Memorandum 4
Memorandum from the Home Office on the
National Identity Scheme to follow up certain recommendations
in the House of Commons Science and Technology Select Committee
Report: Identity Card Technologies: Scientific Advice, Risk and
Evidence (Sixth Report of Session 2005-06 HC 1032)
1. The programme of projects set up to deliver
the National Identity Scheme ("the Scheme") started
in the Home Office and moved to the Identity and Passport Service
(IPS) with the formation of that agency from the UK Passport Service
(UKPS) in April 2006. The work of delivering the Scheme was subject
to inquiries from first the House of Commons Home Affairs Committee
in 2004 (to which the Government responded in October 2004) and
then the House of Commons Science and Technology Select Committee
in 2006. A report on this latter inquiry was published in July
2006 ("the Committee's report") followed by the Government's
response in October 2006.
2. This memorandum is a response to a request
(July 2007) by the Science and Technology Select Committee for
further information on 10 of the recommendations made in the Committee's
report. It also provides a general progress report on the Scheme
including plans for procurement.
SUMMARY OF
PROGRESS
3. There has been significant progress in
the work to deliver the Scheme since the Committee's report:
— IPS is introducing passport application
interviews. We are starting to require adult customers applying
for a passport for the first time (a group which accounts for
approximately half of passport frauds) to attend an interview
with IPS in person to confirm their identity. The requirement
to attend an interview is being introduced gradually. It started
with interview offices in Newport, Peterborough, Glasgow, Belfast
and Newcastle earlier this summer, then Birmingham and Manchester
which opened on 10 September, London on 24 September and IPS will
add further offices through to the end of 2007. This progressive
introduction is enabling IPS to conduct research and get feedback;
this will be used to enhance the interview process for customers.
A biometric enrolment trial has also been conducted in September
at the Derby interview office.
— We are continuing to test and evaluate
the Scheme proposition through a variety of avenues which seek
to improve the delivery of public services and implement innovative
identity management services. Examples include our work with the
Criminal Records Bureau (CRB) on how a criminal records check
can be made faster and with improved confidence in the authentication
of identity, the Passport Validation Service (PVS) which allows
public and private sector organisations to validate a passport
presented as assurance of identity (the private sector service
has now been live for a year and has answered more than 90,000
requests for validation from financial service organisations),
and our move to issuing ePassports which store passport details
on a chip embedded in the passport and represent a significant
advance in the security of the document.
— Since July we have been piloting
an identity and "right to work" service with the Border
and Immigration Agency (BIA) which is currently being extended
to include UKvisas data. We are already investigating suspected
fraudulent UK passports uncovered through the pilot and introducing
new participants to the pilot.
— Last year the Chancellor of the Exchequer
appointed Sir James Crosby to chair the Public Private Forum on
Identity to review the current and emerging use of identity management
in the private and public sectors and to consider how public and
private sectors can work together, harnessing the best identity
technology to maximise efficiency and effectiveness. IPS is one
of the public sector organisations on the Forum along with DWP,
DVLA, HMRC , SOCA and the City of London police. The private sector
organisations are BA, Barclays, Boots, Compass, O2 and Linklaters.
Sir James will report to the Chancellor in the autumn.
— With the release of the PIN and OJEU
notice, we have formally begun procurement. The PIN (Prior Information
Notice) forewarned the market of planned procurement(s) related
to the Scheme. The OJEU (Official Journal of the European Union)
notice invites the supplier market to submit an expression of
interest in advance of a competitive dialogue process.
— Our approach to procurement is to
let a framework agreement with a small number of strategic suppliers
and the use of this approach has a number of benefits and efficiencies
over separate procurements. All of these selected suppliers will
be capable of competing for projects to deliver NIS capabilities
and there will be mechanisms to incentivise delivery and co-operation.
In pre-selecting suppliers a significant proportion of terms and
conditions will be agreed, which will allow projects to focus
on their unique needs rather than on issues that are common to
all requirements. Additionally the duration of the framework (four
years) will enable relationships to develop, allowing co-operation
between all parties to explore new and innovative ways to deliver
the NIS.
— A bidder's conference was held on
14 September. The purpose of this was to allow IPS to further
articulate the aims and practicalities of the NIS Strategic Supplier
Framework to ensure the market understands the process and has
opportunity to ask questions. Additionally the "Competitive
Dialogue" procurement process will include a series of meetings
and workshops with selected bidders to inform needs and ensure
market views are incorporated in our thinking.
— We have made progress with the secondary
legislation needed for the NIS. The Identity Cards Act 2006 sets
out the legislative framework for the introduction of identity
cards. The first secondary legislation under the Act, the Verification
of Information in Passport Applications etc (Specified Persons)
Order 2007 (Statutory Instrument 2007 No 2186 ) came into force
on 26 July 2007, after approval by both Houses of Parliament.
This Order was made under section 38 of the Identity Cards Act
which allows the Secretary of State to require government departments
to check their own records and to provide information to IPS which
could be used to verify the accuracy of details supplied in connection
with a passport application or to determine whether to withdraw
a passport. The order was needed so as to add to section 38 the
Registrar General for England and Wales and a credit reference
agency with which IPS has a contract for the provision of identity
information (currently Equifax plc). A further programme of secondary
legislation under the Identity Cards Act will be required prior
to the issue of the first ID cards to set out the detailed procedures
for the scheme.
4. Other progress is summarised in various
key documents published over the last year:
— The Strategic Action Plan for the
National Identity Scheme ("the Action Plan") which set
out the key design decisions which have been made and the high-level
objectives and plans for the Scheme, including biometric immigration
documents in 2008 and ID cards for British citizens in 2009.
— The Biometrics Assurance Group (BAG)
Annual Report. This independent group, under the chairmanship
of Sir David King, the Government's Chief Scientific Adviser,
has examined IPS's plans for the implementation and testing of
biometric technologies.
— Identity Cards Scheme Cost Report—May
2007. These reports are regular updates to Parliament on the costs
of the Scheme.
— The IPS Annual Report to March 2007.
RESEARCH AND
PILOTING
5. To support programme decisions and aid
in scheme design, IPS has continued to undertake research which
is periodically published on the IPS website. Research is an important
input to business decisions which have a customer impact and is
continuously undertaken to:
— Track public opinion and attitudes
towards the Scheme and the changes to passports.
— Aid definition of the requirements
for new products and services being developed for the Scheme.
— Track customer satisfaction to assess
how well IPS delivers its current customer facing business processes.
6. As part of the development of the Scheme,
services are being piloted with volunteers to confirm requirements
whilst other services are being introduced to discrete audiences.
IPS's programme of research has successfully helped to assess
customer acceptance. For example, the newly introduced interview
process for first time passport customers has been thoroughly
researched throughout all stages of services development, from
concept to launch. This work included people with special requirements
whose feedback has enabled us to make modifications to improve
the customer experience.
RESPONDING TO
THE COMMITTEE'S
RECOMMENDATIONS
7. The Committee requested an update on
10 of the recommendations made in their report (Numbers 9, 10,
15, 16, 19, 24, 26, 27, 31 and 40). In general, the Government's
response to the Committee's report was in agreement with the advice
in the Committee's recommendations and was able to respond positively.
This memorandum can now show where progress has been made since
then. In some cases the Government's response to the Committee's
report indicated agreement with the concern behind the recommendation,
but suggested a different approach to addressing this concern.
Recommendation 10 suggested certain actions to ensure the programme
received adequate ICT (Information and Communications Technology)
assurance. The response agreed with the need for ICT assurance
but proposed a different means of achieving it. Recommendation
24 was on the need to perform independent tests of the biometric
systems; the response agreed with the need to assure and improve
performance levels but that these should be done through contractual
means and through IPS's testing of the systems. Recommendation
31 proposed returning to and implementing the proposals of a specific
report from KPMG on the methodology used to estimate costs in
the Outline Business Case; the response addressed the proposals
which had not already been implemented, summarising what was being
done and the consideration which had been given to each proposal.
8. The recommendations from the Committee's
report are reproduced below, each followed by an update on work
in the area referred to by the recommendation.
ASSURANCE
9. We welcome the establishment of the Biometrics
Experts Group and the Biometrics Assurance Group, although we
regret the time that the Home Office has taken to set them up.
We support the involvement of Sir David King and believe that
the Assurance Group has the potential to work well, particularly
in providing consistent advice across Government. We seek confirmation
from the Home Office that the Biometrics Assurance Group will
be given the direction, tools and time to fulfil its tasks in
practice and that the Group's recommendations will be taken into
account. (Paragraph 53)
9. The work of the BAG during 2006 and the
recommendations it made are shown in the BAG Annual Report. Of
the twelve recommendations the BAG made, IPS have accepted nine
and rejected three. The recommendations were wide-ranging; Those
that were accepted covered the use of test data, the range of
fingerprint quality scores which should be included in testing,
ensuring fairness in biometric procurement, requiring suppliers
to show how they will avoid duplicate enrolments, proper management
of biometric risks, use of biometric terminology, and the formats
which should be used for the storage of biometrics. We rejected
recommendations on the period for which test data should be retained
(the BAG recommended a period longer than we were advised was
legally permissible), the suggestion that we should get an analysis
of "fusion" strategies from suppliers (IPS's preference
is to set output-based requirements on suppliers), and the suggestion
that we, rather than suppliers, should provide operators for the
biometric testing programme (IPS considers that suppliers have
less grounds to dispute test results if they supply the operators
and IPS officials oversee the tests).
10. The recommendations and the number of
them which have been adopted by IPS indicate a healthy assurance
function. Of more value than the recommendations themselves however
was the debate within the BAG and between IPS and BAG members
which preceded the recommendations and which forms part of the
BAG's regular examination of IPS's activities.
10. We recommend that the Identity and Passport
Service establish an ICT Assurance Committee consisting of academics
and industry experts and that this Committee reviews the programme
specifications relating to ICT. (Paragraph 55)
11. As indicated in the Government's response
to the Committee's report, IPS's goal is to simplify and consolidate
its external assurance and ensure that all areas in which assurance
might be required (such as ICT, as suggested in the Committee's
report) are covered. Therefore IPS is in the process of broadening
the remit of the Independent Assurance Panel and making it responsible
for assurance on all aspects of the programme. To underline this
wider role the panel will be renamed the Independent Scheme Assurance
Panel. Assurance on biometrics and ICT, and other areas which
fall outside the expertise of the core membership, will be provided
by inviting contributions from the BAG or members of the BAG and
other individuals and then forming a single view from these contributions.
The scope of the panel's interests will cover the entire Scheme
and will include biometrics and ICT. By combining assurance on
these topics with its other assurance activities, the panel will
seek to provide holistic, "task-focused" assurance and
a clearer interface through which assurance can be fed back into
the programme.
12. In addition, formal assurance of all
ICT infrastructure is also conducted by or on behalf of the National
Technical Authority (CESG ) as part of the accreditation process
both during design and prior to operation and throughout its life.
RELATIONSHIPS WITH
INDUSTRY
15. We recommend that, particularly as it enters
the procurement phase, the Home Office works to develop further
its relationships with industry. Industry is a significant source
of scientific and risk reduction advice as well as being a pool
of potential suppliers. We reiterate that the Home Office needs
to engage in wideranging debate with industrial experts regarding
scientific and technical aspects of the scheme. (Paragraph 70)
13. In August 2007 IPS published a contract
notice in the Official Journal of the European Union (OJEU) formally
launching procurement activity for the Scheme. This step has started
the sequence of events to contract with a number of suppliers
to deliver capabilities for the Scheme.
14. Since October 2006 we have been sharing
information on the Scheme with the potential supplier market and
receiving advice and feedback in return. For example, IPS's Chief
Executive and many of the IPS senior directors have spoken at
conferences and industry events. We recognise the value of such
activity and have received positive feedback from potential suppliers
on the scale and nature of engagement. We have benefited from
industry's broad experience in refining our plans and working
with suppliers has contributed to ensuring that the market is
prepared to meet the challenges. This exchange of information
has necessarily been constrained by the need to avoid prejudicing
fair and open procurement but has been valuable in informing our
approach to delivering the Scheme.
15. In November 2006 the IPS Chief Executive
spoke at an event organised by Intellect, the trade body for the
UK hi-tech industry . At this event the broad vision for how the
challenges of delivering the Scheme would be approached was set
out. Additionally the commitment to engage in dialogue with the
market was reiterated. Following this session IPS worked with
Intellect and its members to devise a series of workshops. These
were focused on specific areas of the Scheme to enable industry
to provide insights into the challenges and how they might be
solved, as well as IPS presenting some of the thinking behind
its plans. Details of the exercise and outputs can be found on
the IPS website.
16. After the six sessions (held in January
and February 2007), a final workshop was held on procurement in
February. At this, the adoption of a framework approach to procurement
with the aim of reducing risk and delivering value for money was
discussed. This discussion provided useful feedback and led to
publication of a "procurement briefing" document setting
out the approach in more detail. Further views and comments on
the strategy were invited in the publication and follow-up meetings
were held with a cross section of the market.
17. We continue to work with trade bodies
and suppliers and recognise the contribution that their broad
range of experience has to offer. This includes working with industry
now that the procurement has formally commenced to ensure that
we continue to understand the market and make best use of available
expertise.
18. Other important areas of collaboration
with industry and Government bodies include:
— IPS is working with the DIUS (Department
for Innovation, Universities and Skills) Innovation Platform,
which along with EPSRC (the Engineering and Physical Sciences
Research Council ) and ESRC (the Economic and Social Research
Council ) is providing £10 million of funding for research
into privacy and consent enabling processes and technology. Via
this Innovation Platform, IPS is engaging industry to promote
investment in the development of technologies that will be required
in the future.
— IPS is leading work on the development
of identity management standards including technical, data and
identity assurance standards. Members of the Government CTO Council
and the EURIM group are helping to inform the cross-Government
standards that will be used in the Scheme.
— IPS is working with other members
of the EU on developing proposals for a large scale pilot on "electronic
ID" targeted on improving service delivery for EU citizens.
COMMUNICATION AND
CROSS-GOVERNMENT
ACTIVITIES
16. We recommend that the Home Office undertakes
a cross-Government consultation regarding its plans for technology
to support the identity card scheme before the specifications
of the scheme are finalised and that it makes the findings of
this consultation public. (Paragraph 76)
19. The Government's response to the Committee's
report last summer acknowledged the need to be more public with
its plans for the Scheme and made the point that IPS was committed
to consultation and publishing an "action plan" which
would set out the vision for the Scheme and the plans for its
delivery.
20. This Action Plan was published in December.
It describes the scope of the Scheme, its principal functions
and how it will deliver services to customers. It covers the high-level
vision for creating the National Identity Register (NIR) using
some technology that already exists in government. It explains
how the Scheme will be made secure and how we will ensure that
information held by the Scheme is only seen or modified by those
authorised to do so. Finally, it sets out the plans for the Scheme
and its governance and how it will build up through the introduction
of biometric visas and other documents for foreign nationals,
enhancements to the passport, ID cards for British citizens, and
identity checking services based on these.
21. IPS and the Home Office are working
across Whitehall in a range of ways to develop this Action Plan
and promote good identity management harnessing the best technology:
— Sir David Normington, Permanent Secretary
of the Home Office, chairs the Identity Management Strategy Group
which has senior representatives from around 15 departments, including
the devolved administrations. As part of its Terms of Reference
it maintains an overview of the development of the Scheme. Recently
the group has invited local government to form an advisory panel
to support the identity management agenda.
— The Chief Information Officer's Council,
again with wide membership, has a complementary role, focused
on technology developments and implementing these and related
changes across government.
— IPS is working with other government
departments and agencies on a number of "joint venture"
initiatives involving customer experience trials and engagement
with potential business customers. These initiatives are tackling
current identity-related business challenges with the aim of building
confidence in and support for the Scheme, ensuring the requirements
for the Scheme are right and piloting identity-related services.
— Innovative research on using technology
to protect privacy is being explored in joint work with a number
of government departments, suppliers, and outside experts.
— James Hall who joined IPS as Chief
Executive in October 2006 leads within the Home Office on identity
management.
— IPS is working closely with stakeholders
to identify ways that existing Government assets can be used to
deliver the Scheme.
TESTING, TRIALLING
AND SELECTING
THE RIGHT
BIOMETRIC TECHNOLOGIES
19. We welcome the Home Office's commitment to
publicising fully its plans for trialling once the procurement
process has begun. In order to continue this move towards transparency
and to build public confidence in the scheme, we recommend that
the Home Office also makes public the results of these trials.
(Paragraph 83)
22. IPS policy on publishing reports based
on the results of trials has not changed since the publication
of the Government's response to the Committee's report. This noted
the recognition by the Committee of IPS's commitment to transparency
in this area and confirmed IPS's intention to publish reports
based on the results of future tests.
24. Given the findings of the biometrics enrolment
report regarding the performance of current biometric systems,
we seek reassurance from the Home Office that systems will be
adapted as necessary to improve performance levels and that final
performance levels will be verified by independent testing. (Paragraph
89)
26. We are surprised and concerned that the Home
Office has already chosen the biometrics that it intends to use
before finishing the process of gathering evidence. Given that
the Identity Cards Act does not specify the biometrics to be used,
we encourage the Home Office to be flexible about biometrics and
to act on evidence rather than preference. We seek assurance that
if there is no evidence that any particular biometric technology
will enhance the overall performance of the system it will not
be used. (Paragraph 93)
23. The Government's response to the Committee's
report indicated that the supplier would have a responsibility
to meet certain performance criteria, that the supplier's technology
would be tested and that these tests may be independently assured.
It also indicated that, while we were somewhat constrained in
our choices, we had some flexibility in which biometrics would
be used.
24. Since then, we have elaborated this
position. First, the Action Plan made it clear that the introduction
of iris biometrics remains possible:
When you enrol into the Scheme, your fingerprint
biometrics (all 10 fingerprints) will be recorded and stored in
the National Identity Register. A subset of these will be held
on your ID card or passport, in line with International Civil
Aviation Organization standards. The introduction of iris biometrics
also remains an option. (Paragraph 65)
25. The key point is that IPS will only
require those biometrics to be enrolled which are needed for legislative
or policy reasons, or to meet international standards for travel
documents—eg EU law will require fingerprints for visa applications
and for residence permits for third country nationals (ie non-EU
citizens). IPS will also require a certain level of matching performance—that
is, matching errors (where a biometric is either incorrectly matched
against one in the database or fails to match against one it should
have matched against in the database) will be recorded and suppliers
will be bound to not exceed a certain level of matching errors.
The supplier then has some flexibility in the design of the solution—having
done those things specified to meet IPS's obligations they would
be able to meet the business requirement (an identity management
system capable of the required level of matching performance)
in a variety of ways. The BAG Annual Report explained this and
set out the process by which the choice of biometric technologies
to be used by the Scheme will be made:
The reasons around the decision not to specifically
require the enrolment of iris at the launch of the Scheme were
discussed. IPS explained that the preference was to set as requirements
those things which are necessary to comply with legislation or
such things as the ICAO recommendations on the format of travel
documents, but leave other requirements as "output-based".
In the choice of biometrics, this implied setting facial and fingerprint
biometrics as requirements but allowing suppliers the choice of
whether to use iris biometrics to comply with the required matching
performance. (Section 3.1, bullet 7)
27. We note the lack of explicit commitment from
the Home Office to trialling the ICT solution and strongly recommend
that it take advice from the ICT Assurance Committee on trialling.
We seek an assurance that time pressure and political demands
will not make the Home Office forgo a trial period or change the
purpose of the scheme. (Paragraph 95)
26. IPS's position on the testing of ICT
remains as it was when the Government's response to the Committee's
report was published. IPS recognises that the delivery of ICT-enabled
services carries with it certain risks and seeks to manage these
risks through:
— formal testing as part of the accreditation
of all ICT including review by the pan-Government accreditor;
— adopting an approach to implementation
which uses an incremental rollout or uses controlled pilot programmes
to test specific parts of the Scheme; and
— testing systems through the life
of the Scheme, to a level appropriate to their associated risks.
27. It is within the Independent Scheme
Assurance Panel's remit to consider the need for ICT testing and
make recommendations on this.
28. On the Committee's point about the purposes
of the Scheme, these have not changed and cannot be changed without
the consent of parliament.
THE KPMG AUDIT
REPORT
31. We recommend that the identity cards programme
team returns to the KPMG audit report and implements its recommendations.
Furthermore, we re-emphasise that the Home Office needs to work
out how costs will impact on performance and we seek reassurance
from Government that cost limitations will not compromise the
level of performance that is accepted. (Paragraph 102)
29. The work underway to deliver the Scheme
is subject to a high level of scrutiny, including OGC Gateway
reviews, Treasury approval of the Business Case and the regular
publication to Parliament of reports detailing the Scheme's costs.
30. The KPMG audit report was thus one of
many examinations of the work to deliver the Scheme. The Government's
response to the Committee's report covered the recommendations
from the KPMG audit report and noted that of the 12 specific recommendations
made in the report only four had not been adopted.
31. Recommendations 3 and 4 proposed certain
approaches to risk management. IPS is committed to a robust risk
management methodology as an essential tool for project and programme
management. This is also consistent with IPS's position at the
time of the Committee's report, and as the Government's response
to the Committee's report noted, the Committee's chairman attended
a confidential briefing on the Identity Cards Programme risk register.
Following this, the Committee's report expressed that they felt
reassured by the programme's approach to risk management.
32. IPS has an established framework for
the reporting and monitoring of risk with a programme risk manager
and project-level risk managers in place and regular reports on
the status of risks to the IPS Management Board. IPS is continually
looking at ways to improve its ability to make informed, risk-based
decisions. For example, IPS will shortly begin piloting the use
of a new tool to support decision-making through risk modelling
and is currently improving its ability to model the financial
aspects of risk.
33. Recommendation 8 suggested that IPS
consider increasing the five-year depreciation assumption for
mobile enrolment centres to eight years. IPS regularly reviews
the accounting treatments used in its financial forecasts and
continues to consider a five year depreciation period for these
assets to be prudent. The cost impact of this assumption remains
minimal.
34. Recommendation 11 suggested a review
of staffing levels required for the National Identity Register.
We continue to keep the staffing levels under review as arrangements
for the delivery of the scheme mature. The most significant change
since the recommendation was made is the use of existing Government
assets (as summarised in the Action Plan) and so the situation
has changed since the recommendation was made. These plans make
staffing levels a shared concern between the Scheme and the owners
of these shared assets. Service Management arrangements for all
services relating to the NIR will be developed by the various
projects established to deliver the Scheme. Staffing levels will
form part of such Service Management arrangements. The procurement
exercise will provide further insight on the validity of the estimates
in the business case but in any case these staffing levels are
not a significant component of the overall cost.
COMMUNICATING PROCUREMENT
REQUIREMENTS
40. Industry is hoping that the commencement
of procurement and the release of specifications will clarify
the Home Office's position. Once the specifications have been
released, we urge the Home Office to take steps to ensure that
the specifications, requirements and risks have been clearly understood
by all involved. (Paragraph 126)
35. Considerable work has been focused on
developing the requirements for the Scheme since the time of the
Committee's report. Much effort has also been devoted to designing
the plan for procurement, the intention being that suppliers should
be able to join a framework within which the various parts of
the Scheme would be offered to suppliers to compete for.
36. The requirements can be divided into
high level Scheme-wide requirements and requirements specific
to the various projects established to deliver the parts of the
Scheme. The high level Scheme-wide requirements will be shared
with potential suppliers during the first, "framework dialogue"
phase of the procurement whilst the project specific ones will
be shared during the second stage. At both stages the requirements
will be discussed and negotiated with the bidders and there will
be opportunity for clarification.
September 2007
| 
