ec2-18-216-190-167.us-east-2.compute.amazonaws.com | ToothyWiki | RecentChanges | Login | Webcomic Small, rectangular pieces of plastic or cardboard containing a person's basest instincts, drives and desires.
Obviously.
Also, a scheme the UK Government is proposing. For general discussion of the assorted related issues, MoonShadow recommends reading the [ukcrypto archives] - a lot of people who feel a lot stronger about the issue than I do have written far more coherent arguments than I ever could, both for and against the subject.
Some Toothywikizens may be interested in signing an [online petition] against ID cards. Not just "yet another petition": note the .gov.uk in that URL. The government has [responded to the petition] in an email sent to the petitioners. The email can basically be summarised as something like "You say ID cards won't do much to reduce crime or terrorism, and are expensive for what they do; but we're sticking to our line of 'they'll do quite a lot', and look! other countries are going for them too! - and as for cost, you're all gonna need to shell out for biometric passports soon anyway and £30 on top of that isn't very much to protect the liberties of the law-abiding."
I signed the petition and I didn't get one of those emails... --Rachael
That's interesting. I wonder if that implies your signature wasn't counted? - MoonShadow
Now I've received the email. Perhaps they sent them in batches. --Rachael
EU directive 39436175880932-B now requires that for your vote to be counted you must have a national ID card. --RobHu
The petition and it's subsequent rejection have now [made /.] I am a bit confused. Did Tony Blair close the petition early? (I really hope not) --RobHu
I would personally summarise the government's email in a much shorter manner: "No." In fact, I signed a few petitions, and have had several responses so far, all of which can be summarised as "No." It obviously makes me feel that there is absolutely no point in the petition system. --Admiral
Playing DevilsAdvocate: I don't think there's anything wrong per se with the government saying No to a petition. Otherwise, what would they do when faced with a petition to do X and a petition not to do X? --Rachael
Well, in theory, do whichever got more support. (Biasing for length of voting period and how much each got advertised, I guess...) --Vitenka
Obviously. But they seem to reject every single one. Let me see, what have I had?
Cycle lanes along major roads should not have to give way to traffic on minor roads. Government response: [No.]
Halt the erosion of civil rights. Government response: [What erosion?]
Professor Ross Anderson did give evidence (by email).
On readers We believe there is a danger that in many day-to-day situations the presentation alone of an identity card will be assumed to prove the identity of the holder without the card itself or the biometrics being checked, thus making possession of a stolen or forged identity card an easier way to carry out identity fraud than is currently the case. The availability of readers of cards and biometrics, including to the private sector, is therefore a crucial factor. (Paragraph 99)
on universality In a similar way, identity cards are not planned to be a single card for all public services, but it clearly is possible, and perhaps desirable, for a successful identity card scheme to develop in this direction. But this should be a decision of Parliament, not of the executive. (Paragraph 159)
Target applications have a tendency to drift even when Government actively doesn't want them to and everyone can see it's a really bad idea; consider the use of US Social Security numbers for authentication. - MoonShadow
We do not think that there should be a central database with all information available to the Government on it. But an identity card should enable access to all Government databases, so that there would be no need for more than one government-issued card. (Paragraph 188)
on security 204. We were told in Germany that the German identity cards were very secure. Witnesses from card manufacturers, such as Richard Haddock of LaserCard?, were confident about the technological security of their products, while stressing the importance of proper security and audit procedures in the production of cards. Industry representatives also argued that the security of the system and of the database could be managed in such a way as to make the risk of fraud “minuscule”.164
When is a supplier not confident of the security of their own products? Will scour report for hard figures later. - MoonShadow
205. Other witnesses, such as the representatives of the UK Computing Research Committee and the Foundation for Information Policy Research, argued that even if the card or the database were effectively secure against attack (which they thought improbable), those seeking to create false identities would simply try to subvert the enrolment and issuing process, for example at a British Consulate abroad.165
206. It is obvious that no system or card will be entirely infallible. It is also clear that the enrolment process, if not put in place with security in mind, may provide the easiest way of subverting the system. But if the card and the system are set up properly, any successful attack on them would have to be determined and technically sophisticated. Professor Anderson of the Foundation for Information Policy Research argued that “the main determinant of levels of fraud is not the card technology that you use but how diligent you are at checking online whether a transaction is valid or not”.166 This suggests that systematic use of card readers by service providers would also be a deterrent to fraud.
use of card readers != online :(
207. We believe that an identity card system could be created to a sufficient level of security. We stress, however, that the security of the system depends as much on using the proper procedures with the appropriate level of scrutiny to verify the card in use as it does on the integrity of the card issuing process or the identity register.
July 9th 2006: [Government officials privately think the scheme is doomed]. Reasons cited in the [leaked Whitehall emails] include worries about the government's history on IT projects, the costs of the different pasts of the scheme, and that ministers seemed to have been ignoring reality, and describe the scheme as "driven by an arbitrary end date rather than reality".
(SK): I said there was no point in getting het up and trying to stop this: the government will screw it up all on their own. If only I could believe that this 'rethinking' might end up pulling the plug before too much of our money goes down the drain, or settling for some cheaper varient, but I suspect it will just result in more being spent as they try to fill up the gap between fantasy and reality with a combination of cash and sheer pig-headedness.
(PeterTaylor) I read that article and was immediately reminded of an [opinion piece] from the previous day.
Articles/rants on other sites
Interesting article [here] on why they will not work to reduce ID fraud. --Tsunami
The [Register] has an in-depth look at UK ID card proposals.
To save myself some reading, is that the same as the one they offered up on the initial consultation (the one when they got the results they flip-flopped from 'overwhelming support' to 'oh, we didn't count those opinions') ?
No, it's a more recent one, including draft legislation.
Humm. That doesn't appear to contain any new information, which is a shame. I'm more entertained by his key escrow locks. Personally I primarily lock my suitcase in order to stop it falling open because the zips are crap. Do US airports really stick their hands into bags? Don't they get a heck of a lot of thefts that way? --Vitenka
www.NothingToHideNothingToFear?.co.uk - a spoof site.
And of course, it's worth having a link to [No2ID], the group who're campaigning against ID cards, the National Identity Register and the database state.
Whilst renewing my passport I happened to be diverted by this helpful propoganda on the [Home Office Identity and Passport Service] website. Particularly the [case studies] about how ID cards would improve daily life. I read the case study 'collecting a parcel' to M-A and quickly fell into the [storybook style] beloved of TerryWogan. It was so facile. I was particularly aghast at the suggestion that we should have to electronically register our presence with a card reader and PIN at the sorting office collecting a parcel. Why do [they] need to know that?
Please feel free to move this if it fits better in another section on this page. --Nat
Risks of misuse of the data
The subject has once more resurfaced on UKCrypto. [This] post contains yet another argument MoonShadow hadn't thought of..
If the police really are that corrupt, then we have much bigger problems. It's not as if they even need a 'database' of everyone's fingerprints to plant mine at a crime scene; a quick dusting of the handle of my front door while I'm at work will do. For DNA they need only break in and find some dead skin or something. If they want to prove I went through a scanner they can just forge the logs of who passed through to put my name in, request a scan for confirmation, and then insert the print. If the police are corrupt then you damn well tackle the corruption. Worying that a database will be used to frame people if the police are corrupt is like worrying about living next to a river when there's a tsunami on the way.
It makes it easier. Much MUCH easier. And forget the conspiracy theory for a moment - what happens when (as inevitably it will) the central storage database is hacked into? Perhaps they'll leave a laptop lying around with those details, or perhaps they will leave a little USB dongle with the patients private details, or maybe a disgruntled employee will email the login password to the Sun. Ignoring the inevitable security flaws. Then anyone can steal those exposed identities. And whereas today, if someone steals my NI number, it is easy (well, bureaucratically hard, but in theory easy) for them to make that number invalid, reauthorise me and give me a new number - like resetting any compromised password - it's pretty hard to reset my iris. --Vitenka
Maybe a silly question but how would they steal your iris? It would be easier to steal your face. --Edith
True, but hardly relevant - it's not your iris that's being checked, it's the biometric data on the card - which, while it was generated from your iris, is *not* the same thing as your iris, and is rather more stealable. Biometric data generation is inherently a many-to-one function, implying that given the biometric data one could look for - and possibly even deliberately construct - collisions. Reliability is currently poor enough that this is not unreasonably difficult (see links in my comment a few paragraphs lower). Once someone does find a collision with your iris, you are stuck with the double since you cannot change your iris. - MoonShadow
On a doom-mongering note, Russia has a system whereby the police have powers to demand your ID at any time. Movement over Russia is not automatically free; the place where you are currently "[propisan]" - registered as inhabiting - is noted in your passport, and the police can stop you in the street and ask you to present your documents and justify your presence if you are somewhere other than the location mentioned in your documents, with fines and/or arrest ensuing if you cannot or will not. You are not permitted to stay in a location not mentioned in your passport for longer than a few days. This is all well and good if the police are "reasonable" and obey the spirit of the law; unfortunately, the Russian police are not. A lot of people here see national ID cards as a slippery slope, with the [next step] being the ability of the police to stop you in the street and ask you to justify your presence there at any time, the step after that being the ability of the police to arrest anyone at any time, and the step after that being Stalinist Russia.
Cost, I cannot really comment on as I have little idea as to how much or what that would impact. Making individuals pay £30 seems a little silly if your main target is people drawing benefits.
How will it damage relations between the police and the community? If the police wish to know who I am, I would be inclined to tell them. If they have some way to verify what I am telling them, so much the better.
Forgeability
On a slightly more practical note, I have yet to be shown a security issue that the cards are actually of help with.
Reducing benefit fraud is the main one I hear of usually.
One assumes that a iris-print will be rather harder to forge than a bit of paper that says 'this person should receive x,y benefit' - Kazuhiko
[Why] does one assume that? (1) Why forge? Just use the one that you handily have on your compulsory ID card. (2) Attack at the point of acquisition of the ID card. Use your one or two existing forged pieces of ID, and suddenly *everyone* believes you are Mr. X, not just the people who trust the old ID. (3) Photograph someone else's iris - maybe while scanning their card on a pretext (suppose you run a car rental business or something). From there it's just as forgeable as current measures like holograms on credit cards and such. (4) [We][can't][do][reliable][biometrics][yet]. - MoonShadow
Do you believe in the existence of reliable biometrics? -- Senji
Where the validity has to be decided automatically, and/or where the biometric is expected to be absolutely reliable (which is what people using machines are likely to assume about the machines' decisions), clearly not - as can be seen from my statements above. - MoonShadow
Personally I'm of the opinion that 'something you have' and 'something you are' are functionally identical as identification mechanisms. -- Senji
"Something you have" is useless as an identification mechanism, since it can be taken from you. "Something you are" would be good; the best we can do in the real world is "something you (or somebody else; think databases) has which is linked to something you are". - MoonShadow
I'm refering to the traditional position - identification: something you have, something you are, something you know - pick any two. The trouble with 'something you are' is that sufficiently determined black-hats can turn it against you (handprints and retina prints lead to people being carried around - or possibly just the relevant parts - for instance) - if you've combined this with 'something you have' then you've lost. Secure-ID is a good example of 'pick any two' -- Senji.
Now I know for a fact that when I get hayfever my eyeballs swell slightly (I know this cos it plays merry hob with my contact lenses). I'm really not sure it's a good idea to have a system that many people can't use if they have the sniffles. Also, what about the blind? Or people with cataracts? The most potentially accurate technique appears to be dna testing, and even that has its occasional blind spots - [human chimeras] for example. Good luck trying to find a system that encompasses everyone. - CorkScrew
In short though - yes it's harder to forge, but once someone knows how to do it, it will be easier to do it over and over. Thus meaning that casual fraud will be harder (no pretending to be over 18 when ordering beer or videos) but real fraud (with organised rings getting orders and distributing altered cards) will have a better time of it. --Vitenka (HugoAndVictor)
I have a feeling that, if we are going to have the damn things at all, we should at least go the whole hog and have UnforgeableIdCards. --DR
Civil Liberties
I completely object to ID cards. The point about driving licenses is spurious. You carry a card to prove you can legally drive. It is a choice you have made. You could choose not to drive and would therefore not need the card. Is the government now saying we need a card in order to exist? When carrying id becomes a matter of force rather than choice it is an infringement of civil liberties.
MoonShadow has seen argument made to the effect that your driving license exists to prove your entitlement to drive, not to demonstrate your identity; therefore a date and biometric (e.g. photo) taken by your examiner when you pass your test should be sufficient, and there is no need for it to carry your name or address.
I will admit to slightly playing DevilsAdvocate here and, quite possibly, exposing my ignorance too. The generic, and seemingly unexplained, cry of "civil liberties!" that crops up every time ID cards are mentioned on the news does get on my nerves though. - Kazuhiko
The basic cry is because it is simpler and more effective to have a single simple 'bad thing' cry than it is to actually reason it out. The reasoning is rather complex - and ranges from the far fringe "Doing this lets the evil government be more evil" through to the more reasonable "This seems to give few or no benefits, and runs the risk of abuse by a future power" - it really is being seen as 'thin end of the wedge' stuff. Remember that not all that long ago they tried to give police arbitary stop and search powers for anyone seen on the street. Combine that with the ability to instantly look up their id and get a "harass this man" report... The potential for abuse is startling. The benign uses do exist, but seem to be outweighed. --Vitenka
Costs
TheEconomist? (2003-09-27 P33) lists a range of possible prices of implementing the scheme, from 1.3 billion (40 pounds per person) for a simple plastic card, to 3 billion for a card (presumably with a chip of some sort in) that can hold biometric data.
Does identity theft [really] cost the UK £1.3 billion per year? Andrew Gilligan tracks down the figures and finds it's more like a tenth of that.
To be DevilsAdvocate - the yearly cost in a decades time may well be a lot more than the current cost. Then again, so might the cost of running the scam. --Vitenka (Scheme. Of course I mean Scheme.)
To be fair, the 1.3 quoted in the Economist is a set up cost to give everyone in Britain a card, not an ongoing yearly cost. --DR
Concerns about staggered rollout
Anyone else reckon it's quite insidious that they're planning to introduce them for foreign nationals this year, and for the rest of the population in [2012]? I only recently found this out; before that I assumed they would be rolled out to the whole country at once, a sizeable proportion would refuse, and that would break the system and it would have to be re-thought. But this way, since the foreign nationals are a small minority, the subset of them who will refuse probably won't be large enough to break anything, and NuLab? will be able to simply stick them in jail or deport them or whatever. And large portions of the population might not care, especially if they don't know any of them personally. (In other words: I previously thought that anyone who refused an ID card when first offered one would have the solidarity and protection of a certain largeish proportion of the whole population refusing alongside them, but now that won't be the case.) And then the cards will already be in use, even if "only" for foreigners, which will make it harder for the rest of us to escape them than if they weren't in use at all. And I expect that the full national roll-out in 2012 will likewise proceed in bite-size chunks (first they came for the...) rather than all in one go. --Rachael Another concern: MS?, will the 2008 plans affect you? Or do you have British citizenship (or whatever the relevant thing is)?
Cool; I can go back to just worrying about the abstract injustice rather than the threat to my own friends. --Rachael
Assuming the quote article is accurate, phasing them in in sections for the national rollout is exactly what they plan to do: "to issue cards to those who are employed in positions of trust where identity assurance is critical to determining their appropriateness for that employment" - ie, those people whose jobs they can make dependent on accepting an identity card. --Edwin
Staged rollouts are exactly the way to do things generally (just because it does allow you to cope with unexpected propblems on a small scale rather than everything falling down at once), and the way governments do everything (remember the planned staged roll-out of all-postal voting, for example). Also it allows you to hide the fact that your ID card scheme doesn't actually work (as it won't) and is actually a big expensive red herring (as it will be). So (a) I don't think it's 'insidious' or a 'first they came for the X' thing -- it's just the way government do any big project; (b) I don't think there was ever any reason to think that it wouldn't have been done this way and (c) the ID cards won't work anyway so don't worry about them, well, except insofar as it's our money they're wasting. -- n-r
Staged rollouts are one thing. Staged rollouts ordered by difficulty of resisting is a bit dodgier. --Edwin
[Eek]. "Nailing trusted relationship groups will essentially mean targeting people who, because their work places them in positions of trust, are required to undergo CRB checks. So teachers, carers, anybody working with children and/or vulnerable groups will be forced to get an ID card, commencing in the second half of 2009." This could be a problem for those of us who do youth/children's work at church. --Rachael
Oh goody, another excuse not to work with children.
[Article] by Nick Clegg saying basically the things we said above. He says "This strategy rests on a highly cynical assessment of the British people. At best it hopes we won't notice when others are having their civil liberties brazenly suspended. At worst it assumes that our fear of outsiders will allow us to sit idly by as innocent people are forced to hand over personal details to a government database." I agree, but he doesn't say what we should do if we do notice, or what the alternative is to sitting idly by. We can vote NewLabour? out at the next election, but that's next year, and too late to stop IdCards for foreigners. We can join No2ID?, but that doesn't seem to be achieving much. I feel quite clueless about how to do anything about it. I wrote to DavidHowarth? to express support and ask for suggestions, but he didn't reply. --Rachael
You wrote to him? By law an MP has to reply to paper letters, IIRC. --Admiral
It was an email, via writetothem.com. Maybe I'll print it out and re-send it by post. --Rachael
According to that site, he has replied to 48 out of the 134 messages they have sent him so far. --Admiral
When I've written to him previously (about the Police and Justice Bill in 2006, suggesting an amendment such that it wouldn't become illegal to e.g. manufacture cable modems) he has replied. Mind you, I used snail mail and, for good measure, mentioned that I was a local party member. --PT
I found an old LiveJournal thread where someone suggested that WriteToThem? were using an out-of-date email address for him, so he's not actually receiving stuff sent via them... --Rachael
Now there are [government plans] to require a passport in order to buy a mobile phone. And there were already plans to require an ID card in order to get a passport. So: no mobile phones without ID. [CLASSIC!] Identity and Passport Service produce adverts which [near-enough admit] that ID cards are a tool of an oppressive regime, used to quash mass protest and to find and punish the ringleaders.
![[Home]](/img/text_logo.jpg){kind=logo}
IdCards