Report - Guardian

The LSE Identity Project Report: June 2005 263they would house the power to track and trace all actions of individuals across allservice providers in real time. In addition, these authorities would have the power toselectively impersonate individuals wherever they go and to deny them access toservices across all activity domains – all at a single press of a central button.The currently envisioned ID card architecture for the UK also has severe implicationsfor the autonomy and security of service providers. When the same universal electronicidentifiers are relied on by a plurality of autonomous service providers in differentdomains, the security and privacy threats for the service providers no longer come onlyfrom eavesdroppers and other traditional outsiders. A rogue system administrator, ahacker, a virus, or an identity thief with insider status could cause significant damage toservice providers, could electronically monitor the identities and visiting times of allclients of service providers, and could impersonate and falsely deny access to the clientsof service providers.In sum, the national ID card as currently envisioned by government poses grave threatsto the privacy of UK citizens as well as to the autonomy and security of serviceproviders.The source of the problemThe main problem with the envisioned ID card infrastructure is that the UK governmenthas modelled its design after enterprise architectures for identity and accessmanagement. Enterprise architectures centrally house the capability to electronicallytrace and profile all participants. This gives the enterprise the power to provide andmonitor access by employees (and possibly “extended” user groups who accesscorporate resources, such as suppliers) to their corporate resources from a centrallocation, and to centrally shut down all their access rights in case they leave thecompany.By way of example, consider the Liberty Alliance ID-FF architecture, an industry effortto standardize so-called federated identity management for the enterprise. ID-FFdescribes a mechanism by which a group of service providers and one or more identityproviders form a circle of trust. Within such a circle, users can federate their identities atmultiple service providers with a central identity provider. Users can also engage insingle sign-on to access all federated local identities without needing to authenticateindividually with each service provider. Liberty Alliance ID-FF leaves the creation ofuser account information at the service provider level, and in addition each serviceprovider only knows each user under a unique “alias.” However, the user “aliases” (alsoreferred to by ID-FF as “pseudonyms”) in Liberty Alliance ID-FF are not pseudonymsat all: they are centrally generated and doled out by the identity provider, which first andforemost acts on behalf of (and in the security interests of) the service providers.