Clarity
37. The scheme aspirations were set out in the bill
and are now outlined at the start of the Identity Cards Act 2006
(see paragraph 8). As detailed earlier, the scheme is intended
to prevent or detect crime; to ensure national security; to enforce
immigration controls; to secure the efficient and effective provision
of public services, and to enforce prohibitions on unauthorised
working or employment.[70]
The emphasis placed on different aspirations has varied throughout
the life of the scheme and this changing focus has resulted in
a lack of clarity regarding the likely technology requirements.
For example, whereas originally the focus was on tackling identity
fraud, it soon changed to countering terrorism and combating crime.[71]
In oral evidence when asked about the objectives of the scheme,
Joan Ryan, the Parliamentary Under-Secretary of State for nationality,
citizenship and immigration acknowledged that "It is true
that people have sometimes given them in a different order and
perhaps with a different emphasis".[72]
We are
aware that political pressures inevitably impact on the scheme,
but it is highly regrettable that the emphasis on different aspirations
has changed. This has created uncertainty for the public and industry
alike. We hope that the situation will stabilise now that the
Bill has received Royal Assent.
38. Although the scheme aspirations are now clearly
laid down, there is still a lack of information regarding how
these aspirations will be delivered by the scheme. Jerry Fishenden
from Microsoft has called this lack of a clear link between aspiration
and practical detail the missing "technology policy"
layer.[73] Professor
Martyn Thomas from the UKCRC stated that "everything…that
I have seen about the programme, lays down a set of aspirations
for the ways in which the identity scheme might contribute to
reducing fraud under some circumstances, but there is no quantification,
there is no analysis".[74]
This missing information includes a lack of detail regarding the
scope of the scheme, the involvement of different Government departments
and the ways in which individuals will actually use their identity
cards. The Government needs to clarify the details of the scheme
in order to successfully develop the technical architecture that
is required to support it. Microsoft stated in written evidence
that "the overall technical architecture…is clearly
inter-dependent on the policy and business requirements and objectives
of the ID card scheme".[75]
Professor Thomas from the UKCRC agreed, saying in oral evidence
that "It is clear that the technology is interdependent with
the business case because the business case is founded on the
requirements and the technology should be there to support the
requirements".[76]
39. It is unsatisfactory that the boundaries of the
scheme still seem not to have been set. We have the impression
that the Government still does not know precisely what it wants
from the identity card scheme. In October 2005 for example, the
Home Office estimated that the number of verification transactions
would be 163 million per annum. In May 2006 the Home Office's
estimate of the number of verification, identification, authentication
and information provision services had risen to 771million per
annum. The Home Office said that the rise resulted from "the
progress made in understanding public and private sector organisations'
intended use of the scheme".[77]
The Home Office asserts that it intends to ensure that a solution
can be scaled up to the demand required rather than developing
the scheme around a number of fixed transactions.[78]
However, this assertion implies that the Home Office is not confident
either in its estimates regarding the number of transactions or
in its awareness of the intended uses of the scheme by public
and private organisations.
40. There is also apparent confusion regarding the
use of the identity card across Government. In oral evidence to
us, the Parliamentary Under-Secretary of State for nationality,
citizenship and immigration, Joan Ryan, said that the Home Office
was in discussions with the Department for Work and Pensions,
the Department of Health, the Criminal Records Bureau, the police
and the Department for Communities and Local Government. She explained
that "we are attempting to get this cross-departmental recognition
of benefits, the buy-in and working together".[79]
There still appears to be confusion regarding whether the NHS
will use the card. In October 2006, the then Home Secretary, Rt
Hon Charles Clarke MP, said that "no medical details will
be on the database".[80]
In April 2006, the then Parliamentary Under-Secretary of State
for Immigration, Citizenship and Nationality, Andy Burnham MP
said that "you could argue that blood group, allergies, donor
status, that sort of information could be potentially helpful"
and he proposed that this information could be placed voluntarily
on the National Identity Register.[81]
However, soon afterwards in response to an article published on
15 April 2006 in The Independent, the Home Secretary Charles
Clarke wrote that the National Identity Register would not include
health or medical records.[82]
This issue was raised by Dr Edgar Whitley from the London School
of Economics in an oral evidence session.[83]
More recently, there has been disagreement regarding the release
of information concerning the likely uses of identity cards by
the Department for Work and Pensions (DWP). In December 2004,
an FoI request was made to the DWP for a copy of the Department's
feasibility study on identity cards. The DWP refused this request
and on 11 July 2005 the individual asked the Information Commissioner
to make a decision about the handling of the request.[84]
On 5 June 2006, the Information Commissioner, Richard Thomas,
decided that the information was in the public interest and should
be released. He said that "there is clearly a strong public
interest in the public knowing whether the introduction of identity
cards will bring benefits to the DWP, and to other departments,
and if so what those benefits will be".[85]
This lack of transparency and reticence to share information regarding
the cross-departmental uses of the scheme damages public confidence.
It also adds to the impression that the Government has not yet
determined the scope of the scheme. It seems that the Home Office
is willing to expand the scheme at a later date. On 14 June 2006,
Joan Ryan MP said that the main aspirations of the scheme "should
not exclude developmental work on using the card in other ways
as time moves on".[86]
41. As already noted, the Home Office is taking an
incremental approach to the identity cards scheme (paragraph 10).
The Home Office has, however, not clarified what the various incremental
steps towards identity cards will be beyond the introduction of
biometric passports. On several occasions, the Home Office has
referred to different schemes as precursors to identity cards
and this has resulted in a lack of clarity between the introduction
of identity cards and other registration documents, which use
biometrics. In oral evidence, the Minister Joan Ryan stated that
"I was watching ID cards being issued yesterday at Lunar
House in Croydon. The ARC [Application Registration Card] card
for asylum seekers is, in effect, an ID card".[87]
Application Registration Cards were launched in February 2002.[88]
The cards contain two digital images of the holder and the holder's
fingerprint details.[89]
The Home Office has also said that the identity cards programme
would begin with the introduction of "biometric residence
permits for foreign nationals in 2008".[90]
It is unclear whether full identity cards, including the three
proposed biometrics, will also be introduced in 2008. Indeed there
have been reports of an "early variant" identity card
that would include a facial image or two fingerprints (see paragraph
10). The Home Office has not clarified the situation by saying
that there are no "firm plans" for a different type
of card to be issued earlier than others.[91]
42. We are surprised
that the scope of the scheme has still not been finalised. There
is insufficient evidence to suggest that uses across Government
have been explored fully. As will be discussed in more detail
in the following chapter, interoperability is crucial to the success
of the scheme and the longer that the Government takes to determine
its scope the more difficult it is likely to become to make sure
that the technology is interoperable. We
urge the Home Office to finalise the scope of the scheme and the
technical standards needed for interoperability as soon as possible.
43. This lack of clarity regarding the overall scope
of the scheme is exacerbated by a lack of detail concerning when,
where and how identity cards might be used. The Home Office website
currently contains three examples of how an identity card might
be used in daily life to prove your age, collect a parcel or transfer
money.[92] This lack
of detailed information regarding precise scenarios has been highlighted
in written and oral evidence. LASSeO has stated in written evidence
that, "It is very difficult to establish what detailed plans
exist or are being developed, what technologies will be selected,
how these technologies will be used, etc.".[93]
Jerry Fishenden from Microsoft explained that "I would have
expected at this stage to see a fairly rich set of very precise
scenarios about exactly where and how the ID card would be used
and to address many of the issues we are talking about here as
to what gets released in those types of scenario".[94]
He also noted that "I have heard nothing in any of the consultation
about how this card would operate in an online context".[95]
Furthermore, he has questioned whether, if a chip and pin type
of technology is going to be used in the majority of scenarios,
the debate on biometrics has been "a bit of a side issue".[96]
44. Representatives from the UKCRC and Microsoft
have also highlighted the lack of clarity regarding when the identity
card would be used for authentication, that is finding out if
you are eligible to do something, and identification, which is
finding out who you are.[97]
Professor Martyn Thomas from UKCRC explained that "If you
go that extra step to ask for identity information when what you
actually want is authentication…you are revealing information
which makes things like identity fraud much more likely to occur".[98]
Jerry Fishenden from Microsoft referred to two examples on the
Identity and Passport Service website, which described that an
identity card would be used to reveal an individual's date of
birth so that they could buy alcohol at 18 or get a pensioner's
discount at 65. He questioned "Why would you want to reveal
somebody's date of birth in that scenario?...You do not even have
to reveal their age, but that they are over 65".[99]
45. In order
to clarify when and how the card might be used, we recommend that
the Home Office releases more information regarding what personal
data will be revealed in different scenarios, including in an
online context. Until this information is released, it is difficult
to ascertain the true scope of the scheme and to fully understand
how technology will be used within the scheme.
46. The evidence that we have received has also highlighted
a lack of clarity in another area of the identity cards programme:
the procurement process. In general, industry appears to be unsure
about when the specifications will be released and, when they
are released, what they are likely to be.[100]
Initially the procurement process was due to start as soon as
Royal Assent had been granted; however several months have passed
and the process has not yet commenced. Nigel Seed, Director of
the National Identity Register, told us on 22 March 2006 that:
"We have what we are calling level one requirements
which describe not in very detailed terms what we want the programme
to do. That will go out initially to all the companies that have
expressed an interest. They will come back and tell us what their
proposals are. We will then down-select to a smaller group that
will receive the more detailed requirements."[101]
However, Intellect has said that they "would
like to see a final Statement of Requirements prior to commencement
of procurement".[102]
We understand that the Home Office is attempting to implement
best practice in procurement but we believe that there is a disagreement
between Government and industry regarding what best practice actually
means. This disconnect may be due to the use by the Home Office
of EU terminology regarding procurement. In January 2006, new
regulations regarding public procurement came into force in the
UK.[103] These regulations
use the term 'procurement' to describe what has traditionally
been known as the acquisition process. Procurement, ie. the buying
stage, was part of this acquisition process, which also involved
feasibility, trialling and piloting. Within the terminology of
these new regulations procurement includes a dialogue with suppliers,
specification, selection and award. Thus whilst Intellect is seeking
a final statement of requirements before procurement begins, for
the Home Office discussion about such a statement is part of the
procurement process. We
recommend that the Home Office issues a clear timetable for the
publication of the technical specifications and defines procurement
processes and stages.
47. The evidence
has highlighted four main areas where the Home Office still needs
to clarify the scheme: its overall scope, the involvement of other
Government departments, the practical uses of the card and the
procurement process. These areas were all highlighted in 2004
by the House of Commons Home Affairs Committee's Report on identity
cards.[104] In response
to this Report, the Home Office noted that "Work is continuing
with stakeholders" on the scope of the scheme.[105]
In relation to the use of the identity card by other departments,
the Home Office stated that "The Government recognises the
need for ongoing work on these issues".[106]
We are disappointed that two years after the Home Affairs Committee
inquiry into identity cards the problems regarding clarity have
not been resolved. We urge the Home Office to address these issues
immediately.
43 
