. The database will exist, will include biometrics, and via passports alone will ultimately cover 80 per cent of the UK population. The Passport Service's transformation from a document-centred to a person-centred database positions it as the sole custodian of 'gold standard' identification in the UK, and the inclusion of biometric ID capabilities tying the individual to the identity document produces further potential benefits. When you go down to the bank to prove you exist, the bank can use a reader to associate you with the identity document, and all of the other claimed ID scheme benefits follow from there.

From this kind of perspective the fact that the UKPS ID Register (or, erm, "database", as Baroness Scotland puts it) can only ever cover those in the population who're UK passport holders is clearly anomalous. But if the ID scheme died and the Government nevertheless continues with the approach, and passport-linked biometric ID infrastructure begins to grow through Government and the commercial sector, we can anticipate how the tentacles will grow.

People might start demanding that ID documentation in a more convenient format (Passport Lite?) be issued. And you could envisage other Government departments (DWP, NHS and DVLA being obvious examples) increasingly using the UKPS database systems for the validation of their own existing ID documentation and systems, and dusting off plans to morph driving licences into ID cards, and to produce "entitlement cards".

The House of Lords, rightly, didn't accept that the Government's oft-quoted cost of £584 million for the ID scheme was anything like the total cost, because it's simply the running cost to the Home Office and does not include start-up costs and costs to other departments. But simply blocking ID cards will not necessarily allow us to avoid all of those other costs - they may be incurred more slowly and haphazardly, but they'll still exist.

As Baroness Scotland put it: "If we then look at the future, it would be easy to say, 'If we just put the Identity Cards Bill to one side these costs would not be expended'. As I hope that I have just indicated, that is unlikely because if we consider the way in which biometric data are being used and will be used in the future — the Passport Office is having to provide ID verification more and more now because those demands are being made upon it — we can see that this development will be necessary."

The 'it's coming anyway, so give in' argument has some strength, but we should bear in mind that the arguments that have been deployed against ID cards are equally valid deployed against a more clearly passport-led national identity scheme. The central database is just as vulnerable, the uncontrolled and unregulated linking of Government and private databases is just as invasive, and the underlying thinking is just as flawed. Which is as one should expect, given that the Passport Office plan is, to all intents and purposes, the blueprint, and the ID Cards Bill is a lot about extending the target population and tidying up the legal framework.

What legal framework? Well might you ask.

Passports are issued under Royal Prerogative, effectively executive powers of the monarch which are exercised by Government Ministers. These powers include the right to grant and revoke passports, exercised by the Home Secretary and the Foreign Secretary.

Three years ago Parliament's Public Administration Select Committee suggested that this and other aspects of the Royal Prerogative (starting wars, that kind of stuff) be put on a more formal statutory basis, but the Department of Constitutional Affairs declined to pursue the matter, observing on passports that "successive Governments have taken the view that the non-statutory system has worked well and that change is not required."

The Government did, last year, say that it could add fingerprints to passports via the Royal Prerogative, but as all of the Passport Service's identity-related plans are going ahead with or without the ID Card Bill, clearly it's all happening under the Prerogative.

Which you might reckon stretches the legal framework well beyond breaking point. Lack of Parliamentary oversight? You ain't seen nothing yet.

It is practically impossible to justify the UK Passport Service's identity management plans as being encompassed by a Royal Prerogative intended simply to cover the granting and revoking of passports, even taking into account the requirements of new international standards. As far as biometric passports are concerned, it's been pointed out repeatedly (not least by The Register that in order to conform to ICAO standards the UK need only add a chip containing a digitised passport photograph to existing passports (which is what the Passport Service is actually doing for biometric passport phase one in this very quarter).

There is no need for a biometric database or online checking, because the thinking underlying the ICAO biometric passport standard is that it should be possible to link the bearer to the document by locally checking the bearer's biometrics against those held on the document. So long as you're confident the document isn't forged or fraudulently issued, you don't even need to keep the biometric data in a database - you could even, as some countries intend to do, just throw it away. You know the document is genuine, hence you know the person is genuine, and you don't need any other information.

Nor (we've said this a lot too) does the UK need to add fingerprints to its passports. The EU's Schengen countries are currently committed to do so, but the UK is not a Schengen country, and does not have to conform to this standard. But again, if we wish to add fingerprints in anticipation of their becoming a widespread international requirement, we could do this on the basis that the individual was matched locally against the document, and for the specific purposes of passport issue and administration we do not need to have the fingerprint data online, or even retained.

There's clearly an argument that even the Passport Office's move from document-centric to person-centric and the consequential construction of its version of the NIR steps beyond the Royal Prerogative (which covers documents, not people). The assertion, "All of those items are coming anyway, and the passport service will have to provide for them" most certainly goes many steps beyond it.

There may well be arguments that commercial demand (should such a thing really exist) for identification services from Government should be met, and we may all view it as a good idea for a database of all UK citizens' fingerprints to exist to allow for "the checking of unidentified fingerprints at scenes of crime" (which was put forward by Baroness Scotland as one of the "extra benefits" of the ID scheme). But it is by no means obvious that the Passport Service has the powers to provide these things, that it is the appropriate department to do so, or that providing them via a centralised Government identity monopoly is the sensible way to do it.

If the ID Cards Bill becomes law, then the legal framework changes. The legislation could be said to place the Passport Service's identity operations on a statutory basis, overseen by the new authority the Passport Service will become, and therefore "all of these items that are coming anyway" will be retrospectively legitimised. But if the Bill doesn't become law, and all of these items continue to come, anyway, then there will be a whole growing edifice there we should be asking a lot of hard questions about. And under the circumstances, maybe the Queen should be asking a few herself... ®