On Government proposals and solving problems

The 2005 Home Office Study “Assessing the Impact of CCTV” (772 Kb PDF) is well worth a read.

The first important thing to note about the study is that it can’t help us come to a reasonable conclusion about measuring outcome in terms of crime rates.

The second is that the forensic use of images, ie in a courtroom, was outside the scope of the study. We can say however that some police are of two minds about it – they like to have the images, but sometimes there are too many images to work through, and some aren’t clear enough to be useful.

The third is that the authors conclude CCTV was oversold by successive governments as a magic bullet (something common to a lot of failed projects, not just IT projects ):

…there was a tendency to put up cameras and expect impressive results, ignoring the challenge of making what is quite a complex measure work (replicating the findings of Ditton et al. 1999), and failing to define what exactly the CCTV system was expected to do.

In the first place, the crime problem must be defined properly, but some agencies failed to do this despite previous experience in this field. Consequently, CCTV was installed in areas and circumstances where it was unlikely to be effective. It is also a mistake to install a large number of cameras just because funding is available.

So, they not only failed to define the problem (eg “there is a high rate of vehicle crime in this car park”) but also failed to define how they wanted CCTV to ‘solve’ it (eg “we want to deter would-be criminals and photograph criminals in the act”).

They also did not have a full understanding of what CCTV could do, in part because of the difficulty in researching it, because of the aforementioned and following problems:

systems have to be monitored properly or recordings made and stored properly; but the quality of this work varied considerably from one control room to another. Hence the researchers were often not evaluating carefully designed systems which addressed clearly defined crime and disorder problems, so much as failures of implementation.

In addition, and this is important from an evaluation perspective, the objectives often did not drive the scheme. For researchers, establishing a scheme’s objectives was not straightforward. Although these had to be stated in tender documents, they did not play a significant role in deciding how the project was implemented. As the objectives were not the driving force and were rarely embedded in day-to-day practice, the failure to achieve crime prevention objectives was arguably less the failure of CCTV as a crime prevention measure than of the way it was managed.

The point being that even if we put civil liberties objections aside it really isn’t good enough to say, “I support CCTV”, “I support ID cards”, “I support bans on drugs/ fox-hunting/smoking”, “children’s databases” and so on.

If you put aside general civil liberties objections (or just don’t care about them) try using something like Schneier’s five steps to help you evaluate a proposal (he is a security expert, but I think the steps work in the more general case):

1. What is the problem you are trying to solve?
2. How well would it solve the problem?
3. What new problems would it add?
4. What are the economic and social costs?
5. Given the above, is it worth the costs?

I urge you to dissect all Government proposals in this way – to think critically about them.

If you find it difficult to get past step one, “what problem are you trying to solve?”, it may well indicate a problem with the proposal – that there isn’t a clearly defined problem, and therefore this could well be an inappropriate proposal, or something that isn’t going to work, like CCTV in some circumstances as outlined above.

Step two is a little easier: if you think the proposal wouldn’t “solve the problem”, then there’s probably little point in pursuing it. If you think it would get it half right, then it might be worth developing.

For instance, suppose an ID card system is supposed to be able to solve ID fraud. Now suppose most ID fraud occurs when the person is not present. How would the system solve that? Probably not very well at all.

And if it is never explained exactly how the proposal will solve the problem, it’s probably worth regarding it with some suspicion.

Step three, “what new problems does it add?”, is a bit more involved and requires research and reflection. Take outlawing prostitution, for example – this could increase the victimisation of prostitutes by police and criminals, and increase the wealth of pimps, and stop some women from being able to feed themselves.

Or ID cards with a central database – clearly the database would become a target for criminals. All this needs careful thought.

Of course new problems need not be limited to deliberate wrongdoing. Suppose the database was checked when you collected benefits or accessed non-emergency health services, but the system crashed, or a mistake was made in your records. What would happen? Would you be allowed to access those services, or would you be sent home?

Now, the economic costs are probably a little easier to determine, although note that the Government usually gets these wrong (or misleads us about them) in terms of IT projects at least. The social costs need more thinking about – I think these overlap with “new problems it adds”, such as wealthier pimps. They could be more abstract, harder to quantify, such as the “chilling effect” brought about by surveillance, or couched in civil liberties terms such as the loss of a freedom to speak.

And then there is step five, “bearing all this in mind, is the proposal worth deploying?”

As I say in my About This Blog,

Do not take my word for anything. Click through the links. Make up your own mind.

And do apply the same to claims made by politicians, because in all likelihood they have the same level of understanding as you about these things and certainly different motivations.

Advertisement

A judge on summary justice

The Times:

The huge growth in on-the-spot fines to keep offenders out of the courts is in danger of bringing the law into disrepute, the Lord Chief Justice’s chief of staff says.

Lord Justice Leveson, the senior presiding judge in England and Wales, said that the use of fixed-penalty notices in some cases had become a farce.

In one case an offender had accumulated fines to a total of £960 for “no fewer than eight notices for theft, presumably shoplifting, and one for drunk and disorderly”.They were “all unpaid, with no real prospect of ever being able to pay a single one of them”, the judge said in a lecture sponsored by The Times.

…

The rise of summary justice at the expense of formal hearings in the courts led to 51 per cent of offences being dealt with last year by a caution, on-the-spot fine or cannabis warning. This was the first time in modern criminal history that more than half of offences were dealt with by out-of-court punishments.

Courtroom convictions as a proportion of all offences brought to justice in England and Wales have fallen by almost 20 percentage points in five years. Figures published last month show that convictions in court accounted for 49 per cent of all offences brought to justice in 2006-07, compared with 68 per cent in 2002-03.

Cautions increased by 17 per cent last year to 350,000, fixed-penalty notices issued by the police rose by 37 per cent to 210,200 and warnings for cannabis possession rose from 57,700 to 83,000. Only 52 per cent of the fines were paid in full.

Lord Justice Leveson emphasised in the lecture at the Centre for Crime and Justice Studies, King’s College, London, that penalty notices for disorder and conditional cautions could still be useful. …

You can download his lecture (91 Kb PDF).

eVoting

The issue of electronic voting is yet another topic where the Government blunders along without heeding the concerns and warnings of independent observers and experts who have no vested interest, just desire to have something that works properly.  Not too much to ask, one would have thought.

I recommend reading this New York Times article on experiences in the USA, where they have had electronic voting for much longer than we have (hat-tip Bruce Schneier).

Project Stork

You may have seen the phrase “EU Project Stork” being mentioned in recent discussions of identity cards (eg).

Do not let it concern you, as James Hall, Chief Exec of the IPS explains in identikit letters to several newspapers (eg Telegraph, Herald), there is nothing to hide and nothing to fear:

Sir – Claims that there are plans to share information from the proposed National Identity Register with 26 other EU countries are unfounded (report, November 27).

Project Stork is a research project involving 14 [not 26! – ukliberty] countries looking at each other’s technical standards for delivery of online Government services, with a view to making it easier for citizens and businesses to access such “e-services” cross-border in future.

Project Stork is not about ID cards, it has nothing to do with the National Identity Scheme or providing personal data from the National Identity Register. Just as with the current passport database, the National Identity Register will only hold core identity information [oh dear!]. It will not hold tax, benefit or other financial records nor be an amalgam of existing Government data.

The scheme will be fully security accredited, and an independent Scheme Commissioner will oversee its operation in addition to the role played by the Information Commissioner.

James Hall, Chief Executive, Identity and Passport Service, London SW1

Strangely, however, the EU suggests otherwise (my emphasis in bold):

An ambitious pilot project to test the compatibility of several different electronic ID systems is to be undertaken in the UK. The pilot, worth over €20 million, is part of the EU’s eID STORK project which aims to establish EU-wide interoperability for eIDs by 2010.

The ultimate goal of the STORK project is to implement an EU-wide interoperable system for the recognition and authentication of eIDs that will enable businesses, citizens and government employees to use their national eIDs in any Member State. Once established, this would significantly facilitate migration between Member States, allowing easy access to a variety of eGovernment services including, for example, social security, medical prescriptions and pension payments. It could also ease cross-border student enrolment in colleges.

European ministers, as well as some non-European countries (e.g. Iceland), set themselves the political objective to reach mutual recognition and interoperability of electronic identities by the year 2010 in the Manchester Declaration adopted in November 2005. This declaration, however, also adopts the subsidiarity principle, leaving full autonomy to Member States as to what kind of electronic identity they issue. The STORK project is expected to help bridge the gap between the different eID systems currently in use, leading to a de facto standard for interoperability in eIDs. The deadline for this is 2010, when the EU’s European eID Management Framework comes into force.

The UK’s Identity and Passport Service (IPS) is leading the pilot project, in close co-operation with the Government Gateway, the UK’s centralised registration service. “It is about the eventual pan-European recognition of electronic IDs,” noted an IPS spokesperson. “Neither services nor entitlements will change; rather, the project is currently about looking at methods that already exist and figuring out how to make them recognise each other.”

How would such a system operate if there was no means for, say, France to check the National Register?

Mr Hall?

Update

See also the Register.

Update 2

Also see this thread in the NO2ID forum (hat-tip David Moss).