, University of Tromsø, Norway
When I was a student, the field of computer science was presented as purely technical. The marvels of category theory and the duality of memory and communication in implementing a multiprocessor operating system was just what I wanted.
Then came security.
It all started with the theory and practice of authentication in distributed systems ( http://portal.acm.org/citation.cfm?id=138874). One thing led to another, and before I knew it, I was worried. The thing is, what you see when you view the world from the authentication perspective is quite worrisome, because the line between authentication and identification is being blurred. Let me explain.
I have numerous customer cards. I don't use them to identify myself as a private person but rather to build and maintain a profile. I earn (too many) frequent-flyer miles, I get a (very small) discount when I shop for groceries, and so on. Companies add a financial advantage to the convenience, and I choose to take advantage of it. But if I drop by my local shop to buy contraceptives, I refrain from using my customer card, because then I don't want to be recognized. At my favorite online bookstore (and too many other places), I have an account that I log into with a user name. These user names, which are password protected, serve the same purpose: to update my profile and load my preferences. The common denominator is that I'm a customer, and the relationship is cordial but very formal: It's strictly related to business. Because it's a professional relationship and not a private one, I'm authenticated but not identified. I've told my bookstore that I reside in my office at the university (which by some definitions is a sad fact) and I want my purchases sent there. They let me use any address I want precisely because the relationship isn't private.
But things are changing. Every week I spend (too much) money on the National Lottery (Norsk Tipping), and I have a customer card there as well. The other day, I received a letter from them that said I could get the new "smart" customer card. By means of the new card, they're offering me new and improved services, and it looks good. But the letter also said that, for my security, I needed to bring some proof of identity to pick it up. For my security? That sounds odd. Some research revealed that the National Lottery is diversifying its business and selling identification services to others. If I go and fetch my new card, they will claim to know my identity. Knowing someone's identity is an asset that they can sell.
The National Lottery is changing the rules of the game by turning the professional relationship into a private one. They do so by adding my identity to my user profile. The implications of this for my privacy are not at all obvious. In particular: What if, in the future, I want to disavow my earlier(bad) habits? Can I escape my past when it's linked to my identity?
In addition to my customer cards, I have two credit cards. I use one exclusively when I travel, wine and dine in (too expensive) restaurants, rent(too large) cars, and so on. I use the other only in the little town where I work to pay for such low-cost activities as a train ride. This division is intentional. Both issuers include advertisements when they send me their(surprisingly large) bills. One of them informs me that now is the ideal time to play golf in Dubai or rent a suite in Shanghai. But the other tells me that now, before the busy season, accommodation is affordable in a remote mountain village named Geilo (you're excused if you haven't heard of Geilo). Obviously, they believe I'm two different people. In fact, my name is incorrectly spelled on one of the cards, so maybe I am two people.
In any case, I've never taken steps to correct this small error. Why should I? It doesn't cause any problems, and I enjoy confusing customer profile processing. This brings me to the issue's core: the difference between authentication and identification—or, more to the point, the blurring of the difference between authentication and identification.
The problem is that our privacy is under great pressure, and privacy is related to identification (not authentication). Here are some examples.
Lately I've scanned quite a few books searching for one to use in a beginners' course on computer security. It's hard to find one that both covers the technical material my students must master and makes them aware of how powerful this technology can be in the wrong hands. Part of the problem is that the books I find that cover this material more often than not refer to foreign and vague legal constructs that were amended to some other legal construct ( http://en.wikipedia.org/wiki/ First_Amendment_to_the_United_States_Constitution). Oh well, I guess this is what we from small nations must learn to live with. In any case, it's a real challenge to find ways to approach this important field without making students believe that pure technical solutions exist.
DS Online's Security Community, http://dsonline.computer.org/security
"Identity Theft Solutions Disagree on Problem", http://dsonline.computer.org/portal/pages/dsonline/0508/o8002.html
"Network Security Basics", http://doi.ieeecomputersociety.org/10.1109/MSP.2005.153
"Valuating Privacy", http://doi.ieeecomputersociety.org/10.1109/MSP.2005.137
"Exploring Privacy Issues in Web Services Discovery Agencies", http://doi.ieeecomputersociety.org/10.1109/MSP.2005.121
Tage Stabell-Kulø, "Blurring the Line between Authentication and Identification," IEEE Distributed Systems Online, vol. 7, no. 2, 2006, art. no. 0602-o2002.