Identity Woman

Independent Advocate for the Rights and Dignity of our Digital Selves

Industry Area

TSA data cloud searching – Flights today, Subways tomorrow?

By Leave a Comment

This article was slashdotted today.

TSA had promised it would only use the limited information about passengers that it had obtained from airlines. Instead, the agency and its contractors compiled files on people using data from commercial brokers and then compared those files with the lists.
The GAO reported that about 100 million records were collected.
The 1974 Privacy Act requires the government to notify the public when it collects information about people. It must say who it’s gathering information about, what kinds of information, why it’s being collected and how the information is stored.
And to protect people from having misinformation about them in their files, the government must also disclose how they can access and correct the data it has collected.
Before it began testing Secure Flight, the TSA published notices in September and November saying that it would collect from airlines information about people who flew commercially in June 2004.
Instead, the agency actually took 43,000 names of passengers and used about 200,000 variations of those names – who turned out to be real people who may not have flown that month, the GAO said. A TSA contractor collected 100 million records on those names.

It brings up some serious concerns about how information collection and validation is done by the TSA for airline passengers. How can we trust governments to collect this much information about us just because we travel.
This week I wonder why care about airlines passengers because security is so tight that airlines do not seem to be a place where the next round of attacks will be. If London is any indication it will be on mass transit. Given the level of police/security presence on the transit systems in the Bay Area this week is certainly seems like there is some concern that mass transit will be attacked. They have started random searching of bags to get on the NYC subway. One wonders if they will start issuing ‘identity passes’ to get on such systems.

On the city subways, which are used by 4.5 million people on the average workday, the inspections started on a small scale Thursday afternoon and were expanded Friday.
The New York Civil Liberties Union opposed the searches, saying they violated the Fourth Amendment. Mayor Michael Bloomberg said he hoped the NYCLU would recognize that the city had struck the right balance between security and protecting constitutional rights. He said the bag-checking program is part of a policy to “constantly change tactics” and “may, or may not, be there tomorrow.”

Database and Identity in Civil Society

By Leave a Comment

On Monday I was at Advocacy Dev II. I got to meet Steve Anderson who has just joined ONE/NorthWest an network of 300+ environmental groups in the Cascadia – Oregon, Washington and British Columbia.
I thought I would post his introduction to give you enterprise guys who read this blog a sense of what the IT folks in Civil Society are dealing with. They are in some ways simpler then identity integration for 30 year old legacy systems. I am excited about the potential do deploy user-centric identity in this sector.

My name is Steve Andersen, the newest member of the ONE/Northwest team. I joined the crew in June to head up our work implementing databases to help our clients strengthen relationships with their constituents. We call the program Powering Relationships, and that’s will be the focus of the work–using technology tools to enable deep and valuable relationships between advocacy groups and their communities. ONE/Northwest has been doing database work for some time, but this year, with the support of MJ Murdock Charitable Trust, we’re going to really dig into the problem with the following goals:

  • Dramatically lowering the cost of database deployments
  • Standardizing our work on a small number of database platforms that show promise for the future
  • Raising the performance of relationship management in the northwest environmental community

I’m really excited about the program, and I’m getting started laying the groundwork for beginning database implementations in the fall of this year. Here’s how I’ve been thinking about the program in my first few weeks:
The Customer
Who are we going to work with? ONE/Northwest has deep relationships with many groups, and I look forward to meeting our customers (I’ve met a few already). Meeting and getting an understanding of who they are, who their communities are, and how they serve those communities will allow us to assist them with database technology to affect change.
The Opportunity
What are the opportunities that northwest environmental groups are facing? Are groups looking to improve donor management, online-advocacy, membership tracking, all of the above? ONE/Northwest has a fair bit of understanding of the existing opportunities from its years of work with groups. I plan to tap into that knowledge by getting up to speed on our current clients and the issues they have with databases. I’d also like to talk directly to some clients, to get the story from the source (always a good idea!).
The Platform
With an understanding of the Customer and the Opportunity, we can get to the technical business of picking a database platform on which to build. This is a critical step, as it is difficult (read: expensive) to change platforms down the road. It takes a bit of clairvoyance to know what platforms will be serving your needs in 3 years. But, there’s some science to it as well, and ONE/Northwest has made a number of platform choices that have worked out over the past few years. I’m confident we’ll make good choices around the database platform as well.
The Process
I’ll be building out a database consulting process that will take us from first contact with a group, through database needs assessment, scoping, implementation, training, and support. I won’t be building this from scratch (thank goodness!) as we’ve got 10 years of experience in this arena I’m really impressed with our consulting methodology and our customers have been very happy with our work in the past.
So, I’ll be busy this summer! I’m looking forward to it, and can’t wait to start implementing some real projects this fall. I’ll try to periodically update this site on new developments.

Catalyst: Government Adoption of Federated Identity

By 1 Comment

This is drawn from David Temoshok’s Talk. He is the Director of Identity Policy and Management GSA Office of Government Policy
Homeland security directive 12
“Policy for Common Identification Standard For Federal Employees and Contractors” – August 2004
HSPD 12 Requirements
1. Secure and reliable forms of personal identification that are:

  • Based on sound criteria to verify an individual employee’s identity
  • Strongly resistant to fraud, tampering, counterfeiting, and terrorist exploitation
  • Rapidly verified electronically
  • Issued only by providers whose reliability has been established by an official accreditation process

2. Applicable to all government organizations and contractors except National Security Systems
3. Used for access to federally-controlled facilities and logical access to federally-controlled information systems
4. Flexible in selecting appropriate security level – includes graduated criteria from least secure to most secure
5. Implemented in a manner that protects citizens’ privacy
Expanding Electronic Government
Needing Common Authentication Services for

  • 280 million Citizens
  • Millions of Businesses
  • Thousands of Government Entities
  • 10+ Million Federal Civilian and Military Personnel

You can learn more on the GSA website – http://www.gsa.gov/aces

Catalyst: Information Compliance Scott Blackmer

By Leave a Comment

One of the most interesting things Scott mentioned today was the proposed Leahy-Spector Bill in congress that would regulate identity brokers and come into effect in June 2005.

– Enact a bevy of new regulations that cover “data brokers,” defined as business or non-profits “in the practice of collecting, transmitting, or otherwise providing personally identifiable information on a nationwide basis on more than 5,000 individuals.” Among the regulations: data brokers would have to allow consumers the chance to change their information, and as with a credit report, receive a copy of that information at their request.
— Require businesses not already covered by the Gramm-Leach-Bliley Act or HIPPA (Health Insurance Portability and Accountability Act of 1996) to create a data privacy and security program. That part of the Leahy-Specter bill also expands disclosure rules nationwide, and mandates that customers be informed of any security breach involving more than 10,000 people, or that revolved around a database with more than a million entries.
— Limit the ways that Social Security numbers can be used as account numbers. This section also bans the sale of Social Security numbers, one of the data bits sold to fraudsters by ChoicePoint in 2004 and disclosed in February 2005.
— And forces the General Services Administration (GSA) to review government contractors’ the privacy and security programs before awarding contracts. This last item came from the recent news that the Internet Revenue Service had awarded a $20 million contract to ChoicePoint.

These new potential regulations have implications for the folks working on DB/datasharing in the nonprofit sector. Any individual with a big mailing list might be responsible to comply. Small businesses will be affected.

Next gen phone aps – interesting future identity use.

By Leave a Comment

Found in this article about next generation phone apps with interesting identity applications.

Curious about the people around you? Pantopic takes the openness, and, well, ‘browseability’ of an online community into the real world. Once you install pantopic, your phone becomes like a webpage that only people in your immediate area can read.
The fun part comes when you link up with pantopic groups in your area. Once you do, you’ll be able to get information about who your friends are hanging out with, and where. It’s going to be a few years before a lot of people have this technology. Pantopic tries to solve the saturation problem by focusing on seeing activity in your groups.

Neighbor node