PA Consulting

[DaveB]

Biometric data. Once on the database, you can't say you're someone else. Gone are the cases of people claiming benefits under 15 aliases and terrorists having 3 or 4 different passports.

And where is this biometric data going to come from? What is the source that will be used to put it on the ID card to begin with? How will it be verified as being "mine"? What do I have to do to prove I am who I am in order to get thet biometric data accepted?


You are missing the point here. The flaw isnt that the cards can be forged. The flaw is that you dont need to forge one to being with.

If I turn up with a fake birth certificate, passport or other forms of ID. Fill in the form to get an ID card and submit my biometric data to be entered on the database against that false ID I get a valid, genuine ID card with valid biometric data on it that matches me as the card carrier but with completely false information as to who I really am.

[Incognito]

I am a DBA. If I were a naughty type, I could sell the DB to anyone/tinker with it for anyone, unless it was encrypted - and even if encrypted I bet I'd be one of the few (dozens, in reality) who had the encryption key, and there'd be loads of copies on USB keys, Post-Its, etc. In no time, the encyprtion key's worth nowt.

Safe data? No such thing because humans are involved.

Exactly, HUMAN error. Just like all the recent data losses that have occured have been down to HUMAN error. It is not down to flaws of the technology or ideal behind it. I have expressed all along that is your attack vector. And what you'll find is that the ID scheme will most probably require DV clearance to get anywhere near it.

If the system can detect that my biometric data appears more then once, then you have something. But since there will be tolerances in taking Iris, fingerprint and other metrics, chances are the system will be happy for me to have 5 ID cards, all with different names and addresses but broadly similar biometric values.

I would suspect that if you had more than 1 biometric value flagging within tolerance ranges then someone would most probably take a look at it. Similar Iris patterns yes, similar Iris patterns and fingerprint swirls, erm no.

We haven't been able to introduce this yet as all data that is imported to the system for passports and driving licences are non-persistent values. Biometric information will change that.

[DimPrawn]

Exactly, HUMAN error. Just like all the recent data losses that have occured have been down to HUMAN error. It is not down to flaws of the technology or ideal behind it. I have expressed all along that is your attack vector. And what you'll find is that the ID scheme will most probably require DV clearance to get anywhere near it.



I would suspect that if you had more than 1 biometric value flagging within tolerance ranges then someone would most probably take a look at it. Similar Iris patterns yes, similar Iris patterns and fingerprint swirls, erm no.

We haven't been able to introduce this yet as all data that is imported to the system for passports and driving licences are non-persistent values. Biometric information will change that.

Will every policemen have portable means of comparing the biometrics of the person in the street with what is on the card/database?

No, so when challenged, holding an ID will be taken as read that the person is legit.

The whole system is full of holes, and is unworkable.

[Incognito]

And where is this biometric data going to come from? What is the source that will be used to put it on the ID card to begin with? How will it be verified as being "mine"? What do I have to do to prove I am who I am in order to get thet biometric data accepted?

If I turn up with a fake birth certificate, passport or other forms of ID. Fill in the form to get an ID card and submit my biometric data to be entered on the database against that false ID I get a card with valid biometric data on it that matches me as the card carrier but with completely false infomration as to who I really am.

I don't know the answer to that, however it will only enter you on the system once, so who cares if you are or are not Joe Bloggs. The system has labelled you as Joe Bloggs. You will only be able to use the label from then on. When claiming benefits, hospital appointments, Immigration reasons, etc. However if you are a wrong 'un and the Police pull you I'm sure if you've been a wrong 'un for a while then I think it shouldn't be too long for the police to realise that Joe Bloggs isn't quite who he says he is and you will have to tell them you're Joe Bloggs as that's the only ID card you have.

[DimPrawn]

I don't know the answer to that, however it will only enter you on the system once, so who cares if you are or are not Joe Bloggs. The system has labelled you as Joe Bloggs. You will only be able to use the label from then on. When claiming benefits, hospital appointments, Immigration reasons, etc. However if you are a wrong 'un and the Police pull you I'm sure if you've been a wrong 'un for a while then I think it shouldn't be too long for the police to realise that Joe Bloggs isn't quite who he says he is and you will have to tell them you're Joe Bloggs as that's the only ID card you have.

It's not going to work if I have no eyes and cut all my fingers off is it?

[Incognito]

Will every policemen have portable means of comparing the biometrics of the person in the street with what is on the card/database?

No, so when challenged, holding an ID will be taken as read that the person is legit.

The whole system is full of holes, and is unworkable.

How do you know they won't? It's only a card reader and a datalink needed. What do you think ANPR does? That's not magic you know.

They might not even do that, they might just give it a cursory inspection and only do a confirmation back at the station if they have to take you in. At the moment the police only require you to produce documents within seven days if they stop you at the roadside. They can check against the dvla database at the roadside. What's to stop them doing similar with ID cards?

[Incognito]

It's not going to work if I have no eyes and cut all my fingers off is it?

True, you have defeated the system sir. Our country is at your disposal.

[DimPrawn]

How do you know they won't? It's only a card reader and a datalink needed. What do you think ANPR does? That's not magic you know.

They might not even do that, they might just give it a cursory inspection and only do a confirmation back at the station if they have to take you in. At the moment the police only require you to produce documents within seven days if they stop you at the roadside. They can check against the dvla database at the roadside. What's to stop them doing similar with ID cards?

You're missing the point (again).

I might hold a card that does not contain my biometrics. Unless the coppers measure my biometrics in the street, my card will checkout and I will walk on by.

Full of holes.

[Pondlife]

How do you know they won't? It's only a card reader and a datalink needed. What do you think ANPR does? That's not magic you know.

How big will the backpack be for the iris scanner? Or does it just clip onto their utility belt batman style.

[Incognito]

You're missing the point (again).

I might hold a card that does not contain my biometrics. Unless the coppers measure my biometrics in the street, my card will checkout and I will walk on by.

Full of holes.

No, the copper will have your ID number and whatever information you have provided. That will then be checked against the database and confirm that ID number does match up against Joe Blogss of such and such address who is 5 foot 10, male, white, blue eyes, etc.

That's all a policeman needs to do. At present a policeman does not take you down to the police station if you've been caught speeding until you prove your identity. There will be no need to in the future. There is a presumption for innocence before guilt in our country.

However, if you get in a fight in the pub and hit someone with a bottle and go down the police station, I'm sure the police will be able to query the National Identity Register against your DNA/fingerprints to make sure you really are Joe Bloggs of such and such.