New identity management models and their impact on privacy and security

Abstract

Identity Management (IdM) systems are being stridently developed by governments across the globe. National and international governmental institutions see them as a panacea for the many ills plaguing society – by increasing the inclusion of historically marginalized communities, bettering the planned development of society, improving security, and effectively distributing social welfare benefits, services and subsidies. Diametrically opposed to this viewpoint are human rights activists and researchers who see such systems as authoritarian encroachments on fundamental human rights and freedoms by governments whose true purpose is actually the establishment of inescapable surveillance systems. This thesis provides a theoretical model for understanding IdM systems, named the Appropriate Access Model, and shows that the views summarized above only seem contradictory because previous research on IdM systems has been fragmented, based on the perspectives of individual disciplines. The multidisciplinary approach used here, taking into account the history, laws, technology and culture surrounding IdM systems, shows that these views are complementary: IdM systems are quite capable of both extremes, depending on the way they are implemented. The application of Niklas Luhmann’s systems theory to IdM systems provides a method of analysing them by answering three key questions: (i) What are the main historical, legal, technical, and cultural contexts that have influenced identification by public bodies?; (ii) What are the risks associated with identification systems managed by public bodies?; and (iii) How can these contexts and risks be incorporated into policy decisions for existing and future identification systems? The thesis uses the Appropriate Access Model to provide concrete steps and recommendations for the implementation of bespoke national IdM systems as well as the analysis of existing systems at various stages of its lifecycle. These recommendations are based on the envisioned purpose of the system, the way a particular society is organised, and the level of assurance required from such systems - while taking into account attitudes towards IdM systems grounded in cultural values, individual beliefs and trust in government. These steps are aimed at: (1) policymakers who are in the process of designing an IdM system for their society; and (2) scholars and officials who are in either an ex-ante or ex-post process of evaluating an IdM system for its fitness, performance, and impact on society.