Feeds

Decoupling from passports added to ID Card Bill's woes

And more cards, less fingerprints?

Top three mobile application threats

Government suffered further defeats on ID Cards last night, as the House of Lords voted to make the scheme voluntary, and to require a further Act of Parliament before ID cards can be made compulsory. The Government has already stated that it intends to reverse the Lords' amendments in the Commons, but as it now has to deal with several substantial changes, and the Dear Leader has several other controversial pieces of legislation on his plate, it may have a difficult time of it.

Last night Lord Bassam of Brighton and Baroness Scotland cut lonely figures arguing - and losing - the Government's case. But along the way they produced some interesting information on the content of the ID card which Government seems, unaccountably, to have been unable to share with us previously. Baroness Scotland said that there were no plans to place any information that the holder was unaware of on the card's chip, and that it would "simply contain the information on the face of the card, technical information regarding the functioning of the card itself, a facial image and two fingerprints." The Register greets this last blurt with particular satisfaction, as we calculated that the card would be likely to house only two fingerprints last October.

According to Lord Bassam, neither address nor telephone number will be printed on the card and "if verification of address is necessary, it can be done against the register". This tells us a little about the kind of transactions the card will most commonly be used for. Currently UK banks tend to ask for a passport and recent utility bill to establish identity and address, and the utility bill (which anyone could run up on a colour printer these days) is an obvious weakness. As the ID card won't have an address stored locally, it can't be used as proof of address. So either the bank will still be asking for a utility bill, it will carry out address verification by phone (an option envisaged by Government), or will have to invest in the kinds of card readers that carry out online checks against the National Identity Register.

So either banks are prepared to invest in hardware or time (for a phone verification), or the ID card's usefulness to them is going to be rather less than might have been expected. Government may be betting they and other financial institutions will be prepared to spend on the stronger verification options, but it may not be right. Quite a few fraudulent financial transactions get through at the moment because companies can be slipshod in using the systems we've currently got, and they all to some extent play the probabilities - letting through the odd homebrew electricity bill can cost less than making it more complex and onerous for all of your customers to do business with you.

A whiff of galloping chaos meanwhile emerged at ID Central product design, with the appearance of some form of Notapassport ID card. Previously we've had a passport, which you could think of as pretty much an ID card (but maybe a bit different) that's not card-shaped. So, and because everybody else in Europe travels on their ID card, we got the ID Card Eurotraveller, allowing you to travel within Europe with ID card but no passport. But people who're not British citizens and therefore can't have a British passsport (not entirely true, but getting into that is a complication too far) probably can't have an ID Card Eurotraveller, right?

And then there's the Irish, who can live here and vote but who're not British citizens (unless they want to be) and have their own passport anyway. Have we missed anybody? Inevitably, so just in case:

"Looking at the number of cards possible, just so that we have it absolutely clear," said a widly over-optimistic Baroness Scotland, "there will be: an identity card for British citizens, issued alongside the British passport and also valid as a travel document; a stand-alone identity card, issued to British citizens who do not hold a passport, and valid for travel in Europe; a plain ID card, not valid for travel and available to British or Irish citizens resident in the United Kingdom; and ID cards linked to residence permits and other immigration documents issued to foreign nationals. Those are the cards that we anticipate being made available."

This appears to hold out the enticing prospect of ID cards coming in just as many flavours as the weird, wonderful and dizzingly large number of permutations of residence permit currently do. Don't go there.

Back on biometrics, limiting the cards to two fingerprints will have some impact on the accuracy of identification and on the level of transaction the card's likely to be able to support. In order not to annoy people too much, it probably makes sense for standard readers just to match one finger, with the second maybe for back-up. But what happens if the second fails? Online transaction or let them through anyway? The nature of the environments the readers are used in will also have an effect on the results, with more hostile environments producing worse results. We can only guess at this stage, but if Government remains determined that the cards will be ubiquitous, it seems likely that the tolerances of the readers will have to be set so broadly that the biometric ID will be of little more use than that produced by the cheap fingerprint readers you can get for laptops and doors these days (Oh? You thought these were some use? Bless...).

It is all, however, rather less likely to happen than it was this time last week. Of the major Lords amendments Government has to deal with, the requirement for adequate costings is the most dangerous to the very existence of the ID scheme. If sufficient Labour rebels sign up to this in the Commons, then the Bill is effectively parked until something that looks approximately like the truth about costs is produced, and that is likely to be a very long time indeed. The other key amendments don't freeze the Bill, but maim it. If it remains possible, as one of yesterday's amendments has it, to get a new passport without being forced to get an ID card or be added to the NIR, then the guaranteed uptake the Government expects through passport renewals won't happen, so that's a problem too. A related problem arises because, as we reported yesterday, the Passport Service is already building a database that looks, feels and smells like the NIR - the somewhat ultra vires nature of this will become more apparent if the individuals include differ from those included in the NIR.

If Government fails to overturn any of these, the scheme will be in deep trouble, going on dead. If it does reverse them, the Lords will have to decide whether to give in or dig in. The Liberals no longer feel bound by the Salisbury convention (by which the Lords refrains from voting down manifesto commitments) and the Tories, who last night repeatedly pointed out that Labour's manifesto said "voluntary", seem inclined not to accept compulsory ID cards as being a Labour manifesto commitment. One of the two issues where Tony Blair voted against his own manifesto commitments, incidentally, was when he helped stymie reform of the House of Lords, which under the circumstances seems somehow appropriate(the other issue, since you ask, was fox hunting. The Dear Leader may be planning a life as a chicken rustling peer on his retirement). ®

The Essential Guide to IT Transformation

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Airbus promises Wi-Fi – yay – and 3D movies (meh) in new A330
If the person in front reclines their seat, this could get interesting
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
Samsung threatens to cut ties with supplier over child labour allegations
Vows to uphold 'zero tolerance' policy on underage workers
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.