Why can't we be more like the Dutch?

Ministerie van Binnenlandse Zaken en Koninkrijksrelaties

Bekker: verbetering biometrisch paspoort mogelijk Nieuwsbericht | 27-02-2012 Het gebruik van vingerafdrukken en digitale pasfoto's (biometrie) in het paspoort en de identiteitskaart is niet mislukt, maar levert nog onvoldoende op. De vingerafdrukken staan niet in een centraal bestand, ze worden niet gecontroleerd aan de grens en ook nauwelijks bij de uitgifte van reisdocumenten aan het gemeenteloket. Er zijn nog mogelijkheden om het gebruik van vingerafdrukken en foto's op paspoorten en ID-kaarten beter te benutten. De hooggespannen verwachtingen van tien jaar geleden zijn niet uitgekomen.

Clear enough. Nothing to add. You may say.

Oh alright, just for the English. That's Dutch, that is, and here is the Google translation:

Ministry of the Interior and Kingdom Relations

Bekker: improving biometric passport may News | 02/27/2012 The use of fingerprints and digital photographs (biometrics) in the passport and identity card has not failed, but supplies still insufficiently. The fingerprints are not in a central database, they are not checked at the border and also largely to the issuance of travel documents to the municipal service. There are possibilities for the use of fingerprints and photographs on passports and ID cards better. The high expectations of ten years ago did not materialize.

Professor Roel Bekker has investigated the matter of biometrics in Dutch passports and here in his report he concludes mildly that "the high expectations of ten years ago did not materialize".

A bit too mildly for the Dutch civil liberties campaigners, Privacy First, who have published a commentary on Professor Bekker's report in which they say, among other things:

An interesting detail in this context is that already the end of 2009 the huge error rate (21%) upon verification of fingerprints known to State Secretary Bijleveld (Kingdom Relations). The House was not until end of April 2011 informed about this error rate ...

It should be pointed out for new readers that when we say "fingerprints" here, we mean the newish technology of flat print fingerprinting, a glorified photocopying process adopted by the UK Home Office and others. Unlike traditional rolled print fingerprinting – which works – there is no police fingerprint expert involved, it's quick, it's cheap, it's clean and it's utterly unreliable.

That's a Google translation again but 21% is a massive error rate in any language.

Suppose you're an officer of the UK Border Force, you're sitting at Heathrow and two A380s have just landed. That gives you 1,000 travellers to check using the Secure ID system the geniuses back at the Home Office have provided you with. You know that on average you're going to get 210 false alerts. You're going to waste your time and the time of 210 travellers because Secure ID wrongly tells you that they are not who they say they are.

You can see why Brodie Clark told the Home Affairs Committee that fingerprint checks at the border are the least reliable security/identity checks his (now ex-)staff perform, why Secure ID is their ninth and bottom priority, and why when push comes to shove in the immigration hall – as it does with 1,000 tired people – the most sensible thing to do is to drop Secure ID.

You can see that. And the Dutch can see it. They've dropped their plans to maintain central registers of people's biometrics and to rely on biometrics for security. That's the lesson they learn from the fact that the wretched technology just isn't good enough or, as Professor Bekker puts it, "the high expectations of ten years ago did not materialize".

But not here in the UK. Oh no. Here in Alice's Wonderland we both acknowledge that the technology doesn't work and continue to spend money on it.

On 27 February 2012, the same day as the Dutch Ministry of the Interior and Kingdom Relations announcement above, the Guardian told us that "the government is to double the number of people required to have a biometric residence permit (BRP) to stay in the UK, raising the number to 400,000 a year". By all means hand out residence permits where that is the right thing to do. But given that the biometrics don't work, why make them biometric residence permits? The biometrics add nothing. Except cost.

These biometric residence permits are all part of IABS, the Home Office's new Immigration and Asylum Biometric System. It doesn't just "do" residence permits. It's also meant to do border security. And it's meant to help to keep the 2012 Olympics safe.

In its first 18 months in power, the coalition government spent £735 million with IABS contractors.

The Dutch know that the biometric bits of IABS are a waste of time and money. A 21% error rate is a fail. Why can't the UK learn the same lesson?

Why can't we be more like the Dutch?

Ministerie van Binnenlandse Zaken en Koninkrijksrelaties

Bekker: verbetering biometrisch paspoort mogelijk Nieuwsbericht | 27-02-2012 Het gebruik van vingerafdrukken en digitale pasfoto's (biometrie) in het paspoort en de identiteitskaart is niet mislukt, maar levert nog onvoldoende op. De vingerafdrukken staan niet in een centraal bestand, ze worden niet gecontroleerd aan de grens en ook nauwelijks bij de uitgifte van reisdocumenten aan het gemeenteloket. Er zijn nog mogelijkheden om het gebruik van vingerafdrukken en foto's op paspoorten en ID-kaarten beter te benutten. De hooggespannen verwachtingen van tien jaar geleden zijn niet uitgekomen.

Clear enough. Nothing to add. You may say.

Oh alright, just for the English. That's Dutch, that is, and here is the Google translation:

The collection of people's biometrics is akin to the old-fashioned schoolboy hobby of stamp-collecting

A courtier asked the Prince [later King George V] if he had seen that "some damned fool had paid as much as £1,400 for one stamp". "Yes," came the reply. "I was that damned fool!"

George V loved stamp collecting.

The attractions of stamp collecting may elude you and me but there's something touching about the enthusiasm of a grown man for this harmless pursuit.

Harmless, at least, as long as it's not being funded by public money. That can rankle. You don't need to be a republican to find the thought distasteful that people's hard-earned money extracted from them in taxes should pay for one privileged man's hobby. Certainly, nothing like that would be acceptable today.

Except that, apparently, it is.

In the first 18 months of the coalition government, £140,023,212 was paid to Computer Sciences Corporation and £67,416,851 to VF Worldwide Holdings to collect the fingerprints of non-EEA visa applicants abroad.

Can anybody explain why? Is this a justifiable use of public money? How can it be? Note to the Home Office: justify it; either that, or please stop.

The collection of people's biometrics is akin to the old-fashioned schoolboy hobby of stamp-collecting

A courtier asked the Prince [later King George V] if he had seen that "some damned fool had paid as much as £1,400 for one stamp". "Yes," came the reply. "I was that damned fool!"

George V loved stamp collecting.

The attractions of stamp collecting may elude you and me but there's something touching about the enthusiasm of a grown man for this harmless pursuit.

Harmless, at least, as long as it's not being funded by public money. That can rankle. You don't need to be a republican to find the thought distasteful that people's hard-earned money extracted from them in taxes should pay for one privileged man's hobby. Certainly, nothing like that would be acceptable today.

Except that, apparently, it is.

In the first 18 months of the coalition government, £140,023,212 was paid to Computer Sciences Corporation and £67,416,851 to VF Worldwide Holdings to collect the fingerprints of non-EEA visa applicants abroad.

Can anybody explain why? Is this a justifiable use of public money? How can it be? Note to the Home Office: justify it; either that, or please stop.

The belief in the efficacy of biometrics is akin to the belief in astrology

Warning. In the following paragraphs approximately half the world will be insulted. Please stay your hand revengewise. In no time at all, the other half will be equally insulted.

Why is it, our ancestors asked, that the children in a given family aren't identical? Some of them are boys, others girls. Some of them are outgoing, others repressed. And yet they have the same parents. What can explain the difference?

It's a good question and our ancestors came up with a good hypothesis by way of an answer. It had to be something unique about each child in the family, something that distinguished each from the others. And the answer suggested was ... the position of the planets at the moment of birth. Permanently in motion, there is something unique about the position of the planets at any given moment. And they're big, the planets, big enough to influence developments here on earth.

Astrology looks as though it ought to have some explanatory value. We naturally believe that there is something unique about each individual person who ever exists and we naturally look for reasons for that, or at least for causes.

Like a lot of hypotheses, astrology has failed. Nothing surprising about that. Most hypotheses fail. Half of science is all about trying to disprove hypotheses. It's that massive failure rate that gives the remaining not-yet-disproved hypotheses their strength. That's what makes knowledge special and rare and hard to come by and valuable.

(The other half is all about having enough knowledge and dedication and imagination to devise a worthy hypothesis in the first place.) 

Anyway, as far as about half the world is concerned, astrology is a waste of time. It's bunkum. It doesn't explain character traits. No causal link between the position of the planets at the moment of his birth and the money-making abilities of Richard Branson, say, has ever been established, his life is not written in the stars, the stars give us no hint what to expect from him next, his horoscope is a useless piece of paper.

You astrologically-inclined persons believe in magic. What the rest of us believe in is science. Scientific experiments are repeatable. Science is respectable and defensible and logical and intelligent and grown up and allows us to predict events in advance.

At least, that's what we like to believe.

We're very scientific and we spend a lot of money on science, which proves our faith, and we like it when scientists talk to us on television but, oddly, we still can't predict earthquakes. Or the eruptions of volcanoes. Or tsunamis. Little things like that seem still to elude us.

Those failures will not detain scientists for a moment. Quite rightly. We may not have all the explanations yet, but we're working on it and we've got a tremendous record of success behind us, a centuries-long demonstration that if we only stick at it, the solution is discovered in the end. The science improves. Technology improves. You can talk to someone in real time on the other side of the planet thanks to telephones. That would once have been considered magic. No more.

No-one can have any objection to research money being spent legally on science while it's still at the hypothesis stage. Certainly not if it's private/personal money or charitable trust money. That's up to the individuals or charities concerned and none of our business, the rest of us. Equally, we can hardly be expected to rely on unproven science like astrology in our everyday lives and we are quite within our rights to object if someone tries to force us to.

Things change when it comes to business. His shareholders would quite properly look askance at Richard Branson if he spent company money on astrological research projects rather than on the dividends that could otherwise be paid.

And they change mightily when it comes to public money. Public money is meant to be spent wisely and in a businesslike way in the interests of the public, so that it contributes to the "common welfare". It's wrong for a public authority to fritter away taxpayers' money, or borrowings added to the national debt, on hopeless (?) hypotheses like astrology.

Of course, our government here in the UK doesn't do that sort of thing.

Or does it?

Consider the Home Affairs Committee report on the Brodie Clark affair, Inquiry into the provision of UK Border Controls. (You knew that was coming. Didn't you?) And consider particularly para.10:

... Rob Whiteman [Chief Executive of the UK Border Agency] explained that he believed that the reason Ministers were opposed to any reduction of Secure ID checks was because they did not agree with Brodie Clark's assessment of them as 'secondary checks' due both to the deterrent effect of the check and because "of course, if somebody is found by that, it is actually quite a high-risk case—if somebody has gone to the position of forging the photograph in comparison with the photograph on the chip—so, although the number might be very low, Ministers were of the view that the risk value of an incident would be high."

Mr Whiteman is slightly confused here. Science is difficult for the best of us, but "Secure ID" is all about fingerprint checks, not face recognition and what UKBA call "opening the chip" in ePassports. Still, it's only a slight confusion, they're both biometrics and biometrics, of course, is a proven science, isn't it.

No, it's not. The belief in the efficacity of mass consumer biometrics is still at the faith stage, it's magic, it's an unproven hypothesis, and the Home Affairs Committee might just as well have written:

... Rob Whiteman explained that he believed that the reason Ministers were opposed to any reduction of Astrological ID checks was because they did not agree with Brodie Clark's assessment of them as 'secondary checks' due both to the deterrent effect of the check and because "of course, if somebody is found by that, it is actually quite a high-risk case—if somebody has gone to the position of forging their date and place of birth in comparison with the star sign on the chip—so, although the number might be very low, Ministers were of the view that the risk value of an incident would be high."

The unnamed ministers' argument relayed by Mr Whiteman is a candidate for the most stupid argument put forward yet in the Brodie Clark affair. Until the Home Office give us some reason to believe that biometrics work and that public money is being wisely invested in this technology, the UK Border Force procedures with regard to biometrics are no more comprehensible than instructing them to detain all Sagittarians.

Ah, you may say, but the technology will improve.

Will it? How do you know that? It hasn't yet. And astrology hasn't improved. So why should biometrics?

And why invest in it and rely on it in our everyday lives before it's known to work? If Richard Branson tried that on, then the institutions who hold his shares would take him aside and suggest that perhaps, old boy, you know, the time isn't right just yet, why don't we wait a bit, let the dust settle, see how the cards fall, then it might be worth investing but until then, it really doesn't look businesslike, in fact it barely looks rational.

The managers of a company have a fiduciary duty to their shareholders to behave rationally and in a businesslike manner. The Home Office even more so – that's public money they're spending. No doubt it seems like magic to Whitehall that we give them £710 billion to spend every year. But there are a few formalities to observe, not behaving like a credulous ignoramus being just one of them.

The belief in the efficacy of biometrics is akin to the belief in astrology

Warning. In the following paragraphs approximately half the world will be insulted. Please stay your hand revengewise. In no time at all, the other half will be equally insulted.

Why is it, our ancestors asked, that the children in a given family aren't identical? Some of them are boys, others girls. Some of them are outgoing, others repressed. And yet they have the same parents. What can explain the difference?

UIDAI and the textbook case study of how not to do it, one for the business schools

The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

It's worked. UIDAI survives for the moment.

But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

The job of the Unique Identification Authority of India (UIDAI) is to use biometrics to identify every resident of India and to issue them with a unique corresponding number, a so-called "Aadhaar number".

"Aadhaar" means foundation or support and the idea is that, once everyone has an identifying number, it will be easier for the various arms of government to build systems on that foundation to provide social security benefits, for example, and to facilitate national security. And beyond government, the banks will supposedly find it easier to authenticate payments.

UIDAI is not without its critics:

• The Standing Committee on Finance (SCoF), a committee of the Indian Parliament, has considered the National Identification Authority of India Bill, 2010. That Bill would establish UIDAI on a statutory basis if it was ever enacted, but it hasn't been. Meanwhile, UIDAI is operating under executive order only. It's not operating very well according to the SCoF report and it's about time UIDAI came under the control of Parliament.
• And then there's the Ministry of Home Affairs. They're a properly constituted body and not just a creature of the Executive. And they have a competing identity management scheme, NPR (the National Population Register). Result – a turf war, Aadhaar v. NPR.

SCoF and the Ministry of Home Affairs pressed their case with the Prime Minister but UIDAI proved too adept for them. The Chairman threatened to resign, which would be embarrassing for the prime Minister – good move no.1. Good move no.2 – UIDAI arranged some convenient PR with the compliant Economist magazine. And then they published not one but two reports making unprecedented claims for the reliability of the biometrics used in Aadhaar:

• Role of Biometric Technology in Aadhaar Enrollment
• India boldly takes biometrics where no country has gone before

Oops. Bad move. There are five problems here:

1. Both reports are produced by UIDAI only. There is no sign that they have been audited by any independent expert body.
2. Both reports quote reliability figures. No other public authority in the world does that. Not operational figures – figures measuring the reliability of biometrics in the field, at the border, for example. They should. But they don't. Now, thanks to UIDAI, they will all come under pressure to quote independently audited figures themselves, figures for reliability, to justify their investment of public funds. It is likely that the public are going to be shocked at just how unreliable the biometrics are, that their governments are using. The public will at last understand why their governments have been so reluctant for so long to quote any figures.
3. Why is that likely? Because the figures quoted by UIDAI are hundreds of times better than anything anyone else has ever claimed following tests of biometrics. Hundreds.
4. The second report says that (a) Aadhaar uses flat print fingerprinting and iris scanning, (b) the two biometrics are fused to form one composite biometric, so-called "multi-modal" biometrics, and (c) UIDAI use not one matching algorithm, but three of them. Any large-scale identity management scheme that doesn't do the same, they say – (a), (b) and (c) – is doomed to "catastrophic failure".
5. The suppliers of biometric technology have never had to give public warranties before. Now they will have to.

Great. Now suppose you're the Australian Customs and Border Protection Service. You've spent millions of dollars of public money deploying smart gates at Australian airports as a security measure. These gates depend on face recognition biometrics. Not on UIDAI's list (a). The Australian (and new Zealand) border security system is doomed to "catastrophic failure". Don't take my word for it. Ask UIDAI.

You've spent years refusing to divulge any figures about the reliability of your technology:

Customs refused to disclose the rates at which the system inaccurately identified people. "For security reasons, Customs does not disclose the false positive and false negative rates," a spokesman said.

Now UIDAI have released figures, how are you going to hold the line? You can't.

You could say that UIDAI's figures haven't been audited and may turn out to be false. Now you've got a fight with UIDAI on your hands. And what's the best result you can hope for? UIDAI's figures turn out to be a pack of lies and actually the reliability of Aadhaar is just as appalling as the Australian system. Not what you wanted. It doesn't help to explain why you've been squandering your own citizens' tax money on joke technology.

The same applies to the UK, of course, and our planned deployment of smart gates at airports. Another catastrophic failure? And all those states in the US busy incorporating face recognition biometrics into driving licences. These people – the Australian Customs and Border Protection Service, UK Border Agency, et al – are not going to be pleased with UIDAI. UIDAI have let the cat out of the bag and have almost certainly started a fresh collapse of confidence in public administration as a result.

And neither are the biometrics suppliers going to be pleased. How are Morpho going to sell their products now without giving warranties? They're not.

And how are IBM and CSC going to be able to sign any more nine-figure biometrics contracts with credulous governments? They're not.

And how are PA Consulting going to sell any more biometrics assignments? They're not.

UIDAI are going to be persona non grata worldwide. Especially in India, where the Prime Minister may yet regret his decision to carry on funding them. And stop. He may give almost any reason but the big reason, the one several people have pointed out for a long time, is that far from curtailing corruption, Aadhaar was simply going to automate it.

A tragedy with a happy ending, the only people who will be pleased is absolutely everyone else in the world, who can now keep some of their tax money and spend it themselves rather than paying public authorities to waste it for them.

UIDAI's Pyrrhic victory? From now on it's going to be known as an "Aadhaar victory". At least it will when the business schools write it up and teach it all around the world. And when the Economist faithfully report UIDAI's defence, under the heading "Poison pill – that's not the way to do it".

UIDAI and the textbook case study of how not to do it, one for the business schools

The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

It's worked. UIDAI survives for the moment.

But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

How to fly a kite, I am told

You're a senior politician. Or you have real power, you're a Whitehall official. There's something you want to say, but you can't be the one to say it. What do you do?

For years, the answer has been simple. Rachel Sylvester. She used to write for the Telegraph. Now it's the Times. The move was interesting – she was insufficiently sycophantic about New Labour, quite sycophantic but not sycophantic enough. But it doesn't matter to you that she moved – wherever she is, she'll fly your kite for you. The following examples from the Times only:

• 14 February 2012: But I am told by one well-placed source that the budget for his artwork could be “over £1 million” ...
• 31 January 2012: I am told that Sir Gus O’Donnell, then the Cabinet Secretary and head of the Civil Service, was among the senior figures who tried...
• 15 November 2011: She took the decision to do this, I am told, against the advice of Home Office civil servants ...
• 28 June 2011: I am told that Stephen Gilbert, the political secretary at No 10, and Andrew Feldman, co-chairman of the Tory party, ...
• 17 May 2011: I am told that the new joint committee will include 12 members of each House, including crossbenchers and a bishop ...
• 10 May 2011: I am told that he first raised concerns with Andrew Lansley at the end of last year ...
• Etc ... The reader is spared the other 28 examples easily found with a single search on the Times website. The Telegraph website yields another 53 examples.

Apparently, somewhere behind the scenes, where people are paid public money to discuss this sort of thing, some conclave of cardinals has been debating the vexed question whether the Home Office isn't perhaps a little too right-wing and the Ministry of Justice a little too left-wing and they've decided to settle the matter by testing the waters in public.

This week's kite, in Ms Sylvester's Tough on crime, tough on namby-pambies, flies as follows:

One proposal discussed in Downing Street is to reconfigure Whitehall to end the good-cop-bad-cop departmental divide. Under the plan the Home Office would be responsible for everything to do with crime, including the police, prisons policy and sentencing. The Ministry of Justice would be scrapped and replaced with a new as-yet-unnamed department handling issues relating to national identity. This would bring together immigration, passport control and citizenship. Damian Green, the junior immigration minister, is mentioned as a contender for the Cabinet job. From the liberal wing of the Tory party, he can talk tough without sounding nasty. It may not happen but a change of emphasis is certainly under way.

If only the cardinals ran a focus group called something like SylvesterRachel.gov.uk, we could all drop by and vote "no".

How to fly a kite, I am told

You're a senior politician. Or you have real power, you're a Whitehall official. There's something you want to say, but you can't be the one to say it. What do you do?