Biometrics won't fix data loss
problems
Academics attack government untruths on ID
John Oates The Register 27th November
2007
Six leading academics have written to a Parliamentary committee to express their dismay at the way biometrics has been used as a magic wand which would have supposedly stopped Darling's great data giveaway.
The six said of claims by the Prime Minister and his Chancellor: "These assertions are based on a fairy-tale view of the capabilities of the technology and in addition, only deal with one aspect of the problems that this type of data breach causes."
Both Gordon Brown and Alistair Darling claimed, after the loss of CDs containing 25m recipients of child benefit, that the data would somehow be protected by biometric information if we had national ID cards.
The letter points out that this is based on three suppositions - that the entire UK population can be enrolled on the database; that no one can forge biometric information; and finally that every ID check would include checks against biometric information on the national database.
The letter said:
Even if, in this fairy-tale land, it came to pass that (a) (b) and (c) were true after all (which we consider most unlikely), the proposed roll-out of the National Identity Scheme would mean that this level of 'protection' would not - on the Home Office's own highly optimistic projections - be extended to the entire population before the end of the next decade (i.e. 2020) at the earliest.
The academics also note that including biometric information on a national ID register would make such records even more valuable to fraudsters, and once compromised make "fixing" the problem even more difficult.
The inclusion of biometric data in one's NIR record would make such a record even more valuable to fraudsters and thieves as it would - if leaked or stolen - provide the 'key' to all uses of that individual's biometrics (e.g. accessing personal or business information on a laptop, biometric access to bank accounts, etc.) for the rest of his or her life. Once lost, it would be impossible to issue a person with new fingerprints. One cannot change one's fingers as one can a bank account.
The six academics also point out that leaking such personal data is not just a question of hassle for people but could be potentially fatal for "the directors of Huntingdon Life Sciences, victims of domestic violence or former Northern Ireland ministers".
The open letter, available here, was sent to Andrew Dismore MP, chair of the Joint Committee on Human Rights.
The academics behind the letter include Professor Ross Anderson and Dr Richard Clayton of the University of Cambridge Computer Laboratory, and Dr Ian Brown of the Oxford Internet Institute. Other signers include Dr Brian Gladman, formerly of the Ministry of Defence and NATO, Professor Angela Sasse of UCL's Department of Computer Science and Martyn Thomas CBE FREng.
the letter in full:
| Mr Andrew Dismore MP Chair, Joint Committee on Human Rights Committee Office House of Commons 7 Millbank London SW1P 3JA cc: Committee members; David Smith, Deputy Information Commissioner 26 November 2007 Dear Mr Dismore, The government, in response to the recent HMRC Child Benefit data breach, has asserted that personal information on the proposed National Identity Register (NIR) will be 'biometrically secured': "The key thing about identity cards is, of course, that information is protected by personal biometric information. The problem at present is that, because we do not have that protection, information is much more vulnerable than it should be." - The Chancellor, Hansard Column 1106, 20/11/07 "What we must ensure is that identity fraud is avoided, and the way to avoid identity fraud is to say that for passport information we will have the biometric support that is necessary, so that people can feel confident that their identity is protected." - The Prime Minister, Hansard Column 1181, 21/11/07 These assertions are based on a fairy-tale view of the capabilities of the technology, and in addition, only deal with one aspect of the problems that this type of data breach causes. Ministers assert that people's information will be 'protected' because it will be much harder for someone to pass themselves off as another individual if a biometric check is made. This presupposes that: (a) the entire population can be successfully biometrically enrolled onto the National Identity Register, and successfully matched on every occasion thereafter - which is highly unlikely, given the performance of biometrics across mass populations generally and especially their poor performance in the only, relatively small-scale, trial to date (UKPS enrolment trial, 2004). Groups found to have particular problems with biometric checks include the elderly, the disabled and some ethnic groups such as Asian women; (b) biometrics are 'unforgeable' - which is demonstrably untrue. Biometric systems have been compromised by 'spoofing' and other means on numerous occasions and, as the technology develops, techniques for subverting the systems evolve too; (c) every ID check will be authenticated by a live biometric check against the biometric stored on the NIR or at the very least against the biometric stored on the chip on the ID card which is itself verified against the NIR. [N.B. This would represent a huge leap in the cost of the scheme which at present proposes only to check biometrics for 'high value' transactions. The network of secure biometric readers alone (each far more complex and expensive than, e.g. a Chip & PIN card reader) would add billions to the cost of rollout and maintenance.] Even if, in this fairy-tale land, it came to pass that (a) (b) and (c) were true after all (which we consider most unlikely), the proposed roll-out of the National Identity Scheme would mean that this level of 'protection' would not - on the Home Office's own highly optimistic projections - be extended to the entire population before the end of the next decade (i.e. 2020) at the earliest. Furthermore, biometric checks at the time of usage do not of themselves make any difference whatsoever to the possibility of the type of disaster that has just occurred at HMRC. This type of data leakage, which occurs regularly across Government, will continue to occur until there is a radical change in the culture both of system designer and system users. The safety, security and privacy of personal data has to become the primary requirement in the design, implementation, operation and auditing of systems of this kind. The inclusion of biometric data in one's NIR record would make such a record even more valuable to fraudsters and thieves as it would - if leaked or stolen - provide the 'key' to all uses of that individual's biometrics (e.g. accessing personal or business information on a laptop, biometric access to bank accounts, etc.) for the rest of his or her life. Once lost, it would be impossible to issue a person with new fingerprints. One cannot change one's fingers as one can a bank account. However, this concentration on citizens 'verifying' their identity when making transactions is only one issue amongst many when considering the leakage of personal data. Large-scale losses of personal data can have consequences well beyond an increase in identity fraud. For example, they could be potentially fatal to individuals such as the directors of Huntingdon Life Sciences, victims of domestic violence or former Northern Ireland ministers. It is therefore our strongest recommendation that further development of a National Identity Register or National Identity Scheme (including biometric visas and ePassports) should be suspended until such time that research and development work has established beyond reasonable doubt that these are capable of operating securely, effectively and economically on the scale envisaged. Government systems have so far paid little attention to privacy. Last week's events have very significant implications indeed for future government information systems development. We would be pleased to clarify any of these points or provide further information if useful to the Committee. Yours sincerely, Professor Ross Anderson Dr Richard Clayton University of Cambridge Computer Laboratory Dr Ian Brown Oxford Internet Institute, University of Oxford Dr Brian Gladman Ministry of Defence and NATO (retired) Professor Angela Sasse University College London Department of Computer Science Martyn Thomas CBE FREng |
See also:
How to clone a biometric passport
Readers please email comments
to: editorial AT
martinfrost.ws including full name