“Today, I am pleased to announce the latest step in moving our Nation forward in securing our cyberspace with the release of the draft National Strategy for Trusted Identities in Cyberspace (NSTIC). This first draft of NSTIC was developed in collaboration with key government agencies, business leaders and privacy advocates. What has emerged is a blueprint to reduce cybersecurity vulnerabilities and improve online privacy protections through the use of trusted digital identities. “
I say the current draft is historic because of the grasp of identity issues it achieves.
At the core of the document is a recognition that we need a solution supporting privacy-enhancing technologies and built by harnessing a user-centric Identity Ecosystem offering citizens and private enterprise plenty of choice.
Finally we have before us a proposal that can move society forward in protecting individual privacy and simultaneously create a secure and trustworthy infrastructure with enough protections to be resistant to insider attacks.
Further, the work appears to have support from multiple government agencies – the Department of Homeland Security was a key partner in its creation.
Here are the guiding principles (beginning page 8):
- Identity solutions will be secure and resilient
- Identity solutions will be interoperable
- Identity solutions will be privacy enhancing and voluntary for the public
- Identity solutions will be cost-effective and easy to use
Let's start with the final “s” on the word “solutions” – a major achievement. The authors understand society needs a spectrum of approaches suitable for different use cases but fitting within a common interoperable framework – what I and others have called an identity metasystem.
The report embraces the need for anonymous access as well as that for strong identification. It stands firmly in favor of minimal disclosure. The authors call out the requirement that solutions be privacy enhancing and voluntary for the public, rather than attempting to ram something bureaucratic down peoples’ throats. And they are fully cognisant of the practicality and usability requirements for the initiative to be successful. A few years ago I would not have believed this kind of progress would be possible.
Nor is the report just a theoretical treatment devoid of concrete proposals. The section on “Commitment to Action” includes:
- Designate a federal agency to lead the public/private sector efforts to advance the vision
- Develop a shared, comprehensive public/private sector implementation plan
- Accelerate the expansion of government services, pilots and policies that align with the identity ecosystem
- Work to implement enhanced privacy protections
- Coordinate the development and refinement of risk management and interoperability standards
- Address liability concerns of service providers and individuals
- Perform outreach and awareness across all stakeholders
- Continue collaborating in international efforts
- Identify other means to drive adoption
Readers should dive into the report – it is in a draft stage and “Public ideas and recommendations to further refine this Strategy are encouraged.”
A number of people and organizations in the identity world have participated in getting this right, working closely with policy thinkers and those leading this initiative in government. I don't hesitate to say that congratulations are due all round for getting this effort off to such a good start.
We can expect suggestions to be made strengthening various aspects of the report – mainly in terms of making it more internally consistent.
For example, the report contains good vignettes about minimal disclosure and the use of claims to gain access to resources. Yet it also retains the traditional notion that authentication is dependent on identification. What is meant by identification? Many will assume it means “unique identification” in the old-fashioned sense of associating someone with an identifier. That doesn't jive with the notion of minimal disclosure present throughout the report. Why? For many purposes association with an identifier is over-identification or unhelpful, and a simple proof of some set of claims would suffice to control access.
But these refinements can be made fairly easily. The real challenge will be to actually live up to the guiding principles as we move from high level statements to a widely deployed system – making it truly secure, resilient and privacy enhancing. These are guiding principles we can use to measure our success and help select between alternatives.