Smart Id Must First Be Secure

[george]

Smart ID must first be secure:

THAILAND'S NEW IDENTITY CARD

BANGKOK: An announcement is likely very soon that will herald the introduction of a smart national ID card, with key decisions likely to be made this month that will affect every Thai national.

Thailand was one of the first countries to introduce an identity card in 1914 and now appears to be on the verge of becoming one of the first nations to implement a ``smart'' version of this _ an ID card that will provide additional security and stronger identification capabilities, while affording the possibility of accessing other government services, even third-party applications such as online banking.

It is hardly surprising, then, that there is a lot of interest in Thailand's smart ID card, which is the biggest project that the Information and Communications Technology Ministry has taken on.

This follows a Cabinet decision in September that put the ministry in charge of the project which was initiated by the prime minister in February 2002. ICT Minister Surapong Suebwonglee immediately set up a team headed by the ministry's permanent secretary and solicited expert advice on how best to go about implementing a smart national ID card, and in early October, at the invitation of the ministry, Gartner Asia/Pacific Research director Dion Wiggins made several key recommendations during a day-long ``Smart National ID Card Workshop''.

Gartner warned the ministry that previously announced plans to begin production in November were premature _ ``wishful thinking'' was the phrase used _ and urged that one to two years be spent in planning the launch.

But it now seems unlikely that the ministry will wait very much longer and the minister has promised to introduce a smart ID card early next year.

Such urgency makes it all the more important that the right fundamental decisions are made. Perhaps the biggest unresolved question is whether the cards are to be produced in two or three centralised locations, or in a distributed fashion at as many as 1,200 locations across the country in a similar way to the process by which ID cards are now issued.

Centralised or decentralised production is said to be a ``six-billion-baht question'' _ because if Thailand gets it wrong, this is how much money the country could waste, according to Gartner's Mr Wiggins in a recent interview.

The research director suggests that strong security, which can be easily implemented with a centralised production process, is also critical in order to prevent fraud.

Gartner also advocates that a laser-engraving process using a polycarbonate-based compound be employed for card production since this will deliver smart cards that will last for 10 years, cards that are impossible to tamper with and that will be extremely difficult to replicate.

Cost-saving is the other benefit derived from centralised production using laser-engraving technology. Gartner argues that this works out at three quarters the cost of doing it in a distributed way, but using dye diffusion thermal transfer printers and laminated cards. This is because of the high cost of consumables and a shorter lifetime of five years for the laminated cards.

The distributed approach has been proposed by the Interior Ministry's Bureau of Registration Administration, which advocates producing Thailand's smart ID cards at over 1,000 locations, which Gartner suggests could be a security nightmare.

The concerns are about the possible theft of card blanks, as well as storage security issues, stock auditing issues and a need to secure the equipment in so many locations from theft or misuse.

Physical security in the production of smart ID cards should be as important as the process for printing banknotes, argues Mr Wiggins _ especially since these cards will later likely be handling on-line financial transactions, potentially involving greater sums of money.

Thailand's smart ID card will also become a vital identity document, equivalent to a passport, and it is expected to be used in lieu of one for travel within the Asean region in the future, so complacency about physical security surrounding the production of these cards could be very costly.

If trust in Thailand's smart ID card were ever to be broken, it would be hard to repair the damage _ especially if national or international criminals found they could easily target these cards for identity theft or other illegal activities, where criminals usually obtain a fraudulent identity to facilitate committing other kinds of crime.

As a pioneer of national ID cards 90 years ago, Thailand now has another opportunity to set a good example and become a role model for the secure way it implements its smart national ID card. So far, the ministry has taken the right step to seek independent advice on how to go about this. Now, a decision to follow Gartner's key recommendations with the centralised and secure production of a tamper-proof polycarbonate-based card would appear to be prudent.

--Agencies/The Post 2003-12-13