When I presented the Laws of Identity at the DIDW conference, someone asked how we would “enforce the laws”. I tried to explain that the laws are not what Bob Blakley calls “desiderata” – things that we would like to see. They are the objective characteristics of an enduring identity system at Internet scale.<\/p>\n
Timothy Grayson of Recursive Progress has written very eloquently<\/a> about how CardSystems has served as his teacher in this regard:<\/p>\n A while back, I took aim<\/font><\/a> at The Laws of Identity<\/font><\/a> with a critique that missed the mark, I'm sure, because I opted (well, truly, I had no choice) not to evaluate it with through the lens of a technologist. One of my comments in regard to Law 2: Minimal Disclosure for a Constrained Use was: <\/p>\n I think that minimal disclosure for a constrained use is essential for privacy and user control, which, presumably, is what drives Law no. 2. The statement, “There is no longer the possibility of collecting and keeping information ‘just in case’ . . .” [emphasis mine] is, however desirable and logical an outcome of a need-to-know minimal distribution of information, not part of technical mechanics. It is, as everyone doubtlessly knows, a matter of policy and practice. Somewhere I read not all that long ago that two of the non-obvious forces that are driving the creation of massive directories and databases — about people — are that (a) thanks to computing capability it's easy to accumulate rich records over time and (b) thanks to cheap storage there's no disincentive to keep accumulating information. These together with the underlying belief that “information is power” and all the other marketing and security-driven forces for creation of directories may be a little bit more than the principle of minimal disclosure can overcome, methinks.<\/i><\/p><\/blockquote>\n Today, MSNBC (among others) is carrying a story about data mishandling by a credit card processing firm in Atlanta (Processing firm: Credit card data mishandled – Consumer Security<\/font><\/a>). This situation speaks to digital identity generally, and at least from one angle to Law 2. Here's the money quote to support my earlier statement: <\/p>\n Under rules established by Visa and MasterCard, processors cannot retain cardholder information after handling transactions.<\/p>\n “CardSystems provides services and is supposed to pass that information on to the banks and not keep it,” Joshua Peirez, a MasterCard official, told the Times. “They were keeping it.”<\/i><\/p>\n<\/blockquote>\n Oops. Broken law. Technology — architecture or otherwise — may or may not have been able to avoid it.<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":" When I presented the Laws of Identity at the DIDW conference, someone asked how we would “enforce the laws”. I tried to explain that the laws are not what Bob Blakley calls “desiderata” – things that we would like to see. They are the objective characteristics of an enduring identity system at Internet scale. Timothy … Continue reading CardSystems appointed Professor of Identity<\/span><\/a><\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[2],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/112"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=112"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/112\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
He [John Perry, chief executive of Atlanta-based CardSystems Solutions Inc., which was hacked] said the data was being stored for “research purposes” to determine why some transactions had registered as unauthorized or uncompleted. “We should not have been doing that,” Perry said in Monday's editions of The New York Times. <\/p>\n