5 ms·

We need something like a web of trust system that enables local governments to validate official ID's and cryptographic signatures. We can't do a perfect job, b

We need something like a web of trust system that enables local governments to validate official ID's and cryptographic signatures. We can't do a perfect job, but doing the best we can with current technology and building a rational framework of data protection at the citizen level is the only rational course. A blockchain system makes sense for a distributed record of a web of trust. Instead of a coin and proof of stake, a proof of population based algorithm would allow nodes to join a network. Such a network could form the basis of any government function and cryptographically protected personal data. You could add trustless age verification for porn sites, for example. Or it could allow checking the vaccination status for college entry, or so on. In the case of identity theft, it should be possible to allow law enforcement or some official entity the ability to issue a new identity key, and revert or modify any changes in private data, flagging the poisoned entries in the blockchain. Anyway, the point is : it doesn't have to be perfect, it just has to be better than the shitshow we have now. We can eliminate SSNs and do a pretty good job of implementing cryptographically secured trustless identity. We can build a system that maintains privacy as a fundamental principle instead of trying to tack on post-hoc reactive solutions that are always too little too late.

walterbell 5y ago
In addition to privacy as a fundamental principle, we also need "separation of powers" as a fundamental democratic governance principle. Once these systems are deployed, how can we guarantee ongoing transparency of policy debates and citizen-tax-representative governance and admin/config/security changes? Without ongoing feedback loops that evaluate systems against explicit democratic principles, there is risk of network effects where early policy choices become difficult or impossible to change after many parties have implemented local systems. In that scenario, early system design could become a far-reaching target for lobbyists and techno-regulatory capture.
- robbedpeter 5y ago
  They should be designed to be interoperable and each functional layer should be completely self sufficient, so that any particular module can be eliminated or modified without affecting underlying data. Anti-theft and anti-abuse functionality needs to be baked in from the ground up, so that individuals have total control over their data, with governments able to maintain some absolutely minimal necessary baseline of record keeping. For example: A health department could build a vaccination status verification system, and be provided by the local government with the ability to signa citizen's record. Participation needs to be voluntary and easily reversible. At the same time, the health department should have an ephemeral record from which an accidentally reversed or deleted signature can be recovered. If someone gets their ID stolen, they can go to their local courthouse, get a new ID key, synchronize everything up to the time right before the compromise, sign off on deactivating the old key, and continue on with life. Not only does it have to be private and secure, it has to allow for human fallibility and malice. A system like this could be the basis for controlling law enforcement access to biometrics. If you have no criminal record, all fingerprint and DNA and other data could be restricted without a warrant, or voluntary participation, or legally structured access. Things like this would eliminate the practice of fingerprinting children, using facial recognition or DNA dragnets without explicit judicial permissions, meaning law enforcement access has to be baked in. If done right, it could mean every piece of information could be cryptographically segregated, and a record stored within the blockchain, forcing accountability in any government access and use of private data. Best of all, it would allow secure digital voting. Instead of an election day, you could set a voting week or even month during which every citizen has the opportunity to cast their vote, then verify their selections. People would need to use the extended time frame to ensure their vote is accurate and their keys secure, and only have to go to a polling location if they have been compromised (or simply want to use paper. ) It would need to be wargamed extensively and over the course of at least a year, but we should be leveraging the best technology has to offer. It just needs to be better than what we have, and that's an abysmally low bar.
helloworld11 5y ago
Keeping our privacy, both digital and otherwise, secure from intrusion isn't and absolutely shouldn't be about simply keeping them secure from "bad governments" and nefarious data thieves. The point should be to rigorously prevent governments of any kind using any supposedly good justification period from easily knowing or tracking certain things. If history should be able to teach us anything it's that good governments can become corrupt and that the data held by any large organization can quickly be stolen or misused by its individual members or others for their own ends. Data like that shouldn't simply be "secured", it should be made extremely difficult to collect in the first place, especially by any large centralized party.

walterbell 5y ago

In addition to privacy as a fundamental principle, we also need "separation of powers" as a fundamental democratic governance principle. Once these systems are deployed, how can we guarantee ongoing transparency of policy debates and citizen-tax-representative governance and admin/config/security changes? Without ongoing feedback loops that evaluate systems against explicit democratic principles, there is risk of network effects where early policy choices become difficult or impossible to change after many parties have implemented local systems. In that scenario, early system design could become a far-reaching target for lobbyists and techno-regulatory capture.

robbedpeter 5y ago
They should be designed to be interoperable and each functional layer should be completely self sufficient, so that any particular module can be eliminated or modified without affecting underlying data. Anti-theft and anti-abuse functionality needs to be baked in from the ground up, so that individuals have total control over their data, with governments able to maintain some absolutely minimal necessary baseline of record keeping. For example: A health department could build a vaccination status verification system, and be provided by the local government with the ability to signa citizen's record. Participation needs to be voluntary and easily reversible. At the same time, the health department should have an ephemeral record from which an accidentally reversed or deleted signature can be recovered. If someone gets their ID stolen, they can go to their local courthouse, get a new ID key, synchronize everything up to the time right before the compromise, sign off on deactivating the old key, and continue on with life. Not only does it have to be private and secure, it has to allow for human fallibility and malice. A system like this could be the basis for controlling law enforcement access to biometrics. If you have no criminal record, all fingerprint and DNA and other data could be restricted without a warrant, or voluntary participation, or legally structured access. Things like this would eliminate the practice of fingerprinting children, using facial recognition or DNA dragnets without explicit judicial permissions, meaning law enforcement access has to be baked in. If done right, it could mean every piece of information could be cryptographically segregated, and a record stored within the blockchain, forcing accountability in any government access and use of private data. Best of all, it would allow secure digital voting. Instead of an election day, you could set a voting week or even month during which every citizen has the opportunity to cast their vote, then verify their selections. People would need to use the extended time frame to ensure their vote is accurate and their keys secure, and only have to go to a polling location if they have been compromised (or simply want to use paper. ) It would need to be wargamed extensively and over the course of at least a year, but we should be leveraging the best technology has to offer. It just needs to be better than what we have, and that's an abysmally low bar.

helloworld11 5y ago

Keeping our privacy, both digital and otherwise, secure from intrusion isn't and absolutely shouldn't be about simply keeping them secure from "bad governments" and nefarious data thieves. The point should be to rigorously prevent governments of any kind using any supposedly good justification period from easily knowing or tracking certain things. If history should be able to teach us anything it's that good governments can become corrupt and that the data held by any large organization can quickly be stolen or misused by its individual members or others for their own ends. Data like that shouldn't simply be "secured", it should be made extremely difficult to collect in the first place, especially by any large centralized party.