258 VIEWS
Pinterest LinkedIn LINE

The other day, while talking with Professor Suzuki of Niigata University, we agreed that media interviews really are difficult. This was our reaction after seeing an article in the 2010/12/22 issue of Nikkei Computer. Professor Suzuki said, “I was made out to be an ardent advocate of the number, lol,” while I was made out to be “an advocate of biometric authentication and an opponent of the number, lol.”

People who know me well probably wondered, “Wait, was Sakimura an advocate of biometric authentication?” Of course, I am a staunch opponent of online biometric authentication. This is not a recent position: I have publicly opposed it since 1997. Wondering where things became distorted, I suspect it may have stemmed either from my saying that, when establishing someone’s identity to open a bank account or the like, identity has not really been verified unless the credential carries biometric information such as a photograph, or from my saying that connecting a living person to the resident register, an “existence-verification database,” requires a “credential” that links biometric information such as a photograph or signature to the key in that database. Offline and online requirements are completely different, but listeners do not have that level of resolution, so the distinction is lost. Speaking clearly is truly difficult.

So today I would like to examine the parts of the article attributed to me.

“He points out that he cannot support the policy of using only IC cards for identity authentication, because of implementation costs and convenience. This is because an IC card reader would be required. ‘If people could also choose authentication methods such as passwords or biometrics, implementation costs would fall and convenience for citizens would improve.’ (Senior Researcher Sakimura) (p. 69)”

Assuming that proper identity proofing has been conducted, there is no doubt that IC cards provide a high level of security. However, implementing support for them is neither simple nor inexpensive. This would be a particular problem for households and small businesses. In practical terms, not every government service requires such a high security level. It is therefore important to let users select an authentication method at the appropriate level, increasing convenience and reducing costs.
On the other hand, for in-person identity verification at a service counter, it will not always be possible to have an authentication system with a connected IC card reader. In that case, identity must be verified using the face of an identity document, which requires biometric information such as a photograph or handwritten signature. For example, even if a “number” has been issued, merely presenting the “number” does not verify anything.
I suppose the quotation above resulted from condensing a discussion like that. Speaking clearly is truly difficult.

Senior Researcher Sakimura believes that “issuing a new number based on the Basic Resident Registration Code,” which is currently under consideration, will be difficult. (P. 71)

Issuing a new number is not difficult. What is difficult is delivering it accurately to the person and, when that person uses the number, enabling the receiving institution to confirm that the person attempting to exercise it is the actual person rather than someone else. Yet it was summarized as above. That makes it sound as though I am saying that issuing numbers itself is difficult.

This is because he considers that “the Basic Resident Registration Code can be changed at a citizen’s request, and information linked to it, such as an address, can also be changed. It cannot be regarded as identity-verified information.” (P. 71)

I cannot quite imagine how the discussion turned into that. What I said was that, until a few years ago, information in the Basic Resident Register was accepted based on applications without even requiring presentation of an identity document, so internationally it would probably be difficult for it to be recognized as identity-verified information.

However, if a new number were issued to every citizen only after rigorous identity proofing, “it could not be done in 3 to 4 years” (Senior Researcher Sakimura). If the number system begins operating around 2014, that would be too late.

This is correct. Even in South Korea and Germany, where identity proofing had already been completed, distributing ID cards has been a major undertaking lasting 5 to 10 years. It would not be surprising if doing this in Japan, where identity proofing has not been completed as described above, took even longer. When the point is this simple, it seems it can be reported accurately.

Senior Researcher Sakimura therefore points out that “we should initially proceed by a method that does not issue new numbers” (Figure 5).

I did not say that new numbers should not be issued (they should be issued steadily over 5 to 10 years!); I said the method should not depend on the number. But the article came out this way. With a number-dependent method, the service cannot begin until everyone has received a number. Instead, the system should allow services to be provided even without a number and then migrate gradually; otherwise, would it not be impossible to launch in 2014? That was my point.
Another point I made was that databases already exist for each program and individuals are registered in each one, but integrating them requires matching each person across the databases. Even if a “common number” is assigned to every individual in each database, one must first identify the person in the database, match that person with the holder of the common number, and then assign the common number to the person in the database. Ultimately, are the basic 4 pieces of information not the only keys available for this? If so, we must discuss how to do this efficiently. Since the matches will not be exact, the individuals themselves must be involved in the matching. (Recall the special pension notices.) Yet it would be impossible to spend as much on every program as was spent addressing the pension-record problem, so a good method must be devised, but almost nothing has been said about that. I believe I mentioned this as well. Efficient processing should use not only addresses, a means of contact dating back 100 years, but also electronic means such as email. Yet Japan currently has no system for registering such information with the government. Whether this means expanding the Basic Resident Register or building something alongside it, it would be more efficient first to establish registries of electronic contact methods (such as email) and electronic payment methods (such as account numbers), and then proceed all at once. That may not have come across clearly.

For the ID used to log in, “an ID issued by a private-sector identity provider should be used” (P. 72).

I honestly believe this. After all, no country has successfully used government-issued IDs online. (Even South Korea, which is often cited, uses IDs issued by 5 accredited private providers. Moreover, their identity-proofing level is far lower than that of Japan’s specified certification service providers. This is one major reason for their widespread adoption.) A government-issued identity document is best positioned as a document used to raise the identity-proofing level of a private-sector ID. I think such private-sector credential information should be registered in the government registry together with email addresses and the other information mentioned above.

Senior Researcher Sakimura says, “The assignment of new numbers can proceed over a sufficient period after the number system begins.” (P. 72)

This refers to the point above about “starting the system without depending on the number and then spreading the number gradually.” But it certainly does not read that way, does it?

That concludes my part, but this really is extraordinarily difficult. I need to practice explaining things more holistically. When I try to be precise and talk about the details, the discussion becomes fragmented and the meaning changes. These days I remind myself that, even at the expense of precision, I must speak so that the overall thrust is conveyed correctly.

P.S. Could we also do something about the fact that saying, “There is no need to create a new number; just use the Basic Resident Registration Code—it is well designed,” gets me labeled an opponent of the number?

Related posts