Eldred Updates

Donna, parts I and II; Ernie; Howard.

Identity And e-Government

(Check with Bret Fausett about Mahi De Silva's presentation, also going on now.)

With David Temoshok and Phil Windley, aka Phil Windley. Premise: governments are in the business of identity management.

Phil's discussing the functions of a driver's license: identifies you, authenticates you, authorizes you to drive and may impose conditions on that. Digital signatures, the UETA, digital certificates. Government has abdicated its responsibility in the issuance of digital signatures. Rights issues, privacy issues.

You interact with government in a couple of ways: in a recurring manner (renewals, taxes), or you have a life event, like you're moving to a new state. Would be nice if there were a system with one site, one form, one payment to take care of all the new government requirements. Need portable identity information for this to work. Utah, for example, keeps names in over 200 separate databases.

Tension between privacy and quick, effective interactions with government. Other problems: governments don't realize they're in the identity business, have abdicated the responsibility for identity issues. Big problem is technology can't solve the real identity problems; you need policymakers to solve these problems, but in reality legislators have no specialized training, get lots of information from lobbyists. Citizens need to pay attention to educating legislators about these issues. If citizens aren't involved, the "black helicopter crowd" will make these decisions.

David's now speaking to what the federal government is doing about authentication. Expanded electronic gov't is on the President's management agenda. Initiatives in process, Mark Foreman, Quicksilver. All involve government business processes requiring identification. Irony: the digital signature law was wet-signed..."Changing culture is a big deal, and that's really what we're up against."

Building for interoperability, "the authentication gateway." Functionality that sits behind a general gov't portal. Need ability to determine the trustworthiness of credential providers and the credentials they issue. One way to do this is public key encryption/infrastructure (PKI). Gov't needs to be setting standards for accredidation. Would like this to be meaningful not just to the federal government, but to other governments and industry, higher education. Federal gov't has built separate PKI domains; federal bridge certification authority enables easy transactions and interoperability across those domains.

David's phone, 202.208.7655, email david.temoshok@gsa.gov, referenced sites: http://cio.gov/eauthentication; http://cio.gov/fpkisc; http://egov.gov.

D.C. Checks In

LawMeme is Live, From Eldred v. Ashcroft. More from Doc's discussion board.

From The Folks Who Brought You The Hummer

(They also brought you XM Satellite Radio.) Dang it, just lost most of my thoughts about Tony Scott's talk, but the gist has been that digital identity issues are permeating all of GM's projects these days, from customer relationships to inventory control to production. OnStar, GM Online Auctions, direct-to-consumer ordering in Brazil, the My Socrates employee portal. GM is part of the Liberty Alliance to help give business input into digital identity infrastructures, and work toward common standards and interoperability.

Regarding data tracked by OnStar: "You can see a model where you log into the car." Would give you access to same resources you would have at your office or at home. "The thought of having to do control-alt-delete as you're driving down the highway is a little scary."

What's to come: gas to fuel cells; mechanics to "drive by wire" (piloting like the space shuttle). Things that look like IT industry standards will begin to have parallels in the automotive field. Differences in car environment, most of today's IT tech wouldn't survive very well. "People won't wait for the car to boot up."

Welcome To Your ID

Phil Becker is giving some opening remarks, Doc is to my left, and we've met our first challenge of the conference -- power! Frank Paynter's in the house, and will be blogging the conference here.

Phil is talking about boom-bust cycles in technology: mainframes to pcs. People started to see the computer could become theirs in a certain way. Not to be feared, but your own personal leverage. By '84, Hollywood was making movies like War Games: premise, child with a computer and a modem could go one on one with U.S. defense infrastructure. '92, Sneakers: it's not about who has the most bullets, it's about who controls the information. Move away from computers as hardware to what computers are doing. '95, Hackers: continued the trend.

Identity issues began to take shape as computers transitioned from huge, expensive, cumbersome mainframes to having near universal access to connect and use a computer. Demographic differences between those operating computers and the general public are being eliminated. "Any information that touches this network is relentlessly driven into the public domain."

Identity is central thread which will enable security, control, manageability and accountability in a distributed network...but these things do not come without costs to rights like privacy. Security: firewalls and VPNs are the last stand, the effort to create physical security in cyberspace. Identity infrastructures and security are closely intertwined. Privacy: enforcing a negative, is about what those gathering data agree not to do with it. Privacy through architecture will inherently be more trustworthy than privacy through policy. [DMH aside: assumes the data will necessarily be gathered; just a question of how it's used or not...are we willing to concede this?] Authentication: "federation" is a big buzz word, refers to integration, how separately managed identity stores work together. Web services: about trying to take integration up a level in the "stack." Cites the WiFi flowing freely in the room here. How can I buy my next software package and plug it into all the data in the packages I've already got? Security and standards all exist to make the round plugs and square plugs fit together. Types of identity: enormous subject, as varied as the Internet itself.

This conference is about the identity conversation: understanding it, and moving it forward.

AKMA and Dr. Weinberger just arrived (Dr. W's blogging the conference here). (Can I just say what a kick it is to be sitting here blogging shoulder to shoulder with Doc?)