RIP IDA – Safran Morpho/SecureIdentity

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

The Government Digital Service (GDS) have contracted with nine so-called "identity providers" or "certified companies" to register all us Brits and to supply us with on-line identities, ready for the brave new digital-by-default world.

Armed with these on-line identities, 90% of us will be able one day (in April 2016?) to use public services via GOV.UK Verify (RIP). That's the idea.

GDS are more diffident about this but, later on, these on-line identities may allow us to use private sector services, too.

Safran Morpho is one of GDS's "identity providers":

Safran Morpho offer a product called "SecureIdentity".

GDS promised in the past that all "identity providers" would be certified by tScheme, an independent body, expert in measuring trustworthiness. That's meant to give the public confidence in GOV.UK Verify (RIP).

Safran Morpho applied for certification for SecureIdentity on 19 November 2015. These things take time. SecureIdentity may or may not be certified in the end but it doesn't appear on tScheme's roll of trust yet.

Unlike the other "identity providers" who have GOV.UK Verify (RIP) products available, Safran Morpho require you to download an app onto your mobile phone.

Your mobile phone then becomes part of your identity. That may imply that your existence is interrupted, as far as Safran Morpho are concerned, when you change phones.

Long-time DMossEsq readers will know that downloading apps onto your mobile phone is indistinguishable from inviting in a virus.

The SecureIdentity app has the features shown in the mobile phone screenshot opposite.

If you are convinced that you understand what they all mean and if you are happy to give SecureIdentity house room, fine.

If not, there are five other "identity providers" to choose from today – Barclays, Digidentity, Experian, the Post Office and Verizon – to which you should soon be able to add GBGroup, PayPal and the Royal Mail.

You had better read, learn and inwardly digest Safran Morpho's terms and conditions for SecureIdentity and their privacy and cookies policies. They estimate 10 to 15 minutes for registration. Good luck with that.

To register with Safran Morpho, you have to tick the box that says you've read all these documents and you may then be deemed to have freely given your informed consent.

What consent?

Answer, your consent to a lot of personal information about you bouncing around the world's telecommunications networks, in the UK and overseas, between Safran Morpho, unnamed credit referencing agencies, unnamed sub-contractors, government departments, law enforcement agencies, tax authorities, Zendesk, DoubleClick, YouTube and Google, because that's who GDS use for their analytics.

De-registration, by the way, takes at least seven years. That's the minimum length of time Safran Morpho will keep any information they have about you.

The SecureIdentity privacy policy includes:

1.2 The types of personal data that Morpho may collect and hold Personal data that Morpho may collect include: - Your full name; - Your date and place of birth - Your postal address; - Your email address; - Your telephone number; - Your user ID (application store account) - Your gender - The data necessary to identify the date, time and duration of a communication - Your static or dynamic IP address - Characteristics of your software platform (Operating System, Browser) - Your passport details - Your Driving License details - Your Marriage Certificate details - Your Birth Certificate details - Your Poll Card details - Your bank account number 1.3 How does Morpho collect your personal data Morpho usually collects personal data directly from you. For that purpose, Morpho may require you to complete a consent form to acknowledge that you are fully aware of the collection and processing of your personal data. Morpho may also check your personal data against publicly available information and information already present in our partner companies' databases in order to verify your identity and ensure that you are the person you' re claiming to be. Personal data that Morpho may check, include: - Your Credit Record History - Your Electoral Roll History - Your financial court orders records (CCJ, IVA, DRO, Bankruptcy) - Your record in the Land Registry … - Your Directors Register record We might in certain circumstances verify if you are active on social networks. Morpho may collect personal data about you because Morpho is required or authorised by law to collect it.

Safran Morpho clearly envisage an intimate relationship with you, including your life in the social media. Not to mention anything that the SecureIdentity app can glean from your sleepless mobile phone, the accounts on it and the network(s) it is attached to.

In the course of that intimate relationship, Safran Morpho can't help collecting a lot of personal information about you:

1.5.1 Disclosure of personal data by Morpho Morpho may share personal data with: - Government Digital Service (GDS): the DVLA, the HMPO [Her Majesty's Passport Office] and any other relevant HMG Department in connection with the provision of the Evidence Checking Services - Its subcontractors (including without limitation third party fraud-prevention agencies and credit agencies) to verify your identity during the SecureIdentity registration process and to provide customer care. Morpho will not sell, rent or otherwise disclose your personal data to third parties without your informed consent. Morpho may also share your personal data if it is required to do so by virtue of any legal obligations (such as law enforcement, tax), or in order to enforce Morpho’s [sic] terms and conditions (a copy of which can be seen at www.secureidentity.co.uk/help). 1.5.2 Overseas disclosure by Morpho Morpho is part of the Morpho Group of Companies ("Morpho Group") which is a global organisation; for the purposes explained in this policy, your information may be transferred to the head office of the Morpho Group, Morpho SAS based in France ... 1.5.3 Marketing communications Your information may be used by SecureIdentity (Morpho UK) for marketing purposes in connection with the service provided ...

GOV.UK Verify (RIP) has been designed by GDS. Their pre-eminent design principle is: "start with needs – user needs, not government needs". That's what they started with and somehow you've ended up handing over reams of the personal information that defines you, beyond your control, to a lot of strangers.

And all you wanted to do was to obey the law by submitting your tax return. That was the user need. You didn't previously feel the need to help the "identity providers" with their marketing, did you?

You've been able to submit your tax return on-line for years via the Government Gateway. Why do you now also have to send your credit history to all these strangers?

Something, somewhere along the line, has gone wrong. It's all got out of hand. GOV.UK Verify? RIP.

----------

Updated 20.3.17
It's just over a year since the blog post above was written. Yesterday Safran Morpho tweeted this: "'Why is the @GOVUKverify programme happening?' Read the answer & other FAQs on our website", followed by a link to this antique page on their website, copy available here.

Troll along and you read: "Right now 13 government services are connected to GOV.UK Verify [RIP] (7 can be accessed as public beta services). By April next year about 30 government services will be using the system and others will join over 2016/17".

Fiscal 2016/17 ends in 11 days time, 31 March 2017, and there are just 12 services signed up to GOV.UK Verify (RIP), not 30, not even 13.

Safran Morpho are an "identity provider" retained by the Government Digital Service (GDS) to sign victims up to GOV.UK Verify (RIP). There's a choice of "identity providers". Would you choose the one that relies on marketing literature over a year out of date?

Victims "must choose from one of nine certified verification companies to obtain their own personal secure ID". That's what Safran Morpho said over a year ago. There aren't nine "identity providers". Only seven – PayPal never turned up and Verizon pulled out, twice. You want the supplier providing you with a "secure ID" to be strong on the detail ...

All the "identity providers", according to Safran Morpho, are "guided by nine Identity Assurance Principles". You won't be fooled into confusing "guided by" with "compliant with". All nine identity assurance principles are flouted by the "identity providers" and by GDS themselves.

All the "identity providers", according to Safran Morpho, "offer the verification service at no cost". Very old-fashioned marketing, nostalgic even, hands up everyone who believes that GOV.UK Verify (RIP) is free.

"To become a certified verification company a business must be able to meet or exceed high standards set by government and an independent certification body". So they keep saying but of course Safran Morpho have not been certified, their SecureIdentity service remains obstinately absent from the independent certification body tScheme's list of approved services, a full 16 months after applying for approval.

Four "identity providers" have had their services approved. What's wrong with the other three – the Post Office, the Royal Mail and Safran Morpho?

With marketing material like this – out of date, inaccurate, misleading, self-hoisting with petard – does GOV.UK Verify (RIP) need critics?


Updated 21.3.17

It's almost as if Safran Morpho are reading this blog. Yesterday they claimed that GOV.UK Verify (RIP) is connected to 13 UK government services. Today, in a tweet, they have corrected that to 12: "You can now access 12 govt online services @GOVUKverify @secureIDverify incl. @HMRCgovuk s.ripl.com/bfkk03".

That message is reinforced by a silent video which lasts for 10 seconds and on which, unless you're a hawk, the text is illegible.

Better that than the video on the SecureIdentity website – the same three chords repeated for 50 interminable seconds:



Is the product called "secureidentity" or "Secure Identity" or "SecureIdentity"? All three versions appear on the Safran Morpho website. And is the product brought to us by Safran Morpho? Or by Safran? Or by Morpho, "the world leader in government ID"? Which is it? There's a bit of work to do on the branding there ...

... and a bit more work to do on the number of UK government services accessible via GOV.UK Verify (RIP). 13? 12? No, not on the SecureIdentity website, neither of those figures, this time it's eight:

Updated 27.3.17

Safran Morpho's identity assurance product, SecureIdentity or secureidentity or Secure Identity or whatever it's called – how many UK government on-line services can it connect you to? 8? 12? 13? You don't know. Safran Morpho don't seem to know.

That's a bit of a worry, as we were saying on 21 March 2017. Safran Morpho are one of the Government Digital Service's "identity providers". You need to be able to trust them. Otherwise you can't trust GOV.UK Verify (RIP). And it's hard to trust them if they can't count. You don't get the feeling you can rely on them.

23 March 2017, Safran Morpho were tweeting again: "Digital access to govt services is changing: here's a helpful Beginner’s Guide to @GOVUKverify ow.ly/hALP308NvZN #identity #infosec". Click on that link and you learn: "At SecureIdentity we’re one of nine verification services you can choose from" and "The first time you use GOV.UK Verify [RIP] to access services, you’ll be given a choice of nine certified verification companies to obtain your own personal secure ID".

Wrong again. Why do Safran Morpho try to confuse beginners? There has never been a choice of nine "identity providers". Briefly, there were eight. Now there are just seven. And of those seven, just four are certified. Three of them, including Safran Morpho, are not certified.

"Competition delivers greater security", say Safran Morpho. Not if some of the competitors don't know what's going on.

We're "Putting you in control". That's what Safran Morpho suggest. They don't seem to be in control themselves.

And not just them. Aren't GDS supposed to do a bit of quality control? This is their identity assurance ecosystem or market that they're trying to create. And one of their agents is misleading the public. In a properly regulated market, that would be quickly detected and corrected. GOV.UK Verify (RIP) doesn't look properly regulated.


Updated 2.6.17

Remember Safran Morpho? The uncertified "identity provider" to GOV.UK Verify (RIP)? The one that can't count?

Well forget it.

There is no Safran Morpho.

Safran have flogged the business to some private equity persons and now it's the uncertified OT-Morpho who own all your personal information and who keep track of you via an app/virus on your mobile.

No announcement from the Government Digital Service, of course. Presumably GDS know about the transaction. Presumably they don't think you need to know:

Updated 7.10.17

We noted above that Morpho don't bother to update their GOV.UK Verify (RIP) information for the public which still tells people that there are nine "identity providers". There never were nine. Currently there are seven. GDS do nothing to correct Morpho. The public continue to be misled.

We noted also that Morpho has now been sold by Safran. Are the new owners as trustworthy as Safran? Who knows. Again, GDS have not bothered to advise the public.

Log on now, four months after completion of the sale to Advent International and Bpifrance, try to create a GOV.UK Verify (RIP) account via Morpho and you still see Safran branding all over the screens.

Odd.

Odder still given that Morpho is no longer called "Morpho". It's now morphed into"Idemia".

There's no mention of Idemia on any GOV.UK Verify (RIP) web pages. The change has passed GDS by. They fail once again to operate their market competently – as we said in March 2016, "GDS have never created or regulated a market in their lives. And it shows".

And there's no mention of GOV.UK Verify (RIP) on Idemia's web pages, nor of SecureIdentity. GOV.UK Verify (RIP) doesn't exist as far as Idemia are concerned. They're not interested. Understandably so. It's dead.

Morpho's GOV.UK Verify (RIP) service was called "SecureIdentity" among other things. Idemia's is called "Augmented Identity". Good name. GDS should have thought of that.

Behind the good name it's just the same old nonsense – biometrics. The same parcel has been passed now from Visionics and Viisage and Identix and Iridian to L-1 Identity Solutions to Safran to the present private equity investors.

Why do these organisations keep selling it? Because one day the parcel-holder is going to find that there's nothing inside the wrapping paper, just an augmented loss.

Meanwhile Morpho is in a bit of trouble in Kenya, please see Safran Morpho asks IEBC to push election date to October 26  and French Biometrics Firm OT-Morpho [Idemia] to Sue Kenyans for Defamation Over IEBC System Hacking Claims.

We in the UK can continue to trust Sagem Sécurité Morpho OT-Morpho Idemia with our personal information, of course. Otherwise GDS would surely have warned us.

RIP IDA – Safran Morpho/SecureIdentity

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

The Government Digital Service (GDS) have contracted with nine so-called "identity providers" or "certified companies" to register all us Brits and to supply us with on-line identities, ready for the brave new digital-by-default world.

Armed with these on-line identities, 90% of us will be able one day (in April 2016?) to use public services via GOV.UK Verify (RIP). That's the idea.

GDS are more diffident about this but, later on, these on-line identities may allow us to use private sector services, too.

Safran Morpho is one of GDS's "identity providers":

Safran Morpho offer a product called "SecureIdentity".

GDS promised in the past that all "identity providers" would be certified by tScheme, an independent body, expert in measuring trustworthiness. That's meant to give the public confidence in GOV.UK Verify (RIP).

Safran Morpho applied for certification for SecureIdentity on 19 November 2015. These things take time. SecureIdentity may or may not be certified in the end but it doesn't appear on tScheme's roll of trust yet.

Protecting civilisation from the fingers of terror

Here's a quotation from an article in New Scientist magazine. You need to know that Visionics is a biometrics company that specialises in face recognition. Now you're an expert:

Airport security isn't the only use for face-recognition software: it has been put through its paces in other settings, too. One example is "face in the crowd" on-street surveillance, made notorious by a trial in the London Borough of Newham. Since 1998, some of the borough's CCTV cameras have been feeding images to a face-recognition system supplied by Visionics, and Newham has been cited by the company as a success and a vision of the future of policing. But in June this year, the police admitted to The Guardian newspaper that the Newham system had never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest.

Admitted ... the police admitted ...

Clearly, the Newham police, for all sorts of human reasons, somehow entrapped themselves in a deception perpetrated on the public at public expense. Has it happened again?

Last week, Assistant Commissioner Mark Rowley was singing the praises of the mobile fingerprint readers now issued to policemen patrolling in 28 of the UK's 56 police forces. Home Office figures suggest that the flat print fingerprint technology used in these devices fails about 20% of the time.

Equally clearly, and to the credit of the Newham police, they finally extricated themselves from this fraud with their admission. Will that happen again?

How long before we read in New Scientist that:

... Assistant Commissioner Mark Rowley admitted to __________ that the MobileID initiative had never even matched the fingerprints of a person on the street to a set of dabs in its database of known offenders, let alone led to an arrest. In fact all it had achieved was to reduce the chances of a felon being taken down to the nick by a straight 20% at a stroke.

For anyone interested in the history of biometrics companies, i.e. how we got into this mess, please note that:

• After the Newham debacle Visionics was taken over by Identix.
• Identix supplied the biometrics technology for the UK Passport Service biometrics enrolment trial from which the 20% failure rate for flat print fingerprinting is taken.
• Identix was taken over by L-1 Identity Solutions.
• L-1 was bought by Safran.
• And Safran provide the biometrics we depend on for the success of IABS, the Immigration and Asylum Biometrics System which is meant to keep the UK border secure and to make the 2012 Olympics safe.

Please note also that the New Scientist article quoted above appeared in the 7 September 2002 issue of the magazine, nearly 10 years ago. The article is so full of important observations of mendacity, opportunism and technological incompetence still relevant today that it is further quoted with grateful acknowledgement below:

Face-off I CAME here looking for an argument but I can't find one. All round this lofty exhibition hall - billed as the world's biggest market for security equipment - the people selling face-recognition systems are being disarmingly, infuriatingly honest ... I thought they'd at least attempt to defend the technology. When they don't, it's me who's caught off guard. Is it true that the systems can't recognise someone wearing sunglasses? Yes, they say. Is it true that if you turn your head and look to one side of the camera, it can't pick you out? Again, yes. What about if you simply don't keep your head still? They nod. Maybe nine or ten months ago they would have risen to the bait. In those days the face-recognition industry was on a high. In the wake of 11 September, Visionics, a leading manufacturer, issued a fact sheet explaining how its technology could enhance airport security. They called it "Protecting civilization from the faces of terror". The company's share price skyrocketed, as did the stocks of other face-recognition companies, and airports across the globe began installing the software and running trials. As the results start to come in, however, the gloss is wearing off. No matter what you might have heard about face-recognition software, Big Brother it ain't ... Image Metrics, a British company that develops image-recognition software, ... warned of the danger of exaggerated claims, saying that "an ineffective or poorly applied security technology is as dangerous as a poorly tested or inappropriately prescribed drug" ... to catch 90 per cent of suspects at an airport, face-recognition software would have to raise a huge number of false alarms. One in three people would end up being dragged out of the line - and that's assuming everyone looks straight at the camera and makes no effort to disguise themselves ... Palm Beach International Airport in Florida released the initial results of a trial using a Visionics face-recognition system. The airport authorities loaded the system with photographs of 250 people, 15 of whom were airport employees. The idea was that the system would recognise these employees every time they passed in front of a camera. But, the airport authorities admitted, the system only recognised the volunteers 47 per cent of the time while raising two or three false alarms per hour ... To give themselves the best chance of picking up suspects, operators can set the software so that it doesn't have to make an exact match before it raises the alarm. But there's a price to pay: the more potential suspects you pick up, the more false alarms you get. You have to get the balance just right. Visionics - now called Identix after merging with a fingerprint-scanning company in June - is quick to blame its system's lacklustre performance on operators getting these settings wrong ... Numerous studies have shown that people are surprisingly bad at matching photos to real faces. A 1997 experiment to investigate the value of photo IDs on credit cards concluded that cashiers were unable to tell whether or not photographs matched the faces of the people holding them. The test, published in Applied Cognitive Psychology (vol 11, p 211), found that around 66 per cent of cashiers wrongly rejected a transaction and more than 50 per cent accepted a transaction they should have turned down. The report concluded that people's ability to match faces to photographs was so poor that introducing photo IDs on credit cards could actually increase fraud. The way people change as they age could also be a problem. A study by the US National Institute of Standards and Technology investigated what happens when a face-recognition system tries to match up two sets of mugshots taken 18 months apart. It failed dismally, with a success rate of only 57 per cent. There's another fundamental problem with using face-recognition software to spot terrorists: good pictures of suspects are hard to come by ... Very few security personnel at American airports have CIA clearance, so they aren't allowed to see the images. "Until they've got cleared personnel in each of those airports they can't stop terrorists getting on planes," says Iain Drummond, chief executive of Imagis technologies, a biometrics company based in Vancouver, Canada ... Airport security isn't the only use for face-recognition software: it has been put through its paces in other settings, too. One example is "face in the crowd" on-street surveillance, made notorious by a trial in the London Borough of Newham. Since 1998, some of the borough's CCTV cameras have been feeding images to a face-recognition system supplied by Visionics, and Newham has been cited by the company as a success and a vision of the future of policing. But in June this year, the police admitted to The Guardian newspaper that the Newham system had never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest.

There are more of these gems available in the DMossEsq treasure trove of mendacity, Biometrics: guilty until proven innocent.

Look at the Image Metrics quotation above, "an ineffective or poorly applied security technology is as dangerous as a poorly tested or inappropriately prescribed drug". Prescription drugs are subject to extensive testing before the regulators will sanction their release to the public. Without that, we'd all be dead. The same goes for aircraft design. Without the Civil Aviation Authority, a lot more of us would be dead.

There is none of that open, public, peer-reviewed testing regime when it comes to the government wasting our money on biometrics. Try to find out what justification there is for Whitehall's decision to invest in biometrics and you get a two-year court case and no information.

There is no good reason for this peculiar asymmetry.

How do we avoid the recurrence of Newham-style embarrassments?

It's about time the Office for National Statistics was involved in Whitehall technology decisions and that initiatives which depend on reliable technology should not be allowed to incur substantial public expenditure before and unless the ONS has agreed and published official statistics supporting the business case.

Protecting civilisation from the fingers of terror

Here's a quotation from an article in New Scientist magazine. You need to know that Visionics is a biometrics company that specialises in face recognition. Now you're an expert:

Airport security isn't the only use for face-recognition software: it has been put through its paces in other settings, too. One example is "face in the crowd" on-street surveillance, made notorious by a trial in the London Borough of Newham. Since 1998, some of the borough's CCTV cameras have been feeding images to a face-recognition system supplied by Visionics, and Newham has been cited by the company as a success and a vision of the future of policing. But in June this year, the police admitted to The Guardian newspaper that the Newham system had never even matched the face of a person on the street to a photo in its database of known offenders, let alone led to an arrest.

Admitted ... the police admitted ...

Clearly, the Newham police, for all sorts of human reasons, somehow entrapped themselves in a deception perpetrated on the public at public expense. Has it happened again?

Last week, Assistant Commissioner Mark Rowley was singing the praises of the mobile fingerprint readers now issued to policemen patrolling in 28 of the UK's 56 police forces. Home Office figures suggest that the flat print fingerprint technology used in these devices fails about 20% of the time.

Equally clearly, and to the credit of the Newham police, they finally extricated themselves from this fraud with their admission. Will that happen again?

How long before we read in New Scientist that:

... Assistant Commissioner Mark Rowley admitted to __________ that the MobileID initiative had never even matched the fingerprints of a person on the street to a set of dabs in its database of known offenders, let alone led to an arrest. In fact all it had achieved was to reduce the chances of a felon being taken down to the nick by a straight 20% at a stroke.

Safran's directors generously give away their shareholders' intellectual property and $1.6 billion of their shareholders' money

Safran press release, Paris 26 July 2011:

Safran completes the acquisition of L-1 Identity Solutions Becomes world leader in biometric identity solutions After completing all required approval procedures, Safran (NYSE Euronext Paris: SAF) today announced that it has finalized the acquisition of L-1 Identity Solutions, Inc., a leading identity management solutions provider in the United States, for a total cash amount of $1.09 billion ($12 per share), which was originally announced in the press release on September 20, 2010. Following this transaction, Safran becomes the world leader in biometric identity solutions ... L-1 will join Safran’s existing security business, operating as Morpho, and will be renamed MorphoTrust. The new company will be partly managed as a proxy structure, thus providing appropriate protection for U.S. national security ... Jean-Paul Herteman, Chairman and CEO of Safran, said: "We are delighted to have finalized this transaction, which is perfectly aligned with the Group’s development strategy in the security business..."

At the date of purchase, L-1 Identity Solutions, Inc., had never made a profit. Hardly surprising. The company was a ragbag of failed biometrics businesses, including Visionics Corp., Identix, Inc., and Viisage.

Identix is particularly well known in the UK. In 2004, the UK Passport Service conducted a year-long trial of biometrics which proved that they are not reliable enough for use in passports, ID cards, residence permits, visas, driving licences and the like, please see cribsheet below. The trial was carried out using Identix products (Appendix C, p.254ff).

"$1.09 billion" may seem like a very precise number. It isn't. Unmentioned in the press release above, Safran took on about $500 million of L-1's debt in addition to buying the company. Safran's shareholders' initial stake is therefore a lot higher than $1.09 billion, please see for example this 16 May 2011 Bloomberg article:

Safran, a Paris-based maker of airplane engines for Airbus SAS and Boeing Co., agreed to buy L-1 for $12 a share, or 48 percent more than L-1’s 20-day trading average before it was first reported July 15 that Safran was considering a purchase of L-1. The offer is valued at $1.58 billion including net debt.

And for that, Safran doesn't even get unfettered control. There's a "proxy structure" in there "providing appropriate protection for U.S. national security". Pleading national security, Safran's US Federal and State contracts could be switched to the all-American 3M Cogent, leaving Safran with nothing to show for $1.58 billion.

You can see why L-1 would be pleased with this deal. It's not obvious what's in it for Safran.

---

This isn't the first time that shareholders and equity analysts will have had qualms about Safran's venture into biometrics.

On 7 October 2009, when their subsidiary Morpho was still known as "Sagem Sécurité", Safran issued this press release in Paris:

Sagem Sécurité chosen by IBM to support United Kingdom’s National Identity Assurance Service (NIAS) Sagem Sécurité (Safran group) has signed a contract with IBM to supply and maintain a biometric management solution for British travel and identity documents, on behalf of the British Home Office’s Identity and Passport Service (IPS). The project is a core element of the Government’s plans to upgrade to biometric passports and enhance the security of the UK border. Sagem Sécurité will provide multibiometric facial and fingerprint recognition technology that was assessed for speed, accuracy and cost in competitive trials developed and run by IBM, using in excess of 10 million images. The technology will enable IBM to help IPS and the UK Border Agency to deliver the next generation of secure and reliable identity documents to British citizens, residents and people requesting asylum, while minimising the risk of fraud ...

How did Safran/Sagem Sécurité/Morpho get this contract with IBM?

The answer is provided in a witness statement submitted by Mr Nicholas Swain in a case heard in the British courts, EA/2001/0081 (please see the entry for 20 July 2011). IBM organised a demonstration of biometric capability for the UK Home Office. Mr Swain is a Commercial Director at IBM and he says:

10. As part of IBM's bid, during late 2008 and early 2009, IBM carried out a series of tests with specialist biometric software providers who were bidding to be part of ... IBM's solution for the NBIS project as part of the Demonstration ... 11. IBM negotiated the commercial arrangements with each of the biometric service providers, including Non-Disclosure Agreements (NDAs) to protect their commercially sensitive information (see further below). Six suppliers participated in the Demonstration ... 14. Thereafter, on 1 May 2009, IBM signed a contract to provide NBIS with the Home Office and, shortly afterwards, entered a sub-contract with Sagem (now Morpho), one of the suppliers who participated in the Demonstration, to provide the specialist biometric software needed for NBIS. In August 2010 this contract was revised and the programme was re-named IABS ... 18. All of the suppliers involved in the Demonstration made significant investment in time and provided IBM with more details about their products performance than is generally available. The information provided included business-critical intellectual property of the suppliers, representing the results of major investment in software research and development ...

In 2008 and 2009 IBM had no particular expertise in biometrics. They have remedied that thanks to Safran, who gave them "business-critical intellectual property ... representing the results of major investment in software research and development".

IBM have played a blinder. They won a £265 million contract from the British government. And they acquired the fruits of several decades of Safran's R&D. All in return for a piece of paper, an NDA. You can see why IBM would be pleased with this deal. It's not obvious what's in it for Safran.

Safran's products can be tested without handing over the crown jewels. IBM and the Home Office only need to know whether Safran's products work, not how they work.

---

The directors of Safran gave the shareholders' intellectual property to IBM and they gave $1.6 billion of shareholders' money to L-1. What did they give to get their contract with UIDAI, the organisation responsible for issuing electronic IDs to 1.2 billion Indians?

---

Cribsheet – the failure of biometrics
Using L-1/Identix biometrics technology, the Home Office conducted trials of face recognition, fingerprinting and iris scanning back in 2004. The report on the trial was published by Atos Origin in May 2005 and even after many months of massage the figures still demonstrated failure.

10% of able-bodied participants in the trial couldn't register their irisprints in the first place, and that figure rises to 39% for the disabled participants. These people would quite simply not exist if public services only recognised people by their irisprints.

Face recognition biometrics failed with 31% of the able-bodied participants and 52% of the disabled. We would all do better to toss an unbiased coin than to rely on face recognition, a technology with an uninterrupted history of failure.

Which leaves us with fingerprints.

Understand that we're not talking here about traditional fingerprinting. The technology trusted by law enforcers worldwide for over a century now. Rolled prints. Taken using ink. By a police expert. Acceptable as evidence in a court of law. A technology so accurate that when there's a disagreement independent experts are flown in to resolve the matter.

No, we're talking instead about a modern, cheap, clean, quick technology, no expert required, a sort of glorified photocopying process, utterly unreliable, with a 19 or 20 percent failure rate. 19% for the able-bodied and 20% for the disabled. A technology that doesn't work well with old people, manual labourers, people from East Asia and women (p.34).

So much for L-1's biometrics technology. No-one is going to fly in independent experts from abroad to investigate 19 or 20 percent of all disputed matches and non-matches. Flat print fingerprinting, to put it loosely, doesn't work.

If the right to public services or the right to work or the right to vote or the right to a pension or the right to get married or the right to live in your municipal area or the right to travel beyond it – the right to cross an invisible eBorder – ever depend on flat print fingerprinting, then 19 or 20 percent of people legitimately entitled to those benefits will be wrongly denied them.

Do Morpho's other biometrics products work any better than L-1's?

So far, the public has not been told. Not in the UK, not in France, nowhere. Public money – your money and mine – is being invested by the UK Home Office and by Interior Ministries around the world, with no justification given.

Given that the only report on the reliability of biometrics published to date by the UK government demonstrates that the technology doesn't work, we need to see some independent and academically scrupulous evidence that our money isn't being wasted.

For all we know, the belief in the reliability of today's mass consumer biometrics is as foolish as the belief in astrology.

As Professor Ross Anderson, the king of IT security engineering, points out, the banks don't trust mass consumer biometrics technology. Otherwise they'd use it. So why does the government trust this technology? And why should we?

With no answers forthcoming, for all we know our money is being wasted on snake oil.

Safran's directors generously give away their shareholders' intellectual property and $1.6 billion of their shareholders' money

Safran press release, Paris 26 July 2011:

Safran completes the acquisition of L-1 Identity Solutions Becomes world leader in biometric identity solutions After completing all required approval procedures, Safran (NYSE Euronext Paris: SAF) today announced that it has finalized the acquisition of L-1 Identity Solutions, Inc., a leading identity management solutions provider in the United States, for a total cash amount of $1.09 billion ($12 per share), which was originally announced in the press release on September 20, 2010. Following this transaction, Safran becomes the world leader in biometric identity solutions ... L-1 will join Safran’s existing security business, operating as Morpho, and will be renamed MorphoTrust. The new company will be partly managed as a proxy structure, thus providing appropriate protection for U.S. national security ... Jean-Paul Herteman, Chairman and CEO of Safran, said: "We are delighted to have finalized this transaction, which is perfectly aligned with the Group’s development strategy in the security business..."

At the date of purchase, L-1 Identity Solutions, Inc., had never made a profit. Hardly surprising. The company was a ragbag of failed biometrics businesses, including Visionics Corp., Identix, Inc., and Viisage.

Identix is particularly well known in the UK. In 2004, the UK Passport Service conducted a year-long trial of biometrics which proved that they are not reliable enough for use in passports, ID cards, residence permits, visas, driving licences and the like, please see cribsheet below. The trial was carried out using Identix products (Appendix C, p.254ff).

"$1.09 billion" may seem like a very precise number. It isn't. Unmentioned in the press release above, Safran took on about $500 million of L-1's debt in addition to buying the company. Safran's shareholders' initial stake is therefore a lot higher than $1.09 billion, please see for example this 16 May 2011 Bloomberg article:

Safran, a Paris-based maker of airplane engines for Airbus SAS and Boeing Co., agreed to buy L-1 for $12 a share, or 48 percent more than L-1’s 20-day trading average before it was first reported July 15 that Safran was considering a purchase of L-1. The offer is valued at $1.58 billion including net debt.

And for that, Safran doesn't even get unfettered control. There's a "proxy structure" in there "providing appropriate protection for U.S. national security". Pleading national security, Safran's US Federal and State contracts could be switched to the all-American 3M Cogent, leaving Safran with nothing to show for $1.58 billion.

You can see why L-1 would be pleased with this deal. It's not obvious what's in it for Safran.

---

Technology securing the border

Poor ... inefficient ... over-hyped ... real risk to the integrity of the control ... immature ... poor quality ... unreliable ... completely fails ... not joined up ... comical ... erroneous ... laughable ... these are just some of the words of praise heaped on the electronic face recognition gates used for passport control at Heathrow Airport, and on the eBorders scheme in general, in Nicola Stanbridge's eulogy broadcast on BBC Radio 4's Today programme this morning.



Hat tip: JGM

Technology securing the border

Poor ... inefficient ... over-hyped ... real risk to the integrity of the control ... immature ... poor quality ... unreliable ... completely fails ... not joined up ... comical ... erroneous ... laughable ... these are just some of the words of praise heaped on the electronic face recognition gates used for passport control at Heathrow Airport, and on the eBorders scheme in general, in Nicola Stanbridge's eulogy broadcast on BBC Radio 4's Today programme this morning.



Hat tip: JGM