News: More Details on ID Card Databases - Ministers Seeking Advice from Industry on Security

The Register is reporting this morning that the Identity minister has announced that UK ID Card scheme is to have 3 different databases: "There is the one that holds the fingerprints and facial image, the biometric data, and then the other information which is broadly what is on your passport already and the third bit is the one that links the two,"

The announcement was made at a meeting organised by the Social Market Foundation. Meg Hillier, the minister, also revealed that her department is still researching how best to to make remote use of ID Cards work.

An example of an ID card reader, visually like a larger version of a card reader used by retailers, was available at the conference. Hillier said that the government "needed to do more work on this" and was keen to hear the views of industry about how this will work, particularly about security.

News: Florence DETECTER Programme Announced

The second DETECTER Project Meeting will take place in Florence on Thursday the 18th of February 2010. The Programme will run as follows:

9.00 – 9.15 Introduction by Prof. Martin Scheinin, Professor of International Law at the European University Institute and United Nations Special Rapporteur on the protection of human rights while countering terrorism

9.15 – 11.00 Identification of terrorist suspects through detection technologies: risks and opportunities
Chair: Martin Scheinin (European University Institute, Italy)

• Ehud Givon (WECU-technologies, Israel) – Security through intent detection
• Jacques Verraes (Europan Commission, Belgium) – Data protection issues related to identification of terrorist suspects
• Ben Hayes (Statewatch, United Kingdom) – Respondent to presentations of Commission and WeCU technologies

11.00 – 11.30 Coffee break

11.30 – 13.30 Human rights aspects of the use of detection technologies

Chair: Daniel Moeckli (University of Zurich, Switzerland)

• Roos van der hilst (University of Oslo, Norway) – Human rights risks of selected detection technologies - sample uses by governments
• Emilio Mordini (HIDE, Italy) - Biometrics, Body, Identity
• R. Leenes (University of Tilburg, the Netherlands) – Location based surveillance – why planes, trains and automobiles are the new castles

13.30 – 15.00 Lunch

15.00-17.00 Martin Scheinin presenting WP4 Deliverable on "Developments in the Declarations of Exceptions, Claims of Inapplicability, or Unilateral Modifications in Respect of Internation Law for the Sake of Counter-Terrorism"

Limited Places - To register, please e-mail mathias.vermeulen@eui.eu

News: Facial Recognition Technology to be used at Cardiff Airport

Frome the Register: Cardiff now joins Manchester Airport in allowing inbound passengers to have their passports checked automatically with facial recognition systems. The option is available for adults with chipped biometric passports, issued since 2006, which, amongst other information, have a picture of the holder encoded on them that can be compared to the subject checking through.

The article refers to the embarassing revelations last year that facial recognition technology in use at Manchester airport was unable to distinguish between pictures of Wynona Ryder and Osama Bin Laden. This happened because the machines initially gave far too many false negatives, and in reponse staff turned the settings so low they effectively 'switched them off'.

News: Biometrics to be Used to Identify 'Outsiders' in Afghanistan

From the Sunday Times: in Afghanistan biometrics such as fingerprints, retina scans or DNA tests are being proposed as a means to draw up "gated communities" in which outsider 'rebels' can be swiftly identified. In Basra, patrolling US soldiers are being issued with iPODs with a list of all local people.

Brigadier James Cowan, the new commander of British forces in Afghanistan, gave an interview to the Sunday Times in which he emphasised the importance of reassuring the local population of UK and US ability to provide security.

For the brigadier it is all about challenging the Taliban’s rule of fear: “What you have to do is create communities where people wish to be separate from the enemy because they have the confidence to be separate from them.”

Cowan’s staff have embarked on a huge exercise known as “human terrain mapping”. It involves not only delineating tribal boundaries, but also family networks, land ownership and all the possible grievances that can be exploited by the Taliban.

News: More on facial recognition technology

According to a report from USA Today, the FBI has begun trials of facial recognition technology in North Carolina. Reportedly, the trials helped to identify a suspect to a double homicide who had seemingly relocated to North Carolina from California and assumed a false name. FBI officers took a photo from the suspect’s California driver’s license and ran it against the photos contained in North Carolina’s Department of Motor Vehicles database. From “dozens” of potential matches, an FBI investigator zeroed in on one particular individual. That individual has now been placed under arrest. Marc Rotenberg of EPIC, however, questioned how effective the use of such technologies will be in counter-terrorist efforts since good photos of terrorists will rarely be available in DMV databases or elsewhere.

News: UK ID Card Design and New ID Commissioner Unveiled

We can now see what UK ID cards will look like. There is an interesting post at Spy Blog asking some important questions:

Will the ID Card number be randomly allocated, or will it betray information about the ID Card controllee, through batch sequences, which can also help to break the cryptographic protections on the Contactless / RFID chip, just as happened with the Netherlands biometric passport ?

The post at Spy Blog also criticises the limitations of the powers of the new ID Commissioner, Sir Joseph Pilling:

The National Identity Scheme Commissioner is specifically forbidden by the
terms of reference which appoint him under the Identity Cards Act 2006 section 22 Appointment of National Identity Scheme Commissioner to look into the following activities, which are exactly the secret activities which are the most likely to abuse the National Identity Register, and which therefore should be scrutinised the most:

(4) The matters to be kept under review by the Commissioner do not
include--
(a) the exercise of powers which under this Act are exercisable by
statutory instrument or by statutory rule for the purposes of the Statutory
Rules (Northern Ireland) Order 1979 (S.I. 1979/1573 (N.I. 12));
(b) appeals against civil penalties;
(c) the operation of so much of this Act or of any
subordinate legislation as imposes or relates to criminal offences;
(d) the provision of information to the Director-General of the Security Service, the
Chief of the Secret Intelligence Service or the Director of the Government Communications Headquarters;
(e) the provision to another member of the
intelligence services, in accordance with regulations under section 21(5), of
information that may be provided to that Director-General, Chief or Director;
(f) the exercise by the Secretary of State of his powers under
section 38; or
(g) arrangements made for the purposes of anything mentioned in paragraphs (a) to (f).

News: Italy to Create National DNA Database

EDRI reports that after a long process the Italian Parliament has passed law 85 ratifying the Prum Convention and creating the legal basis for an Italian National DNA Database. EDRI is scathing, however, about the lack of safeguards built into the legislation. Particularly of note:

• "Lacks any general provision that would oblige all the responsible parties to adopt serious and adequate security measures against unauthorized access, data tampering, and illegal handling of data and information."
• It says "nothing about the need for a properly established chain of custody...[making it]...impossible for a "planted" or "altered" sample to be used."
• Nothing is said "about the effect of an improperly managed chain of custody on admissibility of the samples as evidence in Court"
• "Law enforcement officers can access the NDNA database without prior authorisation from the prosecutor or the judge that is responsible for the investigation involving the sample or profile in question (under Italian law, law enforcement bodies are under the direction and control of the public prosecutor). Since the article is silent about the matter, only future court decisions will determine whether prior authorization is needed to access the NDNA database, thus leaving wide open a window of several years in which "anything can happen".
• Requires "neither the positive identification of the personnel accessing the NDNA database and material in the central lab, nor the secure logging of access to and activity involving the profile and sample."
• Does not "clearly identify who is in charge of ordering the destruction of samples and profiles."
  
• Punishment for a public officer "that communicates or uses data and information without authorization, or for purposes other than those stipulated specifically in the law" is negligible: "a jail term of between one and three years...[which in practice could be reduced to]... "a final jail term of less than six months that could be avoided by simply paying a fine."
• By leaving white collar crime profiles out the legislation opens the door to the database skewing, say, the racial balance of future crime statistics.

News: UK Government Plans to Link ID Cards to Criminal Records

From Slashdot: Previously Government Ministers had denied that the ID database would contain criminal records, but have now admitted to a feasibility study on linking the National Identity Database to the Criminal Records Bureau. In a written statment they said that:

This research is still in the early stages of feasibility and several options are being considered as part of this work, including options for the use of ID card data and fingerprints. The CRB is not considering the use of other biometrics at this stage,