Report - Guardian

272 The LSE Identity Project Report: June 2005deny access to him if he is late in paying his subscription fees at the local library. Inspecial cases, however, conceivably there may be a lawful requirement that access canbe denied at a group of service providers (but not outside of this designated group) tousers who abuse their access rights at any one of them. For these particular services,Bob’s card could agree to enable revocable unidirectional identifiers. The importantpoint to note is that the choice is up to Bob, who may refuse to hook up a revocableidentifier if he deems the request to be unlawful or unreasonable.Secondly, in order for Service B in the above figure to be able to deny access to Bob incase Bob has abused his access rights at Service A, Service B must ask each user whowants to gain access to its service to submit a cryptographic proof that the invisiblyembedded number in their local identifier with Service B is different from the revokednumber that Service A has passed on to Service B. If the embedded number of an accessrequestor is equal to the blacklisted number, no valid cryptographic proof can becreated. The important points to note are: (a) entries on the revocation list aremeaningless random numbers to everyone, (b) the list of revoked numbers must be sentto each user who is requesting access, so each user sees that they are asked to prove theyare not on the list, and (c) proving that one is not on the revocation list does not invadeone’s privacy.ConclusionIt is inappropriate for government to model the design of a national ID cardinfrastructure for citizens after architectures for enterprise identity management thatcentrally house the capability to electronically trace and profile all participants. In thecontext of a national ID card infrastructure, the privacy implications for citizens of suchpanoptical identity architectures would be unprecedented. Panoptical identitymanagement architectures would also eliminate the ability of government and privatesector service providers to function autonomously, requiring a transformation of theirown systems for integration purposes. It would introduce enormous security risks tocitizens, companies and government alike, as fraudulent insiders and successful hackerswould have the ability to electronically impersonate citizens across organisations, tocause false denial-of-access to citizens on a fine-grained per-transaction basis, and tocause massive identity theft damage.Using modern authentication technologies that have been designed to preserve privacy,it is entirely feasible to build a national ID card infrastructure that simultaneouslyaddresses the legitimate security and data sharing needs of government and thelegitimate privacy needs and identity theft concerns of citizens. This approach is notonly much better for the citizen, but also for government itself.In the context of a national ID card infrastructure, security and privacy are not oppositesbut mutually reinforcing, assuming proper privacy-preserving technologies aredeployed. In this context, privacy is essentially the same as security against insiders. Inorder to move forward constructively with a national ID card, it is important forgovernment to adopt technologies that provide multi-party security while preservingprivacy.