Select Committee on Home Affairs Written Evidence


APPENDIX 21

Memorandum submitted by Hewlett-Packard Laboratories

EXECUTIVE SUMMARY

  Attainment of the Government's vision regarding digital services is threatened by many individuals' concerns over the increased potential for surveillance, over them and their actions, that consuming such services would offer. Adoption of digital service delivery infrastructures whose designs avoid the need to know the absolute identity of the service consumer would significantly reduce that potential and the concerns it creates. The technologies that are needed in such designs exist today and are available for use. Clear support by the Government for such system designs would provide the necessary catalyst to enable their widespread deployment. In turn, this would reduce the threat to attainment of that vision.

INTRODUCTION

  1.  Hewlett-Packard strongly supports the Government's vision of:

    "Creating a country at ease in the digital world, where all have the confidence to access the new and innovative services that are emerging, whether delivered by computer, mobile phone, digital television or any other device, and where we can do so in a safe environment."[161]

  It is clear that for the desired confidence and feeling of ease to exist, all consumers of such services must not only do so in a safe environment, but must regard that environment as safe. In turn, such positive regard requires that their concerns about being the subject of surveillance, whether based on actual experience of being the subject of surveillance, reported experiences of others or just a personal desire to enjoy their human right of privacy,[162] be addressed and resolved.

  2.  As the corporate research laboratory of Hewlett-Packard, we wish to submit comments to help the Committee to understand the potential role of information technology to address the privacy and trust concerns that many citizens have about surveillance. The scope of our comments includes the roles of privacy-enhancing technologies and trusted computing technologies, and the necessary rooting of their use in the human/social concept of trust.

IMPLICATIONS OF SURVEILLANCE

  3.  Where the intent of surveillance, whether by government/public agencies or others, is for a clear and specific purpose that is generally viewed positively and the attainment of which is seen to be aided efficiently by surveillance, and the actuality is absolutely limited to that intent, it is to be expected that few would object thereto. However, unless all concerned with the instigating, sponsoring and operating surveillance have both met those criteria and been seen to meet them, this lack raises concerns in individuals, which in turn influence their behaviour. Scaling this argument up from individuals to society as a whole, it can be seen that attainment of the Government's vision will be affected by the feelings that individuals en masse have about surveillance.

  4.  Applying the above logic to the online world, it is clear that surveillance can be performed by a number of parties on both the actions of digital service consumers and on static information about them. The lack of precision, clarity and stability in Government statements about the specific purposes, operational details, controls and limitations over uses of personal data, etc. of schemes such as the retention of communications traffic data, the National Identity Register and Cards, the National DNA Database, the NHS database and various child-oriented services and databases (eg Connexions, the Electronic Social Care Record) does not provide assurance that any surveillance by government/public agencies would be exclusively of the acceptable nature referred to in paragraph 3. The same statement can be made about private sector providers of digital services, many of whom appear to pay minimal regard to the spirit, if not the letter, of the data protection regulations' requirements regarding their privacy policies. We therefore look next at some work we have done which provides an insight into the feelings aroused in individuals by the possibility of negatively-viewed surveillance.

THE INDIVIDUAL'S VIEWPOINT

  5.  A research project, named Trustguide,[163] was undertaken over a period of 15 months to October 2006 by HP and BT, sponsored in part by the DTI Sciencewise[164] programme. It took the form of workshops which explored the opinions of, in total, approximately 250 citizens with a wide mix of backgrounds, ages, interests and personal values, regarding the tensions in the provision of internet enabling technologies that also fulfil personal expectations of trust, privacy and security.

  6.  It is not our intention here to describe or summarise all the findings from this project,[165] but we wish to highlight the following findings that are relevant to the purpose of this submission:

    —    Lack of control and openness leads to mistrust. Citizens want more responsibility to be taken by government, the banks and ISPs (Internet Service Provider) and guarantees to be provided.

    —    Virtually all participants commonly referred to "risk" rather than "trust" when describing their ICT mediated experiences, and felt more comfortable and secure when restitution existed.

    —    A majority of participants believe that it is impossible to guarantee that electronic transactions or electronically held data can be secure from increasingly innovative forms of attack.

THE QUESTIONABLE "NEED" TO KNOW AN INDIVIDUAL'S ABSOLUTE IDENTITY

  7.  Many of the concerns uncovered by Trustguide can be addressed by breaking (or, better, never forming) the link between data that describes an individual's characteristics (or his/her actions) and data that defines that individual's absolute identity, eg, full name plus date and place of birth, or National Insurance number. For many types of digital service, the service consumer's absolute identity is not needed, and only a means of paying for the service is required. Such services can be thought of as being similar to real-world services that are paid for in cash and around which the purchaser retains anonymity, eg, a bus journey, a haircut, an entry to a cinema. For some other digital services, eg, online personal healthcare, a link between an individual's characteristics and his/her absolute identity has to exist, in order to ensure that the service is consumed by the intended person. However, even in such situations that link does not always have to be direct; as long as the service consumer can provide proof of some sort that he/she is the intended recipient of the personalised service and has the resources and mechanism to pay for it, then all the needs of both him/her and the service provider are met—the consumer's absolute identity is just not needed for this.

  8.  Adoption, by public and private sector entities, of digital service delivery systems whose designs minimize (or, better, avoid) the need to know the absolute identity of the service consumer and also minimize (or, better, avoid) the need for information about the service consumer, from which his/her absolute identity can be (easily) derived, would:

    —    reduce the opportunities for surveillance activity to identify observed individuals absolutely;

    —    limit those opportunities to situations where there already exists a valid need for absolute identity to be used for service-delivery reasons;

    —    ameliorate the concerns of individuals about their actions or personal information being linked to their absolute identity, for purposes they have not specifically agreed to, as a result of surveillance activities;

    —    reduce the risks of theft, loss and abuse of absolute identity information and the consequent costs to individuals and society of the associated frauds;

    —    ameliorate the concerns of individuals that their online actions increase the risk of falling victim to such fraud or even just receiving unwanted communications;

    —    reduce the costs borne by service providers to keep large volumes of absolute identity information safe from unnecessary access, secure against loss or corruption due to process/equipment failures and up-to-date;

    —    enable the observation of online activity en masse and the mining of data in large databases to continue to be done, by service providers and others, in order to provide useful aggregated information without the risk of infringing individuals' privacy;

and so increase the perceived safety of, and hence confidence in participation in, the digital economy by individuals, thus helping the Government's vision to be attained.

  9.  We do not advocate the total replacement of identity-based digital service delivery systems by those in which no identity information at all is required; to do so would allow individuals the freedom to break laws and contracts without risk of being traced and held to account. Rather, we wish to inform the committee of the benefits to be gained if identity information demanded by a service provider, whether public or private sector, be just that required to deliver the service, and no more, thus mirroring the requirements found in the real world. Except where there is a real need otherwise, service delivery systems could be designed to allow consumers to indicate their (partial) identities by means of a set of pseudonyms, ie, tags which are not readily linkable to an absolute identity.

  10.  We also wish to inform the committee that, following that principle, in many situations digital credentials that assert the right of an individual to consume a service, or assert his/her competence or capability to perform an action (eg, make payment), could be used in place of absolute identity. To repeat a point already made, for many purposes a digital service provider does not need to know the absolute identity of the service consumer—it is merely a convenient way of discovering, labelling, linking and/or tracking the various characteristics of the consumer, which in the process also permits surveillance and exposes the consumer to a range of risks.

  11.  Some credential-based systems that control access to services, both in the digital and real worlds, require the existence and participation of third parties that are trusted by both the service provider and the service consumer. Typically, such trusted third parties (TTPs) know the absolute identity of a service consumer, and can therefore provide a means for the link between a pseudonym or credential and its owner (ie, the service consumer) to be followed in the event that his/her absolute identity is required, eg, for law enforcement purposes.

  12.  These abilities of a TTP both to revoke credentials and to reveal absolute identity imply that the digital service consumer must place a high degree of trust in the TTP. However, that is no more than the high level of trust that a digital service consumer today must place in most of the service providers with whom he/she interacts; this is especially true in the case of online financial service providers and most government agencies.

RELEVANT DIGITAL TECHNOLOGIES FOR TRUST AND PRIVACY

  13.  There is a variety of technical approaches to providing the individual with the means to manage his/her digital identity information to and control its release and subsequent use. These range from approaches in which all communication and interaction between digital service provider and consumer is done on the basis of anonymous credentials (ie, no identity information is transferred) to those in which the service provider's identity management systems are designed to follow all the consumer's requirements regarding his/her identity information (and thus act as his/her proxy) and are verified as actually doing so.

  14.  Some of these technical approaches are being further researched and developed within the PRIME project,[166] a 4-year co-operation between 20 industrial and academic research institutions, that aims to advance the state of the art of privacy-enhancing technologies. It is part-funded by the European Union, and its scope includes technologies and system architectures, reference prototypes and application trials, all within a context provided by legal, social, economic and human factors requirements for these. Hewlett-Packard Laboratories is one of the leaders of the project. Within it we have undertaken research and development of technologies that:

    —    aid a service provider to manage the identity information, provided by a service consumer, according to the requirements of that consumer;

    —    aid the service consumer to assess the trustworthiness of the service provider's systems, ie, that they will actually manage his/her identity and other information in accordance with his/her wishes;

    —    aid the service consumer to manage the trust aspects of the device he/she uses to access the digital service;

  and work continues on these.

  15.  Note that two of the above-listed items refer to the trustworthiness of a device or a system. This term is used in a technical sense, and can be defined as the degree of reliance that a device or system will behave as specified, ie, that it has not been corrupted or subverted. Given the present level of cybercrime and likely continuation or steepening of its rate of increase, there is a growing need for both service providers and individual service consumers to have trusted mechanisms for ensuring that their systems and devices are protected against attack and to provide assurance that they have not been subverted (and warnings if they have).

  16.  Hewlett-Packard Laboratories has been conducting world-leading research into such mechanisms for many years, the results of which have led to open, industry standard specifications[167] for the necessary system components and their use, and to the commercial availability of these components (eg, PCs, laptops, etc.) from a number of vendors. This research and development work continues.

  17.  Rigorously provable assertions that devices and systems are "trustworthy" are, however, only as valuable as the trust that is placed in the entity making the assertion by the individual or organisation that is considering whether or not to rely on such assertions.

CLOSING THE LOOP OF TRUST

  18.  The Trustguide project also found that there exists a high degree of distrust of ICT-mediated applications and services ("mediated" means: delivered using a range of technologies), that citizens want more responsibility to be taken by government, the banks and ISPs (Internet Service Providers) and for guarantees to be provided. This implies that citizens would be willing to trust these entities, and in turn this opens up the possibility for them to take on the roles of TTPs for individuals, and also to be part of the chain of trust that supports technical verifiers of software and systems.

  19.  The existence of such a trust infrastructure would enable the design of digital service delivery systems that rely much less on needing to know the absolute identities of their consumers.

  20.  To bring this into being would probably require initial support from government. Some reassurance that a critical mass of demand for use of such a trust infrastructure would be generated within a reasonably short timescale would probably be a necessary part of adequately reducing the business risk to investment to create the infrastructure. This may perhaps be less of an issue for financial service enterprises.

  21.  The Government's ability to satisfactorily provide that support, by itself being a pathfinder provider and operator of a trust infrastructure, is currently questionable, because of the points raised in paragraph 4. However, by making clear statements in support of reducing the use of absolute identities in digital services and by providing open commercial incentives to encourage private sector pathfinders, the Government would be widely seen to be acting to reduce the risks and incidences of exposure to unacceptable digital surveillance (refer to paragraph 3).

  22.  The Government could further enhance its trust rating by supporting the wider use of clear, precise statements of the purposes for which a digital service requests any piece of personal information, thereby helping such best practice become the norm.

  23.  Such an enhanced trust rating would increase and widen popular support for other IT-intensive government initiatives that are aimed at fighting crime and terrorism and at providing joined-up government services.

CONCLUSION

  24.  Hewlett-Packard Laboratories believes that privacy-enhancing and trusted computing technologies have a strong role to play in addressing the privacy issues raised by the increased potential for surveillance over digital service consumers, and that clear statements and actions by Government to support the use of these and other technologies to reduce the use of absolute identities in digital service infrastructures will assist in removing the concerns of (existing and potential) digital service consumers over surveillance and cybercrime, and hence help attain the Government's vision of creating a country at ease in the digital world.

April 2007






161   March 2005 Connecting the UK: the Digital Strategy. Cabinet Office, Prime Minister's Strategy Unit, joint report with the Department of Trade and Industry. Back

162   Article 8, European Convention on Human Rights. Back

163   Trustguide website: http://www.trustguide.org.uk Back

164   Sciencewise website: http://www.sciencewise.org.uk Back

165   The Trustguide Final Report is available at http://www.trustguide.org.uk/publications.htm Back

166   PRIME website: http://www.prime-project.eu Back

167   These have been developed by, and are available via, the Trusted Computing Group, whose website is http://www.trustedcomputinggroup.org Back


 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 8 June 2008