Protecting identity is critical and is only going to become more important as time goes on, says former U.S. Department of Homeland Security Sec. Michael Chertoff.

In a speech at the University of Southern California National Center for Risk & Economic Analysis of Terrorism Events in August, Chertoff talked about how important identity can be.

“It lies at the core of a great deal of what we do protecting our financial security, our personal security, and our reputational security,” Chertoff said. “And what I’m referring to is how we manage and protect our personal identities because I’m going to submit to you that in the 21st Century, the most important asset that we have to protect as individuals and as part of our nation is the control of our identity, who we are, how we identify ourselves, whether other people are permitted to masquerade and pretend to be us, and thereby damage our livelihood, damage our assets, damage our reputation, damage our standing in our community.”

Identification online is also becoming important as more business is transacted over the Web. “Identity, more and more particularly with the use of the Internet for purposes of transacting business, lies at the heart of our entire financial and market system,” Chertoff says. “If we don’t know who you are, if we don’t know whether you are accurately representing your assets and your intentions over the Internet or even transacting business face to face, we introduce an element of risk into that business model.”

This eventually could impact the economy. “The entirety of our economic livelihood in the 21st Century is going to turn in large measure upon our ability to verify identity for those who want to transact business, and, finally, our reputation and our privacy depends on our ability to control our identity. If people can pretend to be us, if they can speak in our name in an unauthorized way, they can do great, perhaps irreversible, damage to our privacy or to our reputation and this again from a personal standpoint suggests that identity is increasingly going to become the asset that we have to be most careful to protect in the 21st Century where the ability to get information, move it around the world and store it indefinitely creates greater and greater risks to personal reputation and personal privacy.”

Chertoff gave some examples where identity theft-related issues have caused individuals and companies trouble. Illegal aliens making up Social Security numbers and working in the country illegally have caused problems. He cited one individual who received a letter from the IRS regarding $18,000 in unreported income.

“This person, however, had never worked in the company in question,” Chertoff said. “In fact, the company was on the other side of the country in North Carolina, and all of a sudden, they had an IRS problem that they had to clear up. So they hired a lawyer. They wanted to try to fix it. They kept getting more and more letters from the IRS. They had to try to contact authorities, this is in 2003 and 2004, to see if something could put an end to this individual who was impersonating the Californian and continuing to earn money, but, of course, it was the Californian who was being asked to pay the taxes.”

Chertoff says authenticating identity in different scenarios is going to become necessary. How do we know who people are online? He points to the Social Security number, passport and driver license as ways individuals are identified now, but there needs to be more.

“I like to say that the issue of identity authentication, determining that you are in fact the person you claim to be, really rests potentially on what I call the three Ds: description, device, and digit.”

Description is a piece of information known only by the individual. Device, in today’s world, would most likely be some type of card, but it can refer to other things as well. “A cell phone could be used as an identification device,” Chertoff says.
As for digit, Chertoff says fingerprint biometrics are the third factor. “Your digit is unique. Your fingerprint is unique and the ability to use that as an identifier, as we do, for example, throughout the criminal justice system, gives us a third powerful tool that we can use in order to make sure that we can separate real people from impersonators.”

The future is using all three of these “Ds” together to authenticate identity. “The way forward is to work with all of these tools in combination, to take the ability to use some descriptive information, like a PIN, or some private information, a device like a card or perhaps a cell phone or other electronic device, perhaps with a token, and a biometric, like a digit which is easily used and concurrently be captured on a whole host of mobile devices, to combine these together, and I can envision a time in the not-too-distant future where, in order to authenticate yourself, whether it’s for purposes of getting on an airplane, whether it’s for purposes of transacting business at a bank, whether it’s for purposes of gaining entry into a student dormitory, that you will have some kind of device; it may be electronic, that will combine two or three of these three Ds, as I call them, to increase the ability to be secure in the knowledge that nobody else can duplicate your ability to identify yourself.”

The solution may not be perfect, but it’s better than what exists now, Chertoff says.

“There will be some people who will be so good that … they’ll steal your device, they’ll find a way to get your fingerprint and fabricate it and then they’ll somehow ferret out the piece of information and having assembled all these things, they’ll be able to impersonate you.” Chertoff says

“But, you know, nothing is perfect. If the test of any movement forward in a system were that the new system has to be perfect, we wouldn’t have airbags in automobiles. After all, the airbag is not perfect. If you run headlong into an 18-wheel tractor-trailer, that airbag is not going to help you. But in a lot of accidents, it will help you. So I’m arguing this is a 99% solution and in real life that’s a very good solution.”

---

Related articles:

Giving the user control of online identity What is an identity ecosystem? The Mobile ID Experiment