Dematerialised ID — Producer capture

Anonymity/identity

Capture

Dematerialisation

Campaign

Newcomers and returning visitors, please note that you are welcome to talk to the hermit using this new invention, email.

Dematerialised ID

The voluntary alternative

to material ID cards

A Proposal by David Moss

of Business Consultancy Services Ltd (BCSL)

Section 6

It is easy to paint a picture of how poor the procurement work has been on the government's ID cards scheme. It is not easy to paint any other picture.

The government seem to be the victims of producer capture ...
Dematerialised ID makes imaginative and effective use of existing technology. Its merits seem evident.

Apart from the replacement of cardboard cards with plastic ones, the government scheme is redolent of the typewriters and rubber stamps of another age. The question arises how they have come to adopt such a pedestrian, old-fashioned, inflexible, give-everyone-a-card-and-keep-a-list scheme.

The answer seems to be that they were advised by Intellect, a UK trade association of 1,000 or so IT suppliers.

The Identity Cards Act received Royal Assent in March 2006. The Home Office released its initial consultation document in July 2002. In the early stages of that roughly four-year period, three members of the Board of Intellect, including the President and the ex-President of the Board, were from Philips Electronics, a company which supplies smart cards, particularly its MIFARE^® cards, known in London as "Oyster cards". Philips Electronics for some time also owned 32% of Atos Origin. Atos Origin, in turn, own the old SchlumbergerSema smart card business.

Philips Electronics today supplies only one of Intellect's Board members, in July 2005 it sold its stake in Atos Origin and in 2006 it spun off its semiconductor division to create NXP. But for some time, Philips Electronics would have won whether they got the £2bn contract for ID cards or Atos Origin got it.

It is common to use smart cards to implement mass consumer systems but you do not have to follow convention blindly, there is an alternative, as we have seen – mobile phones. How many of our four mobile phone network operators in the UK are members of Intellect? None.

The following comment, from an informed source, gives an insight into the attitude of the suppliers:

"A national ID card for the UK is overly ambitious, extremely expensive and will not be a panacea against terrorism or fraud, although it will make a company like mine very happy," said Roberto Tavano, a biometrics specialist for Unisys, a US technology company that has worked on national identity schemes in South Africa and Malaysia.

The ID card scheme initially proposed to the Home Office was arguably designed to suit the suppliers, not the client. This is producer capture. The smart card suppliers in this case represent a £2bn threat to the UK taxpayer.

… by producers of limited capability
Atos Origin head the consortium which was chosen to conduct the UKPS biometrics trial. They had trouble getting their facial geometry, irisprint and fingercopy equipment to work and the start of the trial had to be postponed twice.

When the US government became anxious about cost and time over-runs on IT projects, they established the Software Engineering Institute (SEI) to try to find a way to overcome the problem. The SEI devised the capability maturity model (CMM), which they use to score IT departments on a scale of 0 (worst) to 5 (best).

... Atos Origin
The Atos Origin corporate brochure says that it is a CMM-level 3 organisation, "we are one of the few organizations rated Level 3 in Europe" (p.8). To be precise, according to the SEI, there is no such thing as a "CMM-level 3 organisation". Big organisations like Atos Origin have many IT departments, not just one. It is individual IT departments which are rated by the SEI, not the organisation as a whole. Boeing, Lockheed Martin and Motorola, for example, each had five CMM-level 5 IT departments within the organisation when BCSL last checked and Tata had 16 of them.

Perhaps it would be more appropriate for UKPS (now IPS, the Identity and Passport Service) to choose an excellent CMM-level 5 supplier like Tata, as we taxpayers deserve, rather than a third division team like Atos Origin.

... Identix
There is a biennial competition, run by the University of Bologna, which any supplier of fingercopying algorithms may enter. There were 43 entrants to FVC2004, the 2004 "International Fingerprint Verification Competition", which was won by Bioscrypt Inc. of Canada. A logical organisation would choose the winner and, indeed, IBM announced their partnership with Bioscrypt on 6 October 2004.

In choosing the Atos Origin consortium to run its 2005 biometrics trial, UKPS acquired Identix Inc. to provide the fingercopying expertise. It is not clear whether Identix entered FVC2004. It certainly didn't enter under its own name. It may have been one of the 19 anonymous entrants. There is no mention of FVC2004 on the Identix website. The highest placed anonymous entrant came 9th.

Again, therefore, the question arises why UKPS do not choose the first division team that we deserve and settle instead for a company which is at best 9th rate. IBM didn't. What is the point of paying royalties to use a 9th rate biometrics algorithm?

(I have been asked to point out that the argument here is poor and detracts from the better arguments. In the experience of my correspondent, winning competitions like FVC2004 tells you little about how the fingercopy kit will work in practice. I am happy to have the point emphasised that it is live use in production that counts. In the UKPS biometrics enrolment trial, the false non-match rate for Identix fingercopies was 19%, in the case of able-bodied participants, and 20% for the disabled. That was a trial. Who knows whether Identix would be more reliable when used for real, or less?)

... Visionics
In 2002 Identix Inc. bought Visionics Corp., who specialise in biometrics based on facial geometry. It is the Visionics software, FaceIt, which was used in the UKPS biometrics trial:

"The video camera part of the Panasonic BM-ET300 camera unit was used to capture a photo of the participant and also the Facial biometric. This was recorded using the Identix FaceIt software (v5.0) taking a series of images from the video camera" (C1.3).

Visionics used to claim that they wiped crime off the streets of the London Borough of Newham in a trial of their FaceIt system, which matches CCTV images of people in the street to a database of known offenders.

The police have a different memory of the FaceIt trial. They say that "the Newham system ... never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest".

The NPL describe this facial geometry technology in general, not just FaceIt, as failing even to approach the performance required of an ID voucher scheme (p.15). This is the technology that failed to recognise 31% of the able-bodied and 52% of the disabled participants in the UKPS biometrics trial just a few minutes after registration (para.1.2.1.4).

How many times does the taxpayer have to pay for biometrics based on facial geometry to fail?

... Viisage
The answer seems to be at least once more.

DVLA maintain a database of photographs, collected from photocard driving licence applications. In December 2005 they appointed Viisage, another facial geometry biometrics specialist, to conduct a trial to see if these photographs could be used to automate driver identification.

There has been no news of the trial since then. No news of its failure. No news of its success.

New Scientist magazine reported on the problems with Viisage's software, installed at Fresno Yosemite International Airport in California, back in September 2002, in the same article which mentions the Visionics software problems in Newham and also at Palm Beach International Airport in Florida.

In January 2006 it was announced that Identix and Viisage were changing their identity and merging to form L-1 Identity Solutions, Inc. The Identix strategy of cornering the market in biometrics systems that do not work has its problems. According to the press release, the combined operation would have revenues of $220m and EBITDA of at least $40m. Companies which report their earnings before interest, tax, depreciation and amortisation do so because there are no profits left after interest, tax, depreciation and amortisation.

... Accenture
And still the lesson that biometrics based on facial geometry do not work does not seem to have been learnt. Now there is a trial (or pilot) being conducted at Heathrow Airport using a system called miSense:

"The pilot is being conducted under the aegis of the BAA and the UK Immigration Service, with self-investment by selected Simplifying Passenger Travel Interest Group members, including Accenture and its research and development arm, Accenture Technology Labs. Accenture is leading the biometrics implementation as well as the business process and change management that is necessary to maximize the positive impact of this technology."

The suppliers are different but standards are being maintained. According to the BBC:

"... Back out in the terminal, emerging from the queue for an Emirates flight to Dubai, was 49-year-old Jackie Colton, a British national who lives in the emirate. She is one of the 400,000 already signed up to the "E Gate" process in Dubai, which is that city's version of the biometric identity system, and she's eager to do the same at Heathrow. However, Mrs Colton explains that the miSense kiosk next to the check-in queue for Dubai is not working ..."

The kiosk is not working but Mrs Colton "remains keen to sign up her biometric measurements anyway, describing biometric-supported travel as 'blissful'".

Will IPS be equally lenient? They may be. Their new Chief Executive is James Hall, a man who spent 30 years with Accenture, rising to Managing Partner of Accenture UK.

Will the Home Office be equally lenient? They may be. The Minister responsible, Liam Byrne, worked for Accenture when it was still Andersen Consulting, before it changed its identity.

Will the Cabinet Office Delivery Unit be equally lenient? They may be. The Unit is headed by Ian Watmore, "another former Accenture partner" (Private Eye, #1169, 13-26 October 2006).

... PA Consulting
The Home Office took BCSL to task for referring to their ID cards scheme as "the Intellect scheme".

Their point is well made. The involvement of PA Consulting (PA) should not be ignored. Management Consultancy magazine and Accountancy Age reported in July 2005 that PA have been working with the Home Office on the design, feasibility and procurement of the ID cards scheme in a team comprising 43 civil servants and 62 consultants.

Consultants are meant to be independent and objective. PA's considered opinion of biometrics is published in a 24 November 2004 document on the web, Biometrics – Is that really you?, which acknowledges some of the problems associated with biometrics:

"Fingerprint recognition can be fooled by calluses, residual prints on the reader, and even hand cream! Face recognition struggles in certain lighting conditions and can by fooled by disguises; and iris recognition can be confused by contact lenses and watery eyes."

The document clings to the notion that two or three unreliable biometrics taken together become reliable even if no single biometric identifies people reliably. Two or three wrongs make a right?

PA's conclusion is that "despite the problems and objections to biometrics today we will see the technology become increasingly pervasive". We may, indeed, see biometrics becoming pervasive, not only in passports and ID cards but also supposedly one day in car doors and the front doors to our homes but, again, that cannot make them reliable.

The PA document makes the point that the ICAO and the US insist on the use of biometrics, which is true, but those facts cannot make biometrics reliable.

The answer to PA's question is no, biometrics today cannot tell whether that is "really you".

And if biometrics do, one day, become reliable, then PA still won't have solved the civil liberties problems which their document also raises:

"Biometric identification also faces stringent opposition from civil liberties groups who believe that it represents a breach of privacy. There is great concern about the storage of the biometric data and who has access to it. The possibility of storage of personal data on a centralized government database causes greatest concern. There is concern that this data may be misused and even that it may be possible for a person’s stored data ... to fall into the wrong hands."

It is, in short, this document, not a good advertisement for the deployment of logic which we expect from consultants.

It is illustrated with a diagram of what PA call "The Innovation Highway", see below. A car starts at Concept Boulevard, proceeds along Invention Street, goes up Biometrics Mountain, round and round the top, then down Challenge Avenue and Obsolescence Avenue and finally stops in The Car Park of Antiquity. The car is yellow and, according to the legend, that means that the technology is mostly "hype".

The Innovation Highway

Nowhere on this infantile diagram is the Bank of Credulity and Ingenuousness shown but, according to the Management Consultancy and Accountancy Age articles, PA had been paid about £12m for their work by July 2005. The Home Office say that the final cost of PA's assignment is "likely to exceed the estimates quoted" but that this is not an "overrun" because "these costs have never been treated … as the 'contract value'".

Consultants are also meant to be experienced and responsible. Experience teaches that computerised systems need to be tested thoroughly before they are released. To release untested code is simply irresponsible. But the House of Commons Science and Technology Committee have been told that:

"It would not be realistic to rigorously test everything before the scheme goes live, to the point where the government can be sure that no further changes need to be made to the design of the scheme. Some parts of the scheme will not be tested, but will use off-the-shelf technology that has been adequately tested elsewhere" (Computing magazine, 26 October 2006).

Would the Audit Commission be lenient about this failue to observe established procedure? They may be. The new chairman of the Audit Commission is Michael O'Higgins, previously Managing Partner of PA Consulting.

... who have captured several very important jobs
To summarise, the biometrics trial has been led by an admittedly third rate consultancy, Atos Origin, whose consortium includes a loss-making company, Identix Inc., whose facial geometry business has been accused by the NPL of not even approaching the performance required and by the police of lying and whose fingercopy business is at best ninth rate. The Home Office have adopted the scheme recommended by a producer-captured organisation, Intellect, and they are being assisted on design, feasibility and procurement issues by the independent and objective PA Consulting, who acknowledge that the technology does not work – indeed they brazenly depict it as hype – but who nevertheless concur in the charade that biometrics should be deployed anyway. The budget cannot over-run because there is no budget. And the system cannot fail because it hasn't been tested so it must succeed.

Such is the capability of the suppliers the taxpayers are funding and on whom our border controls may depend, access to state benefits, health care and education may depend, and on which the fights against crime and terrorism may rely.

On 11 December 2003 Katherine Courtney, at the time Director of the Identity Cards Programme, gave evidence to the Home Affairs Committe. The following exchange took place:

Q141 Janet Anderson: Do you think that there will be a need for an independent assessment at some point, or do you think that you will have built sufficient safeguards in place?
Katherine Courtney: I am not sure I understand what an independent assessment is?

You can see her problem. Who will review the performance of these suppliers? Who will authorise the deployment of their scheme? Answer, people in senior positions in the government and the civil service. Positions which have now been captured by the suppliers.