Subject: Privacy, personally identifiable information, identity theft

From: [email-masked]
Date: Thu, 8 Apr 2004 08:19:34 -0600

<resend from 4/6, there appears to be some email tarpit>

we were called in by one of the industry groups to do some work on the cal.
e-sign legistlation ... and then later on the federal bill. their interest
was focused on some of the implications between e-sign and privacy. one of
the things that they had studied was the driving factors behind privacy
legislation ... which they claimed to be 1) identity theft and 2) denial of
(institutional) service. Note that since then, there are issues with
exposure of email addresses ... for instance look at the postings in the
PKIX archive:
http://www.imc.org/ietf-pkix/mail-archive/maillist.html

the issue with institutions in the mid-90s retrenching from the early x.509
identity certificates to relying-party-only certificates (basically a
public key and an account number ... or other database index ... where the
actual information might be located) .... wasn't directly an identity theft
issue .... it was the significant privacy issues. Some of the privacy
issues are related to identity theft ... but it isn't solely an identity
theft issue.

the various privacy legislative and regulatory aspects are related to
exposing personal identifiable information ... how and where that
information might be exposed ... regardless of whether or not that
information might be contained in a certificate or any other form. some of
the exposure issues may be related to identity theft.

GLB has a bunch of stuff about sharing of information within an
institutions and/or affiliated third parties. One could imagine a document
(certificate or otherwise) ... where it would be perfectly ok to transmit
and/or exchange between the individual and the primary institution ... but
there would be a requirement that no other entity be allowed to see it. If
some types of that information happened to be contained in a certificate
... then how that certificate was used, how it was transmitted, and who was
allowed to see it might be subject to various privacy legislation and/or
privacy regulations.

Recently issue was rasied that the proposed google email service may be in
violation of various privacy legislation and/or regulations.

In hypothetical scenario an entity digitally signs a perfectly acceptable
transaction. In a certificate-based authentication paradigm, the
certificate could contain personably identifiable information that has
absolutely nothing at all to do with the subject transaction. There could
be one or more relying-parties that had interest in authenticating the
digital signature. Under various legislative and/or regulatory constraints
it might be possible that some relying-parties would not be permitted
access to the certificate because of privacy constraints. Such privacy
constraints might also impose restrictions on how the certificate was
transmitted and/or handled.

Arshad Noor wrote:

I do not believe identity theft will ever be eradicated
regardless of the number of certs.  However, if we assume
that identity certs are useful, then there is some optimal
number that balances the risk against the inconvenience of
carrying too many credentials.  In the absence of objective
research recommending the precise number, or range, the
identity firewalls concept advances one figure.