NS-TIC

NSTIC finalists notified: SecureIDNews

On 4/10, SecureIDNews reported that the National Institute of Standards and Technology (NIST) has notified 27 finalists of "grants that would pilot portions of the identity ecosystem for the [NSTIC]."  The article said that the finalists must decide whether to announce their status.  I'll keep my eyes open for any such announcements.  The finalists are likely made up of state and local government agencies, major companies, business start ups, and universities. 

From here, the finalists must submit full proposals to NIST by May 10th.  After that, NIST will choose 5 to 8 proposals that will receive a total of $10 million. 

A bit of background on NSTIC.

NSTIC Planning Proceeding Despite Uncertain Funding: FierceGovernment

On October 24th, 2011, David Perara wrote for FierceGovernment on how NSTIC should still move forward with pilot programs in the current fiscal year despite uncertain funding.  This was according to Jeremy Grant, the senior executive advisor of the National Institute of Standards and Technology (NIST).  The House of Representative's 2012 NIST appropriations bill would give the agency no money for NSTIC pilots, while the Senate version of the bill would fund the program with $24 million.  Grant assumed that the money for the NSTIC pilot program would still come through despite the funding concerns. 

The pilot program refers to an NIST program that will seek to experiment with the identity ecosystem in certain government and private sectors.  Grant intends to set up multiple pilot programs that span multiple sectors including banking, online commerce, and state government.  Grant hopes that various industrial sectors will bid on the NSTIC pilot programs, allowing those companies to demonstrate that the identity ecoystem, in miniature, is indeed feasible. 

The source article can be found here.

In praise of chaos: The Economist

On October 1st, 2011, The Economist published two articles on the controversy surrounding government's attempts to control the internet.  Using the annual meeting of the Internet Governance Forum in Nairobi as a backdrop, the articles note how some governments want to transition away from the current “multi-stakeholder” approach to a more government-controlled internet.  The multi-stakeholder approach describes how the internet is chaotically governed by a hotch-potch of organisations, causing decision-making to be slow and often unpredictable.  The multi-stakeholder's founding fathers believed that more openness would be both more secure and better for innovation.

Until the early 2000s, most governments were happy—at least in Western countries where most internet users lived.  Yet as the internet has become a global medium, attitudes have changed.  Some governments are uncomfortable with the multi-stakeholder approach because they feel that the internet is too important, politically as well as economically, to continue to operate beyond the power of governments.  China and Russia want the United Nations General Assembly to adopt an “International Code of Conduct for Information Security", and India, Brazil and South Africa have called for a “new global body” to control the internet.

Source: The Economist

The debate has strengthened as a result of the Internet Corporation for Assigned Names and Numbers (ICANN), a body set up to manage the internet’s address system.  Governments have long been unhappy with ICANN because it is not sufficiently transparent or accountable.  The tensions came to a head when the ICANN board moved last year to allow many more “generic top-level domains” as the controversial suffixes of web addresses such as .xxx (see article) or .jesus.  The point being, if even ICANN cannot command the respect of its stakeholders, the entire multi-stakeholder model may be in danger.

However, the articles note that for whatever chaos the multi-stakeholder approach causes, "the shambles are a lot better than the alternative—which nearly always in this case means governments bringing the internet under their control."  The internet’s openness fosters two of its great virtues: encouraged innovation and resiliency to censorship.  Governments have a role to play in the internet, but they should not be allowed the final say; creeping state control would suffocate the internet.

The article "In praise of chaos" can be found here.

The article "A plaything of powerful nations" can be found here.

The Password is Dead. Time for Better Online Security.

Forbes reported on the recent release of the National Strategy for Trusted Identities in Cyberspace in an article by Kashmir Hill dated April 15, 2011.  The article provides a great understanding of what the NSTIC aims to accomplish and why it was necessary in the first place.

Essentially, the days of the username and password are dead, and, according to Commerce Secretary Gary Locke, the time has come to "'create a more secure online environment.'"  During a recent event at the U.S. Chamber of Commerce, Secretary Locke was trying to dispel conspiracy theorists' claims that the NSTIC is really a national online ID system.  Although government-sponsored, the NSTIC "is intended to be led by industry."  

In a nutshell, "the more places you keep a username and password, the more opportunities hackers have to break in and crack your system.  Of course, you want to make sure that your main identity authenticators are secure ones. . . . "  The rub with the NSTIC is that "industry" includes Facebook, Google, and JPMorgan Chase (i.e. several business with different missions and priorities).  As Leslie Harris, of the Center for Democracy and Technology recenlty put it, putting the NSTIC into practice will require a "'spray bottle of water and a lot of cat nip' as it will be like herding cats."  

***

 

Let's hope not.  

 

 

For the entire article from Forbes, follow the link above, or click here.   

 

BSA, ITI, and TechAmerica Oppose Effort to Strip Funding for Trusted Identities in Cyberspace

ag-IP-news Agency, a member of Talal Abu-Ghazaleh Organization, reports in an article dated February 20, 2011, that Business Softwar Alliance (BSA) has joined TechAmerica and the Information Technology Industry Council (ITI) "in urging Congress to support development and implementation of trusted identities online."  According to ag-IP-news Agency, "the Business Software Alliance is the world's foremost advocate for the software industry."

In a letter to the leadership of the U.S. House of Representatives, BSA, ITI and TechAmerica expressed their "strong opposition to House amendment #261 to the FY11 Continuing Resolution, which would prohibit use of funds to develop or implement the digital identity ecosystem described in the National Strategy for Trusted Identities in Cyberspace (NSTIC)."  According to the letter, the amendment "would jeopardize a vital public private partnership to promote trusted identities online and would undermine the nation's cybersecurity posture."

Speaking of the National Strategy for Trusted Identities in Cyberspace, BSA, ITI and TechAmerica said in their letter to House leaders,

"[w]e need a partner in government to help us move trusted identities into the 21st [C]entury. We need the government's involvement to: examine and align governments activities with industry; build consensus on the legal and policy frameworks to enhance privacy, free expression, and open markets; work with industry to identify new standards; support and coordinate interagency collaboration and as well as [sic] [i]nternational collaboration. . . . Done right, NSTIC will reduce cost for government and businesses and increase trust on the Internet." 

***

 

The entire article from ag-IP-news Agency can be found at the link provided above, or here.  The letter to House leaders from BSA, ITI and TechAmerica can be found at the link above, or here. 

 

Editorial: Obama and the Internet Pharaoh

In an editorial appearing in the Washington Times on February 4, 2011, the writer criticizes the Obama Administration's National Strategy for Trusted Identities in Cyberspace ("NS-TIC"), as well as the federal government overall for recent attempts to grant "a White House cyberczar [what the writer calls] Mubarak-like power to declare an emergency and issue directives to any private companies deemed . . . critical by government."

The writer points out that private companies are better suited to guard the Internet, as they "have more of an incentive to preserve their billion-dollar investments than '9 to 5' bureaucrats with guaranteed lifetime employment."  And, in reference to Egypt's temporary Internet shut-down, the writer notes that these "clumsy censorship attempts were bypassed with proxy severs and other simple workarounds."

With regard to the NS-TIC, the writer argues that despite assurances from administration officials that the NS-TIC will not operate as a national ID system, "any government involvement in identity management or security on the Internet is a bad idea.  Big-government types can't resist the urge to control things they feel are currently beyond thier grasp. . . . The temptation to squelch inconvenient speech is too great; no political should ever be given a button to silence the Internet."

 

****

 

The entire editorial piece can be found at the link provided above, or here.   

 

Negotiations Over New Zealand's IGovt Identity Plan

Tom Pullar-Strecker, of Stuff.Co.NZ, an online news agency, reports in an article published February 7, 2011, that the New Zealand Government is working with NZ Post (New Zealand's postal service) "to promote its $122 million iGovt identity system, which may now be mirrored in the United States by the Obama Administration."  Internal Affairs - the Government's go-to agency for iGovt - is currently negotiating with NZ Post to produce a final system "'that maintains the high level of public confidence and trust in the way people's information is managed by the Government.'" 

Under New Zealand's iGovt system, people enroll in the voluntary system by visiting a "post shop to be digitally photographed and have their credentials checked . . . and obtain a password and logon." According to the article, users will also either register their mobile phone so that "a code could be texted to them whenver they wanted to access a secure service online," or they would be issued a "hardware token" similar to those already used by many banks.  

In 2009, the New Zealand Government ordered Internal Affairs to reach out to the private sector for "energy and ideas."  At that same time, the Government forecasted that iGovt would produce benefits between $641 million and $1.37 billion over then next ten years. 

The news article draws the obvious parallel to the Obama Administration's National Strategy for Trusted Identities in Cyberspace, which was recently championed by U.S. Commerce Secretary Gary Locke as "'[a system] enhancing online security and privacy, and reducing and perhaps even eliminating the need to memorize a dozen passwords, through creation and use of more trusted digital identities.'"

In 2009, when New Zealand's Internal Affairs reached out to the private sector, of the issues and concerns raised by private businesses were "whether the Government would be liable if [the private sector] relied on iGovt to authenticate someone's identity and later found they had been defrauded."  According to the news article, "[o]fficials indicated that was unlikely."

 

****

 

The entire news article from Stuff.Co.NZ can be found at the link provided above, or here.  Here is a link to New Zealand's iGovt site for further details.  

 

The Man in Charge of Making the Web Safer: Q&A with Howard Schmidt

MSNBC's Herb "Consumer Man" Weisbaum recently sat down with the White House's Cybersecurity Coordinator Howard Schmidt for a Q&A session regarding the National Strategy for Trusted Identities in Cyberspace (NS-TIC).  Schmidt's answers help to fill in the details of the NS-TIC, as well as give some insight into future plans for the Strategy.  Thus, a few of the questions and answers are provided below.   

 

When asked "[w]ho [between the private sector and the Commerce Department] does the heavy lifting," Schmidt responded:

"The private sector will lead the building of multiple ways that people can identify themselves depending on their interactions online, and to also make sure these trusted identities are indeed privacy-enhancing as well as helping businesses to be more successful."

"Consumer Man" asked if Schmidt had any initial ideas as to how the plan will operate. Schmidt responded:

"We do have some thoughts. Say for example, if I regularly do business with a particular bank. The bank can then give me some sort of device. Let's say . . . it's an application I can put on my mobile device. Instead of using a credit card number every time I do a transaction or a password every time I do something, I have a one-time password or PIN number . . . that's generated locally on my mobile device. So I'm not putting all this personally identifying information on the Internet. A third-party verifier - not the government by the way - can effectively complete the transaction with the business to make sure that they get the ability to sell what they want to sell me, but I also get the benefit of insuring that the business is valid. That's one easy example of a way to do trusted identities. . . . This is not an attempt to create any sort of national identity card. It’s quite the opposite. It’s a matter of letting the private sector, through the normal course of doing business, give people choices, including multiple choices. If I want an identity to deal with my bank, that is something that requires a higher level of validation. But if I want nothing at all, so I can blog about things on the Internet, I also have the ability to do that."

When asked if he expects positive feedback from businesses, and if he has already, what the tone of such feedback was, Schmidt answered:

"We’ve had tremendous response and it’s very, very positive. We’ve had privacy and civil liberties organizations that have taken a look at this. And while we’ve not released the final strategy yet, we’ve been engaging with all of these key groups to make sure they understand the principles we’re operating by. We’ve had tremendous support for that. We’re also working with key lawmakers to make sure Congress has full visibility of the way we’re doing this. And the bottom line is: The more we get positive feedback, the easier it is to have the private sector lead the way on this."

 

****

All of this enlightening Q&A with White House Cybersecurity Coordinator Howard Schmidt, can be found at the link provided above, or here.

 

 

 

 

The Heritage Foundation: "National Internet ID: Calls for Caution"

Jena Baker McNeill and James Carafano, Ph.D., both of The Heritage Foundation, have recently published a short paper, called a "WebMemo," in which they essentially have laid out the pros and cons of the Administration's proposed National Strategy for Trusted Identities in Cyberspace. They caution that  "[b]efore the federal government progresses too far on its project, it is worthwhile to draw some clear boundaries on what makes sense and what does not."  

In a nutshell, The Heritage Foundation holds that while the Obama Administration may have set its sights on a target worthy of concern and analysis, the proposed "government-run or government-directed Internet ID system presents a risk to liberty that simply outweighs the potential security benefits." 

The "cons," according to The Heritage Foundation, which are conveniently labeled "Red Flags," are that the proposed "government-directed national ID system could destroy online anonymity"; "become the equivalent of a national ID";  and could "crowd out private-sector efforts to improve online credentialing."  

Not surprisingly, The Heritage Foundation's recommendations are aimed at addressing the above concerns by "[f]ocus[ing] on improving the efficiency, effectiveness, and integration of federal trusted identity programs"; "develop[ing] more effective public-private partnerships to address cyber concerns"; and "exploit[ing[ the advantages of the free market."  

 

The Heritage Foundation's entire "WebMemo," dated January 27, 2011, can be found at  the link provided above, or here.  

 

 

 

 

 

Cyber Roundtable: Recommendations for the National Strategy for Trusted Identities in Cyberspace

On September 3, 2010, The Institute for National Security and Counterterrorism and the Center for Information and Systems Assurance and Trust, both headquartered at Syracuse University, held a roundtable discussion of the Obama Administration's recently published National Strategy for Trusted Identities in Cyberspace.  The event brought together legal and technical experts, as well as experts in management and public communications.  Additionally, experts from JPMorgan Chase and Co. participated via telephone.  The discussion was recorded, and is now being made publicly available in order to further the analysis and discussion of the National Strategy for Trusted Identities in Cyberspace.   

The dedicated page for the roundtable discussion, complete with higher resolution video of the event, can be found at the link above, or here.