Summary of Conclusions
The Report concludes that the establishment of a secure national identity system has the potential to create significant, though limited, benefits for society. However, the proposals currently being considered by Parliament are neither safe nor appropriate. There was an overwhelming view expressed by stakeholders involved in this Report that the proposals are too complex, technically unsafe, overly prescriptive and lack a foundation of public trust and confidence. The current proposals miss key opportunities to establish a secure, trusted and cost-effective identity system and the Report therefore considers alternative models for an identity card scheme that may achieve the goals of the legislation more effectively.
The concept of a national identity system is supportable, but the current proposals are not feasible. Many of the public interest objectives of the Bill would be more effectively achieved by other means. For example, preventing identity theft may be better addressed by giving individuals greater control over the disclosure of their own personal information, while prevention of terrorism may be more effectively managed through strengthened border patrols and increased presence at borders, or allocating adequate resources for conventional police intelligence work.
The technology envisioned for this scheme is, to a large extent, untested and unreliable. No scheme on this scale has been undertaken anywhere in the world. Smaller and less ambitious systems have encountered substantial technological and operational problems that are likely to be amplified in a large-scale, national system. The use of biometrics gives rise to particular concern because this technology has never been used at such a scale. We estimate the likely cost of the ten-year rollout of the proposed identity cards scheme will be between £10.6 billion and £19.2 billion, with a median of £14.5 billion. This figure does not include public or private sector integration costs, nor does it take into account possible cost overruns. Any system that supports critical security functions must be robust and resilient to malicious attacks.
Because of its size and complexity, the identity system would require security measures at a scale that will result in substantially higher implementation and operational costs than has been estimated. The proposed use of the system for a variety of purposes, and access to it from a large number of private and public sector organisations will require unprecedented attention to security.
All identity systems carry consequential dangers as well as potential benefits. Depending on the model used, identity systems may create a range of new and unforeseen problems. These include the failure of systems, unforeseen financial costs, increased security threats and unacceptable imposition on citizens.
The success of a national identity system depends on a sensitive, cautious and cooperative approach involving all key stakeholder groups including an independent and rolling risk assessment and a regular review of management practices. We are not confident that these conditions have been satisfied in the development of the Identity Cards Bill.
The risk of failure in the current proposals is therefore magnified to the point where the scheme should be regarded as a potential danger to the public interest and to the legal rights of individuals.

Introduction
The introduction of a national identity system will herald a significant shift in Britain’s social and economic environment. Many fundamental concepts such as privacy, anonymity and the individual’s accountability to government will be repositioned. The potential for merging, matching and sharing of personal information across the private and public sector will be made possible. For better or worse, the relationship between the individual and the State will change. Surprisingly little research has been undertaken with specific reference to the identity card legislation currently being considered by Parliament.
The aim of this study is to provide a comprehensive review of the Bill, to assess the costs and implications arising from its provisions, and to suggest areas for improvement. There appear to be some significant potential benefits to the UK in adopting a harmonised system of identification. However, the risks and the financial implications for business and for individuals may be substantial. In producing this report we have kept foremost in mind the potential to create an identity system with limited cost and risk, but one that brings the maximum benefit to individuals and society.
This report is based on research of available evidence. It does not deal with principle or speculation. There is a surprising degree of agreement between the findings of this report and the conclusions of the Home Affairs Committee on the draft Identity Cards Bill. This report agrees in whole or part with 79 of the 85 relevant recommendations in the HAC report (these are set out in detail in Appendix 1). This concurrence is a crucial test of the strength and validity of both reports. This Report provides a comprehensive foundation for further debate about many key aspects of the government's proposals.
Over the coming months we will continue to build on these findings to assess a wider range of issues relating to the impact and implications of an identity scheme for the UK.

Conclusions in Detail

Overview
This Report assesses the implications, costs, opportunities and consequences arising from current legislative proposals to introduce a national identity card scheme.
The Report does not challenge or debate the principles that underpin the proposals. The goals of combating terrorism, reducing crime and illegal working, reducing fraud and strengthening national security are accepted a priori as legitimate responsibilities of government.
The report does, however, challenge assumptions that an identity card system is an appropriate, safe and cost-effective way to achieve those goals. The Report concludes that the establishment of a secure national identity system has the potential to create significant, though limited, benefits for society. Secure identity, if implemented in the right way, can reduce identity fraud and promote the development of the e-commerce environment. However, the proposals currently being considered by Parliament are neither safe nor appropriate.
There was an overwhelming view expressed by stakeholders, experts and researchers involved in this Report that the proposals are too complex, technically unsafe, overly prescriptive and lack a foundation of public trust and confidence. The current proposals miss key opportunities to establish a secure, trusted and cost-effective identity system. There is no evidence to support the use of identity fraud as a justification for the current identity card model. Many of the claims made about the prevalence of identity fraud are without foundation.
A card system such as the one proposed in the Bill may even lead to a greater incidence of identity fraud. The concept of a national identity system is supportable, but the current proposals are not feasible. The Report therefore outlines an alternative model for an identity card scheme that will achieve the goals of the legislation more effectively.
The Government seems intent on pointing to international obligations and precedents to justify the introduction of a national identity card. Our research indicates that a national identity card need not resemble the one that the Government is proposing, nor is any nation under an obligation to create such a card.
Indeed, no other country has done so with such a pretext. An appropriate identity system for the United Kingdom would be one based on a foundation of public trust and user demand rather than one based on enforcement through criminal and civil penalties. The goal of public trust would be made possible, in part, through the use of reliable and secure technologies and the creation of a more flexible “citizen centred” model.
The remainder of this summary outlines the key areas of concern with the proposals as they stand. Each point is discussed in more detail in the main report.

Purposes of the system
The current proposals seek to address multiple, divergent goals, yet the evidence from other national schemes indicates that identity systems perform best when established for clear and focused purposes. The goal of “prevention or detention of crime”, for example, involves a potentially huge number of applications and functions that may not be appropriate for an identity system that also seeks to achieve a goal of public services delivery.
Equally, many of the public interest objectives of the Bill would be more effectively achieved by other means. For example, preventing identity fraud may be better addressed by giving individuals greater control over the disclosure of their own personal information, while prevention of terrorism may be more effectively managed through strengthened border patrols and increased presence at borders, or allocating adequate resources for conventional police intelligence work.
We accept that there is some evidence that the government’s scheme could be used as a means of combating illegal working, though measures have already been put in place to address this issue. Beyond these existing measures, an identity card is unlikely to achieve any significant effect.
We also accept that the proposed scheme is likely to have an impact on false identity within the benefits sector. However, the government has already put in place vetting regimes that are rigorous and effective. Benefit fraud through false identity is relatively rare and we believe the cost of introducing an identity card in the benefits environment would far outweigh any savings that could be made.

The technological environment
The technology envisioned for this scheme is, to a large extent, untested and unreliable. No scheme on this scale has been undertaken anywhere in the world. Smaller and less ambitious systems have encountered substantial technological and operational problems that are likely to be amplified in a large-scale, national system.
The use of biometrics gives rise to particular concern because this technology has never been used at such a scale. The proposed system unnecessarily introduces, at a national level, a new tier of technological and organisational infrastructure that will carry associated risks of failure.
A fully integrated national system of this complexity and importance will be technologically precarious and could itself become a target for attacks by terrorists or others. From a security perspective, the approach to identity verification outlined in the Identity Cards Bill is substantially – perhaps fatally – flawed. In consequence, the National Identity Register may itself pose a far larger risk to the safety and security of UK citizens than any of the problems that it is intended to address.

Cost
Any system that supports critical security functions must be robust and resilient to malicious attacks. Because of its size and complexity, the identity system will require security measures at a scale that will result in substantially higher implementation and operational costs than has been estimated.
The proposed use of the system for a variety of purposes, and access to it from a large number of private and public sector organisations will require unprecedented attention to security.
We estimate the likely cost of the ten-year rollout of the proposed identity cards scheme will be between £10.6 billion and £19.2 billion, with a median of £14.5 billion. This figure does not include public or private sector integration costs, nor does it take into account possible cost overruns.

Private sector costs relating to the verification of individuals may account for a sum equal to or greater than the headline cost figure suggested by the government. Staff must be trained to use biometric systems, and in larger organisations must be on hand at all times to verify customers and new employees.
New facilities may have to be built to accommodate applicants who feel sensitive about having their biometrics taken in public areas. The government has substantially underestimated the cost of biometric readers. Because of physical irregularity or mental impairment, a significant number of people are unable to provide a stable biometric unless expensive equipment is used. The cost of registration of applicants appears to have been underestimated.
The Bill makes provision for the disclosure and processing of more than fifty sources of identification. This element, coupled with the capture of biometrics and the investigation of the biographical history of applicants, may result in registration alone costing more than the projected overall cost of the identity system. The direct cost to people applying to be registered on the system is also likely to be higher than anticipated. Biometric registration may have to be repeated every five years for much of the population. As people age, their biometrics change and become less reliable.
As a consequence, these people are more likely to face problems with the use of the identity card system and may require more frequent updates of their biometric information stored on the system. Approximately 17 per cent of the population are aged over 65 and will fall into this growing class, as will such people as the visually handicapped and those with mental impairment.
The implications for reliability, cost and trust in the proposed identity system are significant. One possible solution to these problems is the endemic use of multiple biometrics. However, this feature would add significantly to the cost of the system.

The legal environment
In its current form, the Identity Cards Bill appears to be unsafe in law. A number of elements potentially compromise Article 8 (privacy) and Article 14 (discrimination) of the European Convention on Human Rights. Because of the difficulty that some individuals may face in registering or verifying their biometrics there is a potential conflict with national laws such as the Disability Discrimination Act and the Race Relations Act. The proposals appear to be in direct conflict with the Data Protection Act. Many of these conflicts arise from the creation of a national identity register, which will contain a substantial amount of personal data, some of which would be highly sensitive.
The amount of information contained in the register, the purposes for which it can be used, the breadth of organisations that will have access to the Register and the oversight arrangements proposed are contentious aspects. The compulsory acquisition of fingerprints in passports may violate the common law right to exit and re-enter the UK.
This common law right of each UK citizen is now enshrined in the Immigration Act, which does provide for exceptions. However, if a right to leave the UK exists and a passport is a prerequisite, then a right to a passport must exist also, subject to those exceptions. That right would likely be hindered if new biometrics were introduced. The Act’s exceptions are aimed in spirit at immigration control of foreign nationals, not control of UK citizens leaving the country.
The Bill also creates a possible conflict with the right of freedom of movement throughout the EU for EU citizens. It is arguable that the Identity Cards Bill may discourage non-UK EU workers from coming to the UK to work and so may infringe EU principles on the freedom of movement of workers.
Furthermore, EU Directive 68/360 governing the rights and conditions of entry and residence for workers may make it unlawful for the government to require non-UK EU citizens to obtain a UK identity card as a condition of residence. Liability and responsibility for maintaining accuracy of data on the Register, conducting identity checks and ensuring the integrity of the overall operation of the scheme has not been resolved. The legislation places requirements on individuals and organisations that are substantial and wide-ranging, and yet no indication has been given relating to how liability would be established, who would assess that liability, or who would police it.

Oversight
The oversight arrangements set out in the Bill appear to be inadequate in several key respects. An Identity Cards Commissioner as envisioned by the legislation may be an insufficient mechanism to adequately promote public trust.
The current population of oversight bodies in the UK is complex, inefficient and frequently in conflict.
Commissioners responsible for various aspects of privacy and surveillance, for example, rarely cooperate with each other. Reform of the oversight process rather than the addition of more oversight agencies might be the most effective way forward.

International obligations
The Government has consistently asserted that that biometrics proposals, both in the new UK passport format and in the identity cards legislation, is a harmonising measure required by international obligations, and is thus no different to the plans and intentions of the UK’s international partners.
There is no evidence to support this assertion.
We find that the Government is unnecessarily binding the identity card scheme to internationally recognised requirements on passport documents. By doing so, the Government has failed to correctly interpret international standards, generating unnecessary costs, using untested technologies and going well beyond the measures adopted in any other country that seeks to meet international obligations. Even in countries with identity cards, numerous safeguards prevent the development of a system similar to the one proposed here. We were unable to identify any country that established identity cards through an open parliamentary process.