Can You Steal My Identity?
November 22nd, 2006
It really depends on what you think a person’s identity actually is. Last week at the Digital Identity Forum (http://www.digitalidforum.com/ ) arranged by Consult-Hyperion in London the participants discussed and challenged many such basic concepts and tried to better understand the implications. Even with the seasoned David Birch stimulating delegates throughout the two day event I left with more questions than answers and perhaps that’s what you expect because Digital Identity is still a relatively new concept.
Yvonne Jewkes and Emily Finch authors of the book Dot.cons, Crime, deviance and identity on the internet started the ball rolling. They argued that identity has three components, Personal, Social, and Legal. Personal is the inner self that cannot be stolen, Social is the role we play in society (e.g. director of a company, membership of clubs, etc) while Legal is a collection of facts about us. Only the latter component can be stolen.
Emily recounted the tale of Lee Simm who reported his flatmate Karl Hackett as missing in the Paddington rail crash of October 1999. No trace of Hackett’s body was found and after further investigations it transpired that Simm had been dead for some fifteen years and the real Hackett had assumed his identity in order to escape his criminal past. Hackett had in fact been leading a blameless life in his new persona until he tried to exterminate his past existence. We might believe that Hackett had assumed Simm’s identity in all its constituents although others argue that identity can’t be stolen only misused.
What becomes readily apparent is that the internet world is different to the real world in that it is easier to assume someone’s identity in the virtual space. We are all aware of credit card fraud on the internet but probably are less familiar with child bullying that takes place in the chat rooms where miscreants adopt others identities and cause mayhem using the victims identity.
So how do we tidy up all this thinking? I would want to argue that identity is totally related to environment, in other words it’s a set of relationships between us and that part of the infrastructure that we interact with, in that sense we have multiple identities, one for each relationship. We have a relationship with the state, with our bank, with our employer, with our internet service provider and so on. When we interact with some third party they are concerned only to verify our authenticity against the identity they have on record. In other words there is always some prior registration process.
This is really the biggest difference between identity management and PKI. Identity management is all about establishing these relationships while PKI is sometimes very woolly and uses the concept of Registration Authorities as a generality rather than in terms of specific relationships. The idea that you can use some arbitrary digital certificate to vouch for somebody’s identity is nonsense. You must be part of the scheme, legally intertwined so that liability can be apportioned as and when necessary. In effect the concept of an open ‘public key infrastructure’ has no business meaning but when used in a closed schema then you can achieve identity management. On a global front GTA (Global Trust Authority) http://www.globaltrustauthority.org/index.htm and Identrus http://www.identrust.com/ are two organisations that have applied these principles.
Less contentious perhaps is identity fraud which is generally accepted as the misuse of identity and as pointed out by Gavin Bell represents about £1.7bn according to UK Home Office figures, by comparison credit card fraud in the UK runs at about £500m per year. Nobody disputes that it’s a growing problem but the difficult bit is what do you do about it? As Gavin points out there is no single solution and whatever you do has to be easy to use and acceptable to the citizen. Now this really is the problem, security and ease of use /flexibility are counterparts, you get one at the expense of the other. If you enforce excessive security controls then it becomes unacceptable to the user, a less stringent policy allows the user to get caught. What this really says is that you can’t have a totally technological solution, the citizen has to take an active part in the process. However what you can do is to make it easy for him to participate. The much maligned password or PIN can in fact offer very effective access control, invariably better than biometrics, but the process needs to be sensible. You can’t post your password on a yellow sticky stuck to the display screen.
Ioannis Maghiros looked at the subject as a matter of balancing security with privacy and what happens beyond. Life is based on risk assessment and management but in this world we also need to take account of digital territories and in particular the physical / logical boundaries. The rub here of course is that the boundaries are diffuse, more and more in the physical world we use our digital attributes for identity verification. When you pay for goods in a shop your physical identity is pretty well irrelevant. In fact it’s even worse than that because the average cashier does not even look at the card let alone associate it with the holder, it just gets popped in the slot. As Bill Thompson said, Identity is a key philosophical point.
And then biometrics, Bori Toth laid the foundation with the statement that biometrics are private data, publicly available. All we have to do is show that the data comes from the live user. At the end of the day the only advantage that biometrics might have over passwords is the concept of non-transferability. If a biometric can be shown to be transferable as has been done by Professor Makimoto of Yokahama University in the case of fingerprints then you might want to argue it is worse than using passwords. Neil McEvoy also made this point, he explained that biometrics are not a substitute for PIN and that they are really only suitable for use in a monitored environment. The use of voice in a challenge/response protocol might be an exception.
Maxine Moot was a big supporter of biometrics and pointed out the spread of such schemes across the globe but was careful to highlight the problems. The crux of her argument for me was based on security being ‘fit for purpose’ which I would certainly endorse. The problem I have with biometrics is that they really only work in certain scenarios and in general that means an attended environment. I am still vividly reminded of the problem watching the fast track iris scanning at Heathrow airport. Of 11 people in the queue (during our very much faster conventional immigration path), 3 were rejected and had the stigma of uncomfortably reversing out of the booth. I didn’t hear anybody in our queue wanting to adopt this new process. Developers involved with biometric access control know the problems, under ideal conditions you can get quite good results but put it in a real practical situation and things invariably go wrong. Airports are harassed places at the best of times without having a machine reject you.
Michael Keegan really summarised for me the problems of identity management techniques,
1) They must work equally well for all members of society
2) They must primarily deliver benefits to the user which is in addition to the service providers
3) They must be easy to use, foolproof, non intrusive, reliable, rugged and inexpensive
At the moment I don’t think we can meet any of these requirements and we certainly can’t achieve this through the use of biometrics. (David Everett)
