Surveillance: Citizens and the State - Constitution Committee Contents


Memorandum by the London School of Economics and Political Science Identity Project

EXECUTIVE SUMMARY

  1.  This document presents an evaluation by the LSE Identity Project of key constitutional issues raised by the surveillance aspects of the Identity Cards Scheme, particularly as they relate to questions of effective Parliamentary scrutiny of proposals of this nature.

  2.  Its primary focus is on the idea of "enabling legislation" and "technology neutral" policy as illustrated by the Identity Cards Act.

  3.  As a result of recent events regarding the late production of the second s37 cost report and secrecy of the OGC Gateway reviews, we also present recommendations about these issues.

SUMMARY OF RECOMMENDATIONS

  4.  We recommend that the Constitution Committee look again at the role of "enabling legislation" for legislation with such a profound impact on the relationship between the individual and the State, as there is a strong argument for not leaving the detailed implementation of such Acts to secondary legislation and statutory instruments.

  5. We recommend that the Constitution Committee look again at the role of "technology neutral" legislation, in light of the experiences with the Identity Cards Scheme.

  6.  We recommend to the Constitution Committee that, when future legislation proposes mechanisms similar to the s37 cost reports for the Identity Cards Scheme, any such mechanisms include details of the Parliamentary scrutiny such reports should initiate and details of any penalties that can be applied, should the will of Parliament be ignored, for example by late delivery of such reports.

  7.  We recommend to the Constitution Committee consider the ways in which Parliamentary scrutiny of major schemes can be enhanced through the effective use of Freedom of Information Legislation.

ABOUT THE LSE IDENTITY PROJECT

  8.  The LSE Identity Project[17] provides ongoing research and analysis into the UK Government's proposals to introduce national biometric identity cards. The main Identity Project report[18] issued in June 2005 was over 300 pages long and identified six key areas of concern with the government's plans including their high-risk and likely high-cost, as well as technological and human rights concerns. The report received extensive, ongoing national and international media coverage, and was frequently cited during debates in both Houses of Parliament.

  9.  Since the publication of the main Report in June 2005, the LSE Identity Project has produced a number of further reports and cross-party briefings for key debates in Parliament and helped shape key amendments to the legislation, including issues of cost reporting and compulsion. Since the proposals became law in March 2006, the project has provided evidence for the Science and Technology Select Committee's review of the use of scientific evidence by the Scheme. Members have also analyzed information issued in autumn 2006 and spring 2007 about the ongoing costs of the Scheme as the government prepares for procurement.

  10.  Although initially focused on the UK proposals, the analysis presented by the Identity Project has also contributed to policy deliberations in related areas including the Federal Trade Commission policy process on identity management in the US, the Australian Access Card, and analyzing the policy landscape for identity policy in Canada.

  11.  Members of the LSE Identity Project have published and submitted a number of academic articles, including pieces in The Information Society, the European Conference on Information Systems and Communications of the ACM. Others are currently under review with other peer reviewed academic journals.

ENABLING LEGISLATION

  12.  Throughout the Parliamentary debate about the Identity Cards Act, Home Office Ministers emphasized the fact that the Bill was "enabling legislation" that would "allow" a system of identity cards to be introduced[19]. As a result, there is "much still to be done in terms of detail, regulations and all the other elements"[20].

  13.  As such, many of the details of the Scheme are not included in the Act, with these details being left to secondary legislation and statutory instruments.

  14.  The use of secondary legislation is not without its critics, as was acknowledged by the Home Office Minister Tony McNulty during the Bill's Committee Stages in the House of Commons: "I shall pass over what is in part a serious debate about constitutionality, secondary legislation and the `Christmas tree' nature of enabling legislation"[21].

  15.  The role of secondary legislation was raised during the Parliamentary debates. For example, Mr Robinson noted: "Secondary legislation would be most unsatisfactory for dealing with changes in such an important measure. It does not give the House the ability to amend; we would simply be asked to accept, on a take-it-or-leave-it basis, any package that the Home Secretary might introduce"[22].

  16.  Mr Heath noted: "I accept that the Standing Committee process is, in many ways, a good means of examining the detail of a Bill—line by line—but it is difficult for a Standing Committee to perform the same role in respect of this enabling Bill. The process is thus imperfect and does not allow hon. Members to consider matters in depth"[23].

  17.  Perhaps the most direct criticism was given by Mr Garnier: "It is legislation by statutory instrument"[24] and as Mr Carmichael noted "The Minister may say, as he did today, that there will be 61 other occasions on which we will revisit the matter, but that ignores the manner in which secondary legislation is dealt with in the House"[25].

  18.  We recommend that the Constitution Committee look again at the role of "enabling legislation" for legislation with such a profound impact on the relationship between the individual and the State, as there is a strong argument for not leaving the detailed implementation of the Act to secondary legislation and statutory instruments.

TECHNOLOGY NEUTRAL POLICY

  19.  Another argument for "enabling legislation" is that it allows for what might be called "technology neutral" policy. Rather than specifying in legislation what technological measures might need to be put in place, this form of legislation allows for these details to be added at a later stage, including during the procurement process. For example, the final Identity Cards Act simply states that an individual may be required to allow "his fingerprints, and other biometric information about himself, to be taken and recorded"[26] rather than specifying the specific technologies that will be used by the Scheme. By not specifying that these biometrics must include face or iris recognition biometrics the Identity and Passport Service was able to lower the risks and cost of the Scheme by dropping the use of Iris recognition in the revised Strategic Action Plan[27],[28].

  20.  In previous research[29] we have shown that attempts at technology neutral policy often face practical problems. Thus, issues associated with government access to email transactions change considerably when email is transmitted via the HTTP protocol (eg in web-based email systems like google mail and hotmail) rather than via the SMTP protocol (eg for "standalone" email systems). Similarly, very different data management approaches are needed to implement data retention policies for `always on' broadband services compared to dial-up connections.

  21.  The Identity Cards Act further confuses the distinction between technology neutral legislation and legislation with specific design implications in the role of the National Identity Register[30].

  22.  Thus, whilst the Act does not specify the form of biometrics to be stored by Government, it does specify that the Secretary of State "establish and maintain a register of individuals" that includes "information about occasions on which information recorded about him in the Register has been provided to any person" (ie the audit trail). It also specifies other audit details that are recorded on the Register including: the date of every application by him for a modification of the contents of his entry; the date of every application by him confirming the contents of his entry (with or without changes); particulars of every occasion on which information contained in the individual's entry has been provided to a person; particulars of every person to whom such information has been provided on such an occasion; other particulars, in relation to each such occasion, of the provision of the information.

  23.  As can be seen, this is a very detailed "design specification" for the Scheme and its operation. Whilst nominally technology neutral it actually implies a very particular way in which the Scheme would be used in practice. For example, it strongly suggests verification against the National Identity Register for confirming someone's identity (rather than, for example, verification against the card[31]).

  24.  We recommend that the Constitution Committee look again at the role of technology neutral legislation, in light of the experiences with the Identity Cards Scheme.

EFFECTIVE DELIBERATIONS ABOUT THE COST REPORTS

  25.  One of the key aspects of the Parliamentary deliberations about the Identity Cards Bill arose around the likely costs of the Scheme[32]. As a result of these deliberations, the Government accepted an Amendment from Mr Dobson calling for six monthly cost reports. We reviewed the reasons for the introduction of the s37 cost reports in our response to the first cost report[33].

  26.  Section 37 of the Identity Cards Act is very clear about the obligation to provide reports on costs to Parliament:

    37 Report to Parliament about likely costs of ID cards scheme:

    (1)  Before the end of the six months beginning with the day on which this Act is passed, the Secretary of State must prepare and lay before Parliament a report setting out his estimate of the public expenditure likely to be incurred on the ID cards scheme during the 10 years beginning with the laying of the report.

    (2)  Before the end of every six months beginning with the laying of a report under this section, the Secretary of State must prepare and lay before Parliament a further report setting out his estimate of the public expenditure likely to be incurred on the ID cards scheme during the 10 years beginning with the end of those six months.

    (3)  References in this section, in relation to any period of 10 years, to the public expenditure likely to be incurred on the ID cards scheme are references to the expenditure likely to be incurred over that period by the Secretary of State and designated documents authorities on:

        (a)  the establishment and maintenance of the Register;

        (b)  the issue, modification, renewal, replacement, re-issue and surrender of ID cards;

        (c)  the provision to persons by the Secretary of State of information recorded in individuals' en-tries in the Register.

    (4)  If it appears to the Secretary of State that it would be prejudicial to securing the best value from the use of public money to publish any matter by including it in his next report under this section, he may exclude that matter from that report.

  27.  The Act received Royal Assent on 31 March 2006. The first s37 report was issued by the Secretary of State on 9 October 2006 (the first day that the House sat, after the summer recess). Thus, according to the Act, the second cost report was required to be laid before Parliament no later than 9 April 2007 (six months after the first report was issued). The House rose for Easter recess on 29 March 2007 and returned on 16 April 2007. Thus, the report could have been issued before the House rose (on any date upto 29 March 2007) or shortly after the House returned (16 April 2007).

  28.  On 25 April 2007, the Junior Minister Joan Ryan gave a written answer about the costs of the Scheme, where she noted:

    Revised cost estimates have been published from time-to-time, for example, when the Identity Cards Bill was introduced to Parliament. During the passage of that legislation, the Government agreed to lay a report before Parliament every six months, which sets out the estimated cost of the National Identity Scheme for the coming 10 years.

    She answered a further question on costs on 30 April 2007, repeating the information that the total expenditure on the Scheme to the end of September 2006 was £58 million since the start of the 2003-04 financial year.

    On that same day, she also gave an oral answer in Parliament to a direct question about when the second cost report would be issued:

        Dr. Vincent Cable: Will the Under-Secretary explain why the ID card cost report, which was due to be published a month ago, did not appear, even though the Government have a legal obligation to ensure its publication?

        Joan Ryan: The costs will be presented, as we are committed to doing, in the cost report, which will be published shortly and in the Identity and Passport Service annual accounts for 2006-07. The hon. Gentleman can rest assured that the report will be before him soon.

  29.  The report was finally issued on 10 May 2007, the same day as Tony Blair announced his plans to step down as Prime Minister. Opposition parties and the press questioned the timing of the issuing of the report as an attempt to "bury bad news".

  According to The Independent:

    The Home Office said the delay was "not significant" and denied that the report had been postponed because of last week's council elections.

  According to The Scotsman:

    A Home Office spokeswoman denied the delay claims. "The announcement has been in the diary | it is no secret", she said. "We have not been able to publish it exactly six months after the last one because parliament has been in recess. A delay of just four weeks is not significant when it comes over a 10-year period."

  The Herald reported:

    Last night, the Home Office said 9 April, when the new ID costs were expected to be released, had fallen during Westminster's Easter holiday and the department had released the figures "as soon as we possibly could". The timing with Mr Blair's departure announcement was coincidental, a spokeswoman insisted.

  30.  In a later written answer, Joan Ryan said "I regret that the latest report on the estimated costs of the identity cards scheme was not published six months after publication of the first report as not all the contents could be finalized in time. However, it was published some four weeks after the due date, on 10 May 2007, by way of a written ministerial statement, and this short delay must be seen in the light of the 10 year period covered by the report".[34]

  31.  Two key issues thus arise from this experience: 1) Although the purpose of the s37 reports is to allow Parliament the opportunity "to stop" the Scheme if it is getting out of control, there is no formal mechanism for either House to review or debate the implications of the cost reports. It is not at all clear what action could be taken by Parliamentarians who were concerned about progress with the Scheme, as revealed by the cost reports. 2) There appears to be no mechanism for ensuring that the cost reports are delivered to Parliament on time.

  32.  We recommend to the Constitution Committee that, when future legislation proposes mechanisms similar to the s37 cost reports for the Identity Cards Scheme, any such mechanisms include details of the Parliamentary scrutiny such reports should initiate and details of any penalties that can be applied, should the will of Parliament be ignored, for example by late delivery of such reports.

SCRUTINY OF TECHNOLOGICAL ASPECTS OF THE SCHEME

  33.  Since 2000, a key activity for ensuring that the procurement of large government IT projects deliver value for money has been a process known as Gateway Reviews undertaken by the Office of Government Commerce (OGC). These independent reviews are intended to check that the plans for the project are sufficiently developed. In the case of the Identity Cards Scheme, the Government repeatedly asserted that the Scheme had passed its various Gateway Reviews but refused to disclose the contents of the reviews.

  34.  The Information Commissioner, who regulates the Freedom of Information Act (FOIA), disagreed with the Government and concluded that, especially in the case of such an important scheme, the Gateway Reviews should be made public[35]. Rather than accepting this decision, the government took the case to an Information Tribunal. In May 2007 the Tribunal concurred with the Commissioner and stated that the ID Card Scheme Gateway Reviews should be released[36]. However the OGC has since announced that it is seeking a High Court review of the decision[37].

  35.  There are also press reports that Treasury officials are ordering the immediate destruction of Gateway internal documents[38] so that they might never be revealed.

  36.  Effective scrutiny of major government proposals is a requirement for good government. This is particularly so for large scale, technological systems. As Appendix 1 shows, the complexity of the National Identity Cards Scheme is such that it is likely to require ongoing, specialist scrutiny. By challenging the decision of the Information Commissioner and the Information Tribunal it is apparent that government is unwilling to provide opportunities for such effective scrutiny to take place.

  37.  We recommend to the Constitution Committee consider the ways in which Parliamentary scrutiny of major schemes can be enhanced through the effective use of Freedom of Information Legislation.

12 June 2007

APPENDIX 1


  Taken from Feedback Presentation: Intellect Workshop: System & Programme Integration http://www.identitycards.gov.uk/downloads/2007-03-23Systems_and_Programme_Integration_Presentation_March2007.pdf


17   http://identityproject.lse.ac.uk Back

18   http://identityproject.lse.ac.uk/mainreport.pdf Back

19   eg Baroness Scotland, 19 December 2005 Column 1565 Back

20   Tony McNulty 28 June 2005 Column 1253 Back

21   7 July 2005 Column 88, emphasis added Back

22   28 June 2005 Column 1204 Back

23   18 October 2005 Column 717 Back

24   18 October 2005 Column 804 Back

25   18 October 2005 Column 805 Back

26   s5 5(a) Back

27   http://www.identitycards.gov.uk/downloads/Strategic_Action_Plan.pdf Back

28   More correctly, according to the Annual Report of the Biometrics Advisory Group "In the choice of biometrics, this implied setting facial and fingerprint biometrics as requirements but allowing suppliers the choice of whether to use iris biometric to comply with the required matching performance" http://www.identitycards.gov.uk/downloads/Biometric_Assurance_Group.pdf page 9 Back

29   Whitley Edgar A. and Ian Hosein (2005) Policy discourse and data retention: The technology politics of surveillance in the United Kingdom. Telecommunications Policy 29(11), 857-874. (ISSN 0308-5961) 
Hosein Ian, Prodromos Tsiavos and Edgar A. Whitley (2003) Regulating Architecture and Architectures of Regulation: Contributions from Information Systems. International Review of Computing Law and Technology 17(1), 85-97. (ISSN 1360-0869)
Hosein Ian and Edgar A. Whitley (2002) The regulation of electronic commerce: learning from the UK's RIP act. Journal of Strategic Information Systems 11(1), 31-58. (ISSN 0963-8687)
Back

30   We analyse the "surveillance by design" implications of the role of the NIR in our submission to the Home Affairs Committee inquiry into "A surveillance society?" http://identityproject.lse.ac.uk/LSE_HAC_Submission.pdf Back

31   The UKIPS website gives an example of how the Scheme might operate in daily life emphasizing the verification against the NIR http://www.identitycards.gov.uk/how-idcard-daily-collecting.asp. In this example, Colin is picking up a parcel from his local courier office. "She asks Colin to enter his Personal Identification Number (PIN). By handing over the card and entering his PIN, Colin is in effect giving his permission for the company to check that the card is genuine and belongs to him. No other information from Colin's details on the National Identity Register (NIR) will be passed on to the courier company. Within seconds there is a positive response. This confirms that the ID card is genuine and is not registered as lost or stolen. Colin can now take both his card and his parcel. The assistant will keep the delivery note and record that the parcel has been collected. The company's computer records will retain a `transaction reference number' from the identity verification service to show that the identity check took place". (Emphasis added). Interestingly, the Home Office design assumptions used by the DWP in October 2004 included an option for offline verification (ie against the Card rather than the NIR) http://www.dwp.gov.uk/pub_scheme/2007/apr/assumptions-040407.pdf Back

32   For more details on this, see Whitley Edgar A., Ian R. Hosein, Ian O. Angell and Simon Davies (2007) Reflections on the academic policy analysis process and the UK Identity Cards Scheme. The information society 23(1), 51-58. (ISSN 0197-2243) Back

33   http://identityproject.lse.ac.uk/s37response.pdf Back

34   Answer to question from Mr Hoban [136922] Back

35   http://www.ico.gov.uk/upload/documents/decisionnotices/2006/decision_notice_FS50070196.pdf Back

36   http://www.informationtribunal.gov.uk/Files/ourDecisions/office_of_govern_commerce_v_infocomm%20_2May07.pdf Back

37   http://www.ft.com/cms/s/a633c624-0e4a-11dc-8219-000b5df10621.html Back

38   http://www.computerweekly.com/Home/..%5C/Articles/2007/06/01/224487/civil-servants-told-to-destroy-reports-on-risky-it-projects.htm Back


 
previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2009