UIDAI and the textbook case study of how not to do it, one for the business schools

The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

It's worked. UIDAI survives for the moment.

But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

The job of the Unique Identification Authority of India (UIDAI) is to use biometrics to identify every resident of India and to issue them with a unique corresponding number, a so-called "Aadhaar number".

"Aadhaar" means foundation or support and the idea is that, once everyone has an identifying number, it will be easier for the various arms of government to build systems on that foundation to provide social security benefits, for example, and to facilitate national security. And beyond government, the banks will supposedly find it easier to authenticate payments.

UIDAI is not without its critics:

• The Standing Committee on Finance (SCoF), a committee of the Indian Parliament, has considered the National Identification Authority of India Bill, 2010. That Bill would establish UIDAI on a statutory basis if it was ever enacted, but it hasn't been. Meanwhile, UIDAI is operating under executive order only. It's not operating very well according to the SCoF report and it's about time UIDAI came under the control of Parliament.
• And then there's the Ministry of Home Affairs. They're a properly constituted body and not just a creature of the Executive. And they have a competing identity management scheme, NPR (the National Population Register). Result – a turf war, Aadhaar v. NPR.

SCoF and the Ministry of Home Affairs pressed their case with the Prime Minister but UIDAI proved too adept for them. The Chairman threatened to resign, which would be embarrassing for the prime Minister – good move no.1. Good move no.2 – UIDAI arranged some convenient PR with the compliant Economist magazine. And then they published not one but two reports making unprecedented claims for the reliability of the biometrics used in Aadhaar:

• Role of Biometric Technology in Aadhaar Enrollment
• India boldly takes biometrics where no country has gone before

Oops. Bad move. There are five problems here:

1. Both reports are produced by UIDAI only. There is no sign that they have been audited by any independent expert body.
2. Both reports quote reliability figures. No other public authority in the world does that. Not operational figures – figures measuring the reliability of biometrics in the field, at the border, for example. They should. But they don't. Now, thanks to UIDAI, they will all come under pressure to quote independently audited figures themselves, figures for reliability, to justify their investment of public funds. It is likely that the public are going to be shocked at just how unreliable the biometrics are, that their governments are using. The public will at last understand why their governments have been so reluctant for so long to quote any figures.
3. Why is that likely? Because the figures quoted by UIDAI are hundreds of times better than anything anyone else has ever claimed following tests of biometrics. Hundreds.
4. The second report says that (a) Aadhaar uses flat print fingerprinting and iris scanning, (b) the two biometrics are fused to form one composite biometric, so-called "multi-modal" biometrics, and (c) UIDAI use not one matching algorithm, but three of them. Any large-scale identity management scheme that doesn't do the same, they say – (a), (b) and (c) – is doomed to "catastrophic failure".
5. The suppliers of biometric technology have never had to give public warranties before. Now they will have to.

Great. Now suppose you're the Australian Customs and Border Protection Service. You've spent millions of dollars of public money deploying smart gates at Australian airports as a security measure. These gates depend on face recognition biometrics. Not on UIDAI's list (a). The Australian (and new Zealand) border security system is doomed to "catastrophic failure". Don't take my word for it. Ask UIDAI.

You've spent years refusing to divulge any figures about the reliability of your technology:

Customs refused to disclose the rates at which the system inaccurately identified people. "For security reasons, Customs does not disclose the false positive and false negative rates," a spokesman said.

Now UIDAI have released figures, how are you going to hold the line? You can't.

You could say that UIDAI's figures haven't been audited and may turn out to be false. Now you've got a fight with UIDAI on your hands. And what's the best result you can hope for? UIDAI's figures turn out to be a pack of lies and actually the reliability of Aadhaar is just as appalling as the Australian system. Not what you wanted. It doesn't help to explain why you've been squandering your own citizens' tax money on joke technology.

The same applies to the UK, of course, and our planned deployment of smart gates at airports. Another catastrophic failure? And all those states in the US busy incorporating face recognition biometrics into driving licences. These people – the Australian Customs and Border Protection Service, UK Border Agency, et al – are not going to be pleased with UIDAI. UIDAI have let the cat out of the bag and have almost certainly started a fresh collapse of confidence in public administration as a result.

And neither are the biometrics suppliers going to be pleased. How are Morpho going to sell their products now without giving warranties? They're not.

And how are IBM and CSC going to be able to sign any more nine-figure biometrics contracts with credulous governments? They're not.

And how are PA Consulting going to sell any more biometrics assignments? They're not.

UIDAI are going to be persona non grata worldwide. Especially in India, where the Prime Minister may yet regret his decision to carry on funding them. And stop. He may give almost any reason but the big reason, the one several people have pointed out for a long time, is that far from curtailing corruption, Aadhaar was simply going to automate it.

A tragedy with a happy ending, the only people who will be pleased is absolutely everyone else in the world, who can now keep some of their tax money and spend it themselves rather than paying public authorities to waste it for them.

UIDAI's Pyrrhic victory? From now on it's going to be known as an "Aadhaar victory". At least it will when the business schools write it up and teach it all around the world. And when the Economist faithfully report UIDAI's defence, under the heading "Poison pill – that's not the way to do it".

UIDAI and the textbook case study of how not to do it, one for the business schools

The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

It's worked. UIDAI survives for the moment.

But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

How to fly a kite, I am told

You're a senior politician. Or you have real power, you're a Whitehall official. There's something you want to say, but you can't be the one to say it. What do you do?

For years, the answer has been simple. Rachel Sylvester. She used to write for the Telegraph. Now it's the Times. The move was interesting – she was insufficiently sycophantic about New Labour, quite sycophantic but not sycophantic enough. But it doesn't matter to you that she moved – wherever she is, she'll fly your kite for you. The following examples from the Times only:

• 14 February 2012: But I am told by one well-placed source that the budget for his artwork could be “over £1 million” ...
• 31 January 2012: I am told that Sir Gus O’Donnell, then the Cabinet Secretary and head of the Civil Service, was among the senior figures who tried...
• 15 November 2011: She took the decision to do this, I am told, against the advice of Home Office civil servants ...
• 28 June 2011: I am told that Stephen Gilbert, the political secretary at No 10, and Andrew Feldman, co-chairman of the Tory party, ...
• 17 May 2011: I am told that the new joint committee will include 12 members of each House, including crossbenchers and a bishop ...
• 10 May 2011: I am told that he first raised concerns with Andrew Lansley at the end of last year ...
• Etc ... The reader is spared the other 28 examples easily found with a single search on the Times website. The Telegraph website yields another 53 examples.

Apparently, somewhere behind the scenes, where people are paid public money to discuss this sort of thing, some conclave of cardinals has been debating the vexed question whether the Home Office isn't perhaps a little too right-wing and the Ministry of Justice a little too left-wing and they've decided to settle the matter by testing the waters in public.

This week's kite, in Ms Sylvester's Tough on crime, tough on namby-pambies, flies as follows:

One proposal discussed in Downing Street is to reconfigure Whitehall to end the good-cop-bad-cop departmental divide. Under the plan the Home Office would be responsible for everything to do with crime, including the police, prisons policy and sentencing. The Ministry of Justice would be scrapped and replaced with a new as-yet-unnamed department handling issues relating to national identity. This would bring together immigration, passport control and citizenship. Damian Green, the junior immigration minister, is mentioned as a contender for the Cabinet job. From the liberal wing of the Tory party, he can talk tough without sounding nasty. It may not happen but a change of emphasis is certainly under way.

If only the cardinals ran a focus group called something like SylvesterRachel.gov.uk, we could all drop by and vote "no".

How to fly a kite, I am told

You're a senior politician. Or you have real power, you're a Whitehall official. There's something you want to say, but you can't be the one to say it. What do you do?

John Vine report published

John Vine CBE QPM is the Independent Chief Inspector of the UK Border Agency (UKBA). His report on the Brodie Clark affair was published on Monday 20 February 2012. Like the Home Affairs Committee report Inquiry into the provision of UK Border Controls published a month earlier on Thursday 19 January 2012, it is a historic document. It criticises the Executive and yet, there it is, in a brave move of the Home Secretary's, it’s been published by the Executive.

If you went to bed on 20 February 2012 having learnt about Mr Vine’s report only from reading the Guardian live blog (starting at 4:12 p.m.) and from hearing Yvette Cooper talking about it on the radio, then you probably slept badly with thoughts of something sacred (England) having been defiled (by the invention of Tony Blair and Gordon Brown) disturbing your sleep and perhaps remembering that Hopkins poem, “No worst, there is none. Pitched past pitch of grief,/More pangs will, schooled at forepangs, wilder wring ...”.

Your mood will not have been improved in the morning by the woodentop predictability of the Daily Mail, with their Britain's 'Mickey Mouse' border controls let 500,000 into the country without any checks for FIVE YEARS headline and so you will have sat down to write your blog, entered the bilious title which wrote itself – John Vine signs death certificate – Home Office RIP – and then ... and then thought perhaps it might be a good idea to read the report first.

It's long. There's a lot in it. There's a lot to think about.

First things first, Mr Vine's report describes an exemplary piece of detective work. He has abided by his terms of reference, the work was done quickly and apparently thoroughly and he writes clearly. He hasn't been cross-examined in an open court of law, of course, but prima facie some of his findings look pretty damning.

Writing about the "intelligence-led" trial in Chapter 4 of his report, he successfully debunks UKBA, who obviously haven't got a clue how to run a trial. At para.4.103 he fingers UKBA for claiming that the trial had been a success on the basis of certain drug seizures they made, without being able to prove that they made the drug seizures because of the trial. If drugs companies conducted trials in the same way, we'd all be dead.

No-one knows what "intelligence-led" means, least of all the poor old Home Secretary – regular readers will remember this interchange when she gave evidence in front of the Home Affairs Committee:

Q33 Michael Ellis: ... can you elaborate on what is meant by intelligence-led security measures? ... Theresa May: Indeed. The basis on which the pilot was to operate was that it was to enable a greater focus on those who were at higher risk. Intelligence-led, led also at the discretion of the officers at the border so that they would be assessing within the two categories of EEA nationals and the biometric chips, and EEA national children ...

Mr Vine's dissection of the Secure ID business in Chapter 3 of his report is minute. "Secure ID" is a misnomer and denotes checking travellers' fingerprints.

Mr Vine is at some pains to show how the failure of immigration officers to do their Secure ID checks can be explained by their inadvertently confusing "Level 2" and "Scenario 2" (para.4.39) or by their failure to understand that Damian Green MP's approval for the suspension of Secure ID checks was a "provisional" approval (para.3.67).

But in the end he has to give up and decide that the immigration officers at Heathrow, in particular, jolly well knew they were flouting ministerial instructions when they suspended Secure ID.

Why would they do that? Are they all rogues?

Maybe not. Maybe they suspended Secure ID because they knew it was a waste of time that they didn't have to waste.

Brodie Clark said when he gave evidence to the Home Affairs Committee that fingerprint checks are the least reliable security/identity checks available and that they are the ninth and bottom priority. Mr Vine doesn't disagree. Indeed he quotes Brodie Clark in this connection saying that there have only been seven "hits" from Secure ID (3.13) since it was introduced in 2009-10.

Let's take a bit of time out here for some numbers. In the first 18 months of the coalition government, the period ending 31 October 2011, two days before Brodie Clark was suspended, the following payments were made by UKBA to contractors involved with computerised border security systems including fingerprint-checking:

Atos ............................... 67,461,976
CapGemini .............................. 90,000
CSC (Computer Sciences Corporation) 140,023,212
Detica ................................ 821,034
Fujitsu ........................... 175,743,106
IBM ............................... 155,438,327
Morpho .............................. 1,227,389
PA Consulting ....................... 3,428,522
QinetiQ ............................... 582,868
Serco ............................. 103,590,132
Steria ............................. 19,084,494
VF Worldwide ....................... 67,416,851

Total ............................ £734,907,911


Source: http://data.gov.uk/dataset/financial-transactions-data-ho

Did those seven hits Brodie Clark talks of cost £105,000,000 each? A cheap mind might say so. Money is the only currency some people can deal in.

But Mr Vine offers us something subtler and more human. He contrasts the pestilentially inflexible computer system which made it hard for immigration officers to collate the statistics of their drugs seizures (4.98) with the benefit of human beings with the gift of judgement, specifically an immigration officer faced with a traveller with impeccable credentials who turned out to have 93 packets of cocaine inside him (Figure 12, p.66).

The computer wouldn't have discovered that cocaine. The traveller's papers were in order. The immigration officer did. He disobeyed instructions and questioned the traveller. He had a hunch. He had a certain amount of autonomy and discretion. And presumably a sound understanding of his duty and an admirable commitment. Which one does the Daily Mail want? Which one do you want?

If you are persuaded that border security depends on people and not on senseless automata then, the more you read John Vine's report, the more you understand what that belief means. It means that forms won't always be filled in correctly. It means that the people at head office will add up the figures and get a different total. It means that one man's "provisional" is another man's "unqualified". No computer would confuse "Level 2" with "Scenario 2", but then no computer will find those 93 packets of cocaine.

Chapter 2 of Mr Vine's report is devoted to the Warnings Index (WI). The WI checks have had to be suspended too often, usually for good reasons (2.21) ...

For example, on 15 July 2011, 100% checks were suspended for one hour and 20 minutes and the reason for this was recorded as “Coaches blocking roundabout”, whilst on 16 July 2011, the reason recorded was “Coaches tailed back to motorway”.

 ... but not always for good reasons. Figure 6 on p.23 of Mr Vine's report lists suspensions of WI checks by port, ending with 106 suspensions at "Other ports combined". Mr Vine attaches a footnote, footnote no.13, one for the history books, explaining that these other combined ports include three holiday destinations. One of them is Disneyland Paris, side-splittingly referred to in the Daily Mail headline above. The three holiday destinations reported just one suspension each, which sounds statistically insignificant. It's just that the suspension went on in each case for four years, Yvette Cooper please note.

It's not good. In fact, it's bad. But look why it's bad. It's profiling.

Some clot decided that no-one coming home from Disneyland Paris was likely to be a security threat and stuck to it for four years. If you believe in the efficacy of targeting, though, this is the kind of result you must expect. This, and the rogue "Operation Savant" uncovered by Mr Vine and dealt with in Chapter 5 of his report.

It does have funny consequences. Also in Chapter 5, Mr Vine records the procedure at Portsmouth, where immigration officers didn't bother to "open the chip" in ePassports, except to annoy French travellers.

But in general, think twice before agreeing that profiling is a good idea.

It sounds targeted or intelligence-led or risk-based, it sounds advanced and scientific. The suggestion is of a crack team of 26 PhDs in the UKBA command and control bunker using advanced pattern-recognition to detect, hidden away in a mineful of data, the geometry of an organised crime or a planned act of terrorism. But as no-one knows the shape of organised crime or terrorism it's baloney.

Mr Vine says in his introduction that "there is nothing I have discovered which could not have been identified and addressed by senior managers exercising proper oversight" (p.6). Which senior managers does he mean?

Go back to the Home Affairs Committee report. The Committee say:

14. ... The UK Border Agency is described as "an executive agency of the Home Office" but it is in fact an integral part of the Department. While it has its own management and budgetary structure, the UK Border Agency is still under the aegis of the Home Office and it no longer formulates its own policy—that is the responsibility of Home Office Ministers, on the advice of Home Office and UK Border Agency officials. 22. ... If we are to accept the version of events as recounted by Ministers and senior Home Office staff then it creates the impression that Mr Clark was running the UK Border Force without effective checks or balances from either his superiors or immediate colleagues despite the fact that the Border Force is not a separate organisation, nor even part of an independent agency, but is part of the mainstream responsibility of the Home Office and comes directly under the responsibility of the Permanent Secretary and the Board of the Department.

So that's who Mr Vine thinks should have exercised proper oversight. The problems aren't all the responsibility of Brodie Clark and a few senior UKBA staff at Heathrow. Responsibility is shared right up into the heart of the Home Office, right up to Dame Helen Ghosh, the Permanent Secretary. And the problems didn't start last year when she started. Dame Helen inherited a lot of the mess from Sir David Normington, her predecessor as Permanent Secretary, who remains as silent about her travails as his ex-boss, Sir Gus, now Lord O'Donnell.

What's the solution? Split the Border Force from the rest of UKBA? That's obviously what Dame Helen and Theresa May have decided to do. A mistake. Especially if they accompany that move with a lot of opprobrium heaped undiscriminatingly on the heads of all their staff. There are success stories. Like the introduction of checks on lost and stolen passports. Success stories which it might be nice if Mr Vine had included in his report.

It could work, though, if UKBA stop wasting lorry-loads of public money on glitzy technology and plausible consultants and contractors and spend a bit instead on the human beings that border security really relies on.

Is there any hope of that happening? On past experience, no. But just maybe the Financial Times story about the deployment of smart gates at UK airports being delayed in advance of Mr Vine's report could herald a break with past experience – maybe UKBA will abort the deployment of smart gates and cut back on their staff cutbacks.

John Vine report published

John Vine CBE QPM is the Independent Chief Inspector of the UK Border Agency (UKBA). His report on the Brodie Clark affair was published on Monday 20 February 2012. Like the Home Affairs Committee report Inquiry into the provision of UK Border Controls published a month earlier on Thursday 19 January 2012, it is a historic document. It criticises the Executive and yet, there it is, in a brave move of the Home Secretary's, it’s been published by the Executive.

Digital by default – the Government Digital Service, Digital Delivery Identity Assurance, Digital Engagement and Assisted Digital

Amazon.  eBay.  PayPal.  Google.  Facebook.  The Cabinet Office looks at these phenomena and sees a lot of hugely efficient money-making machines with global reach and a high-volume, popular, voluntary and growing take-up.

Then the Cabinet Office looks at Whitehall's tax-farming agency, HMRC, and at its big spenders, DWP and the NHS, and it sees ... something different, something sadder, something old-fashioned, halting and with a big hole where the dynamism and the optimism ought to be.

Putting to one side the obvious point – in fact forgetting entirely – that providing public services is a categorically different job from retail,  the Cabinet Office wants to look modern, it wants to partake in the glory of that spontaneous popularity enjoyed by Amazon et al, and it would no doubt like to experience the same energy and "buzz" as the web Titans.

But  the Cabinet Office just isn't Google. As soon becomes embarrassingly apparent.

Google provides web search facilities. But they didn't call themselves "W-Search Facilities". They called themselves "Google".

The Cabinet Office have been trying for years to develop a government digital programme. And what did they call it? To start with, the "G-Digital Programme".

It's flat-footed. The Cabinet Office want people to want to use Whitehall's services, the way people want to use Facebook, but no-one's nostrils are going to flare when they're hit by the pheromones of the "G-Digital Programme", the desire to know more is resistible ...

... which must have been pointed out to the Digital Engagement team, because some stolid worthy had the bright idea of writing "The Club" at the bottom of the G-Digital Programme webpage. Inviting, you see. Companionable. The sort of group people would want to join.

Which deadpan comedian called the digital engagement team the "Digital Engagement" team? Why not "S.W.A.T."? Or the "Whitehall Giants"? Or "Martha's Sappers"?

Talking of whom, Martha Lane Fox has provided the G-Digital Programme with a slogan – "digital by default".

And with that she has provided them with a problem, because millions of Brits have never used the web. How are they going to access all the public services that become digital by default? How are they going to avoid exclusion by default?

It's not a new problem. It arose six years ago when the Cabinet Office came up with Transformational Government -- Enabled by Technology. They didn't solve the problem then and they still haven't. It may be insoluble.

Non-web users would need help to access digital public services. Where could that help come from? Libraries? Maybe. Post offices? Maybe not.

For the moment, there's no solution in sight. But, next best thing, there is a blog – Assisted Digital. A blog with just two posts on it.

"Assisted digital"? How could they? How did anyone think it was a good idea to call the non-existent service to plug the gap between people and the public services they need "assisted digital"? There is only one name possible in the circumstances – "Dignitas".

The analogy between delivering books (Amazon) and delivering benefits (DWP) is misleading.

It is that analogy that turns us, the public, from being "patients" and "parents" and "travellers" into "customers" in the language of Cabinet Office communications. And it is that analogy that leads us to the notion of a digital Dignitas.

It leads to nonsense. The analogy should be abandoned.

Digital by default – the Government Digital Service, Digital Delivery Identity Assurance, Digital Engagement and Assisted Digital

Amazon.  eBay.  PayPal.  Google.  Facebook.  The Cabinet Office looks at these phenomena and sees a lot of hugely efficient money-making machines with global reach and a high-volume, popular, voluntary and growing take-up.

Then the Cabinet Office looks at Whitehall's tax-farming agency, HMRC, and at its big spenders, DWP and the NHS, and it sees ... something different, something sadder, something old-fashioned, halting and with a big hole where the dynamism and the optimism ought to be.

Martha Lane Fox, one of the unwritten bits of the British Constitution

Whitehall say that between nine and ten million people in the UK have never used the web. They also say that they intend to provide all public services over the web, and only over the web. How can they possibly have argued themselves into this position?

For once, Whitehall's answer is clear, ...

Tom Loosemore: This journey started with Martha Lane Fox’s report demanding that Government ‘revolutionise’ its online services ... Francis Maude: Established in response to Martha Lane Fox’s report ... our core purpose is to ensure the Government offers world-class digital products that meet people’s needs. GDS Projects: The Single Government Domain team are responsible for designing, developing and testing a single domain for government as recommended by the Martha Lane Fox report. Digital Engagement: The Government Digital Service is the new name for the organisation created by the merging of Directgov and the Cabinet Office Digital Delivery and Digital Engagement teams, following the recommendations of the Martha Lane Fox review ... David Mann: HMRC is way ahead of the game in terms of creating a ‘wholesale’ model for delivery of government services online, an approach strongly advocated by Martha Lane Fox ... James Stewart: Martha Lane Fox’s report made delivering high quality APIs a key objective of our work ... Ex-Guardian man Mike Bracken: The mission for GDS, outlined by Martha Lane Fox, requires us all to collaborate ...

... "Martha Lane Fox told us to".

This is a novelty in public administration. When did Ms Lane Fox's dicta take on the mantle of statute law? The constitutional historians must be scratching their heads – nowhere in any of the books covering Henry VIII clauses is there any reference to the MLF Prerogative. Not yet, at least.

----------

Added 12.12.12:

Government Digital Service Invitation To Tender APPENDIX B – SERVICE DESCRIPTION 1.                  BACKGROUND TO GOVERNMENT DIGITAL SERVICE 1.1               The Government Digital Service (GDS/the Authority) is a new organisation that has been created through a merger of the Cabinet Office Digital Delivery and Digital Engagement teams with Directgov, the "one-stop shop" for online government. It is the aim of GDS to be the centre for digital government in the UK, building and championing a 'digital culture' that puts the user first and delivers the best, low-cost public services possible. 1.2               GDS is responsible for implementing the recommendations set out in the 2010 review of Directgov, undertaken by Martha Lane Fox. These recommendations called for the overhaul of 750 separate government websites, to be replaced by a single Internet "front-door" to public services on the web.

Martha Lane Fox, one of the unwritten bits of the British Constitution

Whitehall say that between nine and ten million people in the UK have never used the web. They also say that they intend to provide all public services over the web, and only over the web. How can they possibly have argued themselves into this position?