Obama administration officials spoke today about the "National Strategies for Trusted Identities in Cyberspace." The NSTIC ("N-Stick") proposal, which was in draft form last June, proposes the creation of an online identity "ecosystem," which the report defines as "an online environment where individuals, organizations, services, and devices can trust each other because authoritative sources establish and authenticate their digital identities."
White House Cybersecurity Coordinator Howard A. Schmidt and U.S. Commerce Secretary Gary Locke appeared in Silicon Valley to deliver the message that, as Schmidt put it, "we need the private sector to lead the implementation of this." Locke said that President Obama would be approving a final version of the NSTIC scheme within a few months.
What are we to make of this effort? Several points.
- First, the administration in its draft proposal certainly says all the right things about privacy. Unfortunately, privacy advocates have learned over the years just what that is worth: soothing promises often don't translate into action. The administration's draft talks about the need to limit collection of information "to the minimum information necessary" and "limit retention of data to the period [of time] necessary." Those kinds of policies would need to be rigorously included in this system if it were adopted. But we need to see what is actually proposed — we still don't have enough details.
- Second, protecting privacy and the right to anonymous speech online is paramount. While there are certainly many security problems on the Internet, the world is getting along fine without an online identity "ecosystem,", and nothing should be considered that threatens these values. Certainly anything that resembles a national identity system or a "driver's license for the Internet" must be vehemently opposed.
- Third, having an electronic identity system that can assure a person's identity would unquestionably create new possibilities for online transactions that are not now practical, and in some circumstances could help to protect people's privacy. For example, the system could allow the IRS to give you direct online access to your tax returns, which isn't possible now because they can't be sure you are you.
- Fourth, there are amazing new cryptographic/mathematical possibilities that have been invented or discovered in recent years. Techniques have been developed for "unlinkable credentials" that allow individuals to prove things about themselves while protecting their privacy. For example, these techniques allow users to prove they possess some quality, status or right without revealing their identity, in a way that cannot be spoofed. For example, you could prove that you have a library card, or are over 21, or are a resident of Pittsburgh, without revealing your identity.
In short, it's possible that if all the stars lined up perfectly, this "online identity ecosystem" could be a good thing.
Unfortunately, there are too many reasons to doubt that all the stars will line up perfectly.
First and foremost, security agendas are likely to take over as this concept gets implemented:
- This proposal has been primarily presented as and discussed in the terms of a security measure, not as an instrument of commerce. That's how it was presented at Stanford today. And of course, the plan was produced by the cybersecurity czar, not the government's chief information officer or chief technology officer or the Department of Commerce. Security agendas are the big driver of this initiative.
- In the cybersecurity space, there has been a lot of talk of creating a "driver's license for the Internet" — a terrible idea that would eviscerate privacy and anonymity online. Indeed believe that forensics — the ability to trace and figure out what happened after a cyber-attack — is a key understated goal of this initiative. But the ability to figure out who has done something bad after the fact is the same online as it is offline — it can only be assured if everyone is tracked, all of the time, and that is not an acceptable tradeoff in a free society.
- Unfortunately this is an administration that so far has catered to the interests of the national security establishment on issue after issue (for the sad details see our report "Establishing a New Normal"). Despite all the nice talk about protecting privacy, what will remain once the administrative sausage-making is done? If privacy protections conflict with perceived security needs, it is not hard to figure what will win out.
- The White House's draft proposal did not explicitly include "unlinkable credentials" and other rigorous privacy-protecting techniques that are simply a must if this system is to be at all acceptable.
The involvement of the private sector in this non-centralized or "federated" identity scheme is of course preferable to a direct, centralized government-run identity system. That kind of a system would be a non-starter. But we would also have questions about what the private sector will do with this system. The interests and values of large companies tends to push toward stability, security and predictability — not toward the raucous freedom that online privacy and anonymity makes possible. Once a standard is in place, will people have to start identifying themselves everywhere online — even when it's totally unnecessary. This has happened all too often in the offline world. It could be driven by the need for legal due diligence (we need to know you're over 18 or we can't market to you and our lawyers say if we don't use this system we could be liable; we need to track you in case you later turn out to be a hacker) and the opportunity to collect reliable personal data for online advertising and other purposes.
The administration is highlighting the fact that this scheme would be "voluntary" — but in a networked world, such voluntariness would quickly become illusory. It's supposedly voluntary to get a credit card or driver's license, but try participating fully in society without one.
A few other key questions:
- Will this be effective? Some security experts such as Columbia's Steve Bellovin have argued that a federated identity system would be of . As he argues, most security problems are a result of hackers taking advantage of buggy code, not authentication problems. In addition, the use of encryption has not stopped attacks; there is plenty of malware already that is abusing strong authentication mechanisms.
- Can the government make this happen? An entire "identity community" has been discussing the problems of online identity and authorization for many years, yet broad adoption of any new mechanisms has not happened, and despite years of condemnation by security experts, the simple username and password remains the authorization and identity mechanism used the vast majority of the time. It's possible that this reality reflects an accurate ongoing cost/benefit calculation in that the vast majority of the time this simple, cheap and easy mechanism fits our needs. In fact, several private-sector efforts to set up federated ID schemes have failed. Problems of collective action are appropriate for government action, but all this does raise the question of whether the government can succeed where the private sector has failed.
- What will it cost? It tends to cost between $75 and $100 to get a well-proofed identity offline such as a passport or driver's license, and that much of those costs are handling the paperwork and verification of "breeder" documents, which might come into play for a secure electronic ID as well, making it expensive.
What would we support? We would support a system that empowers individuals, not large companies and government security agencies. That means a system that does not create records of individuals' activities online, and does not force them to reveal their identity significantly more often then they do now. It would be a system that uses advanced encryption techniques to expand the freedom and possibilities of what individuals can do online — not to track and control them.
Unless the Obama administration comes out with a detailed proposal for an identity scheme that does these things in ways that are hard-wired into the system, and can convince us that its protections won't fall by the wayside at any point, this scheme appears to be a sweeping, utopian intervention in the Internet driven by anti-freedom security agendas that promises to do more harm than good.
Learn More About the Issues on This Page
-
Press ReleaseDec 2024
Free Speech
National Security
ACLU and Partners Urge Supreme Court to Block TikTok BanACLU and Partners Urge Supreme Court to Block TikTok Ban
WASHINGTON — Today, the American Civil Liberties Union, the Electronic Frontier Foundation (EFF), and the Knight First Amendment Institute at Columbia University filed an amicus brief urging the Supreme Court to block the enforcement of a law that would effectively ban people in America from using TikTok as soon as January 19, 2025. Earlier this month, the U.S. Court of Appeals for the D.C. Circuit rejected TikTok’s challenge to the law. TikTok has asked the Supreme Court for a temporary injunction to prevent the app from being banned while the court considers whether to take the case, saying that unless the justices intervene, the law will “shutter one of America’s most popular speech platforms the day before a presidential inauguration.” “The Constitution imposes an extraordinarily high bar on this kind of mass censorship,”said Patrick Toomey, deputy director of ACLU’s National Security Project. “The Supreme Court should take up this important case and protect the rights of millions of Americans to freely express themselves and engage with others around the world.” The brief argues that the D.C. Circuit failed to fully address the law’s profound implications for the First Amendment rights of the 170 million Americans who use TikTok. While the lower court’s decision correctly recognized that the statute triggers First Amendment scrutiny, it barely addressed users’ First Amendment interests in speaking, sharing, and receiving information on the platform. The court also perplexingly attempted to cast the government’s ban on TikTok as a vindication of users’ First Amendment rights, which it is not. The rights groups also explain that the law was intended to suppress certain content and viewpoints that many legislators believe could be amplified on TikTok, including the risk of foreign “propaganda.” But under the First Amendment, the government must meet a very high bar to restrict speech based on concerns about its “motivating ideology” or “perspective,” and the government has not come close to meeting that bar here. “The government should not be able to restrict speech, especially to the extent here, based on guessing about the mere possibility of uncertain future harm,” said David Greene, civil liberties director at EFF. “The Supreme Court should put the TikTok ban on hold while it considers the DC Circuit’s erroneous ruling.” Finally, the brief underscores that the government can’t impose this type of sweeping ban unless it’s necessary to prevent extremely serious and imminent harm to national security. But the government has not provided evidence of impending harm, or evidence that banning TikTok is the only available way to address its concerns. As the brief explains, the D.C. Circuit improperly treated the government’s invocation of “national security” as a trump card and failed to hold the government to its burden. “Restricting citizens’ access to foreign media is a practice that has long been associated with repressive regimes, and we should be very wary of letting the practice take root here,” said Jameel Jaffer, executive director at the Knight First Amendment Institute at Columbia University. “It would do lasting damage to the First Amendment and our democracy if the Supreme Court let this ban go into effect even temporarily.” You can find the brief online here: https://www.supremecourt.gov/DocketPDF/24/24A587/335380/20241217144322392_24A587%20TikTok%20v%20Garland%20Amicus%20Brief%20pdfa.pdf -
Press ReleaseDec 2024
National Security
Religious Liberty
ACLU Statement on New White House Strategy to Counter IslamophobiaACLU Statement on New White House Strategy to Counter Islamophobia
WASHINGTON – The Biden administration today released the first-ever national strategy to counter Islamophobia and related forms of bias and discrimination, including hate against Arab, Sikh, and South Asian Americans. In advance of the strategy, American Civil Liberties Union and its partners had urged the administration to overhaul government programs that reflect anti-Muslim discrimination. In particular, we have called for urgent action to constrain governmental agencies from continuing to exercise their authorities and technology to wrongly surveil and investigate, watchlist, and question and detain Muslims at the border, as well as deny immigration benefits to people from Muslim-majority countries. While the White House raised expectations that many of these issues would be addressed, the final strategy ended up falling far short. The following is a statement from Hina Shamsi, director of the ACLU’s National Security Project: “While this strategy acknowledges discrimination and its harms, it does little to end them and is a squandered opportunity. For decades, American officials have invoked national security to pass laws and implement programs that disproportionately harm Muslims and people perceived to be Muslim. A serious anti-discrimination strategy would concretely address multiple bias-infused government practices that deny our communities equal participation in civic life and our democracy, like federal watchlisting, surveillance, and investigation. We’re profoundly frustrated that the administration didn’t take even the basic, overdue step of recognizing that anti-Muslim discrimination is uniquely normalized and embedded in government policies.” -
VirginiaDec 2024
National Security
Trabelsi v. Crawford, et al. – Lawsuit Challenging Unlawful Detention and Inhumane Treatment of Acquitted ManTrabelsi v. Crawford, et al. – Lawsuit Challenging Unlawful Detention and Inhumane Treatment of Acquitted Man
Our client, Nizar Trabelsi, is in the United States against his will. The federal government brought him here from Belgium more than a decade ago and charged him with terrorism-related crimes. At trial, the government’s case failed: a federal jury found Mr. Trabelsi not guilty. But instead of allowing Mr. Trabelsi to return to Belgium after his acquittal, the United States placed him in highly restrictive immigration detention and began an ongoing effort to force him to Tunisia, where he was born and where he will very likely be tortured. Mr. Trabelsi’s detention violates the Constitution, immigration law, and the extradition treaty between the United States and Belgium. Through this lawsuit, he seeks to return to Belgium, and he demands an immediate improvement of his detention conditions. -
Press ReleaseDec 2024
National Security
Immigrants' Rights
Federal Judge Rejects Acquitted Man’s Argument That His Immigration Detention Is UnlawfulFederal Judge Rejects Acquitted Man’s Argument That His Immigration Detention Is Unlawful
ALEXANDRIA, Va. — This week, the U.S. District Court for the Eastern District of Virginia ruled that the court does not have jurisdiction to decide whether the government can continue to detain Nizar Trabelsi, a Tunisian national who was brought to the United States against his will for prosecution and was cleared of all charges last year. The ruling means the United States will be able to continue to detain Mr. Trabelsi while it attempts to deport him to Tunisia, where he was born and where, as an immigration judge ruled earlier this year, he will likely face torture. The court also concluded that even if it did have jurisdiction over Mr. Trabelsi’s case, his claims challenging the government’s detention of him would fail. “Reviewing claims that the government is holding someone unlawfully is at the core of the judicial function, and we’re heartbroken for our client that the court got this so wrong,” said Brett Max Kaufman, senior staff attorney with the ACLU’s Center for Democracy. “The government’s arguments in defense of Mr. Trabelsi’s detention makes a hash of the Constitution, immigration laws, and its own extradition treaty.” In 2013, the United States forcibly extradited Mr. Trabelsi from Belgium to face criminal charges in the United States. In July 2023, after almost 10 years of highly restrictive pretrial detention, a federal jury cleared Mr. Trabelsi of all charges. But instead of releasing Mr. Trabelsi or returning him to Belgium, the U.S. transferred him to immigration detention, wrongly treating him as an applicant for admission and placing him in the deportation process. Over the years, the Belgian government has issued multiple formal diplomatic requests asking the U.S. to facilitate his return, but the U.S. has refused to send him back. Mr. Trabelsi filed a lawsuit challenging the government's authority to detain him. He also sought immediate improvements to his detention conditions. Those claims were not part of the court’s ruling today, and will continue to be litigated on a separate track. “Mr. Trabelsi only wants to return to Belgium after being illegally extradited to the United States, held for ten years, and then acquitted by a jury of any crimes,” said Nicole Hallett, clinical professor of law and director of the Immigrants’ Rights Clinic at the University of Chicago Law School. “He cannot be held indefinitely and we will continue to fight to make sure that justice ultimately prevails.” Mr. Trabelsi is represented by the American Civil Liberties Union, the University of Chicago Law School’s Immigrants’ Rights Clinic, the ACLU of Virginia, and Professor Jonathan Hafetz of Seton Hall Law School. The complaint in Trabelsi v. Crawford was filed against Jeffrey Crawford, warden of the Farmville Detention Center where Mr. Trabelsi is being held; Liana Castano, ICE field office director for the Washington Field Office; Alejandro Mayorkas, secretary of the Department of Homeland Security; and Merrick Garland, U.S. attorney general.