Identity Theft Check

Critics of the British identity card scheme suggest that they will compromise our civil liberties in the UK, that they will be too expensive and that they will do little to counter problems like terrorism (mentioned in a previous article).

There are also concerns that ID cards will cause tension within ‘ethnic minorities’, particularly groups that have been affected most by police stop and searches. Some people have even suggested that ID cards would force illegal immigrants to avoid contact with police and hospitals.

The government has tried to assure people that whereas the government does hold information about citizens, such as medical records and driving licence information, so do many private companies from supermarkets to insurance firms.

But the government emphasises that neither they nor the public at large have a system that proves who people really are without a wide margin for abuse and fraud.

Signatures and photo IDs are no longer considered enough in a world of hi-tech and often uncontrollable dispersion of personal information. The British ID cards, however, are intended to link biometric Person-Identifying Information, like iris patterns and fingerprints with the ID document itself.

It is hoped that this would make it nearly impossible for most criminals to impersonate other people for fraudulent ends, or to create entirely fake identities for similar purposes…

Being able to prove who we are is a fundamental part of modern life.  The government has stated that we need a more robust and secure way to check that identities are real and that people are who they say they are.

As more and more people shop and bank online the sheer amount of personal information, like PINs, passwords and security questions, increase with them, because we quite rightly need to prove our identity every time we wish to access these services.

As examples, we generally have to prove we are who we say we are whenever we:

- join a library,

- open a new bank account or apply for some sort of loan or credit,

- travel to other countries,

- apply for state benefits

- collect a mail and parcels from the sorting office.

As things stand at the moment, the current means to check someone’s identity is to require some sort of official document (like a passport) along with a utility bill that confirms a living address. Whereas this system works, it is open to abuse from identity fraudsters because there is no defined standard, so different organisations and services confirm identity in different ways using different documents. Also, utility bills and related documents can be altered or forged quite easily or indeed they can be stolen and uses to assume false identities.

As discussed in previous articles, passports may, and indeed have, been be issued to people who should not otherwise be allowed them; foreign nationals have been able to live and work in Britain illegally; public services (such as state benefits) are routinely abused by people who are not entitled to receive them; all sorts of serious criminals (including terrorists) are known to use multiple identities to throw a veil over their activities.

Hence the government believes we need to bring a more consistent and coherent means of battling all of these.

CETA, the 4,000 strong network of insurance intermediaries, is urging its brokers to promote identity theft insurance.

The risk of this type of fraud is increasing for UK consumers; losses from plastic cards used for Internet, telephone and mail purchases totalled £290.5 million in 2007, although CETA believes the figure could be much higher.

While the crime is mainly associated with credit card fraud, identities are also being stolen to open bank accounts, divert mail and apply for social benefits and mortgages.

According to the network’s managing director, David Quick, identity theft insurance is relatively cheap and can provide invaluable practical assistance to victims.

Mr Quick is concerned that many organisations do not appear to look after customers’ records well and that as criminals become more resourceful, consumers are beginning to live in fear of identity fraud.

The Financial Services Authority has recently completed a survey of the data security systems of 39 firms in the financial services sector and has gone on to warn that businesses must do more to protect customers’ personal data.

The information accessible through your ID card with cover both your ‘biographical footprint’ and biometric data.

Your biographical footprint includes simple facts of your life, like your name, date of birth and living address.

When anyone applies for their ID card, the authorities will not rely solely on what is put on the application forms but will also check the names, addresses and so on against the same data that may be stored along with your National Insurance and driving license details. This is so as to avoid the possibility of forged documents to attain ID cards for people who do not really exist and to prevent criminals claiming ID cards under other people’s names

Once an identity has been checked thoroughly, biometric data will also be recorded for the applicant.  Biometrics are unique personal characteristics that are impossible to be faked except through some of the most sophisticated and expensive techniques, and even then they are not foolproof. Iris scans are currently impossible to fake.

Recording facial and iris biometrics is like having a high-quality digital photo taken.  Recording fingerprints involves just pressing them against a sophisticated reader with no ink involved at all.  Biometric indentifying technology is already being in the facial recognition aspects of the new biometric passports.

Biometric details will be permanently paired and sealed along with biographical information to create completely unique and secure identity data. So that all this can be done, applicants for ID cards will be asked to visit in person a local or mobile application centre wherever possible in an effort to make it even harder for criminals to impersonate someone else when applying for an ID card.

The Government has established a new Home Office agency called the Identity and Passport Service (IPS), which will be responsible for issuing all British ID cards. This new agency also incorporates all the functions of the former UK Passport Service, bringing all the expertise in combating identity crime that this former agency has into the new agency.

It will of course take a few years for the new ID scheme to become fully operational and for all eligible UK citizens and residents to be enrolled on it. The introduction of biometric identification for foreign nationals comes into effect this year (2008) and the first ID cards issued to British citizens in will be sometimes in 2009, although the dates have not yet been finalised.

As mentioned in the previous article, in the initial stages of the scheme all British citizens who apply will be issued with an ID card when they first apply for an adult passport or renew an existing passport, but after that point, structures will come into place to make them available without a passport (called a stand-alone ID card).

In time it is likely that owning an ID card will become compulsory but the government has not yet made any decisions on when this might be just yet. It will probably happen after Parliament has become confident that the ID cards work in the ways that they are intended to before any moves are taken to make them wholly compulsory, but of course this will require a full and independent evaluation of the introductory phase and a debate in Parliament.

Whatever the case, the government has said it will not It will not compulsory to carry ID cards at all times.

Note that no-one will be able to apply for an ID card until 2009.  Also, until January 1st 2010, British citizens will be given an option to choose not to be issued with an ID card when ordering a new passport, (although their details will be entered on the National Identity Register).

Once all the relevant structures are in place and become fully operational, ID cards will be issued as stand-alone documents alongside existing ‘designated documents’ such as passports and visas – although this will not be the only means to get them.

For any foreign national living within the UK, the identity card will also act as a residence permit, residence card and/or registration certificate and will be linked to the National Identity Register (NIR) in the same way as all other British ID cards will be.

As touched upon in the previous article, the scheme will be made secure by the fact that all ID cards will not rely solely on the information printed on the card to prove who you are. The details on your ID card will be checked and confirmed through the Identity Verification Service (IVS) and against your record on the NIR. A fake ID card would be pretty useless if it did not a match your record on the NIR, and faking details that appear on the NIR would be almost impossible without using exceptional sophisticated means..

The government has sought to assure the British population that the whole scheme will not be an invasion of our privacy. The NIR will only hold details of basic Person-Identifying Information (PII) that is already held by various government departments, along with certain other elements of biometric information (like fingerprints and retina scans), and access to this information is very strictly limited by the Identity Cards Act of 2006.

Information will only be held for the purposes of proving identity and nothing else. No sensitive information like medical records will be held, although there will possibly be details of criminal records for certain crimes being held on the database. It remains to be seen what will eventually be included.

Whatever the case, we will all have the right to see what information about us is held on the NIR database.

The identity verification service (IVS) will allow accredited organisations to check your identity safely and quickly, with your permission of course. The intention here is to provide an efficient and secure way for banks, GPs, benefits offices and other organisations to check who you are when you approach them for any reason, thereby minimising the possibility of identity fraud in your name.

The IVS will work in a number of different ways depending on what information is needed at any given moment. So for example for a basic transaction that requires that you prove your age, the IVS would simply confirm that the ID card you are using is valid.

If you are not a British citizen and you are applying for a job within the UK the IVS would confirm that your particular visa allows you to work. Similarly, if someone is applying for work in a caring job or in a position of trust (such as a teacher or perhaps as a nanny) the service could confirm that this person does not have a criminal record or any outstanding warrants for his or her arrest.

But don’t worry too much about all this information being available. For any organisation to be able to access the IVS to find out any information about you, they would have to be fully accredited first, and even then only to access the sort of information relevant to your likely contact with them – so an off-license wouldn’t need or necessarily be able to access whether you have a criminal record or not, but it would be able to confirm your date of birth, as an example.

Overseen by an independent commissioner who reports to Parliament, the National Identity Scheme will be managed and administered by the Identity and Passport Service (IPS). This Service will incorporate the UK Passport Service and will also be work in conjunction with the UK Borders Agency (UKBA) and UKvisas.

The National Identity Register (NIR) will be a self-contained data system that will hold all Person-Identifying Information (PII) and unique for everyone who has enrolled in the scheme.

Although the NIR will contain information that will allow you to be identified easily by the relevant authorities, it will not contain private data like tax records, benefit records or medical records. Any other existent government records that concern you will not be kept in the NIR.

The intention is that once you have an Identity Registration Number (IRN) it will provide the various organisation you approach (like banks or government agencies) quick and accurate confirmation of who you are and thereby minimise the chance of errors or identity fraud.

To sign up with the NIR you need to apply for your ID card and formally register your identity. This will involve recording the biometric data you are asked for and submitting other elements of your PII to the scheme.

Registering your biometric information is a vitally important part of safeguarding your identity. Local enrolment centres will be opened right across the UK before long and mobile centres will be sent to more remote areas to make sure that as many people as possible have access to this service.

The utility of the British ID card programme is predicated wholly upon the success and efficiency of brand spanking new the National Identity Register (NIR) – started just this year (2008).

The system has been described by Government as being easy-to-use and extremely secure, containing personal identification for adults living in the UK – adults, in this case, being anyone over the age of 16 years.

The NIR scheme will be run by the Identity and Passport Service (IPS). The Government predicts that it will take several years yet for the NIR to become fully operational with everyone registered on and with it. Although this year saw the first enrolments of foreign nationals into the scheme, ID cards for British citizens are not expected to be available for issue in the UK before 2009.

The initial stages of the ID card programme will see them being issued to British citizens who apply for passports, either for a first time or to renew and old one, although they will eventually be available to people who do not want passports as well.

 For those who are resident within the UK but who are not British citizens, all residency permits, registration certificates or residency cards will take the form of an ID card instead.

The NIR scheme will eventually become compulsory, although the exact timescale of this has not been ironed out yet. Once it does become compulsory, all British citizens over the age of 16 will be required to have an ID card by law, although we are told that it will not be compulsory to carry it around with us at all times.

The information that will be stored on UK citizens will be a mix of unique biometric data, such as retinal scans and fingerprinting, and more other more mutable Person-Identifying Information.

We can expect the following personal details to be stored as part of the state-wide ID card programme:

- names

- fingerprints

- iris patterns

- facial image (as on passports and modern driving licenses)

- gender

- place and date of birth

- immigration status

- postal/living address

Details that we are told will not be part of our accessible personal database will include information such as:

Medical records

ethnic origin

tax records

religious beliefs

Your PII data will be stored on the National Identity Register database. Only Parliament will be able to amend what sorts of information can be stored on this database and access to the information will be very strictly limited and controlled.

That said, in addition to state agencies like the Benefits Office, the Police and perhaps certain elements of local government, certain private sector organisations will also be able to access your PII in the National Identity Register. So banks, for example, could ask you to prove your identity whenever you wish to open a new account, and accessing your PII will be part of that process. The same will apply when you register with a new GP.