Your ID number is not a password
8th November 2010
With the recent controversy over Octopus Rewards Ltd, and the way it had been
using the data supplied by its customers, we thought this would be an ideal time
to highlight a common misconception regarding the Hong Kong Identity Card
(HKIC) number, or HKID. As we will show, that
misconception is shared by the Government and evident from its recent policy
actions, which are putting us on the road to increased abuse of the HKID and
higher economic losses from fraud. This article also looks at the unfulfilled potential of the Smart ID
Card, including biometric authentication and electronic money.
Identifier, not authenticator
 A unique, unused HKID is assigned to each resident of Hong Kong aged 11 years or older
under the
Registration
of Persons Ordinance and the
Registration of Persons Regulations, and this is displayed on the face of
his HKIC, along with his date of birth and various other data. The
Smart ID Card also contains a chip with a small processor and some encrypted
data, including the photo image, and "templates" of the left and right
thumbprints. The templates are measurements of thumbprints, not images of the
prints - you could not reproduce a thumb print from the measurements.
The HKID is what its name suggests - an identifier. It is
unique to the holder. It is not an authenticator, like a password or
PIN. Indeed, PIN, which stands for "personal identification number" is a
misnomer - it doesn't identify you at all. It authenticates you when you use an
automated teller machine or a web site that requires such a number. Numerous people may have chosen
to use the same secret number - so it can't be an identifier. A PIN should be
called a PAN - personal authentication number.
The HKID, in itself, should not be regarded as "personal data" or a secret.
It is nothing more than an identifier. It says almost nothing about you. [Note:
if it begins with a "W" then you are a foreign domestic helper. Other initial
letters A-Z, and in some cases two initial letters may have unpublished
meanings]. The
number does not include your age, gender, blood type, income or anything else.
It is not much different to your name, which is almost an identifier; we could
say, a "near-identifier", because you probably have a different name to more
than 99% of the population, and your name may even be unique.
Your HKID is recorded in many aspects of life in HK, for example:
- If you visit a secure
office building, particularly after hours, then you may be asked for
identification at the front desk, and your HKIC number will be recorded. A pass may
then be issued to you. It's entirely reasonable - you wouldn't let complete
strangers into your home, would you?
- If you open a bank account, the bank will record your HKID (or passport number), so that it knows which unique person it is dealing with. It
may ask to see your card again when you withdraw large amounts of money, as well as asking for
your manual signature of course. This reduces fraudulent withdrawals, which
reduces banking costs.
- If you are appointed by
the court as a liquidator of a company, then you need to be identified by your
HKID in gazette notices such as
this one, so that people know exactly whom they should make claims to. So
the HKID of anyone who has ever been appointed a liquidator is already in
the public domain - it is not a secret.
- HKIDs are often included in legal contracts for sale and purchase of
property, publicly filed with the Land Registry. That's because the owner
needs to be able to prove that a property is owned by him rather than by
someone else with the same name, and the buyer wants to know that he is
dealing with the real owner.
- The HKID (or a passport number) of anyone who has been a
director or secretary of a company registered in HK is recorded on filings made
with the Companies Registry, so that shareholders, creditors or anyone dealing
with the company knows the identity of anyone who is or was running it. These forms are open to inspection or copying.
As a company director, your
editor David Webb's HKID is there, and to save you the cost of looking it
up, here it is: P135143(9). There you go. No big deal. Not a secret. Just an
identifier. Now if you ever meet someone claiming to be that David
Webb, you can ask to see his ID card.
Incidentally, the last character in brackets ( ) is actually not part of the
HKID. It is a check digit which depends on the characters in the HKID, resulting between
0-9 or A. It is generated by a fairly simple formula, and is used to check for
errors, because if you get one character wrong in the ID,
then the check digit will be wrong. You can use our new online
HKID check digit generator to calculate
the check digit of any HKID - try it and see! Hours of fun for all the family.
Government encouraging the abuse of HKIDs
In recent (30-Aug-2010) consultation conclusions on some company law reforms, the Financial Services
and Treasury Bureau of the Government
said
(page 9) that it will
delete the last 3 digits of any ID number in future filings before displaying
them. This is a naive and misguided move. As the Law Society put it in
their submission
(page 4):
"Identification numbers should be recorded and disclosed in
full as it is a unique piece of information for identifying a person; the name
of a person is not. Persons with identical names are not uncommon. An identification number is not a reliable tool for
authenticating the identity of a person in electronic or telephone transactions.
Use of identification number for authentication purpose is itself a misuse and
should be discouraged."
The Government, in its conclusions, said "the remaining digits (together with
the name) should be sufficient to identify the individual persons". That
directly contradicts its own consultation paper, which
said (p54) "The option of masking 3 or 4 digits of an identification number
would not serve the purpose of identifying a person as there are cases of
persons with the same name having similar identity card numbers".
The Government proposes to allow any company director to pay a fee to get
their HKID in old filings partially blacked out - but that doesn't stop people
accessing the information before the law changes and keeping it. Put simply, you cannot "unpublish"
something once it is out there.
By treating HKIDs as secrets, the Government is encouraging the use of the
HKID as an authenticator. Instead, the Government should be publishing full
HKIDs in its various public notices (just as it does for liquidators), and
should embark on one of its publicity campaigns to remind people that HKIDs are
not secrets and should not be used as passwords.
The easiest way to stop the abuse would be to give clear notice that
in say, two years' time, the full register of all HKIDs and the corresponding
names will be published, so that nobody will rely on them as
authenticators after that. Two years ought to be enough time for all commercial
users to modify their systems to use more reliable authentication.
The SSN problem in the USA
 By encouraging the use of HKIDs as authenticators, the HK Government is on the
road to increasing abuse and higher levels of fraud in the economy. The USA
provides a case study in this: since 1936, the
Social Security Number (SSN), originally designed just to track social
security contributions, has become widely used as an identifier for many
purposes. There's nothing wrong with that in itself, but the problem is that it
has become misused as an authenticator too, even though for any mature adult,
dozens or even hundreds of banks, employers, colleges and service providers (and
any staff of those entities, past or present, with access to the data) know this
supposed "secret", and it often appears on public court records and other
filings.
The US Government has gone the
wrong way about dealing with the problem - actually
discouraging disclosure of
SSNs, thereby encouraging firms to rely on them more as authenticators, even
though any halfway-competent identity thief knows how to find them. You cannot put the genie back in the bottle.
Instead, the US Government should adopt a national identity card system with
biometric authentication and digital certificates, of the type used in an
increasing number of countries. With such a system, the economic losses of
identity theft could be dramatically reduced. Instead of just claiming
an identity with an SSN number, citizens would be able to prove their
identity.
Abuse of the HKIC number as an authenticator
The companies in HK which are abusing the HKID as an authenticator are mostly
low-ticket service providers such as phone operators, pay TV operators and
utility companies. They typically ask for your HKID when you call them by
phone. That's because they don't want to make the necessary investment to set up
a password or PIN and mail it to you.
It's their choice, but they should not
claim reliance on the HKID later on if it turns out that they had been speaking to
an impostor. If they don't have secure authentication, then the customer can't
be held liable for changes to an account made by an impostor, and the operator
can be held liable for any damage to the account holder. Taking on that risk is
a commercial judgement for the operator, weighed against the cost of fraud.
Ultimately, if a service provider is relying on non-secret information to
authenticate someone, such as a phone number, address or date of birth then they
are never going to be 100% certain who they are dealing with.
HKIDs in IPO refunds
In another botched bit of policy-making, on 22-Jul-2004, in order to deal
with the problem of theft of IPO refund cheques from the mail, the SFC
announced that banks would print the applicant's HKID or passport numbers on
the cheques. This was a good move, because it meant that the cheque could only
be paid into the account of someone who not only used the same name but also had
the correct ID number associated with his bank account, but the mistake was
this: with false concerns about data privacy, they decided to mask out the 5th
and 6th characters of ID numbers, for example, "A123**6". They treated the ID
number as a secret rather than an identifier. The unintended consequence was
that this facilitated multiple applications by people who varied the masked
digits in their ID number. Theoretically, you
could make 100 applications that way, or 10 if the registrar was verifying the
check digit.
So on 23-Mar-2007, the SFC
announced a changed system in which the two masked digits would be randomly
selected from IPO to IPO. Of course, there would be no incentive for multiple
applications if the allotments were just a flat percentage of the application
size, but they aren't, and that's a story for another day.
Who is who?
As readers will know, we run a "Webb-site Who's Who" of important people in
Hong Kong, accessible from the search box at the top of every page, and
assembled entirely from public information. We absorb the cost and make it
freely available in the public interest. One of the ongoing challenges we have
is avoiding mistaken identity when referring to real people. The Government's
announcements of appointments to statutory or advisory bodies often don't even
use the full name of the person they are appointing, making them even harder to
identify. They might as well announce that they have appointed "Mr Anonymous".
This hardly encourages confidence in the accountability of appointed persons for
their work on these public bodies.
A recent example was the appointment of "Irene Chow" and "Dennis Chan"
to the Polytechnic Council,
as notified in the Gazette, and another is the
appointment of "Alvin Yip" and "Joe Ngai" to museum advisory panels. These
names have many holders in HK, and the announcement contained no other clues as
to who these people were. In each case, we had to contact the Government and
ask for the full names. It would be far more sensible for the Government to
announce the full name and the identity number of appointees, so that we all
know exactly who they mean. Again, it is only an identifier, not an
authenticator.
Similarly, listed companies should use identity card numbers (or passport numbers, for overseas
directors who do not have a national ID card in their home country) in
appointment announcements and annual reports. These
numbers are already filed when they notify the appointment to the Companies
Registry, but not in the announcement filed with HKEx. Yes, we could get the
information from the registry (until they delete it), but that involves using
their ridiculous and unnecessary pay-per-view system. They actually make far
more profit than the revenue they get from the pay-wall, so they should knock it
down and allow free open access. Filing fees would still bring them a profit.
With the increasing prevalence of mainland individuals on the boards of listed
companies, the mistaken identity problem is increasing. For example, we have
7 of "Li Jun" in our system. Fortunately, the Listing Rules require the age of
directors to be disclosed, otherwise it would be even harder to distinguish
them. If the Listing Rules required a national ID number to be published, this
problem would vanish.
Smart ID's unused potential
One of the sad things about the Smart ID card is that, largely through lack
of Government effort, its full potential has not yet been exploited. All of the "card-face data" - the text
on the card that anyone can read
with their eyes, is encrypted on the card's chip so that only authorised
Government departments can access it using distributed keys. So far, only public
libraries have the keys. But if anyone can read the data printed on the face of
the card, then why not allow access to the electronic version of the same data
when the card is presented to a reader?
Apart from card-face data, there are thumbprint templates in every card's
chip, and these are used when you go through the fast channels at the mainland
border or at the airport. But the
thumbprint system is only used by the Government's immigration department, and
has not been made available to any other service provider.
The way the thumbprint templates are compared at the airport and border
controls is "off-card" - you put the card into a reader, take it out again, walk
through the first gates, and then put your thumb on a reader. If it matches, the
second gates let you through. If it doesn't match, then alarm bells ring, a big
metal cage drops on you from the ceiling, you get tasered, and men in boots
arrive and tell you to take off the silicone mask.
So after you remove your card from the reader, the immigration machine
must temporarily have your thumbprint template, and the machine then decides
whether your thumb matches the template. However, the card's CPU is capable of
making the comparison itself, "on-card", so that the encrypted templates never
leave the card. Installing this additional mode would allow the Smart ID system
to be opened up to commercial users for authentication purposes, without
exposing the thumbprint templates.
 If the private sector could use the card for authentication, then there
would be almost zero risk of forged or stolen cards being used to open bank
accounts, obtain credit, or anything else. The thumbprint
of the forger or thief using the card simply would not match the template on the
card. Users could also use card-readers with a built-in thumbprint reader online
(attached to their PC through a USB port), to authenticate themselves without
having to remember all their different pin numbers and passwords. You could even
open a bank account that way - online authentication using digital certificates would prove who you are.
Using the HKIC and thumbprint would also save banks from issuing so many of
those little
one-time password generators to achieve 2-factor authentication.
The technology for thumbprint authentication is well established. The
HK Smart ID Card runs the
MULTOS operating system, and applications such as
Match-on-Card from
Precise Biometrics
will run on it. This application is included in the
Thai National ID Card and in the
Portuguese Citizens Card. The MULTOS system also has something called
STEP (Secure Trusted Environment Provisioning) which allows the Government
to provide new or improved applications remotely, so any necessary software
upgrades can be delivered over the internet or other means. The upgrades are
digitally signed and the card will only install them if they contain the correct
signature.
Still carrying a driving licence
When the Smart ID was designed, there was also a plan to drop the requirement that we carry driving licence
cards when we drive, and instead, just present your HKIC and thumb if you are
stopped by a police officer, to verify your identity. The licensing
data is stored on back-end government computers, not on the card. So far though, the
Government has
yet to follow through, and we are still carrying around driving licenses.
The physical licenses are only really necessary if you need to show proof of
your driving licence to a car rental company.
E-purse
 There was also a plan in 2002 for an "e-purse" on the card - a segregated area which
would store electronic legal tender issued by the Hong Kong Monetary Authority.
There is still space reserved on the card for that, but there is no timetable
for implementing it. The e-purse function would involve cash on the card which
could be transferred between users just as banknotes and coins are now. It need
not involve using identities or tracking your spending - the different card
applications are segregated by internal firewalls.
The cash balance can be kept on the card rather than in
a back-end database like the Octopus system. Given the recent controversy over
the way Octopus has been behaving, and the fact that it charges merchants 1% on
every transaction, there is certainly a case for the HKMA to revisit the
proposal for electronic money. For one thing, it would reduce the cost and
security issues associated with the "bearer bills" or bank notes currently in
circulation, and complaints over what to do with small coins.
The Hong Kong Monetary Authority
should publish proposals for activating the e-purse function on the cards.
Nobody would have to use it if they did not want to.
Global PIN
There is also a "Global PIN utility" in every Smart ID card, which remains
unused, but could be activated on a voluntary basis by the card holders. LegCo
was
briefed (p7-9) on this back in June 2002, and since then it has been quietly
forgotten. The function could be activated using a
thumbprint reader, then the user would choose a PIN, which would remain secured
in the card. The PIN could then be used along with the thumbprint for 3-factor
authentication: something you have (the card), something you know (the PIN), and
something you are (the thumbprint).
The Smart ID Card has been
issued since 23-Jun-2003. While there may have been governmental caution
over fully utilising the potential at the outset, citizens have grown familiar
with it over the last 7 years, and accept the convenient use of the thumbprint
for authentication at immigration control points. They should be more than ready
to accept wider usage. Meanwhile, the cost of card/fingerprint readers has
dropped, so the widespread adoption of cheap USB readers for online
authentication would be more feasible, if the Government would allow it. Given
the high cost of running over-the-counter transactions with members of the
public, it would likely save the Government money in the long-run to hand out a
free card reader to each user and let them conduct their business online from
their home or office.
Over 7 years after the Smart ID Card was launched, it is time for the
Government to realise its full potential and economic benefits. In the meantime,
the Government should stop treating HKIDs as secrets and publish the full HKID
register of numbers and names, to remove the myth that the numbers are a
reliable means of authentication.
© Webb-site.com, 2010
|