Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Privacy Your Rights Online

British Telecom Pushes Universal ID Check System 278

miladus writes "URU (You Are You) is a new ID verification scheme from BT designed to allow government and businesses to confirm identities on the net. The BBC has a full report on how, according to BT officials, 'URU will be a major ingredient in transforming and joining up government... and how it will become ubiquitous for citizens, businesses, etc.'. Apparently, URU complies with European privacy laws."
This discussion has been archived. No new comments can be posted.

British Telecom Pushes Universal ID Check System

Comments Filter:
  • Uh oh. (Score:5, Funny)

    by Anonymous Coward on Tuesday March 04, 2003 @03:04PM (#5434740)
    Looks like Oracle bought the U.K.
  • by Joe the Lesser ( 533425 ) on Tuesday March 04, 2003 @03:05PM (#5434744) Homepage Journal
    In phase one, the only details that will be entered are name, address and Meter Point Asset Number

    TK-421! Why aren't you at you post?
  • Ick (Score:5, Insightful)

    by Ravenscall ( 12240 ) on Tuesday March 04, 2003 @03:05PM (#5434753)
    Nothing I would want more than a porn site to have my phone number, and therefore access to my name and address.

    Or any kind of site for that matter.
  • by jhh09 ( 613620 ) on Tuesday March 04, 2003 @03:06PM (#5434765)
    How does this fit in with the Liberty Alliance / Passport authentication schemes? Is this yet another one developers will have to choose between, or this limited to UK systems? What's the point of using a single login system if there are a 1,000 such systems users have to register with and log into?
  • Welcome... (Score:5, Insightful)

    by Mourgos ( 621534 ) on Tuesday March 04, 2003 @03:07PM (#5434777)
    to the new Big Brother era.
    How long before everyong revolts?
    • Re:Welcome... (Score:2, Insightful)

      by Anonymous Coward
      ...all experience hath shewn, that mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security.

      I'd say we're still well within the "more disposed to suffer" phase. To move the great mass of people to fight will take far more abusive measures than have yet been taken.

      And yet, those measures will come, eventually. It's no longer a question of "if", but "when".
    • by Pike65 ( 454932 ) on Tuesday March 04, 2003 @03:15PM (#5434852) Homepage
      "Due to information received by Big Brother about 'every ong revolting', all of the ongs will be pre-emptively destroyed. That will be all."
    • This all already revolts me
    • It also requires the person to agree to have the check run and will e-mail them every time their ID is requested,...

      Great... yet another clever way of increasing the volume of unsolicited email, which of course is something we all desire fervently. Think of how many emails this will add to the daily load, as identity verification becomes more common.

    • Re:Welcome... (Score:3, Interesting)

      by tomhudson ( 43916 )
      <quote>
      "We envisage that URU will become ubiquitous for citizens, businesses and government and we predict that in 10 years' time, 90% of ID checks will be done in this way," he added.
      Initially the system is being trialled by well-known retail banks, he said.
      </quote>

      Does this sound like one of those stupid late-90's dot-bomb schemes, full of baseless predictions. Why not name the banks, (unless they don't exist outside the promoters' marketing mind).

    • How long before everyong revolts?

      Sire, the people are revolting!

      I know! I cant stand them either!

      Ok, the first of you that throws a rock at me is gonna...... THUD
    • Re:Welcome... (Score:5, Interesting)

      by EvilTwinSkippy ( 112490 ) <{yoda} {at} {etoyoc.com}> on Tuesday March 04, 2003 @05:50PM (#5436340) Homepage Journal
      This is really dumb.

      Short of Government Desk Jockeys, Domestic Intelligence Agencies, and Identity Thieves, I really don't who would find this all that useful.

      The fact that I CHOOSE to call myself EvilTwinSkippy, and that I am EvilTwinSkippy on a few other websites is a voluntary choice on my part. I have selected that persona, and if the persona no longer suits me at some point, I'll put it down and start a new persona.

      A number is a highly impersonal thing, like a license plate or a MAC address. Having gotten parking tickets because the meter maid was a digit off (how else could my white ford escort be mistaken for a blue chevy pickup) the oppertunity for error is amazing. Hell, my wife is getting junk mail (right down to credit card offers) for her sister because a catalogue company mixed up their 2 accounts. It also doesn't hurt that one is Sara and the other Dara. (S and D are right next to each other on a standard US Qwerty style keyboard.)

      Now harmless junkmail is ok, but imagine if medical records got crisscrossed, or criminal records? And it doesn't even have to be family, imaging if you are TT-1231-12512 and TT-2231-12512 is a wanted terrorist? Or if TY-1231-12512 has an outstanding warrent in New Jersey for driving without a license?

      URU is a very bad idea. A very very very bad idea, especially for causual use by business and beaurocrats.

  • its not new (Score:5, Funny)

    by QEDog ( 610238 ) on Tuesday March 04, 2003 @03:08PM (#5434782)
    This system is the internet version of one that has been out for a long time overthere. They used numerical IDs for the people, the most famous one being 007 James Bond.
  • Does the URU fulfill American privacy laws? (not that it matters much anymore after the USA PATRIOT Act...)
  • by $$$$$exyGal ( 638164 ) on Tuesday March 04, 2003 @03:11PM (#5434819) Homepage Journal
    It also requires the person to agree to have the check run and will e-mail them every time their ID is requested, offering a further safeguard against identity theft.

    That is a step in the right direction, but does anyone see a problem with that solution? If my identity has been compromised, then maybe my e-mail is also compromised...

  • Notification (Score:3, Insightful)

    by meckardt ( 113120 ) on Tuesday March 04, 2003 @03:12PM (#5434825) Homepage

    The only thing that would make this scheme different that current identification methods is the automatic notification (by email) any time the URU identity is used:

    It... will e-mail them every time their ID is requested

    I suspect that someone's URU ID could be misused by someone else as easily as any other ID, but at least you would find out about such misuse before the cops/creditors come pounding on your door.

    • provided of course they haven't already gotten into your E-mail as well
    • Re:Notification (Score:5, Insightful)

      by mpe ( 36238 ) on Tuesday March 04, 2003 @03:38PM (#5435072)
      The only thing that would make this scheme different that current identification methods is the automatic notification (by email) any time the URU identity is used:

      Not quite the idea is to have the same ID used for unconnected things. Which is a generally bad idea.

      I suspect that someone's URU ID could be misused by someone else as easily as any other ID, but at least you would find out about such misuse before the cops/creditors come pounding on your door.

      Unless they are able to also compromise the contact details. e.g. using the ID to get at your email.
    • Re:Notification (Score:2, Insightful)

      by evanhr ( 610024 )
      I think this makes quite a difference.
      The control I exercise over my privacy is directly correlated with my perception of its use. I only worry about it if I feel there's a reasonable potential for abuse. At this point that feeling is often based on naive assumptions, I know, but with a notifcation system I'd be substantially better informed.

      Separate from any given protection scheme, I'd very much like to be informed about who wants my info and ideally why, though if I know the who I suppose I can ask them why myself.

  • Unique ID? (Score:4, Insightful)

    by Chocolate Teapot ( 639869 ) on Tuesday March 04, 2003 @03:15PM (#5434850) Homepage Journal
    In phase one, the only details that will be entered are name, address and Meter Point Asset Number - the number in the corner of every household electricity bill which is unique to that property
    Correct me if I'm wrong, but an electricity meter is hardly unique to an individual household. I have lived in flats in the UK where fuel bills were included as a percentage of the rent, and only one set of meters existed for the entire building (30-40 distinct residences)
  • by L. VeGas ( 580015 ) on Tuesday March 04, 2003 @03:15PM (#5434856) Homepage Journal
    If they had kept the REAL acronym, it would have made people happy.
    You Are You > YAY!!
  • Great. (Score:5, Insightful)

    by AftanGustur ( 7715 ) on Tuesday March 04, 2003 @03:15PM (#5434860) Homepage


    And within a year you will have to use it to authenticate with your ISP's proxy server.. (And no direct connection to the internet).

    The possibilities are endless for abuse ......

  • URU? (Score:4, Funny)

    by foxtrot ( 14140 ) on Tuesday March 04, 2003 @03:16PM (#5434865)
    IMI. Y?
  • URU == ID card (Score:3, Interesting)

    by tom_conte ( 108067 ) on Tuesday March 04, 2003 @03:16PM (#5434866) Homepage
    AFAIK, Britain has no mandatory ID card. This sounds weird to a lot of European people, since most European countries require every citizen to have a government-issued personal identity card which identifies them uniquely (a passport is generally accepted as an alternative). Maybe Britain is just thinking about skipping the physical step completely and going directly to the electronic ID stage. This would certainly make sense, since they are probably going to decide to create a mandatory ID anyway.
    • Re:URU == ID card (Score:3, Insightful)

      by Anonymous Coward
      This would certainly make sense, since they are probably going to decide to create a mandatory ID anyway.

      Unlikely, although it's the wet dream of whichever lot happen to be in government at the time, the fact that none of them have managed to think up a reason for wanting it means that they've never manage to go through with it.

      The traditional argument was that it'll somehow reduce crime, but if anyone asks which crimes will be reduced just ignore the question. Murders? Burglaries? Pickpocketing? Illegal parking?

      More recently it's supposed to prevent illegal immigration. Of course that could work if people were actually required to show their ID so often that it was impractical to live without one, but even David Blunket isn't going to openly propose that.

      Reality is that although the government, whichever party is in power, always desperately wants to introduce ID cards (for reasons never made clear), the public don't want them and the opposition, again whichever party that is, is always more than happy to make political capital out of tearing apart whatever flimsy arguments the government comes up with.

      I don't expect an identity card to be introduced in the UK.
    • Re:URU == ID card (Score:2, Insightful)

      by azzy ( 86427 )
      Correct, Britain has no mandatory ID card. That is, there is no ID card which a British individual /must/ have and /must/ carry. However, as to your final words.. you may not be aware of this.. but each British citizen /aready/ does have a mandatory identity. As well as having an identity, we also have a mandatory identity number in the form of a National Insurance number. Many also have passports and driving licenses. Having some form of digitally usable identity number has absolutly nothing whatsoever to do with mandatory identity cards. Not unless police can stop us on the street and demand our URU and arrest us if we don't have it on us. British Telecom is not an arm of the British security services, BT is a private company. Also, a mandatory ID card requires primary legislation.
  • by JimBobJoe ( 2758 ) on Tuesday March 04, 2003 @03:16PM (#5434869)
    My understanding is that the British have Experian like credit history databases (which are not catalogued by a universal identification number, like the SSN, which I believe is the failure point of the US style databases.) So I'm not sure where this fits in...the article seems to imply it's for online transactions?

    The URU proposal has some interesting elements:

    *(it appears) that inclusion in the database would be voluntary, per European and British data privacy laws

    *the "check number" is essentially the electrical meter on your house. meaning that, at least in some way, the number can be changed, at least by you moving elsewhere. furthermore, there is no reason why anyone else would have that number, theoretically. it's a semi-constant.

    *you are automagically notified when someone performs a check, and i suspect that checks can only be performed when the person authorizes them.

    While the current British government is a bit fixed on putting an "entitlement card" together which will essentially be the you can't live without it national ID card, this proposal is vaguely interesting to me. I need more info to run it through a security model though.

    • this proposal is vaguely interesting to me. I need more info to run it through a security model though.

      This was my take, as well.

      One detail you omitted to mention is that the system will have access to many different government databases. It is not obvious to me how this offers any additional advantages in the way of verification (other than the obvious check to make sure that the subject is still alive), but it does set off my "major privacy concerns" alarm.
  • ID number? (Score:4, Interesting)

    by buttahead ( 266220 ) <tscanlanNO@SPAMsosaith.org> on Tuesday March 04, 2003 @03:16PM (#5434878) Homepage
    what does my electric asset number have to do with my unique ID? Whay if three of the george foreman kids live in the same apartment? then they all get the same id?

    what if you move a lot? does your number change every time?

    Wouldn't something a little more unique and static be of more use?
  • Vague on Details (Score:3, Insightful)

    by keyslammer ( 240231 ) on Tuesday March 04, 2003 @03:17PM (#5434880) Homepage Journal
    The article seemed to suggest that an ID number used by the power company would be used as a sort of "universal id", but didn't offer any details as to how this would work (and why it would offer any more protection than any other kind of identifier). What's to keep someone from digging through somebody's garbage to obtain their ID from their electric bill? And what about people who don't have their own electric accounts?

    It seems to me that with all the nifty encryption technology now available, Big Brother attempts like this could do a better job of preventing fraud than just coming up with another global id scheme.

    Anybody have any pointers to more detailed descriptions of this plan?
    • The article seemed to suggest that an ID number used by the power company would be used as a sort of "universal id", but didn't offer any details as to how this would work (and why it would offer any more protection than any other kind of identifier). What's to keep someone from digging through somebody's garbage to obtain their ID from their electric bill?

      Currently if someone got hold of your electricity customer number they couldn't do that much and you'd only have to deal with one entity to get something done about it.

      It seems to me that with all the nifty encryption technology now available, Big Brother attempts like this could do a better job of preventing fraud than just coming up with another global id scheme.

      Encryption simply protects data in transit from interception and alteration. It dosn't verify the data being sent actually is the data it claims to be.
      • Encryption simply protects data in transit from interception and alteration. It dosn't verify the data being sent actually is the data it claims to be.

        Public/Private key encryption is an excellent form of authentication. Check out PGP [pgp.com]. Or better yet, GPG [gnupg.org].
  • Riiiiiight (Score:3, Funny)

    by Malicious ( 567158 ) on Tuesday March 04, 2003 @03:17PM (#5434883)
    This sounds a lot like the idea of attaching your home address to your keychain, so honest people can mail you your keys if you lose them.
    Too bad most people aren't honest.
  • URU? FU! (Score:4, Funny)

    by JPelorat ( 5320 ) on Tuesday March 04, 2003 @03:19PM (#5434905)
    I refuse to have anything to do with something spawned from the so-called vocabulary of an SMS user.

    Will the email you get be just as undecipherable and irritating?
  • by geekoid ( 135745 ) <dadinportlandNO@SPAMyahoo.com> on Tuesday March 04, 2003 @03:20PM (#5434920) Homepage Journal
    from dictionary.com:
    ubiquitous Audio pronunciation of ubiquitous ( P ) Pronunciation Key (y-bkw-ts)
    adj.

    Being or seeming to be everywhere at the same time; omnipresent: "plodded through the shadows fruitlessly like an ubiquitous spook" (Joseph Heller).

    Is this something you really want your government to be?
    I want to know where the people in the governmant are at all times.
  • Uru (Score:2, Interesting)

    by Phroggy ( 441 )
    Name could be confused with the upcoming game [ubi.com] from Cyan, which sounds like sort of a cross between Myst and EverQuest.
    • " Myst and EverQuest."

      great, a game where you have to wait 12 hours, then have to solve some music puzzle, enev thought you are tone deaf..boy, can't wait. ;)
  • by trmj ( 579410 ) on Tuesday March 04, 2003 @03:22PM (#5434933) Journal
    Well, they already seems to be tracking every property in the UK, as the article states:
    the only details that will be entered are name, address and Meter Point Asset Number - the number in the corner of every household electricity bill which is unique to that property

    But then they go and cause more distrust of the program, by stating of these numbers:
    It could also become a pre-requisite of any universal ID card

    And lastly, I feel we've all eard this one before:
    It is a pro-active way to protect your identity


    Well, ok, one more, but only because it sounds funny out of context:
    we need mega-systems
  • whois 666 (Score:4, Insightful)

    by JThaddeus ( 531998 ) on Tuesday March 04, 2003 @03:24PM (#5434952)
    "And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name." Revelation 13:16-17, KJV
    • Dear me -- and this got modded up to 'insightful'? This same religious nuttery that gets brought up every time *any* kind of identification method is introduced?
      At least with bar codes the identification made some sense. The battle for our rights will be better fought with intelligent discourse than with reactionary bible-thumping, I think.

      Mind you, anything that prompts a reference to the masterful Naked [imdb.com] can't be all bad..
      • by laetus ( 45131 ) on Tuesday March 04, 2003 @04:01PM (#5435275)
        Why do you label this "reactionary bible-thumping?"

        For the subset of Slashdot readers who are Christians, this is a relevant comment. For two-thousand years, Christians have had a prophecy regarding the identification of every man, woman and child on this planet. For a Christian, the Mark of the Beast IS intelligent discourse because it is a very real concern.

        Personally, I think your slight is more of a reactionary, knee-jerk response showing your anti-Christian bias than the Biblical quote being discussed.
        • by kafka93 ( 243640 ) on Tuesday March 04, 2003 @04:18PM (#5435480)
          Christians have had any number of prophecies which can be interpreted in any number of ways. Perhaps that justifies the application of any one of those prophecies to any subject that might be discussed on /., but it strikes me as a rather absurd approach.

          Incidentally, I'm using "reactionary" in the sense of "being conservative" -- such references to the Bible, a book which though beautifully written is nonetheless a difficult source for either moral or intellectual discussion, smack of hysteria. Having a "very real concern" doesn't really mean anything -- I might be worried that aliens are employing these ids to catalogue us all and thus find appropriate mates for their martian daughters, but it doesn't make it my views any better considered.

          I've nothing against biblical references, so long as there's any kind of real point or basis to them. But to start implying that the End is Nigh on the basis of nothing more than a silly government plan is, frankly, ridiculous.
          • "difficult source for either moral or intellectual discussion"

            ???
            It is a great source of moral and intellectual discussion.

            the point, which is relevent to this thread, is that the bible predicts a complet catalog of all humans.

            Now we could discuss how the effect of that statement, and peoples reaction to, it could make it a self-fulfilling prophecy, Or how in the US, the constitution could cause a seperation of believer and non believer because introducing a wide spread system mey make it difficult to purchase goods without the identifier. Maybe in the US the constitution would prevent a national ID because it would descriminate on a feligous basis.
            But I guess you wouldn't consider that a place to start an intellectual discussion.
            • The quote sounds more like every human had the same mark on them. Analogizing a database that contains a unique ID for each person, to a single common mark physically applied to each person, is quite a stretch. Even Elastic Man can't stretch that much.
        • For two-thousand years, Christians have had a prophecy regarding the identification of every man, woman and child on this planet.

          Not identification--forced tattooing.

      • Actually, I thought it would get modded up as "Funny". You see, although I am a Christian, I don't see much purpose in the ravings of the mad monk John of Revelations. Afterall, my end-of-days could come on my commute home tonight.

        If they were to ever reopen the Christian canon, my wish is that they would drop Revelations and substitute Dicken's A Christmas Carol.
        • by mangu ( 126918 )
          If they were to ever reopen the Christian canon, my wish is that they would drop Revelations and substitute Dicken's A Christmas Carol.


          No, no, that wouldn't do at all. If you pay attention, you'll see that Revelation is one of only two books that Bible-thumpers read. They read the Genesis and, realizing how many pages there are in the whole Bible, skip to the Revelation, to see if the butler did it.

  • Wouldn't 'RUU' be a better ancronym for an ID system? I guess it loses its graphics designer-friendly symmetry then, though.
  • I'm convinced that you can't get a peice of identity-based legistlation passed these days unless it make a cute acronym in English. What do the Italians, Spanish, or Germans think URU means?
  • by Kadagan AU ( 638260 ) <kadagan@ g m a i l . com> on Tuesday March 04, 2003 @03:32PM (#5435017) Journal
    The open source version: GURU
  • by eyeye ( 653962 )
    Don't forget that journalists regularly get call information of celebrities from BT, same with private investigators.
    They get caught occasionally but what about the times they don't.
    A security token is only as trustworthy as its issuer.
  • Cool (Score:3, Funny)

    by DriceX ( 210607 ) on Tuesday March 04, 2003 @03:34PM (#5435035)
    Does this officially make them part of Oceania?
  • Doubt it (Score:5, Interesting)

    by mugnyte ( 203225 ) on Tuesday March 04, 2003 @03:44PM (#5435121) Journal
    Here in the US, "diving" through one's trash to glom semi-precious information about them is a common identify-theft method.

    If the Meter ID of every BT customer is on their bill, one only needs there name and address (probably on the same bill!) to act on their behalf.

    This seems to fly in the face of how any private key system would work. If it is a public key, what are the channels that ensure nobody else can use such an identity?

    I predict this will go up in flames. I see the electric bills of past residents of apartments all the time, simply floating into mailboxes long after they've left. If BT still thinks they live there, then "IMU" when I use this info.

    Forgive me if this opinion results from ignorance of BT magical "meter id" number. But nevertheless, private passwords exist for a reason. None of the source info here seems quite secure.

    mug
  • by blowdart ( 31458 ) on Tuesday March 04, 2003 @03:47PM (#5435154) Homepage

    I can see obvious problems with this, having had my identity stolen a little in the UK.

    2 years ago I had a cheque (check) book and American Express card stolen from the post. They were stolen by either

    • Postal workers
    • People in my shared building

    From that information the thieves now had my full name, bank details and details of a credit card I held (albeit a cancelled cards and cancelled cheques). From this information they purchased mobile phones, billed to me and applied for numerous store cards. I only discovered this when the bills started arriving.

    Now, if BT's scheme goes off information available on the Electricity bill (keep in mind there are NUMEROUS electricity suppliers, so numerous databases to tie together), what is to stop someone stealing your electricity bill? Note that the electricy reference is per household, not per person. Now, tie this into the electoral role (which is already sold to marketers, and you can check and query it at your local library, so it's not private) that might almost be adequate.

    Except the electoral role is updated once a year. You can actually manage to miss it completly if you move at exactly the wrong time.

    Also people can choose to opt out of the data sharing that the electoral role provides (but not the information sharing to the credit agencies).

    Lets not forget that BT is a private company, not answerable to anyone except the shareholders. I'm not sure if this is better or worse than the government forcing a scheme through.

    • The electoral roll is now updated monthly and has been for a year. You should not miss being on it, because you can add your name at any time:

      see this web page [electoralc...ion.org.uk]

      The electoral register now comes in two formats, one which is available only to returning officers, credit reference agencies and political parties, and an edited version made available to marketers. You can opt out of being listed in the edited version if you wish.

      See this web page [electoralc...ion.org.uk]

  • I am Emmett Smith.

    (Stupid-A$$ lameness filter)
  • Who's on first? (Score:3, Interesting)

    by ChaoticCoyote ( 195677 ) on Tuesday March 04, 2003 @03:57PM (#5435232) Homepage

    I wonder what the folks at Cyan and Ubisoft think about this? They've announced a game named Uru: Online Ages Beyond Myst [ubi.com], for relase in Q4 2003. I wonder who got the trademark first?

    • Now how in the heck is it off-topic to mention a possible trademark infringement by a company (BT) that purports to be interested in personal privacy?

      Or isn't the slashdot audience interested in intellectual property issues anymore?

  • and if I have to explain that to you, then the battle is already lost.

    BC
  • I'm standing in line and the person in front of me states his name, address and that stupid code in oredr to confirn a URU. Now how does it stop me again?


    I go through your garbage and find a elecrtic bill, now I have your name and add. How does it stop me?


    I am employed at joe blows video rental bonanza. You come to open an account. How does it stop me?


    I fail to see how this is going to work. Please someone explain how any of this is secret?

  • One more step on the way to all of us becoming R.U.R's.
  • That's philosophically debatable...
  • by NiceGeek ( 126629 ) on Tuesday March 04, 2003 @05:18PM (#5436040)
    The Norse thunder god Thor has filed a trademark infrigement lawsuit against British Telecom.
  • by cybercuzco ( 100904 ) on Tuesday March 04, 2003 @07:46PM (#5437119) Homepage Journal
    The problem with ID systems are that the more "uncrackable" they are, the more they are trusted. The more they are trusted, the harder it is to make things right when people circumvent those ID systems. Look at DNA evidence. Im sure that some day, some murderer is going to figure out how to plant somone elses DNA on a crime scene, thus implicating the other person. DNA= Guilt in the eyes of todays courts. The safest ID system is a minmally secure one. That way, people are naturally suspicious of an ID even if it appears to be genuine. Mistrust of ID's prevents abuse more than a so called "bulletproof" ID

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Working...