Strategic Action Plan for the National Identity Scheme Safeguarding your identity

Foreword by the Minister of State for Nationality, Citizenship and Immigration; the Under-Secretary of State for Nationality, Citizenship and Immigration; and the CEO of the Identity and Passport Service

• help secure our borders and tackle illegal immigration: effective identity management will mean that only those entitled can live and work in the UK;

• prevent identity fraud: the use of false identity currently costs the UK more than £1.7 billion a year. The Scheme will make it much more difficult for such fraud to occur;

• become a key defence in the fight against crime and terrorism: the use of false identities plays an increasing part in illegal activity, with sometimes devastating and costly results;

• enhance checks as part of safeguarding for the vulnerable: the Scheme will introduce a high level of efficiency in authentication of identity, and this will significantly support checks on people working with children and the most vulnerable; and

• improve customer service: the Scheme will make it possible to join up and personalise services across government departments, and the wider public sector, by ensuring that we have a consistent means of identifying those receiving services.

• ensure that the Scheme delivers best return on investment. Not only are the benefits we have listed above economically tangible, but it is also important to realise that much of the cost of what we are doing would be incurred regardless of the Scheme. Specifically, biometric passports will soon be required in almost all of the largest passport-issuing countries. Around 70 per cent of the cost of the combined passport and ID card will be required to keep our passports up to international standards;

• take an incremental and pragmatic approach. We will keep risks and costs down, by using existing Government investment and delivering incrementally, based on extensive piloting and trialling;

• provide key safeguards that protect the privacy of the individual and ensure the integrity of the Scheme. These exist at every level from the legislative framework that underpins the Scheme and the independent Scheme Commissioner who will oversee it, to the security of the systems that hold your information and, crucially, your right to see your information and, if necessary, correct it; and
  • deliver a positive customer experience during the implementation and operation of the Scheme. The Identity and Passport Service, the government agency responsible for the Scheme, has a customer service reputation that is literally second to none. We will ensure that those standards are maintained, as we introduce the key changes described in this document.

Executive summary

• First, in Chapter 1, we describe the scope of the National Identity Scheme, its principal functions and how it will deliver services to customers.

• Chapter 2 expands on this description of the Scheme and sets out in more detail how we plan to create the National Identity Register (NIR), partly by using technology that already exists in government. It sets out what we will do for people applying to and enrolling in the Scheme, what identity checking services we will make available, and how these building blocks of the Scheme will evolve from what we have today and how they will fit together.

• Chapter 3 explains how we plan to make the Scheme secure and how we will ensure that information held by the Scheme is only seen or modified by those authorised to do so. Whereas Chapter 2 answers the `what?' question, Chapter 4 answers the `when?' question. Starting from our existing work on passports and the identity checking services available today, it sets out the evolutionary changes which will build up through the introduction of biometric visas and other documents for foreign nationals, enhancements to the passport, ID cards for British citizens, identity checking services based on these, and so on.

• Chapter 5 sets out how the Scheme will be managed, explaining in particular that we will introduce a framework of regulations under the Identity Cards Act 2006 for the operation of the Scheme and that we will appoint a Scheme Commissioner to oversee the Scheme.

• Chapter 6 looks to the future, setting out how we will proceed towards procurement and what our key short-term activities are.

The National Identity Scheme

• • To apply, you will need to provide biographical information covering basic personal details (e.g. name, address, date of birth). When you enrol, biometric information (e.g. facial image, fingerprints) will be recorded. This will allow your identity to be checked by confirming what you tell us. This is to prevent people attempting to defraud the system.

• • For British nationals, biographical and biometric information will be given at a local office. For foreign nationals, this will be done through existing immigration processes, enhanced as necessary.

• • Each person will need to re-enrol once every 10 years, in much the same way as passports are currently renewed every 10 years.

• • There will be a combined application and enrolment process for passports and ID cards for British citizens.

• • A range of options will be available if you want to register a change of details, such as a contact centre or using the Internet.

• Storing your identity data: the National Identity Register (NIR) is where your personal identity details will be securely recorded and maintained. It will have links with other Government systems to share identity data, and will support identity checking services.

• Issuing your card: the creation and delivery of your card and passport and documents for foreign nationals.

• Checking your identity: you will be able to use the Scheme to prove your identity.

• • When you want to prove your identity to an accredited organisation, for example to open a bank account, they will, with your consent, be able to use the Scheme's identity checking services.

• • Different levels of checking will apply, depending on the service you want to access. For example, a financial institution may ask for proof of identity before completing certain transactions and will wish to check the validity of the ID card when you present it.

• • Some of the identity checking services will only be made available to accredited organisations, authorised by the Identity and Passport Service.

• Securing the Scheme: there are integral functions that will oversee and manage the Scheme, to provide safeguards and make sure the Scheme is properly run and is supported by the proper legislation and regulations.

• • The Home Secretary is ultimately responsible to Parliament for the running of the Scheme.

• • The independent Scheme Commissioner will continually review the operation of the Scheme and report to Parliament.

• • The security, assurance and integrity functions will act to drive out fraud, protect your identity information and protect the integrity of the Scheme.

• • Regular reports will be provided to Parliament on the progress of the Scheme and its cost.

• • The Information Commissioner has key powers to protect personal information, including information held in the NIR.

Application and enrolment, customer services and document production

Application and enrolment

Customer services

Production and delivery

The National Identity Register (NIR)

• for NIR biometric information, we will initially use existing biometric systems used for asylum seekers and biometric visas to meet our short-term needs, moving to new biometric services when the NIR is fully operational;

• for NIR biographical information, we plan to use DWP's Customer Information System (CIS) technology, subject to the successful completion of technical feasibility work. DWP's CIS technology is already used to hold records for everyone who has a National Insurance Number i.e. nearly everyone in the UK. However, even though the CIS already contains personal details for most adults in the UK, these entries will not simply be copied to the NIR. The details of any individual entered in the NIR will be recorded when they apply and verified to the highest possible standard before being recorded in the NIR; and

• for NIR information related to the secure issue and use of ID cards, passports, etc. (technically called `Public Key Infrastructure' (PKI) information), we will build on the existing IPS systems. These are used today to issue the six million ePassports each year.

Identity checking services

Key services

• visual check: the person you present your card to might check whether the photograph on the front of the card is your photograph;

• card authentication: the person you present your card to will be able to check, using information held on the chip on the card, whether it is a genuine, unaltered card;

• PIN check: if they require a higher level of proof, they might ask you to enter a Personal Identification Number (PIN) that only you should know;

• verification online or over the telephone: if you want to prove your identity to someone on the telephone or over the Internet, you will be able to do this by supplying your card details and possibly some `shared secret' information, like banking services use today. Higher levels of security will be possible by using the chip on the card to generate a temporary password. Small hand-held devices to support this are cheaply available. Using one of these, the chip can provide a temporary code which confirms that your card is the one being used and that you have entered your PIN correctly; and

• biometric check: if they require a still higher level of proof, they might ask you to present a fingerprint to be checked against those which you gave when you enrolled for the card. Identification: finding out, by searching for your details in the NIR, who you are. This might be used if you do not have your card with you.

• Information provision: this is the ability to make data from the NIR available to other parts of government, to make sure that all parts of government are using the most up-to-date identity information about you, for example to make it much simpler when you change your name or address.

Securing the National Identity Scheme

Creating each person's NIR record from new, based on rigorous checking

Effective checking when a person reports a change to their details or wants to look at their record

Holding each person's NIR record in separate, discrete parts

• biometric details will be held on the biometric system;

• a biographical part of the entry will be held on the Customer Information System (CIS) technology; and

• Public Key Infrastructure (PKI) related information will be held on the PKI technology already being used for issuing ePassports.

Enforcing a clear separation

Making sure only authorised people and organisations can use NIR information

Accrediting the NIR Overseeing the wider Scheme

Making sure the NIR's operation is secure

Supporting the use of biometrics

Counter-fraud, intelligence and enforcement

Chapter 4: Delivering the National Identity Scheme

Enhancing customer experience

• 2001: we introduced extended opening hours, so that all offices are now open at weekends and in the early evening following the introduction of appointment-based counter services.

• 2001: we introduced guaranteed service levels, with fast-track and premier services.

• 2003: we introduced integrated call handling, improving the ability of the contact centre to resolve queries about the progress of passport applications without needing to transfer calls to passport offices.

Increased passport integrity

• 2002: we introduced information updates from the Office for National Statistics and others on infant deaths to detect passport application fraud.

• 2002: we set up the personal identity process pilot project, collaborating with a credit reference agency to validate the personal information provided on passport application forms.

• 2003: we established a new system to manage lost, stolen and recovered passports.

• 2004: we introduced secure courier delivery for passports.

• 2006: the full operational implementation of the personal identity process took place.

• 2006: proof-of-concept trials took place of facial recognition to detect fraudulent applications.

• 2006: ePassports were rolled out nationally. These are the first `biometric' passports: they contain a chip with key personal details and the photograph of the bearer (as already printed in the passport) stored on it. They cannot be changed, but can be read electronically at borders both here and abroad. By the end of 2006, we will have issued four million ePassports.

Introduction of identity checking services

• 2002: we provided a Passport Validation Service to the Foreign and Commonwealth Office.

• 2005: we provided a Passport Validation Service to the Driver and Vehicle Licensing Agency (to validate driving licence applications), IND (for border control purposes) and other government departments (for relevant business purposes).

• 2006: we provided a Passport Validation Service to financial institutions.

Improving passport security and strengthening passport checks

Biometrics required for visa applications

• 2008: by April 2008 we will be recording biometrics for everyone from the 169 nationalities outside the EEA applying to work, study or stay in the UK for more than six months, and for people from 108 nationalities applying to visit the UK. Evolution of the Scheme's identity checking services

• 2007: we will enhance the Passport Validation Service and continue its expansion.

• 2007 onwards: we will design and prototype new and expanded identity checking services through joint ventures with other parts of government and the private sector. In parallel, we will work with the private sector to develop innovative identity checking services for use across the UK.

Biometrics introduced for non-EEA foreign nationals already in the UK

Identity cards

• 2009: we will issue the first ID cards for British citizens, using the improved application and enrolment systems. We will build on our experience of biometrics for visas and other documents for foreign nationals, and will use our learning from the piloting of identity checking services.

• 2010: we will issue significant volumes of ID cards alongside British passports.

2009 and beyond