I have severe concerns about the way we currently deal with the problem of identity verification, so it might seem that I'm a big supporter of the current plans for a national identity register and associated identity cards.
According to Government publicity, this will create a central system using robust biometrics – physical measurements of human features such as height, eye colour, fingerprints – which cannot be duplicated easily. Surely this provides an ideal identity-verification system?
In fact, the principle behind biometric ID cards is an almost ideal solution. The person needing to prove identity presents the card, measurements are taken at the point of verification and compared against the records held on the centralised national database.
Since the database is controlled by the Government, it would be far harder to create false identity tokens (items currently used to prove identity, such as utility bills).
However, I have serious concerns about the plan, some of them shared by colleagues involved in crime and security research, and partners responsible for checking compliance with relevant legislation, particularly the Data Protection Act and Human Rights Act.
When the national ID-card scheme becomes operational, we are told that every UK citizen will be issued with a card and have their details recorded on the database.
The card will carry a photograph and some basic printed details, along with a unique chip which will associate the card with the details held on the database. Only certain authorised agencies will have the equipment required to interrogate the national database.
Because the card is an official government document, it will carry great weight as an authoritative ID token and, I believe, will become accepted as the only item that anyone ever needs to present to prove their identity.
But consider the case of an independent electrical retailer – the sort of shop that sells everything from toasters to plasma TVs. These shops often operate as licensed credit brokers, able to lend money through an arrangement with a credit broker. In order to apply for a loan, there is a need for the applicant – the person buying the £4,000 TV – to prove their identity for credit-referencing purposes.
When the national ID-card scheme goes live, it is very easy to foresee a situation where the ID card is the only thing that needs to be presented in order to get credit for a high-value item that can be taken away immediately.
There is a problem with this: retailers will be neither equipped nor authorised to access the national biometric database. They will have to rely on the photograph and printed details on the card, with no way of checking the card's validity.
As a result, it will be very easy for criminals to produce high-quality fake cards and use them to steal high-value goods by obtaining loans fraudulently in someone else's name.
The obvious solution to this is to equip retailers to query the database, so that they can check the authenticity of ID cards
before completing the loan application.
Eventually, then, we could get to a situation where the ID card has to be presented for checking several times every day. This leads to the second concern.
Every time the database is queried, the time, date, location and purpose could be recorded – allowing the database to build up a complete picture of every movement made by its individuals.
As more agencies are granted access to the database, the number of transactions recorded will increase dramatically, to a point where we may no longer need CCTV, because ID cards are recording our every move.
Potentially, then, an innocent person could find themselves accused of consorting with known terrorists, merely because their ID card happens to have been used for a transaction where several suspects' ID cards have also been active.
The same concern also applies to the tracking of motor vehicles using automated number-
plate recognition (ANPR), or satellite tracking for road
pricing ("Mr Marshall, could
you explain why your car was parked next to a known getaway car at Woolley Edge services on the M1 on Monday night, please?").
Then there is the fact that, for
ID cards to work properly, the police or some other agency must be empowered to demand and check the card at any time, forcing us all to carry them at all times or face severe penalties.
Without this, criminals and terrorists will be free to move around the country without fear of being caught without a valid ID card.
And finally, as a thought experiment, some of my colleagues and I have conceived a way to bring the ID-card system to a halt using inexpensive equipment readily available from high street stores.
It would require a considerable number of volunteers, but we are convinced that anyone who is motivated enough would be able
to carry out this attack on a national resource quite easily, potentially crippling the UK through an attack which causes no obvious physical damage or harm.
The good news, however, is that this is a government IT project with a current estimated cost of £5.4bn.
Given the record of these large IT projects, which tend to suffer from "scope creep" – where more and more features are requested as the project progresses – we can probably expect that figure to treble and the project to be completed at least five-to-10 years later than predicted – and that is if it works at all.
Angus Marshall is a senior lecturer in forensic science at the University of Teesside and is currently involved in a research project on cyber-profiling with Hull and Sheffield universities.