The Top 10 Hot Identity Topics: A Smart Card Alliance Identity Council White Paper

March 16, 2007
An in-depth report on issues affecting identity management and protection

Publication Date: February 2006

Publication Number: IC-06001

Smart Card Alliance

191 Clarksville Rd.

Princeton Junction, NJ   08550

www.smartcardalliance.org

Telephone: 1-800-556-6828

About the Smart Card Alliance

The Smart Card Alliance is the leading not-for-profit, multi-industry association of member firms working to accelerate the widespread acceptance of multiple applications for smart card technology. The Alliance membership includes leading companies in banking, financial services, computer, telecommunications, technology, health care, retail and entertainment industries as well as a number of government agencies. Through specific projects such as education programs, market research, advocacy, industry relations and open forums, the Alliance keeps its members connected to industry leaders and innovative thought. The Alliance is the single industry voice for smart cards, leading industry discussion on the impact and value of smart cards in the U.S. and Latin America. For more information, visit http://www.smartcardalliance.org.

Copyright © 2006 Smart Card Alliance, Inc.  All rights reserved.  Reproduction or distribution of this publication in any form is forbidden without prior permission from the Smart Card Alliance.  The Smart Card Alliance has used best efforts to ensure, but cannot guarantee, that the information described in this report is accurate as of the publication date.  The Smart Card Alliance disclaims all warranties as to the accuracy, completeness or adequacy of information in this report.

Executive Summary

Our shrinking world forces all of us to be constantly thoughtful of the need to protect our own identity and know with certainty the identities of those with whom we trust our wealth, our privacy, and our security. Protecting one’s identity depends both on personal effort and on the practices, policies, and systems of the organizations to which one entrusts personal information. Individuals must exchange identity information and personal data almost daily with other individuals and with organizations. People constantly risk losing control of identity information and must rely on the entities that share the information to protect it.

With the increasing incidence of identity theft and increasing awareness of both the tangible and intangible costs to society of weak identity systems, individuals and organizations are taking more aggressive steps to secure personal information and to implement identity systems that improve identity verification processes.  

To design and implement secure identity systems, organizations must think through the entire identity process and chain of trust.  A complete identity solution must include policies, procedures, and practices that implement the desired level of security and that describe how people interact with the identity system. The solution must start with accurate vetting of the individual’s identity and follow with identity verification processes that provide secure, authorized access to identity information. The technology selected is also critical; technology in general, and smart cards and biometrics in particular, are powerful tools that can help achieve overall system goals and enforce adherence to the chosen privacy and security policies.

This white paper was developed by the Smart Card Alliance Identity Council to provide a high-level discussion of the top 10 challenges associated with current identity systems. The paper covers a range of topics and offers perspectives on how the most critical identity issues can be addressed with policy, process, and technology solutions. The topics include the following:

·         Discussing the actions government, businesses, and individuals can take to prevent identity theft and describing the role of technology in preventing theft.

·         Describing both the institutional mechanisms and the individual actions that can keep an individual’s personal identity information private.

·         Defining what information constitutes an identity and how systems should be designed to put individuals in control of their private information.

·         Assessing how governments respond to new technologies that can provide solutions to identity challenges.

·         Analyzing the challenges posed by breeder documents and discussing potential solutions that could lead to more accurate proofing of an individual’s identity.

·         Discussing how a secure identity can be created and used throughout the identity life cycle.

·         Defining the different types of identity credentials and offering guidance on key considerations for using a credential for multiple applications.

·         Describing how new technologies are being used to verify an individual’s identity in the online world.

·         Defining how biometric technology is used in identity systems to bind an individual to an identity credential and verification event.

Secure, trusted identity systems will result only if policy, process, and technology issues are considered when new systems are being designed. The Identity Council’s goal is to provide guidance on important identity issues, thereby helping policy-makers and implementing organizations understand how smart card and related technologies can best be applied to deliver the benefits of secure identity. 

The Identity Council welcomes input from government, businesses, and the public. For additional information about Council activities, please visit http://www.smartcardalliance.org.

 

Introduction: Why Is Identity an Emotional Topic?

Many studies have attempted to define what a person’s identity is. Some consider identity to be part of an individual’s personality; others consider identity to be the characteristic that defines individuality and distinguishes one individual from another. This paper defines identity as the distinguishing characteristics that determine unequivocally that a person is who that person claims to be. 

Human beings classify their surroundings by assigning names to the components of those surroundings. Everything has a name and everybody has a name. Naming is our way of ordering our world so that we can correctly address something or somebody. Knowing a person’s name allows us to associate an identity with them, which in turn allows us to recognize whom we are dealing with and tell them apart from others.

Although people may want to maintain public anonymity, such anonymity is difficult to achieve. It is nearly impossible to maintain anonymity and operate in modern society. Birth certificates record our entry into society; Social Security numbers identify us to our government. We have passports to attest to our identity and citizenship; we have driver’s licenses to show that we are considered competent to operate a motor vehicle. Each of these identity documents conveys our claimed identity to society for a specific purpose. Collectively, these documents form a series of reference points that attest to our identity. When we desire to achieve some form of anonymity, we use “personas” to represent us to a community where we wish to be less identifiable. For example, many people use personas on the Internet. By creating a “handle” or username in a web community, we can be invisible or not identifiable to some degree. Ultimately, however, the same individual is behind a real-world identity and the persona that the individual uses. Personas are simply a projection of a pseudo-identity masking the individual’s actual identity. In many cases a persona may not be deemed sufficient identification to undertake activities such as financial transactions and therefore have limited use.

Although different people may define privacy differently, everyone would agree that it is important. Another critical point is the recognition that individuals should be in control of their identities. Personal choice should determine whether an individual discloses identity information. However, non-disclosure of one’s identity may mean denial of a service to that individual. For example, the REAL ID Act of 2005 defines the requirements for identity proofing by states, who must issue compliant driver’s licenses starting in 2008. The Act requires U.S. citizens who wish to access services such as flying on airplanes to present themselves and a compliant government-issued ID. Without such an ID, they will not be permitted to fly.

Identity is clearly a valuable commodity to an identity thief or a terrorist. By stealing another person’s identity, somebody can cause a great deal of financial harm or gain access to services to which the thief is not entitled. Stronger ways of assuring and trusting identity are needed to prevent such theft.

Identity programs already affect how our society operates today.

·         Many countries are beginning to issue electronic passports that include a smart card chip. These ePassports will deliver the passport holder’s identity credential to an official accurately and securely. Such capabilities will make it more difficult to commit passport fraud or masquerade as somebody else. Passports will become a highly trusted credential for a citizen. Similarly, proposals are being considered for identity cards for citizens who routinely cross U.S. land borders. These proposals include requiring a biometric identifier, to ensure that the person presenting the card is truly the owner of the card. 

·         The U.S. Government is committed to satisfying President Bush’s Homeland Security Presidential Directive 12, which requires all government employees and contractors to be issued a credential that will be interoperable across the entire Federal government. By October 2006, every agency is required to start issuing smart card-based identity cards conforming to Federal Information Processing Standard 201. Biometric identifiers will form the foundation for identity verification. With the use of smart card technology and privacy-enhancing biometric templates, the person’s biometric can be matched locally, either on the card itself or in the local terminal, eliminating the need to go online to biometric databases for every verification. 

·         Plans to issue identity cards to frequent, trusted travelers is another example of how a person’s identity will be presented to gain access to a specific service – in this case, access to expedited security check lines at airports. These cards are also likely to include biometric identifiers to bind the user to their credential.

Summary

Identity presentation is one of the most important aspects of modern society and is an important part of a person’s life. As we embrace the information age, where data is a valuable commodity, it is essential to use adequate security techniques to preserve each person’s identity and privacy. 

A citizen is entitled to identity protection. A person’s identity should remain private and be disclosed in a secure and trusted form only when the person chooses and only to whom the person chooses. The party receiving the presented identity should be able to verify that the person presenting the identity is the person entitled to present it, and the credential itself should be authenticated. Once we establish a chain of trust for identity, many areas of our society will benefit. Electronic commerce (ecommerce) can become a trusted transaction environment. The nation’s transportation infrastructure will become secure, as travelers are better identified, making it exponentially harder for a terrorist to gain entry using a false identity. 

The Smart Card Alliance recognizes the importance of identity in society and the critical need to protect it and be able to trust it. Smart card technology has proven itself to be a valuable tool for achieving these goals.

In the following pages we explore 10 of the main identity challenges facing our society today. 

Identity Topic #1: Identity Theft—When You Don’t Own Your Identity!

According to the U.S. Federal Trade Commission, identity theft is the nation’s fastest-growing crime in the United States. By many accounts, it is the fastest-growing crime globally.

Introduction

An individual’s identity is defined most simply by the set of characteristics that enable a person to be recognized or known. There are three ways of thinking about identity:

·         Identity from nature: characteristics given by the birth parents to the child (fingerprints, DNA, iris pattern)

·         Identity from status: characteristics assigned to individuals by other people in society (Social Security number, credit card number)

·         Identity from behavior: characteristics assigned to individuals by other people based upon the individuals’ actions (marking profile, credit rating, criminal record)

What Is Identity Theft?

Identity theft is the appropriation of another person’s personal information without permission in order to commit fraud, to steal the person’s assets, or to pretend to be the other person. Identity theft is the fastest-growing crime in the United States, according to the U.S. Federal Trade Commission (FTC). Between January and December 2004, Consumer Sentinel, the complaint database developed and maintained by the FTC, received over 635,000 consumer fraud and identity theft complaints. Consumers reported losses from fraud of more than $547 million. 

There are many types of identity theft, and many stakeholders besides the perpetrator and the victim are involved in identity theft. Identity theft affects all of society. 

How Does Identity Theft Occur?

To prevent identity theft, it is essential to understand who commits identity theft and how identity theft occurs. Typically, three types of people commit identity theft:

·         Someone close to the victim, who knows the victim’s habits and movements

·         Amateurs, who look for unsuspecting subjects and opportune moments

·         Professionals, who work independently or as part of an organized group.

There are many ways to commit identity theft, some simple and some very sophisticated. Simple methods are used mostly by persons close to the victim and by amateurs. The most common simple methods are dumpster diving and social engineering.  Dumpster diving is the practice of rummaging through garbage for a consumer’s personal information. Dumpster divers rely on the fact that people are not aware of the value of the information they possess and are careless about protecting and discarding it. Social engineering methods generally use techniques that rely on human interaction to trick people. A perpetrator might try to gain the confidence of a colleague and then ask to “borrow” their user ID and password to access a secure network, or they might impersonate a utility representative and call an unsuspecting customer to “verify” the Social Security number associated with the account. There are countless examples of these simple methods, and even in today’s environment, they remain very successful.

Professionals use both simple and sophisticated methods to steal identities but tend to focus on methods that can be automated since such methods can be less time-consuming and more profitable. These automated methods are usually technology-driven and include techniques such as skimming, hacking, phishing, and pharming.

·         Skimmingis the practice of stealing credit card information by capturing it in some form of card reader. The thief employs methods such as swiping the credit card a second time during an actual purchase or attaching a reader to an ATM machine where the card is swiped. Skimming occurs infrequently because of the technology required, but when it does occur, damages can be substantial.

·         Hackingis the act of gaining illegal or unauthorized access to a computer system or network. Hacking is the most commonly used method for stealing an identity. Spyware on a computer can be considered hacking, even though the user may have authorized installation of the spyware. Spyware is defined as programs such as keystroke loggers and screen capture utilities, installed by a third party to monitor and observe online behavior or capture passwords and other information. Applications such as adware install themselves surreptitiously through “drive by” downloads or by piggybacking on other applications. They track users’ behaviors and take advantage of their Internet connection.  Users often unknowingly authorize spyware to be installed by clicking on the “Yes” button at the bottom of an end user license agreement.

·         Phishing is a cyber attack that directs people to a fraudulent website to collect personal information. A common phishing scam is to send an email message asking a user to update an account. The perpetrator uses an attractive lure—protecting privacy—and then asks users to verify their accounts by clicking on a convenient hyperlink. A phishing scam may also lure an individual by sending an alarming message stating that a desired service is about to be terminated. Phishers often use the services of spammers to reach the widest number of possible targets. There have been literally thousands of phishing scams on the Internet.

·         Pharmingis a cyber attack that involves a combination of ploys such as phishing, viruses, spyware, and domain name system (DNS) server cache-poisoning or spoofing. Pharming directs people to a fraudulent website by poisoning the DNS server so that web requests are redirected. Victims think they are entering personal information on a legitimate site when in fact they are not. A pharming site will often forward the web request on to the legitimate site so users see their real data.  By monitoring the traffic between the user and the intended site, a pharmer can eavesdrop on personal information and even manipulate transactions.

What Actions Are Government Taking against Identity Theft?

The Federal government and many state and local jurisdictions are passing laws and regulations requiring businesses to take certain actions against identity theft and to establish guidelines for notifying consumers when data breaches may have occurred. Governments are promoting consumer education and resources for preventing and, where necessary, recovering from identity theft.

What Are Businesses Doing to Prevent Identity Theft?

Identity theft causes substantial financial harm to private industry. Businesses incur costs to implement identity theft prevention measures and to replace the losses suffered by the victims of identity theft. These costs are absorbed by the industry and by insurance companies, but eventually they are passed on to the consumer in the form of higher prices for products and services, higher fees, and higher interest rates. Different industry sectors are tackling this problem in the manner most appropriate for that industry and for the specific patterns of theft. Being proactive, staying ahead of the professionals, and being current and diligent in security and privacy protections are critical. 

How Can Technology Help to Prevent Identity Theft?

Technology measures can prevent some types of identity theft. Businesses can require multi-factor authentication (two indisputable sources or elements that must be supplied to verify a person’s identity). Smart card-based implementations can be adopted, such as subscriber identification modules, which prevent cloning of phones and have eliminated telephone theft/fraud, or smart card-based employee IDs, which provide strong authentication, are difficult to counterfeit, and are tamper-resistant. Human intervention and resistance are required to successfully attack non-technical methods of identity theft such as dumpster diving and social engineering. In the case of dumpster diving, for example, a paper shredder can be used to destroy paper bills.

What Should Consumers Do to Protect Themselves?

Consumers should be aware of their rights and responsibilities for protecting themselves and request a free copy of their credit report. In the U.S., a recent amendment to the Federal Fair Credit Reporting Act requires that the national consumer reporting companies (Equifax, Experian, and TransUnion) provide consumers with a free copy of their credit report, upon request, once every 12 months. Consumers need to make this request through the FTC website, as this is the only authorized online source. Consumers are urged to monitor their reports routinely for unusual activity. Consumers are also encouraged to be proactive:

·         Stay educated about the value of identity characteristics. 

·         Monitor sources of identity for possible abuse or misappropriation. 

·         Develop an attitude of caring about identity as a personal asset. 

Identity Topic #2: Protection of Identity Information—Is Your Identity Protected? Can You Protect It?

Introduction

As the result of legislation and the threat of litigation, both the public and private sectors are instituting new policies and practices designed to protect identities, ensure privacy and control access to identity information.

Protecting one’s identity depends both on personal efforts and on the practices, policies, and systems of those organizations to which a person entrusts personal information. Daily life requires individuals to interact with other individuals and with organizations and, in the process, to exchange identity and other personal information. People constantly risk losing control of identity information and must rely on the entities that share the information to protect it.

The increasing incidence of identity theft has led to an increasing awareness of the need to protect identity information. As a consequence, both individuals and organizations are taking more aggressive steps to secure personal information. Concurrently, a number of laws and regulations have been put in place to ensure that personal information is protected and secured. The threat of litigation and financial penalties are motivating organizations and individuals to institute appropriate mitigating measures.

Laws and Regulations

A number of new U.S. Federal and state laws and regulations have recently passed (or are pending) that address the risk associated with organizations not adequately protecting the identity data in their custodial care. These mandates address policy and business practices as well as ensuring that appropriate operational and information technology security measures are instituted.

One piece of legislation that was recently passed specifically to address the identity theft issue is the California Security Breach Information Act (SB 1386), which requires commercial organizations to notify their customers whenever they suspect the security of a customer’s data has been compromised. This notification is required regardless of whether there is evidence that an individual’s data file has actually been compromised. The Act also requires across-the-board notification if only one person’s file has been affected. The consequences for not complying with the notification requirement include financial penalties, negative publicity, and the risk of multiple civil lawsuits. These negative consequences create a strong incentive for affected companies to comply with the law. A bill has been introduced in the U.S. Congress modeled after the California law.  The bill is still in conference but could become law sometime over the next few years.

Other laws that directly affect privacy protection in the U.S. include Sarbanes-Oxley, Gramm-Leach-Bliley, and the Health Insurance Portability and Accountability Act. The common theme of all these laws is that sensitive information, be it personal, medical, or corporate financial, needs to be protected to prevent restricted or private data from being accessed by unauthorized individuals or organizations.

Corporate Policies and Practices

More corporations and private sector organizations are modifying their business practices, operations, and policies to enforce the protection and appropriate use of private data. Certainly anyone who has a brokerage, banking, or credit card relationship with an institution has received privacy notices that describe how the institution protects and uses the private data entrusted to them to facilitate business-consumer transactions. 

One hallmark of these policies is the assurance provided to individuals that their private information will be protected and used only to support the delivery of services; indeed, this type of assurance is often promoted as a differentiator between competing organizations. Polls show that security and protection of information are key reasons why consumers choose one business over another, and the private sector is catering to this concern by including it in marketing and advertising campaigns.

In addition to policies, corporations have implemented business practices and processes that authenticate the identities of the people with whom they transact business to ensure that imposters and fraudsters are not granted access to sensitive information. Examples include fingerprinting people when they cash checks, using multi-factor authentication for web-based and face-to-face transactions, and employing layered security techniques to assure correct and reliable enforcement of access control privileges.

Government Policies and Practices

The U.S. Federal government has also instituted a number of policies and regulations designed to protect privacy and heighten security for the storage and use of personal data which it protects as a custodian. A number of initiatives under such headings as E-Authentication, FISMA/GISRA, and the Privacy Act now govern how the government collects, uses, and stores identity information. New access controls are being instituted and enforced, for both internal access by employees and access by the citizenry, and security measures are being increased to ensure the protection and privacy of stored information such as Social Security records and medical files.

Often, government initiatives to protect data and ensure privacy have led the way for similar programs in the private sector. Because the government manages some of the largest databases and identity systems in the world and is under constant public scrutiny, it is not surprising that it is leading the way in implementing policies, practices and technologies designed to protect identity and enhance privacy.

Individual Behavior: Steps You Can Take

Protecting one’s identity is not just the responsibility of governments and corporations. Individuals have an important role to play in protecting their own identities by taking appropriate, cautionary measures. There are a number of basic rules that individuals should follow, such as:

·         Shred or destroy trash that contains personal information (e.g., bank statements, credit card statements, bills).

·         Do not provide personal information to suspicious websites or individuals who contact you using email. The same rule also applies to telephone and mail communications. Thoroughly investigate and determine the authenticity and legitimacy of any person or organization that contacts you asking for personal identity information.

·         Be cognizant of how your identity credentials are used; make sure that your driver’s license, credit cards, and other credentials are not misused during transactions. Try not to let them out of your sight and maintain control of them to the fullest extent possible. 

·         Report lost or stolen credentials to the appropriate issuing authority immediately.

Identity Topic #3: Who Are You?—The Confusion over Identity Information and Determining Who You Are 

Introduction

Identity is represented by an assortment of information that can be tied to that individual and that describes an individual’s characteristics and uniqueness.

Who are we? In a societal context our identity is established through a series of events and relationships, starting with one’s birth, along with the resulting documentation. Our identity is represented to others through a patchwork of this identity documentation – original paper documents (or copies), ID cards, driver’s licenses, passports, and other types of credentials. In today’s world, managing these items and keeping them safe is an increasingly difficult challenge for all of us. 

How Many Identities Do We Have and Need?

All of us have and use numerous identities in our everyday lives. Some examples are:

·         Professional identity: identity information used by employers

·         Financial identity: identity information used by financial institutions, such as credit card information

·         Citizen identity: identity information used by governments, such as passport information.

·         Healthcare identity: identity information used by the healthcare industry

·         Online browsing/email identity: identity information used to access information on the Internet, such as usernames and passwords

·         Ecommerce identity: identity information used to carry out electronic transactions, such as account numbers, passwords, shipping addresses and credit card information

Technological and process solutions are available that can create more manageable and secure identity tools. Adopting these solutions can ease the fears we all have about identity theft and fraud and implement more efficient identity transactions. To understand these solutions, however, we must understand some of the challenges that underlie the concept of identity.

What Is Identity?

Identity is represented by an assortment of information that can be tied to that individual and that describes an individual’s characteristics and uniqueness. An identity in this context is the information concerning the person, not the actual person.

An identity can be made up of many pieces. Some common components of identity are:

·         Demographics: information describing who you are (name, address, phone number)

·         Biometrics: information measuring a person’s physical or behavioral characteristics (e.g., fingerprint, face, iris, hand, speech)

·         Actions: information describing what you do and/or where you go

·         Preferences: information describing what you like or choose to buy

·         Status: information describing your social status (member or nonmember, married or single, retired, grade level)

·         Transactions: information describing a person’s past transactions (financial credit status)

Current Identity Systems: Multi-use or Silo?

Identity systems have proliferated in today’s society. Some of these systems have developed into multiple-use identity systems while others remain essentially identity silos - single-use closed systems. The more applications a collection of identity information has and the more meaningful that information is to third parties, the more valuable that identity information becomes. The U.S. driver’s license is an example of a multi-use identity tool. Its primary purpose is to prove driving status but it can also be used to provide evidence of identity when opening a bank account, buying alcohol, boarding an airplane, or applying for a job. Another example of a multi-use identity system is a major credit/debit card. Holders of these cards can use them to purchase goods and services almost anywhere in the world. Other collections of identity information have limited use and are essentially identity silos, such as healthcare cards, single-retailer discount or member cards, single retailer credit cards, and online subscriber account information. Although this identity information is more limited in scope than multi-use information, it is less likely that this identity information will be revealed outside of the system in which it is used. For example, healthcare information may be less likely to be divulged to those not needing to know if it is kept within one identity system. Of course, the problem of privacy is not solved by putting identity information in silos. It must be emphasized that identity information is only as secure as the system designed to manage that identity information. Identity information that is in a siloed system is less likely to be divulged outside the system only because it is used and transported less often than information in a multi-use identity credential.

Putting the Individual at the Center of the Identity System

Because it is important for individuals to maintain control over their private identity information, it is necessary to understand where the individual fits in the general identity system structure. There are generally three parties to an identity system:

  1. Identity system providers: Entities that proof information, enroll individuals, and issue identity credentials. For example, governments provide identities to citizens through passports or visas.

  2. Identity system members: The people who must use identity information to obtain privileges. For example, an individual uses the ID badge issued by an employer to enter a secure facility.

  3. Identity system users: Organizations that rely on identities and credentials (banks, law enforcement, retailers). For example, an employer uses a person’s driver’s license or passport as proof of identity for a job application. 

As we can see, the individual is indeed at the center of the identity system – or maybe more aptly put – stuck in the middle. With identity system providers responsible for collecting, verifying, and storing identity information, and identity system users clamoring to get access to this data, it’s no wonder that individuals get nervous about their identity information. So what to do?  Well, some of the main concerns that we all have regarding identity systems can be addressed by incorporating robust and auditable policies, practices and processes into our identity systems. The following are some guidelines to use when creating an identity system:

·         Consent.  Establish identity systems that enforce a policy of consent when transferring identity information. Identity systems should only reveal information identifying a person with the person’s consent. The information should be limited to the information that is necessary to complete the transaction.

·         Transparency. An individual should be able to “see” how identity information is being used. Although individuals may not be authorized to modify transaction information, both they and the entity they are interacting with are best served if the information is visible to them. Visible information creates a higher level of trust between the individual and the entity and also creates a feedback security loop to help individuals police the use of their identity information. (For example, credit card companies allow their customers to access a list of monthly transactions. Fraudulent credit card transactions are often reported by the customer.)

·         Privacy and security.  Incorporate privacy and security features as fundamental and pervasive elements of the identity system.

·         Interoperability. Make the identity system interoperable, so that the individual can use the identity information broadly.

·         Biometrics. Use biometrics as an integral part of the identity system, so that a person is physically associated with the identity information and the identity credential.

·         Ease of use. Adopt ease of use as a primary design principle. The user experience should be simple and consistent. Automating transactions to reduce time and complexity is an important consideration.

Identity Topic #4: Is Technology a Threat to an Individual’s Identity?

Introduction

When our governments consider the hazards and benefits of society’s adoption of a new technology protecting our identities, legislating against its use instead of making illegal its misuse will inevitably “throw the baby out with the bath water,” depriving society of the technology’s benefits.

Our shrinking world compels individuals and societies to be constantly thoughtful of the need to protect our own identities and to know with certainty the identity of those with whom we trust our wealth, our privacy, and our security. When confronted with new opportunities for increased commerce, freedom of movement, communication, and knowledge, we’ve almost always chosen to move forward and have repeatedly turned to technology to enable us to do so and to protect us against the threats accompanying these new opportunities. 

All changes to the status quo entail costs and risks. The challenge is to find ways to make informed decisions about the costs, risks, and benefits of using new technologies to protect our identities. The process we use to evaluate new technologies is critical to achieving benefits from their adoption.

What Has Technology Done for Us Recently to Protect our Identities?

Reliable identification is critical to transactions between parties who have inadequate knowledge of each other. The success of such transactions relies on a trusted third party being able to vouch for the participants’ identities. Third-party testimonials are used in face-to-face transactions of all kinds and in remote transactions, such as purchases over the phone and the Internet. The identity credential issued by the third party must be portable; otherwise, we would constantly be relying on in-person validation like that performed by a notary, something that is inconvenient, costly, and time consuming.

Technology has been able to improve and protect our transactions with strangers and our personal information in a variety of ways. Technology makes such transactions faster, more secure, and more convenient (for example, contactless payment systems like American Express® ExpressPay) and makes access to personal information more secure (for example, biometric authenticators like fingerprints and iris scans). Credentials containing our identities (for example, the new U.S. electronic passport containing a chip) are made more secure by using smart cards that employ the latest cryptographic methods to protect the data on the card and authenticate the entity accessing the data. Smart cards are also being used to protect access to our personal information over public and private networks. These are just a few examples of how technology is being used today to help individuals protect their personal information.

Who Controls When New Technologies Are Adopted?

In our private lives, technological solutions for protecting our identities or increasing our ability to interact more easily with others are typically adopted incrementally. Trade-offs among security, privacy, convenience and cost are continually balanced and rebalanced by mechanisms of our free markets. Some people choose to adopt new technologies immediately, while others choose to wait until the technology is “proven.” We decide when the time is right for each of us.

Currently, our society as a whole is faced with threats to its physical security posed by the falsification of identities at the state and Federal level, and government is charged with addressing these challenges. However, any technological solutions that are chosen to combat these threats cannot be imposed incrementally. The implications of implementing a new technology throughout an entire society are far reaching, and we need to understand and balance the tradeoffs between security, privacy, convenience, and cost immediately.

Don’t We Need Laws to Control Adoption of Technology Protecting our Identities? 

With technology becoming more prevalent and complex and with the pace of change accelerating, governments are struggling to keep up with new threats to their citizens’ identities. Two legislative alternatives commonly considered in such situations are to:

  1. Legislate against new technologies until they are adequately “proven” or deemed safe; or

  2. Outlaw the willful misuse of new technologies, and legislate the responsibility for damages in the event of failures with no criminal intent. 

The first approach carries the genuine risk of “throwing the baby out with the bath water” and depriving society of the benefits of a new technology. The latter allows the benefits to accrue to society without locking in the status quo or selecting technological favorites that can result in stifling competition and increasing costs to society.

How Should Governments Decide Whether to Enact New Laws Governing a Technology? 

A new technology that protects our identities is by nature complex, and reaching a full understanding of its benefits, risks to citizens’ privacy, and vulnerabilities is difficult. Only by involving a wide range of experts and balancing all the pros and cons can logical decisions be made. 

  • Identity technologists – to explain methods of operation, limits on performance, financial limits on enhancement, and types and likelihood of misuse. 

·         Privacy and consumer advocates – to identify the risks associated with the use and possible misuse of a new technology. 

·         Policy experts – to identify how the technology can and should be used procedurally.

Any decision reached without the involvement of all of these parties in an open forum will invariably result in skewed decisions that may deprive us of the proper benefits of the technology.

It is most important, however, to keep in mind that technology is merely one part of the solution to the problem of protecting our identities and validating them to others. The complete solution is a system that must include policies, procedures, and practices describing how people are to interact with the system. In the end, the strength of a system is only as great as the adherence by the people using the system to these policies and procedures. Technology in general, and smart cards and biometrics in particular, are powerful tools for enforcing adherence to policies and procedures.

Identity Topic #5: How Do You Prove Your Identity?—The Problems with Breeder Documents

Introduction

A breeder document is so named because it is usually a source of identity to apply for (or breed) other forms of identity credentials.

A number of years ago, Australia embarked on a project to digitize all birth, death, and immigration records and maintain them centrally as electronic records. The thinking was "if you are here, you were either born here or you came here, and thus there should be a record on you."  In the United States, an E-Government project known as E-Vital was initiated to digitize and make available some of the same kinds of records. However, only death records are currently (mostly) centralized and electronically stored, as a result of the Federal government paying the states to digitize death certificates. Progress on automating other vital records has been very slow. Birth, death, marriage, divorce, and other records may be both issued and maintained in multiple places. At best, such records are automated and maintained at the state level; at worst, they are not automated and are stored in counties across the country.

The Challenge with Breeder Documents

Australia is a good example to use to consider the concept of providing a secure and verifiable identity for every person in a country. Suppose that Australia decided to issue a national ID card to all of its residents. Australia certainly has the technology needed to produce a credential that could include biometrics, the issuer’s digital signature, and PKI certificates. Such a credential could properly be viewed as very secure and be tied to the holder in a way that would make it very hard to counterfeit or alter. 

By issuing such a credential, Australia would solve half the problem:  a central database would confirm the existence and legal presence of every credential holder. The other half of the problem would remain unsolved, however: how to be certain that the person who presents a birth certificate or other “breeder” document to obtain the credential is the true owner of that document. 

The Australian example illustrates the obvious problem for the United States. The United States can automate a record system and put records in a central place. A central database can be queried to verify a person’s existence and permit a very secure, biometrically linked credential to be issued. However, two very important things cannot be done: 

  1. The authenticity of the documents presented to establish identity cannot be validated.

  2. The individual presenting a document cannot be tied to the document. 

Most documents simply do not have enough built-in security to be verified, and few documents can be tied to the individual presenting the document. 

In general, this problem is true of most of the documents used to establish identity in the United States, with the exception of the passport and the alien registration card. These documents, which are at the top of the identity food chain, are the product of an identity proofing or adjudication process and contain a variety of security features that can be authenticated and that make them virtually tamper-proof. 

However, the identity vetting process that precedes issuance of even these documents relies on much less secure documents: birth certificates, driver's licenses, Social Security cards, and foreign passports. The acceptance of documents that may not be genuine or of genuine documents that are not the property of the presenter can result in the issuance of a highly secure credential to an individual other than the individual identified by the breeder documents and a false sense of security in the identity verification process.

 

The United States has a breeder document problem that it is nowhere close to solving and that may not ever be solved. We do not have databases that can be accessed to determine whether a person actually exists. We do not, for the most part, produce birth certificates, social security cards, or, in some cases, driver's licenses that can be authenticated. We do not have the ability to tie most of these breeder documents to the bearer biometrically. 

The Root of the Problem

The birth certificate is both the start and the heart of the problem. Over 100 million birth certificates are issued in this country each year, and in about a dozen states, they are public documents available to anyone who wants a copy. Even in states that ask for some indication of entitlement the controls are very weak. We cannot readily verify the validity of a birth certificate, nor can we be sure that it belongs to the person presenting it. Very good false birth certificates are readily available over the Internet or (in certain geographical areas) from open document markets. These birth certificates can then be used to obtain other legitimate documents, such as driver's licenses, Social Security cards, and potentially even passports. Most issuers of legitimate documents have made little or no investment in the few available technologies that could help them detect bad breeder documents. For example, virtually no organization other than the U.S. Department of State has been willing to incorporate chip technology into documents issued to members of the public. 

Possible Solutions

Solving these problems can be expensive, and the solutions could take many years to implement. Some are sure to raise sensitive issues regarding identity information. One of the more comprehensive solutions involves capturing DNA, tying it to a birth certificate, and linking other biometric information (such as facial images, fingerprints, or retinal images) to the DNA. Another option is to require that older documents be reissued and tied to a rigorous identity-proofing process before a driver’s license or passport can be obtained. These solutions may require that national standards be set for a variety of documents issued by state and local governments. Perhaps most difficult and controversial of all, such solutions could involve the creation of central databases that contain not only vital records but also biometric measures that tie the records to a specific individual. Such databases could be used to verify not only the existence of a document but also that the presenter is the true owner of the identity to which the document attests. 

A more workable interim solution may be to require new identity document applicants to go through a rigor