IPS leak suggests ID card fingerprint chop
Prints might just be needed for 'special' groups
A key component of the UK ID card scheme, the central database of fingerprints, may be abandoned, according to a leaked Home Office document obtained by the Observer. The document doesn't suggest entirely scrapping fingerprints, but instead suggests that their value should be assessed for each group of the population enrolled.
So how does that work? Well, for the ID scheme as originally planned, it clearly doesn't. From David Blunkett onwards Home Office ministers have presented biometrics as the system's USP, the one single factor that makes it entirely certain (in their view) that you are who you say you are. And, they have claimed, the ability to check those biometrics against a central register would give us the 'gold standard' of identity. But if you don't necessarily collect everybody's fingerprints, then you don't have a complete national biometric register, so you might as well save yourself a pile of money, chuck away any notion of online biometric checks as a matter of routine, and forget any ideas you still had about a national biometric register.
Quite a few of the claimed 'benefits' of the ID scheme go out of the window if you do this. The police cannot trawl the register in order to match crime scene fingerprints, nor can they use their mobile fingerprint readers to identify you or to prove that you are who you say you are. Effectively, the ID card would be chip-backed picture ID, with the security of the chip only of value in circumstances where a reader was used.
Except, apparently, for some groups. Immigration Minister Liam Byrne recently reiterated his commitment to issuing the first biometric ID cards to foreign nationals from November of this year. Having this group carrying biometric ID cards makes sense to the government, in a racist sort of way, because it should already have biometrics for many of them via the biometric visa programme. But not all foreign nationals require a visa, so perhaps not all foreign nationals will turn out to require an ID card - at least initially.
But even if the Home Office were to abandon ID card fingerprints for everyone bar the foreigners it's fingerprinting already, it would still ultimately be fingerprinting most of the rest of us, as the Identity & Passport Service (IPS) is currently scheduled to start collecting fingerprints at passport renewal from 2009. The UK isn't a Schengen signatory and therefore isn't obliged, as the Schengen states are, to add fingerprints to passports, but has committed to do so.
Which presents us with a puzzle. The ID card has up to now been envisaged as, effectively, a small format passport - you collect the biometric data for the passport and squirt it onto the passport chip and the ID card chip, same thing, different shapes. But there's always been a need, if the ID card is to be universal, to collect biometric data from that part of the population that doesn't have a passport. And if you're not going to do that, then the passport and the ID card start to become different beasts, with the passport the ID that's more strongly tied to the individual, and the ID card being rather less so.
The picture is not wholly coherent, which is as one would expect from an organisation looking for savings and shortcuts in a desperate attempt to salvage something from the ID card disaster.
Meanwhile in separate leaks, the Home Office is considering beating young drivers with a stick to get them to sign up for ID cards. Well, sort of - see here. ®
@ Andy Davies
Brilliant!!! I'd never actually thought of that. It has the ring of truth that cannot be denied...
Why not just start with a photo?
I have, quite seriously always thought that this was because David Blunkett was blind. The human brain has an amazingly accurate facial recognition system, much better than any software, but DB would not *know* this and all his hangers on would be too PC to tell him. A photo card offers a very quick and easy 'first fence' id check, add a public key encrypted version of the photo to the card then provided that HMG can keep *one* secret the card becomes unforgeable.
@Why a card
I am aware that this point has already, at least partially, been made, but, a card/document based system is infinitely preferable to a central database because it is much harder to abuse.
Anyone discovering a way of manipulating/abusing a central database, or being in a position to manipulate/abuse it, can cause far more damage for far less effort than someone able to create counterfeit cards.
Experience here in Germany has shown that, with a little personnel training, only a vanishingly small percentage of counterfeit ID Cards cannot be identified as counterfeit.
Public Key Cryptography does allow the "Signing" of digital documents in such a way that it can be verified that the signing party was in fact the government and this requires no direct "online" access.
I do not think that ID Systems are useless, indeed having a reliable way of identifying people for important transactions is very useful indeed, for all parties in a transaction. What is needed is a decentralized system that allows no third party to track what is being done - as would be the case with a central database.
I agree that it is very silly indeed to have two systems that should prove identity - a single system is really the only way to go.
A decentralized card based system, with no central database, where biometric data, cryptographically signed at time of issue as correct, is only available on the card, would be the way to go, in my opinion.
As not all transactions require the biometric data, and humans can't read the data without an electronic reader anyway, I would plead for a document that is as difficult to forge physically as it is electronically.