Rethinking security and identity

This morning I read an article in the paper that talked about how police officers have found a way around the statute of limitations.  As you may know, the notion of a statute of limitations is that if you commit a crime, there is only a certain amount of time after you commit the crime that you can be charged or indicted for that crime.  So if someone robs a bank, and there’s a five year statute of limitations on that crime, if they figure out who did it five years and a day later, that robber can’t be charged with it.

For some really nasty crimes, particularly rape, the police and the victims hate letting those crimes see their statute of limitations expire without an arrest.  One solution would be to extend the statute of limitations, but that gets away from the point of this entry.

What the police have done to get around the statute of limitations on these crimes, is when they have a DNA sample of the criminal, which is particularly common in rape cases, the police are indicting the identity of the DNA, which they can do, and then if they can figure out who that DNA belongs to, they can then arrest them even after the statute of limitations has expired, which I think is pretty clever.

My guess is that if police can start to assemble a large enough data base of criminal DNA, if criminals know their DNA is in the system, I bet that will have a noticeable impact on recurrence of crime in the repeat offenders category.

Enough about crime.

Even though the war on identity theft will go on forever, it strikes me that we will see many new and interesting ways to identify people whether they are or are not present.  I suspect that in the not too distant future we will look back and laugh at all of the passwords we currently use to identify ourselves with everything from bank cards to e-mail accounts.  Finger print and optical scanners will be very pervasive.   I also think there are some near term applications to things like licensing that can have broader business implications.

Currently I have to carry a driver’s license, and proof of auto insurance, and a fishing license (if I go fishing).  Right now my driver’s license is a pretty good form of physical identification for many things (from airports to gaining access to bars), but I know my state knows my social security number, and it wouldn’t be hard to renew my driver’s license electronically (linked to that number – but they would still have to take my photo and check my vision) and thus not have to carry a license (police cars have computers and they can bring up photos).  I should also be able to link my insurance data to my driver’s license electronically, so that I wouldn’t have to carry proof of insurance AND the state would have a better sense of who is actually driving without insurance.  Same thing with the fishing license – I shouldn’t have to carry that any more.

Beyond that, when a game warden is checking to see if all of the fisher men and women parked in the lot near the fishing hole have licenses, instead of asking for proof (and stopping the fishing) the game warden could simply look up all of the license plates to see who has a fishing license (and if it turns out that some of the fisherman don’t have driver’s licenses or insurance, he can notify the group that handles that).  I realize some of this is too “big brother” for a lot of our comfort levels, I am simply using this as an example to point out that there are some really clever, available methods to link a person to a piece of information for both security and enforcement purposes, and I hope people have an open mind about what’s possible and smart with these options.

And bravo to New York’s finest for coming up with the DNA indictment, very clever.

-Ric