About The Blog

Debate at the intersection of business, technology and culture in the world of digital identity, both commercial and government, a blog born from the Digital Identity Forum in London and sponsored by Consult Hyperion

Advertisers

Technorati

  • Add to
Technorati Favorites

License

  • Creative Commons

    Attribution Non-Commercial Share Alike

    This work is licensed under a Creative Commons Attribution - Noncommercial - Share Alike 2.0 UK: England & Wales License.

    Please note that by replying in this Forum you agree to license your comments in the same way. Your comments may be edited and used but will always be attributed.

91 posts categorized "Privacy and Security"

In a bit of a State

By Dave Birch posted Jan 26 2010 at 7:57 AM

[Dave Birch] If you build a stable door, then one day you will inevitable find yourself locking it while your horse disappears over the horizon. There's been no better illustration of this in recent times than the recent hulabaloo about Google in China. Apparently, Chinese "hackers" were found it rather easy to break into the e-mail accounts of human rights activists and so forth, because Google had been forced to build a system to do precisely that.

That's because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. "Right before Christmas, it was, 'Holy s***, this malware is accessing the internal intercept [systems],'" he said.

[From Google attack part of widespread spying effort]

So companies are forced to build a stable door, and then when the inevitable happens, people appear shocked. The root problem is, naturally, that there is no underlying strategy: we fight using the technology of the next war but the tactics of the last one, as someone once said but I couldn't find out who by googling. If you want proof of this, you only need consider the US government's official response to the incident in a speech by the Secretary of State, Mrs. Clinton, that cofnirmed one of my most basic criticisms of government policy in this cyber age:

The speech made it obvious that State Department officials do not have a coherent view on online anonymity. On the one hand, they want to crack down on intellectual property theft and terrorists; on the other hand, they want to protect Iranian and the Chinese dissidents. Well, let me break the hard news: You can't have it both ways and the sooner you get on with "anonymity for everyone" rhetoric, the more you'll accomplish.

[From Is Hillary Clinton launching a cyber Cold War? | Net Effect]

In fact, US (and other governments') policy in this area isn't just confused and pointless, it's actually dangerous. While I was googling for references, I discovered that the always sensible security expert Bruce Schneier had used this story to make the same point.

The news here isn't that Chinese hackers engage in these activities or that their attempts are technically sophisticated -- we knew that already -- it's that the U.S. government inadvertently aided the hackers.

[From U.S. enables Chinese hacking of Google - CNN.com]

You can't have privacy without security, as the relatively old saying goes. Ah, you might object, but there's a greater good argument: security without privacy is the only way society can fight the bad guys. We must be able to read people's Google mail accounts because we need to track down criminals and terrorists. And, indeed, this is sort of true. If you know that Osama bin Laden is sending me e-mail, then you might want to investigate me a little further. And I imagine that obtaining the contents of all of my e-mails, from Google, might be a convenient way to do it (although, of course, if I am a terrorist and I know that government is able to read my mail, then I will send misleading e-mail and use an alternative secure channel to conference my confederates). Anyway, you think I'm a bad guy so you want to be able to go to Google and get all my mail. This already happens, in fact.

Prosecutors obtained a CD-ROM disk from Google Inc. this week of Mr. Tannin’s e-mail messages from Nov. 20, 2006, through Aug. 12, 2007. The two funds collapsed in June 2007. Mr. Cioffi, 53, and Mr. Tannin, 48, were indicted for fraud, and Mr. Cioffi also was charged with insider trading, the first managers accused of criminal charges from a company that collapsed in the financial crisis. The hedge funds’ failure cost investors $1.4 billion.

[From E-mail Shows Fear of ‘Blow-Up Risk’ at Bear Fund - DealBook Blog - NYTimes.com]

To be honest, I'm not sure what the fuss is about. If you send something in an e-mail, then as far as I am concerned you have no reasonable expectation of privacy. If you wouldn't put it on a postcard, then you shouldn't put in an e-mail (was it Phil Zimmerman of PGP who first said that?). If these hedge fund guys really wanted to send secret messages to each other then they could have used anonymous comments on an obscure blog, rolling IM accounts changing in a pattern known only to them or, ahem, encryption. Havent't they ever watched the world's best TV drama, "The Wire"?

So I'm not saying that prosecutors shouldn't try to go and get these e-mails. But should they get them from Google? I have a book on my shelf somewhere -- the title won't come to mind -- which says that, essentially, the government doesn't regulate books because it can't and it does regulate TV because it can (this was a few years ago). Surely this is what is going on here. It might be harder to nail those guys without a copy of their Google e-mail, but is it plausible that without the Google e-mail they will get off? Well, in this case they got off because of the e-mails, as far as I can see.

the prosecution blew it — on two counts. First, in devising the original indictment for conspiracy and securities fraud against the two defendants, Ralph Cioffi and Matthew Tannin, it relied on damning snippets of lengthy e-mail messages that when viewed in their entirety proved to be highly ambiguous. Second, the prosecution made a reductionist opening argument claiming the men were nothing more than out-and-out liars, needlessly raising the bar in terms of what it had to prove to jurors

[From Bear Stearns Trial: How the Scapegoats Escaped - DealBook Blog - NYTimes.com]

Suppose you are a policeman. If Osama bin Laden is sending me e-mail every day, but you can't get the contents of those e-mails from Google or BT, is that worse for society than Osama bin Laden being able to read all of your e-mails? The mere fact that I'm getting e-mail, text message or care packages from a cave in Afghanistan is enough for you to put me under surveillance and from then on other methods can take over. Look, I don't know what the answer is either, but I do know that there is a question, and therefore understand that there is a danger

Continue reading "In a bit of a State" »

Jorge Krug, Banrisul

By Dave Birch posted Jan 5 2010 at 12:34 PM

[Dave Birch] Jorge F. Krug is the head officer of the IT Security Division of Banrisul, State Bank of Rio Grande do Sul, Brazil, and has a seat in a number of IT associations and committees, including Brazilian Bank Association (FEBRABAN)’s Digital Certification Committee, Sucesu-RS (Society of Computer Science and Telecom Users of the Rio Grande do Sul State), ASBACE (Brazilian Association of State and Regional Banks). Mr. Krug is also the head of AC-RS (Rio Grande do Sul State Digital Certification Authority). In this podcast he talks about the introduction of the Banrisul EMV card with PKI on board, a project previously discussed in detail on this blog.

Listen here in either [Podcast MPEG4] or [Sound-only MP3] format.

Continue reading "Jorge Krug, Banrisul" »

Trans-mission

By Dave Birch posted Dec 3 2009 at 10:22 PM

[Dave Birch] Should people be allowed to have "anonymous" prepaid mobile phones (well, SIMs) or not? It's a simple question, but a complicated subject. And it's worth exploring because it helps us to have a real, focused discussion about practical privacy and security issues. The subject came up because of one of the current hot topics in the UK, which is the government's proposed "crackdown" (although "crackup" might be a better description) on the authorised copying of copyright material. Once the government has disconnected most broadband users in Britain through the "three accusations and you're out" policy, many desperate internet addicts will be driven to using mobile connections to continue online banking, reading about "I'm a celebrity get me out of here" behind the Murdoch paywall and playing World of Warcraft. At which point, the mobile operators will come under pressure to start disconnecting people as well. But as the always spot-on mobile industry analyst and Forum friend Dean Bubley notes

"On one hand, the government's trying to encourage internet connectivity — bridging the digital divide — but a lot of people in lower socioeconomic groups are on prepay, and the vast majority are anonymous," Bubley said

[From Mobile industry 'cannot identify pirates' - ZDNet.co.uk]

So the mobile operator won't be able to turn over the name and address of the supposed copyright pyrate. When the letter from Apple Corporation arrives at Vodafone asking them to turn over the name and address of the person who downloaded "Love Me Do", Vodafone won't be able to tell them (so presumably Vodafone will then be found in contempt of court or something and their internet access will be turned off).

So what to do? Well, one approach (followed in many countries) is simply to force all prepaid phones to be registered with the authorities. In the UK, the government might use its splendid new national identity register, for example, to ensure that all prepaid phones have a passport or national identity card connected to them them. And, as in Spain, take immediate action against those terrorists, money launderers, child pornographers and criminals who refuse to do so.

Spanish mobile operators last night cut off an estimated three to four million pre-pay mobile phones whose owners had not followed government instructions to register their devices.

[From Spain cuts off 3m pre-pay mobiles • The Register]

I can see exactly why law enforcement and government agencies object so strongly to anonymous mobile phones (although they still allow people to post letters anonymously) but I think they are wrong to react in this way. The truth is, the criminals will just use other peoples' phones and will be even harder to track and trace than they were before.

Consider the most prosaic of examples. Where I live, in a deprived part of Europe called "Surrey", a window in the house opposite to ours was smashed by a gang of feral youths. Sadly, we didn't see this happen so we unable to assist the local constabulary. But suppose I had seen it happen? I have, currently, four prepaid mobile phones about my person (they are used for various demos and experiments for work) so I would have just picked up one of these phones and called the police with the details of the incident and a description of the yobs.

But now suppose that my prepaid phones were now connected to me through the national identity register? Now there's no chance that I will pick up one of them and report the crime, because I'd be worried that my name and address would get (via the police or the database) to the gang in question.

This may be a silly example, but from battered women to corporate whistleblowers there are plenty of good reasons for allowing anonymity. We need this to be part of the infrastructure.

All this does prove, though, that there is a legitimate place for digital anonymity, and I hope that any identity management system required by the US government and others will allow anonymity and not prevent it.

[From Tech and Law: Technology, domestic violence, anonymity]

Note the important qualification here: there is a legitimate place for "digital anonymity". I would go further than that and say that without digital anonymity, we are creating the wrong kind of infrastructure for a successful and prosperous society. Now, your web site may choose to allow or decline access by digitally known, pseudonymous or anonymous identities. If you are a web site discussing Iranian democracy, you may well insist on the latter. If you are government department, you may insisit on the former. The infrastructure must cope with both.

Continue reading "Trans-mission" »

Verily

By Dave Birch posted Nov 25 2009 at 10:43 PM

[Dave Birch] I enjoyed Scott Silverman's talk about privacy and security at ID World. Scott (the devil, according to CASPIAN) is the CEO of Verichip, the company that developed the first FDA-approved RFID chip for human implantation. (It's just a passive RFID chip containing a 16-bit identification number). Apparently, they had had some 900 emergency rooms across the US signed up for the service before the "privacy backlash" started. Opponents of the system told the newspapers that the chips caused cancer, and that was that.

Now, to be honest, I'm very sympathetic to Scott. A couple of years ago, I contacted Verichip because I thought it would be fun to have a Verichip implanted in my arm ready for the Digital Identity Forum, but they said no (spoilsports). My cat has one, and I'm jealous.

Anyway, the point is that the privacy backlash was so great that the stock price collapsed and the company -- which was reduced to a shell -- has now been restructured as PositiveID with Scott as the majority shareholder. They have a number of initiatives, one of them being "PatientID" which will link high-risk patients (eg, Alzheimer patients) to their medical records. Now, as far as I can see (and I'm speaking from the point of view of someone with an Alzheimer's sufferer in the family) this is a splendid idea. I'm pretty privacy sensitive, but this is an application that makes absolute sense to me. If I had Alzheimer's, I'd want a chip so that if I get lost or confused, a doctor can instantly find out who I am and what my conditions and medications are. You could do it by fingerprinting me, or iris scanning or whatever. But it appears to quick and simple to use the chip instead.

Scott also mentioned their "HealthID" initiative that will link sensors to the chip: so, for example, you could have a glucose-sensing chip for some types of diabetes so that when the chip is read to identify the patient it will also report glucose levels. If I had diabetes, I would much rather have one of these than prick my finger and test drops of blood. I wouldn't want everyone to be able to read it though, and this is where the problem comes: we need to have some form of standard privacy-enhancing infrastructure that sits above the "chip layer" to make this all work properly.

Continue reading "Verily" »

Out of control, up to a point

By Dave Birch posted Nov 17 2009 at 12:04 PM

[Dave Birch] I re-read an excellent post over at Emergent Chaos. It reflected an important discussion between two people, both of whom I take very seriously. To paraphrase and simplify horribly, Bob thinks that the social structures maintain privacy, Adam thinks that technological structures maintain privacy.

In a world where some people say "I've got nothing to hide" and others pay for post office boxes, I don't know how we can settle on a single societal norm. And in a world in which cheesy-looking web sites get more personal data — no really, listen to Alessandro Acquisti, or read the summary of "Online Data Present a Privacy Minefield" on All Things Considered... -- I'm not sure the social frame will save us.

[From Emergent Chaos: Bob Blakley Gets Future Shock Dead Wrong]

The lack of a "norm" is a good point here, and I have to say it made me think. We should be developing tools that allow people to construct their norms (within boundaries, obviously) but not setting out a norm so that the tools can only implement one model. For this reason, amongst others, I tend to come down on the more technological side of this argument, which is why I'm so keen to see privacy as part of customer propositions and privacy-enhancing technologies as part of the systems being built in both public and private sectors.

Continue reading "Out of control, up to a point" »

Close enough for jazz

By Dave Birch posted Nov 4 2009 at 6:40 PM

[Dave Birch] I had a typical fascinating and productive discussion with Hazel Lacohee and Piotr Cofta when we last got together. We were kicking around some ideas for finding practical ways to improve privacy, security and other good stuff while simultaneously worrying about the government's approach to the interweb, broadband and ID cards. With the right combination of technology and vision we can take an entirely different view of the "identity problem" and how to solve it. In a decentralised fashion we can see identity develop as an emergent property of trust networks, shaped by evolution to be fit for purpose or, as Piotr Cofta puts it, "good enough identity". Good enough identity (GEI). I love it.

I'm certain that there is merit in this approach. There is a real difference between between trying to create a kind of "gold standard" identity that delivers the highest possible levels of authentication and identification in all circumstances and trying to create an identity that is useful (defined by: reduces total transaction costs and, in my world, aligns social costs with private costs). Therefore, a utilitarian approach of trying to do something, anything to make the identity situation improve for individuals and organisations, we might be better off starting with some simple building blocks and building up rather than by starting with a national ID card (I mean, a 21st-century national ID card of the psychic ID kind, not electronic cardboard) and driving that down. Go from the personal to the enterprise, from the enterprise to government.

Continue reading "Close enough for jazz" »

What a cunning stunt

By Dave Birch posted Oct 28 2009 at 9:19 PM

[Dave Birch] I am, very literally, green with envy. I count myself as a reasonably good speaker, and I try to use narrative and historical examples to explain key principles. But nothing beats a good demo, and I saw an excellent one today, one that I wish I'd thought of!

At the Intellect conference on Identity & Information in London today, Edgar Whitely from the LSE gave a terrific presentation. He was pointing out that the principle of data minimisation in identity systems is important, but he did it in a particularly arresting way.

Here's what he did.

He showed this recent newspaper photograph of the British Home Secretary, Alan Johnson, showing off his new ID card and holding it up to the camera. This version comes from The Guardian....

Alan Johnson reveals the design of the British national identity card

Alan Johnson reveals the design of the British national identity card. Photograph: Stefan Rousseau/PA

As you can see in the picture, for reasons that will be not fully explained in a moment, the UK ID card has the holder's full name, date of birth and place of birth on it. These three data points are sufficient to uniquely identify the overwhelming majority of the population. So Edgar went to the Identity & Passport Service birth certificate ordering service and put in the details from the Home Secretary's card. He then paid his £10 and... with a suitably theatrical flourish, Edgar produced the copy of the Home Secretary's birth certificate that he had been sent in the post. Note that Edgar hadn't done anything wrong. As James Hall, the head of IPS who was on the same panel, pointed out, in the UK anyone can order a copy of anyone's birth certificate. He said that if you are a celebrity then hundreds of people will order copies of your birth certificate every year, which had never occurred to me. I'm sure James is right, but it does seem a little odd that people who want to commit identity theft will simply have to look at their mark's ID card to get started.

Edgar hadn't used the birth certificate to open a bank account or get a driving licence or anything, he was just making the point that if we don't adopt the right principles (eg, data minimisation) for identity systems, then we run the risk of making identity theft worse. It was a great presentation and a super stunt. Well done.

Anyone familiar with my deranged rantings about psychic ID (ie, virtually nobody) will be familiar with the general point: a characteristic of a 21st-century ID scheme is that it should only give up information necessary to enable a transactions, nothing more or less. So, if you are authorised to ask my ID card whether I am over 18 or not, that's all it should tell you. Not my name, not my address, not my age or date of birth. Just whether I am over 18 or not and that's it.

The current ID card scheme does not have this key characteristic, not for any functional reason but because the ID card and passport were jumbled up for a political purpose -- the purpose being, as far as I know, to make it harder for an incoming administration to scrap the scheme -- that constrains the design and implementation. Since the government wants the ID card to be used as a travel document within in the EU, it has to have certain human-readable information on it. That's why it gives away the key data points that make it tempting for criminals to kick-start their identity theft antics.

Continue reading "What a cunning stunt" »

The DNS of the industrial bourgeoisie

By Dave Birch posted Oct 19 2009 at 11:30 AM

[Dave Birch] I have a vague memory -- which five minutes googling cannot substantiate and I'm too lazy to go and find the book in the other room -- that somewhere in the Gulag Archipeligo by Aleksandr Isaevich Solzhenitsyn there is mention of Stalin's desire to have a more revolutionary telephone system where all calls had to go through a central exchange and be encrypted so that Stalin could listen to everyone else's calls but his would be encrypted to remain secret. The prisoners with relevant skills were supposed to be designing this while in the gulag. It never worked, of course, and the Soviet Union had appalling telecommunications infrastructure as a consequence because the communications revolution was halted by the dictatorship of the proletariat: there's some deep incompatibility between innovation and centralisation. I couldn't help thinking of this when I read about the calls by Eugene Kaspersky to have a more Stalinist internet:

The CEO of Russia's No. 1 anti-virus package has said that the internet's biggest security vulnerability is anonymity, calling for mandatory internet passports that would work much like driver licenses do in the offline world.

[From Security boss calls for end to net anonymity • The Register]

What he means by this is that he wants a technologically complicated and expensive solution to be implemented so that ordinary people are inconvenienced to the maximum while criminals can roam free (which is what would happen). Creating such an asymmetric solution is not the way forwards: for one thing, who would decide what to censor?

A little local controversy involving the Church of Scientology and its critics could lead to curbs on the right to anonymity of anyone using the web.

[From Scientology seeks to squash anonymity • The Register]

We already have experience of this "solution" in the UK. Laws giving a wide variety of bodies the ability to monitor CCTV, the internet, phone calls and everything else which were supposed to save us from international terrorism are used by local councils to stop people from trying to get their children into better schools and to check that people are recycling enough of their rubbish. I'm sorry, but creating a world in which anyone can read anyone else's e-mail, track anyone else's web browsing, see what anyone is reading is not the way stop Russian virus writers from taking over everyone's PCs. We need an identity infrastructure.

Continue reading "The DNS of the industrial bourgeoisie" »

Who says?

By Dave Birch posted Sep 23 2009 at 10:05 PM

[Dave Birch] According to a letter I saw a while ago in The Daily Telegraph, British supermarkets won't accept a British armed forces ID cards as a proof of age, but they will accept foreign ID cards that they cannot read. Or not. It depends what for.

The student's French ID card was not deemed to be sufficient proof of her age for the staff at Sainsbury's, even though the chain does accpet the card from foreign workers who wish to work in the UK.

[From Sainsbury's denies French student]

So you can use your foreign ID card to get a job at Sainsbury's but not to buy a bottle of champagne. Bizarre, but predictable: this is what happens when we jumble up credentials and identification, absent any well-formed rules for understanding or verifying them. It reminded me of the discussion from a few weeks back concerning the distinction between actual security and security theatre. Here's a simple example: you go to open bank account and the bank asks to see identity, so you show them a passport. If it is a British passport, they can phone a Home Office hotline to see if it is real, whether it has been reported stolen and so forth. If it is, say, a Bulgarian passport, they cannot possibly tell whether it is real or not, so they just photocopy it and file the copy away somewhere, just as the British Attorney General should have done with her maid's work permit (since it is an offence is to not to keep a copy of such documentation). Thus, if you are a criminal then you will always choose to use a Bulgarian passport. Honest citizens are inconvenienced, criminals aren't. This isn't so much security theatre as security pantomime, as the BBC have highlighted.

The banks are worried it is still too easy to use a counterfeit passport from abroad to open a bank account, or to get an overdraft or credit card.

[From BBC NEWS | Business | Fake passports prompt fraud fear]

Well, I suppose they could always not open the account unless they can understand and verify the identification documents. The fact is, it's really, really hard for anyone to understand foreign credentials of any kind. Remember the amusing story of the mystery Polish serial traffic offender being tracked by the Irish police?

It was discovered that the man every member of the Irish police's rank and file had been looking for - a Mr Prawo Jazdy - wasn't exactly the sort of prized villain whose apprehension leads to an officer winning an award... Prawo Jazdy is actually the Polish for driving licence and not the first and surname on the licence.

[From BBC NEWS | Northern Ireland | The mystery of Ireland's worst driver]

This does nicely illustrate a key advantage of digital identity over physical identity: this would never happen. If my reader can't understand your card, that's the end of the discussion. There's a nice binary outcome. Where the results depend on human interpretation of shades of grey, surely the system will always throw up crazy outcomes.

An innocent South Tyneside man was arrested because his MoT certificate was a paler shade of green. Michael Cook, from South Shields, had gone to the Driver and Vehicle Licensing Agency (DVLA) centre in Newcastle to renew his car tax. Staff thought his two-week-old MOT certificate was a forgery because it was a lighter shade than his previous one, and the police were called.

[From BBC NEWS | England | Tyne | Arrest over wrong colour MoT form]

Essential to a functional identity system, then, is a cheap and simple "box" for checking whether the card is valid. You put your French ID card, British Forces ID card or Tesco Clubcard into the box at the checkout and the light goes green or red. That's it.

Continue reading "Who says?" »

Good morning, thing

By Dave Birch posted Sep 2 2009 at 9:16 AM

[Dave Birch] OK, so I know it sounds spooky and people are uncomfortable with RIFD-at-a-distance, but there would be some advantages to being "recognised" by machines. Think about the subject from a customer service perspective rather than a security, spying and generally creepy perspective. As, in fact, some people already have been.

The Financial Services Technology Consortium (FSTC) today announced the launch of a project whose goal is to help member banks adopt radio frequency identification technology (RFID).

[From FSTC | Financial Services Technology Consortium - Press & Articles]

Why would banks want to do that? Well, it is relatively easy to implement vicinity (let's say up to a couple of metres) read-only functionality along side the proximity (let's say up to a couple of centimetres) read-write functionality used in contactless identity cards, bank cards and NFC phones. The chip sets are readily available. Handled correctly, this is something that a great many customers would appreciate.

Imagine a world where, when you walk into your bank, messages and adverts pop up that address you by name.

[From What high street banking will look like in 2020]

While The Times might see this as something for 2020, more technologically advanced nations are already experimenting with the technology,

Now "Yes Bank" which is a commercial bank operating out of India has been piloting an RFID system so that bank employees can identify these rich fat customers and offer them personalized services. Under the pilot RFID banking cards have been offered to select customers apart from deployment of RFID interrogators and customized gate antennas at bank premises... The moment the elite customer arrives in the bank his details are flashed on the system which enables the relationship team to identify the concerned person so that they can accord him services in the best possible manner.

[From The RFID Weblog: RFID being used to give preferential treatment to rich clients in Indian banks]

I can readily imagine using a Tesco Clubcard with this technology, or a BA Executive Club card or a transit card. As a consumers, I want to get better service where possible and the idea that everything from shopping cards to airport display boards might know who I am and deliver personalised service because of that is rather appealing. At least, it's rather appealing provided that my identity is managed properly and my privacy is assured. This could be done at a physical level: you might, for example, have a Clubcard that only functions when you press a button on it.

This system creates a tiny, ultra-thin, pressure sensitive switch "which ensures that the device can only be read when the owner is pressing the switch", said Peratech.

[From British firm develops RFID security technology to prevent ‘skimming’ | 20 Aug 2008 | ComputerWeekly.com]

Well, I can see how that might work for a card, although it seems a bit of a hassle in practice. But what about other form factors, particularly form factors that might make it difficult for someone to physically reach the switch. For example:

In times where a lot of hue and cry is being raised over injecting humans with RFID tags here is a video of a guy who seems pretty cool about injecting RFID chip in his hand

[From The RFID Weblog: The Do It yourself Guide to implanting RFID Chip in your hand]

Connecting things up is easy, but disconnecting them is hard! The solution, surely, is not down at the physical layer but in the logical layer above it. Extending the future digital identity management infrastructure to the Internet of things has to be the way forward and if properly designed such an infrastructure could deliver more, I think, thank many people imagine. In particular, such an infrastructure could protect privacy through the judicious use of cryptography rather than through codes of practice or goodwill.

Continue reading "Good morning, thing" »