Digital Identity

Theatrical

[Dave Birch] I was in the US recently, and had occasion to visit a number of office buildings. At some of these, in order to comply with security requirements, I was asked to provide "picture ID". A couple of times, I produced my UK driving licence, which the guards looked at and then handed back, waving me through, despite the fact that they couldn't possibly have known whether it was real or not. So what was the point? This is what is called "security theatre", where the people involved (in this case, me and the guard) are both acting out our scripts to show security to the people around us. No actual security is involved. Were I a devotee of Osama bin Laden trying to get in to one of these buildings, I would simply have my accomplice call to make an appointment (perhaps posing as a security equipment salesman) using the same John Smith and then show up with a Western Australian driving licence in the name of John Smith with my picture on it. In fact, I'd lay a pound to a penny that I'd get in with Narnian driving licence. What is going on? If I'm going to see a contact at BigCompany, could he just use his digital identity to sign my Consult Hyperion public key, thus creating a credential certificate that I could load into my phone and that the guard could read using his PC, and which his PC could then resolve up the certificate chain to determine, in milliseconds, that I am entitled to enter the building?

In fact, what would be the point of the guard at all? I could just wander up to the building and present myself to the door: the door would ask my phone for a certificate, the phone would present it, but only if I am holding it (by my voiceprint, for example). That wouldn't be theatre.

government, ID cards, passport , smart cards

Don't call us

[Dave Birch] I had a new phone line added to my home office recently: I find about one message a day there from companies offering to consolidate my debts into a single loan with one easy monthly payment and suggesting that a new law means that I may not have to repay my bank loans or credit card debts at all. Since there are very few people who know my home office number, I assume that either Virgin sold the new number details to some loan sharks or that they are simply autodialling all numbers except those registered with the telephone preference service (TPS). (To be fair, my home number is registered with the TPS and it never gets these calls, so the system clearly works, so instead of moaning about it on a blog I really should call the TPS again).

The TPS is a practical "sharp end" privacy issue. Another case study. A mobile phone number directory was launched in the UK. I immediately wondered how to get off of it. So I asked for advice on Twitter, and the posse (I prefer that to "mob") told me to text "E" to 118 800, which I did. You could also opt out online, which so many people did that the system crashed.

But what's interesting is how violently people now feel about their privacy. In an age when many are apparently happy to share intimate details of their lives on social networks - even shots of their husbands in their swimming trunks - it seems that we feel our mobile numbers are uniquely private.

[From BBC - dot.life: 118800 and a web revolution]

Ultimately, as you may remember, the uproar continued until...

the controversial mobile phone directory service 118 800 had been suspended.

[From Datonomy: UK mobile subscribers revolt against new directory]

So why were people so upset? Why don't they do what I do? I'm not that bothered about the unsolicited calls to my home office number because all calls are screened: I don't pick up the phone unless the number is recognised, and if it isn't recognised I always let it go to answering machine. I never answer a call on my mobile phone unless the caller ID is displayed from my contact book: if you're not in my contact book, you have to leave a voicemail. This works fine. But the issue isn't the practicality, it's the principle. As Robin Wilton wrote at the time

The issue here, to my mind, is one of informed consent. I can honestly claim that I have never knowingly disclosed my mobile number for the purpose of having it listed in a directory enquiries service.

[From Racingsnake - the blog of Future Identity: Mobile Directory Enquiries still broken]

Now I am theoretically ex-directory. (And to be fair, to date, I haven't received any unsolicited commercial calls on my mobile.) The database of 42 million mobile phone numbers still remains, however.

identity, management, privacy, security

Identity is the new money

[Dave Birch] There's a lot going in the world of identity, as anyone following this weeks Internet Identity Workshop will attest to. A decade after the web went mass market, we still have no mass market identity infrastructure in place, despite all of the efforts made by a wide variety of suppliers, standards bodies, open source groups and governments. It's not because there aren't technologies that can help -- there are plenty -- but because the technology is only part of the problem. The key technologies, in fact, are pretty well understood and in "closed" systems such as the DoD they are already deployed on a large scale (and here there has already been some progress on interconnection).

For example, Northrop Grumman is preparing to issue its new OneBadge identification cards to thousands of employees. The OneBadge card design and policies meet federal and DOD standards, said Keith Ward, director of enterprise security and identity management at Northrop Grumman. The company expects to be one of the first federal contractors to use a centralized public-key infrastructure as part of its identity management program, Ward said. The company participates in CertiPath, an entity created by several defense contracting firms that is part of the federal government’s trust network through a bridge relationship with the Federal Bridge Certification Authority.

[From Contractors prep interoperable identity management systems]

Look at all of the technologies that are in place here: PKI, smart cards, certification, federation and so on. Nevertheless technology is an important part of the equation, and we need to pay attention to the emerging technologies, because it will take some real effort by a coordinated industry grouping in order to get worthwhile (ie, involving tamper-resistant hardware) authentication deployed and this will need to be linked to a framework (such as the new OpenID Connect) that can easily be adopted by web sites, mobile services and across other channels.

One such grouping is obviously banks and payment schemes. And here, I think, there is a growing recognition that identity and authentication need new thinking.

The Visa card with one-time code offers banks an innovative solution to authenticate consumers through an alpha-numeric display and a 12-button keypad built into a conventional credit, debit or prepaid card. It is a neat solution for consumers to use and also contains a battery designed to last three years. The product has been developed in conjunction with EMUE technologies.

[From Leading banks join pilots of the innovative Visa card with one-time code]

Over on the Digital Money blog, we're always very interested in developments in identification and authentication. Why are these these so important in the payments world? I think that the dynamic is this: if there is an infrastructure in place to manage identity, and that infrastructure includes clear division of responsibilities and clear assignment of legal liabilities, then it takes a big chunk of the costs out of building and running a new payment system. A general trend in the next phase of electronic payment evolution will be the unbundling of the payment, the identification and other services (such as fraud management).

There are different opinions about how the unbundled identification part might be implemented. I've written before that I think that a mobile, SIM-based approach might be the best way forward. The SIM provides the tamper-resistant hardware that we need to store the keys, the mobile phone provides the connectivity and interfaces and mobile operator provides the business model. There has to be a business to make identity work.

So what is the business model? For the operator, it’s incremental messaging revenue; in the first deployment, with Turkcell, the identifications were charged at the same rate as text messaging. According to Turkcell, this resulted in an average of 21 extra messages a month for each user who signed up for Mobile Signature; as a typical user sent 95 messages a month, that amounts to a 20% boost to messaging ARPU.

[From Case Study: Mobile Signature solution approaches key growth milestone - Convergence Conversation]

There are plenty of other possibilities, and if anyone tells you they know how this will work out, they're wrong. But if they tell you that identity and authentication technologies will shape future payment strategies, they're right. As I heard someone remark in a meeting a few months ago, if I were a bank, I'd want to be part of the identity value chain rather than a commoditised and low-margin payments value chain.

banking and finance, identity, management

Back to the future of the ID card

[Dave Birch] Well, it's bye bye to the ID card. In the end, I shouldn't think that my constant whining about the scheme made a ha'pence of difference and my time on the IPS Advisory Forum was probably wasted. I did make representations (invited, I hasten to add) to a couple of Conservative think-tanks in the run-up to the election, having previously made a number of representations (invited, I hasten to add) to the Government and its advisors. What I said was, in essence, that the Tory plan to scrap the ID card was almost as bad as the Labour plan to keep it. Neither the existing scheme nor the Coalition scheme (ie, nothing) actually solve any of the problems that the lack of an identity infrastructure creates and I absolutely predict that the lack of such an infrastructure will in turn create a major barrier to improving efficiency in public services: it's going to be really difficult to move government services online, introduce more self-service and reduce fraud without some form of identification and authentication system.

It's fair to observe that there a many people (eg, the LSE team who did the original detailed review on the Home Office's ideas) are enjoying their "told you so" moment. The old scheme, created by the Home Office and their development partners PA Consulting back in 2004, was never going to work. It was flawed from the start, and as a showcase for the British technology industry, it was an embarassment: it provided none of the services that the identity cards systems in advanced nations (eg, Germany, Hong Kong, Estonia) provide and there was never any evidence that it would do so. There were no specifications, no toolkits, no APIs. I should say that I don't blame the people working on the project over at IPS, many of whom I have great respect for: the project was doomed before they started work.

There has been no single narrative explaining what deficiency the card is supposed to address: instead, it has been sold as a cure-all remedy for a host of problems. One minute it was touted as tackling illegal immigration or benefit fraud; the next it was the magic bullet for terrorism and organised crime.

[From FT.com / World - MPs deride £5.4bn cure-all]

Indeed, and the card that was built was not only pointless but functionless, implementing nothing more than the existing e-passport application. It wasn't as if they didn't have the money to scour the planet for the best advice.

In 1997/98, the Home Office's total spending on consultants was £7.6m. By last year, it had rocketed to £147.9m. Spending by the Identity and Passport Service - the arm of the department in charge of the ID cards project - has gone up in the same period from £237,000 to £30m.

[From High price of launching ID cards as consultants cost us £150m | the Daily Mail]

I can well remember taking part in the "consultation process" at the time. I can also well remember feeling rather angry about it: no-one paid any attention (as far I could tell) to any ideas or opinions about the scheme or the vision for identity management, only about the procurement process. In particular, just as the Home Office never paid any attention to our submissions about the original entitlement card concept (more on this in a minute), they never paid any attention to any modern conceptions of identity and set about building an electronic version of the scheme was abandoned in 1952. An electronic version of a paper card and an electronic version of a card index. There was always an alternative...

Many people do think eID could and should be implemented without full identification, i.e. more granular disclosure with pseudonymity - see e.g. Dave Birch's brilliant and very readable paper "Psychic ID: A blueprint for a modern national identity scheme" (PDF).

[From Tech and Law]

WH is much too kind, but there you go. Anyway, we are where we are, in an identity limbo. Where do we go from here? It's traditional for incoming administrations to want short and simple instant fixes, so here's a practical three point plan...

1. Turn the "Identity and Passport Service" back into the "Passport Service" and rebrand the current ID card as "Passport Plus", an optional extra for people who are applying for or renewing passports.
2. Start an accelerated consultation process for an Entitlement "Card" that will be mandatory within the lifetime of this Parliament for access to public services.
3. Publish an API for using the service and provide open source software for people to start building services.

I say "Card", of course, because any such plan would distinguish between the identity application that might reside in a smart card, phone, watch, hat, badge or implantable microchip and the smart card, phone, watch, hat, badge or implantable microchip itself. So, my Entitlement Card might have an identity application on it and my mobile phone (SIM) might have an identity application in it and they both have public key certificates with the same link to my entitlement number (or whatever) in it. I'll have to turf out our original response to the entitlement card consultation process and tart it up.

The toolkit of technologies needed to do this -- everything from digital signatures to biometrics to NFC to OpenID -- is already in place. By going back to the original version of the government's pre-Blunkett plan, the government and the industry together can create a more targeted project that can actually contribute to UK plc. I have to say, as an aside, that Consult Hyperion's experiences advising the Irish government on their Public Services Card project has reinforced to me that focusing on a clear, simple and specific goal makes a very, very big difference to national infrastructure efforts of this kind.

banking and finance, government, ID cards, identity, management

Will mobile phones mean more crime?

[Dave Birch] There was a discussion at this year's Digital Money Forum with David Nordell from the Terror Finance blog. He called mobile payments a terrorist's dream, but I disagreed. People always see the worst in new technologies, projecting existing crimes on to it. But the ability of new technology to fight crime is surely just as great. Mobile phones are no different from any other technology in that respect. One the one hand mobile phones can be used to commit new crimes, but on the other hand they can be used to prevent, detect and solve crimes.

Recently, two death row inmates were arrested in Nakuru GK Prison after being tracked through the assistance of mobile services firm Safaricom. More than 10 mobile phones and a number of SIM cards that were used to transact more than Sh300,000 were confiscated. The inmates colluded with people outside the prison to provided them with phone numbers of wealthy people who they called and threatened with death if they did not follow orders. Police launched investigations into how the convicts had separately received Sh350,000 and Sh40,000 in their welfare accounts when the racket that was unearthed in February.

[From Daily Nation: - News |Police probing mobile money transfer racket]

Nice mobile payment application -- call people up, get them to send money back via the mobile payment system -- but only if you're a really stupid criminal, since the phone company knows where you are and will tell the police. And the police will be able to track you, and they will know the details of anyone else you call. And it doesn't matter if it's a prepaid phone not registered to you, because knowing where you are and who you are calling is pretty useful information.

The tracking is especially useful and in the future we will come to accept that we know where stuff is, all the time. As an aside, this doesn't mean the end of privacy, but I think it does mean new notions of privacy.

Within seconds, a Tampa map appeared with a blinking orange dot moving away from the park. "We're thinking to ourselves, there are our cell phones going down the road," Jennifer Jensen said. The dot left the park, headed down McKinley Drive, headed south of Fowler Avenue and stopped less than 4 miles away from where it started... Caroline switched to satellite mode, and they were suddenly looking at the outside of the Bentley Court Apartments, 11603 N 22nd St.

[From There's an app for that, too — Tampa cops find stolen iPhones with GPS - St. Petersburg Times]

At one level, this is just a fun "there's an app for that story". But think about it more as a window into the "internet of things" future. When everything is connected to everything else across an infrastructure then the idea of stealing something will become outdated (although, to be fair, some idiots still rob banks with shotguns). What's the point of getting into my car if you can't drive it without my RFID keyfob, what's the point of stealing my TV if it will only decode encrypted signals if it is in range of my router and what's the point of running off with my mobile phone if it won't allow you to make calls unless you can mimic my voice? And what's the point of stealing any of them at all if I can log in to any computer anywhere in the world and see where they all are?

crime and fraud, identity, mobile