Graham Titterington
UK Government reports on changes to ID scheme
The National Identity Register (NIR) is to become a centre for integrating personal identity information held by the government, rather than a megalithic store. It will substantially re-use information in existing government databases. The arrangement is seen as a lower cost, and lower risk, alternative to the 'big bang' approach previously advocated. The government's estimate for the cost of the scheme is now £5.4 billion over 10 years, although this will be fiercely contested by critics of the scheme.Comment: The downgrading of the role of biometrics comes as somewhat of a surprise. There is no mention of iris recognition, apart from a brief sentence. Generally the report talks about 'biometrics such as finger prints'. It does still contain a commitment to recording all 10 finger prints in the NIR and an increased role for a PIN, when a citizen wants to assert their identity.
Overall the proposals represent a substantial retreat from the 'Gold standard of identity' originally proposed. Whilst, the government is still placing heavy reliance on the role of biometrics in preventing a person from making multiple registrations in the NIR, this objective seems unlikely to be achieved without the use of iris scans.
However, most people in the industry will regard the new proposals as a welcome step towards a more practical scheme, both in terms of its objectives and its deliverability. Gone is the 'big bang' project and in its place are numerous incremental steps towards a vision which will be refined as the scheme progresses. Procurement is planned to start in Q2 2007 with contracts in the biometric area. It is intended that biometrics will be recorded on visa applications before the end of 2007.
The report is somewhat cursory in dealing with how the management of the multiple databases and control of access will be integrated. It stresses the importance of protecting biometric data in the register, but these assurances look somewhat hollow in view of the already demonstrable weaknesses of the data protection on the new e-passports. This failing will become much more critical when finger prints are added and become the enabler of high value transactions.
The report does nothing to clarify the proposed use cases for the NIR or identity cards. It talks about providing a comprehensive 'identity management service', but does not mention charging at the point of use, nor does it mention the issue of the government accepting liability for false information. For this reason, we cannot determine system sizing estimates for the identity verification service gateway.
