In 2005, when the Labour Party decided
to implement the National Identity Project (NIP) in the UK, it drew
severe criticism from many quarters, including the Tories, who later
scrapped the NIP after coming to power. A report by the London School of
Economics (LSE), which stated the project is “unsafe in law” and should
be regarded as a “potential danger to public interest”, was
instrumental in buttressing the arguments of those who opposed the NIP.
The report’s primary author was Dr Edgar A Whitley, a Reader in the
Information Systems and Innovation Group at the LSE and an expert in
identity, privacy and security issues relating to Internet-based
technologies. On a recent visit to Delhi, Whitley told Baba Umar
why such projects could be an intrusion of privacy.
Initially, the UK government was serious
about the identity project. Why was it abandoned later?
In May 2010, the Labour Party (which had introduced the ID card in 2005) lost the election. We ended up with a coalition of Conservatives and Liberal Democrats, both of whom had campaigned against ID cards in their election manifestos. When they decided to form a coalition government, they both reaffirmed their commitment to scrap the scheme. Certainly, the LSE report helped in supporting their stand but the concerns about ID cards also stemmed from the existing political perspectives of both the coalition partners.
In May 2010, the Labour Party (which had introduced the ID card in 2005) lost the election. We ended up with a coalition of Conservatives and Liberal Democrats, both of whom had campaigned against ID cards in their election manifestos. When they decided to form a coalition government, they both reaffirmed their commitment to scrap the scheme. Certainly, the LSE report helped in supporting their stand but the concerns about ID cards also stemmed from the existing political perspectives of both the coalition partners.
What about public opinion?
In terms of public opinion, the support for ID cards dropped markedly when people learnt more about the details of the project: you would have to be enrolled if you chose to renew your passport, there would be a cost associated with obtaining an ID card, you would need to be fingerprinted to enrol, etc. In the UK, fingerprinting has far stronger associations with criminality than other countries where, for e.g., it is used for voter registration.
In terms of public opinion, the support for ID cards dropped markedly when people learnt more about the details of the project: you would have to be enrolled if you chose to renew your passport, there would be a cost associated with obtaining an ID card, you would need to be fingerprinted to enrol, etc. In the UK, fingerprinting has far stronger associations with criminality than other countries where, for e.g., it is used for voter registration.
You said the LSE report helped in
buttressing the opinions of the coalition partners. What did the report
argue?
The report concluded that the project was too complex, technically unsafe, overly prescriptive and lacked a foundation of public trust and confidence. The proposals missed key opportunities to establish a secure, trusted and cost-effective identity system and the report considered alternative models for an ID card project that may achieve the goals of the legislation more effectively. The technology envisioned for this scheme was, to a large extent, untested and unreliable. We also estimated the likely cost of the 10-year rollout of the proposed project to be between £10.6 billion and £19.2 billion. This figure didn’t include public or private sector integration costs, nor did it take into account possible cost overruns. The report magnified the risk of failure in the proposals to the point where the scheme was insisted to be regarded as a potential danger to public interest and to the legal rights of individuals.
The report concluded that the project was too complex, technically unsafe, overly prescriptive and lacked a foundation of public trust and confidence. The proposals missed key opportunities to establish a secure, trusted and cost-effective identity system and the report considered alternative models for an ID card project that may achieve the goals of the legislation more effectively. The technology envisioned for this scheme was, to a large extent, untested and unreliable. We also estimated the likely cost of the 10-year rollout of the proposed project to be between £10.6 billion and £19.2 billion. This figure didn’t include public or private sector integration costs, nor did it take into account possible cost overruns. The report magnified the risk of failure in the proposals to the point where the scheme was insisted to be regarded as a potential danger to public interest and to the legal rights of individuals.
In India, the project was sold on ‘social
welfare and development’ arguments. What were the arguments in the UK?
This is one of the areas where the UK and India are more different. There were various justifications given for the scheme and they tended to vary over time. Indeed, for a while, our joke would be: “It is Tuesday, so the justification for identity cards must be to address identity fraud.” There was an element of security associated with the scheme, particularly in relation to making it more difficult/impossible for a UK citizen to obtain more than one passport. This makes it more difficult for them to travel in and out of the country under different identities). However, following the 7 July 2005 attacks in London, Home Secretary Charles Clarke (rightly) admitted that ID cards would not have prevented it (not least because the attackers were all UK citizens and so would have been entitled to an id card). The government also argued that the cards would address benefit fraud, despite the fact that such cases relate to a misrepresentation of circumstances.
This is one of the areas where the UK and India are more different. There were various justifications given for the scheme and they tended to vary over time. Indeed, for a while, our joke would be: “It is Tuesday, so the justification for identity cards must be to address identity fraud.” There was an element of security associated with the scheme, particularly in relation to making it more difficult/impossible for a UK citizen to obtain more than one passport. This makes it more difficult for them to travel in and out of the country under different identities). However, following the 7 July 2005 attacks in London, Home Secretary Charles Clarke (rightly) admitted that ID cards would not have prevented it (not least because the attackers were all UK citizens and so would have been entitled to an id card). The government also argued that the cards would address benefit fraud, despite the fact that such cases relate to a misrepresentation of circumstances.
What’s your take on India’s Unique
Identification (UID) project?
India’s scale (in this as in everything) is so completely different to the UK that I often find it difficult to comprehend. For example, I understand that 200 million people have already enrolled for UID. That is over three times the total population of the UK. However, these scale factors do have important consequences. For example, with enrolment, you need to delegate the process to lots of enrolment stations and you need to ensure that the quality (and security) of this process is maintained throughout the country and for all the millions of people who are going to be enrolled. Similarly, if you are going to do online authentication (i.e. sending Aadhaar number, name/biometric to the UID Central Identity Data Repository) then you will need to have lots of secure terminals (often in geographically remote locations with poor connectivity) and these will need to operate within a reasonable response time.
India’s scale (in this as in everything) is so completely different to the UK that I often find it difficult to comprehend. For example, I understand that 200 million people have already enrolled for UID. That is over three times the total population of the UK. However, these scale factors do have important consequences. For example, with enrolment, you need to delegate the process to lots of enrolment stations and you need to ensure that the quality (and security) of this process is maintained throughout the country and for all the millions of people who are going to be enrolled. Similarly, if you are going to do online authentication (i.e. sending Aadhaar number, name/biometric to the UID Central Identity Data Repository) then you will need to have lots of secure terminals (often in geographically remote locations with poor connectivity) and these will need to operate within a reasonable response time.
ID projects are working well in some
countries. Then why not in India?
Context is so important that you can’t just take a system that might work in one country and expect it to work in another. Here, issues of scale, levels of documentation — as I understand it, there are huge levels of poor/no documentation for many people — custom and practice: in Germany, you are expected to notify the local council within a few days of moving to a new town. As a result, the new town has a pretty good official record of who lives in their town that can become a source of “proof of address”. I suspect the British would never agree to be “managed” in such a way.
Context is so important that you can’t just take a system that might work in one country and expect it to work in another. Here, issues of scale, levels of documentation — as I understand it, there are huge levels of poor/no documentation for many people — custom and practice: in Germany, you are expected to notify the local council within a few days of moving to a new town. As a result, the new town has a pretty good official record of who lives in their town that can become a source of “proof of address”. I suspect the British would never agree to be “managed” in such a way.
You have been critical of the biometrics
part of the project. Why?
Not “critical” per se, rather we have raised concerns and claims that biometrics are not as perfect as some politicians and biometric vendors would like you to believe. We just want to make sure that any decisions taken about biometrics are based on an understanding of all the viewpoints, not just a subset of them. By definition, biometrics are never error-free. They all operate within particular performance levels and there is evidence (including from UID) about the problems of enrolment and verification of various forms of biometrics, for e.g. manual workers whose fingerprints might become worn over time.
Not “critical” per se, rather we have raised concerns and claims that biometrics are not as perfect as some politicians and biometric vendors would like you to believe. We just want to make sure that any decisions taken about biometrics are based on an understanding of all the viewpoints, not just a subset of them. By definition, biometrics are never error-free. They all operate within particular performance levels and there is evidence (including from UID) about the problems of enrolment and verification of various forms of biometrics, for e.g. manual workers whose fingerprints might become worn over time.
The government says UID isn’t compulsory
and it’s primarily meant to plug pilferage in welfare schemes. Isn’t
there a worry that it will be used for surveillance?
This question of compulsion is often tricky. It wasn’t compulsory to enrol for an ID card in the UK but if you (voluntarily) chose to renew your passport, you would be enrolled. The only way it was not compulsory was if you excluded yourself from travel by turning down a passport. In terms of pilferage in PDS, again this is a situation where the detailed evidence needs to be presented. Is most of the pilferage because of identity-related fraud — where a formal use of UID might address it — or does most of the pilferage happen at an earlier stage, i.e. before the food gets to the distribution point, whereby UID would have no effect?
This question of compulsion is often tricky. It wasn’t compulsory to enrol for an ID card in the UK but if you (voluntarily) chose to renew your passport, you would be enrolled. The only way it was not compulsory was if you excluded yourself from travel by turning down a passport. In terms of pilferage in PDS, again this is a situation where the detailed evidence needs to be presented. Is most of the pilferage because of identity-related fraud — where a formal use of UID might address it — or does most of the pilferage happen at an earlier stage, i.e. before the food gets to the distribution point, whereby UID would have no effect?
I’m not an expert on PDS, so can’t provide the evidence
on this. To some extent, the same ID number may be found in various
systems tracking the individual, so this might be an issue (see, for
e.g., webcast.gov.in/witfor opening plenary where Kapil Sibal (minutes
56-58) talks about tracking someone using Aadhaar but “not intruding his
privacy”).
Some critics tie the UID project to UN
Security Council Resolution 1373. They say these are UN-backed projects
that also include the formation of the National Counter-Terrorism Centre
in all countries (US and now India have it) to which information will
be fed by UID projects.
I don’t know enough about the details of this for a sensible comment, but I wouldn’t be surprised if the UID policy was completely unrelated to other ongoing policy issues such as counter-terrorism. That said, it is unclear how much direct benefit there would be in terms of counter-terrorism for collecting biometrics, names and addresses of large numbers of relatively poorly-documented individuals.
I don’t know enough about the details of this for a sensible comment, but I wouldn’t be surprised if the UID policy was completely unrelated to other ongoing policy issues such as counter-terrorism. That said, it is unclear how much direct benefit there would be in terms of counter-terrorism for collecting biometrics, names and addresses of large numbers of relatively poorly-documented individuals.
Baba Umar is a Correspondent with Tehelka.
babaumar@tehelka.com
babaumar@tehelka.com
