By Steve Ranger
Wednesday, December 20 2006 10:37 AM
URL: http://www.zdnetasia.com/news/security/0,39044215,61976558,00.htm

The U.K. government has trimmed back its controversial ID cards plans, ditching a single mega-database to hold all ID card information, and shelving the use of iris-scanning biometrics.

The National Identity Register (NIR) was to be the giant database at the heart of the project, holding personal identity information and biometric data for everyone enrolled in the scheme. But now three existing systems will share the NIR information instead.

The government's action plan for the ID cards project revealed: "These sets of information--biometric, biographical and administrative--do not all need to be held in a single system. In fact, for security reasons, and to make best use of the strengths of existing systems, it makes sense to store them separately."

James Hall, CEO of the Identity and Passport Service, told Silicon.com: "One of the key things we've been looking at is the use of existing government assets wherever useful. The Department for Work and Pensions has a very large Customer Information System (CIS) and we believe there is a huge opportunity to reuse that technology to store the biographic component of the National Identity Registry."

The CIS technology is already used to hold records for everyone who has a National Insurance number, although the data in the existing system will not be copied but recorded new when people are enrolled in the scheme.

Existing biometric storage systems currently used for asylum seekers will be used for the NIR in the short term. For the Public Key Infrastructure information related to the secure use and issue of ID cards, the plan is to build on existing systems used to issue ePassports which currently rely on facial biometrics.

The plan for which biometrics will be used in the ID cards has changed too. Iris scans are now not going to be used following the review of the project in the summer--only fingerprints and facial biometrics.

The action plan also revealed that while the first ID cards will be issued in 2009, it will be 2010 before "significant volumes" of the cards will be ready.

There are likely to be between five and 10 procurements needed to provide the technology behind the system, a process that will start in April or May 2007 and last for around a year.

Despite the tight deadline, Hall said: "The timetable we've laid out represents our best current estimates of what we can do. This is not a greenfield site--we are not dealing with technology that is unknown. We think we have a sensible, credible plan that we can deliver."

Steve Ranger of Silicon.com reported from London.