Professor Tim J Wilson, Centre for Evidence and Criminal Justice Studies, Northumbria University Law School — Supplementary written evidence (EBM0024)

1. Introduction

1.1 This submission covers undertakings to provide supplementary evidence made during oral evidence on Tuesday, 16th April and to a limited extent subsequent reflection or additional research. It is structured by refence to Q100 - 109.

2. Q100 (Review) /Q101 (the balance between security and ease of travel)/Q102 (scrutiny and oversight) some/Q108 (outstanding issues)

2.1 There is unlikely to be anything intrinsically novel – as a technological system - about ETIAS and ETA. Non-visa EBM systems were introduced some 30 years ago but probably on a much bigger scale (e.g. with ESTA in the USA), approximately 15 years ago. The UK government,[1] EU institutions and their contractors are all likely to have researched the lessons learned from the introduction and operation of precursor systems.

2.2. It is possible, however, that precursor system research will have concentrated on technological, project delivery/contractual management and cost issues, rather than (a) what is required for effective scrutiny and oversight and (b) the very broad contextual issues arising from the nature of and rules applied through border control (ranging from tourism economics to the Brexit consequences for UK/Irish politics). In that respect comparative research into the following issues could be particularly helpful for developing parliamentary scrutiny and oversight: the adequacy of existing inspection/inspection reporting arrangements; the technology of the system itself, including algorithmic and cognitive bias; data base interoperability (‘the hidden wiring’) to verify information provided by the intended travellers; technologically public service contracting and management; operational staff capability and capacity; the quality of decision making/error correction; and the relationship between visa free travel and other forms of entry; the impact on post-Brexit UK/Irish politics; and economic impacts (including but not restricted to tourism).

2.3 Such research would touch on two very important contemporary issues arising from society’s ever-increasing dependence on computer algorithms: the risk of cognitive bias[2] and the need for candour in the management and operation of technology contracts. The latter is well illustrated by the Horizon scandal and, possibly, also problems with the City of Birmingham financial systems - rather than prospective liabilities for the equal pay settlement - that might have resulted in the need for a S.114 notice.[3] Immigration database errors involving 76,000 people being listed with incorrect names, photographs or immigration status[4] have already been discussed during earlier oral evidence.[5] This incident is properly subject to an ICO inquiry but as an indication of more wider problems, it goes to the heart of concerns about ethics, transparency and governance of the management of international data sharing. Especially as a document seen by the Guardian highlights what was described internally as:

a “small but important downside […] a few thousand people in the database who (typically due to human error) had other people’s passport details recorded on their records. The trade-off here was deemed by the business [the Home Office] to be worth it, hence the approval to proceed.”

Who is making such decisions? Were ministers properly briefed? Without the Guardian article would anything about this have come to light so that it could be discussed during oral evidence from Mr David Neal? Both issues would be most effectively undertaken with the participation of operational professionals, especially Border Force staff. Research methodology for working with criminal justice professionals (police officers/staff at all ranks, C PS and defence lawyers) affected by digitalisation challenges is becoming well established.[6]

2. 4 With so much change at UK, Schengen and other borders likely to occur within a particularly short period – the introduction of ETA (at least two high volume implementations to come), EES and ETIAS – UK and EU border management systems may (in effect) be exposed to stress testing, particularly in the UK where EU citizens account for 86% of inward travel and for UK citizens or residents departing for the Schengen zone from travel pinch points, especially Dover. The implementation period could provide unique insights into the resilience of border authorities and their private sector partners to manage change, thus helping to assess and thereby improve border control resilience. (This would include immediate and swift responses to external events such as pandemics and political or military crises.) Lessons would probably be best learned through comparative research, particularly between ETA and ETIAS in a wide range of different operating conditions (eg variously sea, and air travel; public v. private transport and large, small and transit entry points).

2.5. The prospects of early decisions about data preservation/access and research funding would be enhanced by parliamentary sponsorship. As discussed during Q100, the UK-EU Parliamentary Partnership Assembly[7] might be willing and able to lead and coordinate[8] parliamentary input into such research programmes. Such an inter-parliamentary scrutiny focused initiative –that touches on a wide range of activities well beyond security and criminal justice (including multiple forms of cross-border commerce and data exchange) - appears to be consistent with the Assembly being able to fulfil its mandate for working in cooperation with the inter-governmental TCA Partnership Council.[9]

2.6. Research work might begin quickly and modestly by arranging for time sequenced and disaggregated data[10] that is any case being collected for UK government and commercial (location operator and carriers) service standards to be held under access conditions agreed with the data providers at one or more publicly funded academic data depositories to which research projects would later be given access.[11]

3. Q101. (enhanced security)/Q102 (interoperable databases)/Q105 (real time access to criminal justice and other relevant data/potential gaps)

3.1 The basic architecture of internal EU/Schengen Area data sharing criminal justice, security and border management has been clear from at least 2016, though the following example is now dated because of the absence of any reference to ECRIS-TCN data (third country national conviction within EU member states information):

3.2 Comparable information about databases accessible for similar purposes by UK authorities is not, to my knowledge, publicly available. Partly, I suspect, because until 2020 the UK was largely integrated into the EU arrangements which was the predominant source for reliable criminal justice information and benefited greatly from real time access via SIS II. The UK may have had a better record than many EU Member states for publishing information about third country cooperation. Publications indicated that non-EU conviction information sharing was primarily based on a group of Caribbean Commonwealth countries and the statistics published annually served to emphasise that - consistent with Commission/CJEU enforced legal obligations under the EU treaties and the Schengen Area as the place of departure for most travellers to the UK, conviction data sharing was for the most with EU member states. Major efforts were being made to extend this through cooperation arrangements with the FBI and the government of India etc..[12] In more recent years, such information appears to be less readily available or is far less easy to find. It is unclear whether efforts to extend information sharing to countries such as India have worked and, if so, how human rights and data privacy protections are enforced.

4. Q103 (funding border controls)

4.1 The Cameron administration decided that by 2019–20 border control and the immigration system (excluding asylum functions) should be cost neutral (no net public sector funding).[13] By 2017-18, NAO analyses indicated that 89% of the cost of the UK border control and immigration system was funded directly by those – including UK citizens - crossing the border, or anticipating such travel or seeking to establish their legal status to do so. This was to be achieved through substantial cross-subsidy from purchased services such as passports and visas.[14] The current position is not quite so clear because the NAO departmental overview focus has changed – probably because the target has been achieved - and surplus income from visas and passports will also be augmented by any operating profits from civil registration services (e.g., births marriages and deaths) in England and Wales that are now managed within the Passport Office. Ignoring capital investment (agreed by the government and designated opposition to be fundable via borrowing), however, the 2022-23 outturn shows an operating surplus for this element of Home Office activity[15] of £3,166,254,000 (equivalent to 225% of the cost (£1,404,808,000) of borders and enforcement this categorisation[16] appears to be consistent with the intention behind the earlier ‘cost neutral’ target). [17]

5. Q106 -107 (the significance of its EU membership for border control cooperation with Ireland)

5.1 This is an issue where Dr Vavoula is probably better qualified than me to comment, but from an analysis of extradition law, EU membership prevents member states from breaching EU human rights law when assisting third countries under international conventions, such as the Council of Europe (CoE) Convention on Extradition, and, I believe, other forms of bilateral cooperation.

5.2 The Court of Justice of the European Union (CJEU) held in I.N/ Ruska Federacija that:

…. in the absence of an international convention on this subject between the European Union and the third State concerned, . . . the rules on extradition fall within the competence of the Member States. However, as is clear from the Court’s case-law, those same Member States are required to exercise that competence in accordance with EU law … .[18]

For Ireland, as an EU member, its ability to cooperate with the UK will be influenced by how all inter-jurisdictional cooperation ‘rests on a bundle of rights and obligations from which it is not easy or in some cases possible to extricate certain instruments, especially from the outside’.[19] Hence, when responding to Q107, I drew attention to the offer in the draft treaty published by the European Union in March 2020 that would have enabled the UK Government to initiate or to become a party to any proceedings before the CJEU that touch on its TCA relationship with the EU or EU member states.[20]

6. Q108 (outstanding issues)

6.1. One first issue stems from my initial research into electronic border management when official websites that allow travellers to apply for electronic advanced travel systems and visa applications tend to appear significantly after advertisements by agents and intermediaries. For example, one site (after indicating very clearly that the government ETA fee is £10.00 and posting disclaimers about any kind of affiliation to government agencies), offered the following options and prices (inclusive of the £10.00 fee):

Standard - 5 days: Price per applicant USD $112.99.

Rush - 3 days: Price per applicant USD $177.99.

Super rush - 2 days: Price per applicant USD $269.99.

6.3. These timescales seem slow compared with published official target processing times. Such marketing might be read erroneously as implying that such a firm can deliver ETIAS approval faster than a direct application. Presumably there are no government arrangements to allow VIP access via such agents and intermediaries. I don’t know, however, if the government can ensure that search engine providers are obliged to train its search algorithms and report search results so that (a) the official service address appears first; (b) it is clearly labelled as the official site; and it is made clear in the initial content that private providers cannot access routes to quicker decisions. If an applicant is seeking advice or assistance, that is a different matter.

6.4. During the discussion about passports because of time constraints, I did not raise the question of whether the biometric information (the applicant’s photograph) is securely linked to alphanumeric data in official records during the initial enrolment and when changed on renewal. A great deal of effort has been made over several decades to improve the physical integrity of passports, but it is unclear whether potential weaknesses in linking passports to official records has been equally addressed, possibly in a consistent manner by the UK and other pluralistic democracies. For example, information about educational attainment appears to be collected only for ETIAS, or is all the same information in fact also somehow captured for ETA and ESTA, and are the overall results of information collection and analysis a consistent and easily comparable alphanumeric identity across all three systems, while ensuring that the collection of data is proportionate and not unnecessarily intrusive?

6.5 It certainly looks to an outsider as if more significant risks to the integrity of border control may result from how biometric identifiers and key personal details are linked to a passport/identity card holder’s profile. In the UK lifetime passport profile creation safeguards – the production of a birth certificate that can be ordered online and generally unverifiable/unverified attestation of identity by a professional or other person of standing within the community -are particularly weak. This was illustrated by how undercover police officers, mimicking a process publicised in a novel and film, stole the identity of dead children.[21]

6.6. Just as personal data has to be refreshed every two or three years for ETA, ETIAS and ESTA, perhaps governments could better guarantee the match between the demographic profile and biometric data incapsulated in a passport or ID card if it is linked with dynamic citizenship record-keeping (eg health, social welfare/state pension contributions/payments, voter registration and, after a certain age, following the US precedent, annual tax returns)?

7. Corrections and clarifications

The correction of an error in my written evidence (as mentioned in reply to Q108), EBM0006, para. 1.1 and n.3): hidden wiring, not ‘hard wiring’.

O102 (algorithmic accuracy) what I described as a ‘a very tight margin of difference’ is better explained as: where the statistical correlation between different data sets (eg an ETA record and an e-gate image algorithmic analyses of data collected at the gate) results in a correlation score that is very close to the set threshold between rejection or acceptance.

Q109 (ACRO): ACRO was the acronym for the ACPO Criminal Records Office. With the replacement of ACPO by the NPCC the organisation’s name changed to ACRO Criminal Records Office. It has always been abbreviated as ACRO.

22 April 2024