Good news on ID cards?

From VNUNET:

Plans to use iris biometrics for the government’s national identity card scheme have been shelved because of cost and technical uncertainties.

I.e. they won't scan your eyes, but will still take your finger prints (even though some people don't actually have fingerprints due to genetic conditions and the prints also match up with Koala bears!). What about the plans for face scans (which only work if you're white and young)?

Also Not Saussure has stumbled across an article by Bruce Sneider which shows that the Yanks are no longer wanting facial and fingerprint scans, as the technology is too expensive and won't work! One of the reasons our Dear Leader is in favour of ID cards (see here for an article he wrote in the Telegraph, which I fisked) is due to US pressure, so now what will he do?

The costs of ID cards

From the Sunday Telegraph:
People would be fined up to £1,000 for failing to return a dead relative's ID card, while women who marry will have to pay at least £30 for a new card if they want to use their married name, risking a £1,000 fine if they do not comply.

David Davis, the shadow home secretary, said the fines revelation shows that the scheme "will hit the taxpayer not the terrorists" and is "just another Labour stealth tax".

He said: "It is shocking that the Government is considering charges and fines on people at some of the most sensitive times in life. The Conservatives would scrap this plastic poll tax and invest the savings in practical measures to improve security."

Joan Ryan, the Home Office minister, said that charges would apply "if a person wished to add a married surname to his or her register entry". Based on an estimate of 311,000 marriages a year, that would net up to £9 million a year for the Exchequer.

People would be charged at least £30 for lost or stolen cards. Based on the 930,000 driving licences lost or stolen each year, this would earn the Treasury more than £28 million a year, say the Tories.

In a separate plan that the Tories say could hit millions of students, Mr Reid admitted that applicants will be asked for "all current alternative addresses". Failure to update the register with details such as term-time halls of residence could result in a £1,000 fine.

Just another way to scam the public...

The Telegraph's leader column also states:

Terrorists act by concealing their intentions, not their identities: the three countries in the world that suffer most from terrorist violence [I'm assuming one of them is Israel] all operate ID card schemes.

If there is any doubt in your mind about the efficacy of the proposed system, ponder the following. The one group of people exempt from having to own ID cards will be foreigners who have been in Britain for less than six months. Recall this extraordinary fact the next time you hear a minister blathering about the need to tackle terrorism and control our borders.

ID cards don't prevent terrorism. When will the government take notice?

Not one, but three databases!

From the BBC:

The government has abandoned plans for a giant new computer system to run the national identity cards scheme.

Instead of a single multi-billion pound system, information will be held on three existing, separate databases.

Now the information will be spread across three existing IT systems, including the Department of Work and Pensions' (DWP) Customer Information Service, which holds national insurance records.

This might seem a good thing, but, one of the many reasons I'm opposed to the cards is the fact that the data will be linked together. all they're doing is swapping a big, independent database, for several smaller ones, all of which will be linked together - there's no real difference! On top of that, the information in the databases will have errors - what to do if the data in one conflicts with that in another?

Also, once again, the Tories and Lib Dems have the right idea:

Shadow Home Secretary, David Davis, for the Conservatives, said ... the decision to use existing databases was "an admission of what will turn out to be a financial disaster for the taxpayer".

He said Mr Reid "has tried to sneak this announcement out in a written statement that is not subject to scrutiny betrays just how fragile the government's confidence in their own scheme actually is".

Nick Clegg, for the Liberal Democrats, said: "These are sticking plaster measures in which the government is cutting corners to make the increasingly unpopular ID card scheme more palatable.

They can see what a disaster it'll be, why can't Labour?

RFID passports cracked!

From the Guardian:

"The information contained in the chip is not encrypted, but to access it you have to start up an encrypted conversation between the reader and the RFID chip in the passport.

"The reader - I bought one for £250 - has to say hello to the chip and tell it that it is authorised to make contact. The key to that is in the date of birth, etc. Once they communicate, the conversation is encrypted, but I wrote some software in about 48 hours that made sense of it.

"The Home Office has adopted a very high encryption technology called 3DES - that is, to a military-level data-encryption standard times three. So they are using strong cryptography to prevent conversations between the passport and the reader being eavesdropped, but they are then breaking one of the fundamental principles of encryption by using non-secret information actually published in the passport to create a 'secret key'. That is the equivalent of installing a solid steel front door to your house and then putting the key under the mat."

Within minutes of applying the three passports to the reader, the information from all of them has been copied and the holders' images appear on the screen of Laurie's laptop. The passports belong to Booth, and to Laurie's son, Max, and my partner, who have all given their permission.

Booth is staggered. He has undercut Laurie by finding an RFID reader for £174, which also works. "This is simply not supposed to happen," Booth says. "This could provide a bonanza for counterfeiters because drawing the information from the chip, complete with the digital signature it contains, could result in a passport being passed off as the real article. You could make a perfect clone of the passport."

"The problems could get worse when they put fingerprint biometrics on to the passports. There are established ways of making forged fingerprints. In the future, the authorities would like to have automated border controls, and such forged fingerprints [stuck on to fingers] would probably fool them.

"But what about facial recognition systems (your biometric passport contains precise measurements of key points on your face and head)? "Yes," says Grunwald, "but they are not yet in operation at airports and the technology throws up between 20 and 25% false negatives or false positives. It isn't reliable.

It takes around four seconds to suck out the information with a reader; then it can be relayed and unscrambled by an accomplice with a laptop up to 1km away. With a Heath Robinson device we built on Tuesday using a Bluetooth antenna connected to an RFID reader, Laurie relayed details of his son's passport over a distance of 10 metres and through two walls to a laptop.

There's more on Wired:

In other words, electronic passport theft is about as handy as regular, commercial identity theft. The real hell would come if the authorities didn't bother to stare at the passport but simply trusted the signal from the chip. Which was supposed to be the idea in the first place: these arphids are supposed to be making transit SAFER AND FASTER AND MORE CONVENIENT, not just introducing a new level of Rube Goldberg snafu.

If we simply returned to the security situation status quo ante on 9/10 instead of 9/11, it would be like the civilized world suddenly got over a massive, self-inflicted stupidity virus. Furthermore, we'd be a lot safer.

There's always hope...

The People vs ID Cards

From the Mirror:

[R]eaders of the Yorkshire Post were asked in a phone-in poll if Identity Cards should be made compulsory. Seventy-six [%] said "No", and 24 per cent said "Yes".

Tony's wrong about saying people support the things then...

Delays and extra costs

From Computer Weekly:

Computer Weekly has learned that the Identity and Passport Service is running more than a year behind schedule on an online passport system that is far simpler than the ID cards scheme and costs less than one hundredth of its price.

If they can't do it with something a lot simpler, what makes them think they'll succeed with ID cards?

No wonder the government's going to Court to overturn a ruling under the FOIA that it has to release it's costing of the ID cards project. It would also explain why the roll-out for ID cards to those of us who aren't Johnny Foreigner has been put back to 2009.

More technological problems with ID cards

From the Register:

The EU-funded FIDIS (Future of Identity in the Information Society) project has warned that implementation of the current generation of biometric travel ID will dramatically decrease security and privacy, and increase the risk of identity theft. In the Budapest Declaration, which derives from FIDIS' September meeting in Budapest, FIDIS calls for short-term damage control measures to be taken (because biometric ID is already being rolled out), and for "a new convincing and integrated security concept" to be developed within the next three years.

FIDIS points out that the new generation of biometric Machine Readable Travel Document (MRTD) is remotely readable at a distance of 2-10 metres, and that current security simply isn't good enough to protect it.

The most significant problems with these MRTDs are:

• Biometrics in MRTDs currently cannot be revoked and since biometric features of the users such as fingerprints and facial features cannot easily be changed, "stolen" biometrics can be abused for a long period of time
• The key to access data on the RFID tag is stored on the passport itself and can be read by humans and machine scanners.
• Eavesdropping of communication between RFID tag and reader
• Cloning of RFID tags in MRTDs
• Abuse of the remote readability of RFID tags in passports

Even more evidence against ID cards, not that Blair’ll listen of course…