Emergent Chaos

Saving the Taxpayers Money

The Washington Times reports, "Outsourced passports netting govt. profits, risking national security." It is the first of a three-parter.

Interesting comments:

The United States has outsourced the manufacturing of its electronic passports to overseas companies — including one in Thailand that was victimized by Chinese espionage — raising concerns that cost savings are being put ahead of national security, an investigation by The Washington Times has found.

The Government Printing Office's decision to export the work has proved lucrative, allowing the agency to book more than $100 million in recent profits by charging the State Department more money for blank passports than it actually costs to make them, according to interviews with federal officials and documents obtained by The Times.

The GPO tells us we don't need to worry, because the blanks are moved by armored car. I feel better already, but can't stop giggling.

Because RealID Isn't Good Enough

Apparently we need not one, but two national ID cards. Illinois Reps. Mark Kirk and Peter Roskam (may they not get re-elected in November) are introducing legislation that would mandate that Social Security cards have "a photograph and fingerprint, as well as a computer chip, bar code and magnetic strip."

The cards would be modeled after the Common Access Card issued by the Department of Defense, mostly to active military reserve members and their dependents, said U.S. Rep. Mark Kirk (R-Ill.), a sponsor of the bill. Current Social Security cards have limited security features and have no photo or biometric data, he said.

Perhaps Mr Kirk, should refresh his memory on the purpose of Social Security cards. There's a reason that they prominently say "FOR SOCIAL SECURITY PURPOSES * NOT FOR IDENTIFICATION" across the front of them.,

"One of the ways that modern criminals use to attack ... is by falsifying or counterfeiting Social Security cards," Kirk said. "We think that a Social Security card should be hard to forge [and] that it should also make it easy to catch an identity-theft crime."

This sounds all well and good but it's just patently false. This is actually an attack on illegal immigration. The only main people are asked to show Social Security cards is for jobs and the main market for falsified or forged is for illegal immigrants to get jobs. Identity thieves don't forge social security cards, all they need is the number itself. Shame on the Tribune for not digging deeper.

[Image from the above linked Tribune article]

Australia dumps National ID

Opponents of Australia's controversial Access Card received an early Christmas present earlier this month when the incoming Rudd Labor Government finally axed the controversial ID program. Had it been implemented, the Access Card program would have required Australians to present the smart card anytime they dealt with certain federal departments, including Medicare, Centrelink, the Child Support Agency, or Veterans' Affairs. ("Australia's controversial national ID program hits the dumpster," Ars Technica)

Congratulations to the people of Australia. Now let's hope the UK and US pick up on a winning trend.

Picture by Drewsta.

Paddigton Bear, Illegal Immigrant

In the new book [Paddington] bear, who arrived in the country as a stowaway, is interviewed about his right to stay in England.

He has no papers to prove his identity as his Aunt Lucy arranged for him to hide on a ship's lifeboat from Peru when she went to live in the Home for Retired Bears in Lima.

See "Paddington Bear's birthday book" at the BBC for more.

Sammer at Officer Candidate School

Those of you who don't know Sameer Parekh can ignore this message. For those of you who do, he's joined the Marines and is attending Officer Candidate School, and would appreciate your letters:

He does not have access to email or phone. Please send him snail mail (US mail) as often as you can. He will reply whenever he can from his OCS training. Your letters would be a good morale booster for him. Please address the mail exactly as shown below-

Candidiate: Parekh, Sameer, G /2263
Officer Candidate School, A Company, 2 Platton
2189 Elrod Avenue
Quantico, Virginia 22134-5033

Fake Steve and Real Mackey

So with the small, literal men at the New York Times poking through the veil of anonymity that allowed Fake Steve to produce the best blog since "The Darth Side," we have a serious threat to the stability of the republic, which is the false hope that by assigning people names, we can control them. Prevent the random, the funny, the disrespectful. The powerful have always hated having fun poked at them by the anonymous. They forget that anonymity acts as an important social valve, allowing people to share ideas without retribution.

John Mackey took a different approach. He didn't blog, but engaged in conversation on a message board about his company.

I think it's a good thing to be able to hear from CEOs shedding their spin, from journalists freed of their need for access, and everyone else who wants to put forth their own words to stand or disappear on their own strength.

Fake Steve is a little less interesting since the unveiling. The posts about immortality were a nice touch, but, I thought, over-wrought.

Stop Real ID, again

Apparently, the forces of evil have inserted themselves a national ID clause into the immigration bill (two bad bills, risen from the dead together?)

Please go to Unreal ID's action page to send a fax. It only takes a minute.

Global Biometrics Database, Coming to Soon to You

Raiders News Network quotes an Interpol press release, "G8 Give Green Light For Global Biometric Database:"

MUNICH, Germany – G8 Justice and Interior Ministers today endorsed a range of vital policing tools proposed by Interpol Secretary General Ronald K. Noble aimed at enhancing global security.

Secretary General Noble exposed the global problem of prison escapes of terrorists and other dangerous criminals not being promptly and adequately reported to police worldwide, thereby placing the citizens of all countries potentially at risk.

...

'Moreover, the absence of a global protocol on sharing vital information such as fingerprints and photographs of escaped prisoners, including terrorists, constitutes a serious threat to the safety and security of citizens worldwide,' he added.

Note the subtle use of the terrorist card. Note the utter lack of any mention of privacy, wrongful convictions, or the reality that refuseniks and dissidents will end up in the database, harrassed when they show up in other countries.

Don't worry, your national ID registers won't be checked against the database until computer power becomes a lot cheaper.

Federal Computer Week on SSN Purges

There's an article in Federal Computer Week explaining that "Agencies face SSN scrubdown." We mentioned this last week in "White House Data Breach Prevention Guidelines." I am pleasantly surprised to learn that some data actually will be be declared 'unnecessary:'

Agencies can eliminate some SSN uses by asking employees not to write their SSNs on leave application forms, Howell said. NBC also is modifying its time and attendance system to eliminate the use of SSNs...Like USDA, Interior has a head start on scrubbing its databases of unnecessary SSNs. Interior’s National Business Center, which handles many of the department’s major applications containing sensitive information, is able to mask or block the display of SSNs on reports and computer screens, said Interior CIO Mike Howell.

It remains to be seen how much data will be scrubbed. There's also an interesting linguistic tidbit: the article flips between and and or, as in "only as authorized by law and as necessary to carry out agency responsibilities" and "Do we have to have information for a legal or procedural reason."

As any programmer can tell you, there's a world of difference between those two sentences.

Article pointer via Pogo Was Right. Photo, "Social Aptitude," by ms. boomer.

Stop Real ID

So I was a little curt in my bloviation the other day about the REAL ID forum. There's good people doing real work to stop this thing, and they deserve your help and support. Over 40 organizations representing transpartisan, nonpartisan, privacy, consumer, civil liberty, civil rights, and immigrant organizations have joined to launch a national campaign to solicit public comments on Real ID before the May 8 deadline ... no matter what your political persuasion or individual perspective, you're likely to find somebody there you agree with. See http://www.privacycoalition.org/stoprealid/ for more information.

To keep up with what else is going on with Real ID, subscribe to http://stoprealidnow.blogspot.com

DHS Sends a Flunky to Do A Man's Job

So DHS has managed to cancel all but one "Town Hall Meeting" about REAL ID. They're sending a "Richard Barth, Assistant Secretary, Office of Policy Development" to talk to the fine people of San Francisco about the travesty of a national ID card which is REAL ID.

We'll waste $20 billion dollars on this nonsense, and it won't make us any safer.

What more do you expect from the Bush administration?

I'd write something rational and balanced, but the other side sure doesn't, so why bother?

How Long To Be Identified?

Today I spent nine (9) (no, that’s not a typo) hours in line to apply for a passport.

What happened was, since the U.S. changed the rules to say everyone’s gotta have a passport, a lot of Americans and Canadians who were used to going back and forth between the countries suddenly needed passports, and the systems are buckling under the strain. (Hmm... I wonder if Mexico’s is as well?)

My passport’s good till July, but I’m traveling a whole bunch and don’t have much time here in Vancouver. Last Monday, April 3rd, was the start of two no-international-travel weeks. I’d heard about the line-ups but had no idea, so I went down there after lunch and got in front of a human being by 3:30. She sent me away because I was applying for an expedited passport but hadn’t brought documents to prove I was traveling. When I told people this story they were astounded, saying the only way to be sure of getting in on any given day was to be waiting at 6AM when the building doors opened. So writes Tim Bray in "Passport Hell." I figure that if a day's time is worth $100, and every Canadian needs to get a passport to enter the US, this will cost the 30 million people of Canada $3 billion. That's ignoring the roughly $100 cost of each passport (total, $6 billion), and the $100 is just about minimum wage for a day. Still, it seems an awful lot to pay to make Canadians all have more bits of identification.

The photo is of Japanese Americans waiting in line, courtesy of the US government. It's from "Camp Harmony" exhibit at UW Libraries.

[Update: clarified writing around estimates.]

[Update 2: Yoshi, in comments, calls my use of the original photo here insenstive and offensive. See the comments for my thinking, and I've moved the photo out of the post so as not to be offensive. Apologies to those who were offended.]

Stop REAL-ID From Wasting Real Money and Liberty

Welcome to the Stop Real ID Now blog. Not surprisingly, we'll be talking a lot here about the Real ID Act of 2005... and more specifically about an activism campaign that will use the power of blogs, social networks and art as well as creating partnerships and using media outreach to, we hope, stop the Real ID Act in its tracks. To stop it, however, we need you... and lots of "yous"... to help out.

http://stoprealidnow.blogspot.com/

"Voluntary" ID Cards

Anybody who objects to their personal details going on the new "Big Brother" ID cards database will be banned from having a passport.

James Hall, the official in charge of the supposedly-voluntary scheme, said the Government would allow people to opt out - but in return they must "forgo the ability" to have a travel document.

With one in every eight people saying they will refuse to sign-up, up to five million adults could effectively be refused permission to leave the country.

So reports the Daily Mail in "Don't like ID cards? Hand over your passport." I have two brief comments:

First, that's not an "ability," Mr Hall, it's a human right, covered in things like the UN declaration of human rights. Your government used to criticize the Soviets for not allowing their serfs to travel.

Second, all non-trivial privacy fears come true--many are enumerated in the Daily Mail story, so I won't re-hash.

No RFID In Real ID

So DHS finally released the proposed new standard for drivers licenses as mandated under the Real ID Act. It's a rather long document (over 150 pages) so I haven't had a chance to read the whole thing but 27B Stroke 6 has some highlights, including:

While some expected Homeland Security to require the licenses to have smart cards or RFID chips, DHS instead proposes a 2D bar code (magnetic stripe) similiar to those used on many licenses. That information will not be encrypted.

The FAQ (also linked to by 27 B Stroke 6) goes into more depth about both of the above facts, saying:

The regulations propose the use of the 2-D barcode already used by 46 jurisdictions (45 States and the District of Columbia). DHS leans towards encrypting the data on the barcode as a privacy protection and requests comments on how to proceed given operational considerations.

I can't begin to describe how happy I am to hear that RFID is not part of the proposed new standard. It is delightful to see that our objections have been heard and that we will be protected from proximity based attacks. I'm sure it doesn't hurt that 45 of the states and Washington DC already use 2D barcodes, thus making that portion of the standards much more palatable and reducing the costs in that realm.

It's "privacy," Jim, but not as we know it.

The Canadian Privacy Commissioner has issued a number of new rulings, essentially ruling that anyone in Canada can request an ID card whenever they want. The first, summarized by Michael Geist in "Privacy Commissioner on Domain Name Registrant ID Requirements" says:

requirements of personal identification, such as a driver's license, in order to change the administrative email address for a domain name registration...was reasonable.

Which is odd, because my drivers license doesn't contain my email address. Also odd is the idea, in a second case "PIPEDA Case Summary #361, Retailer requires photo identification to exchange an item" that "The investigation established that the information from the piece of identification is not recorded at this store." Except in the paragraphs prior, they found that:

The store’s purpose for collecting the customer’s name, address and telephone number is to protect against fraud and error in order to protect its customers and business. It asks for photo identification in order to verify that the information provided by the customer is accurate.

So...information is taken down, and verified against the card, but not taken from the card. Would things be any different if they copied the information directly from the card?

It seems to me that these decisions are a great blow to privacy in Canada, essentially nullifying the common law tradition of being able to use whatever name one wants to use in one's day to day business.

Remember, all non-trivial privacy fears come true. I'm confident that there were claims that drivers licenses won't be needed for normal everyday life, and privacy advocates predicted this.

Akaka-Sununu Bill Repeals Key Aspects Of The Real ID Act

Daniel Akaka and John Sununu have introduced a bill to repeal title II of the Real ID Act. From the press release:

The Identification Security Enhancement Act (S. 4117) replaces REAL ID with language from the Intelligence Reform and Terrorism Prevention Act of 2004 (P.L. 108-458), which took a more measured approach in mandating tougher standards for drivers' licenses and identification cards by requiring that the new guidelines be developed by a shared rulemaking process that would involve all key stakeholders, including state governments and privacy experts.

It's really great to see some bi-partisan support for our rights for a change. I particularly like the fact that both state governments and privacy experts will be involved. It gives me hope that should this bill pass we'll actually end up with something sane.

[Via EFF: Deep Links]

Small Bits of Chaos

• Michael Giest is covering Canadian Parliamentary hearings over that country's privacy law in "PIPEDA Hearings - Day 01 (Industry Canada)" "PIPEDA Hearings - Day 02 (B.C. Privacy Experts)"
• Bakelblog vents about the petty tyranny of immigration bureaucrats in "Welcome to America, Fuckwads!"
• Alec Muffet has interesting and detailed comments about the broken security of the Apple store at "Easy AppleID Password & Account Theft."
• Bruce Schneier points out that EPIC has gotten ahold of documents that show that "RFID Passports are less reliable than traditional passports." So let's see: less reliable, less secure, less private and more expensive. What's not to love?
• Sameer Parekh points to a story about the elimination of traffic controls, and asks what emerges from chaos in "No More Traffic Controls."

The Kristian Von Hornsleth of the Blogosphere?

Apparently, artist Kristian Von Hornsleth has been paying Ugandans to rename themselves Hornsleth, as a way of drawing attention to aid failures. His exhibit is sub-titled "We want to help you, but we want to own you."

I think it's brilliant. Regular readers know that we talk a lot about identity, id cards, and economics. So this is an art project that really touches me, and I'd like to participate. Mr. Hornsleth, will you donate one extra animal if I rename this blog the Kristian Von Hornsleth of the blogosphere for a week?

Via the BBC, "Storm over 'pig-for-name' artist." To the racism question that leads the beeb story, I think that the racial overtones are cleverly used by the artist to draw attention to a very real problem of ineffective aid.

On Printing Boarding Passes, Christopher Soghoian-style.

Yesterday, I blogged about Christopher Soghoian's print your own boarding pass tool. Quite a few people (including the FBI) are taking the wrong lesson from this. Wrong lessons include "we shouldn't be allowed to print boarding passes," "we should check ID at the gate," and "Christopher Soghoian should be arrested."

The right lesson is that the TSA is putting us all through a silly wringer based on an ID system they know is so porous as to be irrelevant. Much like they did with the "imminent threat" of "liquid bombs" wherein alleged conspirators didn't have passports, the powers that be are responding with theater, rather than saying "it doesn't matter."

If we wanted useful screening, we would screen passengers at the door of the plane, like they do in, say, the Czech republic. It's too expensive. We might consider more air marshals. It's too expensive. Removing a line of seats, and making the flight deck a larger area, with a sealed off washroom and kitchen. It's too expensive. And frankly, there are much better ways to spend our money, including leaving it in the hands of the taxpayers. I digress.

There's nothing in the print your own boarding pass that needs fixing, except bad and expensive theater. Let's fix the problem by admitting that ID checking does no good, rather than acting all shocked at the power of a good demo.