Social Logins for Government Services Profile Users IdentityWho wants Facebook and fingerprints for government ID? The current transition to electronic government (e-gov) means ditching all the paper + telephones + offices, and digitising everything, within the next few years. Driving licences, health records, prescriptions, taxes, benefits, voting, money all of them will be digital. To access these services, each citizen must get a smart-chip to identify themselves to the government via an Identity Provider, such as Google, Facebook, Twitter, PayPal, LinkedIn or Microsoft. The chip, called a secure element, can either be in a card, or a mobile phone, and youll have to hang onto it for dear life, because without it, your life would fall apart. This global smart ID is about to make its debut using social login. Apart from the surveillance involved using social logins, there will be a number of other chilling effects to follow biometric enrolment, for starters, followed by relentless profiling in the name of predictive policing (aka NSA, GCHQ), and even digital clones used for simulations. Mistrust will run amok. Always having to prove who you are, and what youre allowed to do. You could even be held responsible for maintaining our online profiles, meaning youd be liable for what you claim about yourself, and for updating your details when your ID changes in any way. You will also have to pay to have your attributes (such as passing an exam) verified. People are already being advised to watch what they say online, but the global smart ID system would be able to restrict your access to certain resources if you are deemed to be illegible. This might soon happen to people on benefits caught drinking, or smoking, their benefits might be stopped, for instance. Any identity can be revoked, i.e. switched off. The ultimate aim is to get us all using the same standards, which have been developed by the very same companies which stand to profit handsomely from this system. OpenID, used for social logins for government services, is a standard that lets sites such as Google, Twitter or Facebook share the same login credentials. U.S. Government sites require a trust framework, a certification system that enables a party who accepts a digital identity credential to trust the identity, security and privacy policies of the party who issues the credential. OIX is the first Open Identity Trust Framework provider, enabling certified sites to share their login credentials with U.S. Government sites. In 2010, Janrain was reportedly the only company to be, working with the Apps.Gov site to provide OpenID-based login and registration tools. The Open Identity Exchange (OIX) was founded in 2010 by Google, PayPal, Equifax, VeriSign, Verizon, CA and Booz Allen Hamilton, to create a trust framework of standards and certification which would work across borders, and between public and private sectors. Your government wants you to click sign in with Facebook, (or some other identity provider) to begin a transaction with any of its departments. This social login sets in motion a sweep of the Internet to track and trace your words and actions, and decide if youre a real person. This process is known as internet life verification. Each of the IDPs are part of the federated identity ecosystem, which means they are all using the same global standards; it means handing control of your identity to a third party, such as Facebook, Twitter, Google, PayPal, Microsoft, or LinkedIn. These are the dominant IDPs which provide citizens with a social (or federated) login. Some websites now have the NASCAR logo, which features the icons of the dominant Identity Providers (IDPs) listed above, (and maybe some others), and the option to sign in quickly using one of these social accounts is being offered by more and more websites and apps these days. Users may not realise that doing this would mean granting permission for their personal information to be gathered and analysed every single time they sign in. Over the next few years, more and more people all over the world will be using a smart phone, probably in combination with smart-rings or bracelets[1], to pay friends, and access buildings, using their NFC-enabled devices simply verify yourself to your Identity Provider, and the IDP will do the rest for you. In the blink of an eye. To understand what information can be gleaned from these IDPs, you gotta go here.Note that apps, etc, could get read/write access to peoples Facebook data, as well as that of their friends[2]. Security expert Dan Blum notes, A recent conversation amongst developers, about the clear progression of social logins, became a bloodbath, with comments such as: Also, at the Internet Identity Workshop last month (October, 2013), a long list of user challenges with federated login were recorded in the minutes from the meeting; for instance, it was noted that the Identity Provider has the, ability to follow the user to where they go, and that when a user builds up a long term identity relationship, [they] may get greater access to services for having a quality account, but users (who are said to have given permission to share their data) may not understand what gets shared, and be unclear on the potential use of the data. A great many problems are touched upon in the meeting: Social/federated logins are said to make peoples lives easier, and said to make them more private. A couple of clicks and youre in after that, whenever you need to prove who you are, and what you have access to, just click on your IDP icon, and the IDP will do everything for you it will pre-populate forms for you when you register with a site, and, whenever you need to prove who you are, for example, to buy a ticket, it would confirm to the website owner only those credentials which are required, such as name, date of birth, address, etc. Although this prevents other websites from seeing your details, there are several companies who will gather it up for them, literally splattering personal info all over the place. Data is now considered an asset in itself, so the trade in identities will become an even more lucrative market. The thing is, the identity profiles are created and owned by the Data Miners, and, when social profiles are combined with the credit history, and other offline data about that person, (such as call history and device ID, see below), the profiles are considered to provide substantial assurance that the person being presented is indeed who they say they are. Combined with behavioural biometrics, they also provide deep insights into an individuals personality and lifestyle. Marketers are eager for any information which will enable them to personalise their services, i.e. targeted ads. They really want to get to know their customers, as explained in a White Paper by Janrain, another social identity proofing company: Trulioo is another company which aggregates social data from the Internet; it then runs proprietary algorithms which can spot fake IDs, such as those created on Facebook. Developers are advised: Trulioo is partnered with several companies, including Janrain, Socure, andVerizon, which provides Universal Identity Services.[3] Trulioo has been boasting that the UK government is planning to use its services, and saying social logins are a good way to get people on board. For a few years now, financial organisations, such as PayPal and Equifax, have been using social profiles as an additional authentication factor when it comes toauthorisation. (So it helps that Google and Facebook are insisting people use theirreal name.) In other words, even without seeing your birth certificate or passport, the information contained in these profiles is considered to bolster the trustworthiness of data from credit bureaus, cell phones, and criminal records, and allow you to apply for credit online. Financial institutions are already using the services of companies like Janrain, Trulioo, and Socure to decrease the risk of fraud. These companies use social biometrics, to screen an online profile to see if its a wet carbon lifeform, i.e. a real person. The identity proofing companies take in all the data the person has ever entered into any of the social networks, combine it with other publicly available data, and analyse it to assess how genuine it is. There are no laws restricting the collection of this data, and it is even more valuable because it is user-generated (not from cookies), and therefore more reliable. Even without any credit history, an individuals social activity online can, over time, be enough to authenticate an identity to Level of Assurance 1. Once a user has begun the process, (e.g. by clicking, sign in with Facebook), an identity file is created, and can gradually be built up to become a trusted identity, by adding other layers of authentication, such as passport, driving licence, and biometrics such as fingerprints, or heartbeat patterns. With all of these layers put together, a fully assured, Level 4 identity has been created, allowing that person to participate in everyday life. After all, youll be needing Level 4more and more as time goes by. Youre then supposed to carry this identity around with you wherever you go, because youll be needing it throughout the day not just to access government services, or fill out a few forms on the Internet, but to open doors, pay for things, use your smart meter, log in at work, and much more, as time goes by, and trust decreases. Labelling the trusted ones has already begun. Have you noticed some websites are secure and have the green address bar? And you cant leave comments on YouTube any more unless you sign in to Google. For years, companies such as Google have traded their wares to marketers looking for that holy grail of advertising: an in-depth view of each individual customer, to be targeted with personalised ads. This they achieve by tracking their customers across the Internet, and in their phone and credit card transactions, in order to generate identity profiles of them. The profiles contain sets of attributes which make up the digital identity. Marketing has gone beyond demographics, to dig deeper into who we are and reveal our psychographics. Our religious and political beliefs, our friends, our routines, our professed selves. Are we really supposed to believe these profiles are not used by the NSA? The NSA raised its efforts to control identity/access after the WikiLeaks saga and put together the Insider Threat Program the message is, trust no-one, and always report them! The military sets the standards, and society must follow. Everyone is considered to be a potential threat. Its all about Information Assurance. Identity is also to be tied to the device we are using this is part of achieving high authentication, and is to be controlled by the Trusted Computing Module (TCM), installed in billions of devices already. The TCM works with Windows 8 (which the German government waswarned about), and has been approved by the NSA. Windows 7 can be used until the year 2020. The NSA also works with NIST(which is bringing in the NSTIC) to develop encryption standards. All points are to be covered. There are a great many sensors all around us which could be used to provide information to augment what is already known. Certainly, the trend will always be to increase security, as this is the start of a never-ending race to beat the identity thieves. The more that is known about a person, the less risk there is to the corporatocracy. Phones themselves have an incredible array of sensors,[4] even without biometrics. Earlier this year, The Guardian reported on Raytheons RIOT system; they feature a video of a specialist at Raytheon showing how individuals could be tracked through their digital footprints, combined with transaction data. However, the demo of RIOT, and even metadata analysis by the NSA, utterly pales in comparison to what marketers are already doing with the information provided by the Data Controllers. By examining our every move, in real-time, highly revealing personality and lifestyle profiles are being stored and analysed all the time. So if youve been riled by the idea of being tracked and scrutinized by intelligence personnel, youre certain to reject enrolment in the Worldwide Federated Identity Ecosystem they are now proposing. In fact, this is a truly marvellous opportunity for non-compliance, since the system is said to be voluntary. Living in the matrix makes our identities more vulnerable than they have ever been, to hackers and governments and the NSA, and programmers who work for them, creating a one-way mirror for surveillance and behaviour control. Forget their promise of privacy, because there will always be mistakes, hacktivists, and, worst of all, the quantum computer belonging to Google and Lockheed Martin. Anyhow, the NSA, in its effort to predict crime, is already able to crack any encryption the Identity Providers provide, since they are all in cahoots: Notes: [2] Dan Blum noted, Other than allowing one to choose or remove applications one by one, Facebook provides no granularity over how ones data is handled. If, next to Use apps, plugins, games and websites on Facebook and elsewhere? one clicks on Edit there is only the draconian option to Turn off Platform and the stern warning. You will not be able to log into websites or applications using Facebook; Your friends wont be ale to interact and share with you using apps and websites; Instant personalisation will also be turned off; Apps youve previously installed may still have info you shared; Please contact these apps for details on removing this data. [3] Verizon is one of the IDPs chosen by the UK government. However, as reported by The Guardian, Verizon passed customer call records to the NSA, containing, the phone number of every caller and recipient; the unique serial number of the phones involved; the time and duration of each phone call; and potentially the location of each of the participants when the call happened.http://www.theguardian.com/world/2013/jun/06/phone-call-metadata-information-authorities [4] See A Survey of Mobile Phone Sensing, by Lane, et al., 2010) Recently by Julie Beal: 