HC Deb 10 March 2004 vol 418 cc1578-82W
Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department what further consultation is planned with the public regarding identity cards. [156092]

Beverley Hughes

Since the six month consultation period on entitlement cards and identity fraud officially ended on 31 January 2003, consultation with the public has been ongoing via the despatch of the Next Steps publication to all those who responded to the consultation exercise, the identity cards website, and the recording of all public correspondence received.

A covering consultation paper will accompany the draft Bill on identity cards, which was announced in the Queen's speech. The paper will enable further consultation with the public as well as specific stakeholder groups on the detail of the Bill. This will be in addition to any pre legislative scrutiny by Parliament.

During this period there will also be opportunity to consult on the wider issues around how a scheme may work in practice. A communications strategy will be developed to ensure engagement with the public.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department if he will make a statement on the work of the Identity Cards Programme Board. [157007]

Beverley Hughes

As indicated in "Identity Cards: The Next Steps" (Cm 6020), the Identity Cards Programme Board has been established by the Home Office to coordinate and drive forward the different elements of the Government strategy. The board is chaired by the Permanent Secretary of the Home Office. Progress at every stage will be monitored and reviewed as further decisions are taken during the implementation. Before decisions are taken on implementation, there will be an intensive phase of feasibility assessment and prototyping so that decision making is soundly based and risks in the programme are kept to a minimum.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department if he will make a statement on the nature of the proposed national identity database; and what plans he has to use 2D barcodes to store the biometric template on identity cards. [157028]

Beverley Hughes

Data held on the National Identity Register will be basic identity information—such as name, address, date of birth, gender, immigration status and a confirmed biometric—and this will be set out in statute. Organisations using the National Register to verify identity will not be able to get to other personal information, for instance health or tax records, via the register.

At present there is no firm decision on the technology which will be used on the card. Technologies will be evaluated in how well they meet our requirements, in particularly in the areas of security, capacity and adherence to international standards.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department if he will make a statement on the work of the UK Passport Agency pilot scheme, including his assessment of the(a)popularity and (b)effectiveness of different forms of biometric identifiers. [157029]

Beverley Hughes

The UK Passport Service (UKPS) is running a six-month trial beginning in March 2004 to test the recording and verification of facial recognition, iris and fingerprint biometrics. Approximately 10,000 participants will take part in the trial. Results from the trial will help inform the Government's plans to introduce biometrics to support improved identity authentication and help prevent identity fraud.

The objectives of the UKPS biometrics trial include the following: to test the use of biometrics through a simulation of the passport process to include exception cases, e.g. people who may have difficulties in enrolment to measure the process time and hence estimate costs to assess customer perceptions and reactions to assess practical aspects of incorporation of biometrics into a biometric database to identify issues and risks and produce an outline implementation plan.

In relation to the popularity and effectiveness of biometrics in the context of the UKPS's trial, the work is largely based around recommendations from a report in August 2002 by the National Physical Laboratory (NPL) entitled: "Feasibility Study on Use of Biometrics in an Entitlement Scheme", and which is available on the Home Office Identity Cards website at www.homeoffice.gov.uk/comrace/identitycards.

UKPS already plans to introduce a passport with a facial image held in a chip from mid 2005. The NPL report was commissioned by UKPS and DVLA to examine the feasibility of using additional biometrics as a means of establishing a unique identity, to support better identity authentication alongside work on the proposed entitlement (now identity card) scheme.

The report discusses the most significant component of the cost of such a scheme as being the time and effort to enrol individuals and collect their biometric data (especially the impact of exception cases on throughput performance), and that this is one of the least well-understood aspects of biometric technologies. The report recommended further studies in this area.

It is this recommendation which lies behind the objectives of the current trials being conducted by UKPS.

In addition, and as published in "Identity Cards: A summary of findings from the Consultation Exercise or Entitlement Cards and Identity Fraud", UKPS carried out evaluation questionnaires during the demonstrations of iris and fingerprint biometrics in 2002–03. While not fully representative, the sample illustrated a positive attitude towards biometrics. For example, over 85 per cent. wanted to take the opportunity to establish their identity more securely using either fingerprint or iris biometrics, as long as the technology was secure.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department (1) what measures he proposes to deter access to a national identity database for improper reasons; [157031]

(2) how the national identity database will be monitored to detect a potential compromise of its security; [157032]

(3) if he will outline the risk management system proposed for the security of the identity card scheme; [157036]

(4) what measures will be in place under the current identity card proposals to ensure that the identity database is not vulnerable to hackers. [157038]

Beverley Hughes

The security and integrity of the database are integral to maintaining trust in the Identity Cards scheme. The specifications and design of the database and its security features have not yet been established but will take into account security advice from the earliest stages and the design process will include threat and vulnerability assessments. Threats which will be assessed will include unauthorised internal and external access to data.

Home Office officials are already working with security experts to ensure that security issues are considered from the start of the database design, and with other government departments which have similar databases with similar security needs, such as the United Kingdom Passport Service.

The Identity Cards Programme takes risk management extremely seriously and has developed its approach to risk management in line with Home Office best practice. The Programme Board and Ministers are considering the Governance arrangements for the ID Cards scheme and will consider what the risk management system should be in order to ensure the security of the Identity Card scheme.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department if he will make a statement on whether some categories of individuals have a higher failure rate with certain biometric identifiers; and what measures he plans to overcome this problem. [157034]

Beverley Hughes

In his announcement on 11 November 2003, my right hon. Friend, the Home Secretary stated that the Government have decided to begin the process of introducing a national identity cards scheme.

The first stage of the process will include work across Government to develop effective technology particularly on biometrics, and to introduce systems to ensure that biometric data can be collected, stored and used effectively. This includes a biometric pilot which is being run by the United Kingdom Passport Service (UKPS) to test the recording of face, iris and fingerprint biometric information.

One of the specific objectives of the UKPS pilot is to test biometric enrolment on a sample of people who may have difficulties with enrolment. Data gained from this pilot will inform the design of the Identity Card scheme's enrolment processes and procedures for enrolling those unable to provide certain biometrics.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department whether it is possible to combine data from the national identity database with other databases or information systems under the current identity card proposals. [157299]

Beverley Hughes

As set out in "Identity Cards: The Next Steps" (Cm 6020), the National Identity Register will be built from scratch as people are issued with identity cards and will not rely solely on other sources of data. Before an entry on the National Identity Register is confirmed, it will be checked against other databases such as passports, driving licences and immigration records.

Organisations using the National Identity Register to verify identity will not be able to get to other personal information, for instance health or tax records via the Register.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department (1) what action his Department is taking to prevent functionality creep in relation to identity cards; [158658]

(2) what study he has undertaken, in relation to his policy on identity cards, of the use by the US Administration of social security numbers; [158672]

(3) when a complete specification of requirements of the identity cards database will be available; and to what analysis this specification will be subject. [158710]

Beverley Hughes

The Government are aware of concerns about function creep. Our scheme will include safeguards to ensure that there is no extension of functions without proper justification and authorisation. Neither the statutory purposes of the scheme nor the range of information held on the National Identity Register could be extended without Parliament's authorisation.

During the development of the identity cards proposals officials looked at policy and practice in many different countries. The problems in relation to the US Social Security Number were highlighted in the Cabinet Office Identity Fraud Study which was published at the start of our consultation period. This was one of the factors which has led to the government's conclusion set out in "Identity Cards: The Next Steps" that the National Identity Register needs to be established from scratch and that checks on an identity need to be more stringent than those currently in place for passports and driving licences.

The specification of requirements for the database will be drawn up as part of the procurement process. The process will be subject to evaluation to assess how well our requirements are met, particularly in the areas of security, capacity and adherence to international standards. The timing of the procurement process is dependent on the legislative timetable.

Mrs. Curtis-Thomas

To ask the Secretary of State for the Home Department what assessment he has made of the ease with which encryption methods for identity cards can be upgraded. [159758]

Beverley Hughes

There are ongoing maintenance procedures which are a requirement of any encryption scheme. These include but are not limited to key issuing, certificate issuing, certificate revocation and technology upgrade.

Home Office officials are taking advice from cryptography experts within government on the design of the encryption scheme. The necessity for measures to permit maintenance and upgrade of the encryption scheme will be taken into account during the design.