The complete ID primer

Governments across the world are rushing to implement national identity systems. The aims of these systems vary widely, but the many proposals involve a push to create “perfect identity” that will fuse the biometric details of every person (fingerprints, irises, etc) with vast central databases containing personal information. In their most hazardous manifestation, such systems might seriously compromise privacy and individual rights.

Interestingly, many ID proposals are running aground because they have failed to win the trust of citizens. In their haste to implement powerful new identification and tracking technologies, governments are quickly discovering that civil liberties and privacy campaigners are finding a new and popular voice.

In June 2005, for example, the UK government narrowly succeeded in winning a second reading parliamentary vote to proceed with legislation for a national identity card. The vote and the stormy debate that preceded it were eagerly scrutinized by several governments, including Ireland’s, that are considering the development of their own national ID system.

Although the UK proposal ultimately cleared its first hurdle, no government watching the process could have derived any comfort. Over the previous three years, the fortunes of the ID plan had swung tempestuously, starting in 2002 with a high level of overall support, but concluding with substantial public opposition, widespread political dissent, and hostility from key media groups and stakeholders. Those fortunes are likely to become even more uncertain as the bill wends its way through parliament after the summer.

The government intends to introduce a scheme that many people have come to believe is alien to British culture and that would be inimical to the perceived way of life in that country. This outlook is not surprising, as many of the scheme’s elements had been lifted from similar plans introduced by interior ministries in countries that have a poor track record on the protection of rights and freedoms. Others were copied from discredited proposals in democratic countries.

The Identity Cards Bill outlines a monolithic identity system that has eight components:

– the National Identity Register containing a vast amount of personal information
– a National Identity Registration Number
– the collection of a range of biometrics such as fingerprints
– the National Identity Card
– provision for administrative convergence throughout the private and public sectors
– establishment of legal obligations to disclose personal data
– cross-notification requirements obliging government departments to inform other agencies of changes in personal circumstances
– the creation of a wide range of new crimes and penalties to enforce compliance with the legislation

The Bill outlines a number of diverse “public interest” objectives for the proposed scheme. The card and its attendant database will be used “in the interests of national security”, “for the purposes of the prevention or detection of crime”, “for the purposes of the enforcement of immigration controls”, “for the purposes of the enforcement of prohibitions on unauthorized working or employment”, and “for the purpose of securing the efficient and effective provision of public services”.

Dissent grew as citizens learned more about the details and implications of the scheme. The headline support figure for identity cards derived from opinion polls dropped from 80 per cent in 2004 to around 55 percent in 2005. The proposals were increasingly seen as unnecessary, costly, and an intrusion on individual liberties. The House of Lords is preparing to savage the legislation when it leaves the Commons in October.

One remarkable aspect of the UK situation is that it mirrors almost exactly the conditions that existed with a similar proposal in Australia in 1987. Indeed, the UK government appears to have modelled its ID legislation on parts of the Australian ID card law.

The genesis of the proposed Australian national ID card can be traced to the early 1980s, when there was widespread concern about tax evasion and tax avoidance. Coupled with concerns over the extent of welfare fraud, there was a belief expressed in some quarters that an identity card or national registration procedure might assist the government’s administration processes. Fears over the extent of illegal immigration added fuel to these suggestions. Legislation was finally introduced in 1986. Playing on patriotism, the government called it the “Australia Card” (it later became widely known as the UnAustralia Card and the Aush-tralia Card).

The Bill that emerged was identical in many respects to the UK legislation – a monolithic, data-driven system buttressed by heavy civil and criminal penalties to ensure compliance. The idea was sold to the Australian public in a manner almost identical to the sales pitch adopted by the British government 18 years later. The punitive nature of the legislation was disguised in soft tones, implying that penalties were in place to “protect” ordinary people from hard-core refuseniks and troublemakers. Both governments adopted the slogan, “Only those with something to hide would oppose this idea.” The definition of public interest was fully exploited yet was never fully defined. Both proposals were designed for staggered implementation to minimize the risk of a public backlash. Opposing voices were branded as enemies of the common good while supporting voices were praised by government as “forward thinking”, “public spirited” and “reasonable”.

The Australia Card proposal ultimately fell. By September 1987, public hostility had reached the point where tens of thousands were marching in the streets. The government was quite publicly split over the scheme. Opinion polls indicated between 80 per cent and 90 per cent opposition to the ID card.

Despite this setback the core components of the Australia Card worked their way across the world. Thailand (1990), New Zealand (1991), and the Philippines (1991) each pursued a system similar to the Australian model. Each adopted similar PR tactics. The same vendors (IBM, Control Data, ICL, etc) were prominent in discussions with governments in most, if not all, target countries. In most cases the proposals were abandoned in the wake of public hostility.

The same process of policy and public relations laundering is occurring 15 years on. Malaysia, Singapore, and Thailand are among the many countries establishing card systems. China is moving rapidly in this direction with the development of a compulsory ID database and card system, although it abandoned the biometric element after it concluded that the technology was unworkable with large populations. The US military in Iraq is developing a similar system to that proposed in the Identity Card Bill in order to control access to Fallujah and to track those suspected of being insurgents. The UN High Commissioner for Refugees has deployed an iris biometric system to control refugee traffic across the Pakistan-Afghan border. The UAE also uses an iris system for border control.

The issue of identity cards in Canada had a short lifespan. This may in part be because the Canadian government never actually introduced a specific proposal. Rather, the minister of citizenship and immigration proposed a national discussion on identity cards on the grounds that if Canada did not consider an identity system, it might instead be imposed upon Canadians because of US border restrictions.

The proposal was left open to the Parliamentary Standing Committee on Citizenship and Immigration to investigate the case for the cards. The committee held a number of consultation sessions, met with local leaders, and travelled internationally to consult with countries with identity cards and those without. After a few months, it released an interim report. This outlined a number of concerns. They included a transformation of the relationship between the individual and the state, data protection and privacy, function creep, the weaknesses in the technology, over-reliance on a single card, identity theft generated by the card, costs, and race relations. The interim report concluded by stating:

This report is intended to summarize what we have heard thus far and we reiterate that we are continuing our study. It is clear that this is a very significant policy issue that could have wide implications for privacy, security, and fiscal accountability. Indeed, it has been suggested that it could affect fundamental values underlying Canadian society. A broad public review is therefore essential. The general public must be made more aware of all aspects of the issue, and we must hear what ordinary citizens have to say about the timeliness of a national identity card.

No further work followed, and no final report was issued. Rather, with those words, the initiative was abandoned.

One of the more difficult issues to explain is the reason why some countries have ID cards while others do not. Sometimes the answer is framed in assertions that countries of a certain type are less likely to have them, for example English-speaking countries, common law countries, or federalist countries, but these are inadequate explanations because there are always exceptions.

A conclusion that may be drawn from this review is that while many countries do have ID cards, a large number of them never had a national debate about the need for them. Where such a debate does occur, there is usually initial broad support for ID cards that ebbs away when the flaws of the system are seen, the penalties of non-compliance are noticed, costs are disclosed and reviewed, and the implications are considered in detail.

Such debate is a rare occurrence. The identity systems of many countries have been inherited from prior regimes of a completely different kind: under Franco in Spain, registration by a Nazi government, national ID numbers by the Vichy regime in France, national registration by the Church in Sweden, unstable governments in Greece, and Mussolini in Italy. Sometimes they are implemented in times of war, as was the case in Australia, Hong Kong, and even the United Kingdom. In a significant number of cases, ID cards have been implemented by decree rather than through a national law. This was the chosen method in Spain, Greece, Italy, the Philippines, and Thailand.

That cards were introduced within such environments does not lead immediately to the conclusion that they are merely tools of oppression. Such a conclusion would be rash, although it merits further study. For many countries, identity cards became a national custom and part of the political culture in a different era. They become customary only through usage and adaptation, not because of general approbation.

Putting aside the issue of acceptance or rejection of ID cards, it should be noted that not all systems are built equally. Even within the European Union, cards vary widely in their size, content, and substance. Some have very large registries. Some rely on mandatory use. Some involve biometrics. Registration processes vary from registering at police stations to banks; requiring a live witness to a signed photograph by referees; central storage of biometrics to distributed systems that may be deleted once the cards are issued.

The reasons for this variety are largely attributable to national legal culture. The fact that a country has a national ID card does not mean that its populace supports the type of system proposed, for example, in the UK. ID systems in each country are designed with specific safeguards, and it is this that leads to the variability in design. Sweden refused to make use of the registry; Germany cannot construct a database of biometrics; France has not previously made its card mandatory; Italian regulators have wide powers to ensure the adequate protection of data. Outside Europe, the situation is even more fragmented: some countries require iris scans and are considering the use of DNA, while the state of Georgia has removed fingerprints from its licences and China has abandoned biometrics, Taiwan is on the verge of declaring its fingerprinting programme unconstitutional. Bosnia decided against using a smartcard chip, but other countries are considering the use of chips that broadcast a person’s identity and this personal information can be read at a distance. Until recently, every country made its own decisions about the constitution of their ID systems, basing them to a considerable extent on its particular legal and political culture.

Whether it is under constitutional law or because of public sentiment, governments are not free to change their systems without some form of public or legal negotiation. Even when systems were first implemented under oppressive regimes, safeguards were eventually implemented. The French and German systems are prime examples of this, with their variety of restrictions and powerful regulators. Greece, where previously religious faith, profession, and residence were indicated on ID cards, was compelled to remove this by its national regulator. In Italy, it is said that, although Italians like their identity cards, the implementation of a fingerprint biometric would provoke a negative response. In fact, we have serious doubts as to whether any other European country would be able to implement a system similar to that proposed in the UK.

Reviewing the practices of other countries is not merely an academic exercise. We can learn from their achievements and failures. We can understand the risks to networking and creating a central registry from the experience in Japan with the weak security surrounding the Juki-Net. We can learn from the Malaysian MyKad, where banks are advising that they should not be used to their full capabilities to access ATMs. Hong Kong conducted a Privacy Impact Assessment before moving forward with its card. Bosnia decided against using a chip, and managed to reduce costs significantly. Germany deletes registration information from central stores when they are no longer needed, and data is only collected locally. A number of countries do not have onerous enrolment procedures, reducing costs and also minimizing the inconvenience for individuals. Some countries restrict the use of ID numbers. Others have acknowledged that identity cards do affect the relationship between citizens and police, and have tried to find ways to resolve the tensions that may arise. Many countries endow their national regulators with broad powers to monitor abuse.

The UK government seems intent on pointing to international obligations and precedents. Research by the London School of Economics indicates a fragmented approach to ID cards around the world, and there is much to learn from the experiences of others. A national identity card need not resemble the one that the UK government is proposing, nor is anyone under any obligation to create such a card. Indeed, no other country has so far done so.