FROM EDN EUROPE: Selling certainty?

This month, this column is long on background to get to a pretty simple point. Events here in the United Kingdom raised this point, and EDN Europe readers outside this country may well find this point difficult to understand. If so, bear with me. In the United Kingdom, the Home Office (approximate translation: Ministry of the Interior) has announced that the country is to have a system of identity cards, using smart-card technology and carrying biometric data, such as iris patterns or fingerprints, and possibly referencing a database that might include DNA data.

In many European countries that have long had systems of ID cards, the reaction is likely to be: "so what?" To explain all of the reasons that the subject is extremely contentious here would take far more space than I have. Suffice it to say that the UK government has not legally required citizens to carry identification since shortly after the end of World War II. However, the government minister proposing this change presents it as a major tool in the fight against crime and terrorism, regulation of access to state benefits, control of illegal immigration, and so on

This forum is not the place to review the many complex and emotive arguments that this announcement has raised; UK public opinion appears, from various newspaper opinion polls, to be fairly evenly divided. On one side are those who are inclined to buy into the argument that innocent citizens have nothing to fear, and, if the minister says it will help his fight against assorted forms of lawlessness, let him have his system and hope that he in time validates the claim. Those of the opposing viewpoint claim an erosion of civil liberties; they cannot see how the existence of an ID-card system will materially help in preventing and detecting the crimes it is supposed to bear down on, and they are disinclined to trust the State with unfettered access to such a comprehensive database.

Setting up the system should be good business for the security industry, including many of EDN Europe's readers. However, I find one aspect of this announcement slightly worrisome: The politicians promoting the technology of smart-card- and biometrics-based identity cards view it as an absolute solution to security problems. They seem to have little comprehension that the cards would be just tools—and fairly limited ones at that. The technology's promoters show no signs of understanding, for example, that this type of identification is relative; that is, manufacturers can create a system that verifies—to any degree of certainty that they want—that the person the system is checking is the same as the one who earlier enrolled in the system. It doesn't tell you anything else about that person or his or her intentions at either stage of the process.

Again, in the United Kingdom, as in other countries, identity theft is one of the fastest growing crimes. The proposal's opponents pounce on this fact; they point out that the card neatly wraps up in one place everything you need to steal someone's identity. We can design the card system to any specified level of security, but 100% security does not exist, and those who like to deal in absolutes haven't grasped that fact. You can raise the barrier to entry for the criminal to break the security, but you simultaneously raise his or her incentive to do so.

No branch of engineering deals in absolutes. Do you have a traffic bottleneck? Engineers can build you a road to handle 10,000 cars a day. It's an acceptable approach until the drivers learn of the existence of a good, fast road, and traffic consequently grows to 20,000 cars per day. Do you want security? How secure and how much are you willing to pay for it? Set the specification, and we'll design to it. But when someone has a good enough reason to find a way around that system or when some lateral-thinking approach circumvents it, don't say that someone sold you a panacea.

So, it's worrisome when people in positions of power talk as though they have a total and permanent solution to their problems. If anyone from the engineering community is voicing this opinion, stop doing so. But it's rather more likely that the politicians, as politicians everywhere are prone to do, are hearing only the message that they want to hear.

Contact me at gprophet@reedbusiness.com.