What's in a name? The importance of identity verification for public protection
Principal Policy Adviser, Department of Corrections
Michael joined the Department of Corrections Strategic Policy Team in 2014. His areas of interest include strategies to reduce re-offending by high-risk offenders, and the management of offender identities in the criminal justice system. As well as working for Corrections, he tutors public policy at Victoria University, School of Government and is studying professional economics part-time.
Offenders are frequently known to the criminal justice system under a number of names. This is not necessarily unlawful; under New Zealand common law, individuals have a right to use other names providing they do not use them for fraudulent purposes. Citizens adopting aliases as part of everyday life is reasonably common, with an estimated seven percent of New Zealanders assuming at least one alternative or preferred name that is not an official name*. This can often be for legitimate purposes, such as anglicising a foreign name when moving to New Zealand, or simply assuming an alternative given name from childhood. However, cases of fraud and identity theft are a growing problem with the increased need for individuals to identify themselves online and the resulting electronic storage of sensitive personal information. Offenders who come into contact with the criminal justice system are also more likely than the general population to use alternative names for fraudulent purposes to minimise the consequences of their offending.
Addressing the risks posed by offenders using multiple identities requires effective sharing by public protection agencies of accurate identity information that has been verified against an authoritative source (such as the register of births, deaths and marriages). This would ensure that an offender’s sentence, post release conditions and management take account of all of the offender’s previous offending. This article will consider identity management innovations that public protection agencies might use to improve the management of offenders while they are serving their sentence and after they are released into the community.
Issues facing identity management
Hollywood films and popular television shows such as CSI: Crime Scene Investigation often portray a comprehensive government database which enables slick detectives to solve complex cases with only a smidgen of scientific evidence, such as a partial fingerprint lifted from a crime scene. In reality, the pieces of information required to verify the identity of an individual are held across a range of public protection agencies, none of whom hold all the information. The ability of public protection agencies to bring these pieces of information together is critical to minimising the risk posed to the public by some individual. There are a number of practical barriers to bringing these pieces of information together including the ability to obtain accurate quality information from offenders, and efficiently and securely accessing data stored on a number of computer and hardcopy systems.
From a privacy perspective, the holding of personal information on individuals by public protection agencies needs to be proportionate to the risks to public safety. The personal rights and privacy of citizens must be given significant weighting in any consideration of broadening the ability for agencies to obtain and share individuals’ personal information. While acknowledging the importance of protecting the privacy of ordinary citizens, it is vital to have a robust process to verify the identity of offenders when they enter the criminal justice system, and to be able to share that information with public protection agencies responsible for ensuring that offenders serve their sentences and comply with post release conditions.
Underpinning the challenges faced by public protection agencies is the wider management of citizen identity in New Zealand. Unlike some countries, New Zealand does not have a national identity system – i.e. there is no universal “citizen ID” number for individuals to use when interacting with government services. While there are a number of nationally used identity numbers for specific purposes (such as the IRD number for tax or NHI number for health), these are limited to particular administrative purposes and cannot be used or shared outside those limits. Recent initiatives such as the RealMe®** service aim to build identity assurance and share personal information securely, and is now used by agencies to verify identity for services such as StudyLink and CabNet. This does not provide comprehensive identity information for all citizens, but does reduce the risk of identity fraud for these services and is a reflection of government’s use of new technologies to improve identity management practices.
In the absence of a national identity document, the New Zealand driver licence is the commonly accepted proof of identity that is acknowledged by most authorities, as well as the New Zealand passport. A further challenge for the criminal justice system is that many offenders do not hold either of these forms of identity (or may claim not to) due to never officially learning to drive or having a need to travel outside of New Zealand. Many offenders have also had multiple driver licences in different names as, until recently, limited proof of identity was required for a licence to be issued. In these circumstances criminal justice agencies must look to other means to obtain accurate information and verify identity to a high degree of confidence.
Offenders moving through the criminal justice system
As offender behaviour becomes more sophisticated and technology has progressed rapidly, it has become increasingly apparent that biographic information alone is insufficient to reliably verify an offender’s identity. Relying entirely on unverified biographic data means that individuals may have multiple biographic identities either intentionally or unintentionally. An individual may have multiple biographic identities as a result of the misspelling of their names or data entry errors. Other individuals may deliberately use a number of names to fraudulently gain advantage or reduce the consequences of their actions.
An additional complication is that some names are very common. Relying on first name, surname, and date of birth alone to verify identity is problematic. If these three biographic characteristics alone are used they may match with multiple legitimate identities in New Zealand, increasing the likelihood of false-positives occurring in any data matching process. This has important implications for the general public, such as travellers who may be stopped at border security because their names and dates of birth match those of other individuals on a “no fly list”. To minimise the misuse of multiple identities, biometric information needs to be linked to verified biographic information to safely manage the risk posed by offenders and reduce the chances of false-positives in any data matching exercise.
Offenders are dealt with by multiple agencies as they move through the criminal justice system, including Police, Justice and Corrections, and access a wide range of government services throughout their sentence and reintegration. Relying solely on unverified biographic data makes it significantly harder to link offender records held by different agencies to a particular individual, and increases the risk of misrepresentation and fraud.
The primary risk is that an individual is convicted of an offence and may progress through the criminal justice system under a name that is not linked to their official name, or other names under which they have previously been convicted and sentenced. A consequence of this is that individuals who have never been charged under their official name may maintain a conviction-free criminal history in that name. This may compromise conventional police vetting and criminal record checks and pose a risk to public safety. Previous offending may, as a result, not be made known to a sentencing judge or the Parole Board when they are making decisions that require knowledge of an individual’s character and level of risk. A serious violent or sexual offender may be known to the criminal justice system under an alias or assumed name, while maintaining a “clean” identity in their official birth name. As a result their full criminal history may not be known to decision-makers when employment decisions are being made or when they are being considered for release by the Parole Board.
Improving identity verification
There are extensive practical benefits to the justice sector to combine biographic and biometric data to establish a verified identity, and subsequently be able to efficiently establish the correct identity of offenders. For example, a quick fingerprint scan to verify that the offender reporting for community work is the offender sentenced would reduce the ability of offenders to “subcontract” their community work to other individuals, such as gang prospects. This innovation would both improve the efficiency of the process and uphold the integrity of community sentences. A key driver of this opportunity has been advances in technology and the use of biometrics in identity management.
The use of biometrics by criminal justice, immigration and border authorities worldwide has grown, and has proven to be effective in the detection and prevention of identity fraud. Common biometric measures used worldwide (not all of which are in use in New Zealand) include fingerprint*** , 2D face image †† (such as is currently contained in New Zealand passports for use with SmartGate) and iris ††. Reported barriers to wider international implementation of biometric technology are the current cost of biometric technology, the lack of existing biometric databases, privacy, security and human factors. Suppliers of biometric technologies anticipate that the cost of such technology will reduce significantly in the near future as new products are developed. Obtaining accurate biometric information is also important. Greater use of fingerprints as the consistent source of biometric information across agencies may occur in the near future, due to the authority Police currently have to obtain fingerprints of offenders without the requirement for consent†††.
International progress in identity management
There has been significant progress internationally in recent years regarding identity management and information collection and holding by government agencies. In part this trend can be attributed to the response to the threat of global terrorism, increased immigration, and the desire of authorities to have accurate and verified information about individuals in their country.
The Netherlands introduced a new Citizen Service Number in 2007 that replaced the social security and tax number to create a single number enabling public authorities to exchange information with much less risk of errors occurring. Over time, this will create a new verified identity system for the justice sector as all citizens would already have a verified national identity with biometric information linked. The Citizen Service Number (along with photograph) is included in the passport, driver licence, and identity card for all citizens. A fingerprint is also captured and embedded in the Netherlands passport.
The Netherlands is planning to set up a central database of biometric data (fingerprints and photographs) for all foreign nationals who apply for residence or are already residing in the Netherlands. There is already a biometric database for asylum seekers. Maintaining a central identity database should minimise the possibility of an individual using another person’s identity or using false documents to obtain permission to reside, work or study in the Netherlands. Fingerprints will be used to reliably match immigrants to their personal identification data and documentation.
In the United States, North Carolina criminal justice agencies have invested in a web-based application, Criminal Justice Law Enforcement Automated Services, that integrates law enforcement, court and corrections data to provide a complete view of an offender. This provides a “single source” repository of critical information. One of the main benefits is reduced risk of overlooking offender related data, including identity information and aliases. The previous disconnected systems and information had meant offenders were falling through the cracks when it came to detecting criminal behaviour and monitoring and managing risk. Such an integrated system would also be desirable for New Zealand, where Police, Justice, and Corrections records could be linked up as a single authoritative source of offender identity.
It is vital to have a robust way to verify the identity of offenders when they enter the criminal justice system, and to effectively share this information between public protection agencies. Advances in technology and increased online services have created new ways for individuals to obtain multiple aliases, but also present opportunities for innovation by government to establish and maintain offender identities in a sophisticated way that reduces the risk of fraud and identity theft, and improves public safety. It may be a disproportionate, and undesirable, response to roll-out a widespread identity management system for all individuals in New Zealand, such as the Netherlands’ Citizen Service Number. However, a robust system to verify offender identity is necessary to protect the public from fraud and ensure offenders are held to account. Innovations in biometrics and information sharing provide an opportunity for this – though it is important that privacy, and the rights of the general public, are protected.
*Veda Comprehensive Reporting, ‘The Rise of Identity Fraud’, The Angle, May 2012.
**RealMe is a collaboration between the Department of Internal Affairs and New Zealand Post to provide a secure process to manage identities online
***Fingerprint recognition systems work by finding the minutiae of the print – such as the ridge endings bifurcations, and associating a location and direction with each.
†Face recognition relies on finding key distinguishing features on the face, ranging from simple metrics such as distance between the eyes to more sophisticated identifiers such as skin texture.
††Iris recognition systems start by taking a detailed greyscale photograph of the eye. The image is cropped to remove all parts except for the patterned iris region. The remaining ring is unwrapped into something akin to a barcode to create a digital representation of the iris, called a template. The template can then be compared against other templates using specialised matching algorithms. Iris biometrics are considered uniquely capable due to accuracy, stability over time and non-contact nature.
†††Power provided under section 32 of the Policing Act 2008.