1. Copyright 2005 1 Roger Clarke, Xamax Consultancy, Canberra Visiting Professor, Unis. of Hong Kong, U.N.S.W., ANU http://www.anu.edu.au/Roger.Clarke/......../DV/NatID-BC-0602 {.html,.ppt} 7th Annual Privacy & Security Conference Victoria BC – 10 February 2006 (Id)entities Management and Nym Management for People not of People

2. Copyright 2005 2 1.(Id)entities

3. Copyright 2005 3 Names Codes Roles

4. Copyright 2005 4

5. Copyright 2005 5

6. Copyright 2005 6 2.Identities Management

7. Copyright 2005 7 User Access Security for a Single Application

8. Copyright 2005 8 Single-Organisation Single-SignOn (aka Silo'd) Identity Management

9. Copyright 2005 9 Multi-Organisation Single-SignOn Identity Management

10. Copyright 2005 10 Federated Identity Management

11. Copyright 2005 11 3.Identities Management for People not of People Did you ever pause to consider that the expression Identity Provider is Arrogant?

12. Copyright 2005 12 Countermeasures by Individuals Web-Forms can be filled with: pre-recorded data convenient data pseudo-random data false data Personal data can be automatically varied for each remote service, in order to detect data leakage, e.g. spelling-variants, numerical anagrams Personal data can be automatically varied for the same remote service on successive occasions (to pollute the data-store and confuse the userprofile) Users can exchange cookies, resulting in compound profiles rather than profiles that actually reflect an individual user's behaviour

13. Copyright 2005 13 Identity Management by a User-Selected Intermediary

14. Copyright 2005 14 User-Device Identity Management

15. Copyright 2005 15 User-Proxy Identity Management

16. Copyright 2005 16 The Multi-Mediated Super-Architecture

17. Copyright 2005 17 4.Nym Management

18. Copyright 2005 18 (Id)entities

19. Copyright 2005 19 Nyms

20. Copyright 2005 20 Nym One or more attributes of an Identity (represented in transactions and records as one or more data-items) sufficient to distinguish that Identity from other instances of its class but not sufficient to enable association with a specific Entity Pseudonym – association is not made, but possible Anonym – association is not possible

21. Copyright 2005 21 Some Mainstream Nymous Transactions Barter transactions Visits to Enquiry Counters in government agencies and shops Inspection of publications on library premises Telephone Enquiries Access to Public Documents by electronic means, at a kiosk or over the Internet Cash Transactions, incl. the myriad daily payments for inexpensive goods and services, gambling and road-tolls Voting in secret ballots Treatment at discreet clinics, particularly for sexually transmitted diseases

22. Copyright 2005 22 Some Important Applications of Nymity Epidemiological Research (HIV/AIDS) Financial Exchanges, including dealing in commodities, stocks, shares, derivatives, and foreign currencies Nominee Trading and Ownership Banking Secrecy, incl. Swiss / Austrian bank accounts Political Speech Artistic Speech Call Centres Counselling Phone-calls with CLI Internet Transactions 'Anonymous' re-mailers Chaumian eCash

23. Copyright 2005 23 Common Uses for Nymity Criminal purposes Dissent and sedition Scurrilous rumour- mongering To avoid being found by people who wish to inflict physical harm (e.g. ex- criminal associates, religious zealots, over- enthusiastic fans, obsessive stalkers) To protect the sources of journalists, and whistle- blowers To avoid unjustified exposure of personal data To keep data out of the hands of marketing organisations To prevent government agencies using irrelevant and outdated information

24. Copyright 2005 24 Nymality aka ('also-known-as'), alias, avatar, character, nickname, nom de guerre, nom de plume, manifestation, moniker, persona, personality, profile, pseudonym, pseudo-identifier, sobriquet, stage-name Cyberpace has adopted, and spawned more: account, alias, avatar, handle, nick, nickname, persona, personality

25. Copyright 2005 25 Effective Pseudonymity The Necessary Protections Legal Protections Organisational Protections Technical Protections Over-ridability of Protections BUT subject to conditions being satisified, esp. collusion among multiple parties legal authority

26. Copyright 2005 26 Privacy Enhancing Technologies (PETs) Counter-PITs Savage PETs Gentle PETs Pseudo-PETs

27. Copyright 2005 27 Savage PETs Deny identity Provide anonymity Genuinely anonymous ('Mixmaster') remailers, web-surfing tools, ePayment mechanisms Privacy Enhancing Technologies (PETs)

28. Copyright 2005 28 Gentle PETs Seek a balance between nymity and accountability through Protected Pseudonymity Privacy Enhancing Technologies (PETs)

29. Copyright 2005 29 6.Some Myths in the Authentication and Identity Management Arena That the only assertions that need to be authenticated are assertions of identity (fact, value, attribute, agency and location) That individuals only have one identity That identity and entity are the same thing That biometric identification: works is inevitable doesnt threaten freedoms will help much will help at all in counter-terrorism

30. Copyright 2005 30 Roger Clarke, Xamax Consultancy, Canberra Visiting Professor/Fellow, Unis. of Hong Kong, U.N.S.W., ANU http://www.anu.edu.au/Roger.Clarke/......../DV/NatID-BC-0602 {.html,.ppt} 7th Annual Privacy & Security Conference Victoria BC – 10 February 2006 (Id)entities Management and Nym Management for People not of People

31. Copyright 2005 31

32. Copyright 2005 32 Anonymity vs. Pseudonymity Anonymity precludes association of data or a transaction with a particular person Pseudonymity creates barriers to association of data or a transaction with a particular person The barriers are Legal, Organisational and Technical The barriers can be over-ridden BUT conditions apply and are enforced, including: collusion among multiple parties sanctions and enforcement

33. Copyright 2005 33 Pseudonymous Transactions The Basic Principles Enable communications that do not require the client to identify themselves Conduct no authentication of identifiers leaving clients free to choose their identifier Protect the organisation against default or malperformance by the client (by ensuring that transaction risk is borne by the client)

34. Copyright 2005 34 Pseudonymous Transactions The Challenge of Continuity Needs for Continuity arise: within the context of a transaction (e.g. repairs under warranty) to associate successive transactions (e.g. loyalty discounts) Although the identifier is a pseudonym: Authentication is unaffected Customers are still Customers

35. Copyright 2005 35 Pseudonymous Transactions The Challenge of Payments Anonymous Payment Schemes work, e.g. DigiCash, but they have not achieved the breakthrough Schemes based on Credit-Cards dominate Identified credit-card tx undermine pseudonymity Alternatives: sponsor anonymous payments mechanisms separate payment aspects of transactions from the ordering and fulfilment aspects

36. Copyright 2005 36 Pseudonymous Transactions Potential Conflicts Customer Relationship Management 'Know Your Customer' Policies where organisations have become part of the national security machinery To perform their business functions effectively, organisations need to balance many interests, not simply succumb