The first poster on this topic is an advocate for privacy and is
philosophically an ally in my battle against a national ID card. He,
perhaps more wise than I, has not attempted to materially engage in the debate
in this forum. He has contributed good food for thought and this is one of
those morsels. This topic is one I fully engaged on. At the
end of the discussion, however, I probably cemented my reputation as a nut by
saying airline travel would be safer if people were allowed to bring their own
personal protection equipment on board when they traveled. This came up
later when someone wished to discredit me without addressing my points.
The debate that follows was very enlightening to me. It revealed some
of my most vocal opponents did not trust private enterprise and had a deep
concern for making things "equal". In my mind it cemented their
reputations as socialists.
I have not included some of the postings that led me to dead-ends in my
opposition or were sub-threads that were essentially unrelated to the main
topic.
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Richard M. Smith
Sent: Thursday, October 23, 2003 5:55 AM
Subject: Steven Brill's "I'm not a terrorist" card
http://www.nytimes.com/2003/10/23/technology/23secu.html
Venture to Offer ID Card for Use at Security Checks
By JOHN SCHWARTZ
Published: October 23, 2003
Americans hate to wait. But will they pay - and submit to security screenings
and even high-technology fingerprinting - to avoid the long lines snaking
behind checkpoints in airports, office buildings and sports arenas?
Steven Brill is betting that the answer is yes. Mr. Brill, a journalist and
entrepreneur, will announce today a new company, Verified Identity Card Inc.,
which will offer customers an electronic card containing data showing that
they are not on terrorism watch lists and do not have certain felony
convictions on their records.
If businesses, airports and government agencies sign on to the plan and put
Verified's card readers at security checkpoints, cardholders would be able to
zip through, avoiding the most thorough searches.
Mr. Brill, who created CourtTV and The American Lawyer and Brill's Content
magazines, joins a wave of companies hoping to fill a need and make a profit
as government agencies and businesses scramble to shore up defenses against
terrorism.
The card, he said, could serve as a more palatable alternative to a
government-mandated national ID card, which is opposed by privacy advocates
and the Bush administration.
...
The cards will be linked to their owners through finger- and thumb-print scans
at security turnstiles. The network could be at demonstration sites in the
first half of next year, the company said. The enrollment cost would be $30 to
$50 a person, with a fee of a few dollars each month to maintain the
cardholder's information. Businesses, the company said, could buy the cards to
improve efficiency at their own checkpoints and to give their employees the
benefits of the broader network.
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Henry J. Boitel
Sent: Thursday, October 23, 2003 6:51 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
This kind of thing demonstrates the absurdity of the Government's failure to
make fundamental, secure proof of identification available to all residents.
Proof of who one is has always been a government function. Privatizing that
function will have unfair and burdensome effects:
1. The convenience of prompt and secure identification will be available only
to those who can afford it; everyone else can suffer the inconveniences,
embarrassments and indirect costs of being a permanent presumed suspect. The
have-nots simply will be pushed further back in the line.
2. Personal information required to obtain the card will pass into private
hands, with all the potential that entails;
3. An environment in which a substantial portion of the population remains in
the presumed suspect category is an environment in which there is no
materially greater security than if no card had been issued.
The current issue of the New England Journal of Medicine carries a letter to
the editor that has nothing to do with the identification documentation issue,
but, in another context, very concisely makes an applicable point: "[P]artially
controlling one variable of uncertain leverage within a highly complex, highly
interactive, adaptive system is unlikely to have a significant effect on the
behavior of the system." (Peter B. Boggs, M.D, NEJM, Vol 349, p. 1668- Oct.
23, 2003)
That point certainly applies to large scale identity systems. Identity is the
essential point of reference for all security systems. If there are a lot of
people without readily demonstrable identity, then there is no effective
identity system.
Brill's proposed venture simply shifts more of the burden to those who can
ill-afford to bear it, while doing nothing of substance to enhance the overall
security environment.
Henry J. Boitel
New York
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Huffman, Joseph
K
Sent: Thursday, October 23, 2003 7:10 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Henry, I'm a little "harsh" this early in the morning, please don't take my
abruptness personally. I really appreciate your contributions to this forum.
But this time I have to take serious issue with your conclusions.
Refutation of point 1:
A $30 to $50 enrollment fee is hardly a price that puts it out of the range of
the average person. In other words, there are no "have-nots" unless they want
to be. And the "burden" on those that choose to be "have-nots" is that their
lines are shorter. If the government were to provide the ID for "free" (which
current drivers licenses are not) the true cost is only partially hidden. My
rule of thumb is that if the government provides something for free you can be
sure the true cost will be more than double and the quality will be less than
half.
In addition, the motivation for private enterprise management to prevent
corruption is much greater than in government.
You have no point 2, your statement presumes facts not in evidence.
Refutation of point 3:
There was no claim made that this would result in "materially greater
security", so your statement is totally irrelevant.
Joe Huffman
Senior Research Scientist
Cyber Security Group
Pacific Northwest National Laboratory
Richland, WA
509-375-2201
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Jerry Thompson
Sent: Thursday, October 23, 2003 7:27 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Tend to agree with Henry on this one.
Hope (quite an expectation) our government will see this privatization
"maneuver" and realize it is about time they got back into the saddle - in
multiple areas.
Hope the public also thinks about the continuing growth of information the
private secotro continue to build on private citizens. Doubt though if they
will go that deep - too much effort - easier to curse a gvernment body.
Jerry Thompson
P.S. Henry - any plans on forwarding your comments on to Washington? Want to
start a competitive ID card business?
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Henry J. Boitel
Sent: Thursday, October 23, 2003 8:31 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Joseph,
No offense taken. This type of give and take is what is necessary when
significant public policy decisions are being made.
1. I think your first point indulges in some assumptions that have yet to be
established. I do not know what the enrollment fee will be or what it will
purchase on an initial or continuing basis and what the inevitable extras will
cost. I also do not know whether the proposed system assumes government
cooperation in establishing identities prior to card issuance, with or without
reimbursement to the government for that service.. I also do not know whether
it assumes the companies that "honor" the card will put in special equipment
and systems to read and verify the card. If so, who do you think is going to
pay for that cost? Will it just be the card holders or will it be all who use
that company's services? These are just a few of the initial questions that
ought be addressed.
2. You do not appear to have any problem with an identity system, as long as
the government does not run it. Whatever your reason may be, you are entitled
to your view; however, your preferences are not facts, just as mine are not.
It is a fact that the fundamental basis for identity in this Country has
traditionally been based upon government documentation such as birth
certificates, licensing, security clearances, passports, etc. If you want to
shift that process to private enterprise, I think it calls for more than
generalizations concerning the alleged unreliability of government and the
alleged reliability of private enterprise. Your comments concerning the
relative roles of government and the private sector vis a vis corruption are a
bit over the edge, particularly in view of recent events. Under our present
system, laws are enacted and enforced by Government. Without government
involvement, claimed general identity systems are practically worthless from a
security perspective and due process entitlement in the issuance of such cards
would not be present as a matter of right..
3. My point two is: "Personal information required to obtain the card will
pass into private hands, with all the potential that entails".. You entire
refutation is: "You have no point 2, your statement presumes facts not in
evidence". Yes, I am assuming that, in order to issue an "identity card", a
private entity will have to gather information that establishes the accuracy
of the claimed identity. I am also assuming that it will have to keep a record
of that information so that the appropriateness of the certification it
provides when it issues the card can be tested if and when the occasion
arises.
4. Many of us who believe there should be a universal identity system, believe
that it will create a more secure environment by weeding out those who are mis-representing
their identities or who are operating beneath the radar, so to speak. It will
also empower the individual in the face of an identity challenge. You state
that enhanced security is not an objective of the proposed private identity
system:. As you put it: "There was no claim made that this would result in
'materially greater security', so your statement is totally irrelevant." That
is a helpful concession. I trust you will not hereafter claim that the private
system fills any security need. It does nothing more than give people who can
afford it a leg up. You may or may not be of the view that an identity system
can enhance security; at least you agree that this preferential identity
system does not do so.
5. The establishment of a national identity system is a lengthy process. The
longer the commencement of that process is delayed, the longer it will take to
achieve the security component it can bring. The proposal for a private system
will merely result in an expensive, insecure, preferential system.
Best wishes,
Henry J. Boitel
New York
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Rich Roth
Sent: Thursday, October 23, 2003 8:59 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
A number of points:
A good background check will cost over $500, the card at least $10, and as has
been brought out the infrastructure to run it at lot of money.
The leading terrorist in jail for the first World Trade Center Bombing, is in
jail under a false name. When Iraq took over Kuwait, their Intel guys played
with the official Kuwait files. This happens a lot during war the Germans
among others did it.
If you are looking to recruit or turn someone you look for an individual that
is already cleared so they will not be checked as closely.
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Green, Marie
Sent: Thursday, October 23, 2003 9:35 AM
To: BIOMETRICS@PEACH.EASE.LSOFT.COM
Subject: Re: Steven Brill's "I'm not a terrorist" card
I want to know the agency conducting these background investigations...
$500???? Way cheap!
Marie J. Green
Engineer - Strategic Technology Office
Defense Information Systems Agency
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Huffman, Joseph
K
Sent: Thursday, October 23, 2003 9:48 AM
To: BIOMETRICS@PEACH.EASE.LSOFT.COM
Subject: Re: Steven Brill's "I'm not a terrorist" card
The "background investigation" for Steven Brill's card is far less than those
for a security clearance. The card just shows:
... that they are not on terrorism watch lists and do not have certain
felony convictions on their records.
My guess is that cost for this sort of "investigation" should be far less than
$500.
Joe Huffman
Senior Research Scientist
Cyber Security Group
Pacific Northwest National Laboratory
Richland, WA
509-375-2201
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Huffman, Joseph
K
Sent: Thursday, October 23, 2003 9:50 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
1.
The article stated what the expected costs were projected to be:
The enrollment cost would be $30 to $50 a person, with a fee of a few
dollars each month to maintain the cardholder's information.
It's fair to question if this is an accurate projection, but in any case the
total cost for a government project is almost invariable greater than a
private business solution.
-----
2.
Widespread corruption in the government ID business (drivers licenses) is a
well established fact. My understanding is the going "street price" for an
official government issued, but bogus name, drivers license is about $800. If
the management of a private corporation allowed that sort of thing more than a
few times they would soon be out of business. Government entities are never
"put out of business" and government officials only fail to win election and
rarely go to jail -- even when the most egregious financial mismanagement
occurs (California still exists and no one has gone to jail). The "free"
public school system still exists even though private schools produce better
results at less total cost. Competition is a good thing and almost always
produces better results for less cost.
You are at least partially in error about security clearances being a
government function. The actual investigation is done by a private company --
at least the people that investigated my background for my clearance were from
a private company.
You overlook another privately run "Identity System" -- our credit ratings.
Yes, our ID may be stolen (as mine was once -- because they got a hold of my
government issued SSN), but how many times have you heard of someone bribing
someone in one of the credit bureaus to get a good credit rating issued to
them?
I doubt that any (government or not) issued security enhancing ID will ever be
covered under due process as "a matter of right". If it were then all some
terrorist want-to-be would have to do to know if the government were
suspicious of him or her would be for them attempted to get the card. As they
went through the due process procedure the data the government had concerns
about would either have to be withheld (violating due process) or revealed and
expose the government intelligence sources. Intelligences sources and
capabilities are the most highly classified and tightly held secrets, even
higher than the information those sources provided.
-----
3.
You say:
Yes, I am assuming that, in order to issue an "identity card", a private
entity will have to gather information that establishes the accuracy of the
claimed identity. I am also assuming that it will have to keep a record of
that information so that the appropriateness of the certification it provides
when it issues the card can be tested if and when the occasion arises.
And? What of it?
----
4.
I didn't say the proposed ID system would not improve security. I said no
claim was made that it would. It might actually have some security benefit
because resources could be reallocated to concentrate on the people that are
more likely to be a threat. The main benefit would be that the average person,
willing to pay the price, could avoid the long security lines. This cost in
lost productivity is immense and few people take it into account when looking
at the entire security picture. You state:
It does nothing more than give people who can afford it a leg up
And? What is your point? People pay a price one way or the other, they can pay
with their time or they can pay money and some of their privacy. It's about
freedom to choose.
5.
A "universal" ID system has not been shown to provide material security. It
has not been shown that a private system would be more expensive or less
secure. I am completely baffled as to what you might mean by "preferential" in
some sort of detrimental way. Even then it has not been demonstrated that a
private system would be more "preferential" in a bad sort of way.
Joe Huffman
Senior Research Scientist
Cyber Security Group
Pacific Northwest National Laboratory
Richland, WA
509-375-2201
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of OptiSec
Sent: Thursday, October 23, 2003 10:07 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
The discussion on the topic of:
"Steven Brill is betting that the answer is yes. Verified Identity Card Inc.,
which will offer customers an electronic card containing data showing that
they are not on terrorism watch lists and do not have certain felony
convictions on their records."
With all due respect to Mr. Brill, how is Mr. Brill going to know who is on a
terrorist watch list and not a convicted felon? Are the files of the FBI,
Interpol, and all the Secret Services going to open up their files to Mr.
Brill?
Terrorist are not going to enroll into Mr. Brill's system in the first place.
That leaves us with honest citizens.
How many knowledgeable and honest citizens are going to entrust their finger
prints to the gentleman that brought America: Court TV, The American Lawyer,
and Content magazines?
Americans are shouting about the government taking away their right to
privacy. Along comes Steve Brill and now Americans are going to pay a
businessman off the street $50.00 to steal their privacy?
To put it bluntly, the information on the "Verified Identity Card" will have
the same truth value as the information appearing in the "The National
Inquirer".
Any private ID card has value only in a small and closed group of users within
a defined environment.
Yona Flink
OptiSec Ltd
+972 5 4308 727
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Jack Ring
Sent: Thursday, October 23, 2003 10:20 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Take care with present tense. The best a card can do is show that they WERE
not on a terrorism watch list and DID NOT have any felony convictions ---
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Michael Harris
Sent: Thursday, October 23, 2003 10:09 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
All of the past posts are irrelevant to the fundamental issues of
sustainability for the authorized credentialization; i.e., at what cost and
effort can one hope to unequivocally verify an individuals identity and ensure
exclusion from 'updated' watch lists?
Whether using a card or database any body or agency as proposed would be
shuttling through individuals based on potentially (and more than likely)
dated authentication. Perhaps the identity was cleared last month but now that
ID is being used to bypass more stringent security measures and Shepherd the
wrongdoer through various checkpoints. Not acceptable in my vision of world
security.
The proposed plan suggests that it is merely enough to 'prove' ones identity
and innocence once, at minimal cost (unlikely), and forevermore be excluded
from long lines and tedious checkpoints. Fallacious nirvana.
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Jack Plaxe
Sent: Thursday, October 23, 2003 10:26 AM
Subject: Re: Steven Brill's "I'm not a terrorist" card
In a message dated 10/23/2003 12:20:55 PM Central Standard Time, jring@AMUG.ORG
writes:
Take care with present tense. The best a card can do is show that they
WERE not on a terrorism watch list and DID NOT have any felony convictions ---
Great point.
A background investigation involves an investigation of a person's history and
current activities. It must be repeated and updated on a regular basis to find
evidence of new criminal arrests, convictions or other untoward activities.
Jack R. Plaxe
Senior Program Manager - Chicago Office
CTI Consulting
-----Original Message-----
From: The Biometric Consortium's Discussion List [mailto:BIOMETRICS@PEACH.EASE.LSOFT.COM]
On Behalf Of Henry J. Boitel
Sent: Thursday, October 23, 2003 12:21 PM
To: BIOMETRICS@PEACH.EASE.LSOFT.COM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Joseph,
Some of the arguments you are now making are somewhat circular or rely upon
what "everyone knows", when it is clear that no everyone agrees with those
generalizations. So, I will try to stick to new matter. At the end, I will
make some of my own generalizations that I think more accurately apply.
As to whether there is corruption in the existing credit industry I think you
ought give that one some more thought. Rigged credit is a daily fact of life.
Practically all of the corporate scandals of recent date have related to
misrepresentations as to credit-worthiness and the failure of credit auditors,
including credit agencies, to do their job properly.
Moreover, I find it peculiar that you are prepared to hang on Government the
responsibility for fraudulent or fraudulently obtained drivers licenses, but
are not willing to follow the same logic when it comes to identity theft and
fraudulent or fraudulently obtained credit cards. Have you seen the ads by
some credit agencies who promise that, for a monthly fee they will alert you
to circumstances that might indicate you are being victimized by identity
fraud? In other words they want you to pay to find out when some credit agency
has screwed up in a way that is going to cause you grief.
On the due process issue. There are two types of due process. 1. Procedural
due process - is a person given a fair and timely hearing on his claimed
entitlement. 2. Substantive due process - is the dispensation of entitlements
rational or does it unfairly favor certain elements of the population.
Generally due process only applies to government or to private operations that
are performing a function in behalf of government. If a private card issuing
agency will not give you a card because they don't want to send someone into
your neighborhood to verify your address, there is nothing much you can do
about it. If Government refused to give you a card for that reason, you would
have a due process claim. Generally, people who are not concerned about due
process are those who believe they and theirs are not going to be the ones
suffering the results of inequity and they have little concerning about the
inequities visited upon others.
A. In substance, you are saying this is a solution for those who are prepared
to pay to avoid long lines. Frequently, these things occur in a relatively
closed system. If the wait is made shorter for some, it will be made longer
for others. Do you have any problem with that? Should the others effectively
be subsidizing the expeditious treatment being given to those who can afford
it?
B. You indicate that you have no personal sense of what the cost of such a
card/system would be. Is there a point at which you think that being able to
afford it is not a basis upon which preferential treatment should be granted.
For example, if I can afford to pay $25,000 per year for a super id service,
should that buy me preferential treatment on lines at airports or into public
buildings or at the bank or motor vehicle bureau?
C. Backtracking a bit, you indicate that a privately issued identity card may
have a value "because resources could be reallocated to concentrate on the
people that are more likely to be a threat". An excellent point, but over
stated. Showing that someone is who he claims to be does not mean that he is
not a person likely to be a threat. One of the primary benefits of a national
id card is that it will substantially remove one of the security issues: "Who
is this guy?". A lot of time is spent on that issue. Based upon your approach,
however, aside from the identity issue, the person who has such a card would
be cloaked with a presumption of integrity. Bad move.
Preferences and Generalizations
I will elaborate a bit on this last point. Some are reconciled to the idea
that we have been driven to a permanent security state. (A security state is
somewhat less than a police state but not an environment of freedom). I am of
the view that we need a road back to an environment in which our children and
theirs can experience the kind of domestic security comfort that most of have
experienced. We have yet to see, in the US, what it will be like for a
generation of surveilled and regularly challenged children to come to
maturity.
Except for the odd maniac, of the type that has been around for all time, the
only demonstrable internal security problem we have is when insiders and
guardians cheat the system or when people come from outside the country to do
terrible things. It gives me some reassurance that, notwithstanding a very
superficial security system and notwithstanding some pretty aggressive
activity on our part, foreign radicals have not made any move of substance
within the US in the past two years. I am not going to detail what could have
been done by just a few people who were set on that course and prepared to die
for their mission. Such people must be blocked from entering the Country and,
if here already, must be filtered out of the population - to the extent
reasonably possible. I am not aware of any more constructive step in that
direction than a good identity verification/determination system.
If we are to have a road back, we cannot act as though the freedom of all
should materially suffer because of our fears of what might happen if someone
goes crazy or wants to make an ideological point. The first step on that road
is establishing who everyone is and filtering out people who are illegal, i.e.
fugitives or illegal residents. I hold no brief for or against the increase of
permanent or temporary legal residents. However, if illegal residency is
tolerated, then it is an obvious security flaw.
This brings us back to why true and convenient proof of identity is so
important. Most security time with people is spent on the question of whether
they are who they claim to be. A universal system will substantially eliminate
that issue. That will permit focus to be on other security issues and will get
us and other countries on the road back to having the sense of being the land
of the free and home of the brave. A security state diminishes both of those
aspirations.
Some writers have raised the issue of how long a background check is good for.
An id card should never vouch for a person's integrity. It should only
establish who he is. Identity can be absolute (i.e., traced from birth) or
relative (this is the same person who presented himself on such and such a day
and to whom this card was issued, and is probably the same person who claims a
certain pedigree). The crucial point for an id is that it can be immediately
verified and it goes back far enough in the person's history so that he is not
likely to have been planted in the country to engage in terrorist activity.
Beyond that we are not talking about identity and we are not talking about
security. We would be talking about permanently institutionalized paranoia.
Some writers oppose a universal identity system because it will not provide
certainty. Our existing system is far from certain. A privately run optional
system, with the privileges it may bring, will not be certain. If certainty is
the measure of any security system then we would have no security system.
Security systems simply shift the odds in our favor. We do that without
changing the fabric of our society and without giving special waivers to those
who can afford them.
Best wishes,
Henry J. Boitel
New York
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Henry J. Boitel
Sent: Thursday, October 23, 2003 2:22 PM
Subject: Brill ID (V-ID) Press Release
An extended press release with an appended fact sheet, issued by the group
proposing to issue what they call a V-ID, can be found at http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=SVBIZINK3.story&STORY=/www/story/10-23-2003/0002042658&EDATE=THU+Oct+23+2003,+09:05+AM
The fact sheet covers matters such as scope of use, scope of background check,
estimated pricing ($30 to $50 upon application and then $3.00 per month
thereafter).
Two of the points that are not clear to me are:
"4. Privacy
"V-ID will pledge not to keep, let alone share, any data about members,
including the data submitted in applying and information about where they have
used the card for access."
"5. Continuous Validation
"Unlike other card access programs, V-ID will continuously reaffirm the
validity of the card by checking that nothing has changed to cause the member
to fall below the screening criteria. That data will be sent electronically to
readers at all checkpoints at venues recognizing V-ID."
A. If V=ID will not keep any of the application data or any information
concerning when ID was confirmed at a checkpoint, then how will V-ID defend
itself against claims of system failure?
B. The "continuous validation" claim seems to be that, if V-ID gets word that
you have been placed on a watch list or that your status as to other, yet
undefined criteria, has changed, it will deactivate local acceptance of your
card. That would seem to mean that, in addition to the required local
biometric readers, there will have to be constant networking between the
readers and the central system and between the central system and its sources
of information.. There does not appear to be any indication as to what the
infrastructure cost will be and whether that cost will be paid by the
cardholder fees or by the entities that choose to adopt the system.
An aspect of the "continuous validation" refers back to the card issuance
criteria:
"2.Screening Process
"In the application and screening process, V-ID will check each card
applicant's data against all appropriate databases -- first to assure
that the person is actually the person he says he is, and then,
according to criteria developed in consultation with the Department of
Homeland Security, that he does not present a high risk. These criteria
will include presence on any government watch lists, citizenship or
legal immigrant status, and the absence of any significant, relevant
criminal record
C. Perhaps of all of the provisions of the data sheet, the details not
provided in screening process description is the place where the devil may be
lurking.
D. In will be interesting to see how they solve what I call the first
determination problem If you walk in to them with very good falsified ID, what
kind of process can they pursue, within their price range, to deterine that
you are not the person you claim to be. A price range of $30 to $50 means that
they cannot have even a marginally qualified person spend an hour checking out
your materials and qualifications.
E. I will be very interested in seeing what assurance V-ID will be making to
the card holders and to the secured premises. The press release and fact sheet
are silent on liability issues. For example:
- If a person is denied access or knocked off a plane due to a card screwup,
will he have a claim against V-ID for his losses or is a waiver of such claims
part of the application?
- If a convicted felon's card gets him in, because V-ID did not pick up the
conviction or a watchlisting, and if that felon commits some bad act, will
V-ID have any liability for mahem caused by that person, or is that waived by
the secured premises in behalf of itself and its other customers.
F. Does all of this make the assumption that government(s) will make V-ID
privy to watchlistings?
G. If it claimed that a person gave false or incomplete information to V-ID in
the application process, will V-ID be seeking to bring criminal or civil
charges against the person and, if so, on what statutory basis?
There is a portion of the fact sheet that states aspects of the screen process
will be waived if the the individual already has some kind of government
issued security clearance, ranging from local law enforcement and up. For
those who disparage government processes, it is noteworthy that V-ID appears
to intend to rely upon them where they exist.
I hope that V-ID make some substantial strides in developing procedures that
meet the foregoing problems and the many not noted as well as the ones that
won't appear until there is a working system.
Henry J. Boitel
New York
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Huffman, Joseph
K
Sent: Thursday, October 23, 2003 2:29 PM
Subject: Re: Steven Brill's "I'm not a terrorist" card
This conversation has had very little to do with biometrics and I know that I
have probably contributed to this more than anyone. I intend to make this my
last post on the topic and to make it as best I can without continuing the
thread.
I have never claimed "the card", as proposed by Steven Brill, is an identity
card of any sort or that it would necessarily improve security. It would only
relieve the pressure on security check points -- such as when boarding an
aircraft. Critics that dismiss it because it doesn't do some other, possibly
useful, function are bringing straw men to the argument.
Airport security lines are not currently a zero sum system. "The card" as
proposed by Steven Brill would make all lines shorter.
If you want to pay $25K per year for preferential treatment I have no problem
with that. Anyone with that kind of money already does get preferential
treatment. It's called a chartered flight. No security lines and very few
restrictions for your carry-on luggage.
I have not reconciled myself to the need of a "security state" and fear we are
on a one way path to a police state. I am of the opinion we should be moving
toward a free state at this moment. The recent developments (long known to
nearly everyone that has thought about the problem or tested the system -- I
have done both) regarding box cutters, modeling clay, and household bleach
demonstrate existing airport security is essentially worthless. I am of the
opinion it should be eliminated entirely. No airplane crew or their passengers
will allow a successful hijacking for at least a generation. It may be that a
few planes will be blown up (no different than what is possible now), but a
successful hijacking is nearly out of the question. Removing restrictions on
passengers bring their own personal protection tools would make it easier for
them to protect themselves and their plane for a very small fraction of the
cost.
The only irrefutable "benefit" I see to a Universal ID is the implementation
of a police state. The other benefits are speculative at best and in most
cases clearly overlooking demonstrated loopholes in existing systems that
would not be closed with the proposed systems.
Joe Huffman
Senior Research Scientist
Cyber Security Group
Pacific Northwest National Laboratory
Richland, WA
509-375-2201
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Henry J. Boitel
Sent: Thursday, October 23, 2003 3:14 PM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Joseph,
I knew that if we tried we would reach some points of agreement. They seem to
be:
1. The existing security system is next to worthless or maybe worse;
2. Brill's proposed V-ID is a way for people to let people pay to jump the
security que.
That said, you do have a view that seems to be sufficiently different from the
main stream that it bears noting: You state:
"Removing restrictions on passengers bring their own personal protection tools
would make it easier for them to protect themselves and their plane for a very
small fraction of the cost."
That appears to suggest that, instead of screening for guns and box cutters,
we should be happy to see people bring them on planes Sort of a Weapons of
Mass Defense strategy. I suppose it would be equally applicable to other
places of public accommodation that may be terrorist targets. While I cannot
for a moment imagine agreeing with that approach, it is sufficiently startling
as to warrant some elaboration. Have I interpreted your words correctly?
How do you think someone would fare on the Brill V-ID screening program if he
said he thought that the Government is untrustworthy, wasteful and inefficient
and, if he had his druthers he and his party would board planes armed to do
combat with potential terrorists?
On another point, I think it is a mistake to focus so much attention on
planes. Brill's proposal is much more broad than planes and correctly realizes
that the potential for terrorist action is not limited to planes. My view is
that plane attacks are unlikely. There are some vulnerabilities that are much
greater with a lot less logistical effort. Arming the population is not going
to reduce that danger and would probably do more physical and psychological
damage than occasional terrorists might do.
Best wishes,
Henry J. Boitel
New York
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Huffman, Joseph
K
Sent: Thursday, October 23, 2003 3:42 PM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Although overstated a bit, you correctly capture the essence of my position.
Nearly all available data supports my position. Do you have data that
indicates restrictions on tools for personal defense is beneficial? If so the
CDC overlooked it:
http://story.news.yahoo.com/news?tmpl=story&u=/nm/20031002/us_nm/health_guns_dc_2
Joe Huffman
Senior Research Scientist
Cyber Security Group
Pacific Northwest National Laboratory
Richland, WA
509-375-2201
-----Original Message-----
From: The Biometric Consortium's Discussion List On Behalf Of Henry J. Boitel
Sent: Thursday, October 23, 2003 6:03 PM
Subject: Re: Steven Brill's "I'm not a terrorist" card
Joseph,
I don't see the point in getting into a general gun control discussion, but
since you asked, I will comment..
I am sure that the Centers for Disease control (which is prohibited by law
from proposing any kind of gun control), if permitted to answer, would agree
that promoting the general use of lethal weapons as a passenger defense
against terrorism would be inconsistent with sound public health and safety.
The report to which you indirectly cite, merely sets out CDC's efforts to
measure the effectiveness of existing gun control laws and how they are
enforced. The preface to the report actually warns, in italics: "Note that
insufficient evidence to determine effectiveness should not be interpreted as
evidence of ineffectiveness."
If you wish to see the full report go to: http://www.cdc.gov/mmwr/preview/mmwrhtml/rr5214a2.htm;
and for related CDC work go to: http://www.cdc.gov/ncipc/factsheets/fafacts.htm#Publications
My point is that ad hoc possees aboard aircraft is not a good idea. No
Congress or agency would authorize it, no pilots or flight attendants would
fly with such a rule active, and I don't think the flying public would accept
it. I don't see any point in pursuing this aspect of the matter, at least not
on this list.
Thanks for bringing a little life back to the list. You even engaged in a
questioning session about the recently released Bio-Key product, something
that no one else on the list appears to have been inclined to do.
Best wishes,
Henry J. Boitel
New York
At this point I took the gun-control debate offline.