Feeds

Decoupling from passports added to ID Card Bill's woes

And more cards, less fingerprints?

Security for virtualized datacentres

Government suffered further defeats on ID Cards last night, as the House of Lords voted to make the scheme voluntary, and to require a further Act of Parliament before ID cards can be made compulsory. The Government has already stated that it intends to reverse the Lords' amendments in the Commons, but as it now has to deal with several substantial changes, and the Dear Leader has several other controversial pieces of legislation on his plate, it may have a difficult time of it.

Last night Lord Bassam of Brighton and Baroness Scotland cut lonely figures arguing - and losing - the Government's case. But along the way they produced some interesting information on the content of the ID card which Government seems, unaccountably, to have been unable to share with us previously. Baroness Scotland said that there were no plans to place any information that the holder was unaware of on the card's chip, and that it would "simply contain the information on the face of the card, technical information regarding the functioning of the card itself, a facial image and two fingerprints." The Register greets this last blurt with particular satisfaction, as we calculated that the card would be likely to house only two fingerprints last October.

According to Lord Bassam, neither address nor telephone number will be printed on the card and "if verification of address is necessary, it can be done against the register". This tells us a little about the kind of transactions the card will most commonly be used for. Currently UK banks tend to ask for a passport and recent utility bill to establish identity and address, and the utility bill (which anyone could run up on a colour printer these days) is an obvious weakness. As the ID card won't have an address stored locally, it can't be used as proof of address. So either the bank will still be asking for a utility bill, it will carry out address verification by phone (an option envisaged by Government), or will have to invest in the kinds of card readers that carry out online checks against the National Identity Register.

So either banks are prepared to invest in hardware or time (for a phone verification), or the ID card's usefulness to them is going to be rather less than might have been expected. Government may be betting they and other financial institutions will be prepared to spend on the stronger verification options, but it may not be right. Quite a few fraudulent financial transactions get through at the moment because companies can be slipshod in using the systems we've currently got, and they all to some extent play the probabilities - letting through the odd homebrew electricity bill can cost less than making it more complex and onerous for all of your customers to do business with you.

A whiff of galloping chaos meanwhile emerged at ID Central product design, with the appearance of some form of Notapassport ID card. Previously we've had a passport, which you could think of as pretty much an ID card (but maybe a bit different) that's not card-shaped. So, and because everybody else in Europe travels on their ID card, we got the ID Card Eurotraveller, allowing you to travel within Europe with ID card but no passport. But people who're not British citizens and therefore can't have a British passsport (not entirely true, but getting into that is a complication too far) probably can't have an ID Card Eurotraveller, right?

And then there's the Irish, who can live here and vote but who're not British citizens (unless they want to be) and have their own passport anyway. Have we missed anybody? Inevitably, so just in case:

"Looking at the number of cards possible, just so that we have it absolutely clear," said a widly over-optimistic Baroness Scotland, "there will be: an identity card for British citizens, issued alongside the British passport and also valid as a travel document; a stand-alone identity card, issued to British citizens who do not hold a passport, and valid for travel in Europe; a plain ID card, not valid for travel and available to British or Irish citizens resident in the United Kingdom; and ID cards linked to residence permits and other immigration documents issued to foreign nationals. Those are the cards that we anticipate being made available."

This appears to hold out the enticing prospect of ID cards coming in just as many flavours as the weird, wonderful and dizzingly large number of permutations of residence permit currently do. Don't go there.

Back on biometrics, limiting the cards to two fingerprints will have some impact on the accuracy of identification and on the level of transaction the card's likely to be able to support. In order not to annoy people too much, it probably makes sense for standard readers just to match one finger, with the second maybe for back-up. But what happens if the second fails? Online transaction or let them through anyway? The nature of the environments the readers are used in will also have an effect on the results, with more hostile environments producing worse results. We can only guess at this stage, but if Government remains determined that the cards will be ubiquitous, it seems likely that the tolerances of the readers will have to be set so broadly that the biometric ID will be of little more use than that produced by the cheap fingerprint readers you can get for laptops and doors these days (Oh? You thought these were some use? Bless...).

It is all, however, rather less likely to happen than it was this time last week. Of the major Lords amendments Government has to deal with, the requirement for adequate costings is the most dangerous to the very existence of the ID scheme. If sufficient Labour rebels sign up to this in the Commons, then the Bill is effectively parked until something that looks approximately like the truth about costs is produced, and that is likely to be a very long time indeed. The other key amendments don't freeze the Bill, but maim it. If it remains possible, as one of yesterday's amendments has it, to get a new passport without being forced to get an ID card or be added to the NIR, then the guaranteed uptake the Government expects through passport renewals won't happen, so that's a problem too. A related problem arises because, as we reported yesterday, the Passport Service is already building a database that looks, feels and smells like the NIR - the somewhat ultra vires nature of this will become more apparent if the individuals include differ from those included in the NIR.

If Government fails to overturn any of these, the scheme will be in deep trouble, going on dead. If it does reverse them, the Lords will have to decide whether to give in or dig in. The Liberals no longer feel bound by the Salisbury convention (by which the Lords refrains from voting down manifesto commitments) and the Tories, who last night repeatedly pointed out that Labour's manifesto said "voluntary", seem inclined not to accept compulsory ID cards as being a Labour manifesto commitment. One of the two issues where Tony Blair voted against his own manifesto commitments, incidentally, was when he helped stymie reform of the House of Lords, which under the circumstances seems somehow appropriate(the other issue, since you ask, was fox hunting. The Dear Leader may be planning a life as a chicken rustling peer on his retirement). ®

Beginner's guide to SSL certificates

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
HBO shocks US pay TV world: We're down with OTT. Netflix says, 'Gee'
This affects every broadcaster, every cable guy
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
French 'terror law' declares WAR on the INTERNET itself, say digi-rights folks
Liberté, Égalité, Fraternité: Two out of three ain't bad
SCREW YOU, EU: BBC rolls out Right To Remember as Google deletes links
Not even Google can withstand the power of Auntie
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.