Andrew Dilnot and honest political debate in the UK – 2

Whitehall officials are impervious to all requests to explain their mistaken choices.

And yet they are happy to tell us that we need midata to correct our errors.

After you, Whitehall.

After you.

--- o O o ---

We all make mistakes.

That's what the Department for Business Innovation and Skills (BIS) say. Faced with a choice, we make the wrong decision. We need help. Computerised help. And BIS aim to provide that help, through their midata initiative. Applications will process our historical transaction data, they will take into account the products and services currently available from the suppliers, and the right transaction will be brokered for us.

It's not just us proletarians. We all make mistakes. Even Whitehall officials.

It's 10 years since the Home Office published their consultation on what became known as "ID cards", Entitlement Cards and Identity Fraud – A Consultation Paper. Crucial to the system was the belief that all 60 million of us in the UK could be identified by various biometrics, specifically facial geometry and flat print fingerprints.

Utter cockpoppy, the technology's simply not up to it. But the choice had been made. By December 2010, when the Identity Cards Act 2006 was repealed, the Home Office confessed to £292 million of our money having been wasted on the scheme, with nothing to show for it.

The waste goes on. We're wasting money on biometrics in Sarah Rapson's ePassports. We're wasting money on Jackie Keane's Immigration and Asylum Biometric System. That takes in eGates that don't work at UK airports and UK visa application checking systems that don't work all over the world. As part of Project Lantern, the police are deploying mobile fingerprinting equipment that doesn't work. And DWP are threatening to use voice biometrics that don't work for their new Universal Credit system.

It goes on because of one wrong choice made 10 years ago. The reliability of the products wasn't checked properly and adverse evidence was ignored. Typical headstrong proletarian behaviour, no idea what's in anyone's best interests, naïve consumers, too much money burning a hole in their pocket, just buy it because it looks good on TV and sounds modern.

How can you help?

You can write to ministers and their officials. That doesn't help. You can write magazine articles and letters to newspapers and comments on blogs and you can write your own blog. You can speak at public meetings and on the radio. That doesn't help. You can have meetings at the Home Office and ditto. You can respond to government consultations and attend government briefings. Fat lot of good it'll do you. You can write to your MP. He or she will get an answer for you. But it won't help. Whitehall wants biometrics and Whitehall's jolly well going to have biometrics, never mind if they don't work.

So then you have another idea. Get reinforcements. Call on organisations that have institutional power.

When the Home Office start advertising their misbegotten ID cards scheme and making unrealistic claims for the reliability of today's mass consumer biometrics, you report them to the Advertising Standards Authority. Brilliant. Except that there's nothing the ASA can do in this case.

So then you submit a freedom of information request asking what justification the Home Office have for investing public money in expensive systems which depend for their success on biometrics being reliable which they aren't and the Home Office know that perfectly well and therefore know that all or some of our money will be wasted. 2½ years later, thanks to the First-Tier Tribunal (Information Rights), you're 2½ years older and none the wiser, Whitehall continue bone-headedly against all the evidence to waste our money on biometrics.

Then Sir Michael Scholar, chair of the UK Statistics Authority, makes an important point:

One of the reasons I took this job is that having good statistics is like having clean water and clean air. It’s the fundamental material that we depend on for an honest political debate.

Honest political debate? Maybe the UKSA can help. Maybe if they or the Office for National Statistics said that the biometrics technology being considered is not reliable enough, then the Home Office would stop wasting our money? No good. The UKSA can only comment on official statistics. And the statistics adduced from the UK Passport Service biometrics enrolment trial aren't official.

This attempt to help the Home Office to make evidence-based policy and to face up to their mistake – choosing to rely on flaky biometrics – clearly goes back years. Lots of effort. No results. The fundamental material that we depend on for an honest political debate still eludes us.

And then Andrew Watson succeeds through a freedom of information request in getting the National Policing Improvement Agency's own internal report on mobile fingerprinting equipment published.

The report is full of statistics, it's marked "Restricted-Commercial", it's got Northrop Grumman's logo on it and it's been prepared for the Police Information Technology Organisation (the old name for the National Policing improvement Agency). Official, or what?

By this stage, Sir Michael Scholar has been replaced by Andrew Dilnot as chair of the UKSA. Can Mr Dilnot comment on the reliability of mass consumer biometrics? No. The statistics still aren't official enough:

From: xxxxxxxxxx On Behalf Of authority enquiries Sent: 01 August 2012 23:19 To: 'David Moss' Subject: Re: Misleading use by the Home Office and others of statistics associated with biometrics Dear Mr Moss Thank you for your email to Andrew Dilnot regarding biometric information. I am replying on Andrew's behalf. We have considered this matter in discussion with David Blunt, the Head of Profession for Statistics at the Home Office. We share Mr Blunt's view that the studies to which you refer are not official statistics, and we understand from the Home Office that there are no current plans for official statistics in this area to be produced. As you will be aware from our earlier replies, the Authority's statutory remit covers official statistics as set out in the Statistics and Registration Service Act 2007. Our view therefore is that this remains a matter about which we would continue to encourage you to maintain a dialogue with relevant Home Office officials directly. We understand that you attended a meeting with Home Office officials in spring 2010 and, following further correspondence, you received a reply from the National Policing Improvement Agency in June 2010 regarding the specifics of the issues that concerned you. I am sorry that we are unable to assist you further at the present time. Kind regards xxxxxxxxxx Private Secretary to Andrew Dilnot, Chair of the UK Statistics Authority

UK Border Force staff are laid off in the expectation that they can be replaced by biometric technology, then the queues at the airport get too long because the technology doesn't work and the staff have to be re-hired, but still Whitehall remains incapable of justifying its investment of public money in biometric technology which is too unreliable to do the jobs demanded of it. Incapable and unwilling.

Whitehall officials are impervious to all requests to explain their mistaken choices. And yet they are happy to tell us that we need midata to correct our errors.

Andrew Dilnot and honest political debate in the UK – 2

Whitehall officials are impervious to all requests to explain their mistaken choices.

And yet they are happy to tell us that we need midata to correct our errors.

After you, Whitehall.

After you.

--- o O o ---

We all make mistakes.

That's what the Department for Business Innovation and Skills (BIS) say. Faced with a choice, we make the wrong decision. We need help. Computerised help. And BIS aim to provide that help, through their midata initiative. Applications will process our historical transaction data, they will take into account the products and services currently available from the suppliers, and the right transaction will be brokered for us.

It's not just us proletarians. We all make mistakes. Even Whitehall officials.

Political will (if any) trounced by Dame Helen Ghosh and the Whitehall ancien régime

Trust the Home Office.

Last year's annual report and accounts to 31 March 2011 said that the UK Border Agency (UKBA) reduced its staff by about 1,900 during 2010-11 and planned to reduce it by a further 3,500 by 31 March 2015. These reductions would all be achieved by "efficiencies".

So there they were, dutifully implementing government policy, cutting staff.

On 22 November 2011, Dame Helen Ghosh DCB, permanent secretary at the Home Office, gave evidence to the Home Affairs Committee and said that the Border Force – part of UKBA at the time – would be reduced by 900 or so:

... that is driven as much by technological introductions like e-gates, as well as a risk-based approach. Border Force will be getting smaller ...

Advanced risk management and technology, all very modern, just the ticket for 21st century government, spearheaded by the dependable brainpower at the top of the Home Office.

Since then we have had queues at Heathrow, one actual strike by the Border Force and one threatened one and now what do the Times tell us?

Border Force in recruitment drive U-turn Hundreds of new immigration officers are to be recruited by the UK Border Force weeks after it disclosed that 450 staff were cut last year to meet government spending cuts ... The Home Office also admitted that advertisements for the new jobs placed on a Civil Service website said, inaccurately, that 800 new staff were required ... Over the next few weeks it intends to recruit more officers than the total of 457 lost in the year to March 2012 ... Keith Vaz, chairman of the Commons Home Affairs Select Committee, said: “I find it extraordinary that a year after making so many people redundant and paying so much in terms of redundancy costs, the very same organisation is now recruiting more immigration officers. It shows a lack of strategic planning concerning staff at both the UK Border Agency and UK Border Force” ...

Given that the technology doesn't work and we're going back to the 19th century and using people, will the technology contracts for eGates and  Jackie Keane's Immigration and Asylum Biometric Service be cancelled?

No.

We shall simply pay for both – for the additional staff and for the technology that doesn't work. The budget deficit will have to be cut somewhere else, not at Dame Helen's 21st century modern Home Office. Predictable result:

Whitehall 1 - 0 Westminster

Trust the Home Office.

Political will (if any) trounced by Dame Helen Ghosh and the Whitehall ancien régime

Trust the Home Office.

Last year's annual report and accounts to 31 March 2011 said that the UK Border Agency (UKBA) reduced its staff by about 1,900 during 2010-11 and planned to reduce it by a further 3,500 by 31 March 2015. These reductions would all be achieved by "efficiencies".

So there they were, dutifully implementing government policy, cutting staff.

Biometrics – don't ask, don't tell

Police forces all over the UK are introducing mobile fingerprint equipment. Result? Approximately 20% of the criminals who would otherwise have been taken down to the station will now be asked politely to go on their way. That's what we were saying back in May.

Don't ask
DMossEsq wrote to his MP asking about this matter. Would Nick Herbert, the policing minister, care to comment? Or the National Policing Improvement Agency (NPIA)? Could they explain why public money is being wasted on technology that doesn't work?

And thanks to his MP an answer has now come through from Chief Constable Nick Gargan, Chief Executive of NPIA.

Don't tell
Does Mr Gargan express confidence in the biometrics being used? No.

Does he say that mobile fingerprinting will improve crime prevention or crime detection or crime clear-up rates? No.

He doesn't disagree that there is a 20% failure rate associated with flat print fingerprinting based on the 2004 UK Passport Service biometrics enrolment trial.

Rather endearingly – obviously a conservative man with a respect for tradition – he tries on the old line that the biometrics enrolment trial wasn't really a biometrics enrolment trial but it won't wash.

That high 20% failure rate in the biometrics enrolment trial was caused, he says, by using only a small sensor to scan people's fingerprints. That was then. Policemen on patrol are now being issued with so-called "Bluecheck" devices. And what do they use? According to Mr Gargan, only a small sensor to scan people's fingerprints.

The technology has improved, he claims. Is the failure rate down from 20% to 2%? Or 0.2%? He doesn't say. All he says is that the technology has improved. An unsupported and unquantified assertion.

What's the point?
"Finally and perhaps most importantly", Mr Gargan says, policemen on patrol can always ignore the Bluecheck results and take suspects down to the station anyway.

Don't worry
The Home Office are investing your money wisely. You are much safer as a result.

----------

Cribsheet
Given the choice of two giants, Gargantua and Pantagruel, the English choose one and the Italians the other. Whereas we might say in English that the scale of the deception being practised on the public by the Home Office is "gargantuan", for example, in Italian they would call it "pantagruelico". Not many people know that.

Gustave Doré's 1873 illustration for Gargantua,
the second (1534) of
François Rabelais's series of five novels,
La vie de Gargantua et de Pantagruel

Biometrics – don't ask, don't tell

Police forces all over the UK are introducing mobile fingerprint equipment. Result? Approximately 20% of the criminals who would otherwise have been taken down to the station will now be asked politely to go on their way. That's what we were saying back in May.

Don't ask
DMossEsq wrote to his MP asking about this matter. Would Nick Herbert, the policing minister, care to comment? Or the National Policing Improvement Agency (NPIA)? Could they explain why public money is being wasted on technology that doesn't work?

And thanks to his MP an answer has now come through from Chief Constable Nick Gargan, Chief Executive of NPIA.

It's the way he tells 'em

Woody Allen: "This guy goes to a psychiatrist and says, Doc, my brother’s crazy. He thinks he’s a chicken. The doctor says, Well, why don’t you turn him in? And the guy says, I would but I need the eggs".

DMossEsq: "This permanent secretary goes to a politician and says, Minister, biometrics don't work. But we keep spending money on them. The politician says, Well, why don’t you lock up the cheque book? And the permanent secretary says, I would but I need an identity assurance system".

It's the way he tells 'em

Woody Allen: "This guy goes to a psychiatrist and says, Doc, my brother’s crazy. He thinks he’s a chicken. The doctor says, Well, why don’t you turn him in? And the guy says, I would but I need the eggs".

DMossEsq: "This permanent secretary goes to a politician and says, Minister, biometrics don't work. But we keep spending money on them. The politician says, Well, why don’t you lock up the cheque book? And the permanent secretary says, I would but I need an identity assurance system".

HMG's cloud computing strategy – there isn't one – and the Edgbaston Test

On 20 October 2011 Chris Chant listed 23 symptoms of the illness which Government IT suffers from. He carried on energetically repeating his diagnosis, unchallenged, and promoting cloud computing as the effective prescription. There he was, at it again, six months later on 11 April 2012, in a blog post on the G-Cloud website, #Unacceptable IT is pervasive. Two days later his resignation was announced.

The man in charge of G-Cloud is Andy Nelson, the Government's Chief Information Officer (CIO). That's only a part-time job. He is more fully occupied as CIO at the Ministry of Justice, where he's got his work cut out with Libra among other things. Libra is the £467 million Fujitsu system which is meant to produce the accounts for HM Courts and Tribunals Service. When the National Audit Office saw the 2010-11 accounts they were in such a mess that the NAO couldn't even qualify their opinion, they had to disclaim an opinion.

Under Mr Nelson, Denise McDonagh is also responsible for G-Cloud. Again, it's only a part-time job. Her day job is CIO at the Home Office. And again, there are quite a few distractions there:

• There's the £385 million CSC contract with Sarah Rapson's Identity & Passport Service which is one of the reasons UK passport-holders are currently being over-charged by £300 million a year.
• There's the £265 million IBM contract with the UK Border Agency to provide IABS, Jackie Keane's Immigration and Asylum Biometric System. IABS is meant to keep the UK border secure and make the 2012 Olympics safe but there's a problem – the biometrics don't work.
• The same problem applies to the National Policing Improvement Agency's promotion of MobileID, a system to allow policemen on patrol to check suspects' fingerprints on the spot using mobile equipment. The idea is for MobileID to save police time. Which it will because, with a 20% failure rate, this flaky technology will cause 20% fewer criminals to be arrested.

Those distractions and others will no doubt explain her lacklustre post on 26 April 2012, Cloud Cynicism (or Dispelling the Dark Clouds) and why she hasn't been heard from since.

Not so, Eleanor Stewart. She's a trouper. She's the Assistant Director of G-Cloud and she's always good for a lively post. On 27 April 2012 she produced Crowdsourcing and a response., in which she took up some of the many questions posed in the 20 responses to Chris Chant's last post.

What the heck can we do to resolve some of the scary and largely unknown legal and policy issues that people are nervous about in a globalised world?, she asked. Good question. No answer.

And What ‘worked examples’ might we be able to provide to ... sceptics? That's in response to the simple question how cloud computing is supposed to obviate the need for long contracts to produce systems like Libra, for example, or IABS or DWP's Universal Credit. Chris Chant says it will. How? No answer.

Ms Stewart threw the post open to the crowd. And published one comment. One. The limiting case of a crowd. (I wandered lonely as a cloud?)

"Scary and largely unknown"? Hmm. Quite clearly, no-one in HMG knows the answers to some very basic questions about its cloud computing strategy. Which is odd. They keep talking about it. Andy Nelson, for example, was holding forth at the Cloud Computing World Forum only the other day. And they've been advocating it for years – the G-Cloud Overview was being touted in August 2010. But still no-one can answer the questions.

Is it all hot air? A cloud of hot air? A cloud which, when it hits some of the colder patches of reality, results in heavy precipitation and the wettest drought ever seen, which washed out the Edgbaston Test? That's certainly what it looks like at this end of the wicket.

----------

A version of this post has been kindly published by the estimable PublicTechnology.net

HMG's cloud computing strategy – there isn't one – and the Edgbaston Test

On 20 October 2011 Chris Chant listed 23 symptoms of the illness which Government IT suffers from. He carried on energetically repeating his diagnosis, unchallenged, and promoting cloud computing as the effective prescription. There he was, at it again, six months later on 11 April 2012, in a blog post on the G-Cloud website, #Unacceptable IT is pervasive. Two days later his resignation was announced.

Protecting civilisation from the fingers of terror

Here's a quotation from an article in New Scientist magazine. You need to know that Visionics is a biometrics company that specialises in face recognition. Now you're an expert:

Airport security isn't the only use for face-recognition software: it has been put through its paces in other settings, too. One example is "face in the crowd" on-street surveillance, made notorious by a trial in the London Borough of Newham. Since 1998, some of the borough's CCTV cameras have been feeding images to a face-recognition system supplied by Visionics, and Newham has been cited by the company as a success and a vision of the future of policing. But in June this year, the police admitted to The Guardian newspaper that the Newham system had never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest.

Admitted ... the police admitted ...

Clearly, the Newham police, for all sorts of human reasons, somehow entrapped themselves in a deception perpetrated on the public at public expense. Has it happened again?

Last week, Assistant Commissioner Mark Rowley was singing the praises of the mobile fingerprint readers now issued to policemen patrolling in 28 of the UK's 56 police forces. Home Office figures suggest that the flat print fingerprint technology used in these devices fails about 20% of the time.

Equally clearly, and to the credit of the Newham police, they finally extricated themselves from this fraud with their admission. Will that happen again?

How long before we read in New Scientist that:

... Assistant Commissioner Mark Rowley admitted to __________ that the MobileID initiative had never even matched the fingerprints of a person on the street to a set of dabs in its database of known offenders, let alone led to an arrest. In fact all it had achieved was to reduce the chances of a felon being taken down to the nick by a straight 20% at a stroke.

For anyone interested in the history of biometrics companies, i.e. how we got into this mess, please note that:

• After the Newham debacle Visionics was taken over by Identix.
• Identix supplied the biometrics technology for the UK Passport Service biometrics enrolment trial from which the 20% failure rate for flat print fingerprinting is taken.
• Identix was taken over by L-1 Identity Solutions.
• L-1 was bought by Safran.
• And Safran provide the biometrics we depend on for the success of IABS, the Immigration and Asylum Biometrics System which is meant to keep the UK border secure and to make the 2012 Olympics safe.

Please note also that the New Scientist article quoted above appeared in the 7 September 2002 issue of the magazine, nearly 10 years ago. The article is so full of important observations of mendacity, opportunism and technological incompetence still relevant today that it is further quoted with grateful acknowledgement below:

Face-off I CAME here looking for an argument but I can't find one. All round this lofty exhibition hall - billed as the world's biggest market for security equipment - the people selling face-recognition systems are being disarmingly, infuriatingly honest ... I thought they'd at least attempt to defend the technology. When they don't, it's me who's caught off guard. Is it true that the systems can't recognise someone wearing sunglasses? Yes, they say. Is it true that if you turn your head and look to one side of the camera, it can't pick you out? Again, yes. What about if you simply don't keep your head still? They nod. Maybe nine or ten months ago they would have risen to the bait. In those days the face-recognition industry was on a high. In the wake of 11 September, Visionics, a leading manufacturer, issued a fact sheet explaining how its technology could enhance airport security. They called it "Protecting civilization from the faces of terror". The company's share price skyrocketed, as did the stocks of other face-recognition companies, and airports across the globe began installing the software and running trials. As the results start to come in, however, the gloss is wearing off. No matter what you might have heard about face-recognition software, Big Brother it ain't ... Image Metrics, a British company that develops image-recognition software, ... warned of the danger of exaggerated claims, saying that "an ineffective or poorly applied security technology is as dangerous as a poorly tested or inappropriately prescribed drug" ... to catch 90 per cent of suspects at an airport, face-recognition software would have to raise a huge number of false alarms. One in three people would end up being dragged out of the line - and that's assuming everyone looks straight at the camera and makes no effort to disguise themselves ... Palm Beach International Airport in Florida released the initial results of a trial using a Visionics face-recognition system. The airport authorities loaded the system with photographs of 250 people, 15 of whom were airport employees. The idea was that the system would recognise these employees every time they passed in front of a camera. But, the airport authorities admitted, the system only recognised the volunteers 47 per cent of the time while raising two or three false alarms per hour ... To give themselves the best chance of picking up suspects, operators can set the software so that it doesn't have to make an exact match before it raises the alarm. But there's a price to pay: the more potential suspects you pick up, the more false alarms you get. You have to get the balance just right. Visionics - now called Identix after merging with a fingerprint-scanning company in June - is quick to blame its system's lacklustre performance on operators getting these settings wrong ... Numerous studies have shown that people are surprisingly bad at matching photos to real faces. A 1997 experiment to investigate the value of photo IDs on credit cards concluded that cashiers were unable to tell whether or not photographs matched the faces of the people holding them. The test, published in Applied Cognitive Psychology (vol 11, p 211), found that around 66 per cent of cashiers wrongly rejected a transaction and more than 50 per cent accepted a transaction they should have turned down. The report concluded that people's ability to match faces to photographs was so poor that introducing photo IDs on credit cards could actually increase fraud. The way people change as they age could also be a problem. A study by the US National Institute of Standards and Technology investigated what happens when a face-recognition system tries to match up two sets of mugshots taken 18 months apart. It failed dismally, with a success rate of only 57 per cent. There's another fundamental problem with using face-recognition software to spot terrorists: good pictures of suspects are hard to come by ... Very few security personnel at American airports have CIA clearance, so they aren't allowed to see the images. "Until they've got cleared personnel in each of those airports they can't stop terrorists getting on planes," says Iain Drummond, chief executive of Imagis technologies, a biometrics company based in Vancouver, Canada ... Airport security isn't the only use for face-recognition software: it has been put through its paces in other settings, too. One example is "face in the crowd" on-street surveillance, made notorious by a trial in the London Borough of Newham. Since 1998, some of the borough's CCTV cameras have been feeding images to a face-recognition system supplied by Visionics, and Newham has been cited by the company as a success and a vision of the future of policing. But in June this year, the police admitted to The Guardian newspaper that the Newham system had never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest.

There are more of these gems available in the DMossEsq treasure trove of mendacity, Biometrics: guilty until proven innocent.

Look at the Image Metrics quotation above, "an ineffective or poorly applied security technology is as dangerous as a poorly tested or inappropriately prescribed drug". Prescription drugs are subject to extensive testing before the regulators will sanction their release to the public. Without that, we'd all be dead. The same goes for aircraft design. Without the Civil Aviation Authority, a lot more of us would be dead.

There is none of that open, public, peer-reviewed testing regime when it comes to the government wasting our money on biometrics. Try to find out what justification there is for Whitehall's decision to invest in biometrics and you get a two-year court case and no information.

There is no good reason for this peculiar asymmetry.

How do we avoid the recurrence of Newham-style embarrassments?

It's about time the Office for National Statistics was involved in Whitehall technology decisions and that initiatives which depend on reliable technology should not be allowed to incur substantial public expenditure before and unless the ONS has agreed and published official statistics supporting the business case.

Protecting civilisation from the fingers of terror

Here's a quotation from an article in New Scientist magazine. You need to know that Visionics is a biometrics company that specialises in face recognition. Now you're an expert:

Airport security isn't the only use for face-recognition software: it has been put through its paces in other settings, too. One example is "face in the crowd" on-street surveillance, made notorious by a trial in the London Borough of Newham. Since 1998, some of the borough's CCTV cameras have been feeding images to a face-recognition system supplied by Visionics, and Newham has been cited by the company as a success and a vision of the future of policing. But in June this year, the police admitted to The Guardian newspaper that the Newham system had never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest.

Admitted ... the police admitted ...

Clearly, the Newham police, for all sorts of human reasons, somehow entrapped themselves in a deception perpetrated on the public at public expense. Has it happened again?

Last week, Assistant Commissioner Mark Rowley was singing the praises of the mobile fingerprint readers now issued to policemen patrolling in 28 of the UK's 56 police forces. Home Office figures suggest that the flat print fingerprint technology used in these devices fails about 20% of the time.

Equally clearly, and to the credit of the Newham police, they finally extricated themselves from this fraud with their admission. Will that happen again?

How long before we read in New Scientist that:

... Assistant Commissioner Mark Rowley admitted to __________ that the MobileID initiative had never even matched the fingerprints of a person on the street to a set of dabs in its database of known offenders, let alone led to an arrest. In fact all it had achieved was to reduce the chances of a felon being taken down to the nick by a straight 20% at a stroke.

The Home Office, Heathrow Airport, the security of the UK border and the safety of the Olympics

Here's a copy of a press release that's just been issued. Forgot to mention the French. Zut. They're lapping it up, too, just like the Indians.

PRESS RELEASE

To:

Home Office

OIG (re US-VISIT)

IDABC (re OSCIE)

China (re Golden Shield)

Pakistan (re NADRA)

FBI (re NGI)

UIDAI (re Aadhaar)

Agencies

The Home Office – Misfeasance in public office

23 May 2012

Six questions for editors to ponder:

• The Home Office have been asked to reassure the public by publishing a justification for spending public money on biometrics technology they've previously proved to be useless. For 2½ years they've refused. Nor did they present any evidence as to the reliability of their chosen biometrics to the court. Why? Is it because they can't? Is it because there is no justification and our money is, indeed, being wasted?
• The court sees no iniquity in that potential waste of money and describes it as not "in itself or in any way material". If this isn't an iniquity, what is?
• We are assured by the Home Office and the court that the procurement of IABS didn't break any UK or EU rules. That finding of the court is accepted but so what? The Home Office are still refusing to release the IBM trial report to the public. They go further. The Home Office say the trial was conducted under such specific constraints that reading the report wouldn’t tell the public much. In other words they admit that they have no justification whatever for spending our money on biometrics. The procurement complies with the rules but it could still be iniquitous and the Home Office could still be guilty of misfeasance in public office.
• Dame Helen Ghosh, Permanent Secretary at the Home Office, told the Home Affairs Committee that "... there are plans ... to reduce the staff of the Border Force by around 900 people ... that is driven as much by technological introductions like e-gates, as well as a risk-based approach. Border Force will be getting smaller". Is it wise to replace human beings with technology that costs more and doesn't work?
• Rob Whiteman, Chief Executive of what's left of the UK Border Agency, says of IABS in the March 2012 issue of the staff magazine that "the system, delivered by the agency in partnership with Suppliers IBM, Morpho, Fujitsu, Atos Origin and Software AG, is the first multi-modal biometric matching system. It provides greater accuracy in fingerprint matching together with an integrated facial matching element. It delivers a more comprehensive service, underpinning the agency’s objective to secure our border and reduce immigration". It isn't the first. Pakistan's was the first, and much good it's done that unfortunate country. The IABS biometrics provided by Morpho could be more reliable than the previous system but still useless. Just a little less useless. Is Mr Whiteman misleading his staff as to the history and the reliability of UKBA's biometrics?
• Sir David Normington, Dame Helen's predecessor, caused Lin Homer and Brodie Clark to write to David Moss asserting that smart gates were being installed at UK airports on the basis of a trial at Manchester Airport. When John Vine, the Independent Chief Inspector of the UK Border Agency, as he then was, reported on his May 2010 inspection of Manchester Airport, he said "we could find no overall plan to evaluate the success or otherwise of the facial recognition gates at Manchester Airport and would urge the Agency to do so [as] soon as possible". This evidence of the Home Office consistently misleading the public, Parliament, ministers, the media and its staff was put before the court. The Home Office made no response. Neither did the court in its decision. The allegation is a serious one. Why doesn't it warrant a response?

At the oral hearing in the matter of David Moss v Information Commissioner and the Home Office held on 24 February 2012, David Moss turned up in court and so did the Information Commissioner's staff and his barrister, but the Home Office didn't.

Why not?

The hearing concerned the Home Office's Immigration and Asylum Biometric System. IABS was due to go live at the border by the end of 2011 under the direction of Ms Jackie Keane, a senior civil servant at the UK Border Agency. She missed that date but bits of IABS went live at the end of February, with the results we all saw in the ensuing weeks, Heathrow at 'breaking' point as Border Force struggles to cope, leaked memos warn, ‘Minister lying over Heathrow queues’ says BA chief, and so on. We may surmise that the Home Office were too busy to attend.

On the other hand, the barrister who has represented the Home Office since the case began a year ago was there in court, except that this time he was representing IBM.

Why?

Because IABS is an IBM contract. It was awarded to them in 2009.

Stacked to the rafters with Nobel prize-winners in most disciplines, nevertheless IBM had no particular expertise in biometrics and no products of their own. They arranged a competition between six biometrics companies and chose Sagem Sécurité (now Morpho) as the best. In the process, they also made good their lack of biometrics expertise – in fact, IBM played a blinder there.

IABS was initially estimated to be worth £265 million and a lot of that money – public money, your money and mine – is being wasted according to David Moss because the biometrics chosen by the Home Office don't work. That's what the case is about.

You know they don't work. You read the BBC's report on the year-long trial of biometrics, ID cards scheme dubbed 'a farce'. You read the Telegraph's report on the smart gates installed at UK airports, Airport face scanners 'cannot tell the difference between Osama bin Laden and Winona Ryder'. You watched Brodie Clark tell the Home Affairs Committee that fingerprint checks are the least reliable identity/security checks made at the border, the ninth and bottom priority for his (now ex-)Border Force officers and the most sensible check to drop when the queues build up and threaten to get out of control.

David Moss lost the case anyway. It was a 2-to-1 majority decision against, a sort of a Minority Report 2 – they may not work at Heathrow or anywhere else in the real world but biometrics are the bee's knees in Hollywood films.

With the explicit permission of the court and the Home Office and the Information Commissioner you can read IBM's evidence in the case, please see attached. IBM's Commercial Director on IABS, Mr Nicholas Swain, explains that all the testing on biometrics was done by IBM and the results belong to IBM and that's why the public aren't allowed to see them despite paying for IABS. We're just meant to suppose that IABS will help to make the border secure and keep the Olympics safe despite all the respectable published evidence to the contrary. You can read Jackie Keane's evidence, too. She agrees with Nick.

It was all IBM's idea according to Ms Keane. OK, the Home Office gave IBM five million pairs of fingerprints to use as test data. And the Home Office specified the acceptance tests that had to be passed. And the Home Office agreed to pay IBM £265 million. But that's all.

It's been a long haul. It goes back 2½ years to a Freedom of Information request submitted on 6 January 2010. And it's not over yet because the other day David Moss submitted an application for permission to appeal. This could go on for years more.

While we're waiting for closure, we have those six questions above to ponder. And this one – what's IABS really about? It's obviously nothing to do with biometrics, as the court effectively acknowledges at paragraph 8 of its decision.

All relevant documents can be discovered at:

http://dematerialisedid.com/bcsl/foi.html

---

Notes to editors

1. As the Treasury Solicitors say (30 April 2012), "the submissions and open evidence lodged with the Tribunal in this case were relied upon and put in evidence at a hearing held in public". We really do all have permission to quote from this material and to comment on it.

2. Without wishing in any way to "lead" you, it is suggested that it will be most fruitful to start with the evidence submitted by the Home Office and IBM. And the evidence of Professor Ross Anderson at the University of Cambridge Computer Laboratory who points out that the banks have rejected biometrics as being too unreliable and asks why in that case do the Home Office trust them?

3. The background to this case is set out in the first few pages of the appeal document and centres on Whitehall’s competence and its duty to acknowledge the supremacy of Parliament, a subject which you will see there exercises the Home Affairs Committee.

4. Where does this story fit in the newspaper or on the radio/TV current affairs programme? Not on the fashion pages perhaps, but certainly in horoscopes and probably almost anywhere else – UK news, international news (they're all at it, look at India), EU news (the European Commission love biometrics and "eIDs", electronic identities), Westminster/politics, Whitehall/governance, the business pages, law reports/the Constitution, travel, sport (c.f. security at the Olympics generally and specifically UKBA's trip to Istanbul for the world wrestling championships to collect biometrics), the technology pages, cartoons, the crossword, ...

---

About David Moss
David Moss has worked as an IT consultant since 1981. The past 9 years have been spent campaigning against the Home Office's plans to introduce government ID cards into the UK. It must now be admitted that the Home Office are much better at convincing people that these plans are a bad idea than anyone else, including David Moss.

----------

Updated 21.2.18

It's getting on for six years since the blog post above was published.

Nothing has changed as far as the Home Office are concerned:

• Despite their record, the Home Office are still in charge of UK border control and they still find it a challenge, to put it politely, please see Border Force not ready for extra checks, claim MPs and Time has run out for May’s Brexit immigration plan.
• The director of strategy and transformation at the UK Border Force is Mr Christophe Prince according to his LinkedIn entry, the same man who was a deputy director of the UK Border Agency (RIP) for the three years 2006-09.
• And the UK Border Force still relies on IABS, the Immigration and Asylum Biometrics System, run for the moment by IBM and still relying on Morpho biometrics technology.

In the outside world things have moved on a little:

• The UK Government Digital Service (GDS) have contracted with Morpho to supply "identity provider" services to GOV.UK Verify (RIP), the failed identity assurance scheme.
• GDS have stated it as a strategic objective of theirs to incorporate more biometrics into public services on the basis that it's innovative to do so.
• And Safran have sold Morpho to private equity investors, who have changed its name to Idemia.

Idemia gets about a bit. It always has, whatever it was called at the time.

In 2012 they were found guilty of bribery to win business in Nigeria. The bribery of which they were found guilty took place between 2000 and 2003. They appealed and had the verdict overturned in 2015.

There was a spot of bother in Kenya when the opposition party claimed that Idemia had cost them the August 2017 general election. It was the devil's own job for the Kenyan authorities to have the October re-run conducted the way they wanted, and not Idemia.

There was the earlier problem revealed by Naomi Klein in 2008 when she discovered that face recognition technology being used in Operation Golden Shield had been sold to China by L-1 Identity Solutions, Inc., a company subsequently bought by Idemia. That trade is against the law in the US. It is barred by the US Commerce Department's Bureau of Industry and Security post-Tiananmen export controls.

Everything seemed to be going profitably enough for Idemia in India, where their products are used for biometric registration under Aadhaar, the identity assurance scheme for 1.2 billion Indians, until ...

... enter Russia. Idemia allegedly bought some Russian software and inserted it into its own products to improve performance but didn't tell anyone.

Now that some disaffected Idemia ex-employees have made this allegation, the Indians are a little non-plussed. Rather as the Americans may be, also: "The company, now named Idemia, has provided fingerprint-recognition software to the Department of Defense and agencies in 28 states and 36 cities or counties across the US — from the Orange County Sheriff’s Department to the New York Police Department", not to mention the FBI. Cue fears of cyber-espionage being carried out by software buried deep in the security, military and justice systems.

What goes around comes around. The Indians are also worried about allegations that some other software they use in Aadhaar has CIA tools hidden in it but that's another story.

The question here is, do GDS and the Home Office want anything to do with Idemia? How well-prepared are they? Why take the risk? What's the point? After all, it's not as though the biometrics works.

The Home Office, Heathrow Airport, the security of the UK border and the safety of the Olympics

Here's a copy of a press release that's just been issued. Forgot to mention the French. Zut. They're lapping it up, too, just like the Indians.

PRESS RELEASE

To:

Home Office

OIG (re US-VISIT)

IDABC (re OSCIE)

China (re Golden Shield)

Pakistan (re NADRA)

FBI (re NGI)

UIDAI (re Aadhaar)

Agencies

The Home Office – Misfeasance in public office

23 May 2012

Six questions for editors to ponder:

• The Home Office have been asked to reassure the public by publishing a justification for spending public money on biometrics technology they've previously proved to be useless. For 2½ years they've refused. Nor did they present any evidence as to the reliability of their chosen biometrics to the court. Why? Is it because they can't? Is it because there is no justification and our money is, indeed, being wasted?
• The court sees no iniquity in that potential waste of money and describes it as not "in itself or in any way material". If this isn't an iniquity, what is?
• We are assured by the Home Office and the court that the procurement of IABS didn't break any UK or EU rules. That finding of the court is accepted but so what? The Home Office are still refusing to release the IBM trial report to the public. They go further. The Home Office say the trial was conducted under such specific constraints that reading the report wouldn’t tell the public much. In other words they admit that they have no justification whatever for spending our money on biometrics. The procurement complies with the rules but it could still be iniquitous and the Home Office could still be guilty of misfeasance in public office.
• Dame Helen Ghosh, Permanent Secretary at the Home Office, told the Home Affairs Committee that "... there are plans ... to reduce the staff of the Border Force by around 900 people ... that is driven as much by technological introductions like e-gates, as well as a risk-based approach. Border Force will be getting smaller". Is it wise to replace human beings with technology that costs more and doesn't work?
• Rob Whiteman, Chief Executive of what's left of the UK Border Agency, says of IABS in the March 2012 issue of the staff magazine that "the system, delivered by the agency in partnership with Suppliers IBM, Morpho, Fujitsu, Atos Origin and Software AG, is the first multi-modal biometric matching system. It provides greater accuracy in fingerprint matching together with an integrated facial matching element. It delivers a more comprehensive service, underpinning the agency’s objective to secure our border and reduce immigration". It isn't the first. Pakistan's was the first, and much good it's done that unfortunate country. The IABS biometrics provided by Morpho could be more reliable than the previous system but still useless. Just a little less useless. Is Mr Whiteman misleading his staff as to the history and the reliability of UKBA's biometrics?
• Sir David Normington, Dame Helen's predecessor, caused Lin Homer and Brodie Clark to write to David Moss asserting that smart gates were being installed at UK airports on the basis of a trial at Manchester Airport. When John Vine, the Independent Chief Inspector of the UK Border Agency, as he then was, reported on his May 2010 inspection of Manchester Airport, he said "we could find no overall plan to evaluate the success or otherwise of the facial recognition gates at Manchester Airport and would urge the Agency to do so [as] soon as possible". This evidence of the Home Office consistently misleading the public, Parliament, ministers, the media and its staff was put before the court. The Home Office made no response. Neither did the court in its decision. The allegation is a serious one. Why doesn't it warrant a response?

At the oral hearing in the matter of David Moss v Information Commissioner and the Home Office held on 24 February 2012, David Moss turned up in court and so did the Information Commissioner's staff and his barrister, but the Home Office didn't.

Why not?

The hearing concerned the Home Office's Immigration and Asylum Biometric System. IABS was due to go live at the border by the end of 2011 under the direction of Ms Jackie Keane, a senior civil servant at the UK Border Agency. She missed that date but bits of IABS went live at the end of February, with the results we all saw in the ensuing weeks, Heathrow at 'breaking' point as Border Force struggles to cope, leaked memos warn, ‘Minister lying over Heathrow queues’ says BA chief, and so on. We may surmise that the Home Office were too busy to attend.

On the other hand, the barrister who has represented the Home Office since the case began a year ago was there in court, except that this time he was representing IBM.

Why?

Because IABS is an IBM contract. It was awarded to them in 2009.

Stacked to the rafters with Nobel prize-winners in most disciplines, nevertheless IBM had no particular expertise in biometrics and no products of their own. They arranged a competition between six biometrics companies and chose Sagem Sécurité (now Morpho) as the best. In the process, they also made good their lack of biometrics expertise – in fact, IBM played a blinder there.

IABS was initially estimated to be worth £265 million and a lot of that money – public money, your money and mine – is being wasted according to David Moss because the biometrics chosen by the Home Office don't work. That's what the case is about.

You know they don't work. You read the BBC's report on the year-long trial of biometrics, ID cards scheme dubbed 'a farce'. You read the Telegraph's report on the smart gates installed at UK airports, Airport face scanners 'cannot tell the difference between Osama bin Laden and Winona Ryder'. You watched Brodie Clark tell the Home Affairs Committee that fingerprint checks are the least reliable identity/security checks made at the border, the ninth and bottom priority for his (now ex-)Border Force officers and the most sensible check to drop when the queues build up and threaten to get out of control.

David Moss lost the case anyway. It was a 2-to-1 majority decision against, a sort of a Minority Report 2 – they may not work at Heathrow or anywhere else in the real world but biometrics are the bee's knees in Hollywood films.

With the explicit permission of the court and the Home Office and the Information Commissioner you can read IBM's evidence in the case, please see attached. IBM's Commercial Director on IABS, Mr Nicholas Swain, explains that all the testing on biometrics was done by IBM and the results belong to IBM and that's why the public aren't allowed to see them despite paying for IABS. We're just meant to suppose that IABS will help to make the border secure and keep the Olympics safe despite all the respectable published evidence to the contrary. You can read Jackie Keane's evidence, too. She agrees with Nick.

It was all IBM's idea according to Ms Keane. OK, the Home Office gave IBM five million pairs of fingerprints to use as test data. And the Home Office specified the acceptance tests that had to be passed. And the Home Office agreed to pay IBM £265 million. But that's all.

It's been a long haul. It goes back 2½ years to a Freedom of Information request submitted on 6 January 2010. And it's not over yet because the other day David Moss submitted an application for permission to appeal. This could go on for years more.

While we're waiting for closure, we have those six questions above to ponder. And this one – what's IABS really about? It's obviously nothing to do with biometrics, as the court effectively acknowledges at paragraph 8 of its decision.

All relevant documents can be discovered at:

http://dematerialisedid.com/bcsl/foi.html

---

Notes to editors

1. As the Treasury Solicitors say (30 April 2012), "the submissions and open evidence lodged with the Tribunal in this case were relied upon and put in evidence at a hearing held in public". We really do all have permission to quote from this material and to comment on it.

2. Without wishing in any way to "lead" you, it is suggested that it will be most fruitful to start with the evidence submitted by the Home Office and IBM. And the evidence of Professor Ross Anderson at the University of Cambridge Computer Laboratory who points out that the banks have rejected biometrics as being too unreliable and asks why in that case do the Home Office trust them?

3. The background to this case is set out in the first few pages of the appeal document and centres on Whitehall’s competence and its duty to acknowledge the supremacy of Parliament, a subject which you will see there exercises the Home Affairs Committee.

4. Where does this story fit in the newspaper or on the radio/TV current affairs programme? Not on the fashion pages perhaps, but certainly in horoscopes and probably almost anywhere else – UK news, international news (they're all at it, look at India), EU news (the European Commission love biometrics and "eIDs", electronic identities), Westminster/politics, Whitehall/governance, the business pages, law reports/the Constitution, travel, sport (c.f. security at the Olympics generally and specifically UKBA's trip to Istanbul for the world wrestling championships to collect biometrics), the technology pages, cartoons, the crossword, ...

---

About David Moss
David Moss has worked as an IT consultant since 1981. The past 9 years have been spent campaigning against the Home Office's plans to introduce government ID cards into the UK. It must now be admitted that the Home Office are much better at convincing people that these plans are a bad idea than anyone else, including David Moss.

----------

Updated 21.2.18

It's getting on for six years since the blog post above was published.

Nothing has changed as far as the Home Office are concerned:

• Despite their record, the Home Office are still in charge of UK border control and they still find it a challenge, to put it politely, please see Border Force not ready for extra checks, claim MPs and Time has run out for May’s Brexit immigration plan.
• The director of strategy and transformation at the UK Border Force is Mr Christophe Prince according to his LinkedIn entry, the same man who was a deputy director of the UK Border Agency (RIP) for the three years 2006-09.
• And the UK Border Force still relies on IABS, the Immigration and Asylum Biometrics System, run for the moment by IBM and still relying on Morpho biometrics technology.

In the outside world things have moved on a little:

• The UK Government Digital Service (GDS) have contracted with Morpho to supply "identity provider" services to GOV.UK Verify (RIP), the failed identity assurance scheme.
• GDS have stated it as a strategic objective of theirs to incorporate more biometrics into public services on the basis that it's innovative to do so.
• And Safran have sold Morpho to private equity investors, who have changed its name to Idemia.

Idemia gets about a bit. It always has, whatever it was called at the time.

In 2012 they were found guilty of bribery to win business in Nigeria. The bribery of which they were found guilty took place between 2000 and 2003. They appealed and had the verdict overturned in 2015.

There was a spot of bother in Kenya when the opposition party claimed that Idemia had cost them the August 2017 general election. It was the devil's own job for the Kenyan authorities to have the October re-run conducted the way they wanted, and not Idemia.

There was the earlier problem revealed by Naomi Klein in 2008 when she discovered that face recognition technology being used in Operation Golden Shield had been sold to China by L-1 Identity Solutions, Inc., a company subsequently bought by Idemia. That trade is against the law in the US. It is barred by the US Commerce Department's Bureau of Industry and Security post-Tiananmen export controls.

Everything seemed to be going profitably enough for Idemia in India, where their products are used for biometric registration under Aadhaar, the identity assurance scheme for 1.2 billion Indians, until ...

... enter Russia. Idemia allegedly bought some Russian software and inserted it into its own products to improve performance but didn't tell anyone.

Now that some disaffected Idemia ex-employees have made this allegation, the Indians are a little non-plussed. Rather as the Americans may be, also: "The company, now named Idemia, has provided fingerprint-recognition software to the Department of Defense and agencies in 28 states and 36 cities or counties across the US — from the Orange County Sheriff’s Department to the New York Police Department", not to mention the FBI. Cue fears of cyber-espionage being carried out by software buried deep in the security, military and justice systems.

What goes around comes around. The Indians are also worried about allegations that some other software they use in Aadhaar has CIA tools hidden in it but that's another story.

The question here is, do GDS and the Home Office want anything to do with Idemia? How well-prepared are they? Why take the risk? What's the point? After all, it's not as though the biometrics works.