1. Scrap the ID card scheme, the National Identity register, the next generation of biometric passports and the ContactPoint Database.
2. Outlaw the finger-printing of children at school without parental permission.
3. Extend the scope of the Freedom of Information Act to provide greater transparency.
4. Adopt the Scottish approach to stopping retention of innocent people’s DNA on the DNA database.
5. Defend trial by jury.
6. Restore rights to non-violent protest.
7. A review of libel laws to protect freedom of speech.
8. Safeguards against the misuse of anti-terrorism legislation.
9. Further regulation of CCTV.
10. Ending of storage of internet and email records without good reason.
11. A new mechanism to prevent the proliferation of unnecessary new criminal offences.
12. End the detention of children for immigration purposes.

Oh my!

As a digital- and civil-rights campaigner this list fills my heart with joy. The successful passage of this Bill through Parliament would not end the need to champion human rights in the digital era* however it would be a famous victory for that cause: we could say with certainty that this election, that the ousting of Labour from Government, was the point at which the high-water mark of authoritarian social policy in Britain was reached.

Some fellow campaigners have today urged caution and are reserving judgement until the details of the Bill are published. I cannot fault them for their cynicism however I am filled with hope that today we have seen not only the dawn of a new politics in Britain, but a new era of liberty, freedom, privacy and respect for human rights in the UK.

I shall be raising my glass to the death of ID cards and the Database State tonight!

* Three omissions stand out: repeal clauses 11-18 of the Digital Economy Act; make the NHS Summary Care Record opt-in rather than opt-out; end the Vetting and Barring scheme, abolish the Independent Safeguarding Authority and reform CRB checks to make them fair. It’s possible that these will be included in the detail of the Bill.

British civil liberties have been dismantled systematically since 2001. The National Identity Register, biometric passports, the NHS spine, Contactpoint and the Vetting and Barring Scheme are just a few of the most egregious privacy invasions we have suffered.

Our every move is watched with suspicion by the authorities. ANPR systems record every journey we make. Video and audio Surveillance Systems (SS) watch us in every public space and many private ones too. Thousands of public bodies abuse their RIP Act powers to spy on us for trivial reasons. The police can stop us and search us arbitrarily, and they keep “pre-crime” databases on the innocent. Our private communications are monitored, analysed and recorded both by the Government and private companies.

Yet often MPs want one rule for us and another for them. The children of MPs can be “shielded” on ContactPoint to protect their privacy – but ours can’t. Very few MPs have an ID card even though ministers have been doing everything in their power to coerce the public into “volunteering” for them. Many MPs voted to exempt themselves from the Freedom of Information Act, to protect their “privacy”, whilst passing laws that erode ours.

When it comes to liberty in Britain today, all animals are equal, but some are more equal than others. This hypocrisy has to end and the systematic assault on our civil liberties must be reversed.

The Power2010 campaign is conducting a letter writing campaign asking Prospective Parliamentary Candidates to:

…commit that, if you are elected, you will vote to repeal the Identity Cards Act 2006 and will defend our privacy as fiercely as you would defend your own and that of your family.

The above reproduces what I sent to Sheffield Central PPCs. You can take part in the campaign here.

Colour me unsurprised.

The consultants who carried out this work are from the same community of experts who have been warning [pdf] that the cards would be cracked since the Home Office first disclosed the mechanics of the scheme.

The alterations can be detected with a check against the National Identity Register (assuming this hasn’t also been compromised) however each such look-up will cost around £2. The Government expects the majority of transactions will be authorised through local checks rather than referring back to the central database.

Once someone automates the attack and publishes their code on the Internet, anyone with half a brain, the right mobile phone and access to the world-wide web will be able to change their Government-issued identity at will. As the cards use RFID chips this could be done in seconds while on the move. You wouldn’t even have to remove your card from your wallet.

Disturbingly, your card could also be changed without your knowledge by someone standing close to you, or from dozens of feet away with the right sort of radio antenna hooked up to a portable computer. The process leaves no trace, so when your card is subsequently checked against the database and is found to have been modified, it will be impossible to determine when the changes were made or by whom.

Possessing a falsified ID card could land you with a fine and up to two years in gaol. Owning the equipment or software needed to make the changes could be enough to win you a decade-long stay at Her Majesty’s pleasure. [Identity Cards Act 2006 s25 and s29].

If it weren’t for these stiff penalties, I’d be tempted to suggest the ability to change the details on your own ID card is an unintended benefit of the scheme, not for the Government but for those who value their privacy.

The National Identity Register will store fifty different classes of information about you in a collection of linked databases. The Transformational Government project (also known as the Database State initiative) plans to share all of this information with any official who cares to look. This is the antithesis of the “least privilege” security principal: that people should be given access to just enough sensitive information to do their job, but no more. For example you may wish to tell your doctor about your medical history but not about your bank balance or speeding fines. The ID card scheme wrests from you control over your personal information and gives it to the state: it will not be possible for individuals to choose which “registrable facts” about them are made available to whom.

It would be possible to regain some of this control, however, if we were able to change at will the details stored on our own ID cards. Facts that we are not willing to share could be either falsified, replaced with nonsense or erased. A mobile phone “identity management” application could be written to store multiple personality profiles for your ID card. Using this, you could switch between personae as the need arises, perhaps even employing your phone’s in-built GPS chip to make sure the “Mr. Smith” profile is on the card when you’re at the Doctor’s surgery and the “Mr. Jones” profile is active when visiting your bank. Being able to compartmentalise your relationships with third parties in this way would be a very strong personal privacy measure.

Yep, that’s right, I have just suggested committing fraud to regain some control over your identity in the event that you are made subject to the ID cards scheme. It’s a damning indictment of the relationship between UK citizens and the state that we should have cause to consider this at all. It’s a more damning indictment of the Government’s competence and character that it chose to pursue this illiberal scheme despite strident warnings and opposition from just about everyone who knows anything about security and technology. “We told them so” brings cold comfort after so much money and freedom has been wasted.

As each nail in the coffin of the ID cards scheme is hammered home the true motivation of the Home Office in persuing such an abysmal farce becomes ever more clear. If the Government understood security and respected individual privacy they would allow each of us to choose how much personal information we want to reveal to others. Instead they are trying to assume control over our identity, to nationalise it in a register that is not only a gross violation of the right to a private life, but will also lock those who conform into a system of fines and a lifetime of administrative strife. All in the pursuit of the ultimate bureaucratic convenience.

The confirmation that ID cards are totally insecure is a mortal wound. If the Government doesn’t now scrap this benighted scheme then we must scrap this Government at the General Election.

UPDATED 10/8/09 14:00 to add:

The Home Office has apparently turned down repeated offers to demonstrate this breach by the researchers who discovered it. A spokesperson said that the story was rubbish. The Home Office has published details of the encryption technologies used by ID cards scheme.

I’m disappointed, but not surprised, that the Home Office thinks security is a product which, if sprinkled liberally over a system in a manner similar to magic pixie dust, will somehow make it impervious to attack. It’s no good having “elliptic-curve cryptography” and “root certificates with RSA 4096-bit strength keys” if the system allows these things to be tampered with or circumvented.

Props to the Home Office spin department though: releasing the geeky details has distracted at least some of the press from holding them to account on the principles of the scheme.

In recent days the Home Secretary has announced that airside workers at Manchester and City airports will no longer be compelled to enroll with the National Identity Register as a condition of their continued employment. This news has been presented as a pledge that Identity Cards will never be compulsory for UK subjects. The press seems to have forgotten that this has always been the Government’s position while Mr Johnson seems to have done one thing and announced another.

I understand the Home Secretary intends to “designate” under the Identity Cards Act a plethora of documents, licenses and permits required by people in their daily lives. Passports will be chief amongst these. Once designated, it will be impossible to apply for (or renew) such documents without also enrolling onto the National Identity Register.

So holding an ID card will remain voluntary, however enrollment on the National Identity Register will be made impossible to avoid, as the list of designated documents expands to include driving licenses; CRB checks; licenses to practice professions such as teaching, social-work, law and medicine. How about marriage certificates? Birth certificates? Death certificates?!

I would like to see the Home Secretary and the Identity and Passport Service held to account on this point. I believe the National Identity Register presents a clear threat to the freedom of UK subjects and to their right to a private life. I find it both sinister and cynical that the Government plans to present a series of Hobson’s choices to the country, forcing people to submit to registration in return for a continuation of rights and privileges they already enjoy, while claiming that our co-operation is voluntary. I find the suggestion that we will have a free choice in the matter objectionable in light of the facts as I understand them.

I would like to ask the Home Secretary whether he plans to make enrollment on the National Identity Register compulsory, or if his recent statements about the voluntary nature of ID cards mean he intents never to designate an official document. If the latter, will he commit to amending the Identity Cards Act to remove the power to designate documents, thus turning the scheme into a truly voluntary affair? If not, what percentage of the population does he expect to be forced to register as a result of the documents they find they can’t live without being designated?

I would be grateful if you could represent my views to the House during Monday’s debate on Identity Cards. Please can you also seek an answer to my questions from the Home Secretary.

Stop the Database State. Join NO2ID today.

Dear Sir

James Hall is wrong to claim ID cards will be voluntary (Letters, 10 June).

Sheffield residents won’t be forced onto the National Identity Register directly, unless they’re from outside the European Economic Area, however the Government intends to make it impossible for us to live without an ID card.

Compulsion will start with “critical workers” [PDF] in industries such as transport, energy and the emergency services. Next they plan to make registration a condition of applying for a passport. Students are a third group who will be targeted early.

Before long we’ll be unable to start a new job, open a bank account or make a high-value purchase without a check against the register, which may also tip off the tax man about our spending habits. The same will apply if we have to claim benefits. Nothing Mr. Hall says reassures me that we won’t be asked to surrender to the scheme before voting or seeking NHS treatment. Registration is for life and the penalties for non-compliance include £1000 fines and prison sentences.

The government presents ID cards as a Hobson’s choice: comply or they will withhold our access to public services and deprive us of our livelihoods. That doesn’t sound very voluntary to me.

I’m grateful that Sheffield City Council has stood up for freedom and our right to a private life by speaking out against this scheme. ID cards and the sinister database behind them should be scrapped.