Israel's new biometric ID system: A guide for the perplexed
What is a biometric ID?
Old, low-tech IDs contain easy-to-forge information: names, addresses and a unique ID number printed on a card along with a picture. A national database that links names to ID numbers exists, but law officers have no way to know if the card and the picture within are authentic. With a low-tech ID system, identity theft is relatively easy, especially in a world full of high-resolution digital cameras, image-manipulation software and home printers.
A biometric ID is notably harder to fake. The data it relies on is those physical traits that are unique to each person and difficult or impossible to change, such as fingerprints or retina scans. The two identifiers chosen in Israel are fingerprints and facial contour information that remains unchanged even if cosmetic changes are applied.
This is the first attempt to create a national database in Israel, but several biometric identification systems are already in place here. One is a fingerprint-ID system that allows jobs seekers to report to employment service offices without waiting in line. Another system is operated by the Airports Authority that enables card holders to skip passport control. Participation in both systems is voluntary. Many private employers also require biometric identification systems to control access to workplaces or as cheat-proof time clocks.
How will it work?
A person wishing to join the database can report to an office of the Population and Immigration Authority with a valid ID card, a passport or a travel document. A PIA officer will validate your identity with several computer-chosen questions drawn from the Interior Ministry’s databases. You will sign a release authorizing the PIA to collect and store biometric data. An electronic scanner will take fingerprints from two fingers and a specialized camera will scan faces for a personal “facial ID."
The data will be stored in a specialized database, separate from the PIA’s databases, which will be operated by a separate agency. Law officers and others authorized to check biometric IDs will be equipped with portable terminals which won’t give them direct access to personal data – only allow to ascertain the identity of a card’s holder.
Will I have to carry such an ID?
Israeli law mandates that citizens carry their ID card with them at all times (in reality, the law is seldom enforced). When the pilot is completed, and if the initiative isn't scrapped in this phase, the biometric ID will be the only type of ID issued.
Will my information be safe from theft?
Experts have expressed strong concern over the security of the new system, concern that mounted as time went by. They cite the state’s abysmal record in keeping private information safe, as well as multiple hiccups in the project’s creation. As the pilot phase draws nearer it becomes clear that two key requests for tender – one for the supply of an anti-forgery system, the other for the position of data security analyst – will not be filled in time.
Two organizations, whose appeals to the Supreme Court to scrap the project have been denied, have issued harsh statements on Tuesday. The Association for Civil Rights in Israel has said that keeping a database is not necessary for issuing biometric ID cards and warned about the “irreversible” implications of a leak from such a database. The ACRI has also warned that the database will become a data-gathering tool for the police.
Jonathan Klinger, a lawyer for the Israeli Digital Rights Movement, said on Monday that “this will not be a secure pilot phase. Its purpose is to give Israeli police as much data as it can on as many citizens it can – data that will eventually find itself in private hands." The DRM has appealed to the Attorney General on Monday, asking to delay the project until major concerns have been addressed.
In 2006, the entire civil registry was stolen and leaked online, where it is still available on file-sharing networks. The civil registry contains data on all of Israel's citizens including names, addresses, family relations, ID number, sex, nationality, religious affiliation, birth dates, immigrations dates and more. Detractors say the data in the new biometric database is sure to suffer a similar fate.
The Biometric Database Authority said Monday that “the authority’s systems already include high-level security and biometric data comparison [systems]. The Authority has in its employ a security manager and a full-time staff. The authority published RFTs from time to time, as need and technological updates mandate."
Jonny Silver