Since this article was first posted, Alex Pentland at the Massachusetts Institute of Technology's Human Dynamics Laboratory has asked New Scientist to clarify that although a central database would exist under his proposed scheme, it would contain only anonymised aggregate demographic data. Individuals would maintain ownership and control of their own data, and store it themselves on their own devices or using trusted personal services. Samples or "slices" of this personal data could then be provided to third parties to verify identity as required. This system would place less individual personal data in the hands of third parties.
Verifying your identity generally comes down to entering one "key" that only you can provide – be it a password, credit card number or RFID tag.
That's not good enough, according to a new proposal, which suggests that our digital identities will be more secure if they rest on reams of data on our everyday life culled from cellphones, online transactions and the like.
The idea comes from Alex Pentland at the Massachusetts Institute of Technology's Human Dynamics Laboratory. The lab is a pioneer of "reality mining" – studying how people behave by using the crumbs of digital data our every action now produces.
"You are what you do and who you do it with," says Pentland. Researchers and corporations have realised the potential of such data mining, he points out. "It is already happening and it is time for people to get a stake."
Personal control
If people gain control of their own personal data mines, rather than allowing them to be built and held by corporations, they could use them not only to prove who they are but also to inform smart recommendation systems, Pentland says.
He recognises that allowing even limited access to detailed logs of your actions may seem scary. But he argues it is safer than relying on key-like codes and numbers, which are vulnerable to theft or forgery.
"It is not feasible for a single organisation to own all this rich identity information," Pentland says. What he envisages instead is the creation of a central body, supported by a combination of cellphone networks, banks and government bodies.
That bank could provide "slices" of data to third parties that want to check a person's identity. That information could be much like that required to verify high-level security clearance in government, says Pentland.
Privacy expectations
An individual could also allow their data to be used by services like apps on their smartphone to provide personalised recommendations such as restaurant suggestions or driving directions. This has the potental to be much more powerful than the recommender systems built into services like Netflix and iTunes, and would help familiarise users with the value of the approach, says Pentland.
Getting people to share facets of their rich identity is still likely to be a tough sell. "There will be an incredibly complex matrix of sensitivities and privacy expectations when it comes to managing such data," says J. Trevor Hughes, executive director of the International Association of Privacy Professionals.
A wide range of things need to be engineered into any such system to make it work, says Hughes: effective public policy, consumer education, sophisticated data security and more.
Pentland says he is addressing such challenges. "I have already been working with the Harvard Law Lab and the World Economic Forum to develop and advocate the idea." Those two organisations and 70 other industry partners that have expressed an interest will be asked to trial a design for the system currently being finalised.
Pentland presented his proposal at the First International Forum on the Application and Management of Personal Electronic Information held at MIT last week.
If you would like to reuse any content from New Scientist, either in print or online, please contact the syndication department first for permission. New Scientist does not own rights to photos, but there are a variety of licensing options available for use of articles and graphics we own the copyright to.
Have your say
Sounds Like Something The Bush Admin Would Approve Of
Remember when the government laptops were stolen with the information of hundreds of thousands of Vets?
Now imagine what will happen when this new information is stolen. You life will effectively be over financially.
The purpose of privacy is to protect you from those who are stronger than you - AKA government and corporations.
How can you do that by giving them all your data.
Talk about eye-washes!
Wow
Thu Oct 22 14:21:16 BST 2009 by Bill
http://none
Wow, really......
"A wide range of things need to be engineered into any such system to make it work, says Hughes: effective public policy, consumer education, sophisticated data security and more."
so you think "sophisticated data security" could help protect our data? why not just apply this "sophisticated data security" to our own computers then? and forget about handing it over to some government....
is it really that hard to figure out what people want, or need? no it's not.
what is hard, is constantly trying to pull the wool over the eyes of every american, just so you can soak them for another 10 bucks.
There's basically two ways of dealing with identity theft right now.
One is to avoid all electronic systems entirely: don't use a credit card, don't have a debit card, stay off of Facebook, and burn all of your mail.
The other approach is to use these systems and accept that there is a risk of your identity being stolen.
Pentland's approach is like the second option, only now, every time something important happens with your identity, they can send you--the real you--a notification. So if a thief tries to open a fake credit card in your name, you can have the application canceled and a report filed to the cops in 20 minutes, rather than finding out about it a year later when you get a call from a collections agent.
The biggest problem with identity theft isn't that people can use your identity without your consent. The problem is that they can use it without your _knowledge_. Problems you know about quickly you can fix quickly. This makes it harder for the thieves to profit from stolen identity.
And when the profit dries up, what happens to the trade?
Agreed, Instead of putting it all in a pot we should all keep a data mine on ourselves and when information comes up on us that we don't already know about we'll know there is a problem.
All comments should respect the New Scientist House Rules. If you think a particular comment breaks these rules then please use the "Report" link in that comment to report it to us.
If you are having a technical problem posting a comment, please contact technical support.
PRINT
SEND
\
