This week the Daily Mail reported that the biometric residence visa card
that the Home Office brands as the "ID card for foreigners" could be
cloned in 12 minutes using a standard mobile phone, a laptop, and some
freely available software.
http://www.dailymail.co.uk/news/article-1204641/New-ID-cards-supposed-unforgeable--took-expert-12-minutes-clone-programme-false-data.html
The experts were then able to alter the data on the cloned card (the
original being unharmed and unaltered in any way) - and re-sign it to
appear genuine to a standard card reader. Our thanks to the NO2ID
volunteer (who must stay anonymous) whose residence card was used for
this demonstration.
The Home Office response to this was a classic of misdirection: They
denied something that hadn't happened (altering the original card) was
possible; then they tried to imply that if anything had happened it
couldn't do so in the future because the encryption on the next
generation of chips - none of which will be issued for a couple of years
- can't be broken that way. The ID cards to be issued to volunteers in
Manchester within the year (it is said) fall somewhere in the gap
between those denials.
The truth is, just as with e-Passports, that there is a fundamental
conflict between the official convenience of having databases and
smartcards that collate and share our personal information
automatically, and the privacy and the security of the individual. The
system is designed to give personal information to the authorities. So
when it does so to other people, whoever they may be, it is only doing
what it was designed for.
The demand that people identify themselves officially at every turn
doesn't just create insecurity. It is actually a sign of insecurity.
Unless the Home Office can know what we are up to, it fears we may be
out of control. Your privacy and your individual security do not count
in the pursuit of that sort of "security".
that the Home Office brands as the "ID card for foreigners" could be
cloned in 12 minutes using a standard mobile phone, a laptop, and some
freely available software.
http://www.dailymail.co.uk/news/article-1204641/New-ID-cards-supposed-unforgeable--took-expert-12-minutes-clone-programme-false-data.html
The experts were then able to alter the data on the cloned card (the
original being unharmed and unaltered in any way) - and re-sign it to
appear genuine to a standard card reader. Our thanks to the NO2ID
volunteer (who must stay anonymous) whose residence card was used for
this demonstration.
The Home Office response to this was a classic of misdirection: They
denied something that hadn't happened (altering the original card) was
possible; then they tried to imply that if anything had happened it
couldn't do so in the future because the encryption on the next
generation of chips - none of which will be issued for a couple of years
- can't be broken that way. The ID cards to be issued to volunteers in
Manchester within the year (it is said) fall somewhere in the gap
between those denials.
The truth is, just as with e-Passports, that there is a fundamental
conflict between the official convenience of having databases and
smartcards that collate and share our personal information
automatically, and the privacy and the security of the individual. The
system is designed to give personal information to the authorities. So
when it does so to other people, whoever they may be, it is only doing
what it was designed for.
The demand that people identify themselves officially at every turn
doesn't just create insecurity. It is actually a sign of insecurity.
Unless the Home Office can know what we are up to, it fears we may be
out of control. Your privacy and your individual security do not count
in the pursuit of that sort of "security".
When some cards *have* been issued we will be eager to repeat the
demonstration for anyone who believes in the scheme and who has
volunteered for an ID Card. They are the people who need to appreciate
what handing control of their identity to the Home Office means for them
personally, because for them there will be no way back but scrapping the
scheme completely.
From NO2ID Newsletter No.129
demonstration for anyone who believes in the scheme and who has
volunteered for an ID Card. They are the people who need to appreciate
what handing control of their identity to the Home Office means for them
personally, because for them there will be no way back but scrapping the
scheme completely.
From NO2ID Newsletter No.129
No comments:
Post a Comment