Just wanted to let everyone know about another blog I’m involved in: I recently helped Accenture (where I now work) launch a Security Blog.

Accenture has been involved in some of the largest and most complex security deployments of our time. So I believe the blog will be a great opportunity for senior people at Accenture to share some of their insights from these experiences. We’ll also be looking at new opportunities and growth areas for the online security space.

I’ll continue to post on HybridVigor.org as well as on the Accenture Security Blog. So make sure to keep both sites in your RSS feeds (for those of you who still use them) and in your bookmarks list!

In reviewing my last several posts, I was beginning to wonder whether I’m cynical by nature or simply running low on happy pills. But then I found something really positive to write about: Microsoft announced at RSA that it would open source its U-Prove technology. This is really good news.

I hope the development community takes notice and begins contemplating the power of these tools for improving trust relationships online. I discussed some of its potential as part of my post on the “The Law of Relational Projection”  (scroll to the bottom of the post to find the specific reference).

So here’s a shout out to Kim Cameron, Stefan Brands, and the others who made this happen: Congrats!!

The word “trust” appears 32 times in the press release announcing the official launch of the Open Identity Exchange (OIX). Normally, I’d be enthusiastic about such dense coverage of a critical topic, but in this case I question the group’s understanding of the term.

A Governance Template, Not a Trust Framework

OIX is a kind of standards body where techies from various industries come together to prescribe satisfactory methods for identification, so that these IDs can be used across websites. From the OIX site, the process is as follows:

… policymakers representing a trust community (e.g., government, industry association, professional society) start by developing a trust framework specification. This document defines the identity proofing, security, and privacy policies that must be followed by identity service providers to reach a specified level of assurance (LOA). In some cases it will also specify the data protection policies that must be followed by both identity service providers and relying parties to reach a specified level of protection (LOP).

Lastly, the trust framework defines the qualifications necessary to be an assessor for the trust framework—a person or a company who has the professional experience necessary to assess whether an identity service provider or relying party is in compliance with the policies specified for a certain LOA or LOP.

Next the policymakers contract with a trust framework provider (TFP) to operate a certification program for the trust framework. A TFP who operates by the OITF model performs the following functions:

1. Publishes the trust framework so it is publicly accessible.
2. Accepts listings from assessors who meet the qualifications specified in the trust framework.
3. Accept listings from identity service providers (and in some cases relying parties) who are successfully certified by a qualified assessor.
4. Publish updates to the trust framework as it is revised, and periodically renew certifications of participants as required by the trust framework.

Lastly, the OITF model includes roles for auditors and dispute resolution service providers to assist in ongoing assessment of trust framework participants and resolution of any disputes that may arise.

(Side Note OIX: also don’t abuse the word “lastly.”)

Apparently OIX just hosts the party and provides the napkins (for sketching), but little else. Defining the standards is up to the policy makers and certifying compliance is up to a Trust Framework Provider (TFP)—whatever that is.

Identification isn’t Trust

I suppose that, if successful, OIX will improve the way digital IDs are used. That’s not altogether a bad thing, but it’s also not trust.

By analogy, imagine that, in order to improve the effectiveness of TSA screeners, the government sets a policy requiring travelers to present both a driver license and passport at the airport. Does it follow that everyone inside the secure area of the airport will trust each other? If the TSA screener clears someone, does that mean the screener trusts the traveler? Or that the screener trusts the ID? Do the IDs foster any kind of trust at all?

If there’s one thing I’d like to get through to techies who work these protocols, it’s this: identification isn’t trust. Please find another word to describe what you’re doing.

Interesting tidbit in the NYT yesterday about how developers can use public information to get the remaining 5 numbers of your SSN:

The Carnegie Mellon researchers used publicly available information from many sources, including profiles on social networks, to narrow their search for two pieces of data crucial to identifying people — birthdates and city or state of birth.

That helped them figure out the first three digits of each Social Security number, which the government had assigned by location. The remaining six digits had been assigned through methods the government didn’t disclose, although they were related to when the person applied for the number. The researchers used projections about those applications as well as other public data, like the Social Security numbers of dead people, and then ran repeated cycles of statistical correlation and inference to partly re-engineer the government’s number-assignment system.

This is why the b-day listed on my Facebook account is NOT my actual birthday, just my Facebook Birthday. I encourage everyone else to do the same.

In fact, if some of you hackers out there want to put your skills to good use, I’ll open source this idea for a killer privacy app: Develop a “misinformation virus” that goes around the internet making false and conflicting claims about individuals (and their doppelgangers). Make it so only people who know a person can distinguish between fact and fiction. I’d gladly download a “Plausible Deniability” iPhone app that that swarms users together to generate bogus tweets, text messages, photo tags, etc. in the interest of privacy. Anyone want to take me up on this? Reply with the first four of my social so I know your for real.

Imagine a friend invites you to a dinner party. This year, the invitation goes, the party will be catered so you’ll need to pay $40 per guest. Maybe you’re not too excited about the catering idea, but you figure you want to support your friend, so you decide to attend and bring your spouse. At the party, the general consensus is that it’s fun to see everyone, but the catered food wasn’t nearly as good as the traditional potluck approach. Later, word’s passed around that your friend decided to do some cost-cutting on the catering, which explained the below-average food. Then news breaks that because of these cost-cutting measures, your friend actually turned a nice profit on the party and was able to buy her kid a new Nintendo DSi (apparently the kid got mad while playing with the old one and threw it against a wall).

Would you feel happy for your friend? Or would you feel used? After all, your friend took the initiative; she took the risk (after all, what if someone got sick and decided to sue her?); she organized the event; she provided the venue. In short, your friend was the entrepreneur; she “owned” the party. And if that’s not to your liking, what’s stopping you from throwing a party of your own?

But you may still experience a sense of betrayal that comes from feeling obliged to attend an event for friendship’s sake—an event that ostensibly was just a party but turned out to be a fundraiser for your friend’s spoiled kid. In addition, your attendance at the party mandated the attendance of your spouse, prompted you to buy a new dress, and encouraged your mutual friends to attend as well. So you also unwittingly marketed this fundraiser for an over-privileged kid. And of course, since the food was sub-par, you feel taken by your own friend.

Stone Soup 2.0

This modern retelling of the Stone Soup fable is a commentary on capitalistic society, one in which the Pot & Stone owners walk away with most of the soup. Or more literally, American capitalism is a system that distributes the greatest rewards to owners of infrastructure. In this economic arrangement, business owners have much greater control over the value created by the business than do the contributors. This reward structure is said to encourage private enterprise and competition, which eventually will produce the greatest good for the largest number of people.

But the Law of Relational Symmetry tells us that the party in control of the relationship will exploit the other participants. In today’s businesses, owners control the most important aspects of the relationship, such as the ability to set compensation, benefits, and terms of employment. Contributors usually have to sign away their rights to any intellectual property they create to their employer. And often, contributors sign non-compete agreements that restrict their movements after refusing to work under unfavorable terms. With no ability to hold property (intellectual property in this case) and an acute need for income and healthcare, workers in today’s society need jobs the way Victorian women needed husbands.

So while capitalism is undoubtedly the best system practiced on a massive scale for producing wealth, it is nonetheless a system of exploitation and produces less than optimal results for all parties.

Continue reading »

Anyone who read Frank Partnoy’s book F.I.A.S.C.O will immediately appreciate the context of this story: The NYT reported today how Wall St. banks Goldman Sachs and JP Morgan assisted the Greek government in hiding hundreds of billions of dollars in debt, while collecting over $300 million in fees for themselves. According to the Times:

Wall Street tactics akin to the ones that fostered subprime mortgages in America have worsened the financial crisis shaking Greece and undermining the euro by enabling European governments to hide their mounting debts.

As worries over Greece rattle world markets, records and interviews show that with Wall Street’s help, the nation engaged in a decade-long effort to skirt European debt limits. One deal created by Goldman Sachs helped obscure billions in debt from the budget overseers in Brussels….

In 2001, just after Greece was admitted to Europe’s monetary union, Goldman helped the government quietly borrow billions, people familiar with the transaction said. That deal, hidden from public view because it was treated as a currency trade rather than a loan, helped Athens to meet Europe’s deficit rules while continuing to spend beyond its means.

As the Times article later calls out, the rest of Europe is livid. Countries like Germany are likely going to have to flit the bill for this—just as they were nearly finished paying for reunification with East Germany. An article in Der Spiegel (link refers to the English version) discusses bluntly Goldman’s role in the shenanigans. According to the Spiegel article:

In the Greek case the US bankers devised a special kind of swap with fictional exchange rates. That enabled Greece to receive a far higher sum than the actual euro market value of 10 billion dollars or yen. In that way Goldman Sachs secretly arranged additional credit of up to $1 billion for the Greeks.

This credit disguised as a swap didn’t show up in the Greek debt statistics. Eurostat’s reporting rules don’t comprehensively record transactions involving financial derivatives…. Goldman Sachs charged a hefty commission for the deal and sold the swaps on to a Greek bank in 2005.

In an interview between a Spiegel reporter and HSBC chairman Steven Green, the tension is palpable. The interviewer begins with the question “Mr. Green, when was the last time you were ashamed to be a banker?” The interviewer goes on to ask, “You are not just the group chairman of Britain’s HSBC, the world’s largest private bank. In your free time, you also serve as a lay preacher in the Anglican Church. Have you ever prayed: ‘Please God, rescue capitalism’?”

As the Spiegel interview bears out, yelling at the bankers is a cathartic (a nice Greek word) but fruitless exercise. Like Iago in Shakespeare’s Othello, bankers respond with complete dispassion when discussing the suffering they’ve enabled and insist on the legality of the trades and their innocence in these matters. Back to the Times article:

Wall Street did not create Europe’s debt problem. But bankers enabled Greece and others to borrow beyond their means, in deals that were perfectly legal. Few rules govern how nations can borrow the money they need for expenses like the military and health care. The market for sovereign debt — the Wall Street term for loans to governments — is as unfettered as it is vast….

In Greece, the financial wizardry went even further. In what amounted to a garage sale on a national scale, Greek officials essentially mortgaged the country’s airports and highways to raise much-needed money.

Does trust depend on a society’s ability to create a law for every possible act of treachery? Could Moses have brought down the 10,000 commandments from the mountain? Maybe over-the-counter derivatives trades are legal by some literalist interpretation of securities law. But clearly the people who wield the power of such financial instruments pose greater risks to society than Jihadists. In my view, these kinds of over-the-counter trades ought to be illegal and subject to the worst kinds of penalties on the books.

There was a lot of discussion yesterday about the court battle over government access to geolocation data for cell phones. This conjures up all the jokes about how it’s easier to find cows in Canada than to find illegal aliens in the US. The irony is that in the US, people pay for—and pay taxes on—their own tagging devices. I say if the government really wants to track us like cattle, cell phones should be a government subsidy.

Politico reported last week that 49 congressional web sites were hacked, which only became apparent just after the State of the Union Address last week. Web sites displayed simple hacker-speak web pages and many of the sites were completely unavailable for hours.

This should be great fodder for the Black Hat folks meeting in DC (actually Arlington, VA) this week.

Paul Krugman posted an interesting piece in the NYT today, in which he ruminated on the testimony offered before congress by some of the leading banking executives, and concluded the following:

Do the bankers really not understand what happened, or are they just talking their self-interest? No matter. As I said, the important thing looking forward is to stop listening to financiers about financial reform.

I definitely agree that bankers (or anybody for that matter) shouldn’t be allowed to write their own rules. We shouldn’t regard people as benevolent geniuses just because we find it difficult to understand them. Krugman’s point reminds me of some of my own musings on the topic (for example, see “Money Can’t Buy You Trust: What We Won’t Be Getting for $1 Trillion“). In short, there’s no such thing as blind trust.

This week, I started a new job as Sr. Manager at Accenture. I’ll be working in Accenture’s Security Consulting Practice, focusing on Identity and Access Management. So my new role is basically a continuation of my career for the last dozen years, but at Accenture it’s also an opportunity to get involved in some of the most challenging and culturally relevant identity projects of our time.

Governments continue to develop identity systems, commercial sites increasingly add social networking features, and new cloud services strain existing modes of online trust. I’m looking forward to a very interesting year!