 |
 |
 |
 |
April 2006 • Volume 11 Number 4
|
 |
|
Feature of the Month Top Identity Topics: Is Technology a Threat to an Individual's Identity? Our shrinking world compels individuals and societies to be constantly thoughtful of the need to protect our own identities and to know with certainty the identity of those with whom we trust our wealth, our privacy, and our security. When confronted with new opportunities for increased commerce, freedom of movement, communication, and knowledge, we've almost always chosen to move forward and have repeatedly turned to technology to enable us to do so and to protect us against the threats accompanying these new opportunities. All changes to the status quo entail costs and risks. The challenge is to find ways to make informed decisions about the costs, risks, and benefits of using new technologies to protect our identities. The process we use to evaluate new technologies is critical to achieving benefits from their adoption. What Has Technology Done for Us recently to Protect Our Identities? Reliable identification is critical to transactions between parties who have inadequate knowledge of each other. The success of such transactions relies on a trusted third party being able to vouch for the participants' identities. Third-party testimonials are used in face-to-face transactions of all kinds and in remote transactions, such as purchases over the phone and the Internet. The identity credential issued by the third party must be portable; otherwise, we would constantly be relying on in-person validation like that performed by a notary, something that is inconvenient, costly, and time consuming. Technology has been able to improve and protect our transactions with strangers and our personal information in a variety of ways. Technology makes such transactions faster, more secure, and more convenient (for example, contactless payment systems like American Express ® ExpressPay) and makes access to personal information more secure (for example, biometric authenticators like fingerprints and iris scans). Credentials containing our identities (for example, the new U.S. electronic passport containing a chip) are made more secure by using smart cards that employ the latest cryptographic methods to protect the data on the card and authenticate the entity accessing the data. Smart cards are also being used to protect access to our personal information over public and private networks. These are just a few examples of how technology is being used today to help individuals protect their personal information. Who Controls When New Technologies Are Adopted? In our private lives, technological solutions for protecting our identities or increasing our ability to interact more easily with others are typically adopted incrementally. Trade-offs among security, privacy, convenience and cost are continually balanced and rebalanced by mechanisms of our free markets. Some people choose to adopt new technologies immediately, while others choose to wait until the technology is "proven." We decide when the time is right for each of us. Currently, our society as a whole is faced with threats to its physical security posed by the falsification of identities at the state and Federal level, and government is charged with addressing these challenges. However, any technological solutions that are chosen to combat these threats cannot be imposed incrementally. The implications of implementing a new technology throughout an entire society are far reaching, and we need to understand and balance the tradeoffs between security, privacy, convenience, and cost immediately. Don't We Need Laws to Control Adoption of Technology Protecting our Identities? With technology becoming more prevalent and complex and with the pace of change accelerating, governments are struggling to keep up with new threats to their citizens' identities. Two legislative alternatives commonly considered in such situations are to:
The first approach carries the genuine risk of "throwing the baby out with the bath water" and depriving society of the benefits of a new technology. The latter allows the benefits to accrue to society without locking in the status quo or selecting technological favorites that can result in stifling competition and increasing costs to society. How Should Governments Decide Whether to Enact New Laws Governing a Technology? A new technology that protects our identities is by nature complex, and reaching a full understanding of its benefits, risks to citizens' privacy, and vulnerabilities is difficult. Only by involving a wide range of experts and balancing all the pros and cons can logical decisions be made.
Any decision reached without the involvement of all of these parties in an open forum will invariably result in skewed decisions that may deprive us of the proper benefits of the technology. It is most important, however, to keep in mind that technology is merely one part of the solution to the problem of protecting our identities and validating them to others. The complete solution is a system that must include policies, procedures, and practices describing how people are to interact with the system. In the end, the strength of a system is only as great as the adherence by the people using the system to these policies and procedures. Technology in general, and smart cards and biometrics in particular, are powerful tools for enforcing adherence to policies and procedures.
About this Article This article is an extract from the Smart Card Alliance Identity Council white paper, "The Top 10 Hot Identity Topics," researched and written by the Identity Council and published in February 2006. This white paper was developed to provide a high-level discussion of the top 10 challenges associated with current identity systems. This paper covers a range of topics and offers perspectives on how the most critical identity issues can be addressed with policy, process, and technology solutions. Individuals from 15 organizations in the Identity Council collaborated on this white paper. Lead contributors included representatives from: Axalto, Booz Allen Hamilton, Datacard Group, Fargo Electronics, Hitachi America Ltd., IBM, International Biometrics Industry Association, Saflink, Texas Instruments, Viisage. The full white paper and additional information about smart cards and the role that they play in secure identification and other applications can be found on the Smart Card Alliance web site at www.smartcardalliance.org. About the Identity Council The Identity Council is one of several Smart Card Alliance Technology and Industry Councils, a new type of focused group within the overall structure of the Alliance. These councils have been created to foster increased industry collaboration within a specified industry or market segment and produce tangible results while raising public awareness to the value of smart card technology. The Identity Council is focused on promoting the need for technologies, legislation and usage solutions regarding human identity information to address the challenges of securing identity information, reducing identity fraud and increasing the usefulness that secure identity information delivers. The Council engages a broad set of participants and takes an industry perspective, bringing careful thought, joint planning and multiple organization resources to bear on addressing the challenges of securing identity information for proper use. The Council is currently working on projects to raise awareness of the issues that organizations and the public face in implementing and using identity systems and to promote the use of the appropriate technologies to solve these issues. The Identity Council includes participants from across a broad spectrum of identity technology providers. Identity Council participation is open to any Smart Card Alliance member who wishes to contribute to the Council projects. Additional information about the Identity Council can be found at http://www.smartcardalliance.org/about_alliance/councils_ic.cfm.
|
|
