Tag: identity passport online

Don’t call us

24th May 2010by Consult HyperionLeave a comment

[Dave Birch] I had a new phone line added to my home office recently: I find about one message a day there from companies offering to consolidate my debts into a single loan with one easy monthly payment and suggesting that a new law means that I may not have to repay my bank loans or credit card debts at all. Since there are very few people who know my home office number, I assume that either Virgin sold the new number details to some loan sharks or that they are simply autodialling all numbers except those registered with the telephone preference service (TPS). (To be fair, my home number is registered with the TPS and it never gets these calls, so the system clearly works, so instead of moaning about it on a blog I really should call the TPS again).

The TPS is a practical “sharp end” privacy issue. Another case study. A mobile phone number directory was launched in the UK. I immediately wondered how to get off of it. So I asked for advice on Twitter, and the posse (I prefer that to “mob”) told me to text “E” to 118 800, which I did. You could also opt out online, which so many people did that the system crashed.

But what’s interesting is how violently people now feel about their privacy. In an age when many are apparently happy to share intimate details of their lives on social networks – even shots of their husbands in their swimming trunks – it seems that we feel our mobile numbers are uniquely private.
[From BBC – dot.life: 118800 and a web revolution]

Ultimately, as you may remember, the uproar continued until…

the controversial mobile phone directory service 118 800 had been suspended.
[From Datonomy: UK mobile subscribers revolt against new directory]

So why were people so upset? Why don’t they do what I do? I’m not that bothered about the unsolicited calls to my home office number because all calls are screened: I don’t pick up the phone unless the number is recognised, and if it isn’t recognised I always let it go to answering machine. I never answer a call on my mobile phone unless the caller ID is displayed from my contact book: if you’re not in my contact book, you have to leave a voicemail. This works fine. But the issue isn’t the practicality, it’s the principle. As Robin Wilton wrote at the time

The issue here, to my mind, is one of informed consent. I can honestly claim that I have never knowingly disclosed my mobile number for the purpose of having it listed in a directory enquiries service.
[From Racingsnake – the blog of Future Identity: Mobile Directory Enquiries still broken]

Now I am theoretically ex-directory. (And to be fair, to date, I haven’t received any unsolicited commercial calls on my mobile.) The database of 42 million mobile phone numbers still remains, however.

identity, management, privacy, security

Continue reading “Don’t call us”

Digital division

7th December 2009by Consult Hyperion2 Comments

[Dave Birch] There was yet another debate about the “digital divide” in London, featuring the British government’s technology tzarina, Martha Lane Fox (note for foreign readers: Martha Lane Fox was a co-founder of the famous internet enterprise Lastminute.com), who is charged with forcing a recalcitrant populace — one-sixth of Britons say they don’t want the web — to log on to things. There are 10 million people in Britain who have never been on the Internet and the Digital Inclusion Task Force has to get 4 million of them “online” by 2012, otherwise… Actually, I don’t know what the “otherwise” clause is, so had better move on.

At the debate, they were (essentially) talking about the divide between people who order books online from Amazon and people who don’t, and I’m sure this is an important topic, but I’m not that interested in it. I once got into trouble in a meeting with a public sector customer because I said that people who weren’t on the web generally didn’t want to be, and since they could clearly afford Sky television and mobile phones, I didn’t think that it really mattered that they chose not to buy broadband. But I digress.

Is there an interesting, and more important, digital divide? Yes, there is. And it’s the digital divide between the developed world and the developing world. But it’s not what you think and, as Tomi Ahonen frequently points out, it’s got nothing to do with “one laptop per child” or submarine cables for internet access.

In the Industrialized World we have TVs, PCs, FM radios, fixed landlines and mobile phones to consider and compare and use and more than half of the population has one of each of those. In the Developing World, the only technology that reaches half the population is mobile telecoms, and all others are tiny in comparison. For the Emerging World, mobile is not only the first screen it is literally the only screen.
[From Communities Dominate Brands: The Digital Divide in Numbers: TVs, PCs, Internet users, Mobile around the world]

If we are going to deliver services to the mass of people in the developing world, services that are going to improve the lives of the mass of the population, then we need to focus those services on the mobile channel.

# The mobile device will be the primary connection tool to the internet for most people in the world in 2020.
# The transparency of people and organizations will increase, but that will not necessarily yield more personal integrity, social tolerance, or forgiveness.
# Voice recognition and touch user-interfaces with the internet will be more prevalent and accepted by 2020.
[From Pontydysgu – Bridge to Learning » Blog Archive » Digital Identities and Social Relations]

This seems like a reasonable projection given current trends and a bit of imagination and, personally, I think that the issue of transparency may well have the most impact, changing both businesses and government in ways that we haven’t taken on board yet but that’s an issue for another day. But take these points on board, particularly the reinforcing synergies between the mobile phone as the device, the mobile phone as the tool for opening up organisations and the mobile phone as locus for the voice interface (which, together with voice authentication, will transform identity and authentication).

Continue reading “Digital division”

Bring it on

29th July 2009by Consult Hyperion1 Comment

[Dave Birch] As has been mentioned once or twice, the world of social networking provides a specific and immediate kind of weapons range for testing new ideas about identity and privacy. Facebook, in particular, seems to developing an emergent properties space where all sorts of experiments are already under way with the identity concepts at their core already one step removed from the common sense” view of identity . There is one class of experiment that I find particularly fascinating, and these are about matching and comparing the “grown ups” perspective against the “kids” perspective. US examples are always more acute because they involve law suits, so let’s start there. Here’s a fabulous example.

a suit was filed in Mississippi that alleges a school official—more specifically a teacher acting in her capacity as a cheerleading coach—demanded that members of her squad hand over their Facebook login information. According to the suit, the teacher used it to access a student’s account, which included a heated discussion of some of the cheerleading squad’s internal politics. That information was then shared widely among school administrators, which resulted in the student receiving various sanctions.
[From Cheerleader sues school, coach after illicit Facebook log-in – Ars Technica]

This follows on from other recent stories about employers demanding log in passwords for social networks and so forth. If my employer wanted my LinkedIn password, I would regard it is transparent evidence of their insanity and a clear flag that our working relationship had collapsed. But if you’re a kid and it’s a teacher asking, I suppose you might feel under pressure to comply with something that’s obviously a breach of natural justice. Not surprising, in many ways, because it’s always difficult for social mores to adjust to new technologies — people used to be given instructions for answering the telephone — and this stuff is still really, really new. People don’t yet have sense of what is naturally right or wrong in the new environment.

So, people in authority behave inappropriately when faced with new technology. No big surprise. But what I found fascinating about this story — and the lesson it contains about emerging “norms” around identity in a digital age — was the reaction of some other kids faced with the same demand.

…several other students asked for their logins simply deleted their accounts using their cell phones, preventing this sort of intrusion; the schools apparently have a filter that blocks access to its Web interface from school computers.
[From Cheerleader sues school, coach after illicit Facebook log-in – Ars Technica]

In a way, I find this heartwarming. The kids aren’t stupid: they live in that world and they can distinguish their multiple virtual identities. Faced with a privacy violation that undermines a virtual identity, they slash and burn. And the school’s efforts to prevent them manipulating their virtual identities are fruitless.

Continue reading “Bring it on”

Data shrinkage

22nd June 2009by Consult Hyperion2 Comments

[Dave Birch] There are a flurry of stories about the British government abandoning the ID card scheme, a course of action to my mind as bad as continuing with it. What we need is a better ID cards scheme, not no ID card scheme. But who knows what might happen now that there is a new Home Secretary, but earlier in the year the Home Office made some more announcements about the introduction of ID cards in the UK. As I’ve mentioned, they’re going to start in Manchester. I was more interested in what the Home Office said about enrollment though, because as we all know this is the critical phase of an ID project from the point of view of security. A number of people expressed concern that the government was going to use high street retailers for the enrollment process, to save the cost of building specialist enrollment stations in suitable premises in major population centres in the UK (otherwise known as Post Offices). One area of concern is security, but here the retailers were quick to reassure:

High Street retailers have rejected security fears about giving them the job of fingerprinting and photographing people applying for identity cards… Trade bodies representing chains such as Boots and Snappy Snaps told the BBC they can be trusted with the data.
[From BBC NEWS | Politics | Retailers reject ID security fear]

Now, I don’t want to be the one in the glass house throwing stones, because I don’t doubt that I’ve left the odd memory stick around here and there, but I was sure I could remember seeing Boots’ name last year in connection with looking after personal data. A quick bit of web browsing and my imperfect memory was rendered perfect by the World Brain (aka Google):

Major U.K. chemist (drug store) chain Boots has joined the growing list of organizations suffering an embarrassing storage snafu after tapes containing personal details of thousands of customers and employees were stolen… The records reportedly include the bank details of 27,000 customers of Boots’ dental service, which is operated by Medisure, as well as the personal details of some 8,000 Boots employees.
[From Tape Loss Stuns UK Retail Giant – Data Security News Analysis – Byte and Switch]

Whoops! Still, it’s not like the tapes had fingerprints on them or anything like that. Hold on a second: tapes? I thought it was puzzling that in the age of SSL and the interweb, HMRC were still posting unencrypted CDs full of personal data around the place. But tapes?

Continue reading “Data shrinkage”

Hello? Who’s that? Oh wait, let me google you

7th June 2009by Consult Hyperion1 Comment

[Dave Birch] Central to the direction of digital identity is the issue of the connection between real and virtual identities. How is that connection formed, who controls it, who should have access to it, that kind of thing. Now, you can see that one way to make this connection is to demand a one-to-one “hard” correspondence between the physical identity and the virtual identity, constraining the digital identity completely. To do this you would need to register anyone obtaining any kind of virtual identity. I don’t just mean on the web. A mobile phone number is a virtual identity. Oh wait…

Everyone who buys a mobile telephone will be forced to register their identity on a national database under government plans to extend massively the powers of state surveillance.
[From Passports will be needed to buy mobile phones – Times Online]

This is hardly an original idea. It’s already the case in many countries that law-abiding citizens have to provide identity documentation in order to obtain a mobile phone. Ah, you might say, that’s not going to help catch criminals — which I’m sure isn’t true, as such an initiative must necessarily catch some stupid criminals — because the criminals will just carry on using pre-paid SIMs that have not been registered. Well, yes, but surely if a government makes a law that SIMs must be registered, then it will naturally get the operators to block all of the SIMs that haven’t been registered, as they are in the process of doing in Botswana.

The process of registering all prepaid Subscriber Identity Module (SIM) cards in the country will start in September, says the Chief Executive of Botswana Telecommunications Authority (BTA), Mr Thari Pheko. Speaking at a press conference in Gaborone this week… Mr Pheko said the registration process was expected to take 17 months and will be completed on the last day of 2009, adding that unregistered cards will be taken off-air in the beginning of 2010.
[From BOPA Daily News Archive]

Something similar is underway a little closer to home, in Spain.

From November 9, 2007, people who purchased pre-paid mobile phones have been obliged to provide proof of identity, but for those who purchased phones before this date, a two-year period of grace was granted which runs out on November 9, 2009. It is estimated that more than 15 million pay-as-you-go phones are still unregistered in Spain.
[From Costa News – Mobile phone cut-off]

If there is going to be a government database of all mobile phone numbers against registered names, then surely the only way to manage the new identity world that it creates is to just put it on the web and let new businesses spring up to use it. It’s the same principal as with initiatives around health and all sorts of other personal data. If people believe that their connection to their mobile phone number is “secure” but it isn’t, then the outcomes will be perverse. The bad guys will have access to the data and the good guys won’t. Since there is no more possibility of keeping this database secure than keeping, for sake of emotive comparison, the Children’s Index secure, isn’t it better to make it available for mash-up? And, by the way, I didn’t choose this emotive example at random…

Security flaws have halted work on the internet database designed to hold the details of 11 million children and teenagers. The Department for Children, Schools and Families (DCSF) admitted last night that it had uncovered problems in the system for shielding details of an estimated 55,000 vulnerable children.
[From Security flaws halt work on ContactPoint child database – Times Online]

If you can’t keep a government database like this secure, what chance is there of keeping a government database of mobile phone IDs secure?

Continue reading “Hello? Who’s that? Oh wait, let me google you”

Government interface

19th May 2009by Consult Hyperion2 Comments

[Dave Birch] For e-government to take off, it is transparently obvious that population scale identification and authentication infrastructure (beyond e-mail address and alphanumeric passwords) will have to be in place. If not, the pain associated with every single online interaction with the public sector will grow far beyond the point where the bulk of the population will want to get involved and there will be a hard limit on the efficiency of the delivery of public services. No-one, surely, can be against that. Yet we don’t seem to making much progress towards this. Even in cases (in the UK) where online service delivery works very well indeed (eg, vehicle tax), it does so in silos.

Now, many people will (quite rightly) point out that there is a fundamental danger to the idea of using a single identity across all services. There’s a particular danger to using to the same identity across public and private sector services.

In yet another security breach, the US State Department said 400 passport applicants, and maybe more, have had information stolen. Passport applications containing personal information, including Social Security numbers, were accessed and used to open fraudulent credit card accounts. A fraud ring bought information from a government employee. The information was used to apply for cards. Cards were intercepted by another insider in the post office before they were delivered. The passport applicants had no idea their identity had been stolen.
[From National ACH: Government Employees Selling Identities]

Now, that’s the kind of fraud that imagine was dismissed out of hand by the government’s management consultants when they were procuring the system. “Insiders in the Post Office connecting to insiders in the State Department? Oh, come on! That’s like a Tom Clancy novel, it will never happen.”

It this sort of thing — and it seems to happen all the time — that means that many people react against the very idea of a government identity or a government identity management system, although I draw a different conclusion: we need a better (privacy-enhancing) design for a government identity management system, perhaps building on the schemes used in countries such a Germany and Austria where identities are cyptographically-partitioned between service providers.

(Obviously, I trust the Government even less. I’d much rather have O2 manage my ID than the Home Secretary. SIMs are more secure, cheaper and better-managed than the UK’s ridiculous Stalinist ID card system).
[From Dean Bubley’s Disruptive Wireless: Thoughts on managed identity services by mobile operators]

What we want, surely, is the best of both worlds. I want my SIM to hold a number of identities, including government ones, that I can choose to use on a per-transaction basis. And I don’t think it’s far-fetched to expect this kind of modern infrastructure.

Continue reading “Government interface”

Government interface

24th March 2009by Consult Hyperion2 Comments

[Dave Birch] Government identity is so important that the vigilance of the “issuers” must be unwavering. Thus, the rest of the identity management value network can function. It’s so important that one might even go so far as to say that a key role of government should be to test it’s own vigilance in an open and transparent way. In other words, shouldn’t parts of the government be checking up on other parts of the government and telling us what happened. This would be a really interesting experiment to try here in the UK, now that the government has started issuing identity cards. It would be great to have some reassurance that the process is indeed protecting us from international terrorists, dole scroungers and health tourists. The National Audit Office (NAO) could try and obtain bogus identity documents from the Identity and Passport Service (IPS) and see what happens. Just like the recent experiment in the US.

To do so, GAO designed four test scenarios that simulated the actions of a malicious individual who had access to an American citizen’s personal identity information. GAO created counterfeit documents for four fictitious or deceased individuals using off-the-shelf, commercially available hardware, software, and materials. An undercover GAO investigator then applied for passports at three United States Postal Service (USPS) locations and a State-run passport office.
[From Security Document World]

And the results? Did the ever-vigilant staff, the best IT that money can buy and the process designed by top management consultants come together to defeat these almost trivial attempts to deceive?

In its four tests simulating this approach it was successful in obtaining a genuine U.S. passport in each case.
[From Security Document World]

Uh oh.

Continue reading “Government interface”