Report - Guardian

More documents

Recommendations

Info

194 The LSE Identity Project <strong>Report</strong>: June 2005Conditions for Access to Data Held in the National IdentityRegisterIn the operation of Identity Cards, there are three parties to an identity verificationattempt:1. the subject – the person whose identity is to be verified2. the verifier – the person who is seeking to verify the identity of the subject3. the Secretary of State – the person who proposes to offer confirmation ofidentity and offer identity-related data to the verifierand there are three potential sources of biometric data1. biometric data held in the National Identity Register2. biometric data held on Identity Cards3. biometric data derived from actual biometric measurementsThis triplication of biometric data means that many different situations arise in anyidentity check, ranging from complete unavailability of biometrics to a situation inwhich all three sources of biometric data are available. Further complexity arisesbecause there can be no presumption of the extent to which each of the three parties toan identity verification trust each of the other two parties. This includes, for example,the potential for ‘two against one’ collusion between any two of the three parties toundermine the interests of the third party.Such situations need a very carefully constructed technical and legal framework if theyare to be properly managed. A comparable problem arose in the Nuclear Test BanTreaty 466 where the US and the Soviet Union each wanted to place seismic detectionequipment on each other’s territory in a situation in which (a) neither party trusted theother not to interfere with the equipment or the communications involved, and (b)neither party trusted that the only purpose of the equipment so installed was thedetection of illegal nuclear tests.Solving such problems requires a substantial research investment, covering both thetechnical and the legal aspects of the way in which these requirements can be met that issatisfactory to the interests and concerns of both parties. In the case of the NationalIdentity Register, the situation is more complex because there are in fact three partiesinvolved and three sources of biometric data.Although it would be unrealistic to expect that the Identity Cards Bill should specify thecomplex technical details that are necessary to perform an identity verification in such asituation, it must necessarily establish a framework for them that is capable of copingsuccessfully with the challenges that a complex three-party verification process willgenerate. There is little evidence to suggest that the Bill has been drafted in a way thatindicates a capacity to deal with these complexities.466 ‘How to Insure That Data Acquired to Verify Treaty Compliance Are Trustworthy’, by Gustavus. J. Simmons,Chapter 13, Contemporary Cryptology: the Science of Information Integrity, IEEE Press, 1991.
The LSE Identity Project <strong>Report</strong>: June 2005 195This analysis suggests that the provisions in Section 14 of this Bill are inadequate insecurity terms, and fail to establish a sound basis for the security of data held in theNational Identity Register.Access to Data Held in the National Identity Register withoutSubject ConsentThere are also worrying security deficiencies in Sections 19 to 23, that cover access todata in the National Identity Register held without the consent of the subject (this willsubsequently be referred to as ‘covert access’).Inadequate Controls Covering Access without ConsentA large number of organisations can gain covert access to National Identity Registerdata, the only constraint imposed on them being a requirement to show that the datacannot reasonably be obtained in another way. In practice, this constraint is so weak asto be virtually useless.There is, for example, no requirement that such requests should be subject specific,which means that organisations with covert access rights can undertake ‘fishingexpeditions’ in the National Identity Register.Whereas a person who is seeking to verify an identity would have to nominate a subject,the police and others appear to be free to make requests that are not subject specific.This will mean, for example, that requests such as: ‘supply fingerprint and addressrecords for all who live in Worcester’, or: ‘provide the identity records of all thosewhose fingerprints might be a partial match for those attached’, are permissible. Ittherefore appears that those with covert access will be able to interrogate the NationalIdentity Register using full database search and extraction capabilities.The ability to make such access requests without nominating a subject has serious safetyand security implications. Although it might help in fighting crime, it will also createnew risks for honest citizens. For example, those whose fingerprints are innocentlyfound at crime scenes could have to account for their presence to the police, who wouldhave the ability to identify them using the National Identity Register.Although the size of any consequential risk is unknown, it is clearly present if largelyunconstrained police access to the National Identity Register is allowed. In consequenceit is far from certain that benefits in fighting crime will be sufficient to offset new risksfor law-abiding citizens.The Ability of Government Agencies to Impersonate UK CitizensOne bizarre provision within this part of the Bill is that organisations that have rights tocovert access can obtain the passwords and security answers that are supposed to verifysubject access and subject consent for third party access. Since the only possible use ofthis data is to impersonate the subject in respect of the giving of consent, it has to beconcluded that the Government is inadvertently making provision to allow the policeand other agencies to impersonate the subject in this regard. A likely consequence is
Page 1:
The Identity Projectan assessment o
Page 5 and 6:
The LSE Identity Project Report: Ju
Page 7:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 19:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33:
Page 36 and 37:
22 The LSE Identity Project Report:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
100 The LSE Identity Project Report
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
Page 157: The LSE Identity Project Report: Ju
Page 160 and 161: 146 The LSE Identity Project Report
Page 183 and 184: The LSE Identity Project Report: Ju
Page 199: The LSE Identity Project Report: Ju
Page 259:
Page 262 and 263:
Page 264 and 265:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 274 and 275:
Page 276 and 277:
Page 278 and 279:
Page 280 and 281:
Page 282 and 283:
Page 284 and 285:
Page 286 and 287:
Page 288 and 289:
Page 290 and 291:
Page 292 and 293:
Page 294 and 295:
Page 296 and 297:
Page 299 and 300:
Page 301 and 302:
Page 303 and 304:
Page 305 and 306:
Page 307 and 308:
Page 309 and 310:
Page 311 and 312:
Page 313 and 314:
Page 315 and 316:
Page 317:
show all

Report - Guardian

Create successful ePaper yourself

Delete template?

Save as template?