Analysis Growing public concern over the cost of ID cards forced price concessions of sorts from Home Secretary Charles Clarke last week, but these leave the Home Office facing the prospect of an ever-widening money hole as the total cost of the scheme climbs.

On the basis of the current cost estimates of £93 for passport and card, and £20-30 for a standalone card a hole probably exists already, and we're beginning to see clues as to how the Home Office proposes to plug it - it will do so via a cost laundering system we'll be seeing a lot more of as the scheme progresses.

On the morning of last week's Commons debate on ID cards, which the Government won with a reduced majority, Clarke indicated to BBC's Today programme that the Government would be developing sources for income for the ID scheme. "The question of what the charging regime would actually be depends on how much income we bring in from other sources and other departments", he said.

Significantly, he had earlier cited Criminal Records Bureau checks as an example of how useful ID cards would be. During the debate itself he elaborated on this: "The actual charge will be determined by the Government at the time of introduction, depending on the business plan for the card's introduction. It will include, first, the cost of producing the card following the tender process; secondly, it will include the income in respect of driving licences or the Criminal Records Bureau, for example, which we could use to deal with the costs associated with the card."

Spookily, although the Criminal Records Bureau hadn't figured anywhere obvious in the Government's ID plans until last week, at his Wednesday press conference Tony Blair piped up: "Just to give you another example, for the Criminal Records Bureau, which after all hundreds of thousands of people have to go through the whole time [what, like Sisyphus? - Ed], it takes something like four weeks to do an identity check, it would take three days with an identity card."

Blair did not explain why an identity check would still take three days in the brave new world of online biometrics, while for Today Clarke confined himself to saying it would reduce the time dramatically. The point however is that the CRB has popped into some wonk's head as both a useful source of income and a shotgun evangelist for the ID scheme. Those looking for a job in a school might well contemplate previous delays and difficulties in getting clearance through the CRB, and consider the ID card a bargain. Schools, whether they want to pay for ID card checks or not, won't have a lot of choice once potential employees start presenting them as ID.

One is drawn to the conclusion that Blair and Clarke's sudden deployment of the CRB in their case is not entirely unconnected with the need to pay for the ID scheme. The CRB would be a small but steady source, but the size of the revenue stream could possibly be increased simply by widening the requirement for employers to make Criminal Record Checks.

Similarly, employers' requirement to check employment eligibility will produce revenue and stimulate ID card uptake. Employers won't be able to demand an ID card until they're compulsory, but potential employees may well find it a lot easier to get a job if they fall in with the system. And previous Home Secretary David Blunkett, in a speech last autumn, made it clear that once the ID card existed he would see little justification for employers to fail to use it to meet their legal requirements.

Clarke's reference to "income in respect of driving licences" is also interesting. According to Blair "people are already looking at, for example, whether it is not possible to get some of the information you need for your driving licence and this type of thing by use of the identity card", so although it won't be permissible for organisations to require production of an ID card until they're compulsory, here also we could have a case where things happen faster with an ID card, and the ID scheme gains revenue through their increased use. Blair's wording is characteristically fuzzy, but we could possibly interpret "get some of the information you need for your driving licence" as implying a series of database links being used to assemble the components of a licence application.

In the real world, of course, things won't necessarily happen faster with an ID card. Considering the Government's track record (the CRB being a particularly grisly example) the promises of greater speed and efficiency remain open to some doubt; but remember we're talking about where the Government thinks it can squeeze money here, not about where it's actually going to. And the spectacular delays in past CRB record checks were not entirely unconnected with the Government's inability to manage database systems effectively; this has not however stopped Blair and Clarke using the historical mess as an argument in favour of their (probably imaginary) super-efficient future.

Although the Government hasn't been specific about the income from "other departments" it must now have a pretty clear idea which departments are going to have to contribute, if not about the precise levels of contribution. Some charges can be absorbed by the individual departments, while others can be passed on directly to the public (which is paying all of them anyway, one way or another), but there are areas where direct charges may be politically difficult. Charging people for dying, for example, might not be popular, but nevertheless we can't altogether rule it out. As far as Government departments are concerned, one can envisage the National Identity Register as acting as a kind of gatekeeper deriving an income per transaction, while the consequent increasing 'popularity' of the ID scheme will mean the number of transactions will steadily increase.

On the evidence of Blair's press conference, the Government may also be looking at online services as a potential source of income, despite the fact that a biometric ID card isn't a lot of use online. The Government did however rule out the inclusion of a digital signature in the card on the grounds of cost in the entitlement consultation, so unless this has changed, the only way the card could operate online is by use of a PIN.

According to Blair, "at the moment if you want to get your medical records online, you can't because of worries over identity. You would be able to do that" with an ID card, he said. He failed to explain how you would be able to do that, but his bringing the subject up suggests that the Government is considering tying online health record access to ID cards. Without further development specifically aimed at online identification, the ID card at them moment would have to use a PIN, and is about as secure as a credit card (or less so - if you're going to have a card stolen, which would you prefer, ID card or credit card?).

The contribution of private industry, Clarke's "other sources", is less clear, and during last week's debate Clarke, stressing that information on the NIR would not be for sale, placed limits on what could be done. "With the consent of the identity card holder - I emphasise that - banks or other approved businesses will be able to verify identity by checking an ID card against the national identity register," he said. "That would mainly involve confirming that the card is valid and has not been reported lost or stolen, and that the information shown on it is correct. The card holder's biometric details may also - with the card holder's consent - be confirmed against those held on the register."

These are not however limitations that need greatly impact the ID scheme's ability to make money from the private sector. If NIR checks prove valuable for, say, financial service providers, then they will require customers to give them permission in their application forms. And ultimately the service providers may not have a choice. The Government has stated at various times that it feels ID card reading capability could be built into future generations of credit card reader and ATM.

This is not a prospect likely to attract the banks and credit card companies right now, because from their point of view the current chip and pin system provides an adequate balance of convenience and security, and ID cards would simply introduce an extra complication. A simple local check of the validity of the card wouldn't establish the bearer's identity (it could be somebody else's credit and ID card and might convey a false sense of security to retailers), while online checks of biometrics would likely lead to false refusals, and thus reduced trade (and at the ATM, could raise the prospect of severed fingers).

But although the financial and retail sector is not going to volunteer for ID cards, there are areas where it could plausibly be volunteered. ID theft, which in this case is largely what we used to call credit card fraud, impacts on the individuals whose card/identity is stolen far more than it does on the credit card companies, so the public's concerns about ID theft could be harnessed to impose proof of ID requirements on the credit card industry. And once ID cards exist and are widely carried, the Blunkett principle that they constitute a simple and secure method for establishing ID, and therefore there's no excuse not to demand them, might be extended to retail. A legal requirement for proof of ID for transactions over a certain value could be implemented in the name of combating card fraud.

Not all of this will happen immediately, but the pressing and growing need to finance the ID scheme while keeping the cost of the card down to politically acceptable levels will mean that the Government will strive hard to establish revenue sources early on in the scheme. From the point of view of the individual, though, a card cost of 'only' £30 will be nothing to cheer about.

Other costs incurred by Government will be paid for via direct transaction charges and taxation, while the involuntary contributions made by industry will be passed on to the consumer. Economically speaking, if the ID scheme does not deliver savings and efficiencies to match its overall cost (which could quite easily exceed £20 billion), then we will be sucking a huge amount of money that would have been better spent on wealth creation out of the economy. 'Only' £30 indeed...

Clarkewatch: In his ongoing suicide mission (he's a sort of suicide bullshitter) to 'prove' that Government IT projects are not pants, and do in fact deliver the goods, Clarke used the Passport Office, which is now apparently delivering something close to what one might call a service, as an example. And then he cited the successful rollout of chip and pin. We could point that the latter, a networked megaproject, was carried out by private industry, but you no doubt spotted that yourself. What interests us more, however, is that on previous outings for the suicide mission Clarke had trotted out Airwave, the 'on time, on budget' secure digital communications system for the UK police.

At the time we thought it a little cheeky to claim a system that had severe rollout problems and remained crap at data as a successful IT project, and as Clarke's dropped this from his list of achievements it's possible somebody has had a word. However, evidence that Airwave remains crap at data is provided by Northamptonshire police's pilot of mobile fingerprint readers in conjunction with Automatic Number Plate Recognition (ANPR) systems.

Here, if your number plate leads police to make further enquiries, they ask you to 'voluntarily' undergo a fingerprint check against the police database using mobile fingerprint recognition. The systems Northampton deployed, however, used, er, GPRS. But there seem to have been a few problems anyway... Clarke, in any event, can't even get the message across to the rest of the Cabinet. Surveying the wreckage of the new environmental stewardship scheme, Environment Secretary Margaret Beckett says: "Tell me an IT scheme in the Government or the private sector that has been introduced without problems." Oops.

What price an ID scheme?

Charles Clarke, Tony Blair and sundry other Government representatives have rubbished claims, based on the London School of Economics report, that the price of a card could be £300. On the day after the Commons debate, Blair himself said that "some of these figures bandied around about cost are absolutely absurd, I mean no Government is going to start introducing something that is going to cost hundreds of pounds for people, that would be ridiculous."

Which indeed it would be, and Mr Tony might have added that, should his Government propose such a thing, its members would swiftly find themselves suspended from lampposts along Whitehall. But we should contemplate the nature of the absurdity of the £300, and what must be done to achieve the £30 that the desperate characters in the Home Office are pretty close to nailing to the mast.

The origin of the £300 was the report of the London School of Economics Identity Project, but as we noted last week, the LSE estimates the total cost of the scheme, and points out that if the Government were to stick to Treasury requirements that the scheme be self-financing, then the public would have to be charged up to £300 each.

The LSE did not point out the obvious, that anybody attempting to charge this would be strung up, and the ensuing headlines screamed that costs could double or treble. The real story (which we accept would have been a little less likely to grab public attention) was however that if even the lowest LSE estimate was in the right ballpark the Government's public statements on the financing of the ID scheme did not add up. The report, incidentally, also makes a pretty persuasive case for the Government's current estimates (£5.8 billion being the latest we've sighted) erring badly on the optimistic side. For example, although the requirements for the capability of the technology used have increased since the entitlement card scheme was floated, in several cases the claimed costs of equipment (e.g. readers) have decreased since the entitlement card estimates were issued.

In any event, although the £300 scare was helpful in putting the spotlight onto cost, it also allowed the Government to shift the argument at the time of the Commons debate over to card cost. It will now be calculating that if it can hold the card cost at £30, the public will accept a new passport cost of £93 (despite passport cost having virtually tripled over recent years), heaving sighs of relief that it's not being hit for £200 or £300. This shifted attention away from the total cost again, and in rubbishing the £300 the Government was thus able to avoid addressing the LSE's real points, which are rather more difficult to rubbish.

Scheme cost estimates are covered in the LSE report from page 225 on, and use Home Office consultation documents, ID Bill regulatory impact assessments and Passport Office business plans as sources. The Passport Office plans in particular are useful, and it's clear from these that this particular department is effectively taking the lead in ID scheme implementation (we hope to return to the Passport Office's Personal Information Project, relation, at some future date). The report references the source documents liberally, which means that in those instances where Clarke has rubbished specific figures in the LSE report, he has arguably been rubbishing his own officials.

For example, Clarke has cited the LSE's suggestion that cards would have to be replaced every five years, rather than ten, and made the mathematically illiterate claim that this automatically doubles overall cost. But as its source here the LSE cites the entitlement card consultation document, which differentiates between smartcards and cards with a smart chip, and says the latter would need replacing twice in a ten year period.

The cost figures in this consultation put the cost of a smartcard at £3.50 and a chip card at £5. The consultation numbers, says the LSE, add up to a card cost of £240 million over ten years for a plain plastic card, £670 million for a smartcard reissued once over the period, and £2007 million for a sophisticated smartcard (of the kind Clarke is proposing) reissued twice. The Passport Office business plan also suggests that with biometric passports it may be necessary to renew passports every five years, rather than the current ten.

The Government also seems over-optimistic on the cost of readers. In the entitlement consulatation, the LSE notes, the Government "originally envisaged a far simpler scanning system than that used by the police or immigration service, originally considering the scanning of four fingers only." These prints would not have been scanned to a legal standard of proof of identity, so the equipment could be cheaper and staff would not need to be as highly trained in interpretation as police or immigration service staff. But the Government has subsequently said that it does intend to use the NIR fingerprint database to check scene of crime prints, so logically the costs associated with readers should have gone up.

The entitlements consultation however envisaged 2,000 sets of equipment costing £10,000 each, while the ID Card Bill Regulatory Impact Statement puts the cost of readers at £250-£750. This quite possibly factors in some wishful thinking about a far larger number of readers resulting in lower unit costs, however as ministers have recently claimed that the use of three biometrics (fingerprint, facial, iris) will mean the error rate will be extremely low, the cost of 'tri-band' readers should perhaps also be factored in.

Other Government sources tend to support the LSE.

The ever-watchful Spyblog recently unearthed some signposts to true reader costs, flagging a piece of scheme cost laundering while it was about it. The RIA for the Immigration, Asylum and Nationality Bill puts the cost of the initial deployment of biometric passport and visa readers as £3-5,000 per reader plus the cost of a PC, plus £21,000 for the computer network cabling.

The latter is clearly a one-off cost per location, so it's an initial deployment hit the 47 main airports and ports will only have to bear once, but it's also a cost that is likely to be incurred at most of the other sites where an online verification capability is required. As much of this expenditure will be absorbed by other departments via their IT budgets, or incurred by major financial institutions and ID verification third parties, little if any of it will ever be accounted for under ID scheme costs. One might also speculate about the costs of whatever it is the new cabling at ports connects to, and who's paying for that - unhelpfully, the RIA seems not to mention this bit.

The actual costs incurred in association with the Immigration, Asylum and Nationality Bill will be shouldered by the Immigration and Nationality Directorate, and will ultimately be a lot higher than those specified in the RIA, which states:
"Currently there are 47 major ports of entry and an average of 20 desks per location. Due to the staged implementation of biometric identifiers in passports, ports will only have a relatively small percentage of arrivals with biometrically enabled passports. Initially, we may only provide one reader per port. However, as biometrically enabled passports become more common we will increase the numbers of readers per port accordingly. If every desk at every port were to have a reader, Border Control would have to deploy the biometric solution at 940 desks at airports, seaports and the Juxtaposed Control."

It's difficult to get your head around the logistics of the planned 'one per port' initial deployment. Initially the RIA anticipates there may be two readers per port, one handling biometric passports and one handling biometric visas. It is true that numbers for passports will initially be quite small, but once the major economies are starting to ship biometric passports, the number will be ramping fast as old passports expire. European travellers whose passports could be read biometrically will therefore be coming into the UK in fairly large volumes in fairly short order. Biometric visas are intended to be issued to all visitors requiring visas within the next couple of years, and they will therefore constitute a very large volume, very soon.

So what on earth do the loves propose to do with the one appropriate reader available? Clearly it will not be a case of scanning all of the people with biometric passports or visas (try this at Waterloo or when the morning flight from Frankfurt comes into Heathrow), and the machines will be used purely to deal with those 'randomly stopped' or who have aroused the suspicions of immigration staff.* This does not differ greatly from the system as it currently stands. Also note that the RIA appears ("one [reader] for biometrically enabled ID cards") to view visa and ID card readers as the same thing, and therefore to envisage reading ID cards at ports of entry. So perhaps UK citizens could, like other EU citizens, travel within the EU on an ID card, no passport required. The Register has floated this notion before, and soon we may be told.

More broadly, the LSE attempts to nail down major areas of Government cost underestimation in the Cost Projections (Chapter 17, page 241) of its report. Aside from areas we've covered here already, the cost of the National Identity Register and integration costs are likely to be the most substantial additions. The LSE points out that there are clear parallels between the proposed NIR and the NHS spine, but that the former (for obvious reasons, we are continuing to avoid, with a growing sense of futility, calling it "The Register") will involve "greater complexity and must embrace more rigorous security measures. It must also incorporate biometrics - something that we believe will be a technological challenge far greater than the Government has anticipated." The LSE group has therefore put the cost of the NIR at between two and four times the contract price of the NHS spine.

This is one of the most dramatic and potentially contentious variations between the LSE costing and the Government ones. The LSE's reasoning however seems sound; according what's written on the tin, it is more complex and challenging than the NHS spine. So, if this is not reflected in its claimed total tab for ID scheme, the Government needs to explain either why the cost is lower, or where in the Government's IT budgets it is reflected.

Oddly enough, although the LSE's minimum cost estimate is approximately double the Government's most recent estimates, given the existence of some kind of cost-laundering iceberg beneath the visible aspects of the Government estimate, the real numbers might not be that different. If, somewhere within the Government, someone is tallying up the total cost of the scheme and all its related components, then the big number would quite probably fall within the LSE range of £10.6-£19.2 billion).

Given how career-threatening such a tallying exercise might be, we very much doubt that anybody's doing it. But if you think about it, it's exactly what the Government should be doing, then putting the facts before the country and Parliament before embarking on such a scheme. As opposed to the current approach of "capping" card cost at "only" £30, and avoiding telling anybody, probably including themselves, what it will all really cost. ®

* Borderwatch We at The Register take an understandable interest in developments in what really happens at UK border checkpoints, the Eurostar London to Paris run being particularly fascinating, given the quantity of shouting about illegal immigrants on this route there was a few years back. Recently we observed at Paris that the UK checkpoint had started putting the machine readable section of the passport into a reader (well done chaps, even if it has taken you nigh-on 20 years to start), but that only the French post used a forgery detector.

At Waterloo incoming practically everyone on the train was waved through without a check, so we're clearly banking on nobody screwing up at the Paris end. In the other direction, no UK official at all even asked for a passport, but there was a nice new checkpoint checking them, again using a forgery detector. It was operated by... the French. No doubt they're telling us how many of our terrorists are leaving the country.

Public contributions There's more than one way for the general public to contribute to the cost of the ID scheme. You can shut up and pay your taxes, thus helping meet the cost of the scheme, and you can contribute to the cost of the scheme by making it higher. The LSE (hinting, perhaps, at the institution's glorious past) deems non-cooperation as a potential cost, and suggests that one "dedicated non-cooperator", working "strategically and systematically can, quite feasibly, exhaust 200 hours of administration time through the generation of queries, appeals, access requests, database modifications and general civil disobedience." At time of writing the No2ID pledge to refuse an ID card was closing fast on its target of 10,000 signatories, which could mean an awful lot of time-consuming civil disobedience. Click below to nudge it over the 10k, of you haven't signed up already.

Related links:

LSE ID card report
Biometrics won't deter passport fraudsters, chief admits
Soaring card cost headlines threaten UK ID scheme
UK to outsource biometric visa checks to Mumbai
Cost of ID Cards could triple, plan could breach DRA