Smart identity cards: the forgotten issue

PUBLISHED : Friday, 01 August, 2003, 12:00am
UPDATED : Friday, 01 August, 2003, 12:00am

In June, the Hong Kong government embarked on one of the most ambitious and potentially controversial projects since the handover: a plan to issue 6.9 million people with computer-enhanced ID cards that could be used to track movements 24 hours a day. Some privacy advocates have been up in arms about the implications of the new technology, though opposition has been muted - partly because initially the cards will not store much information and partly because of the city's pragmatic attitudes. The $3.11 billion project will get into full swing on August 18, when the department begins to replace all of Hong Kong's 6.9 million laminated-paper ID cards. By 2007, everyone will have one.

Initially, most of the data on the cards will be optional. In a modern city like Hong Kong, thousands of corporate networks already record our daily travel, purchases, phone calls, health care visits and internet use. The smart IDs features may not even be noticed by the average person and it would be easy to dismiss privacy advocates as being hopelessly behind the times. But to its critics, the very idea of a compulsory Smart Identity Card System smacks of George Orwell's Big Brother. The government has a website full of arguments in favour of the new system. The old ID cards were flimsy and outdated, while the new ones could encourage the use of e-government services. Made of polycarbonate, the new card is expected to last 10 years and can be swiped 100,000 times.

The most serious disadvantage of existing cards is how easily they can be forged. As for security, supporters say there is little to worry about. Existing laws put tight restrictions on how ID card data is used. Former secretary for security Regina Ip Lau Suk-yee once claimed it would take 10 years and a supercomputer to break the new cards' 1,024-bit encryption. Nevertheless, each application on the card will be encrypted with a separate algorithm, and the connected data stored on remote databases, so that even if hackers could crack one key, they would not learn very much.

The first generation of smart cards will not be very smart at all. To assuage privacy concerns, the government has installed a bare minimum of data. Most of the card's tiny 32KB memory is reserved for the Immigration Department, storing name, data of birth, ID number, a digital photograph and code representing both of the holder's thumbprints. Cards for non-permanent residents will contain their conditions of stay.

It is the range of potential applications that has privacy advocates most concerned. Also, after three years of planning, there is no single authority charged with managing card content. Legco will have the power to introduce new applications.

And there is room for a lot more data. Even with encryption included, that tiny 32KB would still leave room for around six thousand words of text - or about two pages of newsprint.

Critics say that additional applications are likely to be 'quasi-voluntary', meaning people will ultimately feel compelled to use them or be excluded from many public services. The argument against is simple: if a technology can be abused, it will be. Among those most concerned independent legislator Margaret Ng Ngoiyee. 'I may be paranoiac, but I am strongly opposed to a smart ID card which is compulsory, because this can be used for surveillance without my knowledge and so have a direct impact on my personal liberty. The government's assurance that this won't happen is meaningless because I have no way of checking,' she said this week.

China is planning to introduce its own national smart ID. With no effective laws on the mainland to protect privacy, some say there is no reason to expect the mainland to respect data stored on a Hong Kong ID card.

Other countries with smart ID cards include Italy, Belgium, Denmark and Japan. More projects are under way in several European countries, though the European Union's open borders mean more liberal member states could stymie their neighbours' national ID card plans. In Asia, Thailand, Malaysia and Singapore all have smart ID cards that store more information than Hong Kong's.