Examination of Witnesses (Questions 80-89)
Chairman: Thank you very much, Home Secretary.
ID cards.
RT HON
CHARLES CLARKE
MP AND SIR
JOHN GIEVE
KCB
25 OCTOBER 2005
Q80 Mr Browne: Home Secretary and Sir
John, a Minister in your Department, Tony McNulty, said within
the last week or so—and he was very frank about it—that
there were difficulties with the technology, and I quote; he said,
"not least in terms of people who have difficulties with
their eyes" and then he went on to clarify this by saying
that was people with brown eyes rather than coloured eyes causes
difficulty. Before I became a member of this Committee, last year
it recommended the Government's Chief Scientific Adviser lead
an expert independent scrutiny on the reliability of the biometrics
for the scheme. Given the point that the Minister makes, that
it cannot read them when people's eyes are the wrong colour, do
you not think that panel ought to have been appointed by now and
ought to be carrying out work?
Mr Clarke: I think the concerns
are not unreasonable. I can understand why the concerns are there,
and they are real. The real problem has been finding people who
are at the top level of scientific expertise in this area, biometrics,
who are truly independent. One of the problems is that you need
independence because of all the commercial interests in this area.
At the same time most of the people in this area who have a high
level of expertise are working or related to one or other of the
companies involved in this technology. We have not been able to
solve that as quickly as we should have done, so I accept the
implicit rebuke in the question. We already have in post a senior
Home Office biometrics adviser from the private sector, and the
panel that we establish will be chaired by Sir David King, the
Government's Chief Scientific Adviser. It may be of interest today
that the first meeting of the group will be on 24 November, with
a programme of meetings organised over the coming months. The
group we expect to consist of ten people, five from outside the
UK, including technology experts, people with experience in the
acquisition of large-scale government biometric systems, and people
with a solid and respected academic background. That is the state
of affairs at the moment, but the point that you were making has
weight, and I think it might have been better if we could have
got it going a bit faster.
Q81 Mr Browne: I will not follow it up
because we are pressed for time. The Home Office say that 87%
of organisations, when research has been undertaken, intend to
check identity cards when they are introduced just visually, by
having a peer at them, in the same way as you might do now of
checking somebody's card or driving licence, for example, and
the concern that has been expressed, again, by this Committee
before I became a member of it, was that the more stringent, expensive
tests would then be left with the only one in six or one in seven
checks that will be done more formally and would actually run
all of these biometrics that are going to cost so much and make
these cards so much more sophisticated. Does that concern you,
that the cards will have a much greater capacity than will actually
be tested most of the time? Most of the time people will just
give them a glimpse and all of that capacity will be going to
waste?
Mr Clarke: Not really. I understand
the point, but it does not really give me concern, because I think
the use of the card will vary substantially according to the security
issues that you face. I can, for example, understand that if the
card were used to be your proof of identity opening a bank account,
for the sake of argument, or for going through a national border,
it might be used in a different way than for other applications.
I think the important thing is that the card should have the capacity
to be used at the top level of security for such moments as it
is used. I do not think there is a requirement that every use
of it would be at that top level. John, do you have anything you
would like to add on that particular point?
Sir John Gieve: I think the point
of the registering of the card is to offer a much better and more
rapid way of identifying yourself when you need to. Obviously,
for shop transactions or whatever, it will not be necessary, but
it may still be useful. It may still be useful to have a common
currency of ways of identifying yourself and a common set of cards,
even without the use of the biometrics.
Q82 Chairman: If I can just pursue that
briefly, as somebody who was involved in that report, what we
were told when we produced our report was that, unless cards are
checked to a higher level with some degree of frequency, the system
becomes more prone to fraud, because it is clearly much easier
to forge a card that is only used for visual identity. The Home
Office has never yet published its assumptions about what levels
of checking are necessary in order to make the system secure.
Can you assure us that you will publish those assumptions before
you move to any serious contractual commitments on procurement?
Sir John Gieve: I am not quite
sure what I am being asked to commit to there.
Q83 Chairman: In non-technical terms,
if no card is ever checked against the central register for its
biometrics, it is perfectly clear the card becomes infinitely
forgeable, because you just make a piece of plastic with a name
and a face and something that looks like a chip on it. So all
cards will need at some point to be checked. What we were told
by the technical people that advised us is that you can work out
what is the minimum necessary level of serious checking of the
card to make the system fraud-proof. That is something which security
advisers, including your security advisers, must be telling you
about. All I am saying is can you promise to give the public that
information prior to making a serious contractual commitment on
the ID cards scheme?
Mr Clarke: I think we can. If
you take the two main issuing vehicles that we have discussed
at this stage, with the passport and with the Criminal Records
Bureau situation, both of those are the types of check, going
across borders and so on, where you would be using the card at
a high level of testability, I would expect, and in those circumstances
I do not think there will be major issues of this type, but I
am perfectly happy to say that, once we have got security advice
on this, we can let you have it.
Q84 Mr Browne: A final point on cost.
Many Members' principal objection to ID cards is a civil liberties
argument about shifting the balance of authority between the state
and the individual, but there is also concern on cost, not least
the opportunity cost of all of that money in the Home Office not
being spent on community policing and so on and so forth. The
Government does not seem to be pinned down on a specific projection
of cost. We have heard figures ranging from somewhere in the region
of £6 billion, which as far as I understand is roughly where
the Home Office sees it, rising up to £18 billion, which
is as I understand it a figure the Home Office rejects. As I also
understand it, the KPMG report on the costing methodology, of
which only the executive summary has been published rather than
the report in its entirety, I suppose might lead some people to
believe that the Home Office is concerned that the costs may grow
yet further still, and that may make it harder for the Home Office
to persuade parliament or the public at large that this scheme
is as attractive as it might appear to some people on first inspection.
Mr Clarke: I know cynicism and
scepticism is the order of the day for this Committee, but as
a pure and na-ve individual myself, I do not quite relate
to it in quite that way. Our current assessment for the annual
running costs for issuing ID cards and passports has been published
in the RIA at £584 million. Firstly, let me address the opportunity
costs argument. This is not a resource that we have disposal of
from the tax purse. It is money that is being made by people paying
for passports and for ID cards, and that is money which we would
not have if this were not there. The cost overall to the Exchequer
above and beyond this system is a cost which we believe can be
met by savings that we are establishing elsewhere in our budgets
for this whole approach. So it is not the case that there is an
opportunity cost argument of the type people often make. Secondly,
people have suspicions of the capacity of government to manage
a very large ID card system, and an IT system of this scale. I
think that is not warranted. If you look at the Passport Agency,
which a few years ago people made jokes about and its effectiveness,
it is now coming literally top, ahead of many other suppliers—Virgin,
eBay and so on—in terms of its efficiency as a major organisation
at an IT level with its 40 million records of data. Thirdly, if
you look at the recent chip and PIN development in shops up and
down the country, where there is now a different system of security
for credit cards and debit cards through the chip and PIN mechanism,
again, that is an absolutely massive new IT system that has gone
into place with very few criticisms compared to the system that
existed before. Obviously, one of the reasons for confidentiality
in all this is the commercial tendering that will arise when we
come to a bidding system for the actual regime itself, where we
will be looking at value for money and all the rest of it, and
if it were to transpire that our estimates were completely wrong,
then we would, of course, when the bids actually came in, have
to look at that situation, and rightly so, but none of that takes
away from the need to get legal authority to operate this scheme
as a whole. I know people have the principle objections you raise,
as they can have, but I do not think that is a basis.
Sir John Gieve: The only point
I was going to add is that the larger part of that cost would
be incurred anyway in having passports with the range of biometric
identifiers in them, and we estimate about 70% of the cost would
come simply from converting passports to carry these biometrics,
which is happening and going to happen on an international basis.
So in a sense, this is not all additional cost we are choosing
to incur.
Q85 Mr Browne: I think there is an opportunity
cost for me as an individual paying it. What about the KPMG report?
Mr Clarke: We are intending to
release the executive summary, which will summarise the basic
details. We are very loathe to put more substance into the public
arena until we have gone to tender, but I will look at that report
in the light of what you have asked to see whether we can go further.[8]
Q86 Nick Harvey: You are giving three
weeks for potential suppliers to make an input to your evolving
procurement strategy. Given that you are hoping for major international
companies, some based overseas, to be your suppliers, is this
not rather brisk?
Sir John Gieve: I do not immediately
recognise that, but we have been talking to potential suppliers
over a long period. We have various reference groups who we have
been talking to about what technologies are available. Secondly,
the actual procurement, because we are linking this so closely
to passports, will not take place in a "big bang", going
for the whole programme in one go. It will be a staged process.
I have not had any complaints from the industry that they are
not being given enough time.
Q87 Nick Harvey: You are intending to
choose the suppliers firstly to produce and distribute the cards
and secondly to maintain the national register and record the
biometrics in the first quarter of 2007, and yet you are anticipating
issuing these cards in 2008. The same question: given the history
of government IT sagas, is this not a bit unrealistic?
Mr Clarke: I think the thrust
of the question is not right. Let me just give you a quotation
from the IT trade association for the UK, Intellect, which said
a couple of weeks ago, "Our members and the wider UK technology
industry have the ability to meet the technological challenge
created by the Government's ID card proposals and remain confident
that the proposed 2008 deadlines can be met. We continue to invite
all who express concern about the technological implications of
the card to engage with us in a robust discussion." They
said the day before, "The technology being considered, which
will form the basis of the scheme, has already been used in similar
programmes across the world and is well established. We would
invite all who express concern about the technological implications,
again, to engage in robust discussion." The reason I mention
those quotations is that it is not the Government speaking; it
is the actual IT trade association itself saying that these targets
can be met.
Q88 Nick Harvey: Will not IT contractors
on previous government jobs have said exactly the same thing?
The history is rather unfortunate. When will you release the information
on the sort of issues we have raised in our report, such as the
Chief Scientific Officer's view on biometrics, these false match
rate issues we have heard about, the design of the card and the
chip? Would it not be rather foolhardy to rush into a contract
situation before there has been a proper analysis of all of that?
Mr Clarke: I do not think "foolhardy"
is the right word. I think we have taken, as the Permanent Secretary
just indicated, a large programme of discussing with the industry
both the technology and the ways of dealing with it. I do want
to take issue with another point which I noticed Mr Streeter was
agreeing with you about. The proposition that the Government is
not capable of organising—any government, I mean, whether
Labour or Conservative—a massive IT project I simply think
is not true.
Q89 Nick Harvey: There is quite a lot
of evidence, if you look at the Health Service, for example.
Mr Clarke: Let me give the example
again of the passport service, which has directly achieved top
levels of customer satisfaction as a result of the work that has
been done in developing such a scheme. If you look at the introduction
of the new driving licences, to give a completely different example,
generally, that is well regarded across the piece. If you then
go non-government, I mentioned the chip and PIN that we were talking
about a second ago. Of course, there are equally errors in the
Government's IT programme which can be pointed to perfectly accurately,
as there are errors in private sector IT procurement systems which
can also be pointed to, but I am not prepared to go along with
the argument that says we can never do anything using modern technology
because governments are useless at doing it. I simply think that
is not true; that is not demonstrated by the facts over a period
of time.
Chairman: Could we congratulate you,
Sir John, on your new appointment to the Bank of England. Can
we thank you both very much indeed for a very open and helpful
session.
8 See Ev 40 Back
|
