Identity Management and Biometricsin the Government of Canada: Identity Management and Biometrics in the Government of Canada Alice Sturgeon Senior Director, Accessibility, Identity Management and Security Information Privacy and Security Policies Division CIO Branch Public Forum University of Toronto June 15, 2006


Why is identity management important? : Why is identity management important? Program integrity and program costs Identity theft and identity fraud: impact on the economy Privacy Private sector support and guidance Client Satisfaction: Avoid collecting the same or similar information more than once Service Transformation Opportunities for service improvement Opportunities for cost savings Support to PSAT agenda GC-wide framework permits extension to the enterprise of initiatives such as MyAccounts


Context: Context Growth of government services – need for proof of entitlement Proof of entitlement – proof of identity Foundation documents for identity – birth certificate (provincial/territorial) and immigration documents (federal) Secondary documents issued based on foundation documents Result over time: secondary documents used as foundation documents Outcome: “House of Cards”


Identity and Government: Three key roles: Authenticating Identity Identity and Government: Three key roles Providing Identification Establishing Identity Shared jurisdiction: Federal role for those arriving in Canada Provincial / Territorial role with Vital Statistics for those born in Canada Based on relatively standard set of core attributes including: Name Place of Birth Date of Birth Gender Citizenship Numerous organizations involved at all levels of government, for example: Federally issued.. Social Insurance Number (SIN) Passport Issued by Provinces/ Territories Birth registration # Birth certificate Health card Driver’s license Most organizations require a similar base of information to provide identification Some additional needs specific to the organization Separate stand-alone processes by department or program for authentication: E-Pass Health Infoway Service Canada Etc. Common function: provide verification of clients’ identity Enabling technologies: PKI Biometrics Tokens


What is identity – for individuals?: What is identity – for individuals? Identity – the concept of self: Set of attributes that make up the identity of a single, specific individual Foundation of our social system Categories: Attribute identity Physiological/Biometric identity Biographical identity


What is identity? …2: What is identity? …2 Business: Do governments share identification information for registered businesses, ie. federally, provincially or territorially-registered businesses? Which identifier(s) can be used – Federal Business Number? GC Employees: What privacy rights apply? Does shared authentication methodology extend to other jurisdictions through governance provided by Public Sector CIO Council? Do the same principles apply for both GC employees and other Canadians? At what level is separation of direction and guidance required for each set of clients?


Guiding Principles: Guiding Principles Government responsibility Protection of privacy Joint accountability Equity of access Universality Quality of service Security commensurate with risk Uniformity of standards and compatibility of systems Acceptability to the public Source: F/P/T Council on Identity: Identity Strategic Framework, November 2002


Complementary Objectives: Complementary Objectives Citizen-centric service transformation and service delivery based on a single, comprehensive concept of identity, encompassing all government clients: External clients: citizens, residents, taxpayers, vendors Canadian businesses GC employees and contractors Strong verification of identity for authentication, to address security concerns of anti-terrorism, identity theft, and similar threats of today’s global electronic environment.


Security and Service Delivery: Security and Service Delivery SECURITY SERVICES IDENTITY PKI Authentication Biometrics Unique Identifiers Service Transformation International Requirements Standards Identity Proving National Security Policy and Government Security Policy Privacy Document Integrity Multi-Jurisdictional services Common and Shared Services


Biometrics Backgrounder: Biometrics Backgrounder


Facial Recognition: Facial Recognition Maps facial characteristics of an individual Distance between the person’s eyes; Angle of jaw; Length of nose, etc. Advantages: less intrusive, fewer privacy concerns Disadvantages: most susceptible to failed or false match – caused by changes to physical appearance, angling differences; least static characteristic; dataset increases correlate to decrease in accurate match


Fingerprint: Fingerprint Matching ridges, whorls and patterns Finger minutiae and finger-pattern techniques Advantages: More accurate than facial recognition; Least expensive and most readily available Disadavantages: Interoperability of automated fingerprint identification systems (AFIS) readers and template software; Operator error; Spoofing/liveness – unsuitable for unattended systems (e.g., CANPass); Acceptability – hygiene concerns; criminal connotation


Iris Scan: Iris Scan Advantages: Iris patterns are static Exception: eye diseases and artificial changes High accuracy Size of database does not affect accuracy rates Impossible to spoof Disadvantages: Acceptability – highly intrusive More expensive and difficult to implement


Biometrics Standards: Biometrics Standards To support interoperability and data interchange among applications and systems Includes the following aspects: Common file frameworks Biometric Application Programming Interfaces (APIs) Biometric Data Interchange Formats Evaluation Criteria Methodologies for performance testing Consideration of cross-jurisdictional and societal aspects Many standards bodies ISO/IEC JTC1/SC37Subcommittee 37 on Biometrics ICAO – machine readable travel documents U.S. NIST and ANSI


Biometrics Standards (2) : Biometrics Standards (2) ISO/IEC JTC1 SC37 - Biometrics Inaugural Plenary December 2002 Six Working Groups: WG 1 – Harmonized Biometric Vocabulary WG 2 – Biometric Technical Interfaces WG 3 – Biometric Data Interchange Formats WG 4 – Biometric Application Profiles WG 5 – Biometric Testing and Reporting WG 6 – Cross-Jurisdictional and Societal Aspects 24714 Cross-jurisdiction and societal impacts of implementations of biometrics


ISO/IEC TR 24714-1: ISO/IEC TR 24714-1 Cross-Jurisdictional and Societal Aspects of Implementation of Biometric Technologies, Part 1: Guide to the Accessibility, Privacy and Health and Safety Issues in the deployment of Biometric Systems for Commercial Application Objectives: Enhanced acceptance of systems using biometrics by users Improved public perception and understanding Smoother introduction and operation of these systems Potential long-term cost reduction (whole life costs) Establishment of commonly accepted good privacy practices and principles


Biometrics Architecture: Biometrics Architecture Business and Service Immigration Prison Visitation Cross-Border Travel Native Status Information Citizenship Record of Birth Record of Employment Medical Records Biometric Technologies Finger Minutiae Hand Geometry Iris Scan Facial Scan Applications and solutions Border Crossing Bldg Access Airport Access Data Access


GC Biometric Considerations (1): GC Biometric Considerations (1) 1. Encourage Adoption of Standards: Identify requirements that can employ ISO standards (e.g. interoperability, data interchange, performance measurement, etc.) All GC documentation should be consistent with standardized vocabulary as per ISO Standards Increase overall understanding and application of biometrics by using biometrics tutorials developed by ISO. 2. Promote Industry Compliance: Procurement of biometric components and standards should be compliant to the relevant biometrics standards The GC should assume leadership role in the establishment of biometric certification bodies Establishment of performance testing bodies (possibly in conjunction with NIST).


GC Biometric Considerations (2): GC Biometric Considerations (2) 3. Participate in Standards Development: Departments undertaking biometric pilot programs should become members of Canadian Advisory Council (CAC) to SC 37 Knowledge gained through biometric implementations should be shared with others and the biometric standards bodies (ISO, ANSI) 4. Increase Knowledge of Standards: Raise and maintain general awareness of: Biometrics standards development activities Biometrics pilots and implementations currently underway in other countries.


Relative Nature of Authentication: Relative Nature of Authentication Authentication Continuum Software-based No pswd/PIN or policy control ISO/IEC 15408 evaluated Certified smart token Policy control Certified software-based Policy control Smart token No PIN or policy control Certified smart token PIN control No policy control LOW HIGH MEDIUM Biometrics with no crypto token or No biometric Encrypted biometric template


Some Legislation, Policies & Standards: Some Legislation, Policies & Standards GoC Legislation Canadian Charter of Rights and Freedoms Privacy Act Access to Information Act Personal Information Protection and Electronic Documents (PIPEDA) Act Emergency Preparedness Act (rev.) Security of Information Act TBS Related Policies Privacy Impact Assessment (PIA) Privacy and Data Protection Personnel Information Management Access to Information Management of Government Information Government Security Policy Management of IT Security Standard Electronic Authorization and Authentication Standard PKI Standard National Security Policy In Canada GC Standards GSP Security Standards TB Information and Technology Standards (TBITS) Management of Information and Data Standards Other IT Security Strategy Common Infrastructure and Services IT Strategy In U.S.A. Sarbanes-Oxley Gramm-Leach-Bliley NIST FIPS 201 NIST SP 800-series Clinger-Cohen Act USA PATRIOT ACT


Inputs: Frameworks, Standards, Initiatives: Inputs: Frameworks, Standards, Initiatives Canada FPT Council on Identity Business Transformation Enablement Program: Mapping Identity Management NRS & Vital Statistics CMC Identity Theft Consultation Industry Canada e-authentication principles Public Sector Service Delivery Council BC Corporate Authentication Project UK UK Identity Cards Bill Information Assurance Advisory Council LSE Project US OMB M-04-04:e-Authentication Guidance for Federal Agencies General Services Administration e-Authentication Homeland Security Presidential Directive-12 Federal Information Processing Standard 201/SP 800 National Institute for Standards and Technologies trust levels National Academy of Sciences e-Authentication & Privacy Social Security Administration European Union Privacy Enhanced Identity Management for Europe Australia “Whole-of-Gov’t” ID Framework Centrelink Model New Zealand Evidence of Identity Framework (a representative sampling)