The Guardian article "Government will track ID card use"
features comments from Stephen Harrison, the head of the Home Office's identity card policy unit. He is the civil servant who had to duck and dive 11 times when giving oral evidence to the Home Affairs Committee over how much the ill defined plans would cost - he did not give a clear answer to the nearest ?2 billion.
"Mr Harrison told a Law Society conference yesterday that ministers had started with the assumption that information on the pattern of everyday transactions involving each card would not be kept on the central computer database.
But following representations from the information commissioner they were now minded to keep information "about the audit of transactions" to allow the authorities to investigate abuses of the scheme. Although no final decision had been taken he said there would need to be safeguards to prevent abuse of such information. "
So much for the "Entitlement Cards" consultation process - we made exactly the same points about the need for audit trails in our comments.
Mr Harrison confirmed that individuals will be able to check that the data held on them under the identity card scheme was accurate and to put it right if there is an error. He said they were looking at ways in which this information could be accessed using the identity card rather than the traditional data protection method of writing a letter and paying ?10. However, it would not allow each individual to check on all the government data held on them or on the "audit trail" of checks that others make on their identity"
If part of the justification of forcing us to have a Compulsory Biometric ID Card is to reduce "identity theft", then an individual must be allowed access to their own ID Card transaction audit trail. This is commonplace in other systems such as itemised phone bills or itemised credit card statements or itemised bank statements. Even the dubious Oyster Card travel smartcard allows this.
The reason for doing so is the same - you are more likely to spot unusual transactions regarding the alleged use of your "identity" than any civil servant or automated computer system. These unusual transactions could be genuine mistakes (which according to the civil servant, we will be allowed to correct) or they could be the indicators of ID Card fraud or corruption in a government office, or terrorist activity etc. e.g. if the transaction audit trail shows that your ID Card is apparently being used at a time or a location when you were somewhere else.
If, as Jan Berry, Chairman of the Police Federation said in her oral evidence to the Home Affairs Committee, that an ID card audit trail could reduce the number of racially or religously discriminatory police stop and searches, by showing up exactly who was being unfairly targeted , and by whom, then it is vital that the ID Card audit trail is available to an individual, and that it can be brought into evidence in court.
Audit trail log files are the easy part of any Biometric ID Smart Card technology, computers are very good at logging when and where which device accessed which part of the system, just like trillions of financial, mtelephone or internet transactions get logged every day. If such audit trails are properly digitally signed andd timestamped to make them tamper resistant, they should be admissable in court, even though the technology does not provide for complete "non-repudiation".
One's identity, and any associated Biometric Identifiers, belongs only to the individual, and not to the Government. or to any 3rd party commercial partners or sub-contractors.
This individual will, under the current plan, have had to pay money for the ID Card. This is regardless of whether the individual is under investigation or suspected of any crime, or, as the vast majority of people, is completely innocent.
In order for Stephen Harrison's plan to be brought into force, the Government would have to further curtail our rights under the Data Protection Act and the Freedom of Information Act.
The audit trail requirements should also apply to any future "science fiction" attempts to identify people using mobile Biometric Identifier scanners communicating directly with the central databases, without comparing the Biometric Identifiers with those stored on the Smart Card. This is technically a vastly more difficult and error prone problem, but it should not be allowed to become a loophole around the audit trail - each and every such identification attempt needs to be logged and to be made available to the individual on request.