308 VIEWS
Pinterest LinkedIn LINE

The “Haraguchi 5 Principles on Identification Numbers” have been announced.

Principle 1: The system must protect the rights of citizens

The number is intended to protect citizens’ right to properly receive social security benefits and various government services, and numbers must be assigned without duplication or omission, accurately and securely.

Principle 2: The system must enable people to control their own information, preventing its unauthorized use or storage and allowing it to be reviewed and corrected

People’s own information must not be used or stored improperly, and they must be able to access, review, and correct it (the right to control one’s own information).

Principle 3: The system must use numbers within a clearly defined scope and thoroughly protect privacy

The system must clearly identify which government agencies use a person’s information and for what purposes, take every precaution against information leaks by using the latest encryption technology, and prevent the matching of information across different sectors.

Principle 4: The system must minimize costs and be reliable and efficient

Existing infrastructure must be used effectively to build an efficient system. Cloud-computing methods should also be used to actively promote the shared use of systems within each sector.

Principle 5: The national and local governments must proceed cooperatively

The national and local governments must work together to advance e-government so that better public services can be provided.

Let me comment briefly on each principle.

Principle 1: The system must protect the rights of citizens

The essence of this, I think, is what Minister Haraguchi described as an ID for citizens, rather than an ID for managing citizens. In that sense, the explanation given here appears to address only one part of Principle 1.

That “one part,” however—ensuring there are neither duplicates nor omissions—is surprisingly difficult.

First, there is the question of how accurately births and deaths are recorded.

Even if those records are accurate, linking them to the actual person is difficult.

Japan has no standard that could properly be called an “identity-proofing standard.”

People often say that identity is verified with a driver’s license, but does the person conducting that verification know how to confirm that the license is genuine? Do they verify its authenticity with the issuer? They do not. Because they do not, people can create forged driver’s licenses and fraudulently obtain Basic Resident Registration cards.

New Zealand’s experience is instructive in this regard.

After a pension fraud case came to light—in which someone had impersonated several other people to receive their pensions—New Zealand recognized that its identity-proofing practices had been inadequate and established identity-proofing standards. As a result, identity fraud surfaced all at once. I suspect that serious verification in Japan would likewise uncover considerable fraud.

Consequently, implementing this principle also requires establishing identity-proofing standards.

Principle 2: The system must enable people to control their own information, preventing its unauthorized use or storage and allowing it to be reviewed and corrected

This concerns the so-called right to control one’s own information. To realize this right, there must be a record of where one’s information was provided and under what conditions. Evidence of what the other party promised must also be retained.

OpenID CX (draft) is a protocol designed precisely for this purpose.

OpenID is fundamentally a framework in which a person stores their own information with an OpenID Provider (OP) and supplies it to sites (RPs). Naturally, users can edit the personal information stored with the OP themselves.

CX, an extension specification, handles the record of the conditions under which information was transferred to an RP.

With CX, an organization seeking information specifies the items it wants and the purposes for which they will be used, and then electronically signs the request. The user reviews the conditions and, if they consent, countersigns and returns it. Subsequent exchanges of personal information take place on the basis of this “contract,” signed by both parties. Because the contract remains on the user’s authentication server, it is immediately apparent where the information was provided and under what conditions. The contract also normally specifies interfaces for updating or deleting the information given to the other party, enabling that information to be changed.

Furthermore, if the other party later claims, “We never agreed to such conditions,” bringing this “contract” to court would likely provide strong evidence.

CX is therefore a powerful means of realizing the right to control one’s own information.

Principle 3: The system must use numbers within a clearly defined scope and thoroughly protect privacy

The scope and purpose of use should always be clearly stated, and these will be recorded in the CX “contract.” When data are transferred, they are encrypted using the public key of the recipient specified in the contract, so other organizations cannot read them.

There are 2 measures to prevent record matching.

The first is a mechanism that issues a different “number” for each sector or service. OpenID has a concept called Directed Identity, also known as an OP Identifier. When logging in to the other party’s site, the user specifies only the address of the authentication server they use. (In other words, the user’s own “number” is not communicated to the other site.) Then, when the user logs in at the OP and the resulting authentication “assertion” is returned to the RP, the OP returns a “number” issued only for that RP or sector. This makes record matching impossible.

CX also resolves the problem that electronic signatures can allow records to be matched through certificate information: the OP signs on the user’s behalf.

Principle 4: The system must minimize costs and be reliable and efficient

Under the Obama administration, the U.S. government reversed its previous authentication policy by 180°.

Until then, it had explored a model in which “the government provides citizens with IDs (number + authentication + attributes, etc.).” It acknowledged the failure of that approach and shifted dramatically to a model in which “the government also uses the IDs that citizens already use.” As a result, since March, IDs from Google and other providers have been usable to log in to government websites.

Of course, this does not mean that any ID can be used. The government accepts IDs that meet specified certification criteria. Certification is performed by private nonprofit organizations such as the Open Identity Exchange (OIX), which I also helped establish. OIX devised a certification framework that meets the standards set by ICAM, a subcommittee of the government’s CIO Council. ICAM recognizes that framework; OIX certifies auditors under it; those auditors inspect OPs and submit their findings to OIX; and OIX then certifies the relevant identity provider (OP) based on the results.

A similar arrangement should be possible in Japan, using OpenID and other IDs provided by mobile carriers and others.

Only by using the private sector’s capabilities and resources that already exist can we build a reliable and efficient system at minimal cost.

The government should limit its role to providing various APIs. The private sector is far better at combining services into forms that are easy for users to use. Each task should be left to the specialist. What the government should do is standardize the data formats that private companies need to build services and provide the data through APIs.

It must not, under any circumstances, attempt to build a huge centralized system. Such a system would be nothing more than a new kind of public-works project.

There are many possible API services, but one especially worth mentioning is an “identity-proofing API.” This would serve as a third-party “registry” that private identity providers could use for identity proofing. Similar services are provided in Denmark and New Zealand. Because this is quite difficult for the private sector to provide, I very much hope the government will offer it. I imagine it could make effective use of the Basic Resident Register Network.

Principle 5: The national and local governments must proceed cooperatively

This should go without saying. But there is one point worth noting.

We must abandon the idea of building a national portal.

Denmark is often cited in Japan as a successful example of a citizens’ portal, but within Denmark it is labeled a “major failure.” The words of a Danish government official who spoke to me capture this perfectly:

“A portal is a station. An impressive building stands out, and politicians are pleased because they can report it to voters as an accomplishment. But what really matters is the rails, the trains, and the people who operate them. Unfortunately, Denmark built only the station.”

Japan should avoid repeating that mistake.

What matters is developing protocols and APIs (the rails), preparing data formats (the trains), and putting in place the personnel needed to operate them properly.

2010-03-10 11:30 Addendum

Additional Principle: Disclosure of the History of Identity Information Provision (Access Logs)

On Twitter, Nobutaka Shimada pointed out the importance of making information access visible and disclosing access logs. I believe he is absolutely right.

Perhaps after seeing this exchange, Minister Haraguchi added another principle: the “Principle of Disclosing the History of Identity Information Provision (Access Logs)”.

Not only for identity proofing, records should be kept of “when, where, by whom, and for what purpose” personal information was accessed. Furthermore, because it is unrealistic to expect individuals to visit disparate systems to view those records, I believe the records should be sent as ActivityStreams to a location designated by the user, like a Twitter timeline. What cannot be observed cannot be controlled. I sincerely hope this becomes a reality.

Related posts