Trusted Identities plan a 'major step' toward securing online transactions

The Obama administration today released its National Strategy for Trusted Identities in Cyberspace, a conceptual framework for a system of voluntary, interoperable credentials that could be widely accepted for online transactions.

The goals of this identity ecosystem are to enable more economic activity on the Internet while ensuring consumer privacy and security.

“Old username and password combination is no longer good enough,” said Commerce Secretary Gary Locke in announcing the strategy’s release. Password systems are cumbersome for both consumers and administrators because they do not scale well and provide limited identity assurance. As a result, “the Internet still suffers from something of a trust issue.”

An estimated $10 trillion of business is conducted globally over the Internet each year, and Locke called NSTIC “another major step” in the government’s efforts to promote this online economy. But administration spokesmen emphasized that the private sector would be responsible for developing and fielding the technologies for the ID ecosystem, and that the government would be playing only a supporting role.

“When the market is capable of acting...it should be enabled to do so,” said Deputy Homeland Security Secretary Jane Holl Lute. “The challenge and the role of government is to bring the players together.”

The importance of the private sector to the strategy was emphasized by the venue for announcing the release — the U.S. Chamber of Commerce in Washington. And the private sector appears to support the effort.

“Industry is squarely behind NSTIC as far as I can tell,” said Aaron Titus, privacy director for the Liberty Coalition and chief privacy officer for Identity Finder. “They are the ones who are going to have to make it work."

Locke also dismissed notions that NSTIC would lead to a national Internet ID, dismissing the idea as a “conspiracy theory” and saying that such a centralized ID system would constitute a threat to privacy and civil liberties.

NSTIC’s roots go back to the president’s Cyberspace Policy Review, which recommended the creation of an identity ecosystem that would allow the use of strong, interoperable credentials. A public draft of NSTIC was released in June and the final version incorporates comments and concerns in response to the draft.

Administration officials involved in the development of the strategy said the changes largely were clarification of the roles of the private sector and government. The government will coordinate standards-making and policy-development activities, in conjunction with the private sector, but it will be the companies that will develop and implement the technology.

The strategy does not define the technology to be used, but sets out four guiding principles:

• The identity solutions must be secure and resilient.
• They must be interoperable.
• They will be voluntary.
• They must cost-effective and user-friendly.

The strategy does not envision a single credential or technology for online identities. Rather, consensus standards for ID management and authentication would be developed, and companies would individually develop competing products within that framework. The products could incorporate a variety of formats, from software and digital certificates for PCs or handheld devices to smart cards and tokens. These could be used for transactions requiring a variety of assurance levels, from anonymity to strong assurance of identity.

Ideally, a single form of ID would be accepted by a wide range of organizations, and each organization could accept a range of products. Consumers would be free to use the credentials or not, and to mix and match them as desired.

Despite assurances that the strategy supports and protects consumer privacy, it does not call for any regulation or legislation to enhance government’s ability to police privacy concerns. Instead, it advocates private-sector adherence to fair information practices for ensuring privacy.

Some observers see this as a weakness. To date, privacy regulation in the United States has been narrowly applied and largely ignores online activities, leaving those transactions to the good judgment of companies, Titus said.

“So far they have not been so great at protecting privacy,” he said. “We are going to need regulation to balance the rights of privacy against profits.”

Titus said he supports what NSTIC does but is concerned about the lack of regulatory requirements.

“Privacy is not a partisan issue,” he said, but as for the chances of privacy legislation being passed soon, “I’ve learned not to hold my breath.” It is likely to be a multiyear process and should begin as soon as possible, he said. “If we start taking privacy seriously, we have a chance to make NSTIC work.”

A NSTIC program office is being established in the National Institute of Standards and Technology, and has an aggressive timeline for putting the strategy into practice. It plans to hold three workshops with the public and industry stakeholders by the end of September on governance, technology and privacy standards to create a consensus on moving forward. Dates have not been set yet, but the initial workshop — on governance — is expected to be in June.

An industry-led steering group will be established for technology and policy development, and NIST expects to fund a number of pilot programs in 2012. Funding for the NSTIC program office, which would fund pilot programs has been included in the Commerce Department’s budget proposal for fiscal 2012.