In 2008, British Columbia will be launching one of the first pilots of virtual identity cards in North America, and expect other governments to watch this initiative closely as they look for ways to resolve data redundancy issues, according to Vadim Lander, senior vice-president and chief security architect at CA Inc.
B.C. is using C.A.'s claims-based authentication technology for the virtual card pilot.
Two areas will be tackled initially with the cards: allowing government employees to log onto Wi-Fi networks, and authenticating citizens to government Web sites.
As the name implies, the virtual card is not a physical card but an icon that resides on the citizen's computer that is meant to be used in conjunction with a Web browser. "Instead of inputting a username and password, users just have to click on the card to provide their credentials," he says, adding the process to issue cards to British Columbians and determining what documentation they will need to present to obtain them are being worked out.
Once the cards are issued, individuals will own and control the underlying personal information, which will also reside on their computers, says Lander. "Citizens will have choice and flexibility in how they want to make their data available to government."
For the pilot, one card per citizen will be issued containing basic information such as name, address, and date of birth. "But the technology allows people to have multiple cards with different levels of identity they can present depending on the service they want," he says. "It will be up to the citizen to choose what degree of private information he wishes to divulge."
Different services require different levels of personal information, he explains. Booking a campsite, for example, only requires basic address information, whereas filing an Employment Insurance (EI) claim online requires more sensitive information such as SIN and income information.
There are parallels in the physical world - a driver's licence is sufficient for domestic airline flights, but international flights require passports. Varying levels of personal information and supporting credentials could be embodied in multiple virtual cards for the same individual. "We can imagine a scenario in the future where people have different virtual cards from government, banks and other institutions."
One of the key objectives of the pilot is to determine how citizens will use the new technology, he says. As a back-up mechanism, people will still be able to log on with usernames and passwords if the virtual cards fail. "We'll learn which other back-up mechanisms will be needed from the pilot:B what to do if a citizen loses the card, changes machines, uses a wireless device and so on."
Watching closely
The virtual card interoperates with other types of identity management technologies, as it's based on common SAML standards, he says. "With SAML-based infrastructure, a set of handshakes back and forth between two sites occurs to validate that it's the same individual's true ID."
Other government agencies are watching the pilot closely, he says. "They're interested in setting up similar initiatives. They're looking at virtual cards to see if they can use it in their environments to help them get rid of redundant data."
Since most government agencies collect and store their own identity information, the same individual's information typically exists on different servers and systems, and it's often out-of-date and inaccurate, he says.
The collection and storage of personal information in government systems that may not be strictly necessary to provide a service can be avoided in the virtual card scheme, says Lander.
For example, many agencies provide services only to people who are over 21 years old, and will collect and store the date of birth for citizens who use the service as proof of age. "That's exactly what can be avoided - they don't need to store your age or date of birth, they just need to know if you're over 21. The virtual card has that information and can make the answer available to the application."
Lander says another major benefit is reduced liability. "Organizations that maintain sensitive data are liable for it. By not owning the data, organizations aren't responsible for maintaining it. Users will be responsible for not sharing the cards or divulging information - it's no different than taking steps to avoid losing your wallet. Citizens have to take responsibility over their credentials in the online world just as they do in the physical world."
Virtual card technology is a positive step in the right direction, says Philippa Lawson, director at the Ottawa-based Canadian Internet Policy and Public Interest Clinic (CIPPIC).
"It moves away from biometrics-based identity schemes, and avoids the problems we see in that," she says.
However, Lawson sounds a cautionary note for citizens. "Most consumers are not tech-savvy. Our research shows they often don't understand user consent agreements and their implications, and their user responsibilities under them."
(Rosie Lombardi is a freelance journalist based in Toronto. Contact her atrosie@rosie-lombardi.com)
Related content:
Understanding federated identity
Province of B.C. readies federated identity model
Toronto pet owners safe from Patriot Act
icon.
