Category: Laws of Identity

Conciously false technology claims

My lawyer friends all know I am “legally challenged” – so don't take anything I say about legal issues as representing any particular expertise. 

But on the news today I saw a story about a drug manufacturer showing the consequences of making false technical claims like those I objected to here in other walks of life: 

NEW YORK (CNNMoney.com) — The maker of OxyContin, Purdue Pharma LP, agreed Thursday to a $600 million penalty as part of a plea deal with the Justice Department on a felony charge of misleading and defrauding physicians and consumers, the government said.

Three of the company's executives, including its CEO, general counsel and former chief medical officer, have separately agreed to pay $34.5 million in penalties. The company and the three men appeared in federal court Thursday to plead guilty.

The company also agreed to subject itself to independent monitoring and a remedial action program.

“Purdue … acknolwedged that it illegally marketed and promoted OxyContin by falsely claiming that OxyContin was less addictive, less subject to abuse and diversion, and less likely to cause withdrawal symptoms than other pain medications – all in an effort to maximize its profits,” said U.S. Attorney John Brownlee.

There should be accountability and penalties for those who consciously mislead people like the Marlin County school board, convincing them there is no risk to privacy by preying on their inability to understand technical issues.  It should be mandatory, when selling technology with potential privacy implications, to explain the threats and mitigations in an objective and public way.

QT and the perimeter

Jeff Bohren, The Identity Management Expert at TalkBMC, makes a great point about what laptops mean and hits gold with Quantum Tunneling.

Kim Cameron has another interesting entry on Deperimeterization here. All of this got me to thinking about another aspect of perimeter security, and that is network location. People tend to think of computers as being logically located inside or outside of the security perimeter. Or more specifically people without laptops tend to think that. If you have a laptop, you quickly realize that you flip-flop between the state of being in and out of the perimeter on a daily basis, or more frequently is you use VPN.

I like the analogy of Quantum Tunneling (QT). One moment your laptop is outside the perimeter, the next it’s magically in. Then out again. QT in, QT out. Of course any malware your laptop picks up outside the perimeter will be carried in on the next trip in. This should really be the nail in the coffin of perimeter security thinking, but unfortunately it isn’t.

The QT analogy came to me because I have been reading Ilium by Dan Simmons (author of the Hyperion series). This SF novel combines The Illiad, QT, Greek Gods, a mostly depopulated Earth, a terraformed Mars, Little Green Men, and Jovian Cyborg buddies (one who likes Shakespeare and one who like Proust). I’m not done yet, so it will be interesting to see if Simmons can pull it all together at the end.

Here is the identity tie in. In Simmon’s future Earth, the few remaining inhabitants can teleport from place to place. It turns out that peoples bodies aren’t actually teleported. The body and brain waves are scanned at origin and that information is stored in a central computer. The body, thoughts, and clothing are reconstituted at the destination based on that information.

Teleportation of identity! Fascinating.

Jeff has definitely got it.

Personal data on 2.9 million people goes missing

Joris Evers at CNet has done a nice wrap-up on the latest identity catastrophy.  (Plumes of smoke were seen coming from the reactor, but so far, there has been no proof of radioactive particles leaking into the environment): 

A CD containing personal information on Georgia residents has gone missing, according to the Georgia Department of Community The CD was lost by Affiliated Computer Services, a Dallas company handling claims for the health care programs, the statement said. The disc holds information on 2.9 million Georgia residents, said Lisa Marie Shekell, a Department of Community Health representative.

It is unclear if the data on the disc, which was lost in transit some time after March 22, was protected. However, it doesn't appear the data has been used fraudulently. “At this time, we do not have any indication that the information on the disk has been misused,” Shekell said.

In response to the loss, the Georgia Department of Community Health has asked ACS to notify all affected members in writing and supply them with information on credit watch monitoring as well as tips on how to obtain a free credit report, it said.  [Funny – I get junk mail with this offer every few days – Kim] 

There has been a string of data breaches in recent years, many of which were reported publicly because of new disclosure laws. About 40,000 Chicago Public Schools employees are at risk of identity fraud after two laptops containing their personal information were stolen Friday.

Last week, the University of California at San Francisco said a possible computer security breach may have exposed records of 46,000 campus and medical center faculty, staff and students.

Since early 2005, more than 150 million personal records have been exposed in dozens of incidents, according to information compiled by the Privacy Rights Clearinghouse.

Identity fraud continues to top the complaints reported to the Federal Trade Commission. Such complaints, which include credit card fraud, bank fraud, as well as phone and utilities fraud, accounted for 36 percent of the total 674,354 complaints submitted to the FTC and its external data contributors in 2006.

Beijing's new Internet identity system

According to the Financial Times, the Chinese government has clear digital identity ideas of its own. 

It's a simple solution, really.  Just make sure the government knows who everyone is and what they are doing all the time while they use the internet.  This applies as much to your identity as an “elf” as to your identity as a professional. 

Under a “real name verification system” to crack down on internet usage – and prevent internet addiction among the young – Chinese police are to check the identity card numbers of all would-be players of internet games.

While it is unclear how rigorously the system will be enforced, Monday’s move highlights Beijing’s desire to more closely regulate the internet and reduce the potential for anonymity…

The same crack down will help ensure Chinese bloggers aren't inconvenienced with the kinds of vexing issues we've faced here with the Sierra affair.

Chinese leaders recently announced a broad push to “purify” the internet of socially and politically suspect activity, and have been keen to push users to use their true identities online. Beijing is also looking at ways of implementing a “real name” system for bloggers to curb “irresponsible” commentary and intellectual property abuse.

It might sound a bit draconian to our ears, but Hu Qiheng of the China Internet Association said bloggers’ real names would be kept private “as long as they do no harm to the public interest”.  That's clearly benevolent, isn't it?  We all know what the public interest is.

According to FT: 

China’s 18-digit ID numbers are mainly based on place of birth, age and gender and are unique to each citizen, but widely available software can generate fake but plausible numbers.

Under the new system, Chinese police would check each number, a government official, Kou Xiaowei, said on Monday.

Players whose IDs showed they were under 18, or who submitted incorrect numbers, would be forced to play versions of online games featuring an anti-addiction system that encourages them to spend less time online, he said.

Minors who stayed online for more than three hours a day would have half of their game credits cancelled; those who played for more than five hours a day would have all of their credits taken away.

As far as I know, the proposal that age verification be used to combat addiction is entirely original (patented?)  The analysis of how this proposal stacks up against the Laws of Identity is left as an exercise for the reader.

More here…

Formula for time conversion

The remarkable William Heath, a key figure in the British Government's IT ecosystem and publisher of ideal government, lands a few of his no-nonsense punches in this piece, both sobering and amusing, on institutional learning:

The original Microsoft Hailstorm press release is still there, bless them! Check out all the hype about “personalisation” and “empowerment” with proper protection of privacy (see extracts below). Complete ecstatic fibs! The apogee of Microsoft’s crazed, childish egocentricity. And it all sounds so familiar to the rhetoric of UK government ID management.

Then April 2002 – Microsoft shelves Hailstorm eg NY Times abstract

And Microsoft announced Kim Cameron’s laws of identity in 2005, and Infocards in 2006.

How fast does Microsoft adapt to customers and markets compared to governments, do we estimate? Is “one Microsoft year = seven government years” a reasonable rule of thumb? In ID management terms the UK government is still in Microsoft’s 2001. So for the UK government to get to Microsoft’s position today, where the notion of empowering enlightenment is at least battling on equal terms with forces of darkness and control and the firm is at the beginning of implementing a sensible widescale solution will take UK government and IPS another forty years or so.

Could we get it down to one MS year = 3.5 UK gov years? That means we could have undone the damage of committing to a centralist panoptical approach in just 21 years. Aha.  But Microsoft doesn’t have elections to contend with… (Continued here.)

I know a number of folks who were involved with Hailstorm, and they are great people who really set a high bar for contributing to society.  I admire them both for their charity and their creativity.  It is possible that the higher the standards for your own behavior, the more you will expect other people will trust you – even if they don't know you.  And then the greater your disappointment when people impune your motives or – best case – question your naivity. 

It requires maturity as technologists to learn that we have to build systems that remain safe in spite of how people behave – not because of how they behave. 

Of course, this is not purely a technical problem, but also a legal and even legeslative one.  It took me, for example, quite a while to understand how serious the threat of panoptics is.  Things always look obvious in retrospect. 

I am trying to share our experience as transparently and as widely as I can.  I have hoped to reduce the learning curve for others – since getting this right is key to creating the most vibrant cyberspace we can. 

Biometric encryption

This diagram from Cavoukian and Stoianov's recent paper on biometric encryption (introduced here) provides an overiew of the possible attacks on conventional biometric systems (Click to enlarge; consult the original paper, which discusses each of the attacks).

Click to enlarge

Having looked at how template-based biometric systems work, we're ready to consider biometric encyption.  The basic idea is that a function of the biometric is used to encrypt (bind to) an arbitrary key.  The key is stored in the database, rather than either the biometric or a template.  The authors explain,

Because of its variability, the biometric image or template itself cannot serve as a cryptographic key. However, the amount of information contained in a biometric image is quite large: for example, a typical image of 300×400 pixel size, encoded with eight bits per pixel has 300x400x8 = 960,000 bits of information. Of course, this information is highly redundant. One can ask a question: Is it possible to consistently extract a relatively small number of bits, say 128, out of these 960,000 bits? Or, is it possible to bind a 128 bit key to the biometric information, so that the key could be consistently regenerated? While the answer to the first question is problematic, the second question has given rise to the new area of research, called Biometric Encryption

Biometric Encryption is a process that securely binds a PIN or a cryptographic key to a biometric,so that neither the key nor the biometric can be retrieved from the stored template. The key is re-created only if the correct live biometric sample is presented on verification.

The process is represented visually as follows (click to enlarge):

Click to enlarge

Perhaps the most interesting aspect of this technology is that the identifier associated with an individual includes the entropy of an arbitrary key.  This is very different from using a template that will be more or less identical as long as the template algorithm remains constant.  With BE, I can delete an identifier from the database, and generate a new one by feeding a new random key into the biometric “binding” process.  The authors thus say the identifiers are “revokable”.

This is a step forward in terms of normal usage, but the technology still suffers from the “glass slipper” effect.  A given individual's biometric will be capable of revealing a given key forever, while other people's biometrics won't.  So I don't see that it offers any advantage in preventing future mining of databases for biometric matches.  Perhaps someone will explain what I'm missing.

The authors describe some of the practical difficulties in building real-world systems (although it appears that already Phillips has a commercial system).  It is argued that for technical reasons, fingerprints lend themselves less to this technology than iris and facial scans. 

Several case studies are included in the paper that demonstrate potential benefits of the system.  Reading them makes the ideas more comprehensible.

The authors conclude:

Biometric Encryption technology is a fruitful area for research and has become sufficiently mature for broader public policy consideration, prototype development, and consideration of applications.

Andy Adler at the University of Ottawa has a paper looking at some of the vulnerabilities of BE.

Certainly, Cavoukian and Stoianov's fine discussion of the problems with conventional biometrics leaves one more skeptical than ever about their use today in schools and pubs.

Will biometrics grow up?

Ann Cavoukian has really thought about biometrics – and fingerprinting. As the Privacy Commissioner of Ontario, she hasn't hesitated to join the conversation we have been having as technologists – and has contributed to it in concrete ways. For example, beyond bringing the Laws of Identity to the attention of policy makers, she extended them to make all the privacy implications explicit.

Now she and Alex Stoianov, a biometrics scientist, have published a joint paper called Biometric Encrypton: A Positive-Sum Technology that Achieves Strong Authentication, Security AND Privacy. It is too early to know to what extent Biometric Encryption (BE) will achieve its promise and become a mainstream technology. But everyone who reads the paper will understand why it is absolutely premature to begin using “conventional biometrics” in schools – or pubs. The following table, taken from the paper, summarizes the benefits BE could hold out for us:

Traditional Biometrics:
Privacy OR Security
A Zero-Sum Game		 Biometric Encryption:
Privacy AND Security – A Positive-Sum Game
1 The biometric template stored is an identifier unique to the individual. There is no conventional biometric template, therefore no unique biometric identifier may be tied to the individual. (pp. 16, 17)
2 Secondary uses of the template (unique identifier) can be used to log transactions if biometrics become widespread. Without a unique identifier, transactions cannot be collected or tied to an individual. (pp. 17, 25)
3 A compromised database of individual biometrics or their templates affects the privacy of all individuals. No large databases of biometrics are created, only biometrically encrypted keys. Any compromise would have to take place one key at a time. (pp. 23)
4 Privacy and security not possible. Privacy and security easily achieved. (pp. 17-20, 26-28)
5 Biometric cannot achieve a high level of challenge-response security. Challenge-response security is an easily available option. (pp. 26-28)
6 Biometrics can only indirectly protect privacy of personal information in large private or public databases. BE can enable the creation of a private and highly secure anonymous database structure for personal information in large private or public databases. (pp. 19, 20, 27)
7 1:many identification systems suffer from serious privacy concerns if the database is compromised. 1:many identification systems are both private and secure. (pp. 17, 20)
8 Users’ biometric images or templates cannot easily be replaced in the event of a breach, theft or account compromise. Biometrically encrypted account identifiers can be revoked and a new identifier generated in the event of breach or database compromise. (pp. 17)
9 Biometric system is vulnerable to potential attacks. BE is resilient to many known attacks. (pp. 18)
10 Data aggregation Data minimization (pp. 17)

I'll be writing about the basic idea involved in BE. But I advise downloading the paper since beyond BE, it provides an excellent and well structured discussion of the issues with biometrics in general.

U.K. wants beerdrinkers’ fingerprints

More news from the the U.K. biometrics front.  Here is a piece by Rogier van Bakel from his site – Nobody's business:

All 12 million kids in the country will have to be fingerprinted. Actually, that's not news — I wrote about it here. What's news (to me) is that parents will likely have no way to opt out on behalf of their children. They can't tell Little Nigel to tell the government's data-miners to shove it.

See if you can follow the logic here without gasping.

David Smith, deputy Information Commissioner, said it was a complex issue that was still being worked out, but it was likely that parents did not have an automatic right to decide whether their children's biometrics could be taken by a school.

“The Data Protection Act talks of consent of the individual — essentially that's consent of the child,” he said. “Now there's a requirement that consent is informed and freely given. That will depend on the age of the child,” he said. “The idea is that as long as children can understand the implications of what they are being asked to do, they can give consent without deferring to their parents. The Data Protection Act is about the pupil's rights, not the parents’ rights over the children's information,” said Smith.

Can a six-year-old understand the implications? A ten-year-old? A thirteen-year-old? It's doubtful, but somehow, the government is fully prepared to consider these pupils — and itself — to be more competent in such matters than the children's own parents.

Also note Mr. Smith's up-is-down government-speak when he spins the ominous legal requirement for children to surrender their biometric data as if it were a really a right — one that must be protected from the ignorant stubbornness of Mum and Dad.

Meanwhile, in the name of crime prevention, U.K. authorities are ordering citizens who visit clubs and pubs to get fingerprinted, too. No joke.

The government is funding the roll-out of fingerprint security at the doors of pubs and clubs in major English cities. Funding is being offered to councils that want to have their pubs keep a regional black list of known trouble makers. The fingerprint network installed in February by South Somerset District Council in Yeovil drinking holes is being used as the showcase. “The Home Office have looked at our system and are looking at trials in other towns including Coventry, Hull & Sheffield,” said Julia Bradburn, principal licensing manager at South Somerset District Council. Gwent and Nottingham police have also shown an interest, while Taunton, a town neighbouring Yeovil, is discussing the installation of fingerprint systems in 10 pubs and clubs with the systems supplier CreativeCode.

In order to qualify for a new license, a pub owner or club manager will have to promise to install a fingerprinting system. If, after the system is in place, customers fail to display a “considerable” reduction in alcohol-related violence, the drinking establishments could have their licenses revoked.

I'll make just a brief comment about both these issues.

I think the student should be able to refuse consent if she doesn't want to be fingerprinted, and the parent should be able to refuse it on her behalf as well.  After all, the child should learn how to protect her self, though ultimate responsibility lies with the parent.  Further as shown by Joy's “No scan, no eat” report, we need some way to prevent the bullying of children (and parents) into submission.

As for fingerprinting people on their way into pubs, all I can say is:  Britain, get a grip!    As a Canadian, it's like watching a loved one losing her mind.

Mass fingerprinting of children will start in 2010

More good news from The Sunday Times in Britain: 

CHILDREN aged 11 to 16 are to have their fingerprints taken and stored on a secret database, internal Whitehall documents reveal.

The leaked Home Office plans show that the mass fingerprinting will start in 2010, with a batch of 295,000 youngsters who apply for passports.

The Home Office expects 545,000 children aged 11 and over to have their prints taken in 2011, with the figure settling at an annual 495,000 from 2014. Their fingerprints will be held on a database also used by the Immigration and Nationality Directorate to store the fingerprints of hundreds of thousands of asylum seekers.

The plans are outlined in a series of “restricted” documents circulating among officials in the Identity and Passport Service. They form part of the programme for the introduction of new biometric passports and ID cards.

David Davis, the shadow home secretary, said: “This borders on the sinister and it shows the government is trying to end the presumption of innocence. With the fingerprinting of all our children, this government is clearly determined to enforce major changes in the relationship between the citizen and the state in a way never seen before.”

…Children under 16 will not be part of the ID card scheme. But the documents show that from 2010 they will still have to be fingerprinted for a new passport.

The prints will initially be stored on the directorate’s database. Once children reach 16 their fingerprints and other personal information will be passed for storage on the register, along with those of nearly 50m adults.

If they don't scan, they don't eat

The more I look into this story, the worse it gets.  We don't have to go to Britain for examples of child fingerprinting – just take a look at this email from a lady in Illinois:

Kim,

My name is Joy and I am continuing to get the word out & tell this true story.

In August 2005, our public school district with less than 500 students decided to start using biometric equipment for “accounting purposes”.  We were told at registration to take our children over and have them scanned.  (There was not an opt out or opt in policy).

I objected and said no – our children are not to use this equipment -especially when there is not a policy to look over.

We were told, “if they don't scan ,they don't eat.”

I explained I believed that to against the law and the rights of the children as well as parental rights.  I was then told that this equipment would put Earlville, Illinois on the map (not like they thought).  A few days later I gave birth to our youngest daughter, on Aug 20, 2005, and explained to my husband that when I recovered I was going to discuss this matter with the district administration again.

Meanwhile my eldest children Brooke & Gunner were still brown bagging it.  Well, Sept 21, 2005 my 7 year old son was scanned anyway – even though he reminded the “tech director” that he was not to scan.

I of course called the school and started recieving excuses from the adminstrative staff.  I went to the local paper, the school board and still did not feel as if we were getting very far with our objection.  I then decided to write to Illinois legislators and the media.

Senator Miquel Del Valle introduced SB 2549 in Jan, 2006. CBN came to our town and interviewed us (as well as Senator Miquel Del Valle on a different date.)  The story aired Nov 7, 2006.  Then Senator Miguel Del Valle stepped down and took another position in Chicago. SB 2549-session sine die.

There I was again writing and calling the media and legislators.  In Jan,  2007 I was invited to speak with some privacy advocates and share this almost unbelievable story.  In Feb, 2007 two bills were introduced and are passing:  HB 1559,  introduced by State Rep Bob Pritchard; and SB 1702, introduced by Senator Kim Lightford.

I have several newspaper articles as well as letters from the Superintendant stating that my 7 yearr old son willingly gave up his finger.  Info about this story can also be found on EFFs deeplinks ,the Cato Institute,The End times and of course the CBN website.   As soon as I get updated on the bills I can notify you.   In the meantime I will continue to get the word out and search for advice on this matter .

I had my finger impression scanned for an Illinois licensure requirement, however I am a mother of five, over 30 and a private detective.

Not a minor child trying to by hot lunch at school.  We know that the data on these children can be sold, given away and anyone who knows how to write a FOIA can have access to this info. 

Joy Robinson-Van Gilder