House of Commons - Science and Technology

Select Committee on Science and Technology Sixth Report

2 Background

6. Identity cards were compulsory in the United Kingdom from 1939 to 1952 under the National Registration Act 1939, acting as a security measure during the war and aiding rationing following the war. After the National Registration Act was repealed in October 1951, identity cards were no longer used. In the following years various proposals for identity cards were made, including a Green Paper on identity cards in May 1995.[2] Following a Report from the House of Commons Home Affairs Committee in 1996, the Government announced that it intended to introduce a voluntary identity card scheme.[3] The Government's plans to introduce a draft Bill in the 1996-97 Session of Parliament were cut short by the May 1997 General Election.

7. The notion of an identity cards scheme was reintroduced by the then Home Secretary, Rt Hon David Blunkett MP in February 2002.[4] The Home Office ran a consultation on entitlement cards and identity fraud from July 2002 until January 2003.[5] In November 2003, the Government published its plans for identity cards as Identity Cards: the Next Steps.[6] Five months later in April 2004, the Government published a draft Bill and launched a consultation on the draft legislation.[7] Following a Report by the House of Commons Home Affairs Committee in July 2004, the Government introduced an Identity Cards Bill into the House of Commons in November 2004.[8] This Bill fell at the dissolution of Parliament in April 2005. A new Identity Cards Bill was introduced on 25 May 2005 and it was finally given Royal Assent on 30 March 2006.

8. The Identity Cards Act 2006 outlines the main aims of the scheme as maintaining a secure and reliable record of facts about individuals in order to:

prevent or detect crime;
ensure national security;
enforce immigration controls;
secure the efficient and effective provision of public services; and
enforce prohibitions on unauthorised working or employment.[9]

Overview of Events

July 2002        Home Office launches consultation on entitlement cards and identity fraud

January 2003          Home Office consultation ends
November 2003           Government response to consultation findings
                                        Home Office publishes Identity Cards: Next Steps
April 2004             Government published draft bill on identity cards and launches consultation on draft bill
July 2004            House of Commons Home Affairs Committee Report on Identity Cards, Fourth Report of Session 2003-04, HC 130

October 2004            Government Response to Home Affairs Committee Report
November 2005             Presentation and first reading of original Identity Cards Bill
April 2005             Identity Cards Bill falls at dissolution of Parliament

May 2005             Introduction of new Identity Cards Bill
March 2006             Identity Cards Bill receives Royal Assent
April 2006             Creation of Identity and Passport Service

9. The Act requires all individuals over the age of 16 to register details such as their identity, address, residential status and biometric information including fingerprints or iris scans.[10] As part of the application process, individuals will be asked to visit a local or mobile centre in order to check their biographical details and to record their biometrics. This enrolment process will be overseen by individuals trained in operating the machines necessary to record biometric information. These details will be stored on a National Identity Register (NIR) and on ID cards that are issued to individuals. This information can then be used by accredited organisations to verify an individual's identity.

10. The first identity cards are expected to be issued in 2008 but the Home Office has continually emphasised that the timetable is flexible, in accordance with Office of Government Commerce guidelines.[11] Katherine Courtney, the then Director of the identity cards programme, stated in oral evidence to the Committee that "Our plans have always been to take an incremental implementation to this in a step-by-step way, building on other developments and rolling out over a period of time".[12] Furthermore, she noted that "we have always said that the ready-for-service date for this system would be dependent on the solution that industry proposes to us during the procurement process".[13] In response to questions regarding reports of an "early variant" card using a facial image or two fingerprints, the Home Office wrote:

"the term 'early variant' is misleading in implying that there are firm plans for a different type of card to be issued earlier than others. The plans for ID cards have always been incremental with no 'big bang' implementation and the Identity and Passport Service is considering the most appropriate first incremental steps to introduce ID cards."[14]

The Home Office admitted that the timetabling of the programme was being reviewed by the IPS but said that it "remains committed to delivering the ID cards programme as soon as possible, starting with biometric residence permits for foreign nationals in 2008" (see paragraph 41).[15]

11. The identity cards scheme is closely related to several other Home Office projects. Katherine Courtney explained to us on 22 March 2006 that:

"We have the biometric visas rolling out over the next year or two years, we have biometric residence permits rolling out and we have the biometric passports. We introduced the first electronic passport only this month, that was when the first one rolled off the production line. All of these things are testing the technologies that are the building blocks for this scheme."[16]

Biometric passports, including chips with the holder's facial biometric, were introduced in March 2006.[17] These passports are in line with the standards set by the International Civil Aviation Organisation (ICAO) in May 2003, which nominated facial recognition as the primary biometric with iris and fingerprint as backup.[18]

MANAGEMENT

12. In order to deliver the scheme, the Home Office has created an Identity and Passport Service (IPS) incorporating the United Kingdom Passport Service (UKPS) and the Home Office's identity cards programme team. This new service became operational on 1 April 2006 and the outline management structure for the agency is shown in Figure 1 below. As a result of these changes, the members of the identity card programme team that gave oral evidence to us on 22 March 2006 have now got new job titles. Katherine Courtney is no longer the Director of the identity cards programme but the Executive Director of Business Development and External Affairs. Nigel Seed is Director, NIR and Operational Technology Infrastructure and Dr Henry Bloomfield is Technical Lead, NIR and Operational Technology Infrastructure. In the remainder of this Report, when referring to these individuals we will use their new job titles.
Figure 1 Senior Management Structure for the Identity and Passport Service

Source: Government Memorandum, Appendix 2, Ev 53

13. The new service will be headed by a Chief Executive who will be recruited through open competition. The Chief Executive will also have a role within the Home Office as Director General Identity Services and will sit on4 the Home Office's Group Executive Board.[19] As such we have been assured that the procedures and facilities in place for the Home Office with regard to scientific advice will remain available to the Identity and Passport Service.[20]

14. The Home Office told us that as of February 2006 there were 186 people working with the identity cards programme team: 54 civil servants, 98 consultants and 34 interims. Since the creation of the IPS, the Home Office has said that the number of people working on the identity cards programme has not changed significantly. As Figure 1 shows, the Head of Marketing, the Chief Business Architect and Delivery Director within the IPS are consultants from PA Consulting. In 2004, the Home Office announced that PA Consulting had won a contract to aid the implementation of the identity card programme.[21] The contract commenced in May 2004 and lasts up to a maximum of three years. Between 6 April 2005 and 18 April 2006, the Home Office paid PA Consulting £14,248,799.21 for work on the identity cards programme.[22] The Home Office said that it was necessary to involve a private company because it did not have "ready access to certain skill sets and resources necessary for implementation of a large and complex project such as Identity Cards".[23] The Home Office responded to questions from us regarding the role of PA Consulting by explaining that:

"PA support the design, feasibility testing, security accreditation, business case and procurement elements of the proposed scheme. The specialist skills include project and programme management, procurement, smart cards and biometrics, business process design, financial modelling and business case development."[24]

Overview of proposed technology

BIOMETRICS

15. The Identity Cards Act 2006 states that biometric information will be recorded in the National Identity Register. The Act defines biometric information in relation to an individual as "data about his external characteristics, including, in particular, the features of an iris or of any other part of the eye".[25] There are many different types of biometric technology: facial, fingerprint, iris, signature, voice, hand geometry, vascular patterns, retina, DNA, ear recognition, keystroke and gait. The Government has stated that for ID cards it intends to develop a multi-modal scheme using 13 biometrics: 10 fingerprints, two irises and one face.[26] The Home Office has decided to use multiple biometrics for two key reasons. Firstly, it will ensure that as high a proportion of the population can enrol as possible. For example if an individual is missing a hand, they will still be able to enrol on iris or face. Secondly, if any problems occur during the verification process, for example with fingerprints, then it will be possible to double-check with iris scanning.[27] However, it is envisaged that different biometrics would be used for different scenarios. Katherine Courtney, the Executive Director of Business Development and External Affairs at IPS, explained in oral evidence that "In different business applications, a different biometric might be more appropriate than others. You see, for instance, iris being used quite successfully where you have a high volume of people passing through a system, such as the expedited gate clearing at the airports".[28]

16. Biometric systems work by converting a captured image into a template, which can be used in different ways. A one-to-one match can compare the biometrics to a template obtained on a previous occasion. A one-to-many search looks for a match for the biometric in a database of templates, which takes longer. The Government is proposing that the templates be stored on the National Identity Register and on a chip in the identity card. The biometrics will therefore link an individual both to their card and to the Register. In evidence to the House of Commons Home Affairs Committee, the then Home Secretary David Blunkett said that "the moment someone presents the same biometric but with a different identity, a different name and presentation, that would automatically show up as already existing on the database".[29]

17. The accuracy of biometric systems depends on a number of basic performance measurements:

a) False match rate—the probability that a person's biometric matches the enrolment template of another person.

b) False non-match rate—the probability that a person's biometric fails to match their own enrolment template.

c) Failure to acquire rate—the submitted image is too poor for the system to make a reliable decision. Failure to acquire occurs for several reasons: when the enrolment environment is unsuitable, physical problems presenting the biometric eg. arthritis, or where the biometric is missing (approximately 1 person in 70,000 does not have an iris due to the inherited condition 'aniridia' and over 1 in 1000 fingers are missing or have no fingerprint due to scar tissue). [30]

18. There are no mutually-accepted standards for testing biometric technology and industry claims about performance vary widely. Most independent testing of biometric technologies has been undertaken by the National Physical Laboratory (NPL) in the UK and the National Institute for Standards and Technology (NIST) in the United States. Although there are several schemes that use biometric technology, there is very little published information from real life deployments.[31] The Home Office has stated that it expects the following performance levels to be sufficient for its requirements in the identity cards scheme:[32]

Face—failure to acquire rate close to zero, a false accept rate of 1%.
Fingerprint—failure to acquire rate of 0.5-1%, false match rate of 1.3e-10, false non-match rate of 0.01.[33]
Iris—failure to acquire rate of 0.5%, false non-match rate of 5 % false match rate of 5e-12.[34]

BIOMETRIC TECHNOLOGY OVERVIEW
Fingerprinting
The use of fingerprinting is well-known because of its use in forensic science and law enforcement. Large-scale fingerprint technology works by using coordinates of points on the fingerprint where ridges end or split. It is also possible to match the whole fingerprint pattern but such systems are rarely used on a large scale.
There are two main ways of recording fingerprints: rolling and slapping. Rolled fingerprints are used in law enforcement where the maximum print is recorded. Slapped fingerprints only record the pad of the finger but the process is less intrusive. There are different types of fingerprint reader: slap readers (10 prints), single-finger optical readers, single-finger capacitive readers, ultrasound readers and rolled fingerprint readers. It is likely that the ID Cards Programme would use a 10-finger slap reader.
The basic characteristics of fingerprints do not change, although fingerprints can be damaged by injury, burns or wear due to work. When recording fingerprints, it is important the finger is clean because any grease or dirt can distort the image. The image can also be distorted by pressure on the finger that alters the fingerprint pattern.
There are hundreds of fingerprint companies but only four or five provide AFIS (automated finger identification systems). There are several large-scale fingerprint databases including the FBI AFIS database, which has a database of 47 million fingerprints and Ident1 in the UK, which holds six million sets of prints.
Facial Recognition
Facial recognition works by identifying people according to sections of the face least susceptible to alteration eg. upper outline of eye, sides of mouth, cheekbones.
The two main methods are: local feature analysis and the Eigenface method. Local feature analysis measures the relative distances between landmarks on the face. The Eigenface method looks at the face as a whole and uses combinations of 2D templates that represent distinctive characteristics of a facial image.
Face recognition readers vary greatly in technology and the lighting of the face can have a great effect upon the performance of the technology. There are approximately 10 companies offering 3D technology and less than 100 companies offering 2D solutions.
Iris Scanning
Iris recognition measures the iris pattern in the coloured part of the eye. Iris patterns are formed randomly at birth and iris patterns are different for every eye. The iris can have more than 250 distinct features compared with 40 or 50 comparison points for fingerprints.
Iris scanning involves a camera capturing an image of one or both eyes. The camera focuses on the eye, locates the iris and accounts for areas obstructed by eyelashes or eyelids. This image is broken into circular grids and each area is analysed for unique patterns. This information is converted into an algorithm in the camera that can be used as a template.
Iris patterns are unique, even between identical twins, and these patterns are stable throughout life. There can be some difficulties with iris scanning if individuals are wearing glasses or contact lenses, if they have aniridia (lack an iris) or glaucoma.
The iris recognition market is currently dominated by Iridian, although it may become increasingly competitive as patents expire. Iris performance statistics from independent tests are limited to 100's. However, the technology is widely used in the United Arab Emirates, which has a database of over 350,000 iris scans.

Source: Government Memorandum, Appendix 2, Ev 54-67.

19. One of the risks of biometric technologies is that they might be spoofed, which means that real biometrics are replaced with false ones. Spoofing is usually attempted by re-activating a latent image from a previous enrolment; using a false biometric for example contact lenses, or using a biometric from another individual, alive or dead. Technology is currently being developed that would be able to distinguish live biometrics. The Government memorandum emphasises that in order to spoof the system it will also be necessary to conceal attempts from the trained operator.[35]

20. Biometric technology is becoming increasingly popular as part of identity and passport schemes. In the last five years, there has been a rise in the use of biometrics on visas and passports:

Following 9/11, the United States introduced fingerprint biometric visas for those visiting the US. We observed this scheme, the US-Visit programme, at JFK airport in New York during our visit in March 2006.[36]
In May 2003, the International Civil Aviation Organization (ICAO) adopted a blueprint for the integration of biometric identification information into passports and other Machine Readable Travel Documents (MRTDs).[37]
In June 2003, a border control programme based on iris scanning was rolled out throughout the United Arab Emirates.[38]
In December 2004, following European Parliamentary approval, a new Regulation on passports in the Schengen States was adopted by the Council of Ministers. It provided that newly-issued passports must include digital facial images (within 18 months) and fingerprints (within three years).[39]

It must be noted however that none of these schemes are as ambitious in their use of biometrics as the UK identity card scheme, which will be the first national scheme to use three biometrics.

INFORMATION AND COMMUNICATION TECHNOLOGY

21. The ICT system that will be a central part of the identity cards scheme will consist of one logical database (the National Identity Register) and smart cards. The Home Office has stated in written evidence that the system will be split into modules that will be met wherever possible by customised versions of systems already found in the marketplace. This solution will be used as a reference point for the eventual system design undertaken by the suppliers. The Home Office states that "this modularisation is intended to simplify, and hence help de-risk, IT system delivery, and allow easier substitution of any modules that fail to meet our capability, performance and resilience requirements".[40] It also claims that modularisation will highlight security violations because the information flowing between systems will be visible and auditable.

22. In oral evidence to the Committee, Katherine Courtney emphasised that the National Identity Register was not necessarily going to be a central database. She explained that "The National Identity Register will be a technical system that may involve a series of data storage solutions".[41] The identity cards programme team is focusing upon the outputs of the system and as a result the National Identity Register could be a single monolithic database or a series of databases. Until procurement begins, there is little more information available regarding the likely technology that will be chosen (see paragraph 125).

23. The identity cards will use smart card technology. Physically, the card will be a piece of plastic, like a credit card, with an embedded chip that will contain biographical and biometric data. It will show the individual's name and an image of their face. Each card will have its own Identity Registration Number (IRN) and a Personal Identification Number (PIN), which can be set by the cardholder. Cards can either use contact technology requiring physical connection with a reader or contactless technology like that which is currently used in Transport for London Oyster cards. The identity cards scheme is expected to use a card that could function both as a contact and contactless card. On 20 July 2005, the then Parliamentary Under-Secretary of State for Immigration, Citizenship and Nationality, Andy Burnham stated that:

"It is currently planned that identity cards issued to British nationals eligible for a passport could be used by individuals for travel within Europe. In order to facilitate this, the card will need to meet standards established by the International Civil Aviation Organisation (ICAO), which require the card to be contactless in order to be considered a valid travel document. In addition, we are also investigating whether it would be beneficial and cost effective to be compatible with other card reader national infrastructures, such as the Chip & PIN network, which requires contact card. Thus it is possible that an identity card will function as both a contact and contactless card."[42]

The Home Office has not yet publicly finalised these plans.

2 Home Office, Identity Cards: a consultation document, Cm 2879, May 1995 Back

3 Home Affairs Committee, Fourth Report of Session 1995-96, HC 172-I; Home Office, The Government Reply to the Fourth Report from the Home Affairs Committee, Session 1995-96, Cm 3362, August 1996 Back

4 HC Deb, 7 February 2002, col 1028 Back

5 Home Office, Entitlement Cards and Identity Fraud: A Consultation Paper¸ Cm 5557, July 2002 Back

6 Home Office, Identity Cards: The Next Steps, Cm 6020, November 2003 Back

7 Home Office, Legislation on Identity Cards: A Consultation, Cm 6178, April 2004 Back

8 Home Affairs Committee, Fourth Report of Session 2003-04, Identity Cards, HC130-I Back

9 Identity Cards Act 2006, para 1(3-4) Back

10 Some individuals will be excluded such as those who are residing in the UK without an entitlement to remain there. Identity Cards Act 2006, para 1-2. Back

11 Ev 112 Back

12 Q 310 Back