IPS leak suggests ID card fingerprint chop

At the risk of...

...invoking Godwin in the first post (though someone will almost certainly have beaten me to it by the time I've finished typing), it looks like they're going to make a scheme which already has unhealthy resonances with the Nazi population register share even more characteristics. What's the betting that immigrants who start off having a "foreigner" card with their fingerprint won't have their prints deleted from the database even if they succeed in gaining UK citizenship?

And can anyone explain the function of fingerprints on a foreigner's card in an environment where fingerprints aren't routinely used as an authentication factor?

A simple ID System is whats really needed

The main problem with current government based ID systems (Passports, Driving Licenses etc...) is there is no way to identify stolen or fake ID's - which seems to be the biggest issue these days.

Why can't we have a simple ID card with a large photo (Whole size of a credit card) a card number, a imbedded chip (only holds the owners private key of verification and digital signatures purposes)

The card cost would be small, under £1. and as an added services the government could offer verification services via SMS for a small fee, service that could be included are:

a) Verify if the card is O.K.

b) card holder is old enough to drink,

c) card holder can work in the U.K.

d) card holder has a valid driving license.

e) Verify a picture of the person against a centrally held copy (the photo's do not need to be held on a online System as the operator could have two systems one online to receive the verification request and another off-net to access the stored photo's.

e) etc.....

Why not just start with a photo?

This is what most Western european countries use for their ID cards. A simple photo ID with your name and address is adequate for most situations where you have to provide proof of identity. National identity cards from EU member states or EU photocard driving licenses are deemed to be adequate proof of identity to enter the UK.

They could always add the other biometric nonsense as and when (or if) they get their act together.

Nobody has tied up the EU distate of our electoral system with ID yet

I was listening to radio 4 the other evening on my way home from work as someone from the EU was twittering about how insecure our elections are because of our lack of ID.

It sounded to me like an ideal reason for our useless shower of cnuts to continue with the discredited ID card scheme - just the sort of thing they like... 'europe made us do it'.

Of course, the actual requirement is that the person who registers is the person who voted. This can be accomplished without identifying the person - you only need to ensure it's the *same* person as last time. There are any number of secure systems you can do this with - none of which necessarily require you to actually know who anyone is.

I have NO sympathy ....

... well, well, well. The whole ID card fiasco was predicted before it had been specced, and anyone who knew a passable bit about IT said it wouldn't work, whilst politicians sat in their chair by the sea and commanded the tide to go back ...

The worrying thing, is unlike Canute (and was there *ever* a better suited quasi-anagram ?) the politicians appear to believe their own hype ...

Well, now the real work has to start (if the ludicrous target dates have any chance of being overshot by usual government standards) the house of cards is starting to topple ... scope being narrowed, timescales being "clarified", vendors dropping out (does anyone remember the Inland revenue fiasco when they had to pay rival companies to put together bids they knew they'd never win ?).

I do hope that eventually the papers realise the truth of the situation, and start asking the *really* awkward questions.

Could you not have an "Amy Winehouse" icon for when things are in the crapper ?

@Damian

Abandon it?

Abandon a flagship policy of the last New Labour manifesto? Don't you understand the ID card scheme is the 21st Century version of the 5-year tractor production plan? Just as it didn't matter if the proletariats glorious tractors only had three wheels; it won't matter if the people of Britain don't have working ID cards - they will have ID cards. And isn't that what the late, great David Blunkett would have wanted?

Give up now, just when unreformed science is saying the whole scheme won't work? You might as well say the Dear Leader before the current Great Helmsman showed signs of human fallibility. And we're not quite ready for Gordon's secret speech to the 20th Party Congress on the topic of 'the Personality Cult and its Consequences.'

http://en.wikipedia.org/wiki/On_the_Personality_Cult_and_its_Consequences#Excerpts

@Simple ID system

An excellent idea, but it achieves nothing and should you ever make it useful, it will become redundant...

'Old enough to drink' - well someone is only old enough if they have proof (a passport or one of those pub-approved schemes) or the seller makes a judgement call. No need for a card. Most of us would never be asked to show the card!

'Can drive' - drive what? A motorbike? Geared or auto? What CC/HP (you get different license for both of these). A car and a van and a tractor? Or just an auto car? By the time you put all this onto a card you have a drivers license.

'Cardholder can work in UK' - Useful for employers and govt security agencies, but seems a bit overkill for everyone I know to hold a card. I guess an NI number might do the same thing or how can the employer pay your NI?

'Verify the card is OK' - well, without issuing card readers everywhere or relying on bouncers to type your card number into a phone and wait for an SMS, it's pretty impossible.

I can't see the point of this card if you can legally work without it, legally drink without it and legally drive without it.

To make it cost £1 you'd need to outsource it to, say, Tesco who would love to know the ID of their chosen markets. But as soon as it became useful to, say, underage drinkers they'd be fake ID cards. Same photo, reprogrammed info. Or you get a card from some polish friend who's leaving the UK and skilfully swap the photo so you are now eligible to drink vodka, drive buses and work anywhere in the EU.

What would be the penalty for not showing the card when requested to do so? Would annoyed barstewards refuse to serve a 40 year old because they didn't show their ID card to prove they were old enough to drink?

I *like* the idea of a cheap, simple ID card, I just don't think it'd serve any useful purpose :(

Why indeed have a passport?

Our passport says "Her Britannic Majesty's Secretary of State requests and requires in the Name of Her Majesty all those it may concern to allow the bearer to pass freely without let or hindrance, and to afford the bearer such assistance and protection as may be necessary." Once upon a time this meant something. Nowadays the only force it carries is if you slap someone with it and give them a paper cut. If you happen to be, say, kidnapped by CIA perverts to be used as a torture whore in some godforsaken prison, Her Majesty's government will do exactly f*** all. A passport, like the ID card, is now just a certificate of ownership (of you, by the government).

Crucial difference

While I agree that the European ID card system seems to be a useful streamlined process, there is (at least) one crucial difference between the English and Continental approach to IDs that people should be aware of - generally, on the continent, you have an obligation to carry identifying card at all times. The police have the right to stop and check that you are who you say you are.

This isn't the case in England (one of the main reasons we're not in the Schengen zone), and I for one hope it stays that way.

@Simple ID system

For many activity's we already require an ID - some of the ID's used today include credit cards, driving licenses etc... for example:

obtaining credit

renting a property/car

getting a Job

getting your pension

Entry into some clubs requires an ID.

You can currently be refused liquor or cigarette's if you do not show proof of age.

So most people in Britain today need ID. All I'm suggesting is that simple system can provide most of the requirements:

Cutting and pasting photo's on to ID cards only works if you not sending a picture of the card holder to a central source to be verified.

Each card has a unique ID, so it maybe possible to copy cards but this does not help as many people will be sending in a photo of the card holder.

ITV manage to get the SMS network to respond fast enough for voting on "Dancing on ICE", that show's it could work the application does not require sub second response the first four requirements would be happy with day's as a response time and clubs and pub and shops already verify visa cards sub second so verifying an ID cards could also be done sub second.

NB: The issue with chip & pin is that by closing one hole in the U.K. they opened up another, the rest of the world. Until chip and pin is used by all outlets around the world and a better way of authorising Internet based transactions is used (say some form of secure ID may be the answer) these holes will not be closed.

So in summary we already need ID's for many functions, lets have some that works and is cheap. Nothing I've seen from the government to date works not even chips in passports they keep looking at the wrong problems.

@Why a card at all?

... because clearly the government have no faith in the ability to verify a persons prints on-demand, in real-time 24/7 ...

"stop and check"

Oddly you have the absolute right to require any police officer to identify themselves (name, rank, number) to you for any reason whatsoever.

However, exercising this right will see you done for resisting arrest.

When you are phoned by the bank, they ask some security questions. When I ask them to prove they are my bank, I get told they can't. I ask what it is about (since there may be a reason why they are talking to me and if I KNOW it's nothing to do with me, I'm being scammed) I'm told they can't until they verify who I am. I tell them that unless I know what it's about I can't tell if I want to let them know it's me. They hang up.

If you need to prove yourself to vote, won't the people running the place have to prove themselves?

Can you require full proofs of the board and executive directors to check that your putative employer hasn't been done for fraud (under a different name, even)? Or will asking get you shown the door?

Now when all this proof is centrally stored and verified, doesn't that mean that I will now have to go to a public office with their ID credentials? Will they let me take them?

@Simple ID system

"So most people in Britain today need ID. All I'm suggesting is that simple system can provide most of the requirements:"

All your suggestions are already adequately provided for - Passport, NI, driving license. I know you want a solution that does them all but it will be useless until it becomes useful, in which case it will become useless again.

"Cutting and pasting photo's on to ID cards only works if you not sending a picture of the card holder to a central source to be verified."

OK, so when the card itself isn't sufficient they take a picture of you and someone compares it to the central database. And this is easy? This is biometrics my friend, where key pointers of the face, or fingerprint, or iris, are compared to the stored key pointers.

"Each card has a unique ID, so it maybe possible to copy cards but this does not help as many people will be sending in a photo of the card holder."

So, to buy a drink, someone would need to take photos and swipe cards (to get the unique number) or perhaps you'd prefer RFID? Wouldn't it be cheaper for a pub to use a passport for the odd customer that looks underage?

"ITV manage to get the SMS network to respond fast enough for voting on "Dancing on ICE", that show's it could work the application does not require sub second response the first four requirements would be happy with day's as a response time and clubs and pub and shops already verify visa cards sub second so verifying an ID cards could also be done sub second."

Hmmm I think this is a little wishful thinking. Put your thinking cap on and look at how many ways *you* could bypass such a system. A GSM network blocker holds up the queue to a nightclub before they decide to stop checking with SMS? Flood the bouncers SMS gear with SMS messages?

As soon as it enabled you to obtain credit then think of the number of ways you could buy a way to bypass it and you get free money under a false ID.

"NB: The issue with chip & pin is that by closing one hole in the U.K. they opened up another, the rest of the world. Until chip and pin is used by all outlets around the world and a better way of authorising Internet based transactions is used (say some form of secure ID may be the answer) these holes will not be closed."

Chip&Pin was never meant to stop fraud, in fact it's well known that us citizens are less protected. The difference is that it comes under ATM law and not Cheque law - which means the bank no longer has to automatically refund your money, you have to prove you didn't give someone your card and PIN. A bit hard to prove a negative. Fraud losses have gone down simply because the banks have to pay out less when fraud happens. Which is why they now call it ID theft, because whilst they are responsible for your money, you are responsible for your personal ID number and if anyone steals from your account it is assumed, under ATM law, that you must have given away your pIDn.

"So in summary we already need ID's for many functions, lets have some that works and is cheap. Nothing I've seen from the government to date works not even chips in passports they keep looking at the wrong problems."

Unfortunately, so do you... find a problem that doesn't have a solution. Decide whether the cards will be compulsory. Decide who will pay for all the card readers, cameras, etc. Decide if financial transactions will be more secure because of it, and then realise someone will exploit it and mass-produce it. Just as they do with Visa cards, and Visa reacted by making Chip/Pin compulsory where *we* suffer.

Sorry. I *like* the idea of a cheap ID card but I can't see where it'd be useful.

meh

They should all go back to North Korea.

All the pro ID/Database people would obviously be happier there where their government know exactly where each of them are, what each of them has been doing and what each of them is expected to do.

We ran a quarter of the world without even a pocket calculator. Now we can't run England with all the toys modern technology brings.

@ mike richards

huh? ;-)

@Why a card

I am aware that this point has already, at least partially, been made, but, a card/document based system is infinitely preferable to a central database because it is much harder to abuse.

Anyone discovering a way of manipulating/abusing a central database, or being in a position to manipulate/abuse it, can cause far more damage for far less effort than someone able to create counterfeit cards.

Experience here in Germany has shown that, with a little personnel training, only a vanishingly small percentage of counterfeit ID Cards cannot be identified as counterfeit.

Public Key Cryptography does allow the "Signing" of digital documents in such a way that it can be verified that the signing party was in fact the government and this requires no direct "online" access.

I do not think that ID Systems are useless, indeed having a reliable way of identifying people for important transactions is very useful indeed, for all parties in a transaction. What is needed is a decentralized system that allows no third party to track what is being done - as would be the case with a central database.

I agree that it is very silly indeed to have two systems that should prove identity - a single system is really the only way to go.

A decentralized card based system, with no central database, where biometric data, cryptographically signed at time of issue as correct, is only available on the card, would be the way to go, in my opinion.

As not all transactions require the biometric data, and humans can't read the data without an electronic reader anyway, I would plead for a document that is as difficult to forge physically as it is electronically.

Why not just start with a photo?

I have, quite seriously always thought that this was because David Blunkett was blind. The human brain has an amazingly accurate facial recognition system, much better than any software, but DB would not *know* this and all his hangers on would be too PC to tell him. A photo card offers a very quick and easy 'first fence' id check, add a public key encrypted version of the photo to the card then provided that HMG can keep *one* secret the card becomes unforgeable.

AndyD 8-)#