ID cards and iris codes

[ciphergoth]

From http://news.bbc.co.uk/hi/english/uk_politics/newsid_1559000/1559245.stm

[Blunkett] also maintained that improvements in electronic thumb or fingerprint technology or even "iris-prints" meant the threat of forgery would not make the system redundant.

Iris codes are a very effective identification technology. They scare the crap out of me. This BBC news story provides a summary of how they work:

http://news.bbc.co.uk/hi/english/sci/tech/newsid_1477000/1477655.stm

More information is provided in Section 13.5 of Ross Anderson, "Security Engineering". Here's some tidbits.

They're devastatingly accurate. With any identification system, you can trade off "false accepts" (accepting someone who is not who they say they are) against "false rejects" (rejecting someone who is who they say they are). With iris codes, if you're prepared to put up with a false reject rate of one in ten thousand, you can get a false accept rate of less than one in a trillion.

Unlike fingerprints, iris codes have a very simple structure. As a result, they can be compared very rapidly, and they're not limited to checking that you are who you say you are - it's practical to look up who you are in a database using your iris code. The Nationwide Building Society piloted a cash machine for which no cards were needed - the machine looked you up in their database using your iris code.

http://news.bbc.co.uk/hi/english/sci/tech/newsid_81000/81859.stm

An iris code database for the whole of the UK would fit onto any new PC.

Iris code scanners will be very cheap - they're just a simple low-res digital camera with a fixed-focus lens and fixed exposure. You put your eye in just the right place, close to the lens, and it takes a photograph. However, Anderson says

There's no technical reason why a camera could not acquire the iris from a distance of several feet [...] - it would just cost a bit more - but that brings Orwellian overtones of automatic recognition of individuals passing in a crowd.

Mirrorshades or vanity contact lenses would stop this at the moment. But existing vanity contact lens printing techniques are not fine grained enough to allow me to pass as someone else in an iris code test.

In summary, they might decide they don't need to issue us with ID cards. They may just use the two ID cards we carry with us every day.

Update: More commentary from Ross Anderson