http://www.guardian.co.uk/politics/2008/mar/06/idcards.privacy

Choice quotes from the article:

"Smith said the scheme would not be vulnerable to hacking because it would not be online, and biometric details could only be accessed by people with high security clearance."

Clearly the very fact the the databse is not online makes it impossible to hack. Does this mean that there will be a single terminal in a locked room guardeed by geeks in white coats like a scene from  Mission Imposible?

No. It will be on a network run by EDS or some other large contractor with connections from many offices across the country. If the biometrics are such an important part of the scheme then organisations are going to need to access to the database of biometrics millions of times a day.

If the database is not online, then maybe an official asks to see your fingerprint. He draws a picture of it. and sends it through the post to the office where the terminal is.  The man who sits at the terminal all day looks at the picture of the fingerprint, looks that the picture on his database, puts a form in an envelope and posts it back to the official.

Copies of everyone's "biometrics" would be stored on three government computer systems, making the scheme fraud-proof because individual cards could be cross-checked against the central database, Smith said.

"It is not the case that large amounts of information will be kept on one database," she said.

Indeed not! Large amounts of information will be kept on 3 databases!
Reminds me of the joke from HitchHikers Guide to the Galaxy: What's better than a telephone that never rings?  3 telephone that never ring.

Asked how much information would be required on each individual, Smith explained it would be "about the same amount as the information needed to open a bank account".

Or gain access to an existing one?

She insisted there were "big benefits" from the ID card system, which she said should be rolled out as far as possible.

In any organisation like this I would like to expect that there is a highly paid database professional who knows everything about the data and is responsible for  setting up the access control policies.  This person will ultimately be responsible if some member of staff gets their hands on all of the data.  If the correct TECHNICAL access control policies are in place then the only way that member of staff could get that data would be by consulting the database professional.

One would clearly expect that if IT has been outsourced, then the role that I've just described would be played by a member of EDS staff; who should be just as responsible as the in-house role.  Clearly that is not the case. At the end of the day EDS are not going to be held responsible for this; which is a shame, because they are the ones with the knowledge and know how.  They are the people who really understand just how bad this fuck up is. After all, if this had happened with one of their private sector clients then the client would likely have gone out of business and EDS would have lost their contract; and may well be facing criminal proceedings.

To be quite frank, every single person who is responsible for handling that data in those organisatons should have a PGP key. 
All data that is passed around the organisation should be encypted SOLELY FOR the recipient of that particular transaction. (If you don't understand how this can be done then go and read a primer on PGP public/private key encryption). 

A suitable secure method to transmit this data (lets assume suitably filtered with unneccessary fields removed) would have been to set up a n SSH connection with a 128 bit key, then transmit the PGP encypted zip files over that connection.  This way, there is no way for the discs to get lost, or copied.

Of course, the correct way to do that audit would have been for EDS to provide a reasonably priced service where by they consulted with the audit office to find out exactly what information they needed, and wrote the SQL queries to extract this data.  They could then provide a secure connection to the NAO offices and transmit the results of the queries.

The Labour MPs that have been on telly about this have been appaling.  The party line seems to be that the government stil wants to push on with ID cards.  They keep saying that 'there are important lessons to be learned here'.  Surely the most important lessons to learn are:

1. When any large store of information is entrusted to an organisation then that organisation needs to be responsible to every single person whose information they hold. 
   
2. Any large store of information like this is very valuable to more seedy side of humanity; criminals, fraudsters  and marketing departments.
3. Any large store of information is VUNERABLE.  Always.  Absolute vigilence must be maintained to protect it.  That means recruiting, training and retaining highly qualified and competent IT staff who work in house; and who will be held responsible in the event of a breach.

The IT industry has best practices for storing sensitive information.  The tools that we have are not absoloutely bombproof, but they are definitely more than adequate for the protecting this kind database, when they are used properly.  I'm talking about technologies like PGP encryption, draconian access control policies, secured networks).  If Her Majestys Goverment of the United Kingdom of Great Britain and Northern Ireland is not using the industry's best tools and the industry best practices to protect the data now, then how can we ever trust them to ALWAYS use the upmost diligence at all times in the future? 

Furthermore, how can we possibly extend that trust to future governments who haven't even been elected yet?

I'll reiterate that:  This child benefits database is an example of the most sensitive information that the government handles about its citizens.  If it's not using any encryption tools or following any industry best practice for protecting this data, then that's absolutely horrendously incompetent.  Absolutely.

I have no trust whatsoever that any data in government hands is safe. Absolutely non at all. It's going to take a lot more than a few half assed statements in the House of Commons and on Newsnight to convince me otherwise.

If you do support the principle of ID cards then you need to be absolutely convinced that the governemet's procedures for protecting the data that you entrust to them are absolutely flawless.  I do not recommend tthat any citizen hands over data for an ID card until the IT industry leaders are satisfied with the way that the government handles data.