John K. Davis, Executive Director

Skinny Security

Unlocking cars and activating devices securely could soon be a matter of simply touching them, thanks to a communications system that transmits data across the skin. In an August 4 article at NewScientist.com this new technology from German company Ident Technology is described. Here are a few words from the piece:

...the system operates at just 30 nanoamperes, making it entirely safe for people to use. The code transmitted by the electric signal allows cars to be unlocked, doors opened or other devices started... A credit-card-sized system should run for up to three years without a change of battery and could cost only a few dollars to make.

Broadcast Flag

I have decided to consolidate my musings into one blog--I am not able to keep current publishing six blogs now that I am working full-time. So, I am posting everything here from now on.

"The broadcast flag rule forces manufacturers to remove useful recording features from television products you can buy today," said EFF Staff Technologist Seth Schoen. "The FCC has decided that the way to get Americans to adopt digital TV is to make it cost more and do less."

This means, among many things, that HDTV recorders and other PVRs will be delayed in going to market and it might even prevent such products from ever being sold if they don't obtain approval form the FCC. The biggest shock is that public affairs and news programming are not exempt from the rules. So it also means that public domain programming like CSPAN and PBS will need to be encrypted so they cannot be recorded and viewed at a latter time without expensive new hardware and software. This is nonsense, especially when the Broadcast Flag was designed primarily to protect Hollywood movies.

The only way to avoid this limitation is to purchase equipment before the rules become effective a year from now. I am beginning to research the market and will let you know how I proceed.

For more information check out the Electronic Frontier Foundation's website.

Why Care?

Someone asked me to explain the basics of digital identity and why it is important. Keeping the explanation concise is a bit of a challenge because digital identity, like any kind of identity, can be issued, chosen and/or expressed. A digital identity can also be assigned to a wide variety of holders, can be used in many contexts and can serve a multitude of purposes.

In this context “digital” means connected to programming code in devices that can read, write, or store information that is usually represented in numerical or alphanumerical form. “Identity” in this context means the quality or condition of being the same as something else. “Digital identity” is the representation of a person, place, process or thing in a distributed network interaction with another person, place, process or thing. The general purpose of digital identity is to restore the relative ease and security that transactions once had when humans lived in a tribe where everyone knew each other and both personal and business communications were face-to-face. Strong digital identity leads to deep digital trust.

I mentioned earlier that a digital identity can be issued to you. Your Social Security Number is an identity that was issued to you by the government. It identifies you, and only you, as a taxpayer. Your SSN is used by the Federal government to identify and monitor your compensation and the financial resources you own.

Digitizing your SSN and using it as a digital identity has already occurred. Linking this important identity with other issued identities that have been digitized like your driver license, medical record, insurance, employee ID, credit card, telephone number, bank account, travel records, brokerage account, military ID, passport, etcetera, builds a robust digital identity that describes you and your place in the world in great detail. Unfortunately, because these identities are assigned to you and linking them is not under your control, details about you and your place in the world are rapidly becoming public and easily discovered by people who will use the information to harm and manipulate you.

Some digital identities can be chosen. One of my email addresses is johnkdavis at hotmail dot com. I chose it, and because it was chosen it has expanded utility for me. It communicates something about me and tells people that I have an account with a web-based email service. An email address works fine even if it is a random belch of characters, but being able to choose gives me power and adds value.

My other email address is mail at johnkdavis dot net. This time the domain is mine, too. I own it, and owning the full email address expands my choice and gives me even more power and greater value. I am in control of much more--the domain registrar, mail server, storage location, etcetera--and I use this control to benefit financially and expand my sense of well-being.

This is the key point--your digital identity is important, it is mostly assigned to you and most of it is not currently under your control. It would make us much more powerful if the container that holds our digital identity was in our control and if we could agree to work only with those who will respect the limits we place on it. And, to make this control truly meaningful, the fewer “silos” of digital identity there are, the better it would be for us.

Digital identity is now emerging as the central component of all future networking environments. We will soon be able to put pressure on current systems to accept a digital identity we control. We may have to share control in some circumstances, but we ought to be able to limit the information that is shared.

It will be a battle royal because a lot of very powerful interests would like to control the digital identity landscape. These players will be fighting one another and us. It is during this early battle period when everything is up for grabs that we have a chance to gain substantial control.

Opportunities to choose a robust digital identity will soon be available. I will do my best to promote those opportunities that will empower us.

XRI News

It has been awhile since I have written about XRI here. I first mentioned it over two years ago when the company that owned the protocol, then called XNS, donated it to OASIS where the name was changed to XRI. The last time I mentioned the subject I explained more about my hope that the system would put individuals in a more powerful position to control the privacy of their personal information and I promised to publish a link to version one of the specification when it became available. Well, the rough draft of the specification was recently published.

Now comes news that XRI is getting closer to becoming real. There are a number of stories recently published about the current state of affairs for XRI, but this one really does a good job of putting things into context: New Web Services Security Spec Under Way.

The latest Digital ID newsletter put it this way:

Recovering or Recovered?

Phil Becker posted this entry at the Digital ID World blog this morning:

Both IDC and CIO Magazine surveys indicate that the tech slump will be over next year. When you realize that in today's atmosphere, no public company official will report any good news until after it has happened (that can land you in jail,) articles like this mean the slump has been over for a while now.

With the ending of the tech slump and an increase in IT spending, you can expect to see a bigger percentage rise in identity technologies than most other things. Why? Because identity is what will release the biggest productivity and business process improvement gains.

Barriers to RFID

Rick Fox, president and CEO of Fox IV Technologies, recently pointed out some of the challenges facing RFID technologies even if they work perfectly. FOX IV Technologies Inc. has been designing, manufacturing, integrating, supplying & servicing automated labeling systems for a wide range of manufacturing environments and applications for over 20 years. His comments should be sobering to those who see RFID as ubiquitous and universally embraced.

"I estimate the adoption level of barcodes within the US distribution segment of the supply chain at about 20 per cent. This percentage applies to a combined grouping of those cartons that manufacturers and warehouse have properly marked, and distribution centres that are properly equipped to scan barcodes as they are received...

"This dismal US performance is despite several factors: the existence of global barcode standards, the cost of printing a barcode being significantly less than an RFID tag, existence of industry-developed formats and stiff penalties for non-compliance. My question is: What are we going to do differently, or what do we think is going to happen, with respect to the implementation of RFID that didn't happen with barcodes?."

Some who follow this blog

Some who follow this blog may remember the entry last December about Digital Identity. I reported then that

XNSORG donated its remarkable XNS technology to OASIS (a not-for-profit, global consortium that drives the development, convergence and adoption of e-business standards). The technology will now be called XRI (eXtensible Resource Identifier). OASIS doesn't allow trademarks as names for the standards under its control and XNSORG holds a trademark on XNS in the public interest. So, a name change has been made but it is the same technology.

The OASIS group responsible for XRI has been hard at work and I'm hearing rumblings that version 1.0 of the specification will be announced very soon.

The promise when this project was delegated to OASIS created high expectations. "XRI will be the foundational element of a digital identity infrastructure. Things like trust and reputation will soon be commonplace on the Internet. No more SPAM! Safe financial transactions will be a no-brainer. Computer viruses will be much less prevalent. XRI will speed the transition to an extraordinary future."

The digital ID conversation has matured a lot in the past year. The Liberty Alliance has moved forward with great clarity of purpose. Large enterprises, consumer advocacy groups, interested technology watchers are all pretty much onboard, but the growing volume of consumers wanting to gain control of their information cannot be ignored. Will XRI find its niche in this environment? I think so, big time.

The thing those of us who have been watching closely hope for is a system that will put people in control of their digital identity. For too long the power leading the march forward has been corporate America. Whether its healthcare, financial transactions, Web services, or staying in touch with friends, the person who is the subject of the digital identity should be in control of how that identity resource is used and by whom.

I will publish the announcement of XRI specification 1.0 as soon as it is available.

Read, Write and RFID

Wired News posted an interesting news story today. Here is an excerpt:

Gary Stillman, the director of a small K-8 charter school in Buffalo, New York, is an RFID believer.

While privacy advocates fret that the embedded microchips will be used to track people surreptitiously, Stillman said he believes that RFID tags will make his inner city school safer and more efficient.

Stillman has gone whole-hog for radio-frequency technology, which his year-old Enterprise Charter School started using last month to record the time of day students arrive in the morning. In the next months, he plans to use RFID to track library loans, disciplinary records, cafeteria purchases and visits to the nurse's office. Eventually he'd like to expand the system to track students' punctuality (or lack thereof) for every class and to verify the time they get on and off school buses.

iQUE 3600

Garmin iQUE 3600 review by PC Magazine

Garmin, one of the most respected names in the GPS industry, has entered the PDA market with an intriguing convergent device, the Garmin iQUE 3600 ($590 street).

I recently assisted dear friends to get their new iQUE 3600 properly configured. It took four days.

So, OK, there were a number of special circumstances that created problems for us. First, two of the days were over the weekend. And then there is the thing about a prior Garmin device sabotaging us a bit. But no handheld device should ever take four days to configure.

The basic problem is digital rights management (DRM). Garmin has a chain of registration numbers, unlock codes, customer numbers and serial numbers that are needed to initiate the gadget’s GPS features. If anything goes wrong, and there are many things that can go wrong, you are toast.

Garmin closes at 5:00 PM ET and they are closed weekends. If Garmin feels they must build an obstacle course for customers to navigate, they could at least have support waiting on the sidelines for those who fall wounded during the arduous event.

Ubiquitous RFID

Here is a link to a story about that DoD announcement I told you about: Defense Department orders its suppliers to use RFID tags by 2005 - Computerworld

The new policy will cover practically everything purchased by the U.S. military -- from beans to bullets and from toothpaste to tank parts -- or roughly 45 million line items

So, do you have RFID yet?