Report - Guardian

The LSE Identity Project Report: June 2005 267Figure 3 - Unidirectional IdentifiersEach Government Service associates the unidirectional identifier it received from Bobwith the legacy account information it holds on Bob (indexed, in this example, by hisnational insurance number at Service A and by his driver number at Service B).Likewise, Bob’s ID card keeps track of which unidirectional identifier it has hooked upto which Government Service. Because Bob’s unidirectional identifiers are theequivalent of randomly self-generated numbers, they are unlinkable and untraceablewithin themselves. The implication: Service A, Service B, and the Authority (evenwhen pooling all their data) do not gain any linking, tracing, and profiling powers overBob. In effect, the Government Services have merely associated a unique randomnumber to their pre-existing accounts on Bob. Consequently, Service A and B continueto know Bob exactly as they used to know him – in this case under his nationalinsurance number and his driver number, respectively. However, underneath the hood(through the embedded master identifier that is invisibly present in each of Bob’sunidirectional identifiers), Bob’s accounts with Service A and B are now securelyconnected, in a privacy-preserving manner.The privacy guarantees described in the above figures do not require users to rely onthird parties. Rather the power to link and trace the activities of a user across his or heractivity domains resides solely in the hands of that user. Note that the describedprivacy-preserving ID infrastructure does not make government services anonymous orpseudonymous where they previously were not. Instead, it avoids any degradation inprivacy that citizens currently enjoy when communicating and transacting withgovernment organizations.