IDaaS

Identity as a Service poised for run in enterprise (ZDNet)

Identity and Access as a Service is poised for a strong run at enterprises of all size, and those who have done their homework will dodge the hype and know what's right for them and what's not.

By the end of 2015, Identity and Access as a Service (IDaaS) will account for 25% of all new identity and access management sales, compared with 5% in 2012, according to recent Gartner research "Are You and the IDaaS Market Ready for Each Other?" [ed. link in orig]

Uganda President: Biometric voter verification for 2016

Museveni approves thumbprint use in 2016 (Daily Monitor)

“In future, all that [multiple voting] will stop. We are importing machines for thumb printing in 2016. We shall use thumbprints to know who this is and if you try to steal, the machine will throw you out,” Mr Museveni is quoted in a State House statement [ed. Yoweri Museveni is the president of Uganda].

Mr Museveni’s announcement comes weeks after the Electoral Commission (EC) released a roadmap to guide political parties and voters ahead of the 2016 polls which did not feature the use of thumbprint machines.

Uganda

The article's commenters aren't optimistic.

Tanzania: Biometric voter registration without biometric verification at the polls

Tanzania: BVR Is for Voter Registration, Not Voting, Says NEC (All Africa)

NEC Vice-Chairman Judge (retired) Hamid Mahmoud Hamid clarified that people should take note of the fact that the system will only be used for registering voters and not for voting purposes. The commission's Head of PNVR and ICT, Dr Sisti Cariah, said NEC will collaborate with the National Identification Authority (NIDA) to reduce costs since the latter is currently doing the same in its national identification project.

Tanzania

Here's a piece, slightly edited, that we posted when initially it was reported that Ghana would forego biometric voter verification. Ultimately, Ghana decided to go for biometric voter verification, and despite some imperfections and a simmering dispute among political parties, they seem to have pulled it off. The same issues apply to the Tanzania voting infrastructure.

Originally posted May 15, 2012:

Without biometric verification, the whole enrollment exercise turns on the ID document. A document-dependent electoral system can be successful if three conditions are met: The process whereby legitimate documents are issued is very rigorous; The document is extremely difficult to counterfeit; And there is no significant corruption of the ballot-stuffing or ballot destroying variety.

Rigor in the document creation would include such measures as a real-time biometric query against the database of registered voters before issuing a new registration card in order to prevent duplicate registrations. Making a document difficult to forge involves high tech printing techniques or embedded biometrics for later verification. The corruption part is a function of culture and institutional controls.

Avoiding over-reliance on the physical ID document is perhaps the greatest benefit of using biometrics in elections. If there is no biometric voter verification, the only voting requirement is to have a more-or-less convincing registration card with a more-or-less convincing photo on it.

Biometric verification, by making the finger rather than the paper the overriding criterion for receiving a blank ballot, confers two tremendous advantages. Multiple voting can be made extremely difficult even for people who have multiple government issued registration cards. Second, ballot stuffing can be curbed because an audit of the total number of votes recorded can be compared to the number of fingerprints verified on election day as legitimate voters.

By creating the perception that the electoral apparatus is more effective than it really is, implementing a biometric voter enrollment system without biometric voter verification could even lead to more electoral uncertainty than the system being replaced.

A well-thought-out biometric voting system can reduce fraudulent voting to very low levels but it's also possible to spend a lot of money on a leaky system that involves biometrics without accomplishing much in the way improving the integrity of the vote.

The same sort of analysis can, and should be applied in Tanzania.

How I learned to quit worrying and love the password

Even in a world saturated with biometric ID management applications, Username/Password verification will still be around.

For one thing, there is no logical limit to the number of password hoops users can be made to jump through, with increasing ID confidence with each consecutive correct answer. The web site for one financial services company I use asks for four pieces of information before allowing me to access the account:

• user name (a sort-of password)
• password
• PIN (really just a shorter password)
• (and since I have cookies pretty well locked down on my most-favored browser and haven't bothered to create some sort of exception) one of a menu of security questions is asked every time I log on.

Even though the human representatives employed by this company are uniformly delightful, efficient, and helpful individuals any number of other ID steps could be added to the process before I shunned the web site. After all, the ID steps on the phone with the call center are no less rigorous.

For another, people aren't the only things that claim an identity before accessing IT systems — computers do it, too, and they don't have biometrics. Passwords are also a cheap, well-understood, flexible technology that supports certain access control models that biometric techniques don't.

The challenge that system-designers interested in biometrics now face is to identify where using Username/Password is too risky (or piling them up, too cumbersome), and where biometrics can be used to reduce risk to an acceptable level. This requires identifying everything currently authenticated with a Username/Password and a determining which of these things are more efficiently protected using biometric authentication, then implementing the change. This is far easier said than done.

For starters, and we've been banging this drum for a long time, it's a really good idea to require biometrics for access to tables of stored usernames and passwords. The long and short of it, however, is that passwords are going to be around for a long, long time.

As long as that's the case, it's good to know a little more about how passwords work as a technology and the following article is a great resource.

Passwords: How to choose one and why we need them (PHYS ORG)

Perhaps it is because they are so ubiquitous that we take them for granted without ever really understanding how they work. Passwords are an example using of something you know to prove your identity. In security circles it is often said the way we prove our identity falls into three categories:

• something you have, such as a bank card
• something you are, such as some form of biometric such as a photograph of the user, fingerprint or iris scan
• something you know, with passwords being the most common example

What are passwords really made of?

Well-designed password systems never store passwords directly. What's stored instead is

• the hash – a cryptographic function that takes a sequence of characters or numbers and generates a sequence based on it
• the salt – some additional characters which do not form part of the password, but are added during encryption to make it harder for hackers to hack password files

The output of a hash function tells you very little about its input so is very difficult to reverse. It takes vastly more computation to reverse a hash value than it takes to calculate it. When a password is entered into a system, the hash of the password and any salt value is calculated and compared with the stored value.

Read the whole thing. It's quite good, ending with two points upon which the author and I are in complete agreement: There is nothing as cheap and as well understood as passwords. They are likely to be around a while yet.

Like any other technology, there's a right way and a wrong way to use passwords. If you get to know them, when to use them, how to use them properly, and the techniques used to undermine them, your relationship with the password can be a long and happy one.

See also:
Why passwords are great;
More on the awesomeness of passwords;
Coopetition: Biometrics and Passwords and
Biometrics, passwords & the Illinois water plant hack attack

Tangentially related...

UPDATE: Government lab demonstrates stealth quantum security project (GIGAOM)

Quantum cryptography is supposed to be a kind of holy grail solution for securing the smart grid, cloud computing, and other sensitive networked resources. The technology is still experimental, with only a handful of companies globally providing quantum key distribution services. Now, researchers at Los Alamos National Lab have quietly revealed that they’ve successfully been running what amounts to a mini quantum internet for the past two-and-a-half years.

The basic premise of keeping information secret using quantum mechanical phenomena lies in what is popularly called the observer effect. A quantum message, sent as photons, will be permanently altered if someone observes it, so the sender and recipient will be able to tell if there was a breach.

U.S. Citizenship and Immigration Services adopting biometric verification in field offices

Biometric Data Will Be Collected At Immigration Offices Starting In May (Fox News Latino)

The U.S. Citizenship and Immigration Services (USCIS), the arm of Homeland Security that handles such things as naturalization and permanent residency, or “green cards,” announced Monday that next month it would implement the Customer Identity Verification, or CIV, at its field offices.

The new system will require people to submit biometric data such as fingerprints and photographs, as well as government-issued documentation, when going to immigration offices to conduct business.

Identities will be verified before services are preformed. This is different than simply collecting and warehousing the information. Both law enforcement and identity protection implications are discussed in the brief article.

Who would handle the verification end of a US biometric ID system?

Bruce Kennedy at MSN Money does a good job documenting some challenges associated with a national biometric ID in the United States in Should the US have a national biometric ID card?

Appropriately, cost, culture and the mechanics of a possible future system are addressed.
But because biometric enrollment without biometric verification is a half-measure, the thing that really caught my eye was the part about how the verification end of a theoretical future biometric ID system might work.

Should a biometric ID card become a reality, Haag envisions a new micro-market emerging, of companies creating portable employee-verificatio​n systems that would offer their services to other businesses. "Something along the lines of...these trucks driving around now that do all the shredding that guarantee all of your sensitive documents will be 100% shredded," he says. "I think it would be cost-prohibitive for small business to acquire and maintain the hardware and the software necessary to do it themselves."

Haag's vision of mobile verification is interesting. We've touched on two other possibilities, neither of which depends strictly upon a national system, in the past in:

The Post Office, Identity Assurance & Biometrics
ID Entrepreneurs: Criminal Background Checks

If you only have time for one of the two, the Post Office one is the way to go.

Praise for Ghana's recent elections

We Should Learn From Ghana Experience (PM News)

"Having been based in Ghana as the Nigeria High Commissioner for four years, going back for the last election was an added value to my trip, in the sense that I can confidently say that their last election where I was an observer, was an improvement on what transpired during the previous presidential and parliamentary election in Ghana.

The introduction of the biometric data-based machine actually assisted in terms of verifying and authenticating the voters and orderliness despite the huge turn out. The orderliness demonstrated by Ghanians was highly commendable."

If I recall correctly (and unlike the recent Ghanaian elections), the last Nigerian elections featured biometric registration but not biometric voter verification. That recollection is supported here, where a Nigerian official expresses hope for 100% biometric voter authentication by 2015, and later in the interview.

More at the link.

The point of biometric voter verification

Isn't that the point?

"Some voters could not exercise their franchise because the verification device rejected them even though they were in possession of their voter's ID card and their names were in the register." (Peace FM)

How about...?

Some prospective voters could not exercise the franchise because the verification device rejected them even though they were in possession of a voter's ID card and their names were in the register. 

...which is precisely the point of biometric voter verification. Entities that have adopted biometric verification have implicitly stated that the card and the name are not sufficient to prove identity. Cards are forged. The names of the dead remain on the registry. Ghost voters (who don't have fingerprints) are invented. Those things really happen.

On the other hand it is possible, even likely, that some number of people legitimately entitled to vote, and duly registered were prevented from casting a ballot by misapplication of the hardware, a database error or a bad ID transaction due to a damaged finger or dirty sensor, but the article doesn't produce any examples.

Nevertheless, the electoral commission would be well served to seek out individuals who claim to fit the description quoted above in order to audit the process. Did they register? Is their template in the database? Did it make it on to the proper verification terminal for the appropriate polling place? Etc.

So far, the article's five comments are unanimous. Verification should stay

New Zealand Post office to offer ID assurance services

New Zealand Post online ID system backed by lawmakers (Post & Parcel)

New Zealand has adopted legislation granting the powers for a new national online identity verification service run by the government jointly with New Zealand Post.

The Electronic Identity Verification Act was passed by the nation’s Parliament last week, allowing private sector organisations to access the RealMe ID verification service.

The service launches in 2013 to verify people that use certain services over the Internet are who they claim to be.

NZ Post is set to get even more involved in ID services (see last year's New Zealand ID Management: New Possibilities).

Around the world, enterprising postal services — who have seen their traditional business model of moving paper around steadily eroded — have been changing adding more explicit identity management services. I say "more explicit" because I believe it can be argued that the primary function of the postal service has always been identity management, the paper part was just ancillary to the ID part.

This post, The Post Office, Identity Assurance & Biometrics, expands on the theme.

Click Postal Service (or use the label in the footer) for more on post offices and ID services.

India UID: Things are about to get real

In simple terms, an ID project has two parts: enrollment and verification.

Enrollment is the process by which a user is vetted by, entered into, or purchases an ID management regime.

Verification is when the ID management solution actually has to fulfill its intended function.

You don't really know for certain if the key you just had made is going to open your front door until you try it. You won't know if the combination lock you just bought works until you try it. And India won't know how smoothly the UID-based system can provide a transition away from the subsidy system to the cash transfer system until it gives it a try.

Verification is where the rubber meets the road and India is about to take its first UID test drive as Dr Manmohan Singh, Prime Minister of India, announced last month the launch of a direct electronic cash transfer scheme leveraging India’s Unique Identification (UID) Programme. (FutureGov)

The government has announced that direct cash transfer of subsidies to the bank accounts of the recipients would start in 51 out of India’s 659 districts from January 2013 and would be gradually extended to the rest of the country by April 2014. (The Hindu)


Hopefully things go well. It's hard to overstate the challenge involved or the importance of the project's success.

Ghana election context

ID management is about people.

The following article about Ghana isn't about biometrics but it provides some of the context in which Friday's biometric (registration and verification) elections will occur this Friday.

Biometrics have helped put rigorous ID management systems within the reach of organizations that couldn't obtain them before.

Coup era over, Ghana showcases African democracy (Las Vegas Sun)

"The reason Ghanaians are so drawn to democracy," analyst Jonah said, "is because they have seen that democracy in Western countries has brought a very high level of development, and they want to be like America, they want to be like Britain."

He said that if the rulers can deliver the services the people need, "Then people will say, `OK, democracy isn't just every four years selecting people. Democracy also brings development.'"

Ghana biometric voter verification

Voter Verification Machines Are Reliable-EC
"The verification machines for this year’s general election were custom-made for Ghana and are more than 99 per cent reliable, says Mrs Gloria Asante, a Principal Electoral officer at the Electoral Commission."

Sierra Leone votes tomorrow after biometric voter registration

Sierra Leone to vote in litmus test for post-war democracy (Tengri News)

For several reasons biometric voter registration without biometric voter verification is at best a half measure toward preventing electoral fraud. Hopefully it's enough to insure peaceful elections in Sierra Leone.

No biometric verification, no vote

No verification machine, no voting; Afari Gyan declares (Ghana Web)

No biometric machine, no voting – EC, political parties agree (Ghana Business News)

A thorough biometric system gets around the fake voter ID card problem

Fake Voters’ ID Cards In T’di? (Daily Guide)
Database de-duplication and election day biometric voter verification are crucial.

Ghana testing biometric voter verification hardware

Biometric voter registration without verification leaves certain electoral risks (ballot stuffing, ballot destruction) unmitigated.

It looks like Ghana is aware of those risks and has seen fit to implement a biometric voting system that covers both ends of the electoral process.

EC to test biometric verification devices Nov. 3 and 4 (Modern Ghana)

Before ballot papers are issued to voters, their identities will first be verified "biometrically". Thumbprints of voters will be captured by the verification devices and cross-checked against prints collected during the biometric registration exercise.

This is to establish whether a voter has indeed been captured on the voters' register. Apart from the introduction of the verification device, the EC says it will also make use of the name reference list which indicates specific locations of voters on the register eliminating the task of flipping through the entire register to find a voter.

A post covering some of the nuts and bolts of why registration without verification could be inadequate is here. The issues are discussed within the Ghanaian context but they apply far more broadly.

Ghana opts for biometric voter verification

EC orders 26,000 verification machines…For biometric verification (Ghanaian Chronicle)

“We have several samples of the verification machine in the office that we are going to use for piloting. The first piloting exercise will be done internally, I mean at the offices of the Electoral Commission in Accra. That exercise is slated for the first week of October. Following its success, we will then pilot it at some constituencies before the general elections,” noted Mr. Akumeah.

The biometric verification machine is a handheld machine used to ascertain that an individual ‘is who he says he is’ or ‘is who she says she is’. Biometric verification requires a biometric system or setup to operate in.

This makes a lot of sense because, by itself, biometric voter registration still allows for quite a few of the most common vote-rigging shenanigans.

Enrollment vs Authentication: Nigeria seems to get it

Nigerians to get permanent voters card soon (Business Day)

"As you know, we did biometric data registration; before the end of this year, we will start issuing the permanent voter's card, and these permanent voter's cards that we are going to issue are chip-based, just like many of our own bank cards. So, they carry all the information on a microchip which is embedded in the card of the card," he said.

"What we believe we can achieve at the minimum by 2015, is that we can achieve 100 percent authentication at the polling units.

Biometric voter registration without biometric voter authentication at the polling place is, at best, a half step toward an optimal biometric voting system.

Is Ghana Doing Biometric Voter Verification on Election Day?

If so, this is the first I've heard about it and it's only mentioned in passing.

EC to procure more verification machines (GhanaWeb)

“Haven gone through the registration which was challenging, the verification definitely will also present its own challenges but we don’t anticipate that the challenges related to the verification will be that difficult,” Samuel Yorke Aidoo said.

Unlike the machines used for the registration process which sometimes broke down, the verification machines, he assured, “is handheld, one machine without any connections so we anticipate that it may not give us that serious challenge…”

He, however, added that the EC is making arrangements to procure backups at electoral and zonal levels so that they can make quick interventions in case there is any breakdown.

UK Struggling with Both Halves of International Traveler ID

An effective ID management regime must accomplish two things. It must enroll individuals in the ID management system and it must establish a means of verification when an enrolled individual makes a claim as to their identity.

Britain's issues with timely verification have been well documented and well publicized lately.
See: UK Border Scandal Update: Independent Inspector's Report Published and
UK Airlines Warn Government of Potential Gridlock this Weekend.

The enrollment process (collecting information, issuing identity documents such as passports and visas, etc.) had avoided embarrassment... until yesterday, that is.

You can take your pick of the British news outlets below, but the gist of it is that yesterday the UK Border Agency temporarily lost the ability to create enrollments in their ID management system, inconveniencing a whole lot of people.

BBC: UK Border Agency (UKBA) ID card system crashes
CIO: UK Border Agency ID system crashes amid queuing chaos
The Guardian: UK Border Agency computer failure leaves thousands unable to travel
The Register: UK Border Agency servers go titsup, thousands grounded

It's unlikely that there is a technical connection between the problems on the enrollment side and the problems on the verification side of the UKBA ID equation, but there is definitely a management connection. It is also clear that many lack confidence in the international ID management infrastructure of the United Kingdom.

The timing for a crisis couldn't be worse. The UKBA is confronted with the challenge of improving its performance under conditions where simply maintaining its service standards would be seen as a great accomplishment, given the heightened security concerns, increased volume of travelers and the international visibility associated with the Olympics.

UPDATE:
Border checks could be eased for 'trusted' passengers to cut queues (Daily Mail)
UK-US Bilateral Border Agreement in the Works? (SecurLinx blog)