Name Calling

One of the government's arguments for ID cards is to help prevent 'identity fraud'. And it is an issue for many people.

With many of life's 'transactions' taking place over the phone, by post, or through the Internet, there has to be some way of identifying the respective parties to each other. The ID card may help us open accounts with banks and the like.

But the main argument the government has is the benefit they derive from our having ID cards – they can keep track of us. However their plans are deeply flawed.

For rural dwellers the cost of obtaining an ID card will much more than we have to pay the government. For to have a robust ID card, the applicant has to show up in person to allow their identity to be verified before the new legal document – their ID card – can be issued.

To make an ID card a robust method of confirming identity, there needs to be a link between the card which shows the identity and the person whose identity it is.

Passports have for many years relied on a photo and a signature which could be checked to make sure that the passport you proffer is your own. Fingerprints could be carried on your ID card and be checked against your finger.

But after the 'Shirley McKie' case where a policewoman was wrongly accused on duff fingerprint data, this no longer seems a reliable enough method of linking ID card to owner.

So the government are planning to use retinal scan technology.

Each person has a unique pattern of lines in their eye that can be used more reliably than the traditional fingerprint to check who you really are. But the 'eyeprint' is rather difficult to capture.

The number of offices where you can go to be 'scanned' for your ID card will be quite limited. Probably no more than six in Scotland.

So there are long, and expensive, journeys in prospect for rural dwellers who will have to travel at their own expense to a city.

But of course having this data on your ID card is only of any use if it can be checked.

And that means having a machine scan and compare your 'eyeprint' with the one on your card.

If there are only six machines in Scotland able to issue your card how are the police, in Stornoway for example, going to be able to check your ID card?

And there is worse.

In their rush to race ahead with their ID card scheme, the government are choosing a technically insecure system. A much bigger issue than the civil rights argument about government storing our personal data in their databases and then abusing it. And that is a big issue.

Let me put it this way – would you like every commercial organisation you deal with to have a copy of your fingerprints, or a copy of your DNA profile – or of your new 'eyeprint'?

Almost certainly not!

Whenever you proffer your ID card for an 'eyeprint' comparison it will be necessary to extract the data from your card and compare it with your actual eye.

But it does not need to, and should not, work that way.

Think about using your cash card and PIN number at a cash dispenser.

You probably think that your PIN number is stored in the database on your bank's computers. No!

What they do keep is an 'encrypted' version. And every machine you key your PIN into 'encrypts' your PIN inside a special computer chip that self-destructs if it is tampered with. That data is sent to your bank where their computer simply says 'Yes' or 'No' depending on whether or not you actually keyed your PIN correctly.

So to check your PIN nobody needs to know what your PIN is. A neat trick that keeps your PIN a secret that is not shared with anyone who accepts your card for payment.

That is how the ID card should work if it were secure.

But in their rush, this government are racing ahead of international standards that would allow your card to work in the safe way that your bank card does.

We know that the Royal Bank of Scotland issued the first Cashline cards in 1977, the first Scottish bank with online cash machines, and were able use the system I have just described.

So were are talking a well-proven approach.

Technology decisions made in a rush are always bad decisions. And governments have exceptionally bad records with technology projects.

This is a project which will cost the same as 2,000 extra police in Scotland.

And one which will mean your sharing your private information with any commercial company you deal with.

Time for a rethink methinks.