back to article UK.gov delays biometrics strategy again – but cops will still use the tech

The Home Office has admitted the UK’s biometrics strategy won't be published until next year, as MPs slam an "unacceptable" delay of more than five years. The Home Office has repeatedly put off publishing the strategy it promised in 2012, and has come under fire from MPs, policymakers, civil rights groups, the biometrics …

  1. John H Woods Silver badge

    Simple solution:

    Don't use the tech until the framework is in place?

    1. Chrissy

      Re: Simple solution:

      Good luck with that....

      ANPR's been in operation since 2006.... still no legislation covering it 11 years later.

      1. TRT Silver badge

        Re: Simple solution:

        Is ANPR biometrics then? Unless the acronym refers to something other than Automatic Number-Plate Recognition.

        Arse, Nose and Posture Recognition?

        1. BebopWeBop
          Facepalm

          Re: Simple solution:

          I don't believe the poster was claiming any such thing. Merely that ANPR as a digital technology that relies, in this case, on image recognition, was a good example has been rolled out and the powers that be have allowed the plod to carry on without oversight of any value.

          If you seek to wilfully misinterpret - or are just dumb, then that is your problem.

        2. Chrissy

          Re: Simple solution:

          No.... have you not heard of the concept of "analogy"?

          I'll explain it to you:

          It's an example of ANOTHER technology that, in a similar way to biometrics, was crept in now being actively and heavily used in policing and by private companies who's use has not - deilberately, AFAICT - been discussed in Parliament, nor specifically legislated for, unless you count the chocolate fireguard that is the "Protection of Freedoms Act 2012" Part 2 Ch 1:

          "

          The Secretary of State must prepare a code of practice containing guidance about surveillance camera systems.

          "

          That code of practice was done:

          https://ico.org.uk/media/for-organisations/documents/1542/cctv-code-of-practice.pdf

          .... but missed the point that no-one was ever specifically asked, nor a vote taken on, "Do you want practically every - innocent - movement of EVERY motor vehicle tracked in order to catch a small number of criminals?"; It was just installed without any discussion.

          And that code is largely pointless....

          Quote:

          "Given the significant amounts of information that ANPR systems are able to collect, it is important that individuals are informed that their personal data is being processed. The best way to do this is through signage explaining that ANPR recording is taking place and, if possible to do so, the name of the data controller collecting the information"

          ANPR cameras are ringed around every town in the UK.... have you ever seen signs on any road inbound to a town telling you that you are being recorded by ANPR and who the local Force's DC is???

          1. TRT Silver badge

            Re: Simple solution:

            I see what you were saying there. It's such the normal case that I didn't immediately recognise why you had picked on that. The state does what it will and with little accountability.

          2. Anonymous Coward
            Anonymous Coward

            Re: Simple solution:

            The original ring of cameras around my town are ostensibly operated by the District Council for "public safety" according to the mould covered plates 7 foot up the pole. Latterly they have been supplemented by the "traffic control" cameras of the County Council. Either way, the data collectors advertised on the poles passes the full images on to CountyPlod in real time, in just the same way that MetroPlod gets congestion charge camera images in real time.

      2. John Smith 19 Gold badge
        Gimp

        "ANPR's been in operation since 2006.... still no legislation covering it 11 years later."

        Funny how that works, is it not?

        That'll be an "Operational decision" of the individual police forces no doubt.

        Does anyone else smell a delaying tactic while some particular system is being rolled out in secret, so the cabal of data fetishists that seems to infest the HO can say "Sorry but the money's been spent and the system's already rolled out"

  2. James 51
    Big Brother

    Classic civil service tactics, kick it into the long grass and when people get fed up searching for it and turn around they find out it's too late and organisations are doing what ever they want and the law will be created/changed to suit them.

    1. Anonymous Coward
      Anonymous Coward

      Sorry to Godwin this post ... ...

      At least Hitler had the honesty to pass a law saying that anything the Gestapo chose to do was lawful regardless of what it was. Perhaps the Home Secretary should face up to the need to pass a similar law in this country.

  3. adam payne

    Lamb said that the committee was now pushing the Home Office to find out exactly what the government meant by “next year” and why there had been such severe delays.

    The governments 'next year' statement is the same as every parents 'we'll see' statement.

    1. Anonymous Coward
      Anonymous Coward

      parents 'we'll see' statement.

      I prefer the ubiquitous "should" (never mind the parents) which translates nicely into: "I don't have a f... clue, and I don't f... care".

  4. m-k

    until next year

    given the brexit (and the hiccups around it), make it five. Not that it matters for the plod, eh?

  5. smudge
    Holmes

    Does it exist?

    Williams said that “a great deal of work” had been done, while attempting to justify the delay by saying that the strategy had a wide scope and covered a rapidly advancing field.

    "...and it's being written by the same team that have been doing the Brexit impact assessments."

    1. Milton

      Re: Does it exist? (When is a lie not a lie?)

      "...and it's being written by the same team that have been doing the Brexit impact assessments."

      Heh.

      • Imagine any institution, other than government, in which a senior executive, attempting to justify a controversial policy, repeatedly claims that a large body of exhaustive analytical work has been completed, to inform decision-making.

      • Imagine that said executive is shown to have fabricated the purported work and has no plausible reason to have serially spoken these untruths to multiple people on multiple occasions and in public.

      • Imagine that when the lies are exposed, he claims forgetfulness and makes statements like "an analysis of impact isn't the same thing as an impact analysis".

      Imagine that this person is not disgraced, summarily dismissed and hounded out of the industry.

      Only in government—and perhaps, among the democracies, only in a British or US government, at that—could a serial liar, spectacular fool and monumental incompetent like David Davis not have been shamed and kicked out. People like him disgrace government—but those who make excuses for people like him, and allow them to continue polluting the institution, are arguably even worse. They leave a stain on everything they touch.

  6. D Moss Esq

    No strategy is good strategy

    The House of Commons Science and Technology Committee reported on biometrics in March 2015. The police told the Committee that face recognition doesn't work and that no UK force uses it.

    The police have tested the technology at the last two Notting Hill Carnivals. That is not the same as using it.

    I hope that Norman Lamb understands that.

    The lack of a strategy is a tacit acknowledgement of the fact that the technology doesn't work. That's good news. It might stop the Home Office and others wasting any more of our money on it.

    Presumably Mr Lamb doesn't want an astrology strategy specifying the legal and ethical controls on horoscopes. No more should he want a biometrics strategy.

    1. veti Silver badge

      Re: No strategy is good strategy

      If I thought there was any possibility that the police might choose to investigate or even detain me on the basis of my horoscope, then yes, I damn' well would want there to be some written policies around the subject.

      'Testing' is all well and good. But when you are using the technology in an environment where it may be affecting real people's lives, you've gone beyond 'testing' into the domain of 'field trials', and at that point you need some kind of strategy in place.

  7. Nigel Sedgwick

    Biometrics and ANPR Differ; Government Prevaricates Unnecessarily

    The analogy between biometrics and ANPR is a poor one, both in terms of the technology and in terms of the law.

    Any two (different) car number plates are different. For the UK's current system (for new vehicles), there are (less than) around 1.19 billion possible number plates. There are less than approximately 5% of this number of registered vehicles in total, using the current and all previous numbering systems. Any two (different) people are not necessarily different (in practice) with any single chosen biometric system.

    Number plates have zero domain overlap, because every 'number' on a number plate is different (if it is not exactly the same). Errors in recognition arise because of transmission noise (eg dirt, damage, poor illumination, speed) added to the transmission - between conceptually pure 'number' and the ANPR system.

    Biometrics do not differ in the same way as number plates. No two measurements of a single person's particular type of biometric are (at all likely to be) the same. There is both domain overlap and transmission noise. So even if all transmission noise were suppressed (say by clever image processing techniques), the domain overlap would remain. We know for example that identical twins are identical for DNA, and can and often do look extremely closely similar for facial recognition; this though there are two different people. [Note aside: though iris scans and fingerprints (in most ways but not all) vary largely randomly, between identical twins as much as between members of the general population.] There are many pairs of unrelated people who have (in measurements with practical accuracy) effectively the same fingerprints and (nearly all different pairs of people) who have (again in measurements with practical accuracy) the same iris scans.

    It is this domain overlap that means that no single biometric will ever give certain identification for every possible person. Even multi-biometric fusion (ie use of multiple biometrics like finger prints together with iris scans), though performing much better than each of the single contributing biometrics, will fail from time to time within very large populations of people.

    The differences in law are really that ANPR only automates vehicle recognition that could be done manually, thought in a way that makes results available much faster. Use of biometrics actually gives (in some very useful ways) identification of people in ways that cannot be replicated by manual methods - both iris recognition and separately fingerprints actually give more reliable recognition in practice than manual methods of identifying people. Even so, biometrics are not foolproof.

    The problem of domain overlap of biometrics is one of those presenting some difficulties in law. There are also difficulties with forgeries (such as gummy fingerprint overlays, contact lenses with false iris patters). There are also difficulties with organised criminal gangs selecting impersonators from available gang members (infiltrator selection) whose biometrics are an adequate pairwise match for identified desirable targets.

    Back to the politics, government delay in issuing a biometric strategy is really pointless. Many of the issues have been known for years (see for example my 2005 presentation). Furthermore the issues of changing technology will continue at similar to the current rate. Biometric protection and biometric circumlocution are an ongoing battle - no more and no less than forgery of bank notes and new protective measures.

    Best regards

    1. D Moss Esq

      Re: Biometrics and ANPR Differ; Government Prevaricates Unnecessarily

      On average, Nigel, we "meet" once per decade and a pleasure it always is.

      Has anyone ever calculated BGI (slide #24) or LRGI (slide #25) for the UK for any biometric mode or mode(s)? Were the ratios even greater than 1? Did they make the use of biometrics economic under any realistic assumed scenario?

      Equal error rate is always around 17% in your presentations (slide ##11, 26, 27). Politicians, officials, journalists and normal people all imagine that EER is or should by now be microscopic – 17% is an elephant where we expect a virus. Do you agree that biometrics has failed grossly to live up to expectations? And that it is our job to make everyone realise that?

      Messrs Possolo, Wayman and Mansfield argue that biometrics is not under statistical control and therefore not a science. Do you agree? If not, where is their mistake?

    2. Johndoe132

      Re: Biometrics and ANPR Differ; Government Prevaricates Unnecessarily

      I have fairly limited knowledge and experience on this topic, but Nigel here is clearly a bit of an expert. Where else on the interwebs, let alone in a reader's comments section of a 'red top' could you encounter such insight? El Reg and all the commentards who sail forth, I salute you!

      Merry Christmas one and all.

      P.S. Perhaps the alcohol doesn't evaporate off the gluvine after all.......

      P.P.S. is anyone else noticing slow page loads on FireFox 57 on Linux?

  8. ade328

    Given all that I understand about Biometrics I would applaud this stance as Biometrics are inherently not secure – time will tell! Oh, but my mistake, there is no stance here - it is a delay in jumping off the fence! So either the UK government does not know or (cynical me) it is mindful of upsetting the potential tax revenue from the impending Biometric frenzy.

    That opening paragraph was any easy shot ;-)

    The fundamental flaw with Biometrics is that we all have only *one profile! Finger print, Retina Scan, DNA or other… Once a Biometric profile is out, it’s gone forever as an authentication factor. Unique but not Secret! Which means Biometrics can be used for identification not authentication!

    Biometrics can be used as a secondary factor for Authentication but never ‘the’ factor.

    Ade

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon