Foreign cops ask for UK identity data

THE UK'S serious and Organised Crime Agency is talking with foreign police about letting them access the National Identity Register, the identity card database that will contain the biometric records of every adult in Britain.

The UK is also prepared to trawl its own citizen's biometric records for wanted criminals, but only in special circumstances, THE INQUIRER clarified today.

Andrew Dent, director of the UK's Critical Worker's Identity Card Scheme, said the UK was talking to other countries about the possibility of sharing data from the National Identity Register.

"There are lots of ongoing discussions," he said at the Biometrics 2008 conference in London. "There will be more in the future because the National Identity Scheme is a new capability."

"As you would expect there is interest in it from a wide range of agencies internationally and that is provoking 'what if' discussions and that will only intensify over time," said Dent.

"SOCA is the key agency and that's partially what SOCA was set up to do, to make sure discussions are coherent," he added.

The UK also plans to check people on the Identity Scheme database against " watch-lists" of wanted people provided by other countries, said Dent. The UK's E-borders agency already does this. But biometric watch-lists are not yet common.

Interpol, the international police body, has a biometric database populated with the fingerprints of 0.8m criminals and suspected criminals operating outside their own countries. The agency is expanding the database, aiming for 1m fingerprints by the end of 2009, adding the facility to store DNA, mugshots and iris scans, and encouraging more countries to use it.

Mark Branchflower, head of Interpol's fingerprint unit, said: "We are looking at doing more data sharing. We need to exchange more data."

Branchflower did not say he might make use of access to the biometric data of UK's civilians recorded in the National Identity Register, though Dent sent one of the many conversations SOCA was having with foreign agencies about data sharing with the ID scheme was with Interpol.

The UK's Identity and Passport Service has also struck an agreement to use records from the US Federal Bureau of Investigations' fingerprint database to test the ID scheme, even though the FBI's records are being supplied in a format incompatible with the National Identity Register.

The deal allowed the home office to use both rolled fingerprint records, which are incompatible with the ID Scheme's design and are used only in criminal databases such as the FBI's Integrated Automated Fingerprint Identification System (AIFIS), Interpol's fingerprint database and the UK's own IDENT1.

<strong>Something fishy</em>

Campaign group No2ID believes the UK is preparing to share its citizen's Identity data with foreign police agencies. It even fears that the IPS plans to let police go on "fishing expeditions", trawling through the National Identity Register for suspects.

The UK government has said that the ID database would not be used for fishing expeditions. The assertion is still made, but an IPS executive said today that the data could be trawled in exceptional circumstances.

Duncan Hine, executive director of identity and security for the IPS, said: "The vast majority of transactions are hypothesis driven."

This means that UK police would require more than a fingerprint to get the IPS' permission to search the National Identity Register. They might be asked to specify who they think the suspect is, for example. More technically, he claimed the IPS would perform searches for police on a one-to-one basis - i.e. when they know who it is they are looking for.

Hine said there would be "no trawling, no fishing trips, no big extracts," performed by the IPS on the behalf of the police. And yet there would be some one-to-many searches allowed on the ID data. In privacy circles this is known as fishing.

As Hine conceded in conversation with the INQ: "We don't like searching the database for things, in a privacy sense. Its quite hard to imagine one-to-many uses. Enrolment is the big one. But I'm not willing to specify any other circumstances."

The IPS will perform a one-to-many search on the National Identity Register every time it registers someone with a new identity card. This will check that their biometrics haven't already been registered under someone else's name, said Hines.

"The vast majority of the rest of the time we are doing one-to-one which is a much smaller test with a much higher chance of a strong match," he said.

When THE INQUIRER asked whether the IPS might let the police do one-to-many matches on the National Identity Register, Hines said: "That depends on the type of the crime."

When the government has implemented a biometric database of every British citizen it will be inevitable on the tragic occasion of the murder of a child, say, that there will be irresistible pressure for biometric information found at the scene of the crime to be run past the ID database in a fishing expedition.

The arguments against such use of the system are subtle and include, for example, the fact that biometric evidence is unreliable and error prone on its own, especially when run through one-to-many searches. On the strength of flaky searches, innocent people will have their collars felt and their front doors' becamped. As No2ID says, it risks turning the National Identity Register into a suspect database and overturning the presumption of innocence.

Hence, the government's repeated insistence that it will not allow the police to conduct fishing expeditions on the National Identity Register. Tony Blair landed himself in hot-water in 2007 over claims he wanted to allow the police to go on fishing expeditions for in the Identity data. Joan Ryan, the then Home Secretary, got him out of it by saying it wouldn't be fishing because the police themselves wouldn't conduct the searches, the IPS would.

But fishing expeditions will happen. They might even be conducted on the behalf of foreign agencies. µ

See Also
UK tests identity scheme with criminal data types