Identity Crisis: How Identification is Overused and Misunderstood

by Jim Harper

The advance of identification technology biometrics, identity cards, surveillance, databases, dossiers threatens privacy, civil liberties, and related human interests. Since the terrorist attacks of September 11, 2001, demands for identification in the name of security have increased. In this insightful book, Jim Harper takes readers inside identification a process everyone uses every day but few people have ever thought about. Using stories and examples from movies, television, and classic literature, Harper dissects identification processes and technologies, showing how identification works when it works and how it fails when it fails. Harper exposes the myth that identification can protect against future terrorist attacks. He shows that a U.S. national identification card, created by Congress in the REAL ID Act, is a poor way to secure the country or its citizens. A national ID represents a transfer of power from individuals to institutions, and that transfer threatens liberty, enables identity fraud, and subjects people to unwanted surveillance. Instead of a uniform, government-controlled identification system, Harper calls for a competitive, responsive identification and credentialing industry that meets the mix of consumer demands for privacy, security, anonymity, and accountability. Identification should be a risk-reducing strategy in a social system, Harper concludes, not a rivet to pin humans to governmental or economic machinery.

250 pages, Paperback

First published March 1, 2006

Reviews

[Chris Friend · Rating 3 out of 5]

Effective introduction, accessibly written, using vivid examples to make the ideas “sticky”. Not as detailed/theoretical as I had hoped, but that’s my problem, not the author’s. This book is great for folks who haven’t really thought about what’s behind authentication, identification, and authorization systems.

[Paul Sand · Rating 5 out of 5]

[Imported automatically from my blog. Some formatting there may not have translated here.]

This book is from Jim Harper, Director of Information Policy Studies at the Cato Institute; it discusses the public policy implications of "identification" systems used by businesses and governments: how they make sure that the "you" they're dealing with today is the same "you" from yesterday, last month, or three years ago. Since my day job involves (in part) trying to make sure that unauthorized people don't gain access to resources and information to which they aren't entitled, this was (arguably) right up my alley.

Harper starts with the basics: identification is something we do every day in ordinary life, and civilization is built on it. Unforunately, fraudsters are rife. (Harper could have, but didn't, how old identity fraud is: see Genesis 27 on how Jacob tricked Isaac by posing as Esau.) I'm used to seeing identification systems classified as "something you have" vs. "something you know". Harper uses a finer classification: "something you are" (e.g., biometrics); "something you've been assigned" (names, Social Security Numbers); "something you have" (ID cards); and "something you know" (passwords).

Since Harper is a Cato guy, he's free-enterprise friendly and government suspicious. He makes a convincing case that government has gone down the wrong road with too much reliance on a single number (the SSN) and a single ID mechanism (the driver's license, which, at the time the book was written, was threatening to grow into REAL ID). He also swipes at the post-9/11 TSA airport hassle, which is "security theater" meant to reassure the rubes that the government is "doing something" about airline security, while not thwarting any actual terrorism.

Harper advocates doing away with the effective government monopoly on many forms of identification, instead adapting decentralized systems developed by private enterprise. (One example: Clear, a biometric card that can speed up your process through security checkpoints.) He argues that customers should demand more privacy in their business dealings (or, at least, get clear benefits for surrendering a known bit of anonymity); businesses should, on their end, develop solutions to adapt to such demands.

My own employer has, for nearly all students and employees, long piggybacked on the Social Security Number for its own identity management efforts; now, chastened, we're in the costly and time-consuming process of coming up with something else. If only Harper's book had been available years ago, this is a mistake we could have avoided.

[Meneer · Rating 5 out of 5]

There's more about identity than just identification. There are a lot of misconceptions surrounding the notion of identity. Harpers view is new and it shows why our problems around authentication and authorization can be attributed to these misconceptions.

Great read.

[Craig Bolton]

Identity Crisis: How Identification is Overused and Misunderstood by Jim Harper (2006)