Select Committee on Home Affairs Minutes of Evidence


Examination of Witnesses (Questions 340 - 359)

TUESDAY 24 FEBRUARY 2004

MR NICK KALISPERAS, MR GEOFF LLEWELLYN, PROFESSOR ROSS ANDERSON AND PROFESSOR MARTYN THOMAS

  Q340  Chairman: That is what some people would put as a producer point of view. The electricity company did not want to do it and the bank did not want to do it. From a citizen's point of view is there not a case for saying that people would find it quite annoying to have to carry eight or ten different cards for different purposes, all of which are there to identify them? Is there not some advantage from the citizen's point of view instead to have one card which fulfils all those functions? If we are talking about the citizen's point of view is that not where we should start from?

  Professor Anderson: It might be nice to have but in my view it is not likely to happen as a practical matter. There is other experience. For example, in our university we have brought in a university card to try and unify the various kinds of door locking/photocopier access to our hundred or so libraries and again we ran into problems with that. As a general principle, if you have one mechanism that you make serve more purposes then you make it more fragile, you make it more expensive, you make it more difficult to maintain and it becomes a road block in the things that all sorts of people are trying to do. It is very much more convenient, if you are responsible for a particular library, if you can issue a customer with your own card.

  Q341  Chairman: In the university complex does that mean you have a different list of people who are entitled to use the photocopier from those who are entitled to use the library and so on, or are you talking about different cards but the same database of students and university staff? Are you saying that not only do you have separate cards to identify yourself but you also want separate databases maintained separately, even though it is the same people on them?

  Professor Anderson: As a practical matter you end up with hundreds of separate back-end databases. Each library will have a database of which books are out at the moment; each college, if it is using this for access to buildings, will have its own list of who is a member of the college and which buildings they are allowed to go into. If it is using it for college meal payments then it has to run accounts for each of the students who are using the system. This proliferates very rapidly on a very large scale and it becomes very difficult to have one single centralised system.

  Q342  Chairman: The Government has clearly set out to say that they want one database for all people in the country to which various applications can then be applied. Are you saying that that is fundamentally a wrong approach?

  Professor Anderson: I think it would be completely unrealistic to have one database from which lots of commercial companies built their systems. I think it would even be dangerous, for example, to try and unify the databases of the Passport Office, the National Insurance database and the DVLA because when you unify such databases that means that whichever company is managing them has a much greater hold over the Government and that means that the cost tends to go up, the difficulty of making changes increases and the flexibility of the system decreases, and ministers are in effect held over a barrel because it becomes simply too risky to change the system once it becomes critical to the infrastructure for a very large part of the public sector.

  Q343  Chairman: That was not a success for you, I gather. Does anybody else have a view?

  Mr Llewellyn: I am afraid it means stepping back for a moment. Again, to refer back to the model of use of a card, a card which has to be referred on every occasion of use to a single central database has the advantages of high security, but it has the vulnerabilities of the requirement for the network to be up and running all the time. If you take the point I made earlier about the hierarchy of security and the hierarchy of sensitivity of transactions, then you could see that for a card which was issued to a unique individual under the auspices of the state and which has got the highest possible certification—the holder of that card is actually Joe Bloggs and that can be proved by relating the information on the card to the fingerprint, the iris or whatever it might be, of the person who is there—that proof of identity is then quite enough on its own to act as a key to other databases. For example, if you have got that highest integrity proof of identity, it becomes a multi-purpose card. It does not mean that you have to have a single database. You could perfectly well have your library, your meals, whatever it might be, accessed by that single key but there would be many databases, all accessed by that single key. The critical thing is that the padlocking of that card as an electronic token to the unique individual then enables that card to be used to open up lots of boxes, if you like, and the boxes could be university accounts, they could be tax accounts, they could be social security accounts or whatever, or it could be your free bus pass. The key thing is the association of the unique individual with that electronic token and that has no implications for one massive database. You do not have to have a massive database which has got all of these applications on it. What you need is a single secure key.

  Q344  Chairman: Professor Thomas?

  Professor Thomas: There is a technical systems engineering issue here which is captured in popular wisdom by "don't put all your eggs in one basket". If you create either a single card that has multi functions or a single database then you are adding to the nation's critical infrastructure unnecessarily and by doing that you are making a very large range of services, probably a growing range of services, vulnerable to a single attack, either a deliberate attack or a fault that arises as a consequence of mis-implementation or accident. This seems (and undoubtedly is) an extremely foolish thing to do if you do not need to do it. First, you create a target that is worth subverting and therefore you increase the resources that will be applied to subverting it. Secondly, you increase the damage that is done when, by whatever means, that particular system gets compromised. If it is an individual's card that is compromised, you have increased the damage to them because they do not have the back-up mechanisms of all the multiple cards that they currently have for getting access to other parts of their life. If it is a central system that is compromised, then you are really in trouble because everybody potentially is having difficulties over all the aspects of their lives that are implemented on that system.

  Mr Kalisperas: I think that fundamentally we are in danger of mixing two issues here. The Home Office proposal as it stands at the moment is for a card that verifies identity or for a system that verifies identity. Whether the system itself in the longer term provides access to either commercial or other public services is a separate debate. What we would like to see, and we have said this repeatedly, is an evolutionary card. That can only be done through discussion with industry and with organisations such as those who are here at this table. Jumping ahead to what the inevitable end product is obscures the necessity of getting the original specification right, and that can only be done through a thorough examination of the issues with the various stakeholders.

  Q345  Mr Cameron: What is the point, Mr Kalisperas, of having a system if the intention is not to use it for some of the services that have been outlined? I am confused. Professor Anderson and Professor Thomas seem to be in the "don't put all your eggs in one basket" camp, and I can understand that: you have got one card that gives you access to all these services and if something goes wrong with the database you are in real trouble. I am not quite following the argument at the other end of the table, the Intellect argument; my intellect is clearly not up to it. Can you have another go in explaining why you disagree with them, and in particular answering this point: what is the point of having a card if it does not give you access to services and, if it does give you access to services, are you not in the "eggs in one basket" problem that they have outlined so clearly?

  Mr Llewellyn: There is a rather strong analogy between the introduction of paper money as a means of exchange, making our economy work 300 or 400 years ago, and the cards that we are now talking about. Paper money is a system which has got critical dependencies. It can be forged, it can be played around with in various ways, and yet everybody can see the very obvious advantages in terms of liquidity in the economy and making the economy work using paper money as a way forward. I think we need to have a similar vision, if you like, of the potential up-side of a secure electronic key. The point that Nick was making about a migration path and an evolutionary card bears on that. In terms of the "eggs in one basket" argument, the fact that there is a single database of citizens obviously does mean that there is one source of truth, if you like, and you would need to be absolutely sure that when an ID card was issued to a unique individual there was the highest possible integrity in the process for issuing that card to that individual, but once that has been done the fact that you have got a single database means, for example, that if the card were lost, which is one of the potential "eggs in one basket" problems that has been mentioned, then replacing the card that had been lost would be a much simpler process because you would simply go to a single location and demonstrate that you possessed the biometric in question and a replacement card could be given to you immediately and the card that had been lost would be of no use to somebody else who tried to use it because they would not have the appropriate biometric. In terms of the "eggs in one basket" argument from the point of view of the individual's convenience, I think that there is a response to that.

  Q346  Mr Prosser: Mr Llewellyn, Intellect have told us that their members have been involved in card schemes very similar to what the Government is proposing in various parts of the world. What would you say are the most important practical lessons you have learned from that involvement?

  Mr Llewellyn: It is clear that in issuing an electronic token which is potentially of such great value and significance it is very important that we should address all of the process issues to do with issuing such a valuable token and do it very thoroughly. I made the point about the integrity of the system which issued the cards in the first place. Clearly, what the UK passport service is currently trialling is a component of the process which would issue these cards to individuals, so it is very important that the integrity of the system which issues the cards is very high. I would add another point from a personal perspective, which is that government does need to think through all of the implications of the introduction of the card, and I echo the professors' point that it needs to be clear about the circumstances of use so as to think through all of the scenarios and circumstances of use and have a clear understanding of what is to be done if there are glitches in the process so that people are not paralysed by an unforeseen incident.. Foresight is very important on the part of government. Finally, there is a vision, if you like, which says, "Here is something which is potentially opening up the full potential of the electronic universe that is all around us", and there needs to be that visionary expression of where the future might go in delivering convenience to citizens and saving costs in the administration of government.

  Q347  Mr Prosser: Professor Thomas and Professor Anderson, both your organisations talk about the German system of identity cards and you seem to show some support for that approach. What are the advantages?

  Professor Thomas: I am attracted by what little I know of that system simply because the card number is merely an identifier for the card, not for the individual, but when the card is re-issued, as it will be periodically through the person's life, they get a new number. That stops the number being used by large numbers of other organisations as a personal identifier, as, for example, happens with the social security number in the United States with a range of problems which are fairly well known.

  Professor Anderson: I endorse that. The Germans have perhaps the strictest interpretation of data protection law in the European Union. They have a tradition of identity cards which goes back at least to Bismarck. They have found that it is not as difficult to reconcile the two and in fact, if you look at a German identity card it looks just like the back page of a passport with the same kind of information. On your passport you have got a passport number rather than your national insurance number, so if somebody starts trying to identify you as this number then next week when your passport runs out the database will be confounded. There is an existing practical way of identifying people. I think that the Government's recent proposals, namely, of building on the existing passport system and then perhaps filling in the gaps later (subject to parliamentary approval) are a lot more sensible and practical than what was being talked about at the beginning. None the less we must ask the question: why are passports not used very much more widely by businesses and by other service organisations at present?

  Q348  Mr Prosser: Professor Thomas, you mentioned the way that the US security number system can be abused. Can you tell us a little more about that and how widespread it is? Is it worse than in this country in the way national insurance numbers are stolen?

  Professor Thomas: It is unfortunately common in the United States for the social security number to be used for all kinds of identifying purposes. For example, students enrolling in courses on campus will routinely have their accounts set up with their social security numbers as their passwords. Since it is very easy to obtain somebody else's social security number it means that it is very easy to pretend to be them under a wide range of circumstances. Once you start doing that you can acquire further information about them that makes it even easier to impersonate them. The fact that you have a single identifier that stays with you for life, which becomes widely known to other people for legitimate or illegitimate reasons and which then gives those people the ability to access your personal information and to impersonate you, is a plague that is causing a very wide amount of damage throughout the United States.

  Q349  Chairman: If the Government in its proposals came forward and said, "We will not have a lifetime number identifier", as they are proposing at the moment, would there be any consequences for what the Government says it wants to achieve with an ID card, or is that a simple policy change that they could make and still carry on with the business of identifying people?

  Professor Thomas: You need to understand what they really want to do with the identification card. If all they want is the ability to have a physical token which can be shown to belong to a particular individual on some occasion when they are challenged, and some data that is on that card which is valid at the point of challenge, then clearly you do not need a long history of use; you do not need that data trail to persist over an extended period of time. Even then you have got the problem of what happens when the security on the individual card is compromised.

  Q350  Chairman: Supposing they dropped the lifelong number; you would be able to use it as an identifier. What would they not be able to use it for?

  Professor Thomas: Unless it was merely a fiction that it was not a lifelong number or was merely a subsequent manifestation of a pointer into a common database, they would not be able to trace the pattern of usage of that card, that number, that identity, over an extended period of time.

  Q351  Mr Taylor: My first question is applicable to all witnesses. Could I ask you what evidence of identity should be required for enrolment into the system and is it practicable to check the whole database at each new enrolment to ensure that a biometric just registered is not already on the database?

  Professor Thomas: That clearly depends how important it is to you that you have got the identity right. One of the problems of using a single card for multiple purposes is that you need to make sure that the integrity of the enrolment process is adequate for the most demanding application for which this identity will ever be used. If you are going to use the identity card as a means of letting certain select individuals into rooms that contain top secret documents then you are going to have to ensure that all people who enrol go through an enrolment process that satisfies the requirements of the security services for access to top secret documents. If all it is ever going to be used for is to give people access to free transport on buses then you can afford to be a little more relaxed about it.

  Professor Anderson: A lot of care has to be given to the issue of pre-enrolment fraud. This is already a big deal and once we start putting chips in passports it will become worse. I am told that there was recently a gang exposed that was selling British nationalities to people in Pakistan, which was obviously of concern given that there are terrorists thereabout. The modus operandi was to put an advert in a newspaper in Britain offering a job for, say, a security guard at a slightly larger than usual wage, say, £7 an hour. Thousands of people applied, they filled in on the application form all the information that you need to apply for a British passport, and they were also asked whether they had got a passport. Out of that bundle you take some people who do not have passports and you fill in the passport application forms in their name with the photographs of the guys you want to get into the country; standard pre-enrolment fraud. You are not going to make that any more difficult when you bring in a chip. You may in fact increase the incentives for it and that has to be thought about very carefully.

  Mr Llewellyn: I would make an observation there though that, with the association of a biometric with a smart card chip, or a chip where the chip is in a card or some other thing, it would I think be much more difficult to do the kind of fraud that has just been   described because the unique individual characteristic of the person who is enrolled as it were blocks anybody else from taking that same identity and it blocks anybody else from attempting to present part of themselves off as the person who has just offered their biometric and had it registered on  the database. Therefore, with adequate documentary fraudulent proof you could register as me but then I could not register as me because our biometrics would clash when we were trying to get into the same database. With the addition of the biometrics to the enrolment process here you do not eliminate the danger that somebody with the right forged documents could impersonate me but you would then make it impossible for me to register in my own name and you would also make it impossible for them to register in another name, and as soon as there was a clash caused by the duplication of biometrics there would be an incidence to be investigated.

  Professor Anderson: With respect, I do not think biometrics change much in this context because if our chap from Al-Qaeda has got a passport pretending to be Suleiman Mahmoud from Bradford, then as soon as Suleiman applies for a passport under the current state of affairs the fact that the passport has already been issued in his name can cause an alarm to sound. The issue here is the average time that will elapse between the person being impersonated and his applying for a passport. There is also a second issue, which is the kind of biometric you use. If you use a biometric such as an iris code then you will be able to notice if somebody has applied for a passport in two different names, but if, as is proposed in phase one, all you have got is a digitised photograph sitting in a contactless smart card chip in the spine of your passport, there is no such warning because it is very difficult, indeed it is a computationally infeasible task, to match faces with any useful degree of precision.

  Q352  Mr Taylor: Assuming the system had successfully been put in place using both fingerprinting and iris recognition and covering 60 million people, how long do you think it would take to register an individual and how long to verify identity?

  Mr Llewellyn: The first thing to say is that the UK passport service is currently undertaking a trial, one of the major objectives of which is to look at the process time from a person coming through a door into an office to going out having registered, and so the time for that transaction is at the moment being explored. It will obviously not be appropriate to try and say anything definitive about that.

  Q353  Mr Taylor: Because we will know their answer in due course?

  Mr Llewellyn: Yes, we will know the answer arising from that trial. Early indications in terms of what has been done in laboratories would say that the time to capture a biometric and put it on to a database and print a card which has got that biometric embedded in the chip is in the low number of minutes. We are not talking about an hour's process or anything of that sort. What is vitally important, of course, is that you not only have that component of the process which is the biometric component, but you also have the process which is the checking of any documentary evidence that the person has with them and possibly checking what is called the biographical footprint, which would be something where corroboration of a person's identity would be sought by reference to other data sources, and those things are potentially much more time-consuming than the process of offering and capturing a biometric.

  Q354  Mr Taylor: It is not much use for me to leave the station where these things are issued with a card that perfectly reflects my fingerprints and perfectly reflects my iris unless somewhere it also says "John Taylor, born 19 August 1941", so there are going to have to be some other inputs which I am going to have to be able to verify.

  Mr Llewellyn: Yes, absolutely. The whole question of the process to issue an ID card is exactly what is being explored in part by the passport service trial at the moment, and there is no doubt that in addition to having a fingerprint or an eyeball you would also need to have documentary evidence in other areas to show who you are, and all of those things have to be collated so that at the time that you enrol there is confidence that the documentary evidence is correct, that the biographical footprint is correct and that a good quality biometric trace has been captured. Once those three are put together then you have what can be described as a gold standard of identity attribution and that is the critical thing which would underpin the integrity of any system using an ID card. Referring back to some of the answers that were made earlier regarding the IT systems and the integrity of those, I think we do need to allow for the fact that the sophistication of the technology has advanced and is advancing very dramatically, which means that we can have much more confidence in an IT system built today than we can in systems that are ten years old.

  Q355  Mr Taylor: Should we not in the margin at this stage say that there is also going to need to be addressed the training of the people who do the enrolling?

  Mr Llewellyn: It is absolutely critical that the enrolment process is a matter of people and technology and documents and the people have to be properly trained, the technology has to be robust and the documents have to be of high quality and capable of being checked. This is not by any means just a technology issue. It is also a people, processes and principles issue.

  Q356  Mr Taylor: Chairman, I have one more question which I would like to put to Professor Anderson if I may. Professor, I think you said that fraud patterns do not appear to vary across Europe according to the presence or absence of ID cards, but what about levels of fraud? First of all, are you content with the assertion that I have attributed to you?

  Professor Anderson: Yes.

  Q357  Mr Taylor: The question then is, what about the levels of fraud?

  Professor Anderson: I worked for three or four years in the banking industry and as a consultant for them occasionally thereafter and my experience from that is that the main determinant of levels of fraud is not the card technology that you use but how diligent you are at checking online whether a transaction is valid or not. In Spain, for example, where they made a rule 15 years ago that all credit card transactions had to be verified with the bank regardless of how small the amount, they had a much better reduction in fraud than they did in France where they went to a more complex card technology. In my experience that was a defining experiment. It is not the card technology; it is the processes that surround it.

  Q358  David Winnick: Is it not interesting, Professor Anderson, that in the Home Office consultation document the argument is put forward that it is possible that if a card scheme came about the banks and other financial institutions would rely on that to such an extent that they would not necessarily check in the manner in which they are now doing? In other words it would weaken the fight against fraud rather than strengthen it?

  Professor Anderson: I cannot see the banks moving to somebody else's technology for the basic processes of getting cash out of an ATM or paying for a meal at a restaurant. What might perhaps be useful is that when you open a bank account you might be able to present a passport rather than having to go round with armfuls of gas bills, water bills and so on. This is something that could be done today. Most people have passports and an even larger proportion of people who open bank accounts have passports, and so I suspect that by simply changing money laundering guidelines the Government could encourage banks to accept passports rather than gas bills as primary identification. As far as subsequent transactions are concerned, I doubt that the technologies would be even remotely compatible. What is proposed by the ICAO for the new biometric passport is a contactless smart card chip of the kind that is typically used in door opening applications, whereas what the banks have standardised on for EMV in the chip-and-PIN process is a contact smart card and the two have their advantages and disadvantages in different situations but they are not compatible.

  David Winnick: Do you get the impression that if a particular argument in favour of an ID card falls by the wayside the Home Secretary is only too willing to come forward with another argument to justify it?

  Q359  Chairman: That would be a leading question in the old Perry Mason days, but please do answer it.

  Professor Anderson: I see a number of arguments in favour of ID cards that I do not find at all convincing and, not being involved in the cut and thrust of party-political fervours, I have tried to deflate them gently in the submission I have made to the Home Office.


 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2004
Prepared 30 July 2004