NS-TIC

NSTIC Lays Out a Compelling Identity Ecosystem Vision: WindowsITPro

On October 13th, 2011, Sean Deuby wrote for WindowsITPro on how NSTIC works, the concept of the identity ecosystem, and possible issues that need to be addressed in order to make NSTIC a reality.  Noting that even though our use of the web for sensitive transactions has grown dramatically, there's still many online transactions we can't perform because of the question of identity.  Phishing malware attacks and news stories about hacking always leaves the question "Is this person who he says he is?"  Unfortunately, passwords just aren't cutting it anymore.  As Jeremy Grant, manager of the NSTIC program office, likes to say, “We think the password is fundamentally insecure and needs to be shot.”

This is where NSTIC and the Identity Ecosystem comes in.  The Identity Ecosystem is a user-centric online environment made up of a set of agreed upon standards, policies, and technologies that support transactions ranging from fully authenticated to anonymous and high or low value.  NSTIC isn't necessarily a national ID system, but more of an acknowledgment that secure transactions on the Internet need a common framework that both identity providers and service providers agree to work within.  Moreover, NSTIC isn't inventing any new technology, but rather, using existing technology like smart cards and digital certificates to create a network supporting trust IDs that can be used by all parties.  The identity ecosystem could allow the consumer to make secure online transactions by using a smartphone.

Of course, the successful implementation of NSTIC would be a boon for businesses; with more online security, consumers would be more likely to do their business online, and new areas of online business like online healthcare could open up.  Further, Mr. Deuby notes that NSTIC would also have to be voluntary: "consumers must have choices for who they want as an identity provider, and consumer demand will encourage more identity providers and service providers to join the ecosystem."  However, NSTIC comes with its drawbacks.  First,  an identity ecosystem is far from deployment.  Second, the concept of creating identities warehouses raises both privacy concerns and the prospect of "hyper-identity theft" if someone were able to break into an identity provider.  Even so, Mr. Deuby finds that NSTIC is a vision of how things should be; the private sector just has to step it up and figure out how to make it a reality.

The source article can be found here.

Your Online Driver’s License: NYT

On September 17th, 2011, Natasha Singer wrote for the New York Times about the National Strategy for Trusted Identities in Cyberspace (NSTIC).  Comparing NSTIC to a digital driver's license, Singer explained how NSTIC would make it so people have a simpler, safer way to prove who they are online with more than a flimsy password.  To do so, consumers would choose among trusted third parties — such as banks, technology companies or cellphone service providers — that verify certain personal information about them and issue them secure credentials to use in online transactions.  The system would allow Internet users to use the same secure credential on many Web sites; people could have their identity authenticator automatically confirm that they are old enough to sign up for Pandora without having to share their birthdate with Pandora.

However, authentication proponents and privacy advocates disagree about whether Internet IDs like NSTIC would actually heighten consumer protection.  Privacy advocates argue that identity verification online could make consumers more vulnerable because authentication companies would become "honey pots for hackers."  Lillie Coney, the associate director of the Electronic Privacy Information Center, noted that “You can have one key that opens every lock for everything you might need online in your daily life, or, would you rather have a key ring that would allow you to open some things but not others?”

However, Jeremy Grant (senior executive adviser for identity management at the National Institute of Standards and Technology) noted that no system is invulnerable.  Privacy concerns aside, better online identity authentication would improve the current situation where people use the same passwords for their e-mail, banking, and social network accounts.  Mr. Grant went on to compare weak security to flimsly locks on bathroom doors: “If we can get everyone to use a strong deadbolt instead of a flimsy bathroom door lock, you significantly improve the kind of security we have.”

The source article can be found here.

US could learn from Canadian identity management initiative: Network World

On September 2, 2011, Dave Keams wrote for Network World that the United States could learn a great deal from Canada's identity management initiative.  Mr. Keams argues that the Canadian initiative is smaller and more focused than the U.S. NSTIC initiative because it concentrates on government and citizen interactions. The US and Canadian ideas are generally the same, but differ in scale. 

The Canadian Treasury Board of Canada Secretariat recently released the final version of a document called "Federating Identity Management in the Government of Canada: A Backgrounder." It notes, "How identity information is collected, used, managed, and secured is of critical interest to leaders in the public sector charged with protecting the rights of citizens, ensuring privacy, and ensuring national security and public safety."

The study also sets out what it calls "Guiding principles for federating identity management":

• Achieve consensus through accepted, mutually respected assurances (of credential or identity), risk levels, and accountabilities.

• Respect program accountability.

• Let the citizen decide.

• Enable interoperability.

• Promote a fair and competitive marketplace.

Mr. Keams argues that  NSTIC should abide by these principles.

The Network World article can be found here.

***

 

Naming Names on the Internet: New York Times

On September 4th, 2011, Eric Pfanner wrote for the New York Times on a new twist in the internet anonymity debate: real name policies.  Real name policies require web users to provide their real names in order to post on websites.  The article mentions how South Korea enacted a real name policy in response to the suicide of a popular actress who had been bullied via the internet.  However, the South Korean government decided to abandon the policy after hackers stole 35 million user's identification data (which they had been required to supply in order to verify their identities).

However, the article notes that there have been growing calls for restrictions on Internet anonymity.  Specifically, German Interior Minister Hans-Peter Friedrick cited the case of Norwegian terrorist suspect Anders Behrig Breivik who had blogged under the user name "Fjordman."  Furthermore, Google executive chairman Eric E. Schmidt told a media conference in Edinburgh that “The Internet would be better if we had an accurate notion that you were a real person as opposed to a dog, or a fake person, or a spammer.”

However, Mr. Pfanner goes on to argue that, all in all, real name policies are a lousy idea.  Online anonymity is essential for political dissidents and corporate whistle-blowers; real name policies would severely limit that anonymity.  Further, although cyberbullying and online death threats are an unwanted byproduct of internet anonymity, arrests made of members of the notorious hacking ring Anonymous demonstrates that authorities already have tools for rooting out anonymous trolls when they really want to.

In the end, Mr. Pfanner points out that "The real world is often messy, chaotic and anonymous. The Internet is mostly better that way, too."

The source article can be found here.

CNET News on NSTIC and "Fixing the Web's trust issues"

While addressing larger issues of trust on the Internet, CNET's Dennis O'Reilly has this to say about the National Strategy for Trusted Identities in Cyberspace (NSTIC):

NSTIC is a noble effort that calls for creation of private trusted authorities to serve as go-betweens when consumers interact with Web services. The theory is that consumers will trust a third party with their private data, and the third party will assure the online vendor of the customer's authenticity.

The obvious question is who will pay to establish and maintain this proposed Identity Ecosystem?

via news.cnet.com

He examines pending federal legislation, but ultimately concludes that users are on their own for data protection, concluding: "After all, it's unlikely online vendors will voluntarily adopt privacy-protection practices, and we certainly can't wait for the cavalry to arrive."  To read his full article, follow this link.

The final NSTIC has a ten year expectation for full implementation.  That seems very long to me, given the rate of change in cyberspace.  I suspect that whatever means users ultimately adopt to establish identity will have been here and gone in that length of time.  The article by O'Reilly mentions expense, general government inefficiency, and privacy rights as obstacles to implementation. I agree that all of those are factors, and I believe that there are more.

Editorial: Obama and the Internet Pharaoh

In an editorial appearing in the Washington Times on February 4, 2011, the writer criticizes the Obama Administration's National Strategy for Trusted Identities in Cyberspace ("NS-TIC"), as well as the federal government overall for recent attempts to grant "a White House cyberczar [what the writer calls] Mubarak-like power to declare an emergency and issue directives to any private companies deemed . . . critical by government."

The writer points out that private companies are better suited to guard the Internet, as they "have more of an incentive to preserve their billion-dollar investments than '9 to 5' bureaucrats with guaranteed lifetime employment."  And, in reference to Egypt's temporary Internet shut-down, the writer notes that these "clumsy censorship attempts were bypassed with proxy severs and other simple workarounds."

With regard to the NS-TIC, the writer argues that despite assurances from administration officials that the NS-TIC will not operate as a national ID system, "any government involvement in identity management or security on the Internet is a bad idea.  Big-government types can't resist the urge to control things they feel are currently beyond thier grasp. . . . The temptation to squelch inconvenient speech is too great; no political should ever be given a button to silence the Internet."

 

****

 

The entire editorial piece can be found at the link provided above, or here.   

 

Negotiations Over New Zealand's IGovt Identity Plan

Tom Pullar-Strecker, of Stuff.Co.NZ, an online news agency, reports in an article published February 7, 2011, that the New Zealand Government is working with NZ Post (New Zealand's postal service) "to promote its $122 million iGovt identity system, which may now be mirrored in the United States by the Obama Administration."  Internal Affairs - the Government's go-to agency for iGovt - is currently negotiating with NZ Post to produce a final system "'that maintains the high level of public confidence and trust in the way people's information is managed by the Government.'" 

Under New Zealand's iGovt system, people enroll in the voluntary system by visiting a "post shop to be digitally photographed and have their credentials checked . . . and obtain a password and logon." According to the article, users will also either register their mobile phone so that "a code could be texted to them whenver they wanted to access a secure service online," or they would be issued a "hardware token" similar to those already used by many banks.  

In 2009, the New Zealand Government ordered Internal Affairs to reach out to the private sector for "energy and ideas."  At that same time, the Government forecasted that iGovt would produce benefits between $641 million and $1.37 billion over then next ten years. 

The news article draws the obvious parallel to the Obama Administration's National Strategy for Trusted Identities in Cyberspace, which was recently championed by U.S. Commerce Secretary Gary Locke as "'[a system] enhancing online security and privacy, and reducing and perhaps even eliminating the need to memorize a dozen passwords, through creation and use of more trusted digital identities.'"

In 2009, when New Zealand's Internal Affairs reached out to the private sector, of the issues and concerns raised by private businesses were "whether the Government would be liable if [the private sector] relied on iGovt to authenticate someone's identity and later found they had been defrauded."  According to the news article, "[o]fficials indicated that was unlikely."

 

****

 

The entire news article from Stuff.Co.NZ can be found at the link provided above, or here.  Here is a link to New Zealand's iGovt site for further details.  

 

The Man in Charge of Making the Web Safer: Q&A with Howard Schmidt

MSNBC's Herb "Consumer Man" Weisbaum recently sat down with the White House's Cybersecurity Coordinator Howard Schmidt for a Q&A session regarding the National Strategy for Trusted Identities in Cyberspace (NS-TIC).  Schmidt's answers help to fill in the details of the NS-TIC, as well as give some insight into future plans for the Strategy.  Thus, a few of the questions and answers are provided below.   

 

When asked "[w]ho [between the private sector and the Commerce Department] does the heavy lifting," Schmidt responded:

"The private sector will lead the building of multiple ways that people can identify themselves depending on their interactions online, and to also make sure these trusted identities are indeed privacy-enhancing as well as helping businesses to be more successful."

"Consumer Man" asked if Schmidt had any initial ideas as to how the plan will operate. Schmidt responded:

"We do have some thoughts. Say for example, if I regularly do business with a particular bank. The bank can then give me some sort of device. Let's say . . . it's an application I can put on my mobile device. Instead of using a credit card number every time I do a transaction or a password every time I do something, I have a one-time password or PIN number . . . that's generated locally on my mobile device. So I'm not putting all this personally identifying information on the Internet. A third-party verifier - not the government by the way - can effectively complete the transaction with the business to make sure that they get the ability to sell what they want to sell me, but I also get the benefit of insuring that the business is valid. That's one easy example of a way to do trusted identities. . . . This is not an attempt to create any sort of national identity card. It’s quite the opposite. It’s a matter of letting the private sector, through the normal course of doing business, give people choices, including multiple choices. If I want an identity to deal with my bank, that is something that requires a higher level of validation. But if I want nothing at all, so I can blog about things on the Internet, I also have the ability to do that."

When asked if he expects positive feedback from businesses, and if he has already, what the tone of such feedback was, Schmidt answered:

"We’ve had tremendous response and it’s very, very positive. We’ve had privacy and civil liberties organizations that have taken a look at this. And while we’ve not released the final strategy yet, we’ve been engaging with all of these key groups to make sure they understand the principles we’re operating by. We’ve had tremendous support for that. We’re also working with key lawmakers to make sure Congress has full visibility of the way we’re doing this. And the bottom line is: The more we get positive feedback, the easier it is to have the private sector lead the way on this."

 

****

All of this enlightening Q&A with White House Cybersecurity Coordinator Howard Schmidt, can be found at the link provided above, or here.

 

 

 

 

The Heritage Foundation: "National Internet ID: Calls for Caution"

Jena Baker McNeill and James Carafano, Ph.D., both of The Heritage Foundation, have recently published a short paper, called a "WebMemo," in which they essentially have laid out the pros and cons of the Administration's proposed National Strategy for Trusted Identities in Cyberspace. They caution that  "[b]efore the federal government progresses too far on its project, it is worthwhile to draw some clear boundaries on what makes sense and what does not."  

In a nutshell, The Heritage Foundation holds that while the Obama Administration may have set its sights on a target worthy of concern and analysis, the proposed "government-run or government-directed Internet ID system presents a risk to liberty that simply outweighs the potential security benefits." 

The "cons," according to The Heritage Foundation, which are conveniently labeled "Red Flags," are that the proposed "government-directed national ID system could destroy online anonymity"; "become the equivalent of a national ID";  and could "crowd out private-sector efforts to improve online credentialing."  

Not surprisingly, The Heritage Foundation's recommendations are aimed at addressing the above concerns by "[f]ocus[ing] on improving the efficiency, effectiveness, and integration of federal trusted identity programs"; "develop[ing] more effective public-private partnerships to address cyber concerns"; and "exploit[ing[ the advantages of the free market."  

 

The Heritage Foundation's entire "WebMemo," dated January 27, 2011, can be found at  the link provided above, or here.  

 

 

 

 

 

ACLU: Don't Put Your Trust in "Trusted Identities"

From the American Civil Liberties Union's web site dated 1/07/2011:

Obama administration officials spoke today about the "National Strategies for Trusted Identities in Cyberspace." ...

In short, it's possible that if all the stars lined up perfectly, this "online identity ecosystem" could be a good thing.

Unfortunately, there are too many reasons to doubt that all the stars will line up perfectly.

... [T]his scheme appears to be a sweeping, utopian intervention in the Internet driven by anti-freedom security agendas that promises to do more harm than good.

See http://www.aclu.org/blog/technology-and-liberty/dont-put-your-trust-trusted-identities/