NO2ID

http://www.consumeraffairs.com/news04/2 ... evolt.html

REAL ID Revolt Spreads to 33 States

By Martin H. Bosworth
ConsumerAffairs.Com

May 9, 2007

States are revving up their opposition to the "REAL ID" national driver's license program.

At least 33 states are pushing for laws or resolutions blocking the program, the Senate recently held hearings on its implications for civil liberties, and the Department of Homeland Security's own privacy department gave the initiative the thumbs-down.

...

Dissent At DHS

But even parts of the Homeland Security juggernaut are at odds over the implications of REAL ID. The Data Privacy And Integrity Advisory Committee issued a series of comments on May 7 on REAL ID, stating that DHS' prior efforts to address privacy and security concerns were insufficient.

"Given that these issues have not received adequate consideration, the Committee feels it is important that the following comments do not constitute an endorsement of REAL ID or the regulations as workable or appropriate," the committee wrote (pdf file).

The committee, chaired by DHS Privacy Officer Hugo Teufel, recommended stronger minimum security standards for states to adhere to, as well as limiting "secondary uses" of information collected from the REAL ID authorization process for drivers' licenses.

...

Security Failures

Privacy analysts and security experts have criticized the REAL ID act for creating new vulnerabilities for consumers to identity theft, fraud, and data breaches. The sharing of personal information across interlinked databases, collected through extensive gathering of "breeder documents" such as birth certificates and passports, and presented in public at motor vehicle agencies, represents a "gold mine" for hackers, fraudsters, and cybercriminals.

Security analyst Bruce Schneier, who also testified before the Senate Judiciary Committee, said that the security risks of the overall REAL ID database were "enormous."

"The daily stories we see about leaked personal information demonstrate that we do not know how to secure these large databases against outsiders, to say nothing of the tends of thousands of insiders authorized to access it," Schneier testified.

May I test a campaigning point?

Back in 2005, the LSEmade the important observation that common law countries like the US and the UK tend to dislike ID cards whereas few people's feathers are ruffled by them in countries like, say, Germany and Austria.

In a brief exchange on this matter, I was advised that the US REAL ID Act was not really (sorry) designed to introduce ID cards in the same way as our Identity Cards Bill (as it was then).

That was a sort of denial. After all, "if it looks like a duck, walks like a duck and quacks like a duck, then it just may be a duck" (attributed to Walter Reuther).

Why the denial? Because, for campaigning purposes, the idea was to mark out the politicians in the UK as unique among common law countries in wanting ID cards. "Unique" presumably was meant to equal "bad".

That is a poor argument. As is its converse. The government are always arguing that we have to e.g. move towards using biometrics because other countries are. Where is the logic in that? They speak Hungarian in Hungary. Is that a reason for us to speak Hungarian in the UK?

We would do well, I suggest, to argue less on the basis that the UK ID card scheme is unique. And we would do well to spend a bit more time, resources permitting, making common cause with anti-ID card campaigners in other countries.

I believe that the pressure point is biometrics. The biometrics being deployed in the UK and elsewhere are not reliable enoughto support the weight of expectations -- expectations that they can stop people registering duplicate identities and expectations that they can identify people reliably and quickly.

IPS in the UK ignore that point. After all, the US rely on these biometrics. And perhaps Italy relies on them for the same reason. Etc ... It's like the pile of tins in the supermarket. If we can get one senior politician to say the biometrics emperor has no clothes, then the whole pile could fall down.

After the initial shock, there would be great kudos for the politician who does that. I suggested it to John Reid. So much kudos, I suggested, that he could launch a bid for the leadership of the Labour Party on that basis. Another one of my success stories.

My campaigning point? Lobby in the UK and, as much as possible, abroad. It takes one Interior Minister or Treasury Secretary or Prime Minister, anywhere in the pile of tins, to point out that the biometrics emperor has no clothes and we are all wasting our money, to bring the whole pile down.

Secular_humanist has posteda link to a ... fuse-blowing article in today's Guardian which could be read in association with the campaigning suggestion "above" at 10 May 2007 09:50:30.

Sure. Always.



Brief exchange with who - someone at the LSE?



In 2005, and even now, REAL ID is intended to federate the US driving license - the effect of which may be to create a de facto ID card, as opposed to ID cards de jure as in the UK. While I agree with you and many others about the ultimate consequences, I'm not sure that academic precision should be equated to a "denial".

The clear distiction is that US wouldn't dare attempt to directly impose an ID card - and seems to be having a few difficulties taking the back door approach, as well...



"Uniqueness amongst common law countries" is not actually an argument that NO2ID does use a great deal - whatever people may post in the forums. It was a line both Liberty & the LSE put forward, and which we may have used earlier in the campaign. It most certainly wasn't a central plank or thrust of our argument.

"Uniquely bad" is more the line we take in this area, and this certainly does stand up to international comparison. If you get people to look at how other countries do ID cards, it throws into sharp contrast some of the decisions taken by our politicians - "more gung-ho about biometrics than the People's Republic of China", "centralising citizen data in a way that is constitutionally banned in Germany", etc. - and makes the important point that things don't actually have to be the way the Home Office says they do.

The point about 'the hand of the EU' is different, and not primarily about "uniqueness". The UK ID scheme is not being driven from Brussels - which, as you rightly point out, gets you no further to an actual explanation anyway - but there are clearly shared/common agendas.

Our international outreach is, as you acknowledge, limited by resources - but as of this week, NO2ID has registered supporters in 39 other countries and HQ is in direct contact with anti-ID campaigns and campaigners in the US, the Netherlands, Australia, Serbia, Japan and (through our extended network) privacy campaigners in literally dozens of other countries. "Creating common cause" is one thing, another immediate goal is to reach those in/from other countries who do not yet realise the impact that the UK ID scheme will have on them.



While you are absolutely right about biometrics not being up to the job, getting anyone in a position to do anything about it to admit that the emperor has no clothes is an immense task. For one, the vested interests are huge and go way beyond government.

Tackling biometrics within the context of the ID scheme is what we do, and will continue to lobby and brief on this basis - but we don't oppose biometrics (or any technology) per se. And, in the absence of being able to mount our own large-scale trials, we'll only get the chance to illustrate the fallability of biometrics when the government actually starts fingerprinting some people - probably next year. Claim and counter claim in the absence of evidence is unlikely to convince anyone.

Don't forget, the results of the 2004 UKPS biometric enrolment trial didn't put the government off. Nor did CESG's refusal to sign off on the use of biometrics within government, let alone on mass populations. HO has been forced to create its own 'biometrics assurance group' to rubber stamp whatever they do. Most ministers are technologically illiterate, and - while in office - committed to the government's course of action anyway.

I suspect it would take a lot more than one Minister or Prime Minister's statement to bring the whole biometrics pile down at this point. Most countries will comply with ICAO, US visa waiver and Schengen - even if they don't have to. The question is what would (minimal) compliance involve*, and which countries (like the UK) will use this as an excuse to drive forward their own internal programmes of population control?

--

*Putting, e.g. two fingerprints onto a chip on a passport, for the purpose of one-to-one matching only - i.e. "Is the pile of flesh in front of me associated with this document?", is certainly within the capabilities of current biometric technology. No NIR or ID interrogations required.

One-to-many matching to prevent multiple applications and 'identify' suspects is a dangerous fantasy. The politician who gets up and says this, and then applies it to their ePassport programme (and junks any plans for internal ID control) will save millions if not billions. But this person is likely to be someone who wants to get rid of the ID programme already...

Thank you, Phil, for your full and prompt response.


It would certainly help, I agree, if this politician was against ID cards for other reasons but my point is that all this politician actually has to understand is that 19 is greater than 1.

Everyone understands that 19 is greater than 1. Children. Journalists. The point could be conveyed on the News at Ten. Or on Newsnight. Can you imagine Paxman asking a Home Secretary over and over again, "do you or do you not realise, Minister, that 19 is greater than 1"?

It's an arithmetical point. It doesn't rely on opinion or bias or wishful thinking.


No, it isn't. That's just what the UKPS biometrics enrolment trial showed. 19% of the piles of flesh did not match the prints registered just minutes before.


Quite right. Neither do I. It is important to be precise. DNA seems to be reliable and traditional fingerprinting seems to be reliable but these new-style flat print fingerprints don't.


But the UKPS trial results are evidence. That's the point of doing the trial. As acknowledged by Atos Origin in their report on the trial when they recorded the 19% failure rate under Key Findings in the Management Summary.

They're not the only evidence. Every two years, the University of Bologna organises the global Fingerprint Verification Competition. No contestant has ever achieved the reliability required by the Home Office. They do better than UKPS. But then they're all PhDs working under ideal conditions. Take this technology out of the laboratory and give it to normal people and you seem to get back to 19%.

The Home Office may want 1% but they can't have it. It isn't there. It is unrealistic of them. It is wishful thinking on their part.

US-VISIT uses this technology and has done since 4 January 2004. The US Department of Justice reviewed performance after the first year of operation. They found that on average 118,000 people pass through US-VISIT each day. They are all subject to biometric checks, primary inspection, by computers. 22,350 of them fail and are referred to secondary inspection, by immigration officers. Guess what 22,350/118,000 is. Yup. 19%.

It's not the same 19% as in the UKPS trial. Some people are referred to secondary inspection because they are on no-fly lists or other watchlists or because officials have some other reason to be suspicious of them. I can't find a breakdown anywhere of the reasons for referral and there is no point guessing. But if the biometric failure rate is only 1% or less, then that means that 18%+ of US-VISITors are on watchlists or look suspicious, which would be extraordinary.

What I can tell you is that 92% of people referred for secondary inspection are subsequently allowed into the US. So whatever method the Department of Homeland Security are using to identify them is pretty ... blunderbuss.

I know that No2ID believe that biometrics are a "red herring". You may be right. But that doesn't matter. The point is that the government have repeatedly committed themselves to the ID cards scheme on the basis of biometrics. That is the unique selling point they have offered the public for five years (since the July 2002 consultation document). That is the glass jaw they are proferring. Let's clunk it, shall we?

I wouldn't say that we think biometrics are a complete "red herring" - though much of the technology associated with the ID scheme is little more than a McGuffin. The real issue, about state control of personal identity, is technology-agnostic.

Your reference to the University of Bologna competition is very interesting, but we have repeatedly used the UKPS trials as evidence over the past 3 years and referenced the failure of DHS/US VISIT biometrics. I'm afraid there may be a bit of 'old news' syndrome now attaching. I've even heard biometrics suppliers being very realistic about the performance of their systems in recent months to UK officials - its the ministers who don't want to listen.

When the next set of fingerprint trials start showing the 19% real world failure rate, we shall certainly have the ammunition to mount a full-frontal assault on the claims for biometrics - but at present, we must (and do) continue to work through the channels available to us, i.e. lobbying and briefings. And we have at least now left the days of Blunkett's "infallible" biometrics a long way behind...

The sad fact is that without a really obvious, timely 'hook' there's almost no chance of getting the sort of attention, and therefore pressure, required for the sort of 'about face' you (and everyone else) is looking for.

Thanks again.
Agreed.
Nothing to add.