The Politics of Identity Policy

1
The Politics and Technology of Identity Why
is it so difficult to establish a UK identity
policy?
Department of IS University of Melbourne
April 23 2007
Presenter Professor Leslie Willcocks The London
School of Economics on behalf of the ISIG LSE
Identity Project - Gus Hosein, Edgar Whitley,
Simon Davies and Ian Angell
2
2002 Efficient public services

• After the terrorist atrocities in the United
  States on 11 September 2001, I was asked whether
  the Government was considering introducing
  identity cards. I said at the time that any
  debate about identity cards should not centre
  exclusively on issues of national security. Far
  more important are the issues of citizenship and
  entitlement to services and it is in this context
  that I would like to see the debate unfold.
  David Blunkett

3
2005 Labour Manifesto

• We will introduce ID cards, including biometric
  data like fingerprints, backed up by a national
  register and rolling out initially on a voluntary
  basis as people renew their passports

4
Design of the scheme

• National Identity Register
• Use of biometrics face, finger, iris
• Online verification done everywhere
• Audit trail of verifications
• Use by and payment from the private sector
• Paid for by the public

5
Multiple purposes

• Must prevent identity theft
• Must prevent terrorism
• Must be in accordance with international
  obligations
• Must be designed by the Home Office
• Must enable e-government and access to government
  services

----Painting yourself into a corner?
6
(No Transcript)
7
2005 The Bill version 2

• Reintroduced after General Election
• First reading May 2005

8

• The Government is introducing an ID card
• but it isnt sure why.

9
Reason 1 Combating terrorism.

• A third of all terrorists use multiple identities.

10
Reason 2 Efficient Public Services.

• Create an entitlement card that allows us to
• gain access to public services.

11
Reason 3 International Obligations.

• International obligations to create biometric
  passports. Blame America.
• US visa waiver scheme requirements for passports
  to contain a facial biometric from October 2006
• ID Cards are everywhere in the world.
• EU mandate of both facial biometrics (August
  2008) and fingerprints (2009) for Member States
  passports within the Schengen area

12
Reason 4 Identity Theft.

• Identity theft costs the UK economy 1.3 bn GBP
  per year.

13
Reason 5 Imperative.

• Technology and global politics are converging in
  a way that permits and requires the creation of
  such a system.
• "The next few years are going to see effectively
  a visa and passport revolution across the EU and
  the developed world.
• We have the chance to use this opportunity to get
  ahead in this change and the move, therefore, to
  biometric passports makes identity cards an idea
  whose time has come."
• - Tony Blair, June 26, 2005

14
Reason 6 Terrorism.

• Greatest civil liberty of all is the ability to
  go to work without being blown up.

15
Reason 7 Identity Theft.

• Identity theft costs the UK economy 1.3bn GBP per
  year.

1.7bn!!
16
Reason 8 Terrorism.
17
Reason 9 Illegal immigration (Nov.2006)

• Companies are expected to verify the legal status
  of employees and can face large fines for
  employing illegal workers
• 23 prosecutions under the Asylum and Immigration
  Act between 1999 and 2003
• Home Office used a firm that supplied five
  illegal immigrants who worked as cleaners at the
  Immigration and Nationality Directorate

18
Reason 10 'Modernity'

• "The real issue here is not privacy or cost, it
  is modernity. We face some new problems.
  Biometric technology offers new solutions. But,
  in addition, we can already glimpse what else
  might be possible." 
• - Tony Blair's monthly press conference, 6
  November 2006

19
The LSE Report no. 1
20
So many questions...

• What are these 'international obligations'?
• What are other countries doing?
• What are the implications of the Home Office
  designing the system?
• Does the 'technology' 'work'?
• Are the governments claims precise?
• How will this affect policing?
• Are there alternative structures and technologies?

21
The LSE Identity Project Main report 27 June
2005

• Evaluated the impact of identity cards on
  national security, organized crime and terrorism
  policing race, discrimination and immigration
  and identity fraud.
• Reviewed the use of biometrics, the security and
  safety of the National Identity Register as well
  as international obligations on identity
  documents and the legal environment in the UK
• Considered issues of public trust and the
  government IT environment in the UK
• Presented an alternative blueprint for identity
  management in the UK

22
LSE Identity Project

• Technologies are challenging, e.g. biometrics.
• Home Office design is risky and complex.
• International obligations are mythical.
• Legal problems remain significant.
• Government track-record on IT projects is
  problematic.
• Costs are likely to be higher than predicted.
• Alternative designs exist - centralised v.
  decentralised.

23
LSE analysis not admired popular...

• Some of the figures bandied around about cost
  are absolutely absurd- Tony Blair
• Mr Clarke said it was technically incompetent
  and contained figures that were simply mad. He
  accused the LSE of running a campaign against ID
  cards. Behind the scenes the Home Office has been
  pressuring the university to withdraw the study
  in a way that Sir Howard Davies, its director,
  has described as bullying and intimidating
  behaviour. So there you have it. Our elected
  government lies and it bullies.
• - Times
  Editorial, July 3, 2005 -

24
(No Transcript)
25
After Parliamentary Debate debate

• Legislation is passed March 2006
• Scheme virtually identical to 2002 model
• Amendment on cost reporting (s37 report)
• New agency UK Identity and Passport Service
  launched on April 1st 2006
• James Hall (ex Accenture) appointed Chief
  Executive October 2006

26
Formal Reviews 2003-2006
27
OGC Gateway reviews

• Gateway Review 0 June 2003
• Gateway Review 0 (strategic assessment) January
  2004
• Gateway Review 1 (business justification) July
  2005
• Gateway Review 0 (strategic assessment) January
  2006
• Gateway Review 2 (procurement strategy) April
  2006

28
KPMG

• Cost Methodology and Cost Review
• Outline Business Case Review
• Extract published 7 November 2005
• We conclude that the methodology used to cost
  the ID Cards proposals is robust and appropriate
  for this stage of development

29
Parliamentary comment

• We are not saying that we can go from what
  we have now to a database covering 60-odd million
  people overnight, hoping and praying that the IT
  and the procurement will work and that everything
  will be successful. We have learned the lessons
  of the past, and this project has to be rolled
  out on a phased basis Tony McNulty 18 October
  2005

30

• Projects such as this will always face
  such challenges and opinions in the field of
  technology will differ. However, the body of
  representations within industry, existing project
  experience and research by established experts in
  the field of biometrics and database technology
  indicate that we are right to proceed with our
  plans at this stage Baroness Scotland 31 October
  2005

31

• The scheme has been through a series of
  gateway reviews, and that directly builds on
  experience learned from past failures. Some of
  the people involved in the process have been
  involved in other major public and private sector
  procurement. Obviously, they have clearly
  learned the lessons and know exactly what they
  are doing now Andy Burnham 13 February 2006

32

• I cannot comment on a hypothetical
  problem. I am not anticipating something major
  that would completely delay or derail the
  programme. I would like to reassure the committee
  that nothing is more important than getting this
  right Joan Ryan 14 June 2006

33
Procurement process to start
immediately
34
But Leaked emails.. Sunday Times 9 July 2006

• Also even if everything went perfectly
  (which it will not) it is very debatable (given
  performance of Govt ICT projects) whether
  whatever TNIR The National Identity Register
  turns out to be (and that is a worry in itself)
  can be procured, delivered, tested and rolled out
  in just over two years and whether the resources
  exist within Govt and industry to run two
  overlapping procurements

35
Proved Damaging.

• What benchmark in the Home Office do we
  have that suggests that this is even remotely
  feasible? I conclude that we are setting
  ourselves up to fail Email from David Foord, OGC
  Sent 8 June 2006

36
And a Ministerial Change... reviews

• New Home Office Minister John Reid Full
  scale review of all Home Office operations
• In December, the Government will be
  publishing plans for the introduction of the
  National Identity Scheme which will provide more
  detail on the contribution which existing assets
  could make to the delivery of the scheme

37
Leads to Sir James Crosby

• Chancellor appoints Sir James Crosby to lead
  Public Private Forum on Identity
• Reports back April 2007
• James Hall IPS procurement will start next
  summer (2008)

38
A Radical Redesign?
Time For A Review
39

• The review identified that there may be
  existing technical infrastructure and systems
  that could be used as the basis for reducing the
  delivery and cost risks associated with the
  identity card project
• I did not mean to imply that a solution
  might involve stringing a number of legacy
  databases together. That has never been part of
  this proposition. We have always said that our
  requirements are for a data repository that could
  be populated one record at a time Katherine
  Courtney

40

• A change in the way in which the scheme
  is to be phased in would require considerable
  reworking of the current identity cards business
  plan and procurement strategy. This would create
  further delay in the programme and so could add
  to costs Baroness Scotland

41
Biometrics
Looking Back - Some Issues (1)
42
Testing biometric technology

• The goal of the Trial was to test the
  processes and record customer experience and
  attitude during the recording and verification of
  facial, iris and fingerprint biometrics, rather
  than test or develop the biometric technology
  itselfit was not a technology trial. We will be
  undertaking further trials and testing in due
  course but do not have any immediate plans for
  further trials at this stage
• We anticipate piloting the recording of
  fingerprints as a second biometric from
  volunteers in late 2007. This prepares the UK to
  match mandated EU standards for both fingerprint
  and facial biometrics for Schengen area
  passports

43
Biometrics in s37 report

• Discussion of expanding fingerprinting
• No explicit mention of iris scanning

44
Verifications
Some Issues (2)
45

• Cost of verification
• Base case 0.57
• Least appealing 2.00

46
Biometric or PIN verification?

• Biometrics are being used to more strongly tie a
  verified identity to an individual. In this way,
  biometrics can be used along with an ID card to
  verify that identity against the record held for
  that card. Other forms of authentication, such as
  PIN numbers and passwords can be stolen along
  with a card so are much weaker at linking a
  person to an identity Andy Burnham

47
Liability
Some Issues (3)
48

• Society will depend on the integrity of the
  system
• to establish the eligibility of each party to
  conduct a transaction
• to assign the limitations of liability in the
  event of a failure
• Government proposals are currently unclear on
  this point

49
Security
Some Issues (4)
50
We Were Not Alone...

• Putting a comprehensive set of personal data in
  one place produces a honeypot effect - a highly
  attractive and richly rewarding target for
  criminals.
• The system was something that no technologist
  would ever recommend.
• I have concerns with the current architecture
  and the way it looks at aggregating so much
  personal information and biometrics in a single
  place. There are better ways of doing this. Even
  the biometrics industry says it is better to have
  biometrics stored locally.
• - Jerry Fishenden, NTO Microsoft UK

51

• "A national ID card for the UK is overly
  ambitious, extremely expensive and will not be a
  panacea against terrorism or fraud, although it
  will make a company like mine very happy."
• - Roberto Tavano, biometrics specialist for Unisys

52

• "None of the potential suppliers have had
  sufficient access to specification of what is
  intended or who is to be served to be able to
  provide costings of any reliability. There is no
  evidence that the potential private sector
  partners with experience of running supposedly
  similar operations (e.g. financial services) have
  been consulted in any more depth."
• - Eurim meeting notes, January 2006

53

• "far more discussion is still required before
  Government will be in a position to make informed
  decisions on all of the proposed technologies
  including biometrics, but also data management,
  security, authorisation / authentication, storage
  and data sharing between departments. The only
  way that Government will be able to develop an ID
  Card scheme will be if it has a comprehensive
  understanding of the industry, its capacity and
  its capabilities."
• - Intellect, January 2006

54

• "The primary aim of the Government with this
  legislation should be to establish a scheme which
  allows people to reliably identify themselves
  rather than one which enhances its ability to
  identify and record what its citizens do in their
  lives."
• - Information Commissioner

55

• The Bill's provision for the retention of
  extensive personal information relating to all or
  large sections of the population may be
  insufficiently targeted to be justified as
  proportionate to the statutory aims and may lead
  to disproportionate interference with Article 8
  rights."
• - Joint Committee on Human Rights

56

• We believe that the Bill provides Government
  with unnecessary and undesirably wide powers to
  record, retain and disseminate personal data, and
  do not believe that adopting an identity card
  scheme is a proportionate response to the
  challenges which the Government is trying to
  address.
• In addition, we believe adopting the scheme would
  increase the administrative burden on those
  delivering public services and put a heavy
  financial burden on government and members of the
  public.
• - Law Society

57

• Perhaps in the past the Government in its
  enthusiasm oversold the advantages of ID cards.
  We did suggest or at least implied that they may
  well be a panacea for ID fraud, benefit fraud,
  terrorism and entitlement, and access to public
  services.
• - Tony McNulty, Home Office Minister, July/August
  2005

58
But they ignored it anyway...

• "The creation of the National Identity Scheme,
  employing cutting edge biometric technology, will
  provide the nation with a safe and secure means
  of confirming identity in everyday life. It will
  also enable us to crack down on abuse of our free
  public services by those not entitled to them."
• - Andy Burnham, Safeguarding Your Identity IPS
  Sets Out Ten Year Plans, April 21, 2006.

59

• "We have been looking at this for many years,
  actually several years before I joined the
  programme as a matter of fact. Before the policy
  decisions in principle were even taken, quite a
  lot of feasibility analysis went forward. ...
• Those studies came back showing that the
  technical risks to a programme like this were
  medium risks and were manageable and actually the
  important thing to focus on was of course the
  business risks and making sure that we are
  getting the business process right and all the
  other factors around how you identify a person
  and register their identity, and then confirm
  it."
• - Katherine Courtney before Parliaments Science
  and Technology Committee, March 22, 2006.

60

• "I find that answer, with the greatest respect,
  absolutely astounding. Two weeks ago, the
  Committee was in the United States talking to the
  Department of Homeland Security who said exactly
  the opposite to what you have said.
• - Chairman of the Committee, Q272, March 22, 2006

61
Politics or Policy?

• "The Government is not alone in recognising a
  number of factors that cast doubt on the
  credibility of parts of the report as well as the
  impartiality of the reports core team.
• The Government supports the right of such
  individuals or groups to express their views in
  open debate. However, such views do not
  necessarily constitute objective, rigorous
  academic research.
• Therefore the Government maintains it was
  entitled to defend its proposals and to assert
  that the report was not as independent or
  accurate as was claimed by its authors.
• - Home Office response to Parliamentary Science
  and Technology Committee, October 2006

62
Politics or Policy?

• Mr. Byrne The hon. Gentleman would be wise not
  to pray in aid the LSE report. That report
  ignored research from the National Physical
  Laboratory, exaggerated the cost of verifying
  identity information and had some pretty basic
  problems with its maths. It overstated the number
  of people who might have problems giving
  biometric data by an extraordinary 1,800 per
  cent, so I am not sure that that is the report to
  pray in aid in support of the hon.Gentlemans
  argument.
• - Parliamentary Question, February 20, 2007

63
(No Transcript)
64
Politics or Policy?

• "The cost argument we can certainly address
  pretty easily, the LSE report has been pretty
  comprehensively rubbished by virtually everybody
  - it wasn't an LSE report, it was somebody who
  happened to work for the LSE - we've gone through
  that.
• - Stephen Pound, MP, March 9, 2007

65
But if we don't do it, then who will?

• The Act is in better shape now than it was
  previously.
• Constitutional crisis is not always a bad thing.
• Academia is designed to be separate and
  protected if we're not doing this then why
  should we have that freedom?

66
Why is it so difficult to establish an identity
policy?
Conclusion

• Political process may not be the best way to come
  up with design specifications.
• Dream of what technology will bring is hard to
  resolve with what technology may do.
• Projects that entail involvement of entire
  population are hard to plan, harder to implement,
  and likely harder to induce.

67

• "It is, to me at least, almost incredible that
  the proposal to introduce an identity register in
  the UK should be so extraordinarily
  controversial. But it is."
• - Tony Blair, August 2006
• Coda It is currently planned that the first
  identity cards for UK citizens will be issued
  from 2009

68
Contacts at LSE

• I.hosein_at_lse.ac.uk
• e.a.whitley_at_lse.ac.uk
• http//identityproject.lse.ac.uk