Al-Khouri, A.M. (2006) 'Pitfalls in Large Scale IT Projects: The Case of UAE National ID CardProgram', Electronic Passport Forum- ID World International Congress, November 28-30, Milan, Italy.

1. Emirates Identity Authority
UAE National ID Card Progam
Ali M. Al-Khouri
Milan, Italy, November 28th-30th 2006
A national vision towards a better future for the United Arab Emirates

2. AGENDA
• Strategic Goals ..
• Registration Process ..
• Technology components ..
• Ongoing projects ..
• Lessons Learned ..
A national vision towards a better future for the United Arab Emirates

3. Project Goals ..
A national vision towards a better future for the United Arab Emirates

4. Strategic Goals
Identity
Management
System
Security Economical
A national vision towards a better future for the United Arab Emirates

5. Security & Economical Objectives
enhance homeland security integrated population database
Security
government trusted identity
minimise identity theft verification infrastructure
provide identity verification
improve access/delivery of public service services to other ministeries,
banks, hospitals, etc.
unification of existing cards and
one card multi-uses reduce management & production
Economical
cost (e.g., dls’, labour, health)
timely, accurate statistical info.
support strategic decision making for planning e.g., education,
healthcare, energy, etc. )
support e-Gov and e-Commerce national e-authentication
infrastructure
A national vision towards a better future for the United Arab Emirates

6. ID card scheme and IDentity theft ..
A national vision towards a better future for the United Arab Emirates

7. Identity Theft …
Worldwide = $ 300 billion
VALUE IN US $ BILLIONS
$56.6
$54.4
$53.2
YEAR
2003 2004 2006
Source: Privacy Clearing House, http://www.privacyrights.org
A national vision towards a better future for the United Arab Emirates

8. UAE and Identity theft …
• NO accurate figures of cases or cost..
• UAE iris system caught
to date > 120,000 illegal attempts to
re-enter the country after deportation..
A national vision towards a better future for the United Arab Emirates

9. GCC Survey 2006 …
Al-Khouri, A.M. (2006) “ National ID infrastructure and e-Government,” Emirates Identity Authority, UAE.
Identity Theft/Fraud
A national vision towards a better future for the United Arab Emirates

10. Registration Process ..
A national vision towards a better future for the United Arab Emirates

11. Registration/Issuance Process
• checking government issued credentials
VERIFICATION
e.g., passports and visas
ID Registration-Cycle
• online verification of presented docs
ENROLMENT
BACKEND
CHECKS
CARD
ISSUANCE
A national vision towards a better future for the United Arab Emirates

12. Registration/Issuance Process
VERIFICATION
ID Registration-Cycle
• capture photo
• hand signature,
ENROLMENT
• scan docs,
• biometrics.
BACKEND
CHECKS
CARD
ISSUANCE
A national vision towards a better future for the United Arab Emirates

13. Registration/Issuance Process
VERIFICATION
ID Registration-Cycle
ENROLMENT
BACKEND • background checks,
CHECKS e.g., biometrics, watch lists…
CARD
ISSUANCE
A national vision towards a better future for the United Arab Emirates

14. Registration/Issuance Process
VERIFICATION
ID Registration-Cycle
ENROLMENT
BACKEND
CHECKS
‫رقم الهوية‬
‫رقم الهوية‬
‫رقم الهوية‬
CARD • centralised card ‫رقم الهوية‬
‫رقم الهوية‬
‫رقم الهوية‬
ISSUANCE production
• pickup /
home delivery
A national vision towards a better future for the United Arab Emirates

15. Card, System & Security ..
A national vision towards a better future for the United Arab Emirates

16. Several anti-counterfeit
physical features
Overt:
chip data
• Guilloches & Rainbow
digitally
signed & • Ghost image
encrypted • Holographic overlay
• Variable fine lines
• Special Raster
• UV ink
• Rainbow printing
Covert:
• Micro text
• Hidden text
• UV
A national vision towards a better future for the United Arab Emirates

17. Chip Information (Privacy?)
Public Data Restricted data
Name digital image
Nationality fingerprints
2 x fingerprints data (Match on card)
(Match off card) other pers. info
etc etc
A national vision towards a better future for the United Arab Emirates

18. Architecture …
Security Measures: System Design
application level: biometric & passwords 4-tier web-based architecture
network level: VPN, DMZ, IDS, etc. latest standards
ISO
system Level ICAO
x.509
physical Level
high availability
A national vision towards a better future for the United Arab Emirates

19. Technology components ..
A national vision towards a better future for the United Arab Emirates

20. Project Primary Focus …
Determining the identity of an
individual by comparing a
presented characteristic to all
Identification pre-enrolled in the database.
WHO ARE YOU?
Recognition
Authenticating identity of an
individual by comparing a
Verification presented characteristic to a
pre-enrolled characteristic
ARE YOU WHO YOU
SAY YOU ARE?
A national vision towards a better future for the United Arab Emirates

21. Trust Chain: Technology …
• a three factor authentication enabling technologies...
something you
have?
smart card
something
password biometric something
you know?
you are?
A national vision towards a better future for the United Arab Emirates

22. Technologies …
Smart Card PKI Biometrics
Smart Card: Gemplus, Authentication: Assurance of fingerprints (rolled prints,
Chipset: Infineon identity (Digital Certificates) palm prints, writer)
ISO 7810, 7816-1/2 Confidentiality (Data Privacy):
compliant protection of data (Encryption … to improve FAR/FRR:
Algorithms)
Java-based OS, 32/64 KB • facial recognition
EEPROM, 136 K ROM Integrity (Authorisation): • Iris recognition
data consistency and integrity
compliant with Java Card (Data Hashing)
2.1.1 & GP card specs. V2.0.1
Non-Repudiation: ownership of
contains person’s data, document/transaction (Digital
portrait, certificates, and Signatures).
private keys
Updatable chip
A national vision towards a better future for the United Arab Emirates

23. Choice of authentication …
(examples of transactions)
Complexity
Biometrics
with PKI
PKI/Digital
Signature
Pin/
Password
None
Class I Class II Class III Class IV
Risks
* as the level of risk associated with the transactions increases,
the choices of authentication gets higher in complexity ..
A national vision towards a better future for the United Arab Emirates

24. Choice of authentication …
(examples of transactions)
Complexity
Biometrics
something you with PKI
have?
PKI/Digital
smart card
Signature
Pin/
Password
something
password biometric something
youNone
know?
you are?
Class I Class II Class III Class IV
Risks
* as the level of risk associated with the transactions increases,
the choices of authentication gets higher in complexity ..
A national vision towards a better future for the United Arab Emirates

25. Ongoing projects ..
A national vision towards a better future for the United Arab Emirates

26. Collaborative Government Environment…
• interoperability & integration with other systems
General
Local Ministry of
Information
Authorities Justice
Authority
Private
Ministry of
Ministries companies &
Education
org.
Economics &
Ministry of
Planning Police Central Database
Defense
Ministry
Ministry of Ministry of
Central Bank
Labour Health
A national vision towards a better future for the United Arab Emirates

27. Unification of cards …
to also act as:
Residency Permit/Card
Labour Card
Health Card
GCC Travel Passport
e-Gate
ATM Card
e-Purse (e-Cash - eDirham)
e-Pass (e-Gov)
….
A national vision towards a better future for the United Arab Emirates

28. e-authentication
a simple e-authentication model to access and interact with the government
A national vision towards a better future for the United Arab Emirates

29. Some lessons learned ..
A national vision towards a better future for the United Arab Emirates

30. Registration process
• Present process requires three offices for enrolment (building cost)
• Three workstations are required for one enrolment line (equipment cost)
• If a problem with the enrolment of one applicant is experienced,
the total line becomes un-operational
A national vision towards a better future for the United Arab Emirates

31. Registration process
• Present process requires three offices for enrolment (building cost)
• Three workstations are required for one enrolment line (equipment cost)
• One Stop
If a problem with the enrolment of one applicant is experienced,
Registration
the total line becomes inoperational Office
A national vision towards a better future for the United Arab Emirates

32. Project Stages …
Stage I Stage II Stage III
Interface/
Promote the
Short Integrate
use of the
Form with
Card
organisation
Interfacing and Integration
Issue/Produce ID Promote (enforce) the with:
cards to citizens and presentation of ID
• Ministry of Labour (MoL)
residents and card as a means for
• Ministry of Justice (MoJ)
minimise potential identity verification
• Ministry of Interior (MoI)
noise from public and pre-requisite to • Ministry of Education (MoE)
(make it smooth!). benefit/access to a • Ministry of Higher Ed (MoEd)
government services. • Ministry of Health (MoH)
data warehouse
A national vision towards a better future for the United Arab Emirates

33. Enrolment Strategy
Target: to enrol total population of 5 million ..
GO Live Mass
June/2005 1/1/2006 mid 2007-
Pilot 9,000
Enrolment 140,000 Full
Interim Enrolment
enrolled
(System Testing) total enrolled so far Enrolment
Registration Registration Marketing Driven
limited to Military, limited to gov. Enrolment
Interior, and organisations
Police staff and their 8-14 Registration
families Centres
Residency issuance
stage
A national vision towards a better future for the United Arab Emirates

34. Scope Creep
Time
Budget Scope
A national vision towards a better future for the United Arab Emirates

35. An example of varying interpretations
of user requirements:
A national vision towards a better future for the United Arab Emirates

36. Quality Acceptance Framework …
ISO/IEC 9126
Functionality Reliability Usability Efficiency Maintainability Portability
Suitability Maturity Understand Time behaviour Analysability Adaptability
Accuracy Fault tolerance ability Changeability Installability
Interoperability Recoverability Learnability Resource Stability Co-existence
Security Operability utilisation Testability Replaceability
Attractiveness
Functionality Reliability Usability Efficiency Maintainability Portability
compliance Compliance Compliance Compliance Compliance Compliance
Are the required How reliable is the Is the software How efficient is How easy is to How easy is to
functions available software? easy to use? the software? modify the transfer the
in the software? software? software to
another
environment?
A national vision towards a better future for the United Arab Emirates

37. Thank you...
Ali M. Al-Khouri
Deputy Director General
Emirates IDentity Authority
E-mail: alkhouri@emiratesid.ae