June 17, 2008

To sort out Internet born rumors about American presidential candidates, ordinary folks must prove to have investigative talents worthy of Daniel (1). According to Julie Bosman and John M. Broder (*), the Barak Obama campaign has opened a site specifically to combat "unfounded and potentially damaging reports". May I suggest it links back to its sources, wikipedia style? I started a "baseless and false" rumor myself and would welcome the extra visitors.

In a world of lies and make-believes, no wonder Truth goes naked (2). Take Scheherazade Daneshkhu and Ben Hall's recent update on the Kerviel case (**). "One of SocGen's financial controllers told the police that anomalies discovered in March 2007 indicated that some of Mr Kerviel's operations amounted to 'real fake trades which had no economic significance'". What will lawyers charge to free Truth from such a sentence?

Add the specter of terror to this context of elusive truth and no wonder the American government is bent on making sure personal identity becomes firmly established. Yet, in the ID Divide (3), Peter P. Swire and Cassandra Q. Butts have shown the dangers of asking for too much identification and expecting far too much to come out of it. Fairness and practical reasons dictate one proceeds with caution and, in my view, compensation should be built-in for inevitable errors, which befall citizens unevenly.

Truth is, Identity itself is the butt of some wild misconceptions. Consider my fillip a modest attempt to counter some of them.

Most socioeconomic relationships require a party to sustain its identity through time to claim the associated rights. Being recognized to be "the same as before" is what the ID Divide calls "authentication", to be effected through some id bearing token. In a working relationship, the rights manager have the means to prevent abuse by the id bearer. For instance one can prevent voters from casting multiple ballots by maintaining a registry of id tokens presented so far. In a balanced relationship, the id bearer is also expected to actively cooperate in case this id is lost or stolen.

However a rights manager may want to forbid a party to transfer its identity to another. When the relationship itself is truly personal, this makes sense and presents no difficulty, apart from real fake Sosies (4). Issues with authentication arise only when personal rights are enforced by bureaucracy. Whether a suspect instance of monopolistic behavior, to prevent ticket scalping, or fully justified by law and national security, to monitor airplane boarding, right transfer interdiction couples authentication with identification per se.

From a practical perspective, identification occurs when a party to a relationship is known to be "the same as someone already known" through one or more other relationships. Slyly carried for marketing purposes by personal data aggregators, this cross-referencing is pure Privacy violation. When sought by the party concerned to benefit from a third party recommendation, it is a fundamental Identity service. Notice that nothing requires recommenders to constitute national databases nor to link their databases together. In fact the more decentralized these "white lists", the better.

Rule of three recommendations provide the basis for Responsibility, the third element of our motto. If one suspects parties may want to escape from past obligations rather than to claim privileges, one can get insurance by requiring one's relationships to be bonded by special recommenders.

One thing is to try shedding civil responsibilities, another to avoid facing criminal ones. Laws authorize governments to check one's identity against blacklists of "wanted individuals". With targets less than fully cooperative, it is quite efficient to rely on id tokens bearing biometrics identification. First it is affordable to properly secure blacklists, which hold but a small fraction of the population. Second such id checks ought to be enforced in a personal encounter with a qualified officer. Under his or her watchful eye, will one fake one's fingerprints with gel, as feared by the ID Divide?

By issuing driver licenses and similar tokens, the American States have played the role of local recommenders for many years, a useful service. To prevent ID theft, they have recently been discouraged by the Federal government from using US Social Security Numbers (SSN's) on their id tokens, a wise decision. In the name of national security, the Federal government now asks the same States to strengthen their tokens scheme, a very legitimate goal. The problem is that, before awarding their identifications, the States themselves must now rely on Social Security Administration issued cards and State Department issued passports, both Federal agencies. Check for four flaws in this circular scheme.

Rather than to limit civil agencies to authenticating their own users with the help of decentralized recommenders, and law enforcement to identifying people against small criminal blacklists, this scheme needlessly cross-references huge civil whitelists into a universal ID system. Prevented from using the SSN to achieve exhaustive cross-referencing, it knowingly depends on highly unreliable keys such as name and address and victimize a majority of the people in the process. Rather than to restrict the use of biometrics to lawful officers for comparing one's physical marks and id tokens in the field for the purpose of interrogating central blacklists, it debases biometrics into a layman authentication standard for which it is unfit. Lastly, unable to manage blacklists responsibly, it populates them based on rumors.

Will Obama repay Edward Kennedy's endorsement and use his new site to keep the senior senator for Massachusetts off the No-Fly list?

Philippe Coueignoux

• (*) ..... Obama's Campaign Opens a New Web Site to Strike Back at 'Dishonest Smears', by Julie Bosman and John M. Broder (New-York Times) - June 13, 2008
• (**) .. Kerviel case raises difference between virtual and fake trades, by Scheherazade Daneshkhu and Ben Hall (Financial Times) - June 10, 2008
• (1) see Susanna's slander case in the wikipedia
• (2) see for example La Vérité by Jules Joseph Lefebvre
• (3) The ID divide, by Peter P. Swire and Cassandra Q. Butts (Center for American Progress) - June 2008
• (4) the English language ought to adopt "sosie", from the inimitable comic hero of Plaute and Molière. Go enjoy Amphitryon (English translation).