1.6k VIEWS
Pinterest LinkedIn LINE

Regarding the pension number leak, apparently “all leaked numbers will be changed”1. Personally, all I can think is, “Oh dear.” As I wrote in yesterday’s article2, if operated appropriately, leakage of the number itself is not a major risk. Since the names, addresses, and other information leaked with it cannot be changed, changing only the pension number has little meaning.

Conversely, because pension numbers use an old design, changing one may fail to update correctly wherever a corresponding change must be made, and thatmay instead cause harm.

The design of a “number” (it should really be called an identifier, but for convenience I will call it a “number” here) involves various considerations depending on the anticipated form of use. Thus, in one sense, the ideal design for a “number” varies case by case. On the other hand, there are minimum requirements that should always be satisfied.

So let us list those requirements for a “number.”

  1. Create a primary-key identifier, a “personal number.” This is essentially immutable. Because it should not be changed, it is used only to manage internally the “numbers” that are actually used (hereafter, “numbers”). Naturally, it must never leave the system.
  2. A “number” has an issuance date, activation date, suspension date, reactivation date, and retirement date3, and is managed in association with the primary key.
  3. Give the “number” a unique format. For example, the 3th character might be katakana and the 4th character a checksum. This makes it possible, when data leaks, to keep items in that format from appearing in search-engine results.
  4. A “number” has an expiration date4.
  5. A “number” can be changed at any time. The management system has an API for changing it.
  6. When an organization receives a “number,” it presents the “number,” “organization number,” and “organization credential” to an organization-specific number issuance API provided by the number-management organization and obtains the individual’s “organization-specific number.” It immediately discards the original “number”5. Thereafter, the organization uses this “organization-specific number.”
  7. When one organization requests information from another, it obtains a “permission number”6 from an authorization server to retrieve the data and uses it to request the data. The information-providing organization presents this “permission number” to the authorization server, learns whose data it should provide, and provides that data.
  8. As a rule, data is held only by the organization primarily responsible for it. Each organization retrieves and uses it as necessary, then promptly discards it.

That should cover it.

The advantages are as follows:

  1. Even if one organization leaks data, that data cannot be combined with data held by other organizations. In other words, the privacy impact is low, so costs remain low.
  2. Changing the leaking organization’s “organization-specific number” does not affect other organizations, so it can be changed as often as necessary. This also reduces costs.
  3. The leaked data itself can be kept out of search engines and similar services. It is also easy to recover. At present, we cannot even hope for this.7
  4. Because the “number” changes periodically, it is harder to create a “merciless society”8 through cross-temporal record linkage that uses it to connect the past with the present. This also reduces costs.
  5. Since each organization holds only the data for which it is primarily responsible, the privacy impact of a data leak is lower than under the current model, in which every organization holds copies of data.

Why, it is nothing but advantages.

What? “Would this make the system too difficult? It would never work at a scale serving 100 million people!” Nonsense. This is the very mechanism by which the Internet operates. In that world, “100 million people is small-scale.” Of course it will not work if you use a strange architecture9. But a JSON/REST architecture like those used by Google and Facebook will be fine, provided it is designed properly.

Incidentally, the My Number system actually incorporates much of this thinking, including in the information-provision network. The unfortunate point is that the essential “My Number” itself is “immutable in principle”…10. This is probably a political matter; I expect the system technically permits changes. Yes, surely it does.

 

Footnotes

  1. Nobuo Gohara “Is It Really Safe to ‘Change the Leaked Basic Pension Numbers’ and Send Change Notices by Mail?” (2015/6/9), The Huffington Post, http://www.huffingtonpost.jp/nobuo-gohara/nenkin-number_b_7540210.html
  2. Natsuhiko Sakimura, “Is It Dangerous When a ‘Number’ Leaks?” (2015/6/9), @_Nat Zone, http://www.sakimura.org/2015/06/3038/
  3. These should really be recorded at least to the second, not merely the day.
  4. When issuing what seems to be the EU’s most recent eID card, Germany made the “number” the document number. It therefore changes when the card is reissued. This is entirely correct.
  5. This is also essentially how the US Department of Defense guidelines on the use of Social Security numbers work. Incidentally, if even giving the “number” to an organization is considered a risk, the individual can obtain an “organization-specific number” and give that to the organization. SAML NameIdentifiers and OpenID PPIDs work this way. Because it is automated, the individual probably does not notice.
  6. The technical term is an access token.
  7. This fails, of course, if someone maliciously reassigns the “number” to something else.
  8. Natsuhiko Sakimura, “A Merciless Society and Numbering Systems: The Dangers of Record Linkage Seen in Victor Hugo’s Les Misérables” (2010/12/13), @_Nat Zone, http://www.sakimura.org/2010/12/686/ Also published on gihyo.com.
  9. Such as an enterprise XML/SOAP system. Those systems are intended for, at most, around 2 million people. XML-based systems involve too much extraneous data and computation. Serving 100 million people that way would be difficult…
  10. And it is also unfortunate that each organization, such as employers and financial institutions, stores My Number…

Related posts