Flaws in UK government ID Card scheme

Two news items this week point to major problems in the government's plans for an ID card scheme. First is the revelation, by Silicon.com, that the £4.7 billion scheme omits a rather important budget item, card readers. Freedom of information requests to the passport service have shown that there are no police stations, border entry points or job centres with card readers for the ID card's biometric data. "Once again ministers have shown that the ID card project is absolutely farcical. What is the point of spending billions of pounds on cards that can't be read in the UK?" said Shadow home secretary Chris Grayling.

Identity minister Meg Hillier, who claims the biometrics are a vital part of the ID card scheme, could give no time table for roll out of card readers and made it clear that each police force would have to invest in readers when they decided they needed them. Hillier also said that it was dependent on reader manufacturers to decide "whether it is worth their while to produce them".

This alone would be a major issue, but the lack of transparency of the entire ID card scheme was brought into stark relief by an European Network and Information Security Agency (ENISA) report on ID card security in Europe. The paper evaluated the security and privacy of ID card schemes around Europe and noted issues with contact-less cards. Although not noted in the press release, the report itself has some problems evaluating the UK's ID card scheme. It was for example, the only card scheme is Europe where it was "unknown" if the card had an electronic signature. It was also "unknown" if the primary data on the card could be changed, whether additional data could be written to the card and if "housekeeping" data could be written to the card. On privacy features, the UK scheme was listed as "unknown" for PIN based access control, symmetric key based access control, certificate based access control and encrypted data transmission.

The Identity and Passport Service (IPS) started issuing card in November 2008, initially to foreign nationals, and it's expected that 50,000 ID cards will have been issued by April of this year.

With so much unknown, at least to the public and ENISA, Hillier's hopes that manufacturers will be queuing up to produce readers for these cards, for organisations who don't have the budget to buy them, to cater for 50,000 people, could well be in vain.

(djwm)