Draft Identity Cards Bill: Evidence to the Home Affairs Select Committee
Evidence from the volunteers at Stand.org.uk
Thursday, May 20, 2004
Stand is a voluntary group who seek to increase democratic involvement in the legislative process through the use of technology. In particular, we're interested in using the Internet to place Parliament and government in touch with informed citizens who have strong opinions, and long-standing knowledge, on issues regarding the Internet, new technology and the ramifications of the digital revolution.
Part of the rôle of Stand is to provide tools for concerned individuals of every political persuasion to provide their view directly, in ways and media convenient to our current democratic process. Another is to collate the concerns en masse that we receive from unaffiliated members of the public and seek to distil them in an aggregated form that might more easily be digested by the government's already overstretched civil service.
We responded, at not inconsiderable length, to the government's consultation, a year ago, into "Entitlement Cards and Identity Fraud". We submitted comments and concerns to every question the Home Office posed. Similarly, we are sure the Committee will recall our submission in January, after its request for comments on the Home Office's proposals. We were very grateful for the Committee's invitation to present oral evidence and were very disappointed that we were not able to take up that offer.
We continue to be disappointed that David Blunkett is continuing to introduce a scheme — particularly given that, when counting all the responses fairly, the individual comments raised by the initial consultation were overwhelmingly opposed to any such introduction and very few of the initial objections appear to have been addressed by the Draft Bill.
As we wrote in January, we welcome, cautiously, the efforts of the Home Affairs Select Committee to take a more independent look at the issue. We have been pleased to see the tough questioning the Committee has been given to all witnesses and look forward to reading the Committee.s reports on the matter.
This document is necessarily terse; we would like to remind the Committee — and any other readers — that, should they desire a deeper insight into our views on the whole issue, our original report, submitted in January 2003 to the Home Office Consultation, is available at http://www.stand.org.uk/StandIdCardReport.doc (400 kb, Microsoft Word format).
We are more than happy for any of our comments in this report to be made publicly available, in any forum. We ask that, in any citation, they be attributed to Stand.org.uk. This report is, as we have mentioned, a group effort, edited by Owen Blacker with some help from James Cronin, Yoz Grahame, Cait Hurley, Manar Hussain, Malcolm Hutty, Tom Loosemore, Adam McGreggor, Stefan Magdalinski, Danny O'Brien, Alaric Snell and Stuart Tily
This report is released under version 1.0 of the "Attribution-ShareAlike" licence, from Creative Commons. Readers wishing to see the full version of the licence should visit Creative Commons' website at http://creativecommons.org/.
It should be noted that any quotes from Oral Evidence sessions, held by the Home Affairs Select Committee on December 11, 2003, and May fourth, 2004, are taken from uncorrected transcripts and are under Parliamentary Copyright. The uncorrected transcripts also disclaim the following:
Any public use of, or reference to, the contents should make clear that neither witnesses nor Members have had the opportunity to correct the record. The transcript is not yet an approved formal record of these proceedings.
Readers viewing a printed copy of this document should be aware that italicised and underlined text is hyperlinked in electronic copies and that further reading is available on these subjects. If no electronic version is at hand, a full copy should be available for download from our website at http://www.stand.org.uk/, provided the Home Affairs Select Committee does not object to us publishing this document more widely.
Addendum to online version: Some minor edits have been made from the Word version, in order to make this version flow better on screen. All of these edits are merely cosmetic and they mainly affect the way some hyperlinks have been presented, which was optimised for printing in Word. In the event of any confusion, the Word version should be considered definitive.
Evidence to the Committee
1. We have some grave reservations with some of the clauses in the Draft Bill. There are a few points that do, however, give us some succour. We have tried to comment on all of these, though this document should not be considered an exhaustive list of such points.
2. Our primary objection to the Draft Bill is that we do not believe that, if the scheme is necessary at all (which we would contest), that any clauses should be included in it for the future introduction of compulsion. A compulsory ID card scheme would represent a fundamental change in the relationship between citizen and state in the UK, particularly given our Common Law heritage and our lack of a codified constitution.
3. It is our firm belief that compulsion should only be considered after a substantial period of reviewing any system actually in progress and an informed evaluation of such a scheme to date. As such, we believe that any introduction of compulsion should be handled by a full Parliamentary Act, with the all the debate and committee procedures that would entail.
4. Only a new Act could allow for the appropriate quantity of debate and only this would provide the appropriate opportunity to amend the original Act in ways that might be difficult to foresee now but which might be necessary at such a time. We do not believe the Home Office's strange invention of a "super-affirmative order" process, mentioned in clause 7, would be able to provide this necessary — and healthy — level of legislative oversight.
5. As such, we would like to see clause 6 replaced, in its entirety, with an explicit interdiction on any requirement to register until the clause is repealed by a future enactment.
6. If clause 6 stands, we still have concerns about the vagueness of its wording. That the Secretary of State can require any arbitrary group to register for cards has an overtone with which we are profoundly uncomfortable. We believe that, if the clause really must remain, the wording definitely requires review.
7. Similarly, we have considerable difficulties with clause 15, which allows for public services to require production of ID before service provision. Recent reportage of proposals to require nurses to alert managers to asylum seekers unentitled to receive healthcare (reported in last week's Observer) suggest that service providers are likely to be very hostile to such demands. Indeed, a former chair of the BMA's Ethics Committee has said the same thing, as we mentioned in our original Consultation response. This is another clause we believe should be removed to some potential future Bill.
Compulsion by the backdoor
8. On a related note, we object to the provisions of clause 8(6), which requires anybody applying for a 'designated document' also to apply for an ID card, even if they object to the scheme. If the Home Office is so confident in the public's level of support for their proposals, we wonder why they feel the need to insist that even objectors must acquire ID cards during any non-compulsory phase. If ID cards are genuinely to be discretionary for the first phase after introduction, those people who disagree with the scheme should not be forced to obtain one simply because their passport or driver's licence requires renewal.
9. We share the public's deep concerns both with the whole concept of the civil penalties envisaged by the Draft Bill and the proposed levels of such penalties — according to a recent YouGov poll, 61% of under-30s are opposed to these fines. We believe £1000 for failing to notify the Home Office of a change of address seems onerously high, particularly given that nearly half the respondents to the same poll were unhappy with that information being included in the scheme in the first place. Repetitive fines of £2500 seem similarly disproportionate for non-compliance with such a controversial scheme.
10. Certain readings of clause 12 could suggest that a £1000 fine would be in order should a change occur in an individual's biometric data. Irises certainly change infrequently; it is still our contention, however, that this means of biometric scanning is too unreliable and impractical to be definitive for any ID card scheme. Fingerprints, though, can change very frequently; we hope the Home Office is not proposing that fines be levied should someone forget to tell them about a kitchen accident, for example.
11. Our main concerns regarding biometrics, predictably, though, are related to the immaturity of the technologies involved. Firstly, we believe it is worth bringing the Committee's attention to some comments made about biometrics by Bruce Schneier, a leading cryptographer and technologist in the US:
12. It is worth adding that whilst that article is now over five years old, the state of the art has not rendered any of the assertions invalid. Far from it, indeed: subsequent developments mean it is now possible to 'fool' biometric scanners for all three suggested technologies. For more details of these exploits, we recommend articles on ComputerCops.biz, heise.de and in Crypto-Gram.
Reliance on secondary legislation
13. We are also very worried by the number of details that may be changed by the Home Secretary by secondary legislation — including which data may be stored about an individual and even the minimum age of eligibility. Whilst we are aware that it has become commonplace for much of the implementation of enactments to be deferred to statutory instruments, we believe that any alteration of such fundamental parts of a scheme that has such an impact on the relationship between citizen and state should not be left to a process that receives substantially less legislative time and where it is near-impossible to prevent an Order from being passed — we believe only three times in Parliamentary history has an SI been defeated.
14. This leads us on to related concerns regarding oversight. Many of the powers given to the Secretary of State (cancellation of cards, issuance of fines and the like) would appear to suffer no oversight other than that of the Commissioner to be established under clause 25. We remain to be convinced that such a commissioner would be particularly protective of individuals' concerns — to whit, we would point to conversations on the UK Crypto discussion list about the similar commissionerships, notably a post by Simon Watkin and a response by Ian Batten — but, in either case, we would hope that there might be some judicial oversight in the form of a court hearing for many such prerogatives given to the Home Secretary by this Draft Bill.
Data sharing and data integrity
15. There are several parts of the Draft Bill where information is to be shared between different bodies. We understand that this is part of the whole point of an ID card scheme and remain to be convinced either that such widespread data sharing is in the interest of the general public or that it complies with Data Protection Principles. We are pleased to see that, according to this week's Computer Weekly, the Office of the Information Commissioner still believes there are "many serious questions that need answering about the government's proposals".
16. In addition to more general disquiet regarding data sharing, there are specific points about data integrity that appear to have been overlooked by the Draft Bill. Clauses 11 and 22, for example, both provide powers to share information without there being any requirement to ensure the accuracy of these data.
Data disclosure without notification
17. The Draft Bill contains, in clauses 20 and 21, powers to allow intelligence and law enforcement agencies to access all of the data held in the National Identity Register about an individual. These powers in themselves could do with better oversight, in the same way as we commented above with regard the powers assigned to the Secretary of State.
18. We are notably concerned, however, that disclosure may be made to the intelligence services — and, when dealing with 'serious crime' (meaning, effectively, any crime for which a 21-year-old with no prior convictions could expect a gaol term of three years or more), to just about any organ of state — of the 'audit trail', which would provide full information about every ID-card–reliant public service accessed by the individual in question. We are especially worried about the impact this could have on doctor/patient confidentiality — particularly so with regard anonymous-access services such as genitourinary medicine, for example. We believe this poses a peculiarly severe intrusion into an individual's privacy and should be allowed only in the most exceptional circumstances, if at all, and with judicial oversight, at the very least.
19. We are certain other groups will better be able to comment on the race issues in relation to the government's proposals, so this section of our response is especially terse. We do believe, however, that the government's assertions about the race equality impact of a scheme, made in Annex C of "Legislation on Identity Cards: A Consultation", are without foundation and optimistic, at best.
20. The government notes that "the scheme must have due regard to […] good relations between people from different racial groups", yet we see absolutely no evidence of this, either in the Draft Bill or the accompanying consultation document. Particularly, given that one of the claimed justifications for the introduction of these proposals is directly related to the issues of immigration and asylum, we find it hard to believe that middle-class, white people are likely to be asked to prove their entitlement to public services as frequently as people from ethnic minorities, for example. We would suggest that this issue merits substantial further attention.
Freedom of association
21. We are concerned over the potential for 'guilt by association' implicit in the concept of ID cards. Given the flagrant over-use of anti-terrorism powers against legitimate, peaceful protest recently, we are anxious that friends of protesters asked to provide ID may be treated unfairly, simply because they happened to share a car with them, for example.
22. We were dismayed to note that the Home Office has, yet again, chosen to hide most of the technical details of any scheme behind the cloak of "commercial confidentiality". We do understand that private sector involvement means that some details are particularly sensitive to competing tenders; however such details — notably security and infrastructure arrangements — are so important that we feel, at the very least, that ballpark details should have been provided.
23. Until such time as even vague particulars may be provided, the proposals cannot properly be evaluated — to the benefit of the Home Office, which continues to insist that we should trust their good faith, but to the detriment of open debate and a fair assessment of the minutiæ of the scheme. As is often the case, the devil is in the details and such obfuscation from Queen Anne's Gate is unhelpful, at best. With such an appalling track record of public IT projects behind it, we feel that relying on the public trusting their good faith is surprisingly naïve.
Data held in the National Identity Register
24. We do not believe that all the data listed in Schedule I (which, we note, can be changed quite easily by Order from the Secretary of State) are necessary or appropriate for inclusion in any ID card scheme. It is our contention that many data categories in this Schedule have been included primarily for the purpose of facilitating data sharing, as discussed above, or to meet the purported needs of law enforcement. The desires of law enforcement to gain easy access to such data seem particularly ironic, given the circumstances in which the last ID card scheme in Great Britain was abolished.
25. It would seem that, whilst nobody is quite sure why an ID card scheme is being proposed (is it terrorism? is it immigration? is it benefits fraud?), there are plenty of things that might actually be useful that are being ignored. The Home Office seems insistent that they have no interest in introducing some Orwellian scheme to monitor British residents, yet the Draft Bill goes into a lot of detail about allowing intelligence and law enforcement access to the National Identity Register and eschews the opportunity to create a public key infrastructure for digital signatures, for example. If the Home Office really does feel there's the need to introduce an ID scheme — which we refute — it might behove them to make the scheme actually useful to cardholders, otherwise it lends the impression that benefiting the citizen isn't actually a priority for Queen Anne's Gate.
26. There are other resources to which we would like to draw the Committee's attention. Notable among these are an excellent article by technology news website The Register, entitled "Everything you never wanted to know about the UK ID card", which summarises many of the issues presented by the government's proposals, and an essay by leading cryptographer Bruce Schneier, published in his monthly Crypto-Gram newsletter.