Security Watch

Is a National ID Card Coming?

Like it or not, Big Brother will soon know exactly who you are.

Governance
Last month, President Bush signed into law a bill that, among other provisions, will require all Americans to obtain federally approved, machine-readable ID cards approved by the U.S. Department of Homeland Security. The law, known as the "Real ID Act of 2005," was attached to an Iraq/Afghanistan military spending bill. Enforcement starts in May 2008.

This will create a national ID card, no matter what anyone might say to the contrary. If DHS has approved a machine-readable identification card, it is unlikely that some other card will be created which serves a similar purpose. According to supporters, the Real ID card is intended to ensure that illegal immigrants won't be able to get driver's licenses. However, once created, it's likely that it will make an attractive replacement to Social Security numbers, passport numbers and other credentials which would be more easily trackable in a national database.

Read more on the Real ID Act:

  • A summary of H.R.118
  • The U.S. House of Representatives Committee on the Judiciary's press release
  • Technology security expert and author Bruce Schneier's blog

Malicious Code
Anti-virus firm F-Secure confirmed it was unable to infect an automobile, a Toyota Prius, with variants of the Cabir worm, despite rumors to the contrary.

Privacy
According to a report published by the Boston, Mass.-based research firm Aite Group, the United States is the most prone to identify theft among developed countries. Identity theft occurs seven times more frequently in the U.S. than in other industrialized regions.

The biggest challenge financial institutions face is the regulatory and business pressure to rely on commercially available data to identify customers. That data is extremely vulnerable. To reduce the current level of identity theft, financial institutions need to shift the ID verification paradigm. That means relying less on credit bureaus and information brokers, and more on third parties who do not trade consumer data and whose core business is fraud management and ID verification.

(Note: Cybertrust does not use the term "identity theft" if we can avoid it. Identity theft is actually identity fraud, since the victim continues to have the use of his identity after being attacked.)

This finding is akin to saying that more people have car accidents on the road versus those who have them in pastures. Given the per capita use of computers in the U.S., coupled with the American willingness to purchase online, it's no surprise that they would be the most prone to identity fraud.

Also, there are unlikely to be third parties who don't trade consumer data if they have a lot of it, given the very high demand for that type of information. This isn't to say that trading or selling such data is a good thing—only that it is a major business driver and extremely marketable.

About the Author

Russ Cooper is a senior information security analyst with Verizon Business, Inc. He's also founder and editor of NTBugtraq, www.ntbugtraq.com, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most-recognized security experts, he's often quoted by major media outlets on security issues.

comments powered by Disqus
Most   Popular