BBC NEWS | Politics | ID card reviews 'to be published'

Peter Tomlinson ukcrypto at chiark.greenend.org.uk
Fri, 20 Feb 2009 13:15:17 +0000


Congratulations to those who pursued this.

And a little note of caution:

- These reviews are Gateway Reviews by OGC, in the days when such 
reviews were, I have been told by a number of people, a survey of the 
paper trail to make sure that it was all present and correct according 
to the Prince 2 methodology. And the information reaching me was that 
they did not review the technical or even organisational merits of the 
project in any way.

- In 2006, some emails were leaked. They showed that OGC was conducting 
a more in-depth review of the project, under what rules I know not, but 
OGC is an arm of Treasury. That review somehow resulted in the end 2006 
major change to the project, dropping the concept of re-registering 
everybody, and changing to the current architecture of linking two 
existing databases (DWP and IPS), adding biometric data as and when it 
is collected, and thus over a long period cleaning the data to create a 
register of people entitled to reside permanently here (perhaps another 
way of describing the qualification is to hold or have the right to hold 
a UK passport - I'm not sure of the exact criteria).

- In a system architecture diagram used by another reviewer 
(consultants), there was a port in the bottom left hand corner of the 
scheme system diagram for on-line connection of other govt depts and 
other trusted organisations. Despite being involved in discussions about 
this at various times from 2004 to 2007 (and also having been in a 
position to ask questions during 2008), never have I had any indication 
that HO is able to produce any information about how or when this port 
was or is to be implemented in order to provide for on-line verification 
of ID cards. Even today, with the first eResident cards out there for 
non-EEA nationals who have been given permission to reside here, there 
is no information about a method for secure verification by using the 
card online (not even through dedicated terminals) - all that is 
available is a call centre. Modesty forbids me to recount some of the 
things said about this problem.

- The proposed UK ID card is not an eID card (i.e. not for use on-line) 
(not unless there has been a change since I last was in a position to 
ask, which was in late October 2008, that is). Some 8 other EU 
countries, I am told, either have or intend to produce eID cards - and 
the EC is now active in trying to bring the various national 
specifications together (so is the supply chain for systems - there is 
money to be made).

Peter

Ian Batten wrote:
>
> http://news.bbc.co.uk/1/hi/uk_politics/7901383.stm
>