Report - Guardian

260 The LSE Identity Project Report: June 2005Technologies such as digital credentials, privacy-friendly blacklist screening, minimaldisclosure proofs, zero-knowledge proofs, secret sharing, and private informationretrieval can be used as building blocks to design a national ID card that wouldsimultaneously address the security needs of government and the legitimate privacy andsecurity needs of individuals and service providers. The resulting ID card wouldminimise the scope for identity theft and insider attacks. A federated solution wouldalso better model and suit existing relationships, whilst ensuring proportionate datapractices.These solutions are well known to the private sector, but are rarely sought out whengovernments endeavour to develop national identification systems. The reasons forgovernment reluctance to consider these technologies are many. One is the poor designprinciples behind national ID cards, always perceived as large projects that enable onlythe full flow of information, rather than the proportionate flow of information. Anothersignificant reason may be because these alternative authentication systems empowerindividuals to control the amount of information that is disclosed.If the Government wishes to improve identification in general throughout Britishsociety, it needs to consider all the relationships involving the citizen. Instead theGovernment is proposing a system that will supersede all other relationships and currentidentification techniques. This is acceptable as long as the National ID is designed toallow proportionality and adaptability to local conditions. The current policy does notdo this, even though the necessary technology exists.Proper use of privacy-preserving techniques would allow individuals to be representedin their interactions with service providers by local electronic identifiers that serviceproviders can electronically link up to any legacy identity-related information they holdon individuals. These local electronic identifiers by themselves are untraceable andunlinkable, and so today’s segmentation of activity domains would be fully preserved.At the same time, certification authorities could securely embed into all of anindividual’s local identifiers a unique “master identifier.” This embedded masteridentifier would remain unconditionally hidden when individuals authenticatethemselves in different activity domains, but its presence can be leveraged by serviceproviders for security and data sharing purposes – without causing any privacyproblems.Designing such systems is possible, but the proposed UK scheme aims only to increasethe links to and from, and enable the full flow of information across, sectors and otherboundaries.In Federated Identity systems, there is a plurality of Credential Providers (public andprivate sector) who issue cryptographic security tokens for representing identity in somelimited domain, or linked set of domains. The credentials can be designed to be permitrecords of transactions to be either linkable or unlinkable, or on some spectrum ofproperties between the two. For example, it is possible for identifiers to:- be bi-directional or unidirectional, so that multiple identities can be traced fromone domain to another, but not in the reverse direction;