If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

Schneier on Security: Separating Data Ownership and Device Ownership
A(nother) good article by Schneier on the security issues when data is owned by someone other than the controller of the medium.

(Original image)

When the Nazis came for the communists,
I remained silent;
I was not a communist.

When they locked up the social democrats,
I remained silent;
I was not a social democrat.

When they came for the trade unionists,
I did not speak out;
I was not a trade unionist.

When they came for me,
there was no one left to speak out.

People often counter discussions about privacy with the phrase “If you’ve got nothing to hide, you’ve got nothing to fear”. There have been some great counters to this (my favourite been “So why do you have net curtains?”), but I think sometimes we need a reminder that privacy IS important. The picture above was a fantastic No2ID advert that ran in the Guardian recently. Complaints were received, but it was decided that the image is not offensive. For more information on the poem, see here.

Techdirt: Forget ID Cards, UK Police To Begin Scanning Your Fingerprints On The Street

I’m naturally suspicious of this sort of thing generally and there are a number of implications of this that I’ve not seen covered yet (particularly by the BBC TV news where I first heard it).

The stated goal of the scheme is to prevent drivers from giving false information to the police when stopped for traffic offences (in general, non-arrestable offences). One immediate flaw I can see in this is that (currently) only a small percentage (about ten) of the population already have their fingerprints stored in the police database (I’m fairly confident, that having never been arrested, I’m not in that group - although I seem to recall a school visit to the local police station at about age 10 that included a demonstration of fingerprinting - what happened to the prints I gave?). If such a person is stopped for speeding (as an example) then this method would not help in verifying their identity! What do the police do in this situation?

If I carry around my driving license (I do generally keep it in my car), then can that be used to verify my identity and the data matched up to the prints that I’ve just given? What if my prints aren’t on record and I don’t have supporting identity information? The usual scenario (when a person does not have their license) is to be given an order to produce the driving license within a week. Whilst in trial stage, fingerprints taken with mobile scanners will not be kept, but presumably, when this is deemed a success and rolled out fully that will not be the case and could prove a very effective method of loading the database quickly (especially in conjunction with passport renewals leading to the ID card system).

The mobile fingerprint scanning device is only 95% accurate and only about 6% of people will be in the group of drivers who give false information and have fingerprints already on file (which has to be the target group). How successful will this scheme really be?

Addendum: More here (from The Register).

My former colleague Paul Toal (If anyone has seen where he stashed the escape plan, let me know! ) has been involved in a posting conversation with Paul Madsen (1, 2, 3, 4), both highlighting their inabilities to comment on the other’s blog. I guess that trackbacks are too much to ask for in 2006… (Oh, Blogger doesn’t support those either! - having said that I’m still not convinced trackbacks work properly from here anyway).

My own thought is that the OpenID plug-in for Wordpress is not quite perfect - it seems to do the job in most cases, but there are some little oddities about the implementation (I couldn’t do any better before anyone says anything!) as I’ve found a few quirks myself. I’d hope that WordPress 3.0 includes OpenID by default (PLEASE!) as it should be on the way to becoming the dominant personal identity implementation. Whilst I’m still using the plug-in here one change I’ve made recently is to actually allow unauthenticated comments - anyone wanting to use OpenID (or even register for an account here!) can still do so.

I think that the discussion highlights the requirement for consistency in identity verification - whilst I can see the captchas on Paul Madsen’s blog I’ve had problems with them before (and my eyesight is still perfect!) and they’re not my favourite method to avoid spam (which is, after all, the primary reason for authentication on almost any blog).

U.K. Dept of Health: Prescription for Disaster
Doctors ambivalent about NHS IT

More commentary on ongoing NHS NPfIT - a project which more and more is looking like a white elephant. One thing that is important for any IT project is support from the users (primarily in this case, doctors) along with properly defined goals and requirements and that does not seem to have happened here. The desire to constantly recreate existing processes and software (NIHS) is hurting even more - this seems endemic with any Government IT project (and not just in the UK). More importantly - IT is just not a priority (I’d make the analogy to the idea of giving a laptop to children in the developing world instead of curing malaria) in health care - at least not to this extent (I think there are some cost savings and security problems to fix) and the money would be best used for healthcare.

The Sheep Market
Just. Bizarre. Strangely interesting though!

JasonKolb.com: Idea #14: Google yourself
Rough Type: Nicholas Carr’s Blog: Links aren’t messy anymore

Jason Kolb picks up on the story running about Ted Leonsis’s “gaming” of Google - attempting to get, and achieving, the highest ranking for a search of his name. As I read the initial story I started to think about how this relates to identity and I’m glad to see that Jason has picked up on this.

The implications of this story are important for everyone - I wrote previously regarding the way that an online life WILL intrude in the real world at some point (as the identity becomes de-fragmented) - so if there’s going to be data about you on-line you should make sure it’s either accurate or flattering (and preferably both!) (and also demonstrating that a certain amount of identity de-fragmentation is a good thing). The trick here is to make sure that the right things can be linked back to a person.

This is a difficult thing to do on a global scale - the most common identifier a person has is their name, something that has evolved over the years and is certainly not unique. It’s a problem that needs to be addressed - not just in a digital identity sense; we’ve seen recently examples of problems with the NO-FLY lists in the US where a person is blocked purely based on their name, meanwhile I can start using any name I like right now (and legally change it if I want to increase the speed at which reputational data is attached). It’s this desire for a context unique identifier that leads to the issuing of SSNs (or, as we in the UK have, NI numbers) by nations - combining those into a global system is beyond political desire right now, but one can imagine a future where that is not the case.

In the digital world, we do have globally unique identifiers - URIs and email addresses have to be unique. The problem (and I’ve mentioned this before as well) is that URIs (in the current format) are not permanent - I rent this domain for a period of time (2 years), after which it may lapse. Even worse is that the domain name may be taken away from me! It’s pretty unlikely to happen in my case, but there have been situations where that has happened (and many more where it has been threatened) - it seems to happen more in the name of companies and/or products and the larger party just bullies the smaller into giving up a name and thus, identity.

Fighting over domain names doesn’t happen so much any more and one of the primary reasons for that is Google. I actually saw someone a few days ago, when looking for The Register, type “the register” into Google and then just click on the top result. Other, smarter, people have commented on this before, but the effect is that domain names are NOT as valuable as they were; their place taken by a Google rank. When I first started blogging a search for my name didn’t turn up any results for me until the second page - now I have 4th place in Google (I’m obviously not as influential as Ted Leonsis!), but why shouldn’t I have the top result?

There are legal arguments ongoing now about SEO (or even worse, look at the potential confusion between u-tube and youtube!) and it’s a sad reflection that the top indicator of a person’s (or brand’s or company’s) identity is the placement on a Google search results page - but why shouldn’t we, as individuals, control how our data are displayed? Google doesn’t owe me anything, but I can see why people fight so hard to get noticed and there are no easy solutions to this.

The upshot is that finding something by keyword in Google (or any other search engine) is always going to be unreliable - when I’m looking for orange would I prefer to see information a colour or a Wikipedia entry on William I? Context and semantics raise their ugly heads again and until they are properly applied to our interactions then our current methods of identifying an object will nearly always fail when systems are scaled.

Schneier on Security: Why Management Doesn’t Get IT Security
This matches my own experiences - security is often not give a strategic level consideration and tends to be forgotten about until it’s too late!

On Thursday evening I attended an event hosted by Oracle in London - “Information Security and ID Management Strategies” - as part of their architect’s club (the first I’d attended).

Apart from being an excellent networking opportunity (to which I stupidly forgot to take business cards!) there were a couple of excellent speeches from John Madelin (formerly of RSA, but who now works for BT) and Des Powley (of Oracle), before a rigorous Q&A session. Madelin’s presentation was a very “blue skies” look at identity federations and how that will change with the increasing connectedness of our world - one thing that was very significant was the use of the word fragments to describe the separate parts of ones identity. We increasingly find that those fragments are being pieced together to allow others to see a whole that in many cases the owner of an identity themselves cannot view.

The Q&A session introduced Toby Stevens (along with the other speakers) and the questions came forth from a surprisingly willing audience! First and foremost on peoples minds when the word identity is used seems to be that of ID cards, but what I think becomes very clear is that these are merely representational of the process of de-fragmenting identity, but on a large scale, in the current guise. Identity on a national scale should be about enabling, not just access control (which tends to be the focus of corporate identity projects) and there needs to be part of that focusing on privacy aspects - it’s not desirable to have everyone knowing everyone’s business! There were some wonderful examples given of where privacy is paramount, but where individuals require access to services (therefore the system must adhere to Law 2 of Kim Cameron’s Laws of Identity disclosing the least amount of data required). This is very much at odds of most people’s concept of an ID card - and certainly at odds with what the Government is proposing (the idea of allowing privately owned stores to read data from a card when a purchase is made is ludicrous!)

Right at the very end of the session, the question was raised of how the concept of roles fits into this, but unfortunately the discussion was brought to a close… My own take on this is that identity is best dealt with in classes (or roles) of individuals - a good (my favourite) example of this is the case of a person wishing to buy beer. The thing that the bar tender requires is NOT proof of age, but merely that the person presenting the card is over the age of eighteen, presumably verified by a trusted third party (of course there must be some authentication method present, I’d expect a visual one would be adequate for this!). In this parlance the bar habitué needs belong to the role of “Over 18s”, but no other data are released during the transaction - using current identification methods there are data leaked (a driving license contains an address, DOB, endorsements etc). This convergence of roles into the wider identity space is something I think should be explored further.

Perhaps the best thing to come out of the event was a realisation by some of my more sceptical colleagues that privacy IS important after all, and that bodes well for persuading the general public.

Addendum (14/11/06 @ 00:28): Paul Toal was also there

NHS IT chief failed computer studies course | The Register

There’s a few points to be made about this story, which by this time will probably have been picked up on elsewhere. Firstly, I think this is a good indication of why one should always be nice to their mother…

The most important things are that it doesn’t really matter whether Granger passed the exam or not (although I wonder about the circumstances of writing to Princess Anne to ask for a resit!), or that he got a 2:2 in Geology - I don’t believe that the best people for forming IT strategy are necessarily those who have been embedded in IT, or that it necessarily requires a great academic to perform this task - Granger’s deeds since university obviously speak for themselves (particularly as a partner at Deloitte). The most significant aspect of this story is the way that Granger’s mother has decided to go to the press about this - her comments regarding the cost of the CFH project, taking vital money out of front-line services are telling and something that many people (myself included) believe. Quite simply, the benefits of the project will not, in my opinion, match the costs - which is terrible, particularly in the current conditions of cost cutting.

I’ve commented previously on the book “Plundering the Public Sector” which details a lot of the problems with the whole CFH project in particular (and government IT projects in general). One of the things highlighted in that book is the presence of large numbers of consultants in the civil service and projects such as this, showing that, effectively, consulting companies are running government strategy.

All comments and opinions really are my own and nothing to do with any organisation I may be linked to (I should probably put this as a standard disclaimer somewhere )