Subject: QC Biometric Support. Was: Location and Identification

From: Anders Rundgren <[email-masked]>
Date: Mon, 22 Mar 1999 10:57:35 +0100

Andrew.
>I think the discussion at the moment is philisophically about whether to put
>some of this biometrics stuff online at all.

>In our country, the push for a national identity card was totally sunk upon
>issues of privacy.  We don't even allow so much as the US social security
>card style.  Also, the only people with fingerprint databases are the police
>and only for convicted felons.  

>I believe whilst it is technically feasible to putsome of this biometrics
>online, it is not commercially feasible or socially acceptable.

This is Australian POLITICS and not globally acknowledged FACTS.   Should IMO have
no impact on the specification of QCs.  It is a deployment issue if you use
SSNs and/or biometrics.

If you care to read a document in early alpha-stage on why I think it is fairly easily
to find powerful supporters for biometric data in certs, please read this:

http://www.mobilephones-tng.com/papers/idcards.html#READ_AND_WEEP

which I have prepared in great haste in order to also give our
non-ASN.1 readers a chance to see what it is all about.

BTW, has the QC task-force actually talked to FBI and immigration authorities?

Regards
Anders

---

From: Andrew Probert <[email-masked]>
Date: Tue, 23 Mar 1999 08:33:41 +1000

Sorry I beg to differ.  Desire for privacy is an international and globally
acknowledged FACT.   

I happened to state my personal Australian experience.  From what I read in
the press many other countries are similar.

I could equally cite Malaysia who have issued a digital id to everybody over
the age of 14, with photo, dual thumbprints etc as a counter claim.

There are a lot of projects we work on, healthcare for example, where a
unique id would be a blessing to we IT people and solve a hell of a lot of
technical and data matching issues.

I agree you can easily put stuff like this in standards and do niche
deployments.  

Pragmatically, I think you will find it hard to get mass deployment.

Andew Probert
Rotek Consulting   http://www.rotek.com.au
a Division of Secure Network Solutions
Tel  +61 3 9690 8877
Fax +61 3 9690 8171

> -----Original Message-----
> From:	Anders Rundgren [SMTP:[email-masked]]
> Sent:	Monday, March 22, 1999 7:58 PM
> To:	'Bob Jueneman'; [email-masked]; 'Andrew Probert'
> Cc:	[email-masked]; 'SEIS-List'; 'STEPHAN ALMQVIST'; 'Petra
> Glöckner'; 'Stefan Santesson'; 'Stephen Kent'
> Subject:	QC Biometric Support.  Was: Location and Identification
> 
> Andrew.

---

From: Alan Lloyd <[email-masked]>
Date: Tue, 23 Mar 1999 18:42:41 +1000

Some thoughts - 
a) I agree with andy.

b) we should not with new technologies and information paradigms (as
provided by directory services), design and use the system based on old
procedures. We should adopt new design methodologies comensurate with
evolving practices and the new system concepts and functionality. 
 
c) Having some minimal experience with the requirements of crime info
support systems and the application of directory services  - could mean
that we can:

1. put (eg.) fingerprint search engines/databases as subordinate
directory services to the backbone directory infrastructure.

2 put directory based relational search engines over the top of the
directory system to correlate information in the subordinate search
engines (eg. images) and directory information bases (eg. case
material).

3. Use a certificate to cryptographically sign and identify  (by name)
an image or biometric bit oriented object.

ie. The  approaches listed above to designing information systems (with
large scale directory services) -  actually solve many operational
requirements.

How such directory functions are applied re Users, Policies, privacy,
etc are operational matters and upto those who build such systems. 

The point - there are many commercial and socially accepted reasons for
putting bios/images in certs - its just there are some uses of bio certs
which may not be socially accepted in some countries.. 

However, this is a technical group - and we cant fix the worlds
social/X.509 issues for all countries.

regards alan 

----------
From: Andrew Probert
To: [email-masked]
Sent: 3/23/99 8:33:41 AM
Subject: RE: QC Biometric Support.  Was: Location and Identification

Sorry I beg to differ.  Desire for privacy is an international and
globally
acknowledged FACT.   

I happened to state my personal Australian experience.  From what I read
in
the press many other countries are similar.

I could equally cite Malaysia who have issued a digital id to everybody
over
the age of 14, with photo, dual thumbprints etc as a counter claim.

There are a lot of projects we work on, healthcare for example, where a
unique id would be a blessing to we IT people and solve a hell of a lot
of
technical and data matching issues.

Andew Probert

> >I think the discussion at the moment is philisophically about whether
to
> put
> >In our country, the push for a national identity card was totally
sunk
> upon
> This is Australian POLITICS and not globally acknowledged FACTS.
Should
> IMO have
> no impact on the specification of QCs.  It is a deployment issue if
you
> use
> SSNs and/or biometrics.
> 
> If you care to read a document in early alpha-stage on why I think it
is
> fairly easily

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 23 Mar 1999 11:50:12 +0100

Alan Lloyd,

>etc are operational matters and upto those who build such systems. 

But unfortunately the directory solution has at least as many
problems as the solution I suggest.  Who will have the right to access bio data?

My solutions allow the CLIENT/USER to choose what information he/she wants to
give to a relying party.  BTW, have you actually read the ID-document?

>social/X.509 issues for all countries.

We don't have to either!  By making room for the bio stuff in certs everybody will
be happy.  If the cert/bio, dir/bio or no-bio will be the "winner" is a thing for the market to
decide.

We all have our favorites and PKI is (at least deployment-wise) a young technology
so where we should be in ten years or so cannot be carved into stone today.

Regards
Anders