digital identity electronic identity cards trust Archives

2 + 2 = X

Friday, 5 March 2010 by Dave Birch Leave a Comment

[Dave Birch] I went to an enjoyable dinner (under Chatham House Rule) organised by DEMOS (a think tank that published a paper on privacy called "Putting People First" a couple of years ago) to discuss some issues around identity and privacy, particularly in the context of social networking. A couple of people raised that point that more privacy is, by itself, not necessarily a social benefit or a individual benefit. The "Privacy Taliban" should recognise economic activity as a social good, essentially.

It’s a controversial topic, but important, since hasty legislation could have dire consequences for the survival of newspapers.
[From The Spectator]

Indeed, and I was keen to press the point about helping content industries to reshape rather than preserve their business models a point of which there seemed to be fairly wide agreement. One area where there wasn't, and where my opinions were regarded as odd, was choice. I said that it was obvious to me that giving people choices about how much information they disclosed online (and to whom) was a practical way forward.

It turns out that the people who most benefit from the ability to set their own software preferences are well educated I.T.-saavy professionals with money — the people who suffer are the poorer and less educated users. So making privacy an individual option basically takes privacy away from the poor.
[From multicast » Blog Archive » On Facebook, Only the Rich Have Privacy]

This is surely correct. Now, I accept that the coming generation see privacy in a different way, and may have different norms, but we don't let them have a choice about whether to wear seatbelts or build houses that aren't to code, even though we acknowledge their perspectives.

Digital immigrants tend to think about privacy as the ability to conceal information from others. Digital natives instead share information within certain contexts, and with granular privacy controls on that information.
[From Is Online Privacy a Generational Issue? | GeekDad | Wired.com]

One topic that was raised was that the trawling of social networks by machines can take facts that are by themselves not particularly sensitive and match them together to obtain information that is sensitive. This is a topic discussed here before, and I don't want to rehash it, but it is interesting to delve into the commercial side of this. I think, because I'm optimistic about technology, that it ought to be possible for the "system" to mine data about me and offer me useful and relevant commercial relationships without knowing who I am. And I don't mean just knocking the name off.

digital identity electronic identity cards trust mobile, privacy

[Read more...]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Moving to Privacy 3.0

Thursday, 25 February 2010 by Dave Birch 1 Comment

[Dave Birch] A typically excellent piece from Jan Chipchase that I've continued to think about again and again since reading it. Commenting on the Facebook privacy stories that have were around recently, he asked whether the Facebook privacy "moment" is:

their Microsoft Moment, that point where the internal perception of themselves starts to significantly, negatively diverge from the public perception? Or will we look back on it as more akin to the iMac Floppy Moment where Apple launched said computer without, gasp, a floppy drive.
[From History's New Gatekeepers - Jan Chipchase - Future Perfect]

The idea that Facebook is the crucible in which new notions of identity and privacy are being forged is, I think, true to some extent. First of all, let's remind ourselves where the fuss started.

To make privacy simpler, Facebook's controls will be changed to permit sharing with three groups: "only friends," "friends of friends," or "everyone."
[From How Facebook's New Privacy Changes Will Affect You - NYTimes.com]

Never mind whether you think these changes were good or bad, the point I want to raise is that they shape young persons very ideas of privacy. In a funny way, for the coming cyber cohort, Facebook's privacy settings are privacy. We struggle with notions of privacy because our brains still think in terms of index cards, databases and junk mail but my eldest son's generation (Generation Whatever) do not: their notions of privacy are founded in social networking. They have no problem using "unfriend" as a verb.

But what are they doing? They may have taken on board the facebookisation of identity, but I'm not convinced they understand the googleisation. I can see that replacing old ideas about identity with an identity model that is based on relationships makes sense and is a good basis for developing the necessary paradigm, but the idea of identity as digital footprint, defining a persona as the sum total of all of the data about them, doesn't seem right. The issue may be something about control, as the future privacy paradigm will rest on a more active version of privacy than the simple ability to be left alone.

[Read more...]

In a bit of a State

Tuesday, 26 January 2010 by Dave Birch Leave a Comment

[Dave Birch] If you build a stable door, then one day you will inevitable find yourself locking it while your horse disappears over the horizon. There's been no better illustration of this in recent times than the recent hulabaloo about Google in China. Apparently, Chinese "hackers" were found it rather easy to break into the e-mail accounts of human rights activists and so forth, because Google had been forced to build a system to do precisely that.

That's because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. "Right before Christmas, it was, 'Holy s***, this malware is accessing the internal intercept [systems],'" he said.
[From Google attack part of widespread spying effort]

So companies are forced to build a stable door, and then when the inevitable happens, people appear shocked. The root problem is, naturally, that there is no underlying strategy: we fight using the technology of the next war but the tactics of the last one, as someone once said but I couldn't find out who by googling. If you want proof of this, you only need consider the US government's official response to the incident in a speech by the Secretary of State, Mrs. Clinton, that cofnirmed one of my most basic criticisms of government policy in this cyber age:

The speech made it obvious that State Department officials do not have a coherent view on online anonymity. On the one hand, they want to crack down on intellectual property theft and terrorists; on the other hand, they want to protect Iranian and the Chinese dissidents. Well, let me break the hard news: You can't have it both ways and the sooner you get on with "anonymity for everyone" rhetoric, the more you'll accomplish.
[From Is Hillary Clinton launching a cyber Cold War? | Net Effect]

In fact, US (and other governments') policy in this area isn't just confused and pointless, it's actually dangerous. While I was googling for references, I discovered that the always sensible security expert Bruce Schneier had used this story to make the same point.

The news here isn't that Chinese hackers engage in these activities or that their attempts are technically sophisticated — we knew that already — it's that the U.S. government inadvertently aided the hackers.
[From U.S. enables Chinese hacking of Google - CNN.com]

You can't have privacy without security, as the relatively old saying goes. Ah, you might object, but there's a greater good argument: security without privacy is the only way society can fight the bad guys. We must be able to read people's Google mail accounts because we need to track down criminals and terrorists. And, indeed, this is sort of true. If you know that Osama bin Laden is sending me e-mail, then you might want to investigate me a little further. And I imagine that obtaining the contents of all of my e-mails, from Google, might be a convenient way to do it (although, of course, if I am a terrorist and I know that government is able to read my mail, then I will send misleading e-mail and use an alternative secure channel to conference my confederates). Anyway, you think I'm a bad guy so you want to be able to go to Google and get all my mail. This already happens, in fact.

Prosecutors obtained a CD-ROM disk from Google Inc. this week of Mr. Tannin’s e-mail messages from Nov. 20, 2006, through Aug. 12, 2007. The two funds collapsed in June 2007. Mr. Cioffi, 53, and Mr. Tannin, 48, were indicted for fraud, and Mr. Cioffi also was charged with insider trading, the first managers accused of criminal charges from a company that collapsed in the financial crisis. The hedge funds’ failure cost investors $1.4 billion.
[From E-mail Shows Fear of ‘Blow-Up Risk’ at Bear Fund - DealBook Blog - NYTimes.com]

To be honest, I'm not sure what the fuss is about. If you send something in an e-mail, then as far as I am concerned you have no reasonable expectation of privacy. If you wouldn't put it on a postcard, then you shouldn't put in an e-mail (was it Phil Zimmerman of PGP who first said that?). If these hedge fund guys really wanted to send secret messages to each other then they could have used anonymous comments on an obscure blog, rolling IM accounts changing in a pattern known only to them or, ahem, encryption. Havent't they ever watched the world's best TV drama, "The Wire"?

So I'm not saying that prosecutors shouldn't try to go and get these e-mails. But should they get them from Google? I have a book on my shelf somewhere — the title won't come to mind — which says that, essentially, the government doesn't regulate books because it can't and it does regulate TV because it can (this was a few years ago). Surely this is what is going on here. It might be harder to nail those guys without a copy of their Google e-mail, but is it plausible that without the Google e-mail they will get off? Well, in this case they got off because of the e-mails, as far as I can see.

the prosecution blew it — on two counts. First, in devising the original indictment for conspiracy and securities fraud against the two defendants, Ralph Cioffi and Matthew Tannin, it relied on damning snippets of lengthy e-mail messages that when viewed in their entirety proved to be highly ambiguous. Second, the prosecution made a reductionist opening argument claiming the men were nothing more than out-and-out liars, needlessly raising the bar in terms of what it had to prove to jurors
[From Bear Stearns Trial: How the Scapegoats Escaped - DealBook Blog - NYTimes.com]

Suppose you are a policeman. If Osama bin Laden is sending me e-mail every day, but you can't get the contents of those e-mails from Google or BT, is that worse for society than Osama bin Laden being able to read all of your e-mails? The mere fact that I'm getting e-mail, text message or care packages from a cave in Afghanistan is enough for you to put me under surveillance and from then on other methods can take over. Look, I don't know what the answer is either, but I do know that there is a question, and therefore understand that there is a danger

digital identity electronic identity cards trust mobile, emerging markets, government, ID cards

[Read more...]

Indian summer

Monday, 11 January 2010 by Dave Birch 3 Comments

[Dave Birch] The Indian government has ambitious plans to issue a billion Unique Identifiers (UIDs) in the next few years, thus creating a national population register. There were many reasons for this, but one was social inclusion.

The upper and middle classes have many forms of identity but the poor often have none
[From ‘The idea is to be inclusive. The upper and middle classes have many forms of identity but the poor often have none’]

This is something that can get overlooked in the discussion about identity cards. One of the reasons why an identity card of the type conceived by the British government is so uninteresting to people like me is that I already have plenty of other forms of primitive identity documentation (ie, identity documentation that doesn't work online)such as a driving licence. So the marginal benefit of an additional expensive mini-passport is vanishingly small. But if I didn't have something like a driving licence, then how could I prove who I am? This may not matter when my horizon extends no further than my village. But suppose I want to get a mobile phone, or a mobile money account, something that will improve my lot in life significantly? Then the lack of documentation is a real barrier and means exclusion. Yes, of course the security services and law enforcement agencies want an national ID register, but the issue about the relationship between identity and inclusion is genuine, and important.

Lamenting that lack of identity proof often resulted in harassment and denial of services to the poor and marginalised, Prime Minister Manmohan Singh on Wednesday urged all ministries and departments to support the initiative to provide a unique identity number to all Indian citizens in order to improve the delivery mechanism of the government’s pro-poor schemes and programmes.
[From Back UID scheme for sake of poor: PM to ministries]

A great deal of government help targeted at the poor never reaches the intended recipients.

digital identity electronic identity cards trust mobile, emerging markets, government, ID cards

[Read more...]

The DNS of the industrial bourgeoisie

Monday, 19 October 2009 by Dave Birch Leave a Comment

[Dave Birch] I have a vague memory — which five minutes googling cannot substantiate and I'm too lazy to go and find the book in the other room — that somewhere in the Gulag Archipeligo by Aleksandr Isaevich Solzhenitsyn there is mention of Stalin's desire to have a more revolutionary telephone system where all calls had to go through a central exchange and be encrypted so that Stalin could listen to everyone else's calls but his would be encrypted to remain secret. The prisoners with relevant skills were supposed to be designing this while in the gulag. It never worked, of course, and the Soviet Union had appalling telecommunications infrastructure as a consequence because the communications revolution was halted by the dictatorship of the proletariat: there's some deep incompatibility between innovation and centralisation. I couldn't help thinking of this when I read about the calls by Eugene Kaspersky to have a more Stalinist internet:

The CEO of Russia's No. 1 anti-virus package has said that the internet's biggest security vulnerability is anonymity, calling for mandatory internet passports that would work much like driver licenses do in the offline world.
[From Security boss calls for end to net anonymity • The Register]

What he means by this is that he wants a technologically complicated and expensive solution to be implemented so that ordinary people are inconvenienced to the maximum while criminals can roam free (which is what would happen). Creating such an asymmetric solution is not the way forwards: for one thing, who would decide what to censor?

A little local controversy involving the Church of Scientology and its critics could lead to curbs on the right to anonymity of anyone using the web.
[From Scientology seeks to squash anonymity • The Register]

We already have experience of this "solution" in the UK. Laws giving a wide variety of bodies the ability to monitor CCTV, the internet, phone calls and everything else which were supposed to save us from international terrorism are used by local councils to stop people from trying to get their children into better schools and to check that people are recycling enough of their rubbish. I'm sorry, but creating a world in which anyone can read anyone else's e-mail, track anyone else's web browsing, see what anyone is reading is not the way stop Russian virus writers from taking over everyone's PCs. We need an identity infrastructure.

[Read more...]

U.K. government research

Monday, 11 August 2008 by Dave Birch Leave a Comment

[Dave Birch] The British Government is to invest in three new research projects that will help to develop the next generation of secure identity management systems. The Technology Strategy Board, Engineering and Physical Sciences Research Council (EPSRC) and Economic and Social Research Council (ESRC) have joined forces to back the three projects with an investment of over £5.5 million. The three projects are:

Encore, which will focus on the issue of providing more rigorous means for individuals to grant and revoke their consent for the use, storage and sharing of personal data, bringing together technological, procedural and regulatory developments.
VOME, a research project that will reveal and utilise end users’ ideas and concepts regarding privacy and consent, facilitating a clearer requirement of the hardware and software required to meet end users’ expectations.
Privacy Value Networks (pvnets), will generate a detailed understanding of individuals’ and organisations’ conceptions of privacy and identity across a range of contexts and timeframes – using a range of techniques including in-depth privacy value and devalue chains analysis to model the impact of the personal information.

Consult Hyperion are contributing to the VOME project (with Royal Holloway University of London, Cranfield University, Salford University and Sunderland City Council) and the pvnets project (with University of Oxford, University of St Andrew’s, University College London and University of Bath), so I hope to be able to share some interesting results with blog readers in the future!

[Read more...]