Report - Guardian

More documents

Recommendations

Info

254 The LSE Identity Project <strong>Report</strong>: June 2005There are strong technical and legal analogies with the debate over the mandatoryretention of telecommunications traffic data (cf. Anti-Terrorism Crime and Security Act2001 Part.11), but with the following differences:- audit trails are strictly superfluous to the function of the Register, rather thanarising through ordinary business processes;- the data are created and retained centrally by a government-operated onlineauthentication service, rather than scattered in different private-sector (ISP andtelephone company) records systems. (ECHR Article 8 therefore fully applies);- the debate in Standing Committee strongly suggests government currentlyintends no finite limit on retention, and deletion will be the exception not therule;- the trails are very strongly authenticated to the individual, and thus more privacyinvasive than other forms of retained data (e.g. traffic data).The way to cut the Gordian knot that abuse cannot be redressed unless an audit trailexists, is that there should be a retention period fixed by statute (perhaps one year – inline with the remit of the IPT) after which all audit trails should be deleted. A long orindefinite retention period will over time become the main privacy threat to theindividual, one that outweighs the risk of a potential inability to pursue redress, but thisdoes not seem to have been widely appreciated so far in public debate.Design Considerations and Legislative Implications of Audit Trails- In order to deal with privacy issues arising from access to the central register,the audit trail should record all occasions when access or verification takes placewithout the consent or awareness of the individual;- The Investigatory Powers Tribunal and Intelligence Services Commissionerwould benefit from direct access to the complete audit trail, including thoseportions recording access events within their purview authorised under clause23(5);- The audit trail should distinguish the trail of access and verification events ofwhich the user is aware or to which they have consented from other types ofevent, and require deletion after a period fixed by statute, or sooner at theindividual's request;- It is technologically feasible to require the provision of online Data Protectionsubject access to trails, at the discretion of the individual and certified as validwith an official digital signature from the Register. The ID card itself can beused as the means to authenticate subject access online;- To enable such a system to operate within the confines of British law, throughthe design of the system we can ensure that Commissioners and Tribunals canaccept trails in user possession, certified by an official digital signature, as validevidence in any complaint or investigation of abuse, and we can ensure thatunauthorised parties cannot accumulate and retain copies of audit trails throughperiodic and incremental lawful access to the Register, beyond the fixedstatutory period allowed for retention in the Register.
The LSE Identity Project <strong>Report</strong>: June 2005 255The central biometric database with broad purposesAnother challenge to the proposed ID card and Register scheme is that, in order to havea biometric system that is proof against duplicate enrolment of individuals, it wouldappear to be necessary to be able to check each enrolment against a central database ofbiometrics already enrolled. This would involve a central database with over 60 millionrecords containing personal information such as fingerprints, iris-scans and otherbiometrics.A centralised database solution necessarily gives rise to enormous additional privacychallenges. An alternative scheme would involve the storing of biometrics on a‘smartcard’, a card containing a digital processing chip with storage capacity. It islikely that the card envisioned by the Home Office is already going to be a smartcard,and if the ID Card is designed in accordance with the passport standards from theICAO, then the biometrics will already be on the chip. The difference, however, is thatthe biometrics in the UK Identity Card scheme will include a database holding copies ofthe biometrics. There is an enormous difference in the implications for the human rightto privacy between this type of system, and one where a biometric is only stored locallyin a smartcard, as recognised in opinions of the EU Article 29 Working Party on DataProtection. 676The Home Office has maintained that a crucial advantage of the proposed scheme is theprovision of a unique and inescapable identity for each individual and avoidance of thepossibility of multiple enrolments (which might be used for unlawful purposes).But a system based on smartcard-stored biometrics would undoubtedly be much lesscostly in design and operation, because identity would be verified by a biometric readermatching against the template stored on the card, rather than online against a centraldatabase of biometrics. If attributes and facts securely stored and periodically refreshedon the smartcard were for some reason insufficient, there could still be a centralRegister of facts, but they need not contain biometrics. Offline biometric-readerterminals would be far less expensive because no online communication capabilitywould be necessary, and no communication costs would be incurred each time the cardwas read.Nor is it the case that online verification to a central database would be any more securethan offline verification against a biometric stored in the card. The authenticity of thebiometric stored in the card could be checked by a cryptographic digital signature,which only government would hold the key to create, preventing fraudulent cards beingcreated with a valid biometric.It may be suggested that checking against a central database is more secure because dataheld centrally would be “fresher” than data held in a smartcard, orerrors/omissions/malfeasance might occur resulting in differences between data held onthe cards and a central database. However the database could and should rely on676 Article 29 Working Party, Opinion No 7/2004 on the inclusion of biometric elements in residence permits andvisas taking account of the establishment of the European information system on visas (VIS), the EuropeanCommission, August 11, 2004, http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2004/wp96_en.pdfand Article 29 Working Party, Working document on biometrics, August 1, 2003,http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2003/wp80_en.pdf.
Page 1:
The Identity Projectan assessment o
Page 5 and 6:
The LSE Identity Project Report: Ju
Page 7:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 19:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33:
Page 36 and 37:
22 The LSE Identity Project Report:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
100 The LSE Identity Project Report
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
Page 157:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 183 and 184:
Page 185 and 186:
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
Page 193 and 194:
Page 195 and 196:
Page 197 and 198:
Page 199:
Page 202 and 203:
Page 204 and 205:
Page 206 and 207:
Page 208 and 209:
Page 210 and 211:
Page 212 and 213:
Page 215 and 216:
Page 217 and 218: The LSE Identity Project Report: Ju
Page 259: The LSE Identity Project Report: Ju
Page 262 and 263: 248 The LSE Identity Project Report
Page 317: The LSE Identity Project Report: Ju
show all

Report - Guardian

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?