Jim Harper (click to enlarge)

Tonight Jim Harper gave a talk on identity and public policy at the Utah State Capitol. I've recorded the talk and will hopefully have it up on IT Conversations soon.

Jim starts by telling the story of his book, Identity Crisis: How Identification is Overused and Misunderstood. . A few years ago, Jim joined the CATO institute and was invited by the ACLU to join them at the US Capitol for an event on national ID cards. He read the ACLU briefing and thought it was good, but overly simplistic. He sat down to read the literature on identification and identification policy--it took him a few hours and he was done. Jim decided to go back to the beginning and develop a theory of identity.

He start with identifiers--there are four

1. Something you are (e.g. biometrics, what you look like)
2. Something you are assigned (e.g. name, rank, and serial number)
3. Something you know (e.g. passwords or other shiboleth)
4. Something you have (e.g. an ID card)

He brings up some interesting points about these. We use socially assigned identifiers like time and place for a meeting that are single use.

Card issuers gather information and print it on the card and then the relying party ties the card to the user and verifies that the card is legitimate.

Each identifier that we use has different qualities: fixity (how tied to the person is the identifier?), permanence (can it be changed?), and distinctiveness (how many people use the identifier?).

Identifiers allow us to recognize people and visit consequences on wrong-doers.

Jim talks about identity systems.

1. A government issued ID has preeminence as far as who uses it. The more easily it is to ask for ID (with the issuance of national ID), the more likely it is that it will be asked for--accelerating the move to a surveillance society. Jim brings up the ACLU Pizza screencast.
2. An ID transfers information and thus power to the identity providers (institutions), giving them more power over our lives. Jim brings up the example of Holland in the 1930's. They had a wonderful identification system. It was very efficient, which was wonderful until the Nazi's came in. The fact that the religion of an individual (in this case Jewish) was known was a
3. Identification is used to secure things. What if we only had one physical key? You couldn't let someone else use your car key for fear that they'd end up in your house. Having multiple keys is less convenient, but more secure. Moving to a single key system may leave us vulnerable. Identity theft is, in part, a product of the fact that there is a single key that gives people entrance to multiple records.

Children aren't born with identities. They build them over time.

Security, national security, is a significant argument in favor of strong identity systems. Identity makes forensics easier. Immediately after an attack of some kinds, identity reveals who did it, leading us, deceptively, to believe that identity could have told us who was going to do it. The 9/11 terrorists, for the most part, accurately identified themselves. They didn't rely on anonymity. They relied on surprise.

A national ID would have some effect on illegal immigration. The easiest way to measure it is the market price of a fake ID. If it costs $1000 now, it might cost $2000 with a national ID system. The benefit of being a documented worker is worth hundreds of thousands of dollars, so you'd have to raise the cost of obtaining a fake ID significantly to stop illegal immigration.

Directly addressing the threats is a more effective strategy than identity for preventing terrorist attacks. The hardened cockpit doors are probably the single biggest improvement to airline safety, not anything that's happening at the airport.

Jim talks about RealID. Hard to blog because, but he has some great information--listen to the audio. Using ID to control access to places like courthouses has significant constitutional issues. RealID is perfect example of how bad process leads to bad results.

A competitive and diverse credentialing marketplace holds more promise for stronger identification than a national ID system. Different cards have different purposes--high value and low value transactions need different identifiers.

Jim holds up a $1 bill and a $20 bill. One has been updated twice to prevent counterfeiting in the last decade where the other has been updated not at all. When you make an identifier more valuable, you increase the cost of protecting it.

I didn't blog the question and answer session, but there was some good discussion of the social cost of identity and the way social systems can be used in place of identity. We didn't have a mic for the questioners--didn't think of it--so I hope we can get them into the audio.

This was a great session and I'm glad Jim could come do it. He is entertaining and makes good points about identity in public policy. Very good stuff.