Workshop 19 on Security and Governance of Identity on the Internet. Presented by BCS the chartered institute for IT, UK and OpenNet, Korea.

Transcription

1 Workshop 19 on Security and Governance of Identity on the Internet. Presented by BCS the chartered institute for IT, UK and OpenNet, Korea. The workshop went very well and had a good attendance. The discussions were split in two. The first covered identity attributes and identity being used to fund the Internet, the second covered the balance between privacy, security and anonymity. In the first part Dr. Louise Bennett from the BCS who was chairing the session introduced the session and the BCS. She introduced the other panel members: Andy Smith BCS Prof. Keechang Kim OpenNet Korea Sarah Whynne-Williams Facebook Prof. Hong Xoe, Normal University Beijing We also had Ian Fish as the remote moderator onsite. Unfortunately we did not have very good remote participation as due to the early time of the session it was 02:00 in Europe where most publicizing of the session had taken place. Louise introduced the workshop by describing the work the BCS had undertaken over the last 3 years including at IGF 6 and 7 and the reports that had been written following these. Louise then covered the use of identity as currency on the Internet she covered various aspects including how identity attributes are used to pay for services and how use of attributes for targeted marketing etc. She pointed out that identity is critical to the digital economy with everything from know your customer regulations to simple financial transactions all reliant on some form of assured identity. These may not be totally online but even a pseudonym used on the Internet can normally be traced back to a credit card or bank account and from there to a real person. She covered the need to develop valid incentive models that would make the various stakeholders exist or want to participate in an online identity governance framework and the need to understand how this might work across very different jurisdictions because the Internet is global. She noted that one business model that is contentious is the monetization of personal data attributes on the Internet to

2 subsidize free or cheap products and services. In return, you are often targeted with advertising or offered pay versions of the free software. This is really step 1 in monetization of your identity. She gave cautionary note that some people believe if you are using a free service, you are not a customer; you are a product. This could be viewed another way as the aggregation of personal data is the productization of people. Identity becomes currency. Most of us give this attribute data information away when we interact on the Internet without even realizing it. Companies are storing that data and monetizing it to give us superficially free services. Be they access to social networks or search company algorithms or money. By and large we want these apparently free or subsidized services and are prepared to put up with sometimes invasive advertising that might be associated with them. The Internet, though, is not a free resource. It costs money to build and maintain it. The question is: Are you happy to help fund the Internet with your identity attributes? You need to realize you are doing so and accept that if that's what you want. Andy Then took over and gave a brief summary on protecting the naïve from themselves. He started with a question - How many people have put personal information up on the Internet then regretted having done so? Also find out that having put the information up on the Internet, it is virtually impossible to remove it again. He noted that data aggregation is becoming more of a problem with huge amounts of personal data (BigData) or the aggregation of multiple data sets can be data mined to find out unexpected or unintended results - that is the problem. He noted there are now really good, freely available search algorithms, but you have now got a lot of publicly available information you can get someone's address details and that from 192.com, their career information from monster.com and you can start bringing this all together and aggregating it and mining it. He noted It's quite amazing how much you can find out about individuals. He then covered identity theft and the fact People just don't realize they put themselves at risk. You still get people who

3 are going to a cybercafé and using an untrusted machine to fill in forms online and give away all of their personal information. People don't understand what the risks are and don't understand how the risks come about, this is why we're all about protecting the naive from themselves. It's people who want to use the Internet, want to take advantage of all the benefits on the Internet but are not tech-savvy. We need to find a way of helping these people to understand the risks we want to make sure they are using the Internet securely. The final point he covered was frauds and scams and how easily people are taken in by these currently, include spam and fake websites. Michael Nelson asked the question 15 years ago I was convinced that we should have the online identity problem tackled in four or five years. Do the panelists have any idea on why that hasn't happened? This prompted an interesting discussion on why online identity systems work but they usually only work in very specific circumstances and there is still no sign of a global solution. However the question was not directly answered until a further discussion after the session. It seems to come down to the risk reward model and the fact that people still operate in communities even online, thus no one organisation will ever be accepted as the ultimate arbitrator of online identity. Andy pointed out that any such system would also have to deal with the whole population, every age, every language, every ethnicity, every creed, every religion. He also noted that static credentials such as passwords just don't work when you are dealing with organised crime, but these are still the only simple and prevalent method for access control. Keechang noted that identity is also context specific and driven by a value base. The problem is that there is no simple solution and the preconceived notion of one size fits all is flawed. Michael then asked another question about the Indian approach. The resultant discussion was on biometrics and the use of biometrics to provide convenient and security identity, both with biometrics being used as the user ID and as a credential. What was noted from the Indian example is its not perfect, but

4 importantly its not expected to be perfect, its expected to be much better than the solutions it replaced. It unlikely that any system will be perfect and any that claims to be will fail the first time it is circumvented. Keechang noted that state-managed identity being used on the Internet should be regarded with caution as they often have the best intentions but do not implement the systems very well. He noted that if your password is used to identify you, and your password is somehow leaked, you can simply reset your password. But biometric data, when it is leaked and it is in the bad hands, it's going to be very difficult to reset it! He noted people tend to have overconfidence about biometric being very secure. Andy noted that if you can have electronic identity in some form of token using PKI that is properly implemented, you can have secure online identity and you can only reveal the personal information necessary to do a particular transaction. I think that's the way we need to go is actually having some form of secure online identity that does not use static credentials. Sarah commented that we are seeing this in services like Facebook and work needs to be done on how you merge the technologies with biometric data and safeguards that need to go on top of use of biometric data. The Chair of the web payments group at the W3C asked a question - How do we get more stakeholders such as Government involved with the technology companies that are actually building these solutions and developing standards? Louise agreed with him that it was a problem and even IGF has not got a full balance of stakeholders yet. However she noted her view is that there's never going to be some big universal solution. We're going to have appropriate solutions for different classes of transactions and people will have different identities, different levels of security that they need for doing different things. Louise then moved on to the second set of discussion topics which were introduced by Keechang and Sarah and covered the balance between Security, Privacy and anonymity. Keechang introduced one of the problems he had been dealing with. South Korea has had an experience of enforcing state-

5 managed offline identity regime on online. In 2007 the South Korean government introduced legislation which required Internet users to identify themselves if they want to put a posting on the certain websites. They chose to use the Citizens registration number. So that's a very cautious attempt to use and enforce identity in the Internet that created a huge problem. He explained some of the dangers in introducing such an identity regime without thinking it through properly and looking at how it can be misused. He also asked if a national identity regime in the Internet really makes sense in the first place. The point is that the way it was implemented isolated those websites to non-koreans. They effectively implemented censorship without meaning to. The other issue is misuse of tokens as they can be copied and used for identity theft or even just pretending to be someone else when performing nefarious activities. This means that currently enforcement is flawed as the wrong person is found guilty. There are many stakeholders and players like governments, service providers and users and I think you need to have far more careful approach. He used the example of Age verification would be very important issue but very difficult issue. Because for services like Facebook or any service which aims at global market can they rely on one particular government's authoritative statement about a user's age? But then how are you going to come up with this age verification? Idenity can be a very diverse, fluid concept and depending on whether you talk about prevention of crime, prevention of online fraud, whether you talk about protection of a minor from adultoriented material, the goals are different and the level of assurance is bound to be different and the context of use is also going to be different. Sarah then gave a brief introduction to anonymity and its use online. She pointed out that organisations such as Facebook obviously made a value judgment around whether anonymity is desired and one thing that we think is fundamental to Facebook having over a billion members is our real-name culture and part of that is that there seems to be a desire that wasn't there for people to interact as their authentic selves on the Internet.

6 When we look at Facebook as a community, this real-name policy is actually essential to creating an environment where people feel comfortable and secure because they know who they are interacting with. She noted that there are challenges when you operate under a real name policy. Part of that is when you create a real-name culture, when you are not operating anonymously, there is a layer of accountability that is not there when you are anonymous. Hong then gave a short talk on the real name system in China, since we talk about identity on the Internet. She pointed out that the real name system in China is very much legitimate and expanding its implementation. This is defined by law, and enacted in 2000 by state Council. Still the most fundamental law on all information services offered an on the Internet. If you want to offer any public information services on the Internet in China you have to provide your real name information that is absolute. The logic behind this is that you are making information available to the public; you should make yourself available to the government and very much viable. This is one perspective. There are other circumstances that have become interesting. How to handle Internet content providers. For example, the blogging and microblogging in China, as Internet is really the paradise of information flow. Very hard to filter, control, censor, so these services are very much developing in China, though the more popular international ones are still blocked. You could use a pseudo-name, but it must be very viable so the issue for the content service provider, they must verify the real identity of all their users. This is their legal obligation. She noted in Europe, the recent court decision from the court that anonymous posting should be allowed so these people won't be in fear of the crime of defamation and this could be seen as positive for information flow and free expression. So we put a question mark of this real name system and look at it in the whole international perspective. Keechang added a point on anonymity because both previous speakers recognize the need for anonymity, but at the same time, they emphasize the benefits of real identity. He noted there is

7 a certain amount of ambiguity about the notion of anonymity itself and in many cases, the very notion of anonymity is deceptive and misleading because technically it is very difficult to achieve. So what is really important is to educate people that they are really not anonymous! You cannot be truly anonymous. You are being watched and especially by government and also by industry. But then at the same time we should not give up the notion of privacy because privacy is something which is entirely compatible with the situation where your identity is known. You don't need anonymity to have privacy. A comment was made on anonymity not being possible with the person stating they completely agree that from a governmental perspective, you are not anonymous online because so much data can be found out about you but from the perspective of young people, using services like Twitter which don't require your real name, it's not always possible to find out who the person is you are receiving anonymous postings from. A question was raised to the panel - Do you think there's a risk that although using online services like Facebook which require real name do you think there's a risk it limits our freedom of expression because we are scared of the accountability? Sarah replied I think it comes back to having a choice of platform and that identity is being used in different ways depending on the context. Keechang reiterated that Technically Internet is not anonymous. But by having a civilized governance framework and rules to operate by anonymity can be retained in the most part unless the authorities have a need for law enforcement or national security purposes to investigate who someone is. A question was raised about the process and strength of process to required to register that credential in the first place. Andy responded that he things this will remain one of the big problems as today most online identities are still based on a real world identity normally itself based on a government-issued identity or identity document. He noted it's incredibly difficult to do remote verification and registration of identity. A lot of people have tried it. There

8 have been various schemes on the Internet but unless you've got some way of verifying the attributes someone claims and corroborating the evidence they give you, it is really difficult to have any assurance in the identity and that identity belonging to the person that is claiming it. Keechang noted that the Korean government tried doing this with a PKI. They experimented and actually enforced a nationwide, mandatory PKI system where every user who intends to do financial transaction, online, online banking and shopping, must have. Its based on a government-endorsed PKI certificate. The government thought that would provide a very secure, very reliable identity verification for critically important transactions, online transactions. However the certificate and public keys can be extracted from peoples PCs as they are not properly protected which undermines the whole concept. A remote participant asked about the point on being tracked online as he didn t think it would be a view the whole panel held. Sarah replied it was an incredibly dynamic area and they were trying to make the US government be more transparent about the actions it takes. She noted we should make sure we're talking about what our expectations are and communicating those expectations and I actually hope that's part of the IGF more broadly. Hong commented you could presume you are anonymous but you are highly traceable by the governments or the other technical capable people. But her real concern is that once our identity has been identified on the Internet we enter into a scary world. Can we leave the system? Stop being identified? Can I erase my identity apart from the facial identity? If it can't be forgotten, can I be forgiven? Keechang reiterated his view I think government, if they narrow down their focus on certain individuals basically there is no way you can hide. That is why in my view it is important to educate people and propagate this technical effect you cannot hide. Andy commented I think the truth is that governments do monitor the Internet. They monitor all usage on the Internet and they will continue to do that. There are very, very good reasons, law enforcement, national security, for doing that.

9 But Governments may be monitoring and recording lots of information but they look at it reactively. They only look at it when there is a problem or something they need to investigate. They don't have the time, resources, or the inclination to look at every thing and track people. It is just not viable. Louise then make closing comments and all the panelists summed up. Conclusions There is still work to be done on the different balances. The balance is between anonymity and privacy/security not between privacy and security. Anonymity on the Internet is very hard to achieve, metadata can often be used to trace people. Normally this is a good thing as it is used to track criminals and is only done reactively however it can also be misused. Big data, aggregation and data mining are becoming more of a problem and both industry and online organisations are making more use of big data to more effectively target product advertising and services. Privacy online is possible but most people are naive in how they use the Internet and reveal more personal data than they should. This is more of an issue as nothing is ever deleted once it's on the Internet. Without people agreeing to subsidised services by 'paying' with their identity the Internet would be much more expensive and some services may not even exist. Some governments have tried to use regulations and enforce real name identity and even though this could be a good thing they have not normally implemented them properly which results in risk and misuse especially for the identity owner. Real-name identity systems have many benefits in a civilized online world and should be used. It is doubtful that anonymity is technically really possible and though there are sometimes good motives for wanting it, anonymity is often abused for nefarious actions. If Government are going to implement identity systems they

10 should do them properly and ensure that the failure modes are understood, that the identity system does not censor the network or services or limited them to a small community and that they are properly tested and secured before being implemented. Identity systems should be compatible and frameworks such as identity assertion based on commercial contractual models similar to those used in the global finance industry should be investigated for online identity.