Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our...
Transcript of Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our...
![Page 1: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/1.jpg)
Identity and Economics: Terrorism and Privacy
Adam Shostack
![Page 2: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/2.jpg)
Victor Lopez-Florez
• An illegal immigrant from El Salvador, waspaid $100 to help Ahmed Alghamdi get areal Virginia ID card.
• Alghamdi was one of the hijackers on UAflight 175.
• Lopez-Florez was convicted on November19, 2001
![Page 3: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/3.jpg)
Overview
• Terrorism and security and ID cards• Economics of ID cards• ID cards and privacy
![Page 4: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/4.jpg)
Trust
• Trust, Trustworthy and Trusted• Trust is the state of accepting a risk from, or
being vulnerable to someone• Trustworthy people behave to reward your
trust• Trusted is someone who is able to violate
the security system
![Page 5: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/5.jpg)
Terrorism
• Terrorism: Use of violence to intimidate andadvance a political purposes
• We would like to be free of such violence• To fight terrorism, our security goals:
– Intelligence– Prevention– Response
• How does ID interact with these goals?
![Page 6: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/6.jpg)
Driver’s License Security:Essential to Homeland Security?
“It may be the only way to stay a step aheadof the counterfeiters and help keep thenation’s skies secure.” (Linda Lewis,AAMVA)
![Page 7: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/7.jpg)
National ID Card:The Ultimate Security Measure
“Most of us already carry severalidentification cards, including a driver'slicense and a Social Security card, so whynot something that's a little more robust?...A card that really proves you are you wouldsimplify transactions and prevent futureapplications from being hindered bysuspicion...”
![Page 8: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/8.jpg)
Evaluating Security Mechanisms
• What problem does the security measure solve?• How well does the security measure solve the
problem?• What other problems does this measure create?• What are the costs of the security measure?• Is it worth doing?
![Page 9: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/9.jpg)
Terror & ID
• Strong constant ID checks may maketerrorist travel & activity harder
• May increase quality of intel• Will increase quantity of data• Huge dragnet, constitutionality problems• Energy misdirected
![Page 10: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/10.jpg)
Terror & ID
• There is a very short list of known terrorists– A few hundred names– Those names are so widely distributed that the
terrorists know they’re on the list– As does everyone named David Nelson– Lots of unknown terrorists– Checking ID does not catch unknown terrorists
![Page 11: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/11.jpg)
National Crusades
• Abortion, Guns, Drugs– Always a supply and demand
• War on Terrorism– No demand curve!– Bringing in economics of ID cards prevents us
from winning
![Page 12: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/12.jpg)
Economics of ID Cards
• Huge market for fake ids (college students,foreign workers)
• ID becoming harder to forge• Transitioning to a huge market for
fraudulent ID• Millions of Lopez-Florezes
![Page 13: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/13.jpg)
New Jersey Press ReleaseApril 21 2003
• “In 2002 ... the State Police arrestedmembers of two major document fraudrings. Since the summer, approximately 200individuals have been arrested for trying toobtain fraudulent identification from theDMV, 15 employees have been faced withcriminal charges, and dozens of others havebeen fired.”
![Page 14: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/14.jpg)
DHS Information BulletinJuly 23 2003
“DHS conducted a survey...”
“...from February to May, hundreds of officialidentification cards, badges, decals,uniforms, and government license plateswere reported stolen or lost.”
“No historical baseline data”
![Page 15: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/15.jpg)
The American IdentityInfrastructure
• The national id card has many uses• Driving, working, flying, drinking, voting• Drives
– Fake ID– Fraudulent ID
• ID cards lead to people being trusted
![Page 16: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/16.jpg)
Breadth of ID use
• Ask any college student– Drinking
• Ask Victor Florez-Lopez, or any otherimmigration specialist– Working
• Renting an apartment, getting a health clubmembership, cell phone, etc
![Page 17: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/17.jpg)
“More secure ID cards”
• Biometrics• Holograms and Microprinting• Online validators• More ID checking• All combine to create a market for issuance
fraud
![Page 18: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/18.jpg)
Economics of Security
• Companies don’t spend on security• Should they spend those resources on
checking IDs?• Companies want the customer’s money• Do they really care if the ID is real?
– Doesn’t that require ignoring that the ID isfake?
![Page 19: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/19.jpg)
Where’s the Birthday?
![Page 20: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/20.jpg)
Motivation to Check ID
• A CBS News undercover investigationtested airport security using a $150 fakedriver's license...The tickets were usedat five different airports in California andNevada. We found that ticket andsecurity agents paid little attention tothe counterfeit driver's license, whichcontained a made-up name andaddress.
![Page 21: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/21.jpg)
Nash Equilibria
• Game theory• Everyone makes rational choices• Suboptimal results are locked-in
![Page 22: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/22.jpg)
Nash Equilibria and ID
• Checking ID as CYA– Entering buildings– Flying– Bars
• Hard to be the first skyscraper to stopwasting people’s time
![Page 23: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/23.jpg)
Privacy and the ID infrastructure
• National ID infrastructure is free to use– No cost to view an ID
• Required to have an ID to live (in practice)• Anyone can ask to see it, copy down data• No cost to company• ID theft costs to citizens• ID is government subsidy for privacy
invasion
![Page 24: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/24.jpg)
Consequences of ID Theft
“Malcolm Byrd was home with his two children on aSaturday night when a knock came at the door.Three Rock County, Wis., sheriff’s officers werethere with a warrant for Byrd’s arrest. Cocainepossession, with intent to distribute, it said. Byrdtried to tell them that they had the wrong man, thatit was a case of mistaken identity, that he was avictim of identity theft. But they wouldn’t listen.Instead they put him in handcuffs and drove himaway. Again.”
![Page 25: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/25.jpg)
Future of ID Theft
• Economics ensure its going to get muchworse
• Arrest records– cost of arrests
• Mortgage theft– cost of mortgages
• Virginia ID Theft passports
![Page 26: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/26.jpg)
Advice to Businesses DesigningSystems
• Consider what an ID gets you• Ask yourself about liabilities
– ID theft– CA disclosure laws– HIPPA, GLB, other laws
![Page 27: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/27.jpg)
DHS encourages...
• “Check multiple forms of valididentification for each facility visitor”
• “Improve ID card technology to eliminatereuse or unauthorized duplication”
• (July 22, “Potential Terrorist Use of OfficialIdentification, Uniforms, or Vehicles”)
![Page 28: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/28.jpg)
Challenge Your Executives
• Does this spending solve our securityproblems?
• What problems does it create for ouremployees?
• Can we talk to our industry association tomove to better measures?
![Page 29: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/29.jpg)
Advice to GovernmentsDesigning Systems
• Everyone checking IDs reduces the value ofID systems where they really matter
• Identity infrastructures and “freeloading”are a bad combination
• If their name is in a database, a terrorists arereally motivated to get fraudulent ID
![Page 30: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/30.jpg)
“Missing Computer Adds toAirport Screeners’ Woes”
• Federal officials are quietly scouring theWashington DC area for a stolen laptopwith information on dozens of airportbaggage and passenger screeners that couldbe used to forge IDs.”
• “We’ve let our screeners know they need tosafeguard their personal information”– (TSA spokeswoman Chris Rhatigan)
![Page 31: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/31.jpg)
Real Advice to Governments
• Legalize teen drinking– Dry up the college student demand
• Legalize immigration– Dry up the working demand
• Do it to save lives
![Page 32: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/32.jpg)
Conclusions
• Problems are economic• Problems are solvable
![Page 33: Identity and Economics: Terrorism and Privacy · 2014. 6. 11. · •To fight terrorism, our security goals: –Intelligence –Prevention ... •There is a very short list of known](https://reader035.fdocuments.net/reader035/viewer/2022071104/5fdd8661a6faeb51e521bbe5/html5/thumbnails/33.jpg)
Adam [email protected]