White House unveils system to create online identities

The White House is moving forward with a plan that will invite people to create online identities in order to streamline the online transaction process, combat identify theft and reduce the amount of personal information available on the Internet.

Information access groups are watching developments to see if the new system will have any negative affects on public access to information, particularly government-held information that identifies individuals.

The Obama administration introduced the new "Indentity Ecosystem" as a component of its National Strategy for Trusted Identities in Cyberspace on June 25th. The effort is part of as part of President Obama’s Cyberspace Policy Review and the Department of Homeland Security assisted in developing the strategy.

“We want to create an environment, or an Identity Ecosystem as we refer to it in the Strategy, where individuals and organizations can complete online transactions with confidence, trusting the identities of each other and the identities of the infrastructure that the transaction runs on,” said the White House in a fact sheet outlining the program.

Under the system, users will obtain “digital credentials” such as a smart identity card or digital certificate on their cell phone, which will provide automatic authentication for a host of online transactions that includes banking, accessing health records and purchasing goods and services.  

“No longer should individuals have to remember an ever-expanding and potentially insecure list of usernames and passwords to log into various online services,” said the White House in their blog.

The digital credentials would be provided by a variety of private and public organizations and an individual could choose the organization from which to obtain them.  Each organization that supplies credentials would be responsible for validating the individual’s physical identity.

Participation in the Identity Ecosystem will be voluntary.

The White House also emphasizes that users will only have to disclose data that is necessary to the transaction. For example, when an individual shows a driver’s license only for the purpose of verifying age, the individual is also disclosing other information, such as an address and full name, because that information is also included on the license. By using the new digital credentials, an individual would only need to disclose his or her age.

Even with the supposedly improved system, however, it is unclear whether identity thieves will truly be blocked from accessing personal data.

Alice Neff Lucan, a media law attorney, said that while she is not a technology expert, she did not see how the system would eliminate identity theft, particularly when a single set of digital credentials could be used to access a wide variety of personal information.

“If you have registered information on any type of record, it is always possible to find that record,” she said. “With a system of uniformity, you may actually be making it easier for hackers because you reduce the number of targets.”

The draft strategy will be posted on the web for public review and comments until July 19th.  Approximately 70 industry advisory councils and associations gave input on the current draft.

The White House says the strategy should be finalized in October to coincide with National Cybersecurity Awareness Month.