Report - Guardian

The LSE Identity Project Report: June 2005 259At the same time, local identifiers have the important benefit of limiting the capabilitiesof service providers to create profiles of an individual’s activities with other parties. Apub owner does not need to know a customer’s name, birth date or birthplace but merelywhether he is of the legal age to consume alcoholic beverages. Previously a relationshipof trust would be established between the publican and the clientele; or a form ofidentity would be verified to ensure that the individual’s birth year is prior to thethreshold year. These means of identification involved natural segmentation thatensures that identity thieves can only do damage with specific providers where theyhave gained information on users of those providers.The transformation and reduction of local relationshipsThe envisioned national ID card would replace today’s local non-electronic identifiersby universal identifiers that are processed fully electronically. This migration wouldremove the natural segmentation of traditional activities. In the case of a pub, ifadditional information was disclosed, say through a national ID card, malicious staffcould steal this information, or this information can be abused in other ways. As aconsequence, the damage that identity thieves can cause would no longer be confined tonarrow domains, nor would identity thieves be impaired any longer by the inherentslowdowns of today’s non-electronic identification infrastructure. Furthermore, serviceproviders and other parties would be able to electronically profile individuals acrossmultiple activities on the basis of the universal electronic identifiers that wouldinescapably be disclosed when individuals interact with service providers.Ironically, the currently envisioned ID card architecture therefore has severeimplications for the security and autonomy of service providers. When the sameuniversal electronic identifiers are relied on by a number of autonomous serviceproviders in different domains, the security and privacy threats for the service providersno longer come only from eavesdroppers and other traditional outsiders. A rogue systemadministrator, a hacker, a virus, or an identity thief with insider status would be able tocause massive damage to service providers, could electronically monitor the identitiesand visiting times of all clients of service providers, and could impersonate and falselydeny access to the clients of service providers.In sum, the national ID system as currently envisioned by government poses threats tothe privacy of UK citizens as well as to the autonomy and security of service providers.While the card may well be acceptable for the internal needs of businesses that engagein employee-related identity management within their own branches, the privacy andsecurity risks of adopting the card as a national ID card for citizens would be high.A constructive way forwardFar less intrusive means exist for achieving the publicly stated objectives of the UKnational ID card. Over the course of the past two decades, the cryptographic researchcommunity has developed an array of entirely practical privacy-preserving technologiesthat can readily be used to design a better national ID card. The system would not needto be centralised and could build on existing societal relationships, to better ensuresecurity and privacy.