Are You Ready for the US Government as the Arbiter of Trust and Privacy?

By Dave Wieneke | in Identity, Privacy/security | 22 Apr 2011 | 3 Comments

Not all nations spy on their people without court orders, but Washington does.  In in my mind, this excludes the government from the privacy and trust business. Or at least from getting my business, if there were a real choice.

I’d prefer competition between nations and private firms in providing trusted identity management. For instance, I’d trust Iceland, a government with a huge privacy and free speech commitment, to guard my identity and privacy better than Washington. That’s not being unpatriotic; its just not being a patsy. Here’s what got me thinking about this.

We’re From the State, We’re Here to Identify You
Earlier this week the White House announced its plan to coordinate private-sector efforts to create trusted identification systems for the Internet.

Commerce Secretary Gary Locke described the drivers of an option for national online identification:

1. Prevent ID and data theft.
   Locke said about 8.1 million US residents were victims of ID theft in 2010.
2. Increase e-commerce by building trust.
   “Many people don’t trust the Internet,” Locke claimed. “[the Internet] will not reach its full potential — commercial or otherwise — until users and consumers feel more secure.”
3. Lower the current high cost of identity management
   The cost to business is high.  A company with 500 employees spends about US$110,000 a year managing employee IDs, according to the Department of Commerce.

I’m excited about colossal innovation happening all over the digital world, but not this. I don’t believe this will help one whit.  Yes, there are commercial interests this plan will serve (that’s why the Chamber of Commerce is all for it) but there is little chance this will advance the digital economy.

These goals seem to be somewhere between flawed and just false:

1. Preventing ID and data theft.
   Large scale data theft such as Epsilon’s Data Breach wouldn’t be helped by a federally established identity program.  Virus attacks, such as those being developed by the US for cyber warfare, simply don’t rely on identity. To protect data and identity, laws must require encryption and safe keeping of data. Statutes in Massachusetts create liability and fines for firms that fail to protect data. They’re being enforced, and the corporate focus on data security has never been higher.
2. Increase e-commerce by building trust.
   Sure, five or ten years ago there was mistrust of e-commerce.  Does anyone really believe that the App Store, or iTunes, or Kayak, or Amazon are missing sales because a significant audience doesn’t trust online retailers? As e-commerce takes place globally, does it make any sense for identity providers to take a nation-by-nation approach to identity?  These firms are doing well, and they’re earning international trade. Seems like we’re fixing something that’s working way above par, and oddly, only fixing it for domestic participants.
3. Lowering the high cost of identity management
   Lowering the high cost of health care is a national priority, and federal leadership on that is still rather a hot issue.  Of the challenges facing businesses, identity management is pretty low in the corporate hierarchy of needs. Yet the feds are itching to help with a problem that is marginal at best.

Identity management is far from perfect, but I have more confidence that the market will move us there at the right pace.  And if there isn’t a broad market-based demand for identity management, that could be because we value anonymity and a degree of disintegration in our digital lives.

Back in the day, there was something reassuring about state governments not being able to find out about drivers who were ticketed while visiting their states. Some inefficiency in government is reassuring, and I’m not sure I’m ready for that day to end on the Internet. Are you?