Report - Guardian

208 The LSE Identity Project Report: June 2005The deliberative process on this bill has already suffered from a lack of open discussionon projected costs. The Home Affairs Committee was warned by a variety of expertsthat detailed specifications were required in order for costs to be reigned in, and withoutadequate research, the specification would remain ambiguous. For instance, the UKComputing Research Committee argued that a number of questions remain unanswered:- “How long could this process be permitted to take (mean,median and maximum) before the delays became unacceptablein the most time-critical of the required functions?- What level of false positive matches (fraudulent use notdetected) is acceptable for the most demanding function forwhich the card would be required?- What level of false negative matches (legitimate use rejectedby the system) is acceptable for the most demanding functionfor which the card would be required?- What level of failure to obtain any matches (biometric not ableto be read) is acceptable for the most demanding function forwhich the card would be required?- Would all necessary data about the cardholder be contained onthe card itself, or would there need to be interrogation of oneor more databases?- How would the authenticity of the data on the card (or in anyassociated databases) be established initially? What is theacceptable error rate in this data?- How sensitive (private/secret) is the data on the card or on anyassociated database? (This will influence the necessarysecurity mechanisms).- Will any databases be accessible from public terminals orconnected to the Internet?- How many people/locations will need to be able to read thedata on any databases?- How many people/locations will need to be able to alter thedata on any databases?- What mechanisms are required to allow the cardholder to haveaccess to, or to modify, any or all of the data held aboutthem?” 484These questions cannot be answered without detailed studies into the use of biometrics,detailed consideration on the content of the cards, trials of cross-countryimplementation, and clear operational guidelines.Particular reference should be made to one study on the feasibility of biometricsconducted by the National Physical Laboratory and BTexact (hereafter referred to as‘the NPL report’) conducted in 2003 (see section on Biometrics). The UK ComputingResearch Committee found this study to be ‘competent’ and supported the conclusions,although with the caveat:484 ‘Memorandum submitted by the UK Computing Research Committee’, submitted to the Select Committee onHome Affairs, available at http://www.publications.parliament.uk/pa/cm200304/cmselect/cmhaff/130/130we52.htm.