Select Committee on Home Affairs Minutes of Evidence


Examination of Witnesses (Questions 220 - 235)

TUESDAY 12 JUNE 2007

PROFESSOR ROSS ANDERSON, MR PETE BRAMHALL AND DR ANDY PHIPPEN

  Q220  Chairman: I am as keen on ID cards as Mr Winnick is opposed to them. I am quite prepared to go round persuading people that they should have ID cards to protect themselves from impersonation rather than identity fraud. A lot seems to be hung on this issue of language but I cannot quite see that if we went back to the old language of talking about impersonation rather than identity fraud it would make a blind bit of difference to any of the issues that we are talking about today. It seems to me to be a semantic argument but you clearly think that somehow by talking about identity fraud either government policies would be different, or bank policies would be different or something. I do not really quite understand.

  Professor Anderson: The fundamental issue is an issue of liability. If a bad person whom I have never met goes to a bank with whom I have never done business, how should that be able to ruin my life by causing the debt collectors to call on me and causing all sorts of other derogatory stuff to be propagated about me through the system? It is clearly bad that such things happen. How do you go about stopping it? I suggested in our written submission one practical way of stopping it, namely that the Information Commissioner should enforce the existing law against the credit reference agencies. In the absence of that, what other policy options are available? One can debate this at a number of level. At the legal level, one could talk about various possible private remedies but, at the political level, surely politicians should set the tone for the debate, shaping the debate and deciding what sort of language is used. My point is that the language about identity theft is not helpful from the point of view of consumer rights and security economics.

  Q221  Mr Streeter: Focusing on regulation, we mentioned this point earlier about the importance of individual responsibility as consumers and education to make people aware of risks. In terms of protecting privacy, apart from individual responsibility, apart from technological advances in terms of security, can we focus for a few minutes on what could a government do to regulate this incredible market place to protect people's privacy more? If you were advising the UK government, each of the three of you, what is the one thing that they should do which they are not doing? What is the thing that the government should do in terms of regulation?

  Professor Anderson: The one thing I would do had I the legislators' power for a day would be to change the UK rules on legal costs to the American rules. In America, constitutional matters, which in this context would mean section eight of the European Convention on Human Rights, can feasibly be enforced by individuals. A young law lecturer wishing to win his spurs and become a professor can go to the Supreme Court and litigate. He does not have to face the prospect of paying $10 million in costs to the government if he loses. That right of private action is not present in Britain because of our rules on costs. That means that there is an assumption that all these actions have to be state actions. As a practical matter, we have an embedded Information Commissioner's Office which was designed back in 1981 to be ineffective. David Waddington, the then Home Secretary, at the time was quite open about the fact that it was a minimal implementation to keep us legal with Europe. Although the ICO has expanded his gamut somewhat since then, it still remains a very weak body. Are we to wait 50 years for successive ICOs to build up their clout within Whitehall so we can enforce constitutional law? If you want constitutional enforcement to be available to citizens, you have to make private action available as well as public action. That is why I would say let us move to the rules that they have in America or, if that is unacceptable to judges, let us move at least to the rules that they have in Germany where there is very much stricter limitation on taxation on the scale of the costs you have to pay if you lose.

  Q222  Mr Streeter: That is a surprising answer but it is slightly outside the box of my question, is it not? It is a brilliant answer and, as a lawyer, I am all in favour of it but surely the government can do something top down as well at the same time as changing the rules on the costs of litigation?

  Professor Anderson: The government could do something top down if, for example, the kind of law and practice that one sees in France and Germany on privacy were imposed on government departments, but again you come down to the question of the individual departments and their incentives and how power works in this town or indeed in any town. One suggestion that we made to the Information Commissioner's office was that he should see to it that the data protection officers in various government departments report to him rather than the departmental Parliament secretary, along the lines of CESG cryptosecurity officers reporting to Cheltenham rather than locally. That way, the data protection officer would see his job as enforcing the rules within the department rather than seeing to it that the department has an easy ride with the Information Commissioner. These are all very difficult things to do because they are not the sort of things that you can do easily by means of a simple statute law. How you go about changing a culture of half a million people that has been 800 years in the building is hard.

  Dr Phippen: The witness on my left might disagree with this but I think one of the big issues is tougher regulation of the IT suppliers and providers themselves. I spend quite a lot of time trouble shooting between small businesses and it seems to be web development companies in particular who will behave incredibly unethically in terms of what they are going to charge people for. It is a classic case. If you offer an IT supplier half a billion pounds, of course they are going to say, "Yes, we can do it." Why would they not? They will think about the technologies afterwards. At the moment you are looking at the IT "profession". You have a long way to come to achieve the levels of professionalism that exist in other professional practices such as law, accountancy and the medical profession. I think it is getting better. The fact is that the British Computer Society is talking with the government more now. There is a growing code of conduct there but it could possibly do more to make suppliers more responsible for what they are promising. I had a colleague who used to describe IT departments as having all of the power and none of the responsibility because they say, "You signed the spec. That is what you asked for." That kind of thing is changing a bit but it still has a long way to go if you are getting true professional liability within IT professionals.

  Q223  Mr Streeter: It is all your fault. Do you want to apologise?

  Mr Bramhall: I am just thinking about the phrase I used earlier about not tarring everybody with the same brush and how perhaps it might apply. There are two points, one regarding professionalism which I know is not your question but, yes, increased professionalism has to be good. There is in the information security space a new Institute of Information Security Professionals, for example, which is just coming into being and will hopefully have an impact on—I hesitate to use the word "standards" because I do not mean it in the regulatory sense—raising standards of quality in that space. In terms of the specific question you asked about regulation, I must admit I am coming at it as a technology research manager and I do not really feel confident to comment on that side of it, certainly not to the level of detail that Professor Anderson has done. Similarly, we have not conducted any research into the effectiveness of the ICO's power and therefore we should remain silent on that point as well. In general HP does support any actions which the Information Commissioner takes which will increase the general level of confidence that people have about participating online.

  Q224  Mr Streeter: I cannot get my mind around the difference between UK regulation and global regulation. So much of this obviously is accessible globally through the worldwide web. Professor Anderson, you have mentioned other European countries which make a better fist of regulation than we do. To what extent is this industry capable of regulation nationally as opposed to internationally? Is there some more regulatory action that should be taken internationally and globally?

  Professor Anderson: There are two different issues there. You get better regulation of privacy in France and Germany because you have different constitutional settlements that essentially predate automation, or largely so, or at least go back to the sixties or seventies. In Germany you have privacy written into the Constitution for reasons that are not particularly surprising. In France more recently there has been a dispensation that CNIL, which is their equivalent of the Information Commissioner's Office, is consulted by government departments while they are proposing new system developments and has a veto or something that in practice amounts to a near veto. The second issue which Andy raised is why is the government so awful at developing computer systems. It is generally reckoned that 30% of large IT systems in the private sector fail and 70% of large IT systems in the public sector fail. That was an admission by the Department of Work and Pensions CIO at a conference last month. We have all known this for a while. Why does it happen? FIPR has talked extensively on the subject. My FIPR colleague, Jim Norton, put together a programme and tried to get our ideas across to permanent secretaries. The gist of the FIPR take on this is that there should never be another government IT project; there should simply be business change projects. Ministers should cease seeing the purchase of a large IT system as a displacement activity, as something that will kick a difficult problem into touch, for the next government to worry about. Instead we should have a discipline that if somebody wishes to change the way their department does business, they should specify that and engineer it properly. If IT is part of the solution, then fine. We have been unable so far to sell this idea to Whitehall. I am sure its time will come sooner or later. From the point of view of privacy, some people might take the view that perhaps it is a good thing that 70% of large government IT projects fail.

  Q225  Ms Buck: We have covered quite a lot of the questions that I was asked because we have been dipping in and out on a lot of questions about trust, risk assessment and things of that kind. Can I go back to something Professor Anderson said earlier about what it might take to change public consciousness? You used that very vivid language of a few dramatic stories on the front pages of the red-tops. You were teasing us a little bit with some thoughts about where that might come from and what it might mean. Can I ask about the research on trust and break it down into categories? What we have tended to do in the last couple of hours is weave in and out of different groups of people and what they mean by trust. There are very different issues—and perhaps you will give us an idea about this kind of risk analysis in greater detail—between children and what children understand and what parents understand about children and risk; about young people and what young people think about risk and about the long term implications of their behaviour, knowing as we do that young people tend not to think long term; and also about adults and their levels of risk and what it might take, perhaps in those different categories to be the shock that requires people as individuals and people in relation to government and the private sector to get some changes.

  Professor Anderson: The relevant research here is perhaps that of George Loewenstein at Carnegie Mellon University, who is a behavioural scientist and looks for example at the extent to which people overestimate the happiness that they would get from a good event in their lives or underestimate the sadness that would result from a bad event. He looks for example at how happy people are who are paraplegics or who have had an arm or a leg amputated after cancer, and finds that, although most people think that having an arm cut off would be the end of the world, in practice within two or three months people adjust just fine. They report that they are just as happy as they were before. The lesson that he draws from this is that the public's sensitivity to risk basically relates not to the absolute level of risk but to the change in the perceived level of risk. In other words, if a level of risk or threat increases very, very slowly, you will get occasional grumbles from the public, but you will not get a great outburst. He refers to this as the `boiled frog syndrome' after this apochryphal idea that if you put a frog in cold water and boil it it will not jump out. His concern about this is in the context of global warming, that if planetary temperature continues to rise by a per cent every few decades without a dramatic shock the public will never get sufficiently agitated to demand that politicians do something. It strikes me that exactly the same argument applies to trust and to privacy, in that if privacy is slowly eroded then people will get used to it. We might end up in a society that is rather different from our society today and some of us old fossils might, in our bath chairs in our eighties, be grumbling very noisily about what has happened to the world, but there will not be a great outburst. If you get a series of shocks all at once, then that may change and public concern may suddenly spike and create the window of opportunity for regulation. This of course can cut both ways. It may very well be that the large number of privacy-invasive systems that government has built or talked about building over the past two or three years will together give that spike. Maybe ID cards plus kids' databases plus NHS databases plus ANPR plus and so on finally will hit critical mass and the public will go ballistic. We do not know. This behavioural research would strongly suggest that that is what politicians should watch out for.

  Dr Phippen: Our work with young people would suggest that they do not really take any risk analysis when going online. They just go online.

  Q226  Ms Buck: We can all vouch for that, with kids.

  Dr Phippen: With 100-odd kids we spoke to, we had probably three clear cases of stalking going on and not one of them reported it to the police or went any further than, "I just blocked them from my MSN". "Why did you not report it?" "I did not know how to." "Did you think there was anything dangerous there?" "No, I just thought it was some weird kid and ignored them." The work that CEOP are doing at the moment is making great strides forward in that they are getting into schools. One thing the kids are all saying is, "We do not really cover this in school." When you have a look at the IT and the computing curricula for both GCSE and A level it is not covered at all and they say, "We might touch on it in citizenship", but again it is not covered a great deal. We are hopefully going to be doing some work with CEOP in the near future, looking at kids' responses to that. That is something that definitely needs doing. You have essentially a captive audience with children. You can go into the schools and talk to them. Initially they might say that it is a load of nonsense or whatever but it gets through to them and they do think about it. With adults, it is more interesting in that they start off looking at how you can get people to trust systems. What we realised very quickly was that trust is not really an issue. The issue is convenience and restitution. What people will do is look at the service on offer and think: what is in it for me? What could go wrong? Has anyone else used the site before? If it is fairly positive, then they will probably go for it. When you talk to them about why they go online, they say something different. We spoke an awful lot to people about what makes them use a website and an awful lot of people said that you need human contact at the end of it. It is not just the website. When you say, "What is your most trusted brand on line?" Amazon continually came up as the most trusted brand. You never deal with a human on Amazon. "Yes, but I have a mate; something went wrong and they rectified it very quickly." That is the thing Amazon do very well. They do not say, "This will never go wrong" but when things do go wrong they rectify them. They do not try to hide from them.

  Q227  Ms Buck: You make an important point in your report about restitution but how can we learn that lesson from Amazon and expect, either within the private sector or in terms of government's duty in relation to the private sector, to be able to apply that restitution?

  Dr Phippen: I feel a little sorry for public sector IT in that you do not have the commercial incentive there that you generally have with the private sector. The first thing to look into is the convenience, which is why the closed systems like DVLA and school registrations work. It needs to be a case of: what is in it for me? What am I going to get out of that? It does not have to be financial; it could be time saving or saving them having to go to local authorities and deal with something like that. I think it is a little more difficult in the public sector because there are immediate convenience measures that you can take. I do not think security is a massive issue in either the public or the private sector. I always think back to education but I think it is the major point. The big concern is people believe that, if they buy something on their credit card and something goes wrong, it is the credit card company's problem, not theirs. Obviously credit card companies are back pedalling from this a great deal at the moment. They do not realise the long term damage in terms of credit referencing and those sorts of issues where, even though they might have had it rectified and they got their £500 back, they might not have gone down the chain and it could ultimately end up with them having a poor credit rating as a result of something. They are not aware of these issues.

  Q228  Ms Buck: None of this would lead you to conclude that there is a public readiness in any of those categories to invest time or money in a personal solution? I am not saying that one exists but, were there to be a technological fix on offer or some steps that they could take which would involve some effort and some expense to protect themselves against some of those risks, there is not the public awareness yet to support that?

  Dr Phippen: I do not think so. Tom Illube was behind Egg and is now in charge of Garlik. He spoke to the parliamentary IT committee a while ago. He said that when he was at Egg they did a lot market research for their customers so security is important so they introduced another factor to their authentication process and people stopped using it because it was too inconvenient. They cannot remember all that. I mentioned multiple identities. Most people have multiple identities all with the same password because, no matter what security experts say, you cannot possibly remember 30 or 40 alpha numeric, random strings. I do not ever think there is going to be a silver bullet technology that sells all this because there should not be IT problems or technology problems. There should be process problems which perhaps IT will address. I think the public are aware of that as well. They do not go online because everyone is telling them to. They go on line because it is of benefit to them.

  Q229  Ms Buck: To paraphrase, we should raise the school leaving age to 25 in order to be able to accommodate a massive public education programme on this.

  Dr Phippen: The biggest problem is the people who have already left school, between the ages of 18 and 60. In those cases, the media have a very strong role to play because all these people tell me, "You should not go online because how do you know that? I read about it in the paper or I saw it on the television." The media obviously are going to be far happier reporting on identity theft or government IT projects going wrong than, "Here is another successful use of IT in society." That is not sexy. That is not interesting. The media have a great responsibility to play in education.

  Q230  Ms Buck: Does that make you feel optimistic?

  Dr Phippen: No.

  Q231  Gwyn Prosser: I have gained the impression from all three witnesses to different degrees that the public are very relaxed about these issues, whether it is CCTV cameras or going online or sharing their personal details. It is mostly certain classes and the media that are making a noise about big brother. You have given us the warning that as these layers of potential intrusion build up we should take a wake up call because it might suddenly come back with a public reaction an a resistance from the public. Is it not a fact that using CCTV, which is perhaps separate from your line of expertise, when it was first introduced in this country, created concern but over the years, as it has increased in areas of surveillance and as these other layers have come on with regard to the internet et cetera, people have become more relaxed about it and in some cases, especially camera surveillance, are demanding of politicians to have more in their patch?

  Professor Anderson: The most telling criticism of CCTV is that the money could be better spent on other things. When we did the Information Commissioner's report on the children's databases, we looked at various crime reduction initiatives with a multidisciplinary team. In 1997 the government started off with some very admirable and well-researched initiatives including Communities that Care, an initiative whereby people would be got together in tough neighbourhoods—stakeholders, policemen, ministers, councillors, whatever—and would be consulted about what the best crime reduction measures would be for that neighbourhood. The Home Office no doubt would have a budget to spend on these. Similar programmes have been effective in the USA. However, what appears to have happened—there is a reference in our written submission—is that this was subjected to lobbying by the CCTV industry and instead one had programmes to the effect that, "We will give you money for an initiative provided it involves CCTV." This appears to have been one of the reasons why the `Communities that Care' initiative was not as successful as might reasonably have been expected. Yes, there may be some placebo effect from having large numbers of closed circuit television cameras around, but the analysis of the crime statistics which we cite tends to show that although they are good at reducing crime in car parks they are not so good at reducing crime in town centres and there is a very serious question about whether far too much money has been spent on these and not enough money on other crime reduction initiatives.

  Q232  Gwyn Prosser: To what extent do you think the increase in the sophistication of technology to enable the state and private enterprises to scrutinise people's personal information and have access to it will, on that side of the equation, compete with the increasing potential for individuals and companies to protect themselves from that surveillance? Where are we at the moment and how do you see that tension developing?

  Professor Anderson: One of the big tensions that we see developing is that of equality of arms and the balance between private and public action. At present it is very easy for the police to get hold of CCTV data or ANPR data to prove that you did something bad, but it is a lot more difficult for you to get hold of it to prove that you did not, to establish an alibi. When we move into the realm of civil cases, for example disputes between customers and banks, the same issues arise. The banks can get CCTV data but you cannot. There are also issues about, for example, how you go about tracking people. The Information Commissioner a couple of sessions ago remarked that there had been a website which enabled people to track individuals in the UK from electoral roll data. This provoked an outcry from people who had perfectly good reasons not to want to be tracked. It was accordingly shut down by the Commissioner. Yet again, many new pieces of surveillance have to do with people trying to track other people. What sort of mechanisms should be available for someone who has a bona fide reason to want to track down another person? We suggested in our written submission that if there was some means whereby, for example, a wife who was seeking alimony from an absconded husband, and had got fed up with the delays involved in the government mechanisms for doing that, should be able to go to a court and get an appropriate order to get information from relevant databases to find where hubby is living and where he is working so that she can go to the court and get an attachment order against his wages. Again, these all have to do with the fact that surveillance centralises power. Whether it centralises power in the hands of the state or in the hands of large corporations, it raises all sorts of issues: equality of arms, public versus private action, but I think that successive governments over the next few years are going to have no choice but to think about it.

  Mr Bramhall: Right at the beginning of your previous question, I think you said that people are very relaxed about participation and so on. The TrustGuide work showed that that was not the case, and that there was a general unease. It was not a specific unease, but there was a general unease and a wish to move forward.

  Q233  Gwyn Prosser: But not sufficient to discourage them from using that access?

  Mr Bramhall: No. And again different people took different views on that. TrustGuide was not meant to be a large, statistical sample. It was more qualitative but within the collection of people who participated there were some who felt quite comfortable, some who did not and some who never have but probably would not because of something they have read about. I do not think we can say that people are very relaxed. They are generally uneasy but, you are right. It does not inhibit them.

  Q234  Gwyn Prosser: Professor Anderson, you give us the prediction or caution that we will need a number of headline stories in the tabloids about the hard cases before we perhaps wake up to some of the concerns. If you were to look 20 years hence and take into account that these various changes in public perception of policy can take place, would you expect that the private sector and government would have overall more knowledge about us as individuals or less?

  Professor Anderson: They will have more knowledge but it will be much better regulated. We have seen the beginning of the push back, for example, on Google, with Google now agreeing to de-identify personal data after two years. This is remarkably quick. The issue was raised first at a conference in France in February[6] and now it is already actioned. It is high on the European agenda, so these things move up the political agenda as more people become aware of them. The hearings that we are having are, I believe, driven by the fact that there is general raising of public awareness, bringing surveillance onto the agenda. One cannot stop the collection and processing of data becoming cheaper because technology advances, but as it affects more people and perhaps also more interests within society, more organised interest, you are going to get a push back because, after all, what tends to stop one large, powerful lobbying force is not people speaking fine words and arguing from principle but the opposition of other large, powerful lobbying forces. Just as the whole intellectual property debate came into balance when the music industry started being faced down by the supermarkets et cetera, so I would expect that in due course, in the private sector, the action of the Googles, the Microsofts, the Yahoos and other big players will evoke enough lobbying response from those businesses that are losing out.

  Q235  Gwyn Prosser: More information and better regulated?

  Professor Anderson: More information and better regulated.

  Dr Phippen: I would certainly agree more information and hopefully better regulated in the next 20 odd years.

  Mr Bramhall: I agree that more information will be known. I agree also that it will be better governed or the governance will be better. Some of that might come from better regulation for the reasons mentioned. I suspect that will be rather patchy. I think it would be true in the UK and Europe. I am not sure we can take that as a global statement. Where regulation is not the motivation for the improvement, also there will be some motivation from individual private sector enterprises wishing to differentiate themselves again by being seen to do a good job and being more trustworthy. That is less determined by whether they're UK, Europe or the rest of the world.

  Chairman: Thank you very much indeed. It has been a very useful session.






6   Note by witness: Sorry, January-Economics of the Software Industries, Toulouse, Jan 18-19; the relevant discussion was on Jan 19th. Back


 
previous page contents

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 8 June 2008