Clarke's ID card cost laundry starts to break surface
By John Lettice
Published Tuesday 5th July 2005 09:53 GMT
http://www.theregister.co.uk/2005/07/05/id_laundry_analysis/
Analysis Growing public concern over the cost of ID cards forced price
concessions of sorts from Home Secretary Charles Clarke last week, but these
leave the Home Office facing the prospect of an ever-widening money hole as
the total cost of the scheme climbs. On the basis of the current cost
estimates of £93 for passport and card, and £20-30 for a standalone card a
hole probably exists already, and we're beginning to see clues as to how the
Home Office proposes to plug it - it will do so via a cost laundering system
we'll be seeing a lot more of as the scheme progresses.
On the morning of last week's Commons debate on ID cards, which the
Government won with a reduced majority, Clarke indicated to BBC's Today
programme that the Government would be developing sources for income for the
ID scheme. "The question of what the charging regime would actually be
depends on how much income we bring in from other sources and other
departments," he said. Significantly, he had earlier cited Criminal Records
Bureau checks as an example of how useful ID cards would be. During the
debate itself he elaborated on this: "The actual charge will be determined
by the Government at the time of introduction, depending on the business
plan for the card's introduction. It will include, first, the cost of
producing the card following the tender process; secondly, it will include
the income in respect of driving licences or the Criminal Records Bureau,
for example, which we could use to deal with the costs associated with the
card." Spookily, although the Criminal Records Bureau hadn't figured
anywhere obvious in the Government's ID plans until last week, at his
Wednesday press conference Tony Blair piped up: "Just to give you another
example, for the Criminal Records Bureau, which after all hundreds of
thousands of people have to go through the whole time [what, like Sisyphus?
- Ed], it takes something like four weeks to do an identity check, it would
take three days with an identity card."
Blair did not explain why an identity check would still take three days in
the brave new world of online biometrics, while for Today Clarke confined
himself to saying it would reduce the time dramatically. The point however
is that the CRB has popped into some wonk's head as both a useful source of
income and a shotgun evangelist for the ID scheme. Those looking for a job
in a school might well contemplate previous delays and difficulties in
getting clearance through the CRB, and consider the ID card a bargain.
Schools, whether they want to pay for ID card checks or not, won't have a
lot of choice once potential employees start presenting them as ID.
One is drawn to the conclusion that Blair and Clarke's sudden deployment of
the CRB in their case is not entirely unconnected with the need to pay for
the ID scheme. The CRB would be a small but steady source, but the size of
the revenue stream could possibly be increased simply by widening the
requirement for employers to make Criminal Record Checks. Similarly,
employers' requirement to check employment eligibility will produce revenue
and stimulate ID card uptake. Employers won't be able to demand an ID card
until they're compulsory, but potential employees may well find it a lot
easier to get a job if they fall in with the system. And previous Home
Secretary David Blunkett, in a speech last autumn, made it clear that once
the ID card existed he would see little justification for employers to fail
to use it to meet their legal requirements.
Clarke's reference to "income in respect of driving licences" is also
interesting. According to Blair "people are already looking at, for example,
whether it is not possible to get some of the information you need for your
driving licence and this type of thing by use of the identity card", so
although it won't be permissible for organisations to require production of
an ID card until they're compulsory, here also we could have a case where
things happen faster with an ID card, and the ID scheme gains revenue
through their increased use. Blair's wording is characteristically fuzzy,
but we could possibly interpret "get some of the information you need for
your driving licence" as implying a series of database links being used to
assemble the components of a licence application.
In the real world, of course, things won't necessarily happen faster with an
ID card. Considering the Government's track record (the CRB being a
particularly grisly example) the promises of greater speed and efficiency
remain open to some doubt; but remember we're talking about where the
Government thinks it can squeeze money here, not about where it's actually
going to. And the spectacular delays in past CRB record checks were not
entirely unconnected with the Government's inability to manage database
systems effectively; this has not however stopped Blair and Clarke using the
historical mess as an argument in favour of their (probably imaginary)
super-efficient future.
Although the Government hasn't been specific about the income from "other
departments" it must now have a pretty clear idea which departments are
going to have to contribute, if not about the precise levels of
contribution. Some charges can be absorbed by the individual departments,
while others can be passed on directly to the public (which is paying all of
them anyway, one way or another), but there are areas where direct charges
may be politically difficult. Charging people for dying, for example, might
not be popular, but nevertheless we can't altogether rule it out. As far as
Government departments are concerned, one can envisage the National Identity
Register as acting as a kind of gatekeeper deriving an income per
transaction, while the consequent increasing 'popularity' of the ID scheme
will mean the number of transactions will steadily increase.
On the evidence of Blair's press conference, the Government may also be
looking at online services as a potential source of income, despite the fact
that a biometric ID card isn't a lot of use online. The Government did
however rule out the inclusion of a digital signature in the card on the
grounds of cost in the entitlement consultation, so unless this has changed,
the only way the card could operate online is by use of a pin number.
According to Blair, "at the moment if you want to get your medical records
online, you can't because of worries over identity. You would be able to do
that" with an ID card, he said. He failed to explain how you would be able
to do that, but his bringing the subject up suggests that the Government is
considering tying online health record access to ID cards. Without further
development specifically aimed at online identification, the ID card at them
moment would have to use a pin number, and is about as secure as a credit
card (or less so - if you're going to have a card stolen, which would you
prefer, ID card or credit card?).
The contribution of private industry, Clarke's "other sources", is less
clear, and during last week's debate Clarke, stressing that information on
the NIR would not be for sale, placed limits on what could be done. "With
the consent of the identity card holder - I emphasise that - banks or other
approved businesses will be able to verify identity by checking an ID card
against the national identity register," he said. "That would mainly involve
confirming that the card is valid and has not been reported lost or stolen,
and that the information shown on it is correct. The card holder's biometric
details may also - with the card holder's consent - be confirmed against
those held on the register."
These are not however limitations that need greatly impact the ID scheme's
ability to make money from the private sector. If NIR checks prove valuable
for, say, financial service providers, then they will require customers to
give them permission in their application forms. And ultimately the service
providers may not have a choice. The Government has stated at various times
that it feels ID card reading capability could be built into future
generations of credit card reader and ATM. This is not a prospect likely to
attract the banks and credit card companies right now, because from their
point of view the current chip and pin system provides an adequate balance
of convenience and security, and ID cards would simply introduce an extra
complication. A simple local check of the validity of the card wouldn't
establish the bearer's identity (it could be somebody else's credit and ID
card and might convey a false sense of security to retailers), while online
checks of biometrics would likely lead to false refusals, and thus reduced
trade (and at the ATM, could raise the prospect of severed fingers).
But although the financial and retail sector is not going to volunteer for
ID cards, there are areas where it could plausibly be volunteered. ID theft,
which in this case is largely what we used to call credit card fraud,
impacts on the individuals whose card/identity is stolen far more than it
does on the credit card companies, so the public's concerns about ID theft
could be harnessed to impose proof of ID requirements on the credit card
industry. And once ID cards exist and are widely carried, the Blunkett
principle that they constitute a simple and secure method for establishing
ID, and therefore there's no excuse not to demand them, might be extended to
retail. A legal requirement for proof of ID for transactions over a certain
value could be implemented in the name of combating card fraud.
Not all of this will happen immediately, but the pressing and growing need
to finance the ID scheme while keeping the cost of the card down to
politically acceptable levels will mean that the Government will strive hard
to establish revenue sources early on in the scheme. From the point of view
of the individual, though, a card cost of 'only' £30 will be nothing to
cheer about. Other costs incurred by Government will be paid for via direct
transaction charges and taxation, while the involuntary contributions made
by industry will be passed on to the consumer. Economically speaking, if the
ID scheme does not deliver savings and efficiencies to match its overall
cost (which could quite easily exceed £20 billion), then we will be sucking
a huge amount of money that would have been better spent on wealth creation
out of the economy. 'Only' £30 indeed...
Clarkewatch: In his ongoing suicide mission (he's a sort of suicide
bullshitter) to 'prove' that Government IT projects are not pants, and do in
fact deliver the goods, Clarke used the Passport Office, which is now
apparently delivering something close to what one might call a service, as
an example. And then he cited the successful rollout of chip and pin. We
could point that the latter, a networked megaproject, was carried out by
private industry, but you no doubt spotted that yourself. What interests us
more, however, is that on previous outings for the suicide mission Clarke
had trotted out Airwave, the 'on time, on budget' secure digital
communications system for the UK police.
At the time we thought it a little cheeky to claim a system that had severe
rollout problems and remained crap at data as a successful IT project, and
as Clarke's dropped this from his list of achievements it's possible
somebody has had a word. However, evidence that Airwave remains crap at data
is provided by Northamptonshire police's pilot of mobile fingerprint readers
in conjunction with Automatic Number Plate Recognition (ANPR) systems. Here,
if your number plate leads police to make further enquiries, they ask you to
'voluntarily' undergo a fingerprint check against the police database using
mobile fingerprint recognition. The systems Northampton deployed, however,
used, er, GPRS. But there seem to have been a few problems anyway... Clarke,
in any event, can't even get the message across to the rest of the Cabinet.
Surveying the wreckage of the new environmental stewardship scheme,
Environment Secretary Margaret Beckett says: "Tell me an IT scheme in the
Government or the private sector that has been introduced without problems."
Oops.
What price an ID scheme?
Charles Clarke, Tony Blair and sundry other Government representatives have
rubbished claims, based on the London School of Economics report, that the
price of a card could be £300. On the day after the Commons debate, Blair
himself said that "some of these figures bandied around about cost are
absolutely absurd, I mean no Government is going to start introducing
something that is going to cost hundreds of pounds for people, that would be
ridiculous." Which indeed it would be, and Mr Tony might have added that,
should his Government propose such a thing, its members would swiftly find
themselves suspended from lampposts along Whitehall. But we should
contemplate the nature of the absurdity of the £300, and what must be done
to achieve the £30 that the desperate characters in the Home Office are
pretty close to nailing to the mast.
The origin of the £300 was the report of the London School of Economics
Identity Project, but as we noted last week, the LSE estimates the total
cost of the scheme, and points out that if the Government were to stick to
Treasury requirements that the scheme be self-financing, then the public
would have to be charged up to £300 each. The LSE did not point out the
obvious, that anybody attempting to charge this would be strung up, and the
ensuing headlines screamed that costs could double or treble. The real story
(which we accept would have been a little less likely to grab public
attention) was however that if even the lowest LSE estimate was in the right
ballpark the Government's public statements on the financing of the ID
scheme did not add up. The report, incidentally, also makes a pretty
persuasive case for the Government's current estimates (£5.8 billion being
the latest we've sighted) erring badly on the optimistic side. For example,
although the requirements for the capability of the technology used have
increased since the entitlement card scheme was floated, in several cases
the claimed costs of equipment (e.g. readers) have decreased since the
entitlement card estimates were issued.
In any event, although the £300 scare was helpful in putting the spotlight
onto cost, it also allowed the Government to shift the argument at the time
of the Commons debate over to card cost. It will now be calculating that if
it can hold the card cost at £30, the public will accept a new passport cost
of £93 (despite passport cost having virtually tripled over recent years),
heaving sighs of relief that it's not being hit for £200 or £300. This
shifted attention away from the total cost again, and in rubbishing the £300
the Government was thus able to avoid addressing the LSE's real points,
which are rather more difficult to rubbish.
Scheme cost estimates are covered in the LSE report from page 225 on, and
use Home Office consultation documents, ID Bill regulatory impact
assessments and Passport Office business plans as sources. The Passport
Office plans in particular are useful, and it's clear from these that this
particular department is effectively taking the lead in ID scheme
implementation (we hope to return to the Passport Office's Personal
Information Project, relation, at some future date). The report references
the source documents liberally, which means that in those instances where
Clarke has rubbished specific figures in the LSE report, he has arguably
been rubbishing his own officials.
For example, Clarke has cited the LSE's suggestion that cards would have to
be replaced every five years, rather than ten, and made the mathematically
illiterate claim that this automatically doubles overall cost. But as its
source here the LSE cites the entitlement card consultation document, which
differentiates between smartcards and cards with a smart chip, and says the
latter would need replacing twice in a ten year period. The cost figures in
this consultation put the cost of a smartcard at £3.50 and a chip card at
£5. The consultation numbers, says the LSE, add up to a card cost of £240
million over ten years for a plain plastic card, £670 million for a
smartcard reissued once over the period, and £2007 million for a
sophisticated smartcard (of the kind Clarke is proposing) reissued twice.
The Passport Office business plan also suggests that with biometric
passports it may be necessary to renew passports every five years, rather
than the current ten.
The Government also seems over-optimistic on the cost of readers. In the
entitlement consulatation, the LSE notes, the Government "originally
envisaged a far simpler scanning system than that used by the police or
immigration service, originally considering the scanning of four fingers
only." These prints would not have been scanned to a legal standard of proof
of identity, so the equipment could be cheaper and staff would not need to
be as highly trained in interpretation as police or immigration service
staff. But the Government has subsequently said that it does intend to use
the NIR fingerprint database to check scene of crime prints, so logically
the costs associated with readers should have gone up.
The entitlements consultation however envisaged 2,000 sets of equipment
costing £10,000 each, while the ID Card Bill Regulatory Impact Statement
puts the cost of readers at £250-£750. This quite possibly factors in some
wishful thinking about a far larger number of readers resulting in lower
unit costs, however as ministers have recently claimed that the use of three
biometrics (fingerprint, facial, iris) will mean the error rate will be
extremely low, the cost of 'tri-band' readers should perhaps also be
factored in.
Other Government sources tend to support the LSE. The ever-watchful Spyblog
recently unearthed some signposts to true reader costs, flagging a piece of
scheme cost laundering while it was about it. The RIA for the Immigration,
Asylum and Nationality Bill puts the cost of the initial deployment of
biometric passport and visa readers as £3-5,000 per reader plus the cost of
a PC, plus £21,000 for the computer network cabling. The latter is clearly a
one-off cost per location, so it's an initial deployment hit the 47 main
airports and ports will only have to bear once, but it's also a cost that is
likely to be incurred at most of the other sites where an online
verification capability is required. As much of this expenditure will be
absorbed by other departments via their IT budgets, or incurred by major
financial institutions and ID verification third parties, little if any of
it will ever be accounted for under ID scheme costs. One might also
speculate about the costs of whatever it is the new cabling at ports
connects to, and who's paying for that - unhelpfully, the RIA seems not to
mention this bit.
The actual costs incurred in association with the Immigration, Asylum and
Nationality Bill will be shouldered by the Immigration and Nationality
Directorate, and will ultimately be a lot higher than those specified in the
RIA, which states:
" Currently there are 47 major ports of entry and an average of 20 desks per
location. Due to the staged implementation of biometric identifiers in
passports, ports will only have a relatively small percentage of arrivals
with biometrically enabled passports. Initially, we may only provide one
reader per port. However, as biometrically enabled passports become more
common we will increase the numbers of readers per port accordingly. If
every desk at every port were to have a reader, Border Control would have to
deploy the biometric solution at 940 desks at airports, seaports and the
Juxtaposed Control."
It's difficult to get your head around the logistics of the planned 'one per
port' initial deployment. Initially the RIA anticipates there may be two
readers per port, one handling biometric passports and one handling
biometric visas. It is true that numbers for passports will initially be
quite small, but once the major economies are starting to ship biometric
passports, the number will be ramping fast as old passports expire. European
travellers whose passports could be read biometrically will therefore be
coming into the UK in fairly large volumes in fairly short order. Biometric
visas are intended to be issued to all visitors requiring visas within the
next couple of years, and they will therefore constitute a very large
volume, very soon.
So what on earth do the loves propose to do with the one appropriate reader
available? Clearly it will not be a case of scanning all of the people with
biometric passports or visas (try this at Waterloo or when the morning
flight from Frankfurt comes into Heathrow), and the machines will be used
purely to deal with those 'randomly stopped' or who have aroused the
suspicions of immigration staff.* This does not differ greatly from the
system as it currently stands. Also note that the RIA appears ("one [reader]
for biometrically enabled ID cards") to view visa and ID card readers as the
same thing, and therefore to envisage reading ID cards at ports of entry. So
perhaps UK citizens could, like other EU citizens, travel within the EU on
an ID card, no passport required. The Register has floated this notion
before, and soon we may be told.
More broadly, the LSE attempts to nail down major areas of Government cost
underestimation in the Cost Projections (Chapter 17, page 241) of its
report. Aside from areas we've covered here already, the cost of the
National Identity Register and integration costs are likely to be the most
substantial additions. The LSE points out that there are clear parallels
between the proposed NIR and the NHS spine, but that the former (for obvious
reasons, we are continuing to avoid, with a growing sense of futility,
calling it "The Register") will involve "greater complexity and must embrace
more rigorous security measures. It must also incorporate biometrics -
something that we believe will be a technological challenge far greater than
the Government has anticipated." The LSE group has therefore put the cost of
the NIR at between two and four times the contract price of the NHS spine.
This is one of the most dramatic and potentially contentious variations
between the LSE costing and the Government ones. The LSE's reasoning however
seems sound; according what's written on the tin, it is more complex and
challenging than the NHS spine. So, if this is not reflected in its claimed
total tab for ID scheme, the Government needs to explain either why the cost
is lower, or where in the Government's IT budgets it is reflected.
Oddly enough, although the LSE's minimum cost estimate is approximately
double the Government's most recent estimates, given the existence of some
kind of cost-laundering iceberg beneath the visible aspects of the
Government estimate, the real numbers might not be that different. If,
somewhere within the Government, someone is tallying up the total cost of
the scheme and all its related components, then the big number would quite
probably fall within the LSE range of £10.6-£19.2 billion). Given how
career-threatening such a tallying exercise might be, we very much doubt
that anybody's doing it. But if you think about it, it's exactly what the
Government should be doing, then putting the facts before the country and
Parliament before embarking on such a scheme. As opposed to the current
approach of "capping" card cost at "only" £30, and avoiding telling anybody,
probably including themselves, what it will all really cost. ®
* Borderwatch We at The Register take an understandable interest in
developments in what really happens at UK border checkpoints, the Eurostar
London to Paris run being particularly fascinating, given the quantity of
shouting about illegal immigrants on this route there was a few years back.
Recently we observed at Paris that the UK checkpoint had started putting the
machine readable section of the passport into a reader (well done chaps,
even if it has taken you nigh-on 20 years to start), but that only the
French post used a forgery detector. At Waterloo incoming practically
everyone on the train was waved through without a check, so we're clearly
banking on nobody screwing up at the Paris end. In the other direction, no
UK official at all even asked for a passport, but there was a nice new
checkpoint checking them, again using a forgery detector. It was operated
by... the French. No doubt they're telling us how many of our terrorists are
leaving the country.
Public contributions There's more than one way for the general public to
contribute to the cost of the ID scheme. You can shut up and pay your taxes,
thus helping meet the cost of the scheme, and you can contribute to the cost
of the scheme by making it higher. The LSE (hinting, perhaps, at the
institution's glorious past) deems non-cooperation as a potential cost, and
suggests that one "dedicated non-cooperator", working "strategically and
systematically can, quite feasibly, exhaust 200 hours of administration time
through the generation of queries, appeals, access requests, database
modifications and general civil disobedience." At time of writing the No2ID
pledge to refuse an ID card was closing fast on its target of 10,000
signatories, which could mean an awful lot of time-consuming civil
disobedience.
You are a subscribed member of the infowarrior list. Visit
www.infowarrior.org for list information or to unsubscribe. This message
may be redistributed freely in its entirety. Any and all copyrights
appearing in list messages are maintained by their respective owners.
