Report - Guardian

256 The LSE Identity Project Report: June 2005cryptographic techniques 677 to ensure that any loss of integrity would be instantlydetectable. Similarly, cryptography will be used to protect the communications datapath between a biometric reader and the database in an online checking scenario. Thecryptography and its implementation will have to be trusted for communication withand protection of a central biometric database. If one trusts the cryptography for online,why not for offline?Would online checking help against very sophisticated insider attacks involvingtampering with the database cryptography? The answer is no – these threats implycomplete compromise to the integrity of the system. Any putative additional securityvalue for online verification is illusory.Also, offline verification provides a far more resilient system overall. A single,centralised online authentication service carries an inherent risk of systemic loss ofservice. A system based on biometric readers that match against templates stored on thecard do not carry this additional and catastrophic risk of a single point of failure, andwould permit most transactions to continue.In summary a central biometric database system with online verification is much morecostly, much riskier in operation, and for example is extremely vulnerable to distributeddenial-of-service (DDoS) attacks on its authentication servers. Its sole advantage seemsto be the possibility of preventing individuals enrolling with multiple identities.The government has stated in support of the proposed scheme that one-third of terroristincidents involve multiple or false identities. But it would be logically fallacious to inferthat a system with unique non-duplicated identities could necessarily reduce theincidence of terrorism. Terrorists could continue to employ those modalities where theyhave operated under their real identities.Little benefit fraud involves false or multiple identities, ranging from 1% to 3%. Thevast majority involves misrepresentation of circumstances (undeclared income, housingbenefit ineligibility etc.). To bear down on benefit fraud, cross-departmental datamatchingcould be used to detect false statements of circumstances, and this would beeffective because inter-related claims must be connected through related identities.What has prevented this to date is a profusion of incompatible legacy systems that areunable to co-operate in data-matching cost effectively and reliably. Identification andidentity management systems are only a small part of solving this problem.More generally, the position in common law has traditionally been that use of an alias orpseudonym is lawful provided there is no fraudulent intent. Nevertheless, it isreasonable to ask if there is a risk that introducing an identity system in which multipleenrolment and a plurality of official identities was theoretically possible, could lead toan explosion in exploiting such a “loophole” for illegal purposes.However, such concerns can be obviated by adopting some simple principles ofcryptographic technical design, which are now being developed by IT vendors as677 Including, but not limited to, such as chained hash functions.