Back on the ID cards trail.

This ain't gonna make me popular:-)

I've been thinking about the debate on ID cards at ****con and why it continues to dismay me. The reasons people cite against ID cards tend to fall into two camps: practical and principled.

Practical

1. The database project won't work; the error rate will be high, the information won't be successfully updated, the Chinese walls (if any) will be compromised etc.

2. The biometric data part of the project currently has too high a rate of false positive and false negatives for succesful identification, plus some people can't reliably provide biometric data.

3. Even if these problems could be solved, the project will go wildly over budget - like all public sector IT projects.

4. The public will have to pay for ID cards/passports at an unreasonable level compared to current cost of passports.

5.Even if access to the ID card database is restricted (as it should be for DP law purposes) to government agencies like health providers and welfare agencies, or police/crime investigation/intelligence etc , information will become available on the black market, and thence to everyone from private detectives to ID thieves.

To me these are issues of detail - of technology and management; which are difficult to critique in a non paranoid way right now as we know so little about the design of the underlying database or its costing. The time to argue these points is when we know how the database is to be designed, what the permissions for access to data will be and what the rules for dealing with erroneous data, false positive etc, will be.

On issues of non enforcement and data seep - the general mantra is that oh yeh, DP and confidentiality and ethics law exist that are meant to prevent these problems, but it won't work. In which case we might as well give up on ever having laws at all. I see the problem, believe me I do, but blanket cynicism is not a principled way to argue against ID cards, any more than blanket cynicism about enforcement of laws against car theft (equally viable) is a reason to abolish all laws on theft of cars, or all expenditure on enforcement of car theft laws.

On issues of cost - if in principle there is a case for ID cards , then the issues of cost have to be secondary. The cost is a matter for a principled debate in terms of how much we value the fight against terorism and other alleged evils (benefit fraud, asylum seeker entry) as against how much we value our personal data privacy. That debate just isn't happening in the UK right now.

"Practical" issues - of efficacy rather than principle - do not seem to me to be where the debate should be currently focussed. And at the moment, judging by yesterday's panel, for most people, it is.

What are the principled arguments against an ID card?

1. Putting all the data in one basket - a single linked database - creates a single point of failure. One decent hack or unprincipled employee or illegal agreement for a access by a government agency with a private actor, and huge amounts of personal data can be released - whereas if we only have, say, an NHS database, at least only health data can be so compromised.

2. Function creep. Create a single linked database of personal data and more uses will be found for it. We start off saying we'll only use it to assist in crime or terorism detenction , or, more benignly, to allow child care agencies to track children at risk wherever they go - but then we end up lending it to debt collectors, to commercial database marketing firms, to people who want to find out where pedophiles live, etc etc.

3. Compulsion. Till now no one in the UK has actually needed to acquire an ID card - no compulsion to get a driving license or a passport. Our Continental cousins, who live in liberal societies where ID cards (NOT ID databases) have been standard for decades find our objection to this one hard to parse: and indeed it is hard to claim , if you look at the empirical reality, that we are a freer society than, say, Belgium or Germany because they have ID cards and we don't.

4. Most of all, the principled issues are about the consequences of a linked ID database, not an ID card: this point itself is obscured in most of the on line/extralegal discussions.

I'm not particularly for a national ID card/database. I'm not particularly against it either. I can see advantages: I'd quite like to live in a world where I was exposed to less degree of risk at airports, at large public events. I can see disadvantages: I also don't want to run the risk of discovering Sony, or the DMA, or my ex boyfriend, or my employer, can find out everything there is to know about me. (But I have a feeling we pretty much live in that world already with or without an ID card.)

My own feeling is that we already have a system as good as we can devise of laws and practices for dealing with consent to the collection of, and subsequent protection of, personal data. It's called data protection law. I've critiqued the PRACTICE of DP law extensively myself but almost no one disagrees that the principles are sound. The problem currently is that there is a generic "get out of jail free" clause in DP law, in relation to personal data collected for the purposes of investigation of crime or security, as well as some other public sector functions. We need to consider how data protection could, albeit in part, and with more safeguards, be applied not wholy exempted in relation both to the police and security services, and to private sector parties exercising crime prevention roles (most CCTV cameras, eg, are operated by private actors, and they too benefit from this blanket fiat.)

The other problem is that DP law enforcement is wildly under resourced. One hypothetical argument about enforcement might be that in an ID database world, the state must finance the Information Comissioner as fully as it finances the police. (yeh right :-)

But most of all I'd like to see a debate on ID cards that isn't focused around "it'll never work" or "it'll cost too much" or "they can't make me do this" or "we all know it's a bunch of lies". That isn't a debate. That's a lynching. I'd like to see a debate that focuses round the real issues: how do we want to balance our needs for privacy and our needs for security? How, if at all, do we want to balance our privacy rights and the positive uses that can be made of a linked database, for both citizens and consumers? What are the safeguards that need to be built in, which once specified we can then pass to the database builders? And most of all what kind of privacy do most people really want - not the activists, not the No2ID card people, not the constitutional law academics, but everyone?

(Thanks for ideas included herein from my fellow panellists Dave Clements, Andrew Adams and Mike Scott.)

Not computer viruses this time ..!

My colleague Michael Bromby passes me an evocative example of why anonymity on the Internet is still sometimes a Really Good Idea.

Anonymous notification of STDs (with cool graphics, no less!)

Authentication algorithms, and more Oysters for Easter

Tired, like me, of deciphering skewed letters and numbers in order to persuade a site that you're not a spambot?

This new authentication system is based on recognition of fluffy animals - specifically picking 3 kittens out of a 3 X 3 block of cute animals. It's fun and it definitely picks out the human beings.. I don't THINK it's a late April fool and it somehow seems very appropriate for easter (though maybe that should have been bunnies..?)

Blogscript has been to another, non-law, conference which shall Not Be Named, where, as usual, she nonetheless spent a good part of her time talking about IT law, and participated in a rather good panel discussion about ID cards and ubiquitous surveillance. I discovered that in re the Oyster card discussion of a few weeks back, although not much publicised, you can apparently buy "anonymous" Oyster cards ie ones without identifying information either stored on, or accessible via, the card, for particular cash values. Furthermore, unlike normal travel tickets, these are officially freely transferable. This seems to overcome the traceability problem, rather as pay as you go phones do: but it raises a new legal issue - since these prepaid transferable Oyster cards are essentially stored value digital cash, are London Transport an electronic money issuer and subject to the regulations of the Electronic Money Directive? Answer - I think not, because those rules only apply to electronic money issuers where the stored value is accepted by multiple outlets (hence store loyalty cards are also excluded.) But if as reported a while back, London Transport do intend the Oyster cards to be picked up by private enterprise as a means of paying for low value items like sweets, papers or coffees, that might change..

For those who want to seriously confuse any potential investigators of Oyster card electronic tracks, eg anti terrorist squads, private detectives, it was also suggested that season ticket users could meet up and swap cards two or three times a day.. although one feels this might interfere with the average commuter's actual working day.. Interesting stuff!

The IT Crowd Goes to Westminster

Am off again for the Easter weekend. But not before quoting this delightful exchange from a recent debate in Parliament on the new law (yes that one again!) making it (or intending to make it) illegal to design, use and sell hacking and DDOS tool kits.

"The hon. Member for Hornsey and Wood Green (Lynne Featherstone) was right to raise the issue that hacking tools are often used by computer technicians to rectify problems. I have been very stressed since Monday morning, when I switched on my desktop computer in Norman Shaw, North only to get an error message and find that I could not access my programmes, my e-mail or anything else. Fortunately, I have another computer. I phoned extension 2001 and eventually managed to speak to an intelligent life form, although it took a little while, as we know happens with extension 2001.

The Chairman: Order. The hon. Gentleman’s travails are deeply fascinating to the Committee, but we have to get back to the amendment under consideration.

Michael Fabricant: As ever, I accept your guidance, Mr. Conway. Mr. Graham Lugton, who I suspect is in my room this very moment, might be using that [diagnostic tool] software.

Stephen Pound (Ealing, North) (Lab): Wiping your history, I hope."

See http://www.publications.parliament.uk/pa/cm200506/cmstand/d/st060328/am/60328s03.htm .

Booby Job of the Week

This appeared shyly on an on line recruitment list I (used to) subscribe to..

Vacancy Title: Chief Executive

Location(s): London

Reference:
Department: Home Office
Salary: Not specified

Brief description: The National Identity Scheme is being delivered through a new Executive Agency (IPS) formed from the UK Passport Service and the Identity Cards Programme. IPS will work closely with other parts of the Government and private sector organisations to deliver the wide-ranging benefits expected of the scheme.

Working Arrangement(s): Full Time
Closing Date: 8 May 2006
More Information: http://www.careers.civilservice.gov.uk/index.asptxtOverRideDocID=19945


Any volunteers?-)

Gadding About for Fun and Profit, oops, non-profit..

Having not yet opened my suitcase from last (highly stimulating and not at all sunny:-) jaunt to Malta, I have to admit that this conference upcoming in June is very tempting. And not only because it's being held in Rio:-)

"The aim of iCommons reaches far beyond the infrastructure that CC is building. The aim of the iSummit is to bring together a wide range of people in addition the CC crowd - including Wikipedians, Free Software sorts, the Free Culture kids, A2K heroes, Open Access advocates, and others -- to "to inspire and learn from one another and establish closer working relationships around a set of incubator projects." iCommons has a separate board from Creative Commons -- Joi Ito is its chair -- and its ultimate mission (in addition to this annual moveable feast of commons conversation) will be determined by the conversation that will continue in Rio." See further Lessig blog.

Having just come from the launch of Creative Commons Malta with that self same Lessig in attendance(at, uh, that conference mentioned in the previous item with the name that sounds like a skin disease), I was becoming a mite cynical about how much I actually still had to learn about CC and its international progeny. It's a lovely idea for a religion (as Ron Hubbard is once said to have declared in another context), but as far as actual law goes, it's just software licenses after all - would it go down as well with the great washed open source yoof if it was called Just Another Type of Licensing, rather than the much groovier Creative Commons? (I may yet write my paper on this for GikII, Martina...!)

But the move towards collaborative creation of, and open access to, knowledge in general - and the future of wikis and Wikipedia in particular - is something that I think is becoming of crucuial importance in the development of the Web and the nurturing of knowledge - including legal knowledge. So maybe I'll go after all.

And IT law conferences are like buses - no good ones for ages then three come along in one month. Having already decided I really don't have time for the The First International Conference on Legal, Security and Privacy Issues in IT, April 30- May 3, 2006, Hamburg, Germany, I now get an invite (at BILETA - no website I can find yet) to the even more enticing LEFIS Monitoring and Supervision Workshop in Rotterdam in - guess when - June!

Good thing my union is on strike so with any luck we won't be marking any poxy exams in June, huh?

**EDIT: In the interests of fairness and open access!, I should add details of yet another victim (for me) of the June pile up, namely IT and the Legal Learning Space,
The 9th bi-annual conference on Substantive Technology in the Law School, Oslo Thursday 29, Friday 30 June and Saturday 1 July 2006. In the past this conference (colloquially known as Subtech ) has been one of the higlights of the acdemic year, and this year it is to be run by the Oslo people and that colossus of the field , Jon Bing - I hate to face the reality that this year, I just can't prioritise over at least 2 of the 3 others listed above..

And it doesn't end there. July 10th-11th 2006 sees another goody, the Unlocking IP conference in UNSW, Sydney, Australia, courtesy of the ever energetic Graham Greenleaf and his team at AustLII. It's going to be a long hot summer for (well funded and time-rich) open source/creative commons mavens: if they don't change the world they should at least come home with a tan and knowing how to (a) light a barbie and (b)salsa..

Wikipedia vs Linux

Fascinating comparison of the numbers of users and active contributors to Linux and Wikipedia.

"Wikipedia can draw on half a billion potential contributors; only about 100,000 people can code Linux.

It's hard to overstate this difference."


So, yes, I'm back from BILETA in Malta (the annual reunion of the UK and increasingly, European/Asian IT Law, Internet law, and legal technology in education tribes.) Saw lots of interesting papers, some of which may even be written up when I've regained the energy, after twelve hours travelling on two hours sleep, to open my bag and find my conference abstract programme.

After last year's deluge of P2P and FOSS papers, this year, much talk of eBay, Flickr, Wikipedia, Jurispedia and Wikis as the new legal textbooks - looks like C2C and collaborative peer production models have hit the legal hive mind..

The DOS wars: Blogscript strikes back

Blogscript sadly fell beneath the waves of overwork at rather the wrong time to make a dent in the amendment process to the Police and Justice Bill revisions of the CMA 1990. Well, inspired by general waves of self congratulation from everyone form the APIG to the BCS, I feel inclined to remark in curmudgeonly way that I'm still not at all happy that the CMA amendments will do anything to water-tightly criminalise DOS in the UK. See my previous blog post at http://blogscript.blogspot.com/2006/01/denial-of-service-i-told-you-so-part.html .

If the latest version of the PJB is as at http://www.publications.parliament.uk/pa/cm200506/cmbills/119/06119.27-33.html, which I *think* it is, then it seems the amendments made have changed nothing useful (in cl 34 - cl 35 has been improved).

The crucial point is that in cl 34 it now reads:(I paraphrase)

S 3(1)CMA90 is amended to say

"A person is guilty of an offence if—
(a) he does any unauthorised act in relation to a computer;
AND (emphasis added)
(b) at the time when he does the act he has the requisite intent and
the requisite knowledge."

It doesn't help to define the intent required by s 3(1)(b) to include intent to impair* if s 3(1)(a) can't be established. You need both pre conditions for a conviction. And as things stand, post last year's DOS acquittal, someone who sends ordinary email or page requests etc to an open website is still not "unauthorised".

What is needed is to re-define or clarify "unauthorised". One easy way might be something like "The owner or operator of a website or server is rebuttably presumed not to give authorisation to the sending of data or traffic to that site where it is sent for the primary purpose of [insert the terms from s 3(2)]*".

I can't see any attempt to clarify "unauthorised" in the PJB. Worse still, we stil have s 3(4) declaring that "For the purposes of subsection (1)(b) above the requisite knowledge is knowledge that the act in question is unauthorised".
I sincerely hope I've missed something. Pah. Why do we expect MPs to draft legislation? We don't expect them to perform heart surgery or build bridges. Why is drafting law, a difficult and skilled task, treated as amateur hour?

* s 3(2) CMA 1990: " (a)to impair the operation of any computer,
(b) to prevent or hinder access to any program or data held in any
computer, or
(c) to impair the operation of any such program or the reliability of any such data,
whether permanently or temporarily."