More thoughts on identity

Mary Branscombe comments

Reg Developer contributor Mary Branscombe has some thoughts on the Microsoft Identity Management Workshop (see blog here) - she fell foul of our seven day limit for replies.

So, here is her view:

Couldn't resist commenting myself! Identity and rights management; you can't manage who is allowed to view/change/print etc a document without having a good way to manage who they are. One reason why ADFS will be able to provision InfoCards for users (or whatever anodyne name InfoCards gets when the technology ships).

If I want to give you rights you are either an individual or in a class of those to whom I wish to grant rights. The current MS IRM - which has been around since 2003 in much the same form - handles the first group: people I can name, ideally through my Active Directory.

The second group are the ones I personally find interesting; I'd like to be able to say that everyone who has a subscription to a magazine I write for can download a copy of any of the articles I've written for the magazine and access that for up to three years after their subscription lapses, after which they can't access it until the article is at least five years old.

A business might say everyone who is of at least pay grade X can access this report. A website might say everyone who works for company Y can read our subscription-only white papers without signing up for an account. Depending on the information they put in the InfoCard, an InfoCard system could cope with all of those (though blocking the content after time and then re-releasing it is harder and needs a continuing infrastructure of some kind). But more companies wanted the first - let me limit the price list to the five people who should see it and stop anyone seeing it when it's more than six months old - than the second, because you can see an obvious immediate business case for implementing the first.

I am not a lawyer but I remember that the login for Windows was once considered an invitation even if you weren't the legitimate user. I believe that conversely, if you tell people that there's a policy that only person X can read document Y and employee Z who is aware of the policy reads it, then they're knowingly breaking company policy. Stopping people easily printing or copying the text means you have to use PrintScreen or take a photo or use a screen scraper - and it's hard to argue that you did any of those accidentally.

And I mostly agree, although Mary presents the normative case - there's nothing to stop you granting rights etc to people even though you don't really know who they are for certain.

Remember when security policies said that you were responsible for anything done on your login even if you weren't logged in? This assumed that if it wasn't you, you must have shared your password or chosen an easy one etc...Not necessarily true, but I bet many policies still say that - and passwords are a pretty poor way to manage identity...

So identity management is a requirement for effective rights management, but I'd rather MS got identity management working before confusing the issue with rights management...I suspect that rights management, for office documents, is simply going to be used to provide a cosmetic veneer of access control.

The MS project manager said that getting round DRM "proved" intent to defraud or damage the company. I'm not a lawyer either, but I'd still like to see specific case law before deciding that evading DRM proves any sort of "intent" - some of the "invitations to hack" have been pretty obscure and I think you might need training and written policy backup in addition to just installing some software. You can't always assume that what makes logical sense is what the law means.

I think Mary's split ("you are either an individual or in a class of those to whom I wish to grant rights" is very useful... ®