HumanHuman Identity, Identity, HumanHuman Identification Identification and Human Securityand Human Security

Jindrich Kodl, Ph.D. Jindrich Kodl, Ph.D. Milan Lokay, Ph.D.Milan Lokay, Ph.D.

CZECH REPUBLICCZECH REPUBLIC

AABSTRACTBSTRACT

Many information systems involve data about Many information systems involve data about peoplepeople..

This presentation seeks to overcome that This presentation seeks to overcome that deficiency, by undertaking a survey of human deficiency, by undertaking a survey of human identity, human identification and human identity, human identification and human securitysecurity..

The techniques discussed include names, codes, The techniques discussed include names, codes, knowledge-based and token-based id, and knowledge-based and token-based id, and biometrics. biometrics.

KKEYWORDSEYWORDS

Identity, Identity,

IIdentification, dentification,

SSecurity, ecurity,

BBiometrics,iometrics,

Identification Bases and Schemes,Identification Bases and Schemes,

Personal Identification NumbePersonal Identification Number.r.

IINTRODUCTIONNTRODUCTION

The presentation focuses on the identification of The presentation focuses on the identification of human individuals.human individuals. The following related matters The following related matters illustrates this area, but are not the focal point of illustrates this area, but are not the focal point of discussion: discussion:

the identification of products and packaging; the identification of products and packaging;

the identification of vehicles; the identification of vehicles;

the identification of animals; the identification of animals;

IINTRODUCTIONNTRODUCTION

forms of identification which show a category forms of identification which show a category to which a person belongs, rather than to which a person belongs, rather than specifying the individual; specifying the individual;

HHUMANUMAN I IDENTITYDENTITY

From our point of view, identity is used From our point of view, identity is used to mean to mean "the condition of being a "the condition of being a specified person",specified person", or or "the condition of "the condition of being oneself ... and not another".being oneself ... and not another".

It clusters with the terms It clusters with the terms 'personality''personality', , 'individuality''individuality' and and 'individualism','individualism', and, and, less fashionably, less fashionably, 'soul'.'soul'.

HHUMANUMAN I IDENTIFICATIONDENTIFICATION The term The term 'identification' 'identification' means the act or process means the act or process of of "establishing the identity of, [or] recognising","establishing the identity of, [or] recognising", "the treating of a thing as identical with another""the treating of a thing as identical with another" "the act [or process] of recognising or establishing "the act [or process] of recognising or establishing as being a particular person",as being a particular person", but also but also "the act [or process] of making, representing to be, "the act [or process] of making, representing to be, or regarding or treating as the same or identical".or regarding or treating as the same or identical".

HHUMANUMAN I IDENTIFICATIONDENTIFICATION

In the context of information systems, the In the context of information systems, the purpose of identification is more purpose of identification is more concrete: it is used to link a stream of concrete: it is used to link a stream of data with a person. data with a person. This presentation adopts as its This presentation adopts as its operational definition: operational definition: human identification is the associationhuman identification is the association of of

data with a particular human beingdata with a particular human being

HHUMANUMAN I IDENTIFICATIONDENTIFICATION

All identification mechanisms are fraught All identification mechanisms are fraught with difficulties, and hence the vast with difficulties, and hence the vast majority of transactions involve risk. majority of transactions involve risk.

They also cost money. They also cost money.

OORGANISATIONALRGANISATIONAL N NEEDSEEDS FFOROR F FORMALORMAL

IDENTIFICATIONIDENTIFICATION Identity and identification are vague and Identity and identification are vague and ambiguous. ambiguous.

They continue to be treated with considerable They continue to be treated with considerable looseness by most legal systems. For social looseness by most legal systems. For social purposes, informal, contextual identification is purposes, informal, contextual identification is sufficient. sufficient.

There are also many circumstances in which There are also many circumstances in which informal identification, or even none at all, informal identification, or even none at all, suffices for economic transactionssuffices for economic transactions

OORGANISATIONALRGANISATIONAL N NEEDSEEDS FFOROR F FORMALORMAL

IDENTIFICATIONIDENTIFICATION

When, for example, organisations have to When, for example, organisations have to have reliable identification of the have reliable identification of the individuals they deal with then have to individuals they deal with then have to ensure the protection of the individual.ensure the protection of the individual.

More commonly, the purpose is to More commonly, the purpose is to protect the organisationprotect the organisation.

OORGANISATIONALRGANISATIONAL N NEEDSEEDS FFOROR F FORMALORMAL

IDENTIFICATIONIDENTIFICATIONThe source of the issues discussed in this The source of the issues discussed in this presenttion are the following questions:presenttion are the following questions:

                when anonymity is unacceptable and when anonymity is unacceptable and identification necessaryidentification necessary,,

                what circumstances the restriction of what circumstances the restriction of a person to a single identity is a person to a single identity is

appropriate. appropriate.

BBASESASES FORFOR F FORMALORMAL IIDENTIFICATIONDENTIFICATION

A variety of means is available for identifying a A variety of means is available for identifying a person, in order to associate data with them. person, in order to associate data with them. These include: These include:

appearanceappearance - or how the person looks; - or how the person looks;

social behavioursocial behaviour - or how the person interacts - or how the person interacts with others; with others;

namesnames - or what the person is called by other - or what the person is called by other people; people;

codescodes - or what the person is called by an - or what the person is called by an organisation; organisation;

BBASESASES FORFOR F FORMALORMAL IIDENTIFICATIONDENTIFICATION

knowledge knowledge - or what the person knows; - or what the person knows; tokenstokens - or what the person has; - or what the person has; bio-dynamicsbio-dynamics - or what the person does; - or what the person does; natural physiographynatural physiography - or what the - or what the person is; and person is; and imposed physical characteristicsimposed physical characteristics - or - or what the person is now. what the person is now.

NNAMESAMES

Over a period of centuries, the demand of using Over a period of centuries, the demand of using of surnames began to be necessary. For people of surnames began to be necessary. For people who did not own land, the primary sources of who did not own land, the primary sources of surnames were: surnames were:

locality or territory; locality or territory;

offices, and later occupations and trades; offices, and later occupations and trades;

parentage, predominantly in the male; and parentage, predominantly in the male; and

nicknames. nicknames.

CCODESODES

To cope with the vagaries of name-based To cope with the vagaries of name-based identification, it is common for identification, it is common for organisations to create coding schemes.organisations to create coding schemes.

These are commonly based on a set of These are commonly based on a set of digits, but may incorporate alphabetic digits, but may incorporate alphabetic characters. characters.

KKNOWLEDGE NOWLEDGE -- BBASEDASED IIDENTIFICATIONDENTIFICATION

PasswordsPasswords are a very common are a very common application of knowledge-based application of knowledge-based identification. identification.

Another is the Another is the Personal Identification Personal Identification Number (PIN)Number (PIN) used in conjunction with used in conjunction with Automatic Teller Machines and Automatic Teller Machines and merchants' EFT/POS terminals. merchants' EFT/POS terminals.

BBIOMETRICSIOMETRICS

The term 'biometrics' is used to refer to any The term 'biometrics' is used to refer to any and all of a variety of identification techniques and all of a variety of identification techniques which are based on some physical and difficult-which are based on some physical and difficult-to-alienate characteristic. to-alienate characteristic.

They are sometimes referred to as 'positive They are sometimes referred to as 'positive identification', because they are claimed to identification', because they are claimed to provide greater confidence that the provide greater confidence that the identification is accurate.identification is accurate.

BBIOMETRICSIOMETRICS

Hence biometric techniques involve 'metrics' or Hence biometric techniques involve 'metrics' or measurements of some kind, rather than measurements of some kind, rather than depending merely on informal or subliminal depending merely on informal or subliminal methods. methods.

The natural physiological characteristics The natural physiological characteristics traditionally employed by the international traditionally employed by the international passport system are fairly gross, and are passport system are fairly gross, and are seldom sufficient to reliably identify a person.seldom sufficient to reliably identify a person.

A TA TAXONOMYAXONOMY OFOF BBIOMETRICIOMETRIC T TECHNIQUESECHNIQUES

appearanceappearance

social behavioursocial behaviour

bio-dynamicsbio-dynamics

natural physiographynatural physiography

imposed physical characteristicsimposed physical characteristics

DDESIRABLEESIRABLE CCHARACTERISTICSHARACTERISTICS

OFOF AA H HUMANUMAN I IDENTIFIERDENTIFIER universality of coverageuniversality of coverage

- - every relevant person shouldevery relevant person shouldhave an identifier have an identifier

uniqueness uniqueness - - each relevant person should each relevant person should

havehave only one identifier only one identifier - - no two people should have the no two people should have the

same identifier same identifier

DDESIRABLEESIRABLE CCHARACTERISTICSHARACTERISTICS

OFOF AA H HUMANUMAN I IDENTIFIERDENTIFIERpermanence permanence

- - the identifier should not change, the identifier should not change, nor be changeable nor be changeable

indispensability indispensability - - the identifier should be one or more the identifier should be one or more

natural characteristics, which each person has natural characteristics, which each person has and retains. If artificial, the identifier should be and retains. If artificial, the identifier should be enforcedly available at all times enforcedly available at all times

DDESIRABLEESIRABLE CCHARACTERISTICSHARACTERISTICS

OFOF AA H HUMANUMAN I IDENTIFIERDENTIFIER collectibilitycollectibility

- - the identifier should be collectible the identifier should be collectible byby anyone on any occasion anyone on any occasion

storability storability - - the identifier should be storable in the identifier should be storable in

manual manual and in automated systems and in automated systems

exclusivity exclusivity - - no other form of identification should no other form of identification should

be be necessary or used necessary or used

DDESIRABLEESIRABLE CCHARACTERISTICSHARACTERISTICS

OFOF AA H HUMANUMAN I IDENTIFIERDENTIFIER precision precision

- - every identifier should be sufficiently every identifier should be sufficiently different from every other different from every other identifier that mistakes are identifier that mistakes are unlikelyunlikely

simplicity simplicity - - recording and transmission should recording and transmission should

be be easy and not error-proneeasy and not error-prone

DDESIRABLEESIRABLE CCHARACTERISTICSHARACTERISTICS

OFOF AA H HUMANUMAN I IDENTIFIERDENTIFIERcost cost - - measuring and storing the identifier should not be measuring and storing the identifier should not be

unduly costly unduly costly convenience convenience - - measuring and storing the identifier should not be measuring and storing the identifier should not be

unduly inconvenient or time-consumingunduly inconvenient or time-consuming acceptability acceptability - - its use should conform to contemporary social its use should conform to contemporary social standards standards

CCURRENTURRENT DDEVELOPMENTSEVELOPMENTS

During the last decade, the march of During the last decade, the march of identification, data-processing and identification, data-processing and communication technologies have excited communication technologies have excited a particularly enthusiastic surge of a particularly enthusiastic surge of attempts by governments to introduce attempts by governments to introduce general-purpose, national schemes.general-purpose, national schemes.

PPUBLICUBLIC P POLICYOLICY I ISSUESSSUES - - IINHERENTNHERENT O OBJECTIONSBJECTIONS

TOTO I IDENTIFICATIONDENTIFICATION All forms of identification may attract All forms of identification may attract opposition in different circumstances. opposition in different circumstances.

The greatest degree of public distrust, The greatest degree of public distrust, however, is generally associated with however, is generally associated with biometric identifiers.biometric identifiers.

Their use is in some cases invasive, and in Their use is in some cases invasive, and in all cases seems that way. all cases seems that way.

PPUBLICUBLIC P POLICYOLICY I ISSUESSSUES - - IINHERENTNHERENT O OBJECTIONSBJECTIONS

TOTO I IDENTIFICATIONDENTIFICATION As the sophistication of identification As the sophistication of identification technologies increases, the identification technologies increases, the identification schemes operated by individual schemes operated by individual corporations and government agencies corporations and government agencies require regulation, in order to achieve require regulation, in order to achieve appropriate balance between personal, appropriate balance between personal, corporate and social needs. corporate and social needs.

RRISKSISKS ININ M MULTIULTI - P - PURPOSEURPOSE IIDENTIFICATIONDENTIFICATION

SSCHEMESCHEMES Most people are cowed by the power of Most people are cowed by the power of large institutions, and resent at least large institutions, and resent at least some aspects of the surveillance society. some aspects of the surveillance society.

The imposition of social control The imposition of social control mechanisms, including the enforced use mechanisms, including the enforced use of intrusive identification, could stimulate of intrusive identification, could stimulate an increased degree of conscious non-an increased degree of conscious non-acceptance of authority. acceptance of authority.

CCONCLUSIONSONCLUSIONS

Identification is an important design Identification is an important design consideration in information systems, consideration in information systems, which deal with people.which deal with people.

The more effective biometrics-based The more effective biometrics-based identification schemes all involve serious identification schemes all involve serious social implications, and can be expected social implications, and can be expected to excite considerable public suspicion to excite considerable public suspicion and even hostility. and even hostility.

CCONCLUSIONSONCLUSIONS

The highest-integrity schemes combine The highest-integrity schemes combine physically intrusive data-collection with a physically intrusive data-collection with a potentially ubiquitous instrument of power.potentially ubiquitous instrument of power.

As a result, the kinds of multi-purpose As a result, the kinds of multi-purpose identification schemes, or inhabitant identification schemes, or inhabitant registration systems, which would appear registration systems, which would appear capable of exciting the greatest degree of capable of exciting the greatest degree of concern are those based on DNA-printing and concern are those based on DNA-printing and implanted chips. implanted chips.