Newropeans Magazine - An electronic identity card for the UK ...
8 May 2006 ... The proposed UK scheme will resemble those in countries such as ... The big difficulty the UK faces is it has to take two steps at once. ... The register issues unique identifiers for each Belgian citizen ... Dr. Martin Meints, Independent Centre for Privacy Protection Schleswig-Holstein, Germany: ...
www.newropeans-magazine.org/index.php?...id...89 - Cached – Similar
| An electronic identity card for the UK - European perspectives |  |  |
| Written by Stephen Gardner | |
| Sunday, 07 May 2006 | |
| The UK government finally reached an agreement with the House of Lords on the Identity Cards Bill on 29 March, after a bruising battle which saw the Bill rejected in the upper house five times.  The UK has no history of identity cards, apart from temporary schemes during the first and second world wars, but can look to a number of other EU member states for guidance.The proposed UK scheme will resemble those in countries such as Austria, Belgium, Estonia, Finland and Sweden. Belgium's is perhaps the most similar. It has mandatory identity cards linked to a National Register controlled by the Interior Ministry. Around 2.4 million eID cards had been distributed in Belgium by March 2006. However, there are also significant differences. First there is the question of scale: Belgium has 10 million people, compared to 60 million in the UK. Second, the UK will aim for quick implementation from scratch, whereas Belgium has a history of identity cards. Third, the UK National Register will collect far more information than Belgium's, including biometric identifiers, which the Belgian register currently does not incorporate. Euro-correspondent.com asked five eID experts in Belgium and other European countries for their opinions on the UK proposals. The local services provider Bud P. Bruegger, ID specialist, Comune di Grosseto, Tuscany, Italy: Many countries have population registers; only a few are decentralised. In Italy, for example, local authorities are responsible for population registers. A central infrastructure is easier to manage in many ways but distributed systems seem to be more precise – local authorities are closer to the citizen. The big difficulty the UK faces is it has to take two steps at once. Other countries now issuing eIDs have a long tradition of identity cards and population registers. The social/political component of making the change is much more problematic than the technical/financial component. The service aspect of eID is not obvious until a critical mass is reached. Without this, securing services just won't work. However, with the increasing importance of online services – public and private – we absolutely need eID cards. We are at a critical point where transactions protected with just a username and password are increasingly risky. eIDs are an important part of the answer. The European good practice perspective Baudouin de Sonis, Coordinator of the European Commission funded Promote eGovernment Good Practice Portability (PPP) project, which has a specialised eID component: The UK's proposed National Register approach offers some advantages: ease of rollout of the cards, and more straightforward digital rights management and training of civil servants in charge of issuing the cards. Other approaches imply numerous partners and greater effort in terms of integration and coordination. The position of the UK Information Commissioner should be considered from the outset. In the PPP project, we realised there is a strong link between the maturity of such bodies and public acceptance of the card. However the amount of information to be handled by the National Register and eID in the UK is very large, and may be seen as a 'Big Brother' attack. Overcoming this needs market validation and an extensive marketing campaign to explain the potential and real benefits of eID. I am convinced that security is not a strong marketing argument, but that new services and modernisation of relationships with the administration are. The technical details Danny De Cock, Researcher in Applied Cryptography, Katholieke Universiteit Leuven, Belgium: Belgium created a National Register of natural persons in 1983. The register issues unique identifiers for each Belgian citizen in the form YYMMDDNNNCC, where YYMMDD refers to the date of birth of the citizen, and NNN is an even number for females and odd for males. CC is a checksum so errors can be detected when processing the number automatically. The register also keeps track of current and past addresses and keeps a record of all the citizen's identity-related documents: passport, driving licence and so on. A mistake was made in Belgium by including the structured register number in the certificates stored in the electronic ID card. This is something that must be avoided: the number leaks too much information about the citizen – gender and age. The only biometric included on Belgian eID cards is the holder's photo, which is about three kilobyte in size and not suited for automatic recognition of the cardholder. Correct implementation of biometric features is a very complicated issue, and may not be realistic and cost-effective. [In comparison to the UK proposals] the Belgian eID card costs about €12.50, including the chip, maintenance of the infrastructure and two certificates per cardholder with a validity of five years. The critical comparison François-Xavier Chevallerau, eGovernment consultant and former editor of the European Commission's eGovernment Observatory: The UK eID scheme seems out of proportion with comparable projects in Europe. It is moving from one extreme to another: from no ID card to implementation of the most complex, sophisticated and potentially intrusive eID infrastructure in the western world, collecting and storing an unprecedented amount of personal data. Given the UK government's track record with large-scale IT implementations, a lower profile project or incremental approach might have been preferable, rather than a scheme making extensive use of biometrics, the maturity and suitability of which for personal identification remain questionable. The government has had to oversell the scheme, citing terrorism and other issues, in order to overcome traditional strong opposition in the UK. This overselling carries a political risk because there is little evidence ID cards will significantly contribute to tackling illegal immigration or terrorism. An ID scheme is primarily an instrument for making peoples' lives easier, even if it implies a degree of state control. In most of continental Europe, this is accepted and it is part of the state's role to guarantee personal identity. The situation is quite different in the UK and the scale of the UK scheme is perhaps partly aimed at providing a wider justification for ID cards. The privacy expert Dr. Martin Meints, Independent Centre for Privacy Protection Schleswig-Holstein, Germany: From a privacy point of view, the main issue in addition to the data-minimisation principle is the purpose-binding principle – data should only be collected and used for a specific purpose. In most countries such as Germany, ID cards are used to authenticate citizens against authorised authorities only. In addition ID cards are used in the private sector to confirm identity, for example, when renting a car. In Germany, at least for the police and military forces, data protection principles apply. Germany has different databases which are not linked, managed by different authorities. These databases have well defined purposes and corresponding access controls, for example for police officers. The corresponding data are not included on the ID card; there is online access to the database only. In the UK, eID cards are proposed as a tool for national security, crime prevention, immigration control and prevention of unauthorised working, as well as for access to public services. Some of these planned purposes relate to the so-called “third pillar” (including state security), where the European Data Protection Directive 95/46/EC with its fundamental principles does not apply. The UK eID scheme aims to link different identifiers, such as immigration, work, national insurance and passport IDs, in different contexts. Depending on the legislation, this may not conflict with the European Data Protection Directive. This has security implications, as unauthorised reading of an ID card could uncover all the linked partial identities of the cardholder. This potentially makes ID theft much easier due to additional context information. The UK scheme is ambitious compared to other national ID card implementations. Compared to a decentralised scheme, a centralised solution potentially offers cheaper operation of the central database, whilst planning and building might be much more expensive. It is difficult to say where the break-even point of the centralised solution compared to the decentralised one might be. |
