The Obama administration today unveiled its strategy to safeguard transactions in cyberspace by helping to create voluntary "secure, efficient, easy-to-use, and interoperable identity solutions."

These secure credentials, provided by the private sector, would help consumers easily manage their identities online by eliminating the need for multiple passwords while making it easier for firms to identify legitimate customers and build their businesses online, according to the White House.

"By making online transactions more trustworthy and better protecting privacy, we will prevent costly crime, we will give businesses and consumers new confidence, and we will foster growth and untold innovation," said President Barack Obama in a statement [1], releasing the National Strategy for Trusted Identities in Cyberspace [2] (NSTIC).

Cybercrime costs the American economy billions of dollars every year, while consumers victimized by identity theft can lose up to 130 hours trying to recover from the fraud, as well as an average of $631 in out-of-pocket expenses, according to the administration.

The core of the strategy, to be implemented by the Commerce Department, calls for development of an "Identity Ecosystem" populated by the interoperable, secure identity credentials of consumers who opt in.

"It is an online environment," according to the strategy document, "where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities--and the digital identities of devices."

The White House assures consumers who opt for the credentials that they will have many options for how they verify their identity online—everything from smart cards, cell phones, keychain "fobs," to one-time password generators and solutions not yet invented.

In an effort to sell the strategy, the White House provided imagined scenarios in which online users whiz around the Internet safely and securely to shop, chat, and access new markets.

In one such hypothetical situation, "Mary" uses a smart card provided by her Internet service provider to speed around the Web, buying products without having to remember multiple user names and passwords for each site she visits.The smart card talks to the Web site without her having to do a thing.

In another, 13-year-old "Antonio" carries a school-provided keychain fob with his identity credentials embedded to access online chatrooms reserved for adolescents. The keychain fob allows Antonio to verify his age but does not provide any biographical information, thereby allowing Antonio to interact anonymously with children his own age.

Anticipating fears of government and corporate surveillance, the White House emphasized that solutions would be fielded theoretically by many different private companies and their management decentralized.

"Since consumers will be able to choose among a diverse market of different providers of credentials, there will be no single, centralized database of information," the press release states.

The identity credentials' privacy-enhancing technologies would also make it harder for service providers to link and create a profile of online user, according to the administration.

"By default, only the minimum necessary information will be shared in a transaction," the strategy explains. "[T]he Identity Ecosystem will allow a consumer to provide her age during a transaction without also providing her birth date, name, address, or other identifying data."

Finally, the strategy emphasizes that the program would be voluntary.

""[T]he Strategy does not advocate for the establishment of a national identification card or system Nor does the Strategy seek to circumscribe the ability of individuals to communicate anonymously or pseudonymously, which is vital to protect free speech and freedom of association," the document states. "Instead, the Strategy seeks to provide to individuals and organizations the option of interoperable and higher-assurance credentials to supplement existing options, like anonymity or pseudonymity."

♦ Screenshot of NSTIC Homepage

Thumbnail: