Tuesday, October 25, 2005

Officials recognise genuine problems with ID cards

William Heath is convinced that senior Whitehall officials are coming to understand how seriously flawed the government's ID card system really is. Even more importantly, from the point of view of doing something about it, there is a good chance that the plan will get entangled in procedural problems which would make it really difficult for the system to get formal Whitehall security accreditation.

"I'm told I can't say who said it or where but there's been some movement on the ID cards/register policy and there's considerable pressure for rather more.

Senior industry and Whitehall figures outside the Home Office agree that the lack of a business case is a problem. The notion that we don't yet understand enough about identity and what it means in an e-enabled world has wider credence than sceptics may have feared...

And just as Kable found earlier this year there was insufficient clarity about how the Home Office ID system proposals would work in practice to inform a market-sizing exercise (not that the Home Office much cared) so now it is becoming clear that the same lack of clarity makes it impossibe to do a formal Whitehall risk assessment and security accreditation. This information-assurance issue is rather more serious, since the ID system would form part of the critical national infrastructure...

There is the potential for the legislation to get through the Lords only to find one department irrevocably politically committed to introducing ID cards at loggerheads with other parts of government responsible for policing good practice in government's acquisition and management of the critical IT infrastructure, who will block the project.

These major Whitehall-procedural snags sit alongside philosophical differences about the role of identity and stability of democracy when stresses on society will be greater than they are today, and deep technical questions about future generations of technology. As devices proliferate and biometrics evolve, what architecture will prove robust? There's a strong case for holding our bets.

"I'm personally concerned about any system that claims to solve all problems in one go," said one senior source. "You can't have a gold standard which at the same time is easy to use for vast numbers of people. There tends to be a trade-off between ease of use and high security." Instead, he argued, we need to discover the relationship between the individual and the state, and set out the principles that underlie the future architecture. In the US, such a deep-lying and non-partisan issue would require an amendment to the Constitution.

You need to keep calm sitting on a panel trying to create dialogue with someone who never returns your emails and who studiously ignored various important people who try to offer vital insights, indeed denies they have ever tried to get in touch...

It'll take good science and good manners. But we'll get there."

I admire his persistence and his confidence but remain skeptical. He makes an interesting point about the US but arguably they've already laid the foundations of their own national ID card system with the Real ID Act and there were no questions of constitutional reform there. However, now that the Irish justice minister has done a U-turn and claimed Ireland will have to follow the UK on ID cards, having previously being opposed to the notion, I wonder if there is any mileage in exploring the potential contitutional hurdles to such a scheme in my homeland?

No comments: