Most often people will believe bad news much easier than good news, displaying a general sense of pessimism that is part of the human soul. But sometimes it is really hard to believe what kind of madness politicians come up with: The Governor of Massachusetts, Mr. Deval Patrick, is currently concerned with the state's budget. Well, the times are tough, and it is understandable that we either have to cut programs, raise taxes, or both. These are hard decisions, and I do not envy anyone having to take them.

However, one suggestion Mr. Patrick made yesterday immediately got my attention: there are apparently plans on the table to introduce a "chip" in the state's vehicle inspection stickers, so that cars can be tracked as they use the Commonwealth's highway system. What might seem like a prudent idea to shift the cost of the transportation infrastructure to those that are causing them, is in reality an attempt to introduce an Orwellian surveillance system of European proportions.

It is bad enough that the private industry (in the form of the wireless carriers) have a rather comprehensive location profile of all their customers. Yet, it is really easy to turn of the cell phone, leave it at some place, or switch to another cell phone, in case one wants to obfuscate one's location. However, even in Massachusetts it is rather hard to get around without having to resort to using a car. Within the 128 belt this might be manageable, but once you get beyond 495 it becomes impossible. Mandating a tracking and surveillance device in vehicles for tax purposes will now create a gigantic database with rather sensitive information. The potential for abuse is scary:

• With location data, one can attempt to create a political profile by tracking conventions, conferences, and events a person goes to. I am not a lawyer, but this seems to be getting rather close to infringing a couple of First Amendment rights.
  
• The collected data can be subpoena in all kinds of litigations, including sensitive things like divorce proceedings or insurance disputes.
  
• If the database is ever breached, the hacker could have a field day, exposing location profiles of individuals. Depending on whose data is stolen, this could actually result in increased personal risk for exposed persons.
  

There are a lot more things that can go wrong, so this bill must never even come close to being considered.

tags: privacy massachusetts deval patrick big brother

The DHS Data Privacy and Integrity Advisory Committee of the Privacy Office of DHS has sent a letter to the new Secretary of Homeland Security, Janet Napolitano, making some recommendations for the adjustment of the way the department deals with privacy policy and issues. Some of the more notable ones include:

• Compartment Privacy Officers

• Data Governance

• Interoperability and Data Integrity

• Overhaul of the 1974 Privacy Act

• Independence of the Privacy Office from the rest of the organization

These are excellent suggestions, especially when applying them as a whole: having a compartment Privacy Officer, that can act independently of the rest of the organization has the potential of channeling the efforts of the department into the right direction. Improved data governance, integrity, and better interoperability should really be on the agenda of the CIO as well, but especially in the context of E-Verify or Border control these issues also gain a privacy facet.

Overall, this letter should be a recommendation not only to the DHS, but government and private organizations in general (mutates mutandis). Major privacy invasions (as we have recently witnessed them en force in Germany) can only be avoided if privacy compliance is considered as critical to an organizations success as any other good governance principle.

tags: privacy dhs

It took a long time, but it seems that the time for an older idea of mine has come: Jeff Hodges is reporting on a report he prepared for the MIT Kerberos group to explore the use of SAML tokens in traditional security systems. A while ago, I was exploring a similar idea - then with Eve and Nico - on how to use SAML attribute and bearer token in the context of the GSS-API. 

The ideas and concepts we had then would still seem valid to me, although a lot of things have moved on since then. I will definitively follow this, if only from a distance.

tags: saml gss-api kerberos

We are truly living in interesting times, and while I sometimes prefer to be boring, I think that the increasing interest in authorization is definitively a good sign. Recent discussions on the OAuth Charter for the IETF WG, and Martin Kuppinger's article on Authorization Management are good indicators that the community is moving towards new approaches for distributed authorization.

While XACML has solved many of the problems that may arise from a technical perspective, it is fairly heavy-weight and in its current form not particularly appealing to the large number of RESTafarians. Also, as Martin is pointing out in his articles, what seems to missing is a framework comprising business rules and policy management for "multi-layer authorization" models. Nevertheless, with the recent addition of XACML to the HITSP IS01^[1] and the XSPA XACML 2.0 profile for healthcare will likely raise the visibility for XACML beyond its core community.

At this point, privacy protection concerns (as also voiced in  XACML core) will play a major role, especially when considering the sensitivity of HC related information. As such any authentication management framework must either address these privacy protection issues, or be open enough to interface with emerging technologies such as CARML et al. from the IGF.

tags: authorization xacml oauth hitsp carml igf privacy

[1] Along with SAML 2.0, WS-Federation, and WS-Trust...

Oh well, I finally sat down and took the time to convert my aging main web site into something more dynamic. Since my - overall - quite reliable hoster gives me free PHP5 and MySQL databases, I took a closer look at Drupal, given its overall support, ease of use and add-on module availability. My first impressions are quite good: it was easy to get up and does not seem to be too hard to administer. Converting my exising HTML went well, although the default editor (or more specifically: the Drupal filters) have a tendency to get in the way at the beginning.

Now, one thing I will probably spend a little time on over the next few weeks (time permitting - haha), is to develop a somewhat more reasonable authentication scheme for my various web properties. I have a happy collection of PHP apps, this .NET based blog, and also some custom Java apps. So far there is really no identity management in place; a fact that has been a sore for a while. A simple SSO authentication scheme across these difference platforms is a panacea, but it should not be to difficult to achieve. I am looking actively into using Oauth or SAML as the token format, and a simple RESTful transport.

tags: web site identity saml oauth rest

Times are changing, and people have to change with it. Doh - another pearl of obvious wisdom, but there is an interesting application to the work life: while regular employment might change rather abruptly, business and community relationships usually do not. So while you might no longer be working for a particular company (say, Sun, for example), you would still be interested in continuing your work in a particular area of interest (say, identity, for example).

In this spirit, I decided to join the Liberty Alliance as an individual member. The new structure of the organization, combined with a reasonable fee schedule allows me to continue my formal relationship with one of the more comprehensive identity consortia currently in existence. While I have not yet quite made up my mind on how this engagement will be, I know that there are a number of current project in TEG and IAEG that stir my interest.

One of the most interesting developments in Liberty right now is the realization that a RESTful approach is quite necessary to extend from an enterprise-centric identity management system to one that can scale up to the needs of health care providers and governments. The need for a lightweight IdM and federation framework is indisputable, and the GSA and Internet2 have already demonstrated that the existing feature set in SAML2 is sufficient to build a meaningful federation. However, it will take the legal and business rules framework of the IAF and related efforts to extend these technologies into the realm of social networking and eGovernment where you cannot rely on having a mutual trusted partner in identity.

So, going forward, it will be a lot of fun to dabble with the same technology, only now from a slightly (or not so slightly) different angle. 

tags: project liberty identity rest

Wow - what a week this was... I have been through quite some ups and downs, and that is not even mentioning the fact that the U.S. got a new administration.

Bad news first: not only did I have a mild form of food poisining (not that there was anything 'mild' about it, but I heard it can be much worse), but I am also affected by the workforce reduction at Sun. Yes, that's right... after a meager 11+ years I am on to new adventures elsewhere. To all those that I have been working with: it was a very interesting and mostly fun ride. I really had a sense of being able to work on something big and accomplish a lot, but the energy and the creativity at Sun was very inspiring. I met a lot of smart people there, and I hope that I will have the chance to continue working with them, one way or another.

Going forward, I see myself continuing on the themes that I have been dealing with for a while now: interoperability, web-centric (now cloud) computing, and the related identity and security aspects. There is a lot of work ahead, and I am quite determined to continue contributing. 

Since my age-old email at Sun will cease to work soon, you will now be able to reach me though an interim alias: work-at-removethispart.beuchelt.com^[1]. I am also on Facebook and LinkedIn, so please feel free to connect with me:

http://www.facebook.com/people/Gerald-Beuchelt/615829807

http://www.linkedin.com/in/beuchelt

With more time on my hands for now, I will also start spamming your RSS readers... just kidding - but I will write more here now, so stay tuned.

But now for the good news: yesterday my application to become a U.S. citizen was approved and - assuming all goes well - I will take my Oath in early March. Contrary to its horrible reputation my experience with USCIS (formerly INS) was actually quite good: yes, they are bureaucratic (you should have seen the piles of files they had on me), but overall the process was quite efficient and fast: it will have taken less than 6 months from sending in the application to my Oath ceremony.

Interestingly enough, my becoming a U.S. citizen will also open new doors on the job market: as of March I will be able to get a security clearance, work on certain government contracts, etc. The timing could not have been better.

tags: identity management naturalization workforce reduction

[1]Sorry for putting the "removethispart" subdomain in - obviously it is only beuchelt.com after the @ sign. 

UPDATE: Many thanks to Tim Bray for highlighting this note in his (most unfortunately rapidly growing) Stray Sunbeams series!

There has already been quite some discussion on how to get Windows 7 to run under VirtualBox (bottom line: it works - just install it). Here is a litte add-on to this discussion: Running Windows 7 Beta 1 under VirtualBox on Solaris 10 U5 over a SunRay terminal (exhale....).

Now, since I had tried Vista under VirtualBox, I was not expecting anything (except abysmal graphic performance), but - lo and behold - I was quite positively surprised: the install was complete smooth, and the VirtualBox Vista drivers worked like a charm, once I was using the compatibility mode with Vista (right-click the executable on the mounted ISO image, select Properties and the Compatibility tab, select Vista, close everything and then simply double click to install). Without this trick, the VirtualBox installer would complain about not supporting Windows 7 yet.

Overall performance was pretty much as expected: a lot better than Windows Vista, and about the same as Windows XP. Now bearing in mind that the SunRay system is not exactly targeted at power users for CAD applications, and you will arrive at a the conclusion that Windows 7 Beta 1 under VirtualBox is a logical step from running Windosw XP in the same scenarios to deal with those 7 applications that you just cannot find in open source. If Windows 7 actually came in a freeware version, it could actually be worthwhile upgrading those legacy HDD images. But then, Microsoft has shown over the last few years that they are capable of learning, so I will not loose my hope ...

Seriously: if Windows 7 has a similar performance and resource demand profile as the beta versions, it has a good chance of convincing me to attempt another upgrade. Just one thing will be crucial: application backward compatibility.

tags: Windows 7 Sunray Solaris VirtualBox