Is this the world’s most vulnerable national ID system?

By Professor Fraser Sampson, former UK Biometrics & Surveillance Camera Commissioner

Few things have driven biometric technology like identity. The imperatives to secure financial, digital and physical borders have supercharged the global emergence of biometric ID solutions — as one glance at this Biometric Update page will show.

But there’s one critical outlier, a dependency covering all sectors of our national infrastructure that has seen no meaningful technological improvement in decades and now represents perhaps the greatest ID-based vulnerability worldwide.

While innovations like mDL, age confirmation and liveness detection have powered national ID capabilities for citizens, the system for reliably identifying our vehicles has remained stationary. From a strategic perspective, when it comes to driver vs vehicle identification the latter matters most. Macro management of traffic-dependent risks like pandemics and environmental hazards, as well as supply chain continuity, civil contingencies and national resilience, relies on accurate vehicle identification.

That is why I reported to parliament that Automated Number Plate Recognition (ANPR) has become part of our Critical National Infrastructure. Quietly and unobtrusively, ANPR supports pretty well all the functions set out in the government’s just published National Security Strategy. Recording as many hits-per-second as Instagram, the UK’s ANPR system is a formidable tool but in identifying the country’s 41.2 million registered vehicles it has a single and failing point of weakness: what my predecessor called the humble number plate.

The licence plate is a vehicle’s national ID card – one that you can order online or over the counter from any of some 40,000 registered suppliers, all using uncontrolled stationery and ineffectual manufacturing standards. Enforcement is supplied by a network of cameras which are unable to detect flaws, forgeries or fakes and simply let you pass if they can’t read it at all.

Researchers at Cranfield University have found that registration is no guarantee of even basic compliance and were easily able to locate registered suppliers willing to sell them number plates to defeat ANPR or emission zone cameras. Under the current scheme, registered suppliers in the UK can sell you a number plate with any alpha-numeric combination you like if they call it a “show plate.” The only safeguard is that you must promise not to use it on a road (would we do that with tires or brakes?). The scheme relies on registered suppliers requiring proof of ID from the buyer, who must also show their entitlement to display the number they’re buying — researchers found many registered suppliers who didn’t ask for either.

As dependence on traffic cameras expands, incentives to game the vehicle ID system increase. Using an inherently unreliable ID system to enforce financial measures like vehicle tax and emission zone penalties is where the system’s absurdity becomes most acute. Tens of thousands of drivers are receiving substantial fines and penalties because their vehicle’s “identity” has been copied and the volume is accelerating. The arrival of the UK’s new “Data Act” promises secure digital identities to improve efficiencies, create positive customer experiences and reduce fraud, yet someone can clone your vehicle as easily as buying a pair of driving gloves.

Sophisticated customer ID procedures, supplier management processes and anti-money laundering protocols have become a way of life for all of us. Rapid advances in remote ID and authentication in areas like banking, online behaviour and even basic household security highlight the asymmetry in vehicle identification. In contrast, the national vehicle ID system doesn’t need deepfakes or impersonation software to fool it and there’s no need for deep packet inspections (DPI) to expose its weaknesses: they’re right under our noses every time we take to the road.

And this situation is not unique to the UK. While some in-vehicle variants such as RFID are being used in some countries, they are equally vulnerable to cloning and corrupting as number plates.

Even where a vehicle is displaying correct plates, ANPR cameras have misreads. In the UK, the police set an “acceptable” misread level at 5 percent. With daily reads approaching 100 million, “acceptability” means over 200,000 mph (misreads per hour). Viewed through a cyber-security lens that’s an unfathomable number of common vulnerabilities and exposures (CVE) for a system protecting our critical infrastructure.

Perhaps it’s because our vehicles enjoy far greater privacy than we do that ANPR vulnerability has attracted so little attention. In the hot debate over police ID technology, the ratio of attention spent on Facial Recognition vs Vehicle Recognition is surprising. This imbalance will become more important as autonomous vehicles begin to appear on our roads.

Recently, the revenant issue of the “ghost” plate has been picked up again by MPs (the Cranfield Vehicle ID Group’s response can be seen here) but formal reports to ministers by the last two Surveillance Camera Commissioners on ANPR’s strategic vulnerabilities produced little beyond boilerplate rehearsal of assurances. Meanwhile, UK lawmakers are debating new police powers to stop protestors hiding their identity (see the Crime and Policing Bill) – they might note that the protestors’ ability to conceal the ID of their vehicles will remain as easy as pulling on a COVID mask.

The vehicle registration plate is an ID relic from another era. In the UK it’s governed by an underpowered regulatory framework that insists it’s keeping up despite the lap time evidence to the contrary. Looking down the biometric highway, the latest Police Emerging Science and Technology Trends report sees UK policing one day using brainwaves to confirm individual ID. By contrast, the system of vehicle ID looks like a horse-drawn solution to an F1 problem; our continued reliance on it leaves us profoundly exposed.

Alternative technologies will need careful, informed research but cracking the challenge of a remotely-readable unique vehicle identifier (RUVI) will bring a once-in-a-generation, globally scalable market opportunity. The Cranfield Group have ideal credentials for such a project.

About the author

Fraser Sampson, former UK Biometrics & Surveillance Camera Commissioner, is Professor of Governance and National Security at CENTRIC (Centre for Excellence in Terrorism, Resilience, Intelligence & Organised Crime Research) and a non-executive director at Facewatch.

Article Topics

ANPR  |  biometrics  |  digital identity  |  Fraser Sampson  |  identity management  |  license plate readers