Smartworld - Identity EcosystemTsze-lu said, The ruler of Wei has been waiting for you, in order with you to administer the government. What will you consider the first thing to be done? The Master replied, What is necessary is to rectify names.(Confucius, Analects XIII, 3, tr. Legge) Part One: IDENTITY CRISIS I am not a dog Cybersecurity has become the dominant concern for geeks and elites around the world, as governments and corporations attempt to exert control over the Internet to protect their interests. News is hot with updates on the TPP and the like, but there is little coverage of the push to control identity. For many years, the anonymity afforded by the Internet has prompted discussions about the problem of not knowing who exactly youre interacting with online, i.e. how can you tell its a real person, and not a dog? More to the point, how do you know who to trust? Most of the technical aspects to resolving this issue have been successfully tried and tested for many years now, as those with the most to lose have implemented Identity and Access Management (IAM) systems which offer secure solutions for digital transactions. This has created a powerful industry, especially for military applications; in fact, the market for IAM is expected to grow to $12.3 billion by 2014, from just $2.6 billion in 2006. This industry is now eager to expand into the civilian market, to provide each one of us with a unique global identification number, together with databases of all the personal information that makes us what we are. This is the age of e-governance, where just about everything is going online: relationships, government and business services, banking, and even law increasingly these transactions can be done with a mobile device, bringing a whole new set of factors into play when it comes to identification. Online and on the move, smartphone use is creating a multitude of e-IDs (electronic identities), as well as facilitating a massive rise in the use of RFID (radio frequency identification), such as contactless payments. Cybersecurity is achieved by using encryption protocols online as well as identity verification systems which employ RFID, or NFC (near field communication), i.e. scanners reading microchipped devices. With the introduction of IPv6, things are about to go wild. Its a global market, after all and every element will be itemised and accounted for. When the Obama administration released the National Strategy for Trusted Identities in Cyberspace (NSTIC) in 2010, there was heavy criticism from those opposed to national ID cards and loss of privacy. There has been scant mention of the scheme in either the mainstream or alternative press since then, yet NSTIC is flourishing, alongside similar schemes around the world. The plan is to make each national system standardized, and able to communicate with systems in other countries; leading to interoperability on a global scale, where all citizens have a single, virtual, global ID. This ID will be smart: using an identity device which proves your credentials, which employs microchips, RFID, and biometrics to grant or deny access and other privileges. At first the system will be voluntary, but eventually a tipping point will be reached where it becomes impossible to participate in society without submitting your personal details to an Identity Provider. Although most of our lives are already online, the push towards e-government and virtual finance represents the completion of this trend. Identity management for all looks set to be implemented by the end of the decade, by which time the few who have not joined up to the Trust Network will look very suspicious indeed conspicuously so. All bureaucratic transactions will be done online: getting a driving licence, applying for a job, or a social security benefit. Banking and shopping are becoming increasingly mobile and virtual too, necessitating identity verification even further. Youll have to keep updating your attributes with your Identity/Attribute provider: things like change of address and health details, pregnancy, photos anything at all related to who you are and what you do and what you look/sound like. Chances are that if you dont, the employer who insisted you keep your ID up-to-date will sack you, or that your health insurance/driving licence/mobile banking, etc, will be invalidated. We are expected always to be responsible citizens, in the name of security and protection. All Web transactions will be time-and-date stamped, to provide legal proofs and facilitate official investigations. There will be various levels of authentication which you will have to provide online, with the highest level pertaining to banking and governmental bureaucracy, and the lowest to the use of social media. The trust network will govern the rules of the identity ecosystem, and all members must agree to abide by the terms and conditions; failure to do so could result in your credentials being revoked. The police will also be interested in your details, to help them in their inquiries should a crime be committed. More than this, analytics could be performed on the identity data to predict when crime is likely to occur. There may even be a communitarian element to all this, where we are called on to sacrifice some of our rights to privacy, and join the identity ecosystem to realise global cybersecurity: 1. (i) Global Situation Countries around the world have been establishing national identification systems, most of them include biometrics and the issuance of smart ID cards. Identity management (IdM) involves numerous bodies in continually updating all identity attributes and credentials, and working towards a standardised, federated system. Since most of the world is implementing IdM, and since travel, migration, and international trade all require ID verification, it seems possible that global interoperability may one day be achieved. Some of the countries currently involved include: North America USA much progress has been made on the National Strategy for Trusted Identities in Cyberspace (NSTIC). Multi-factor biometric identification systems being rolled out to ports, as part of the SAFE Port Act, and some airports. Canada has issued a strategy. South America Brazil fingerprint readers installed in many ATMs. Rolling outunique-ID cards with biometrics. Mexico biometric authentication for voter registration. Africa Kenya National ID Card, biometric Resident Alien Card Ethiopia Biometric passport project Namibia Biometric driving license Ghana Biometric Voter Registration Morocco National ID with smart card Cote DIvoire Smart card project in the pipeline Nigeria is moving towards a cashless society for which it feels identity management is crucial. This is being overseen by the National Identity Management Commission (NIMC). South Africa has implemented biometric smart payment cards, which incorporate social security payments as part of MasterCards vision to create a world beyond cash. IdM in South Africa is being used for a population register, immigration and refugees. Europe Germany biometric residence permits for third country nationals France compulsory biometric passports with option forsecond chip for ID verification. Albania citizens may only vote if they can authenticate their identity with biometric passport or ID card. United Kingdom preparing to introduce IdM NumerousEuropean projects to achieve federated identity management are underway, e.g., Sweden, Germany, Belgium, Austria, Greece and Finland have taken part in the Global Identity Networking of Individuals. (see below). The Middle East Iraq biometric ID cards, data held by U.S. Central Command. Afghanistan strategy for IdM; huge biometric database, controlled by US military, the FBI and the Department of Homeland Security. Israel voluntary biometric ID cards being developed. The Gulf Cooperation Council, namely, Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates all operate biometric smart ID cards and are seeking to establish interoperability for e-ID management. Asia India comprehensive multi-biometric enrollment of citizens by the Unique Identification Authority of India Malaysia integrated ID card with biometrics 2. (ii) Cybersecurity and the The International Telecommunications Union (ITU) From helping to settle patent disputes involving mobile device manufacturers such as Samsung, Microsoft and Apple to suggesting a kind of web tax which could change the Internet as we know it, the International Telecommunications Union (ITU) has also been a key proponent of IdM. They have formed a number of study groups to research and report back on various aspects of this, and Study Group 17, which began work 2006, has done a lot of the groundwork for establishing a global IdM infrastructure. The International Telecommunications Union was founded in 1865 to regulate telegraph communications, and is now an executive arm of the U.N. In December, the ITU will be holding a major conference in Dubai the World Conference on International Telecommunications (WCIT) where the 193 U.N. member countries, each of which has a single vote, will meet to review the International Telecommunications Regulations (ITRs) which form a global, binding treaty between nations with regard to communications, whether by phone or computer, with voice, video or data, worldwide. This, of course, includes the Internet. There is currently a furore about the potential meddling of countries like Russia and China with the freedom of the Internet, with many fearing an end to the openness of the Internet (the proposal to levy charges for Internet traffic may lead to a balkanised Internet, according to a number of commentators). However, there are several debunkers, who dont believe the ITRs will change enough to have such a drastic impact. The ITU are dismissed by many writers as ineffectual as they typically lack consensus and are slow to get things done. The group is also criticised for not being a multi-stakeholder model, lacking transparency, and for excluding private interests. A detailed and highly topical paper by Patrick Ryan (The ITU and the Internets Titanic Moment) ), published in July (2012), argues that neither international law, nor treaties formed by the ITU, are totally binding. The influence of large corporations may, however, be significant, as the ITU have been continually involved with the private sector throughout much of their research, such as e-ID and online child protection. One of the best analyses, however, comes from Dwayne Winsecks Media Blog (19 June, 2012), which debunks the most prevalent fears abounding right now, but offers insight into specific possibilities, namely related to additions to Article 8, in particular the need to establish digital citizen identification, and address privacy concerns and Internet content regulation. Winseck also notes that several changes may be driven through using Web 3.0: ITU Telecom World 2012 provides an arena for government officials and industry leaders to debate the global ICT agenda, focusing on the effects of the rapid advance of disruptive technologies, noting, Last years conference attracted 237 companies from 41 countries some of the big names from IdM attended. The ITU Workshop on Addressing security challenges on a global scale (2010) examined standardization gaps and needs, concluding, It called for the development of standards-based operational models and common global protocol platforms for the trusted exchange of information. It also called for measures to safeguard both the security of biometric ID systems, and the privacy of personal data handled by Identity Providers (IdPs) and Accreditation Authorities. The ITU have also formed another body which is worth noting: the International Multilateral Partnership Against Cyber Threats (IMPACT) is attempting to address global cyberthreats by forming a public-private alliance with companies which include Microsoft and Symantec. IMPACT is part of the ITUs Global Cybersecurity Agenda (GCA), with the backing of 193 Member States as well as Interpol, academics, and other industry experts. Datuk Mohd Noor Amin, Chairman of IMPACT, is reported to have said It is really only a matter of time until there is a new global framework to deal with cybercrime. The main focus of IMPACT has been on ensuring online child protection. The partners from IMPACT held several meetings during the WSIS Forum this year; these were private meetings unavailable to other attendees, as all of them were closed. Each year IMPACT hosts the Global Cyberlympics, for which ITU Secretary-General, Dr. Hamadoun Tour, is the patron. The competition involves ethical hacking in an effort to understand how to protect and secure critical information and assets, and enhance online child protection through education. The ITU hosted the World Summit on the Information Society (WSIS) earlier this year. Stakeholders in the WSIS include the Internet Society; UNESCO; Intel; OECD; OISTE; GPII ; the Global Knowledge Partnership; the Commonwealth Telecommunications Partnership; Coverity; the World Economic Forum, and many others. Irans Science and Technology University won the WSIS Award at the Forum. 3. (iv) Industry players The chief Managed Security Service Providers (MSSPs), including ATT, Cybertrust, Getronics, IBM, Sprint, Symantec, VeriSign and Verizon, have been the industry leaders for many years now. Amidst a series of mergers andacquisitions, these companies have come to play a key role in the identity ecosystem, alongside Internet giants Oracle, Google and Microsoft, and a host of other multi-nationals. The Center for Identity, at the University of Texas at Austin, aims to be at the forefront of research and education in identity management. The member partners of the centre are: CSID; Deloitte Touche; Federal Bureau of Investigation; IBM; Indiana University; Intersections; LexisNexis; VISA; United States Department of Defense; United States Marshals Service; United States Secret Service; Texas Comptroller of Public Accounts; Texas Department of Public Safety; and TransUnion. The Center for Identity also hosts an annual conference and this year the managing director of Verizon spoke in connection with the NSTIC program. There are already a number of well-established Trust Providers who have tried-and-tested the architecture of the accreditation and verification systems involved in identity management. The leaders in the field remain so in this transition period to global implementation. They include Accenture, ID/DataWeb, andTrulioo, which is working in the area of social identity verification. The Kantara Initiative have approved several companies to be Identity Providers (IdPs) for the US ID ecosystem: evalid8, Deloitte Touche LLP and Electrosoft received the first approvals; then on 26 July, 2012, it was announced that Experian has been approved as an Identity/Credential Provider at the highest levels of assurance (levels 2 and 3) certified by Kantara for the NSTIC program. Verizon has also recently been accredited as a level 3 Identity Provider by ICAM; Verizon claims it is leading an identity-management revolution with a simple premise: to let in the right people and keep out the wrong people. Europoint has also been approved. Other companies, such as the US Postal Service are also getting involved in the establishment of a world where you constantly have to prove who you say you are. There are, of course, countless other organisations and corporations financially involved with establishing global digital IDs, and these will become apparent from the information presented below. 2. (iv) The ID Management Industry Virginia, which last year received more than $1 trillion in contracts from the federal government, boasts that the top cybersecurity firms have headquarters there, and include Verizon, VeriSign, Lockheed Martin, Boeing, Raytheon, L-3 Communications, BAE Systems, Northrop Grumman, SAIC, General Dynamics, Booz Allen Hamilton, Computer Sciences Corporation (CSC), Apple, Cisco, Google, HP, IBM, McAfee, Microsoft, Oracle/Sun, and Symantec. These companies are the main players in the IdM industry. The proponents and developers of the identity ecosystem claim the service will be a user-centric model, whereby the individual can control the types of credentials which are seen by the relying parties. The individual (user) can have a variety of personas, and will have the illusion of choice, the sense of control, and even of hiding behind a persona (using a pseudonym), confident that they will be protected by their Trust Provider. Maybe so, but still the data on the matrix which comprises their identity will have been aggregated to central hubs of information these are the Attribute Providers, and the Identity Providers, and, ultimately, the Governance Authority for the ecosystem. Control is hierarchical, with each stage of governance and control representing the gatekeepers of the knowledge. You will only have one entry in the identity ecosystem one account for each natural person. By signing up to the Trust Framework, you must agree to abide by all terms and conditions, because without trust, the system cannot work. You will have one password to access the ecosystem and validate your identity for online transactions, and to gain access to documents, buildings, etc. Each transaction on the Internet will involve you (the user), the person or organisation you are dealing with (the relying party), and the go-between (Identity Provider), who validates your identities to each other, to verify that you can each be trusted. Attributes are what make up an identity; the little bits of information about you that say who you are. They fall into three categories: Attribute Providers validate these aspects of an individuals identity; for instance, banks and credit agencies can validate your financial attributes, and governments can confirm your recorded and biometric details. Identity Providers (IdPs) must be certified by the Registration Authority they can then collect and assess the attributes for an individual, in order to issue a credential, which is stored on an identity device (e.g., USB/smartcard/phone). A parent company, e.g. the owner of an IdP, retains a legal right to access information, unless expressly prohibited by law. However, the whole point of identity management is to combat crime, and for all the protection we are promised, it is clear that our data will be made available to law enforcement agencies in the name of protection and security. Its for our own good. When it comes to privacy and anonymity, it is said that we need to balance this with the need for national cybersecurity, for what is in the best interests of the nation. BCS Identity Assurance Working Group have produced a paperwhich examines various aspects of IdM as it now stands. The paper goes on to pose a series of unanswered questions, as to the specifics of just who would be allowed access to identity information, how much of the information they would be allowed to check, and who would have the power to authorise access in the first place. There are also questions over whether people should be allowed to know if their details have been checked. So just how much can they find out? The data you produce each day, as you form your biographical footprint, already feeds a lucrative market for datamining companies and advertisers. But with IdM in place, all transactions on the web are recorded, as blogger Aaron Titus notes: For all the encryption and other protections offered to you, the whole point of IdM is fighting crime, terrorism, etc. When the law wants to check out your credentials, and your biographical footprint, it will be granted access; re-identification is easily achieved, and will be said to be necessary to ensure national, or even global, security. If your credentials are revoked, the Revocation Authority would also need to gain access to records during their investigations. 2. (v) The National Strategy for Trusted Identities in Cyberspace (NSTIC) According to the document, signing up with an Identity Provider (IdP) will facilitate: In response to the release of the NSTIC document, there were 186 proposals to design a standards-based ID infrastructure, each competing for a share of over $16.5 million of funding committed by the US government. There were 27 finalists picked in April, including the Transglobal Secure Collaboration Program (TSCP), which is a consortium whose members include the US Department of Defence, the UK Ministry of Defence, Boeing, and Wave Systems. The TSCP uses the standards of Open ID Exchange, the Center for Democracy and Technology, and the Trusted Computing Group. The full list of players involved in setting up the identity ecosystem in the US can be found at the new website for theNSTIC Steering Group. The Secretariat is Trusted Federal Systems. The group responsible for implementing the NSTIC consists of a Management Council, a Steering Group, a Plenary, a Usability and Accessibility Working Group, a Security Working Group, and an International Coordination Working Group. The US government acts as an identity provider, attribute provider, and relying party. An NSTIC blog reports that credentials within the identity ecosystem are issued according to the specified criteria for verifying the identity of individuals and devices. They must be resistant to theft, tampering, counterfeiting, and exploitation, and can only be issued by certified providers. It would appear, then, that identification is about more than just itemizing people, its also about verifying (tracking) the digital tools we use. Any fraud or glitch within the system would need to be quickly dealt with: 2. (vi) Progress in Europe Like Americas IdM strategy, the project underway in Europe claims to be user-centric and privacy enhancing. Known as GINI-SA, (Global Identity Networking of Individuals Support Action) , the project is developing the infrastructure for federated European identity management; the architectural, legal, and regulatory requirements. Citizens are to be given an Individual Digital Identity (INDI) which will link them to approved national data registries. It is claimed the new market space created for handling and storing ID data will enhance privacy, because the proportionality and minimization principles will apply. However, The GINI agenda was presented at a special session on identity management organised by ITU/OISTE at the World Summit on the Information Society (WSIS) in May. GINI-SA also participated in the WSIS Forum this year, as well as the EEMA eID Interoperability, Concepts and Compliance Conference; theCyber Security Privacy EU Forum (CSP-EU); and the Global Forum. Nokia, Microsoft, IBM and Deloitte are represented on the Board of Directors of EEMA (the European Association for e-Identity and Security), which is an industry led non-profit, formed in 1987. It is a members-only network for the IdM industry, working with governments and standards organisations to effect interoperability between systems, and legislation which advances IdM. STORK is an IdM project involving industry, government, academics and research organisations, and is part funded by the European Union. The aim is to achieve interoperability of online identities, in part to strengthen the European digital single market. STORK constitutes a pilot of IdM for citizens, which is attempting to achieve interoperability of e-ID systems across Europe and beyond, by trialling cross-border management of digital identities. These projects include a chat portal called SaferChat, verifying ID between young students and their teachers; secure online delivery of documents across borders; and the establishment of the European Commission Authentication Service, among others. EURIM brings together a variety of groups to address several aspects of Internet governance; corporate members include Microsoft, Google, Symantec, Citibank, ATT, and IBM. The UK government is now inviting tenders for the establishment of Identity Providers, which it intends to use with the new Universal Credit system. The Cabinet Office have published guidance on the issue and protection of credentials, highlighting the security breaches that a user can cause, such as leaving their password written down in view of others, or problems with using their mobile phone. 2. (vii) IdM Framework The architecture of the identity ecosystem has been built and trialed successfully over the last decade in particular. There are already numerous frameworks in place, and a huge industry has built up around them. Those who stand to lose the most, i.e. the DoD, corporations, banks, and governments, are already using the Identrust trust framework. Like other trust frameworks (eg reputation) it establishes a set of principles and rules which all who sign up to the framework must abide by. OpenID, Google, and Shibboleth (ID management for higher education) use trust frameworks which are already operating successfully. Social identity management is provided by connect.me The key Internet identity protocols are OpenID Connect, OAuth 2.0 and Account Chooser. A group set up to bring ldM to the wider market, the Open Identity Exchange Corporation (OIX) was established as a Washington State Non-Profit Corporation in February 2010 as per the wishes of the Directors of the Information Card Foundation (ICF) and the Open ID Foundation (OIF). The founding Board of Directors of OIX includes representatives from the OpenID Foundation; Equifax; Google; PayPal; Verisign; and Verizon. The OpenID Foundation Board of Directors represent JanRain; NRI; Google; Facebook; Yahoo!; New York Times; NPR; and Sears. The OIDF Sustaining Members are Booz Allen Hamilton; Facebook; Google; IBM; LexisNexis; Microsoft; PayPal; Ping Identity; Verisign; and Yahoo! The Information Card Foundation, another non-profit, was founded in 2008, for the purpose of advancing the adoption of Information Cards as a universal user experience metaphor for digital identity transactions based on an underlying identity metasystem that incorporates different technologies and token formats. Most of its Board of Directors are elected by the OpenID community and include, Azigo; Burtonian; Microsoft; Ping Identity; Google; Deustche Telecom; and Meristic. The OIDF Steering Members are, Booz Allen Hamilton; Equifax; Deustche Telecom; Google; Microsoft; Oracle; PayPal; andVerizon. The Open Identity Foundation (OIDF) is collaborating with the Kantara Initiative on the NSTIC. In the UK, it has just been announced that miicard is joining the OIX. Internet Society Personal Data Ecosystem Consortium OASIS (Organization for the Advancement of Structured Information Standards) whose founding sponsors include IBM and Microsoft, is involved in the standardization of various aspects of Internet management, including the smart grid, and identity federation. Members of the Technical committee include Microsoft, IBM, Cisco Systems, SAP, EBay, Ping Identity, Symantec, Boeing Corp, US Department of Defense, Verisign, Google, and Rackspace. The International Organisation for Standardisation (ISO), has produced international standards for certain aspects of digital identity management and Internet security. The Global Trust Center was formed in 2003 by a small group of individuals, and aims to develop and communicate what it deems to be best practice and guidance on issues of digital identity and trust. Since 2006, the group has participated in several events and discussion processes arranged by IKED, the OECD, the Global Forum, UN, EU, ETSI, and ASEM. It has also been involved in setting up biometric e-IDs. The Global Trust Council deals with rights and liabilities in digital interactions. There may also be a strong element of behaviour control from the outset it is being made clear that there are strict global terms of compliance in the trust ecosystem, and that failure to comply will result in exclusion from the system. Your data will be shared with the criminal justice system if deemed necessary. There will be nowhere to hide. VeriSign VeriSign (and Symantec, which has now incorporated VeriSign) is a company that has been involved in designing and implementing the identity ecosystem for many years, working with the ITU and also on the NSTIC. Verisign was created in 1995 to act as a notary public for the Internet. The company uses encryption software to secure online transactions with branded digital certificates and manages the Internets root directory service for the .com and .net domains, as well as providing the ONS (Object Naming Service) for RFID tags. As such, VeriSign serves as a steward of critical components of the Internets global infrastructure and is a key provider of cybersecurity mechanisms. VeriSign shares its technology and software-monitoring tools with the Department of Homeland Security, and has just been approved to run ICANN for another six years. In 2005, the ITU criticised VeriSigns monopoly over digital content, a result of their role in managing the core Domain Name Service (DNS) directory and maintaining the system of electronic product codes for RFID tags, which could eventually identify billions of products (and even people). It is of the utmost importance that the current monopoly over the DNS system is not transferred to the future Internet of Things. However, the ITU are now suggesting that they wish to work in partnership with ICANN. Dr Hamadoun Toure, the ITUs secretary-general told the BBC that some countries were unhappy with the way ICANN had looked after the DNS, pointing out that there has not been enough consultation with governments around the world. He dismissed claims that the ITU want to take control away from ICANN, saying, I truly believe there is a complementarity involved between our work we can work together. Verisign continue to exert dominance in the field of Internet governance, and last year hosted a symposium called Building a Better Internet, and, through Verisign Labs, has sponsored numerous university research programs this year, in addition to the infrastructure grants. In 2011, President Barack Obama appointed Mark McLaughlin, president and CEO of Verisign, Inc. to serve on the Presidents National Security Telecommunications Advisory Committee (NSTAC). Neustar Neustar is a massive telecommunications company which was founded in 1998 as part of Lockheed Martin, and is said to have information on every cell phone in the US. In fact, many companies turn to Neustar to handle surveillance requests. It claims to provide cybersecurity, and the US government is one of its biggest partners. Last month it was announced that Neustar and Swisscom, another telecommunications provider, are to be the founding members of the global Trust Network. Neustar have been heavily involved with the NSTIC through the Kantara Initiative, alongside PayPal, NTT, Danish National IT, Deutsche Telekom, and the government of Canada. There is a core group of identity security companies who also stand to profit enormously from the ID ecosystem; they are not household names but their influence is considerable. Ping Identity, for example, Just how bad is it? The OECD published a global survey last year of national strategies and policies being followed in OECD countries across Europe, America, Canada, Chile, Australia, Japan, Korea, and New Zealand. This was followed with the release of Digital Identity Management for Natural Persons: Enabling Innovation and Trust in the Internet Economy Guidance for Government Policy Makers, which is based on the premise that digital identity management is fundamental for innovation, trust, and security on the web, and necessary for the continued development of the Internet economy. It calls for governments to work together to enable verification of digital identities across borders. As has been shown, this is now coming to fruition, and now that the architecture, technology, industry capacity, and legal frameworks are in place, the next step is to get the masses on board. This area has been, understandably, a sticking point for NSTIC, as for how to get small businesses and consumers involved with the ID ecosystem how to bring all the ID authentication technologies to the market one possible solution is Facedeals, which encourages consumers to register their facial biometrics with Facebook, so that they can then check in to venues who use the recognition software. By liking businesses on Facebook, they would stand to be offered discounts by them when they check in online, or are scanned by facial recognition software as they enter the premises. Symantec (now incorporating Verisign and the Norton Secured Seal) has also released a Personal Identity Portal (PIP) using OpenID , thereby expanding ID verification to the wider (non-technical) market. This is an update on a product which came out a few years ago, which now has a Facebook app, so you can share your identity with your friends. The PIP is still in beta mode, supporting just 70 popular websites (look out for the green address bar) so they are hoping to get positive feedback to make the project really take off. Verisign has been working with the ITU on IdM for years. In 2009, for instance, Verisign proposed individual end-users are more concerned with social networking, convenience, identity services (esp. location based services) and portability, controlling unwanted intrusions and mitigating identity theft, so it can be expected that these factors will be part of any promotion of products like the PIP. He also called for global verification specifications for IdM and website verification. Social media is really starting to take off reputation graphs are being used to decide who can vouch for someone, to say they are who they say they are. The Respect Network Corporation is providing the Respect Network via Connect.me. It provides a way for people to manage their social identity online, as well as the personal data they are sharing, helping them to be more private. It is a peer-to-peer network, where people can build their reputation, and even become a Trust Anchor. Currently in beta mode, Connect.me is trialling a method which links an individuals social graphs from Facebook, Twitter, and LinkedIn. The best round up of the status-quo in the US was published by Zack Martin, at digitalidnews.com. He looks ahead to the next phase of the development of IdM, and notes that Don Thibeau, whose name figures prominently throughout IdM negotiations, and who is representing Google for the NSTIC, believes retailers can be brought on board by giving them a value proposition: Martins article goes on to note: The Transglobal Secure Collaboration Program (TSCP) is trying to address the problem of how to get more relying parties on board, ie those who only require low-level ID assurance. Currently there exist no incentives for the smallfry to join a trust network, but the TSCP are looking into ways to extend the use of federal PIV cards into other areas, i.e. using the credentials in the PIV card for other government services. Jeremy Grant, Senior Executive Advisor for IdM at the National Institute of Standards and Technology (NIST) is predicting that the ID ecosystem will be fully implemented by January 2016. He also advocates government take-up to stimulate demand this was instigated at the end of May, when the White House hosted a colloquium, where top companies were invited in an effort to get them involved with the ID ecosystem, by volunteering to become relying parties some of these companies included Amtrak, Dell, Mastercard, and Amazon. However, the one password for everything part of ID management proposed by NSTIC has been criticised as unworkable blogger Francisco Corella points out that other ID authentication regimes have so far not managed to avoid the password issue, which could be used by someone else. He also points out, The Governor of Virginia, where all of the top names in IdM and biometrics are based, recently promoted a special CITER Day in Virginia, as he believes verification technologies are criticalto the continued safety of the citizens of the nation. He received official letters of recognition from U.S. Senators Jay Rockefeller and Joe Manchin of West Virginia and U.S. Rep. David McKinley representing the 1st Congressional District of West Virginia. As will be shown in Part 2, IdM will boost datamining, ID profiling and surveillance, and it is clear that many stand to gain financially from the aggregation of personal data. In fact, the World Economic Forum describes identity as a new asset class. But could it be that IdM will create yet another type of asset; identity as a product, to be bought and sold for profit? Blogger Aaron Titus thinks so: Titus goes on to say that FIPPS are required, but not mandated, by the ecosystem: (Throughout all of my research for this article, I have found no other reference to the need to safeguard personally identifiable information from datamining organizations.) As for what its like to have a biometric ID, this comment from a Portugese resident gives just a few hints about the spread of this, and what its like to have to have one: The Obamacare solution? The Senate Healthcare bill HR3200, often cynically called Obamacare, has attracted a lot of controversy, especially as regards the mention of an implant. What has not been discussed, however, is the connection between this healthcare plan and identity management: e-health providers play a big part in the booming IdM industry and stand to gain handsomely from their involvement with all aspects of digital health and patient management. The Kantara Initiative is involved with implementing many aspects of the NSTIC, of which the Healthcare Identity Assurance Workgroup plays a big part. The workgroup is developing a model for the voluntary initiative, which uses the Internet to exchange health information across states, using Nationwide Health Information Network technologies (which provide federal agency connectivity). The project is called PIDS (Patient Identity Service) and is led by the eCitizen Foundation (a member group of ID Commons) and the Kantara Initiatives Healthcare Identity Assurance Workgroup. There are also a number of other organizations and individuals involved. PIDS incorporates an e-ID for the healthcare system with the Health Information Exchange, and registers patients with an OpenID that serves as their unique global ID. It is attempting to establish a digital patient verification system in alignment with the National Strategy. Other key participants include ApeniMed; an industry-leader in health information exchange, the Nationwide Health Information Network; Surescripts, which offers e-prescriptions and links with the Microsoft Health Vault; eHealth Ohio; Global Patient Identifiers, Inc.; SAFEBiopharma; and over 20 otherorganizations. At the end of July, Thomas E. Sullivan, M.D., testified in favour of electronic prescription services in a hearing on Sharing Trusted Identities in Cyberspace. Dr. Sullivan, who for the past eight years has been working for a small electronic prescribing company in Rockville, Maryland, called DrFirst, was called as an expert witness, although he said he had been unaware of NSTIC until that point. However, he has been on the board of Global Patent Identifiers, Inc. (GPII) since 2008 so it would be surprising if, in all that time, Barry Hieb, who left his post at Gartner to set up the non-profit GPII, had never mentioned his heavy involvement with NSTIC and the Kantara Initiative to the rest of the board. In fact, it would seem highly improbable that Sullivan could be unaware of NSTIC so why did he say that? (See Office of the National Coordinator Hearing on Trusted Identity of Physicians in Cyberspace; July 11, 2012; Prepared Remarks of Surescripts, LLC.) Patients are said to be in control of their own credentials, and the same arguments used years ago by the Verichip Corporation are now being used to implement the system, such as safer and more efficient medical care, and reducing medical errors related to the mis-identification of patients, especially in emergency situations. As will be documented in Part 2 of this article, Scott R. Silverman has seen the Verichip through a number of business incarnations. Silverman has also succeeded in finding alternative markets for the technology. In 2006, for instance, it was announcedthat VeriChiphad acquired the distribution rights for all VeriChip radio frequency identification (RFID) products in South Africa, including the VeriMed Patient Identification System, which had received a positive response at the 11th International Convention of Telemedicine. The President of iChip had faith the products would be welcomed by the population, especially in the field of health care. Currently, iChips website is still promoting the Verichip as a solution to patient identification, along with various biometric solutions. The patented iChip is now featuring as part of the Individually Controlled Health Information Platform provided byLifeNexus. The LifeNexus Personal Health Card is being marketed as crucial kit for everyone to carry at all times. It will enable people to provide their digitised health and insurance information to doctors and hospitals who employ the Rapid Admission System. Last year, LifeNexus enlisted VeriFone Systems, Inc. to provide payment facilities on the card (i.e. to add funds to the card, enabling it to be presented as paymentfor healthcare). The company has also partnered with the Center for Health Transformation (CHT), a think-tank founded by Newt Gingrich, and Gemalto, who will enhance the security of the card. Silverman (see Part 2) is now heading VeriTeQ, which has recently increased its power and coverage in the implants for health and safety movement: earlier this year, the company merged with Connectyx Technologies, the maker of MedFlash, an electronic Personal Health Manager (ePHM) which connects all health records to the Internet. The merger helps pave the way for the Verichip to be used as a Universal Patient Identifier (UPI) each chip has a 16-digit number which can be scanned to instantly provide all health information for the implantee. Not only can the Verichip save your life, you cant lose it. Silverman has even lined up an alternative, for those who just cant bring themselves to get the chip: Medflash provides the same service, but with a USB flash drive and a smartphone application instead of the chip. Earlier this year, Experian and Symantec announced they had jointly developed a two-factor credentialing solution, which has been selected to provide Enterprise Remote Identity Proofing (ERIP) and Multi-Factor Authentication (MFA) Credential Services by the Centers for Medicare Medicaid Services (CMS) in support of the Affordable Health Care Act (ACA) . This is to enable SAIC (Science Applications International Corporation), one of the biggest US defence contractors, with a$78 million contract with the CMS, to deliver secure credentialing for online access to the State and Federal Health Insurance Exchange, for more than 35 million U.S. citizens. In his book, Mass Mind Control (published by Adventures Unlimited Press, 1999 and 2003), Jim Keith noted, Several mergers have taken place, which are consolidating the power of various e-health providers. In May it was announced that IBMs predictive analytics software enabled North Carolina to detect $6.2 million in potentially fraudulent Medicaid payments. IMPRINTS SOCIAL ENGINEERING An ambitious research project into the wider aspects of identity, and how it relates to cybersecurity, is currently underway. It involves several universities in the UK, working in partnership with American academics, including experts in Visual Analytics at Purdue University in the US. A large part of the work appears to be an attempt to understand public perception of identity control, and even metaphysical concepts which arise in attempts to define identity what does it mean to be me? The project was kickstarted in 2010, when the EPSRC (the Engineering and Physical Sciences Research Council) hosted a sandpit event, which matches industry and government needs with academic funding needs. The event centred on a research proposal sponsored by the EPSRC, funders of the Home Office INSTINCT Programme and the US Department of Homeland Security. (The EPSRC has funded a plethora of projects, e.g. UBhave: ubiquitous and social computing for positive behaviour change.) The proposal requested research programs related to specific aspects of establishing the identity of someone. In particular, the research would need to focus on how someones online persona relates to their real identity, and how confidence is established and maintained. The aim is to develop scientific methods for assessing these, so the researchers would need to devise means to measure levels/types of confidence. The project is now in full swing, and includes funding from RCUK Global Uncertainties, and the Department of Homeland Security. Global Uncertainties is part funded by the Department of Homeland Security, the UK Ministry of Defence, and several Research Councils. The project has been split up into three separate research groups, each with their own defined areas of interest. IMPRINTS, for instance, is examining what is considered to be socially acceptable in revealing elements of an identity, and involves testing public opinion as reflected in art and popular culture, as well as common reactions to issues which touch upon ID management. The paper also notes the effect of 9/11: the new norm when it comes to risk is the precautionary principle, rather than prudence. Grusin argues this is due to pre-mediation filling the public imagination with images of what could happen, from pre-emptive war games, to media coverage, to box office hits such as Minority Report and other films. Others would call this predictive programming. The IMPRINTS team fail to point out that manipulative pre-mediation is a form of social control: if films, art, TV, and newspapers start including future scenarios of identity management, for instance, if a film were to portray ID implants in a positive light, people wouldget used to the idea, and be more ready to accept its implementation in the future. In fact, this research into pre-mediation is the ideal way to find out how to begin programming citizens to secure e-ID for all, especially as the burgeoning ID industry is ripe for expansion, governments around the world are implementing biometrical e-IDs, and IdM is considered essential to protect the national interest. The IMPRINTS team also fail to acknowledge the effects of their own input: by laying the groundwork for the military and large corporations, they are helping to shape society into accepting the type of ID management already planned, and just waiting to be implemented on a global scale. The team have envisioned various future scenarios, from which they predict: Wearable technologies are also being extensively examined, as this will be the first level of widespread acceptability, though the team also include implants and ingestibles in their ambit, such as Proteus Mindfulness pills (microchipped tablets, where stomach fluid acts as the electrolyte for the circuitry) to aid health monitoring. The IMPRINTS team note, as I have discovered in my research for this article, that there is very little coverage of the topic in the press. They conducted a search for the phrase identity management in the Nexis newspaper data base, for all UK broadsheets (Daily Telegraph, Guardian, Independent, Observer, Times), and found only 92 articles from the last ten years of coverage, five of which concerned the management of corporate identity. On average this means about nine articles a year, spread over five newspapers. The SuperIdentity project is examining the connections between real and cyber identities, and purports to be a fusion of data, with the promise of supporting robust identification decisions, guiding intelligence and surveillance efforts, and revealing previously hidden information. The final project is called Uncertainty of Identity and includes researchers from Arizona State University and experts in Visual Analytics at Purdue University. One of their aims is to identify the geography of online behaviour, and to supplement conventional geodemographic measures of neighbourhood characteristics with indicators of online participation and behaviour. http://kantarainitiative.org/confluence/download/attachments/28049411/NSTIC+in+Healthcare+-+ecitizenfoundation This article first appeared at Get Mind Smart Julie Beal is a UK-based independent researcher who has been studying the globalist agenda for more than 20 years. Please visit her website, Get Mind Smart, for a wide range of information about Agenda 21, Communitarianism, Ethics, Bioscience, and much more. You can support this information by voting on Reddit HERE 