I wonder whether it was incredible chutzpah or mere ignorance on the part of our Chancellor Alistair Darling. On the Today programme, he suggested that the loss of records on half the population was an argument IN FAVOUR of ID cards.
The reasoning goes something like this: OK we might hand over all your person details to criminals, but when you have a biometric ID card, they won’t be able to exploit it. Sure, they’ll know a host of intimate details about your life but without your fingerprint or iris, all that information will useless.
Perhaps I overlooked the part in the ID card costings where the Government pays for every person in the country to have a home iris-reader to authenticate themselves to their Internet banking service; but this is either hopelessly naive or exceptionally foolish.
Let’s be clear about this: the cards themselves are not the issue. Sure, they’ll be horribly expensive. Yes, we know that biometrics are a long way from the infallability that ministers tout, and that the Government’s own trials make the flaws glaringly obvious. But, honestly, the card isn’t such a big deal.
In fact, I’ve been carrying a biometric ID card around with me for several years and there’s a good chance you have too. In my case, it’s my driving licence and the biometric is a photograph of my face. Although I’d be very concerned if I was legally forced to have it, I can’t honestly say that it’s bothered me too much.
No, the issue is and always has been the database. Big databases are a problem. A database can work, be big or be secure: pick any two, but you can’t have all three. This isn’t anything to do with the way Labour manage Government IT projects. There are huge problems with that too, with billions of pounds and effective control of IT being handed over to a small number of very large, accident-prone companies, but fixing that wouldn’t make ID cards work. No, this is a problem that no-one has cracked. Not our government, not any other government, not any private company.
No-one has even come close to figuring out how to create a database containing large amounts of sensitive information on millions of people, to be accessed by further millions of people across hundreds of government agencies and private companies and make it both secure and functional.
Let’s imagine that biometric ID cards worked perfectly and you had an iris scanner and fingerprint reader in your home and in every branch of every bank and other financial institution in the country (it would cost a fortune, but bear with me). Someone accesses your private information on the ID card database, but you don’t mind, right? After all, you’re a good citizen and you’ve got nothing to hide.
So, just to check, you don’t mind personal information about your children being sold to every predatory paedophile in the country. Excellent, that’s OK then. You’ve no objection to your entire history being known by anyone at all – friends, enemies, colleagues – no secrets. Great. How many people who say “I’ve got nothing to hide” freely go around telling everyone exactly how much they earn, I wonder.
Other countries have ID cards; none has databases of the scale and scope being proposed by Labour. It’s the database that’s the problem, and it’s the database that the Government have so graphically illustrated their utter inability to secure.
Follow @libdemvoice.org on Bluesky
Like us on Facebook
Subscribe to our feed
Sign-up for our daily email digest
"The old savage England": D.H. Lawrence visits the Stiperstones
Church Green video
Thinking of standing for election or re-election next year? Helpful questions to consider
Endometriosis and acetylation
Nonconformistradical
Henry
Daniel Walker
David Raw
3 Comments
As no one else has said it, well said sir, well said. “Someone accesses your private information on the ID card database, but you don’t mind, right? After all, you’re a good citizen and you’ve got nothing to hide.” Precisely–it’s not hiding, it’s privacy, I’m not hiding behind my curtains, I’m protecting my privacy.
And it is surely technologically forseeable that sooner or later someone will be able to fake your biometrics (capturing them from supersensitive CCTV perhaps), and then will have access to everything, absolutely everything. Once they have your fingerprints you won’t be able to replace them with a new set like your PIN number. And I don’t want to have to screw my eyes out just because some organised criminal gang has faked my irises.
There is also a design problem with biometrics, which is that any biometric test has to be performed by a trusted reader.
Suppose that a criminal knows my fingerprints and iris patterns, but can’t put together a fake finger or a fake eye that’s “good enough” to fool a reader.
If it’s a remote reader – ie across the internet – then that doesn’t matter; he can just have a computer program that is pretending to be a reader with your fingerprint / iris pattern programmed in. There are only two possible counters to that:
1. There is a secret password (or encryption key, or whatever) which is given to the reader and is not known to the human being using that reader. This is security by obscurity, in that you can almost certainly analyse the device (which, don’t forget, is in your possession), find out the secret, and then create a program that pretends to be the device. This whole thing is essentially the equivalent of trying to produce an effective anti-copying system for DVDs; you need a trusted device that can be widely distributed and is immune to reverse-engineering. As DeCSS and the breaking of HDCP both demonstrate, this is laughable.
2. Trusted devices, ie ones that are under physical control of trusted people. This works, but it means that biometrics are only meaningful where the testing is being done by a trusted person using a trusted device. So that’s fine for going into the branch and applying for the bank account, but not very useful for internet banking.
The other point is that, even if you can get a fake finger, you also need to convince the person operating the fingerprint reader that the fake finger is your actual finger. I guess you might bribe a bank teller to let you open an account, but I suspect that in most cases, the face-to-face situation will be a difficult one. But if you’re at home, with a fingerprint reader on your laptop, then the person you have to fool is yourself – which is easy.
Again, the only situation where biometrics work properly is a high-security one like actually being in a bank, physically being in passport control or visiting a high-security building.
Other than that, there are too many problems that are provably insoluble. Biometrics solve a very small set of problems at very great expense.