Report - Guardian

The LSE Identity Project Report: June 2005 189quality levels below that needed to implement the NIR. This is the case even for special“secure” versions of software, such as the Open INGRES/Enhanced Security databaseand the Sun Solaris 2.6SE operating system.The NIR is an example of a class of computer systems requiring ‘Mandatory AccessControl’, which means that the security policy cannot be overridden by the users. Themost common systems of this type are described as ‘multi-level secure’. These aresystems that defence and intelligence agencies have been seeking to build for more thantwo decades. Although they are technically feasible on a small scale, experience showsthat their development is extremely costly, their performance is very often disappointingand their maintenance and support costs are prohibitively high.The problem is well summarised by Dr Rick Smith, a US computer security expert, whosays:“Multilevel security (MLS) has posed a challenge to the computersecurity community since the 1960s. MLS sounds like a mundaneproblem in access control: allow information to flow freely betweenrecipients in a computing system who have appropriate securityclearances while preventing leaks to unauthorized recipients.However, MLS systems incorporate two essential features: first, thesystem must enforce these restrictions regardless of the actions ofsystem users or administrators, and second, MLS systems strive toenforce these restrictions with incredibly high reliability. This has leddevelopers to implement specialized security mechanisms and toapply sophisticated techniques to review, analyze, and test thosemechanisms for correct and reliable behaviour.“Despite this, MLS systems have rarely provided the degree ofsecurity desired by their most demanding customers in the militaryservices, intelligence organizations, and related agencies. The highcosts associated with developing MLS products, combined with thelimited size of the user community, have also prevented MLScapabilities from appearing in commercial products.” 465Since the National Identity Register will require a mandatory access control system, thescale, complexity and assurance of which is a long way beyond anything everpreviously contemplated, the programme is certain to face technical problems of a kindthat are known to lead to development difficulties, and very often to uncontrolled costgrowth during development.There is thus very good evidence to suggest that it will not be feasible to build acomputer system capable of operating the National Identity Register with effectivesecurity provisions. An attempt to build such a system is likely to be extremelyexpensive and at high risk of failure.465 http://www.cs.stthomas.edu/faculty/resmith/r/mls/index.html