Conclusions and recommendations
Stakeholder engagement
Consultations
1. The
Home Office has consulted the wider community and has tried to
apply best practice in this area. However, stakeholders are not
satisfied with the nature of consultation and feel that consultations
have been unduly limited in scope with unclear evidence gathering
objectives. As a result, the wider community does not have the
level of confidence in the scheme that could be expected following
a successful consultation process. (Paragraph 31)
2. We recommend that
the Home Office undertakes future consultations on scientific
and technical issues as well as the procurement process. (Paragraph
33)
Transparency
3. We
conclude that the processes by which scientific advice is incorporated
into policy are not completely transparent and that organisations
are not receiving feedback regarding their advice. We urge the
Home Office to fulfil their welcome commitment to make it clear
how and what advice has been incorporated into the development
of future policy, particularly the technical specification. (Paragraph
36)
Clarity
4. We
are aware that political pressures inevitably impact on the scheme,
but it is highly regrettable that the emphasis on different aspirations
has changed. This has created uncertainty for the public and industry
alike. We hope that the situation will stabilise now that the
Bill has received Royal Assent. (Paragraph 37)
5. We urge the Home
Office to finalise the scope of the scheme and the technical standards
needed for interoperability as soon as possible. (Paragraph 42)
6. In order to clarify
when and how the card might be used, we recommend that the Home
Office releases more information regarding what personal data
will be revealed in different scenarios, including in an online
context. Until this information is released, it is difficult to
ascertain the true scope of the scheme and to fully understand
how technology will be used within the scheme. (Paragraph 45)
7. We recommend that
the Home Office issues a clear timetable for the publication of
the technical specifications and defines procurement processes
and stages. (Paragraph 46)
8. We are disappointed
that two years after the Home Affairs Committee inquiry into identity
cards the problems regarding clarity have not been resolved. We
urge the Home Office to address these issues immediately. (Paragraph
47)
Sources of scientific advice
Advisory committees
9. We
welcome the establishment of the Biometrics Experts Group and
the Biometrics Assurance Group, although we regret the time that
the Home Office has taken to set them up. We support the involvement
of Sir David King and believe that the Assurance Group has the
potential to work well, particularly in providing consistent advice
across Government. We seek confirmation from the Home Office that
the Biometrics Assurance Group will be given the direction, tools
and time to fulfil its tasks in practice and that the Group's
recommendations will be taken into account. (Paragraph 53)
10. We recommend that
the Identity and Passport Service establish an ICT Assurance Committee
consisting of academics and industry experts and that this committee
reviews the programme specifications relating to ICT. (Paragraph
55)
11. We welcome the
work that has been undertaken over the last two years by the Government
in developing the network of Chief Information Officers and more
recently, Chief Technology Officers. We have not received any
evidence demonstrating that these changes have impacted upon the
identity cards programme. Given the central role played by ICT
in the identity cards programme, we recommend that the involvement
of ICT professionals within Government in the scheme be made clear
and, if appropriate, that the Chief Information Officer chair
the ICT Assurance Committee. (Paragraph 57)
Academia and learned societies
12. We
believe that the Home Office is not taking full advantage of the
impartial advice that could be offered by the academic computer
science and information systems community. We recommend that the
Home Office uses the ICT Assurance Committee in order to fully
engage the academic ICT community. (Paragraph 61)
13. The LSE reports
served a useful purpose in opening up debate on the scheme but
the resulting emphasis upon the cost of the scheme and the errors
in the initial interim report inhibited the development of the
necessary wide-ranging debate. (Paragraph 65)
14. We are disappointed
by the nature of the Government's reaction to the criticisms outlined
in the LSE reports. We believe that the way in which the LSE reports
have polarised the debate regarding identity cards, whether intentionally
or not, has been detrimental. The Home Office would have been
better advised to put together a dispassionate critique of the
LSE Identity Project Report rather than seek to undermine its
credibility and motivation. (Paragraph 67)
Industry
15. We
recommend that, particularly as it enters the procurement phase,
the Home Office works to develop further its relationships with
industry. Industry is a significant source of scientific and risk
reduction advice as well as being a pool of potential suppliers.
We reiterate that the Home Office needs to engage in wide-ranging
debate with industrial experts regarding scientific and technical
aspects of the scheme. (Paragraph 70)
Co-ordination within Government
16. We
recommend that the Home Office undertakes a cross-Government consultation
regarding its plans for technology to support the identity card
scheme before the specifications of the scheme are finalised and
that it makes the findings of this consultation public. (Paragraph
76)
International models
17.
We recommend that the Home Office continues to develop international
links during the programme but stress that the limitations of
advice and evidence from other schemes must be recognised by Ministers
in the light of the unprecedented scale, the use of multiple biometrics
and the complex IT requirements of the UK scheme. (Paragraph 80)
18. In order to build
public confidence in the technologies involved, we recommend that
the Home Office publishes an overview of the scientific advice
and evidence that it receives as a result of international co-operation.
(Paragraph 81)
The evidence base
Trials
19. We
welcome the Home Office's commitment to publicising fully its
plans for trialling once the procurement process has begun. In
order to continue this move towards transparency and to build
public confidence in the scheme, we recommend that the Home Office
also makes public the results of these trials. (Paragraph 83)
20. We welcome the
Home Office's cautious incremental approach and we encourage the
Home Office, if necessary, to extend the procurement phase to
ensure that enough time is taken to gather the necessary scientific
evidence and to undertake all the appropriate trials. In view
of the potential adverse impact on large numbers of people, it
is better that the scheme is late and workable than on time but
flawed. (Paragraph 84)
21. We recommend that
the Home Office publicly outlines the ways in which the results
of the trials have influenced and changed the programme. (Paragraph
85)
22. We seek assurance
that the Home Office will not limit the number, scope or quality
of technology trials in order to stay within the allocated budget.
We recommend that the Home Office ensures that sufficient funding
is available to undertake the necessary technology trials for
this scheme and that it retains flexibility regarding the trials
that may be required. (Paragraph 86)
23. There is evidence
that whilst trial plans were set out clearly the processes with
which they were enacted lacked rigor. As a result, the Home Office
has selectively used evidence from the biometrics enrolment trial
to support its assertions. We believe that the Home Office has
been inconsistent regarding the status of this trial and this
has caused confusion in relation to the significance of the evidence
gathered about biometric technologies. We recommend that the Home
Office clarifies whether or not it accepts the validity of the
results gained during the trial regarding the performance of biometric
technologies. (Paragraph 88)
24. Given the findings
of the biometrics enrolment report regarding the performance of
current biometric systems, we seek reassurance from the Home Office
that systems will be adapted as necessary to improve performance
levels and that final performance levels will be verified by independent
testing. (Paragraph 89)
25. We note the lack
of independent evidence relating to the performance of iris scanning
and welcome the Home Office's commitment to undertake a large-scale
matching test using pre-recorded biometrics. Given the relative
lack of information available publicly regarding the performance
of biometrics in a national scheme, we recommend that once the
scheme is established the Home Office publishes details of the
performance levels of the technology. (Paragraph 91)
26. We are surprised
and concerned that the Home Office has already chosen the biometrics
that it intends to use before finishing the process of gathering
evidence. Given that the Identity Cards Act does not specify the
biometrics to be used, we encourage the Home Office to be flexible
about biometrics and to act on evidence rather than preference.
We seek assurance that if there is no evidence that any particular
biometric technology will enhance the overall performance of the
system it will not be used. (Paragraph 93)
27. We note the lack
of explicit commitment from the Home Office to trialling the ICT
solution and strongly recommend that it take advice from the ICT
Assurance Committee on trialling. We seek an assurance that time
pressure and political demands will not make the Home Office forgo
a trial period or change the purpose of the scheme. (Paragraph
95)
Research and development
28. We
recommend that the Home Office identifies the gaps in the evidence
base underpinning the identity cards programme, that it commissions
research to fill these gaps and that it feeds any new developments
into the scheme where appropriate. This process should be overseen
by the departmental Chief Scientific Adviser. (Paragraph 96)
29. The Home Office
cannot afford to delegate responsibility for horizon scanning
to others. We recommend that the Home Office actively undertakes
horizon scanning activities relevant to the technologies involved
in the identity cards programme and that it develops mechanisms
to feed this information back into the scheme. (Paragraph 97)
30. We urge the Home
Office to commission, and where appropriate fund, research focused
on the specific requirements of the information technology systems
in the identity cards scheme rather than relying on general existing
study results. (Paragraph 98)
Technology and operating costs
31. We
recommend that the identity cards programme team returns to the
KPMG audit report and implements its recommendations. Furthermore,
we re-emphasise that the Home Office needs to work out how costs
will impact on performance and we seek reassurance from Government
that cost limitations will not compromise the level of performance
that is accepted. (Paragraph 102)
32. We are sceptical
about the validity of costs produced at this early stage. We acknowledge
that the release of firm overall costing has been driven by political
imperatives but the Home Office could have credibly given a broad
range instead of precise figures. We note the danger that a desire
to keep below a costs ceiling might drive the choice of technology.
We seek assurances that the costings are flexible. We strongly
recommend that, once the procurement process has taken place,
the Home Office publishes a breakdown of technology costs, including
set-up costs, running costs and predicted savings as a result
of the scheme in the Home Office and elsewhere. (Paragraph 105)
33. We recommend that
the Home Office prioritise funding as necessary to ensure that
required social science research is undertaken and if necessary
commissioned. In particular, we emphasise the need to undertake
work to understand the attitudes of prime users towards the current
proposals. (Paragraph 109)
34. We recommend that
the Home Office establishes a clear process by which advice from
external social science experts regarding future research and
the social science aspects of the programme can feed into the
scheme. Once research has been undertaken, we urge the Home Office
to develop the expertise that will allow it to follow up the results.
(Paragraph 111)
The treatment of risk
Treatment of risk
35. The
Home Office has provided us with details of the risk management
strategy within the identity cards programme. However we are disappointed
that the Chairman was not allowed to view the risk register in
confidence. In the light of the evidence provided to us, we are
somewhat reassured by the Home Office's risk management strategy.
Any delay to the procurement process will postpone the treatment
of various risks. We seek assurance that the timing of the procurement
process will be considered in relation to risk management. (Paragraph
116)
36. We recommend that
the Home Office make details of its risk model public and that
it takes steps to ensure that advice regarding risk management
can feed into that model. (Paragraph 117)
37. We recommend that
an overall indication of the outcomes of the OGC Gateway Reviews,
but no specifics, be made public in order to increase confidence
in the scheme. (Paragraph 119)
38. It is important
that the impact of a politically-imposed deadline will not override
the impact of scientific advice or evidence on the readiness of
the scheme and we seek reassurance from the Government on this
point. (Paragraph 120)
39. We emphasise the
importance of the development of an holistic approach to risk
management in order to ensure that focus on biometrics as an emerging
technology does not detract attention from other aspects of the
scheme. (Paragraph 122)
ICT system
40. Industry
is hoping that the commencement of procurement and the release
of specifications will clarify the Home Office's position. Once
the specifications have been released, we urge the Home Office
to take steps to ensure that the specifications, requirements
and risks have been clearly understood by all involved. (Paragraph
126)
41. The Home Office
is reliant on external expertise in the area of ICT and is unable
to act as an intelligent customer of scientific advice. We recommend
that the Home Office uses a senior and experienced systems architect
to advise on the specifications and to provide support during
the procurement process. (Paragraph 129)
42. We recommend that
the Home Office give the security properties of the solution a
very high priority, not only from the point of view of being trustworthy
but also to ensure that the security features do not adversely
impact upon the operation of the scheme. Furthermore, we suggest
that if possible, the solution should be based on security architectures,
technology and processes that are already in use.(Paragraph 135)
Public engagement and communication
43. We
support the identity cards programme's public communications strategy.
However, we believe that this effort has been undermined by damaging
media reports. We recommend that the Home Office seeks to inform
the identity cards debate with accurate statistics and evidence,
and communicates with the media more clearly in addition to seeking
to rebut allegations as they arise. (Paragraph 141)
| 
