Report - Guardian

The LSE Identity Project Report: June 2005 197In the light of these examples of the high risks that the availability of identity data willbring to some, it is worth reflecting on a statement made by David Blunkett, speaking ina debate on the earlier Identity Cards Bill:“Let me make it clear: no one has anything to fear from beingcorrectly identified …” 467It is our view that those who understand the nature of identity would never pursue thetype of centralised approach embodied in the National Identity Register because manyof the security risks identified here are inherent in such an approach.Insider Attacks and AuditingOne of the most difficult and challenging aspects of secure systems design andimplementation is that of providing effective auditing that is capable of detecting andrevealing malign behaviour on the part of system operators or users.The difficulties inherent in the audit requirement can be illustrated by considering theaudit load that will be generated by the National Identity Register. The system will haveto handle (depending on the time of day or hour) up to 100 transactions per secondcontinuously, each of which has to be recorded for audit. This will generate around 1Gigabyte of data per day.Although auditing can generate large quantities of data, the real problem is not thevolume as such, but rather the ‘needle in a haystack’ problem of analysing this data todetect suspicious behaviour by users or system operators. Proactive audit analysis isimportant for the early detection and removal of subverted users and operators, but thevolume of data forces the use of some form of automated or semi-automated auditanalysis, or the random or targeted analysis of the audit records for specific users andoperators.However, although automated audit analysis will often catch ‘amateur’ insider attacks,long term subverted insiders will go to considerable lengths to ensure that their actionsappear unremarkable. As a result, they are only likely to be discovered by manual auditanalysis, meaning that that they can operate as subverted insiders for a considerabletime without fear of detection, unless a high proportion of operators are subject toregular manual audits.The regular manual audit of a high proportion of system operators for a system as largeas the National Identity Register will be an extremely expensive process. Again, it islikely that corner-cutting to reduce costs will curtail effective auditing and exacerbatethe risks of security compromises in the operation of the National Identity Register.467 Commons Hansard, Identity Cards, November 11, 2003.