I'm Dispersing

When I was a student, there was a proposed law that many didn't like. In October 1994 people took to the streets to protest against the CJB. As the darkness fell on hide park, the protest turned to riot. As the peaceful crowds melted into the inky blackness, the helicopters whired overhead. A story is told, amongst my friends, that a roaming light picked out one of our number and the tannoy roared “disperse now or force will be used”. The fear gripped him and the last we saw of him that night was a far-away shape running shouting “I'm dispersing.....I'm dispersing......”

Little did I realise in those early days of the internet how prophetic those words where. Identity is dispersing. The web has brought us to a paradox – by making an identity information it ceases to a property of the thing-in-and-of-itself, the very thing it is meant to represent. Twenty years ago presenting my passport was enough to prove in a meaningful way that I was I. Today I find facsimiles of my identity scattered across the digital wasteland, my identity now appears to have several parallel lifes of it's own, often more impressive than mine. The problem extends beyond the sphere of personnel identity and infects organisational identity - is the bank I see before me just a spector with an evil genius behind the facade ready to steal my keys? As more of our important interactions take place in the meta-reality of the information space, validating the actual agents behind the digital identity becomes more urgent.

The identity problem has a long history in Philosophy and in it's most relevant guises is known as the problem of intentionality. Without a long exegesis of the literature (as I really can't remember back to the lectures I didn't make it to) the philosophical position is that, thanks primarily to Saul Kripke in Naming and Necessity, philosophy has gone beyond the study of language to talk of the actual things themselves.


My approach to the current operational paradox is based upon an intuition I had when I reading about Navajo code talkers and specifically about one of the features of the language which made it so cryptographically useful, that nouns were often derived from verbs. My intuition was that the paradox of digital identity is driven by the treatment of identity as a noun, a static subject of discourse. In order to deal with identity as a piece of static digital information we have to have the messy business of multiple/complex identities and we need to face the fact it becomes eminently more steal/fake-able when it moves from the physical realm to the binary. Why don't we treat identity as a verb, as a process? This seems to capture an important aspect of identity, that in our transactions with other we often validate each other through shared historical events, anticipated responses and word patterns. When Gordon Jackson's character in the Great Escape responses instinctively in English to a question asked in English by a German soldier inspecting his papers his identity as an escapee is revealed. When Arnie in Terminator II, impersonating John Connor, asks John's foster mum “How's Wolfy?”, her positive response indicates that she is being impersonated (the dog's name was Max).

So how does this approach actually help in Information Security? One suggestion might be to make our transactions with entities more information rich by including shared historical events, essentially making the one of the factors of authentication a dynamic known value. For example, an email from your bank that details the last three transactions before it was sent is a lot harder for a phisher to fake and fairly easy for the recipient to validate. One might also include a new number to enter in a transaction (in addition to PIN and/or CV2), the amount of the previous transaction that card was used for. A discrepancy on the back end processing could be quickly checked and the transaction flaged if the numbers didn't match. This approach doesn't directly defend against covert channels, cloning or man-in-the-middle but would significantly cut down the time window available to make use of captured information. The approach also has the added benefit of increasing security as the card is more diversely and regularly it is used, instead of the common-sense intuition that it would reduce it. It could also provide a valid defence against a fraudulent use that was patterned to look similar to the mark (and therefore evade detection due to geographical/spending anomaly).

It seems to me a rethinking some of our assumptions about identity could enhance our approach to some of the common challenges of our information rich lives.

The Task

This week I was inspired to write a long comment or two on a blog which likened the state of information security to the dark ages. There were three main themes to the comments I made:

- I believe that it is not just information security that is trapped in the dark ages. I believe that our grasp of the whole information ecology is at a fork in the road. On the path lies the shadow of a medieval information philosophy on the other the beginning of a struggle towards the light.

- Old concepts, that we have been comfortable with for many centuries, are not servicing us well is the new world. This new world where information lives forever, can be broadcast globally in real time and can be replicated, federated, reused or, in some other novel way, completely re-contextualised.

- That the time to act is now, and that what is preached should be practised.

So time to self administer the poultice and begin, for myself, that struggle towards the light. As most of the ideas I have in mind are not best served by chopping into sound-bite chunks, I thought a home-essay-ists medium like a blog most appropriate. Thus I created this.

The purpose of this blog is largely for making me organise my own thoughts into something approximating a coherent whole then get them out 'there' for critical distance and refinement.

Subjects I hope to cover include

Identity
Privacy Vs Secrecy
The landscapes of trust
Shadows, Memory and Echoes
Political boundaries Vs Information Tectonics
Rationality
Work Vs Play
Pattern vs Content

If they sound of interest, please visit again.

Be seeing you.