Real-ID-NPRM

GSA-Protecting Personally Identifiable Information

The General Services Office of Intergovernmental Affairs solicited and is now publishing a collection of articles related to protecting personal information.  Included below is the announcement with a link to the newsletter.  This is a good series of articles on projects and approaches in Government.  Additionally, there is an article by yours truly relating what I believe to be the current state of privacy and who are the responsible parties.  Hint provided by Walt Kelly through Pogo (Does anyone remember Pogo?): "We have met the enemy and he is us."

The USA Services Intergovernmental Newsletter on Protecting Personally Identifiable Information is now available.  For access click on Link .  This edition highlights the many ways governments and other organizations are protecting personally identifiable information, or PII, with articles from US federal agencies, state and local governments, other countries, associations, and industry, and excerpts from the U.S. government’s fiscal 2008 budget and recommendations of the President’s Identity Theft Task Force.

PII is information that can be traced back to a specific individual user, e.g., name, credit card number, postal address, digital identity, Social Security or telephone number.  The FTC estimates that as many as 9 million Americans have their identities stolen each year.   

Articles include a discussion of the key elements in an agency strategy for protecting personal information; ways employers can implement responsible information handling practices; national policies for dealing with privacy and the use of PII in five countries; advantages of a federated approach to secure data exchange; the progress that has been made and the enterprise-wide strategies that are being employed to reach a high level in data security. These are just a few notable initiatives presented in this newsletter.

Highlights from the newsletter include:

Protecting PII: the VA Story, by Robert Howard, Assistant Secretary for Information Technology, U.S. Department of Veterans Affairs
Keeping Citizen Trust: “What Can a State CIO Do To Protect Privacy,” by Mary Gay Whitmer, Senior Issues Coordinator, NASCIO
Personal Information Protection in Japan, by Yoko Miyazaki, Deputy Director, Ministry of Internal Affairs and Communication
The  of PII, by Joanne McNabb, Chief, California Office of Privacy Protection
Prevent Identity Theft with Responsible Information-Handling Practices in the Workplace, by Beth Givens, Privacy Rights Clearinghouse
Privacy (for You and Me) is Dead. By Dan Combs, Board member National Electronic Commerce Coordinating Council

We hope you will enjoy Protecting Personally Identifiable Information and find it useful.  If you have any questions or comments please do not hesitate to contact Lisa Nelson at lisa.nelson@gsa.gov.

Denial of Service in Estonia and Real ID(?)

Steve Spoonamore, CEO of CYBRINTH, is one of the subject matter experts I trust and from whom I have learned a lot concerning the really scary side of electronic commerce/government and virtual life. Steve sent this note and I think it worth reading and incorporating into your view of the worlds, real and virtual, in which we operate. Steve’s message follows immediately and a link to the New York Times article after that. I even included a few ideas of my own after the link to the story.

“Many of you have heard me say the following: 'Everything you have seen in hacking up until now, has been a Beta Test of what is possible.'

This would qualify as a full Pilot. Small, but very succesful. It was not a Siege. It was a multi-pronged, multi-tasking, multi-fronted attack against several asset classes and financial institutions using a flame war of honor as COVER for the operation.

This article does not report the massive shut downs – Globally – of Central Banks, Processing Centers, parts of the US and EU Treasuries and many other financial elements. Many digital ripples extended from this event.

The ARPAnet turned Internet was designed to be a robust, synchronous and neutral tool. It was intended to facilitate kinetic wars by facilitating communication from all points to all points as kinetic attacks made communications routing unpredictable. But what exists today is, or soon will exist, will be far more powerful than all the kinetic tools themselves. It is the tool by which the tools are accessed, targeted and controlled.

If this does not wake people up to the need for defined Policy, defined Goals, defined Access and Prepared response. I am a loss as to what will. Interesting that this is now a front page of the NY Times story.”

Check out the entire story at the link provided below.

Check out the entire story at the link provided below.

TECHNOLOGY   | May 29, 2007
Digital Fears Emerge After Data Siege in Estonia
By MARK LANDLER and JOHN MARKOFF
The removal of a Soviet statue prompted cyber assaults that nearly shut down Estonia’s Internet infrastructure.

(Remember, just because you’re paranoid doesn’t mean that they ain’t out to getcha.) While the article is interesting it focuses on the cover or diversion rather than what is likely the underlying purpose of this attack. It would be much more interesting to see (although not very likely that we will) the follow up report detailing the crimes, successful and attempted, beyond the denial of service cover that occurred during the attack and seemingly persist still.

Why should this appear on a blog about Real ID?

The same organizations, criminal, other governments and terrorist (COGT), that are amassing the ability to conduct and those perpetrating these attacks are also indicated to some extent in ID crimes and would benefit tremendously from combining the DoS cover with high volume crimes employing compromised personal information. We make this much easier, more profitable and more likely because we have not addressed the need for strong identity functions. While much of the justification for the Real ID Act is based upon preventing physical entry, activities and movement of terrorists it is at least as important to inhibit the same or related activities in the virtual world. Real ID done right could be a tool in this fight.

Over the last few years there seems to have been a dramatic gap between the massive amount of personal information compromised and the much smaller amount used for criminal activity.  At some point “market” forces should quell the appetite for compromised information, but that does not seem to have happened.  It is worthwhile to ponder, “where is the information going and who continues to feed the demand side for personal information?” I believe one potential answer worth considering is that some combination of COGT organizations (their membership roles are not necessarily mutually exclusive) are supporting the “market” and stockpiling the personal information of U.S. citizens for future use.  Remember, there is no expiration date on this information.

NPRM Comment Outline

Here is a draft outline for our workgroup comment on the Real ID NPRM.

Download real_idnprm_comment_outline.doc

EC3 Real ID Workgroup Topics for Comment

David Lewis provided some very good edits to the potential list of topics for the Real ID Workgroup to cover.  Thank you, David.  Following is the updated list.  Please post your comments or otherwise let me know what you think.

We are looking for 3 or 4 high level topics that we can address in relation to the proposed rules for Real ID that might be missed by other comment efforts or on which we can provide a valuable or important input.

1. Governance: including information about potential models, membership and comment about what decisions should be left to the governing group vs. DHS regulation.

2. Business Model: paying for Real ID; how can or should various business models be accommodated through the proposed rules

3. Coordinating with other identity system/infrastructure efforts including Social Security, Dept. of State, INS, State vital records agencies and other state DMV’s.  HAVA, WHTI and other similar initiatives should appropriately coordinate efforts. (Real ID people and the Elections Assistance Commission should talk.)

4. Contemplation of Use:  What, if any, use beyond entrance to federal facilities and airport travel validation will the Real ID be used for? What protections will be afforded to the data collected by third parties from the card in these circumstances? For what and how will the cards, information and systems be used?

MIT/EC3 Real ID Forum In-Person Meeting

You are invited to join us for a meeting of the MIT/EC3 Real ID Forum.

The Real ID Act (RIDA) was passed into law in the fall of 2005.  Since that time there has been anxious anticipation of the rules to be written by the Department of Homeland Security.  Those rules have now been published and the public comment period is in progress. It is your turn to respond to these rules and we will be taking comments and contributions concerning any questions or issues you believe need to be addressed with the rules or the Act.

Following are details about the MIT/EC3 Real ID Forum to be held on Wednesday, April 11, 2007 from 1:30 to 5:00 Eastern Time.

What: Discussion on the Real ID Act and Rules: Overview of the key issues, problems and prospects; Short facilitated discussions on key topics (Governmental: draft rule/NPRM process, Congressional activity, state government activity; Putative Federation, etc), Policy and Legal (Privacy, Information Awareness and Sharing, State v. Federal jurisdiction for licensing functions, civil liberties implications, public/private partnership pro/con, etc), and Technology/Operations (Card requirements, one-driver-one-license implications for batch processing and tracking people, encryption, unique numbers for card holders, etc) and Next Steps (future scenarios in various economic sectors that might use Real ID to authenticate individuals, i.e. healthcare, eCommerce, eGovernment, eLearning, etc).

Why: The concept of a national identity system comprised of standard state issued federally regulated cards would have been politically and socially impossible before the attacks of 9/11.  However, as a measure to combat terrorism, the Act was passed with no debate in the Senate, with many key public policy questions and concerns remaining under-explored or completely unanswered.  To what extent, if at all, can the Real ID Act actually realize the promise of curtailing identity fraud, increasing personalization and transactional efficiency and enhancing law enforcement and intelligence ability to keep us safe?  If so, will the the impacts on privacy, civil liberties, centralization and federalization of state government licensing processes, operations disruptions at DMV and other citizen-facing friction points and the direct monetary costs to individuals and government at all levels, worth it the benefits – if any – that can reasonably be expected?  Using the good offices of MIT as the convener for Such We intend to compile a record of the contributions from the day to help inform the larger national dialog and will also make that record available to the appropriate Congressional Committees as they consider the need for repeal or reform of the Real ID Statute as well as to the Department of Homeland Security as it considers comments on their draft rules under the existing statute.  We also intend to pass the information back to key state government policy setting organizations such as the National Governor’s Association, the National Association of State Legislatures and the American Association of Motor Vehicle Administrators.  The proceedings will also be available on the MIT website: http://ecitizen.mit.edu for general public education.

Join us in person, on a conference call or online. Please register at http://ecitizen.mit.edu and then use the email addresses at the top of this page to request participation information.

Download real_id_forum_agenda.doc 

4-3-2007 Real ID Workgroup

Today Chris Louden of Enspier Technologies will be presenting for the EC3 Real ID workgroup.  Chris has been instrumental in developing identity infrastructure and Federal Government Identity Federation Architecture.  Included here is a biography and the PowerPoint presentation for this afternoon's call.

Download chris_loudenbio.doc

Download ec3real_id_040307.ppt

Washington State, enhanced Driver's Licencse

http://www.nwcn.com/statenews/washington/stories/NW_032307TRBlicensepassportKC.d707c88.html

This is a link to the article on Washington STate enhanced drivers' licenses.

Winter Storm-Identity Interoperability Demonstration and New Jersey Attorney ID Cards

There is some interesting work underway in several different areas to create credentialing systems.  Here is a link to information about the Winter Storm Identity Interoperability Demonstration, http://www.smart.gov/iab/presentations/NCRfirstResponderInitiative.pdf.  This seems to be a very important community to serve with necessary identity functions and the demonstration seems interesting. Download winter_storm_aar03_21_07_final_2.pdf 

On the other hand there is the work in New Jersey on establishing a separate credentialing system for New Jersey attorneys to get into NJ Courthouses quicker than the rest of the public. See the whole article here, Download nj_attorney_id_cards.pdf.

It was decided that each County Sheriff's office would issue the cards, $11,000 per office for equipment to produce the cards that are, "similar in appearance to New Jersey drivers' licenses but with the heading 'NJ Attorney Identification,' the cards include the lawyer's signature, photo, year of admission, date of birth, height, weight, eye color and sex. ...and would facilitate the establishment of separate courthouse entrances for lawyer."

"(State Bar President, Wayne) Positan said that in counties that don't have a separate line or entrance for lawyers, the new card will make it easier for county bar associations to negotiate new arrangements for courthouse entry.

He said he's not bothered by those counties that are sitting out the new ID program. 'I'm not looking to sell it, he said. If it helps 300 attorneys make their day a little easier, I'm happy."  It seems that not every New Jersey Citizen agrees.

When Public Information is too Public?

On February 28 the EC3 Real ID Workgroup had an excellent presentation and discussion concerning public records.  Here is a link,  http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9012221&pageNumber=1 ,to a story now unfolding in Texas with versions and variations occuring across the U.S.  The Texas Attorney General has issued a ruling that the practice conducted by county clerks (and by extension other government personel) of publishing on the Internet various public documents that include personal information, such as social security numbers,  "is a criminal offense punishable by jail time and fines."  The ruling does not say that the information is not public, that access to the information should be restricted nor that changes be made to the information included in these records, etc., just that it is illegal to publish public information in this particular manner and that the clerks in this case have a responsibility for the content.

It is worthwhile to reference www.cspra.org website and read The Public Record: Information Privacy and Access--A New Framework for Finding the Balance by Richard Varn and Fred Cate to understand another point of view on this topic.  Broad societal naivete and misunderstanding of what information is and is not public energizes a large proportion of the discussion related to the Real ID Act.  A first step to conducting a productive discussion on the potential effects of Real ID on privacy and personal information is to understand what information is or is not private.  It seems misguided to to blame the Real ID Act for making public information less private.  by Dan Combs