ID card watchdog 'reassured not alarmed' by scheme's progress

But hurdles remain, including major database-migration project

The UK identity commissioner - who oversees the security of information collected under the ID cards scheme - has said he is "reassured rather than alarmed" by the progress made on the project so far.

Sir Joseph Pilling - who was appointed as UK identity commissioner in October last year - yesterday published his first annual report on the National Identity Scheme.

"A lot of work remains to be done and some tricky issues are not yet resolved. On the other hand, on the basis of wide experience of central government, IPS [The Identity and Passport Service] strikes me as well-motivated and equipped with the right culture and skills to make it more likely than not that it will succeed," he said in the report.

But there are still plenty of hurdles ahead for the project, including a database-migration project. The government will have to transfer ID card data from its temporary home to a new database, a switchover which will need to be carefully managed to prevent any risks to the security or integrity of the data.

Pilling said ID card data will be held in a temporary database and then transferred over to a larger database in 2012.

People living in the North West and London, and others that have registered an interest, are able to apply for an ID card at present and their biographic and biometric details are being held in a temporary database. From 2012 this information will then be transferred to a new database that is capable of holding the details of far more people, to coincide with when - under current government plans - the cards will be made available to the general public in the UK.

Early adopters of ID cards could face an increased risk to their details, the UK identity commissioner has said
(Image credit: Home Office)

"I think that if you move [data] from one scheme to another you do add to the risk," he told silicon.com.

"I think the two broad areas [of risk] are, a vulnerability to unintentional data loss by allowing people to have access to the data who should not have access to it. Also... in transmission some data could get distorted.

"We need to make sure that data is moved in a way that will allow checks that the data at the end is the same as at the beginning of the process."

Pilling said it was a issue that could only have been avoided by delaying the introduction of the ID cards project until the completion of a database capable of holding the details of the entire UK population.

"I do not think that they had any option, unless they were going to delay the ID cards project until they had something that was all-singing and all-dancing," he said.

"It was a reasonable approach to take but it does raise a question of how the transition is going to be managed and how the risks are going to be minimised when moving from one system to a second system."

In his annual report Pilling said he will undertaking work this year to review plans for the longer term strategic solution and to ensure that the switch-over, when it comes, occurs without any compromise to the security and integrity of the data, and said: "My initial view is that I see no problem with having two distinct solutions."

The IPS has also come under fire for launching the ID cards scheme for foreign nationals without issuing any readers for the ID card's built in microchip and Pilling said there was a need for readers to be issued to public bodies in future.

"It seems to me that government bodies who feel they need readers, that should be funded by the taxpayer."

Pilling said that he had been in discussions with various government departments about their interest in the scheme, such as the Department for Work and Pensions, which was interested in using the scheme to help verify the identity of benefit claimants, and HM Revenue and Customs (HMRC), which was interested in "fixing an individual's identity" to make sure the correct taxes are paid.

There have already been reports of ID cards not being accepted as a valid form of ID at a UK bank and Pilling said there would be more instances of ID cards not being recognised as valid ID by officials.

"It is a problem that you cannot overcome in the early stages," he said.

"You have to anticipate a certain roughness around the edges of the project until many ID cards are in circulation," he said.

With a pending General Election and the Conservatives still polling ahead of Labour, Pilling also said it would be important to consider how the scheme would be shut down securely if the Conservatives are elected and go ahead with their pledge to scrap the ID cards scheme.

"It is something that no doubt they will pay close attention to, depending on the result of the election, and I will take an interest in anything that they are doing along those lines," he said.

The Home Office said in a statement: "We welcome the identity commissioner's comments and we will work with him to make the most of his insight and advice. The National Identity Register is held in a secure repository and is security accredited to meet government and industry standards. The transition arrangements will be carefully managed and a limited number of staff with high security clearance will have access to the data to ensure the highest levels of protection."