The government here in the U.K. is planning to issue identity cards. This is a great idea, in principle, as if it is done properly it could end or at least significantly curtail identity theft. The problem is that if it’s done wrong, it will just be a pointless waste of time and money.

The BBC is currently running a story about how the ID card scheme is to be delayed, in which it says:

They have also come under fire from experts, including Professor John Salt, of University College, London, who has advised the government on migration trends. Asked by a House of Lords Committee on Tuesday if ID cards would help curb illegal immigration, Professor Salt said: "No, if they are capable of being forged - and that is probably likely to happen."

I think it’s a little mischievous of the BBC to use that quote like that; Professor Salt is a Geography professor, and since preventing forgery of these identity cards is a technology issue, it seems reasonable to question his expertise in suggesting that it is “probably likely to happen”.

Certainly I see no reason why it should not be possible to prevent forgery using smart card technology. You would ideally want a tamper-proof mask over the chip to prevent probing, and you would need a well-designed cryptographic system as well as careful software design for the card. But if those elements are in place, it shouldn’t be possible to forge or even copy a card, since the card wouldn’t provide any data except to a central government-run system, and even then it wouldn’t be possible to intercept the information given proper use of modern cryptography.

I don’t think forgery is the primary threat. On the contrary, I think the primary threats come from the mechanisms for (a) issuing cards in the first place, and (b) replacing cards that are lost or stolen. The issuing mechanism is an obvious point of attack, since people can present false documents in order to obtain a legitimate ID card. The replacement mechanism, likewise, requires some sort of identity check, which could potentially be defeated (that’s true even for things like iris scans, by the way).

Personally I’m broadly in favour of an identity card, and I think it probably will reduce the problem of identity theft, provided it’s relatively difficult to falsely obtain legitimate cards from the authorities themselves. The big question is how the government plans to solve that problem.