NIST Standards for New Biometric ID Card Published

rts008 writes "eWEEK is reporting that NIST has published the biometric data specs on the new Federal ID cards for employees and contractors that will be issued in October. From the article: 'Specifically, the guidelines state that two fingerprints must be stored on the card as "minutia templates," mathematical representations of fingerprint images. [...] Guidelines require that all biometric data to be embedded in the CBEFF (Common Biometric Exchange Formats Framework) structure. This ensures that all biometric data will be digitally signed and uniformly encapsulated. This format will apply not only to PIV cards, but also to any other biometric records kept by federal government agencies.'" The published standards [PDF] are also available from the NIST web site.

Comments

No thank you

[gomaze]

I will be doing everything I can to not get one of these. If I decide to give out my information, fine. If I need to make a request from a department of the gov., fine (they already can cross-ref items). I really dont see a need for this, other then to find a way to spend more money.

Re:No thank you

[mcheu]

According to the description, this card is for a new government employee ID. I'm Canadian, so I don't know for sure how this is for the US, but up here, if you work for the government, your government department is already going to have a lot of your personal information. While it's not required for all public service jobs, some positions require to get at least a minimal security clearance, and depending on how high a clearance you need to get, you might get fingerprinted. The only thing new here is that they're encoding all that digitally onto your staff ID card.

It should be rediculously easy to avoid getting one of these cards: Just don't apply for a government job.

Re:No thank you

[Anonymous Coward]

Well that's great if you dont work for the government or work as a contractor. But if you do, like me, it puts you in a terrible predicament. I've been a contractor for several years now, and have talked with my contracting officer about this extensively in the past. He said he won't make me do it,and that he'll resist doing it himself (he's a fed, I'm a contractor). If worse comes to worse, I'll just quit. My job has nothing to do with national security or defense, there's no need for them to have this data about me any more than they would need it from any old citizen. I don't get it, and I won't play.

Re:No thank you

[drDugan]

Just don't apply for a government job

Sorry, it's not that easy. Two problems with this. First, the class of workers that work for/in the gov.t is a huge group, and we have every reason to believe that this class will grow in size.

Second, you run a slippery slope accepting things you disagree with, even if they don't affect you personally. If it's OK for gov't workers, next it will be OK for everyone. Next everyone will need a biometric ID to use a bank, or travel. Next if you have an outstanding issue with the government, -- oops, no money, can't travel, you're outta-luck buddy. Next Canada will say -- it's OK in the US, we should do that here. etc etc etc...

Re:No thank you

[Anonymous Coward]

One could say the system is designed to work this way. It puts you at a distinct economic disadvantage if you don't go along with it yourself.

The government takes money from all, as taxes. It then redistributes the money, but only to those who accept biometric surveillance.

Re:No thank you

[Lord Ender]

Hold up. Why would it not be "OK" to use biometrics for a government ID? What could "they" do to you if you have a biometric-based ID that "they" couldn't do if you just used a driver's license-type ID?

The photo on your license is just another type of biometrics...

Re:No thank you

[LordThundering]

Ah.. u already need a Biometrical ID for Traveling to the US. or at least u will need one as of 8.2006 So.. not big news there. If we need Fingerprints and so on as RFID-Chips to get into ur country, u could just have them yourselves.

New CAC Cards?

[Gyorg_Lavode]

Great, does this mean I have to get another CAC card?

Re:New CAC Cards?

[CaptainJeff]

So you want another Common Access Card card? Then you would need another PIN number... :)

Re:New CAC Cards?

[pedestrian crossing]

Current CACs have biometrics. Remember pressing your thumbs on the reader when you got it?

Re:New CAC Cards?

[fluffy99]

But naturally the format on the CAC cards doesn't comply with the new standard, so you'll see the DOD reissuing all the CAC cards...

Re:New CAC Cards?

[Anonymous Coward]

Good. About 80% of the photo on my CAC has wiped off. Looks good showing to the rentacops every morning =/

Re:New CAC Cards?

[Schraegstrichpunkt]

Sometimes redundancy helps improve comprehension.

Implications for British ID cards?

[pjt33]

Maybe this will kill Tony Blair's "We have to have biometric ID cards first so that we can create the de facto standards" argument. Or maybe that's wishful thinking on my part.

Re:Implications for British ID cards?

[joe 155]

an atricle here: http://www.theregister.co.uk/2006/02/03/clumsy_id_ card_study/ on the subject of Uk ID cards, it seems like they might not be that useful for stopping theft... I still think that they are useful for stopping low level crime if they are linked to a national register of fingerprints and DNA, although in this example it seems to only be the prints.

Re:Implications for British ID cards?

[VJ42]

Maybe this will kill Tony Blair's....argument.

i sincerly doubt it, everytime I see him make any argument he seems to really believe it. I think that if he convinced himself that black was white, he'd carry on believing it to the grave. Even if we don't get ID cards he'll remain convinced for the need for them. The fanatical force with which he puts his arguments, and the way he seems so exasperated with anyone who disagrees scares me at times.

Re:Implications for British ID cards?

[AnotherDaveB]

I still think that they are useful for stopping low level crime if they are linked to a national register of fingerprints and DNA

The police take a DNA sample from everyone they question. They keep this on record whether or not it leads to a charge. So they already have a very, very big database with DNA and fingerprints of all the usual suspects and then some.

It's worth remembering that the the ID card scheme was one of Mr Blunkett's pet ideas. Every gov't job he gets he seems to feel he has to do something which leads to a Captain Chaos string of pointless projects.

The ID card scheme is the ultimate pointless project. The Home Office keep changing their justifications for it because its only value is to control freaks in the HO who want to know where everyone is every minute of the day. Fortunately the House of Lords may have put the brakes on. They've added an amendment to the bill, not yet agreed by the Commons, that the project cannot proceed until a full account of the costs had been produced. That would be embarassing.

Re:Implications for British ID cards?

[mu-sly]

"I still think that they are useful for stopping low level crime if they are linked to a national register of fingerprints and DNA"

Well, you might as well have said "I believe turning the UK into a police state would be useful for stopping low level crime" - because that's what this amounts to.

So what if ID cards can stop low level crime? Why should it be at the expense of the liberty of the rest of the millions of completely innocent, law abiding people living here?

We wouldn't accept CCTV in every room of our homes - even though it would help catch all kinds of domestic violence, child abuse, drug dealers, bomb preparation and so on. We wouldn't accept the government locking us in our homes and selling us a key, every time we wanted to go out - even though that would undoubtedly help cut crime, since people would think twice before leaving the house, so less people out (and the government keeping track) = less crime. We wouldn't accept tracking devices under our skin, even though it would help the police work out who was in a specific area at a certain time and identify potential suspects.

The fact is: being good at stopping crime is nowhere near a good enough reason for having ID cards, especially when they come at the expense of our fundamental liberties.

So they would be good at stopping low level crime... so was Saddam Hussein's regieme!!

If we give up our freedom so easily, remind me what exactly it is that we're trying to preserve here? Because the way I see it, ID cards just cut off our nose to spite our face.

I think the government are going to find out one way or another that the British people (at least, enough of them to completely thwart this system) will not give up their liberties on the back of such a flimsy argument. I for one will take bankruptcy and jail over ID, any day of the week.

I'd rather live with the possibility of encountering crime in a free country, than be locked in a completely safe government-enforced cotton wool wrap in a police state.

You can put a gun against my head, and the answer is still "no fucking way, not now, not ever"... Defy ID!

Fingerprints?

[Old Spider]

But... fingerprints can be stolen. How does storing someone's fingerprint on these cards make them better than any other form of ID? If the image of your fingerprints is on the card, then anyone who has stolen your card can make fake fingerprints... and likely a fake card with thier photo on it and with your fingerprint data. I mean, if they stored your retina patterns and maybe even a snapshot of your brain structure, then I could believe these cards are worth the trouble, but something tells me these new cards are nothing more than a way for whomever is making them to get some government cash by way of a false sense of security. What a joke.

Re:Fingerprints?

[cdrguru]

Making "fake" fingerprints isn't all that simple.

Sure, if you need a fingerprint that withstands some sort of cursory optical examination, that can be done without too much trouble.

But, if they are actually using any of the better techniques, like a guy with an ink roller or a sensor that isn't optically based, you can forget about faking it.

Actually, even just having someone watching as your fingerprint is read is going to deter about 90% (maybe 99%) of fake attempts. You don't get to use a fake finger or most things on your finger if someone is actually watching and looking for that. Not 100% certain, for sure, but nowhere near as weak as you seem to think.

Re:Fingerprints?

[MrAnnoyanceToYou]

Unfortunately, as soon as fingerprints are on cards, along with other biometrics, the cards themselves become much more trusted. One of the dangers of security is the appearance of things being more secure than the actual method. Ergo, much more trusted despite only marginally more effective security. This means that when you get the key to the castle, you have one to all the doors. Not good. This is a case of the added value of having such identification on a card being trumped by the reality that if someone gets their hands on it and the ability to use it your financial life is not going to go well for a seriously long time.

Making a security system more complex does not disallow it from being broken, it simply puts more complex holes in it. The reason anyone wants biometrics on a card is to take advantage of the gathered information, and has nothing to do with wanting more effective fraud reduction.

Re:Fingerprints?

[Old Spider]

That doesn't rule out the 1% of very good fingerprint forgeries and copies which any competent spy would make use of, and that's the primary reason to use these cards. There are better ways to foil a spy is what I'm saying. Try a retina scan. It's a lot harder to copy one. Or a brain scan; that is, using an MRI scan of a person's brain structure. Try copying that. And then all three of these methods could be doubled-up by also scanning to see if whatever is being used as the object for scanning is actually alive (severed hand for fingerprints, plucked eyeball, severed head... if it works in a movie, there's a chance it'll work for real). ...uh... did I mention I watch too much sci-fi? Blow me.

Re:Fingerprints?

[Reaperducer]

But... fingerprints can be stolen. How does storing someone's fingerprint on these cards make them better than any other form of ID? If the image of your fingerprints is on the card, then anyone who has stolen your card can make fake fingerprints

It doesn't sound like they're storing the actual finger prints, but a mathematical representation of them. Which could mean some kind of one-way mathematical hash, like many computers have for passwords. I'm not saying it's perfect, but I don't see how it's possible to take a set of numbers and create someone else's fingerprints. Sounds like someone's dishing out warm steaming bowls of FUD for breakfast.

Re:Fingerprints?

[emptycorp]

Making "fake" fingerprints isn't all that simple.

I guess if you're really that desperate to commit crimes you'll figure out a nice easy way to do it, won't you?

Score 5 Interesting, not hardly.

Re:Fingerprints?

[Anonymous Coward]

Contrary to popular misconception, fingerprints are not necessarily unique. And, while carefully taken prints can be very accurate (to a person's fingers), those found at, say, a crime scene are not. So matching is fuzzy, on top of the fuzziness of non-guarantee of uniqueness (this ain't DNA), on top of the ease of planting fake prints. So, it's like using a person's name to identify them. It's okay for basic puposes, but for anyone whom you would worry about, it doesn't do much. Or, at least when it does, there's a significant chance of the PTB being out to lunch for no good reason. See the September 11th, 2001 highjackers: valid ID, valid names, in government databases as terrorist potentials, and - BAMM -- not a damn thing done about it (nevermind the PDB of a month earlier). Your papers please? Okay, you may pass comrade.

As others have pointed out, this is just an excuse to spend money. The multi-hundred-billion dollar Pentagon budget has to seem to be doing something for the taxpayers, right? Doesn't it?

Re:Fingerprints?

[Intellectual Elitist]

> There are better ways to foil a spy is what I'm saying. Try a retina scan. It's a lot harder to copy one. Or a brain scan; that is, using an MRI scan of a person's brain structure. Try copying that. And then all three of these methods could be doubled-up by also scanning to see if whatever is being used as the object for scanning is actually alive

Agencies are allowed to pack whatever other biometrics they like on the PIV card, and are allowed to use whatever additional security measures they like on their grounds. The two fingerprint minutiae templates are just the baseline requirement.

Re:Fingerprints?

[Intellectual Elitist]

> If the image of your fingerprints is on the card, then anyone who has stolen your card can make fake fingerprints... and likely a fake card with thier photo on it and with your fingerprint data.

They're fingerprint minutiae templates, not fingerprint images. And they're digitally signed and protected by a PIN. Plus the applicant's original biometrics are kept in a secure database as a backup check, and lost PIV cards can be blacklisted and rendered useless very soon after being reported.

Re:Fingerprints?

[kko]

The minutia used by AFIS and most other fingerprint sistems is just a list of points in the loops, whorls, and other curves in your fingerprint. I've seen systems using 34 and 64 such points.

The way fingerprint authentication works is that the image from your fingerprint is analyzed, and the minutia points are extracted and compared to the stored minutia, and a match score is assigned to this comparison. If the score surpasses a certain threshold, then the match is deemed as positive.

More points and higher match scores (or percentages) are used the more secure you want your auth system to be, but depending on the quality of the fingerprints (people with cuts on their fingertips, scrapes and whatnot) raising the threshold and the amount of minutia points will become a liability, requiring you to try many times, or giving false negatives.

For the usual tin-foil slashdot crowd, no this is not an image of your fingerprint, and faking a fingerprint based on a bunch of minutia points is really hard. Current fingerprint readers are not easy to dupe (like the big bricks used by the INS in some airports). So, settle down kids.

Why store them on the card?

[EnsilZah]

If i wanted to verify someone's information, i'd rather do so from a secure database rather than a card he gave me.
Or am i missing something?

Re:Why store them on the card?

[joe 155]

well you seem to be putting a lot of faith in the "security" of the database, I'm reminded of those 35,000 or so patient records which were stolen from an employees car which were supposed to be being held "securely"... at least if someone robs your card they only get one person's data... alhtough it'll probably have a coresponding database anyway, in which case they are just creating more potential problems

Re:Why store them on the card?

[Agelmar]

You're missing the fact that the biometric data (actually, likely all data on the card) is signed. Think of it this way:

The issuer of the card has a certificate issued for that purpose. When the card issuer creates your card, they store your biometric information and a signature of that information on the card. If anyone tries to change the biometric information, the signature is no longer valid. Assuming that the certificate uses strong encryption and that the private part of the certificate's signing key is protected (which are both reasonable assumptions), then the data integrity is ensured.

This makes a lot of practical sense. If you want to pull everything from a centralized database, then your readers all have to be networked. This means that each reader next to every door in the building must be networked, and while that's fine for many situations, in some areas it's not practical. With the signed data on the card, the user can present their card which contains their biometrics and access credentials, the reader can verify this locally, and then act accordingly. Of course you still need to have a way to publish the root certificate and CRLs from time to time, but it does give you more flexibility.

Re:Why store them on the card?

[ElephanTS]

You're also missing that you probably won't 'give' anything to anyone. The British ID cards will probably include RFID in the spec now, though this has been very under-reported.

http://www.theregister.co.uk/2005/07/25/id_card_go es_icao/
http://www.telegraph.co.uk/news/main.jhtml?xml=/ne ws/2006/01/28/nid28.xml&sSheet=/news/2006/01/28/ix home.html
http://management.silicon.com/government/0,3902467 7,39131459,00.htm

I suspect this will apply to the US version too we'll have to see. Politicians are very cagey about this one for obvious reasons.

Re:Why store them on the card?

[atchijov]

I think you are absolutely right. Biggest problem with having biometrics "on-card" is that it is impossible to guarantee authenticity of the data. We are comparing person finger with finger stored on the card. Without communicating with some sort of centralized facility, we only can confirm that these two fingers match. One may argue that data can be signed with some really long certificate/key. But then you will need to verify certificate, which in turn will require "... communicating with some sort of centralized facility...". If we assume that we are going to have private part of certificate available "locally", than we will have two more problems. First one is physical security. Device which contains this certificate can be stolen and certificate extracted. Second one is inability to implement "aging" of certificates. No mater how long it is, if certificate stays valid "forever", it will be cracked. So basically the only way to go is to assume that we can not trust any information on card. And verify fact that finger (and other biometrics) scanned at entry point match with finger (and other biometrics) stored in centralized data base for the person to whom this card was issued to. The only information we are using is some sort of ID. And this ID by itself does not provide any authentication. It just used to get proper biometrics records so we can do "match" instead of "search"

Re:Why store them on the card?

[swillden]

If you want to pull everything from a centralized database, then your readers all have to be networked.

There are also potential security and privacy problems with having a centralized database. I don't know about this particular application, but many systems that employ biometrics put them on smart cards specifically to avoid the security, privacy and potential legal issues associated with having such a centralized database.

Re:Why store them on the card?

[Anonymous Coward]

The biometric data (signed BTW) is stored in secure databases but there are use cases which do not include access to those databases (First Responders to a bio-hazard at a government building during a major black-out).

Also the stored information is detail, not images. The location and orientation of some interesting points on your print are captured and stored. Comparing the real print to the stored info is relatively easy but you cannot re-create the original print from the stored info.

Analogy: Take a city map overlaid with a clear plastic sheet. Circle a bunch of interesting intersections (with a few notes about what makes them interesting). Given the same city map, you can validate it using your overlay, but you cannot recreate the entire city map from the overlay. Which intersections connect up to which? What interesections were not included?

As always, the privacy issue is still valid, but losing our privacy is not dependent on the government using biometrics. Don't fight specific technology that can be used incorrectly, fight for broad protection from intrusion in ALL forms (whether popularly publicized or not).

Re:Why store them on the card?

[mattpalmer1086]

I don't think you understand public key infrastructures. Certificates are a way of distributing signatures in a way that they can be verified locally without requiring communication. Each certificate gets signed by someone else, in a chain of trust.

Of course, if a hierarchical PKI is used, you will need to already trust the root certificate signers. If a web of trust is used (like PGP), you must make your own decision.

India's richest temple has already implmented this

[ravee]

Biometrics is widely used in India's richest temple at Tirupati(which is also worlds richest one). Infact, if the devotees have to get into the temple, they have to get their finger print copied to a database using biometrics and they are alloted a time to enter the temple. This is because over quarter million people daily visit the temple and crowd control is a big job for the administration.

Brilliant idea!

[David Horn]

I know, let's make people carry around a card with copies of their fingerprints and retinal scans on it. You know, just in case they forget to bring along their hands or eyeballs.

Re:Brilliant idea!

[LiquidCoooled]

BLACK KNIGHT:
        'Tis but a scratch.
ARTHUR:
        A scratch? Your arm's off!
BLACK KNIGHT:
        No, it isn't.
ARTHUR:
        Well, what's that, then?
BLACK KNIGHT:
        I've had worse.

So...

[damneinstien]

will it be digitally signed?

Yes?!? WHOA!

I am more concerned

[binkzz]

That one day these will be mandatory, and that they will be placed as a chip under the skin of the hand or the forehead. If you don't have one of these chips, you won't be able to pay for anything or even buy food.

Re:I am more concerned

[Anne Thwacks]

Doomed, doomed,

Just cos you cant buy bread, doesnt mean you won't get bird flu!

Re:I am more concerned

[markdavis]

We should *NEVER* allow the government to collect finger prints of citizens en-mass.

Why? Because once they are in a database, you WILL be a suspect EVERY time a fingerprint is run at every crime scene. It *WILL* be used to track your movements, eventually, whether you believe it or not. And once they are collected, they will *NEVER* be removed from the database, regardless of any change of law.

Fingerprints are left all over the place all the time. They can be searched without the person's knowledge or permission. A retena scan, however, I will provide (reluctantly) to the government for ID purposes because unlike fingerprints or DNA, I am not leaving my eyes all over the place. I will know EXACTLY when and where a retena scan is performed.

Before someone mentions it: Minority Report is pseudo-science *fantasy*. It is not and will not be possible to scan someone's retena from afar, it defies the laws of optics.

As usual, the sheep are quite willing to give up all their rights and privacy in the name of safety. Life isn't safe, and I don't want to live in a "safe" world if it means someone is constantly watching me and telling what I can do and where I can go.

Re:Fingerprints- Come on read the summary at least

[Anonymous Coward]

They don't store the actual fingerprint. They store what ammounts to a hash of your fingerprint.

4th Amendment violation?

[Antony-Kyre]

I'm not so sure if it's legal to mandate that the employees give up their fingerprints like that.

Below is the part of the 4th Amendment in which I am referring. Aren't our fingerprints considered to be part of our property? Isn't mandating that they collect our fingerprints without being suspected of a crime an unreasonable search? (It's one thing to do a background check and ask for fingerprints. It's another thing to require your fingerprints be on a card you have to carry around.)

The right of the people to be secure in their persons, ... against unreasonable searches and seizures, shall not be violated,

Re:4th Amendment violation?

[NewbieProgrammerMan]

I'm sure there's a good chance that the 4th amendment can be reinterpreted by the Supreme Court to find that the federal government is empowered to require almost anything of federal employees. And an even higher chance that a team of federal lawyers can write reams and reams on how there's nothing to worry about unless you're a terrorist.

<dons flame-retardant suit>

Of course, even if it doesn't officially get interpreted that way, US Presidents seem to be able to get away with doing things that they aren't empowered to do (except receive blowjobs in the Oval Office and tell G. Gordon to break into Democrat headquarters). After all, it's just a goddamned piece of paper!

Re:4th Amendment violation?

[Aladrin]

You are not 'giving up' anything. You are simply recording your identity, like you already have several different ways just to be hired in the first place.

They are not requiring this to live in the US, or a certain posh suburb. They are requiring this to work for the government and be party to some information, regardless of how public that information actually is. If you don't want to record your fingerprints (an utterly harmless and costless procedure for the participant) then you can just not work there.

If you want to take the 'you shouldn't be required to give up anything' logic backwards, then they shouldn't be required to give their name, address, social security number, or countless other pieces of information.

Heck, criminals should be allowed to work for the government (other than the obvious ones that already are, I mean) because they shouldn't have to 'give up' the information about their criminal past.

Is there a point that invades privacy too much? I'm sure there is. Fingerprints, retical scans, and other harmless, non-intrusive collections of data are not in that list. They aren't consenting to a wiretap or letting the government read their mail/email, they are just proving they are who they are, daily, with little hassle.

I worked for a company that required I carry a badge that opened the door downstairs. I fail to see how this is more bothersome or intrusive, unless there are worries about a felony coming to light.

If it was taken a step further, and they were required to 'log in' to terminals everywhere they went, then that would be a breach of privacy. And I mean everywhere, not just at government buildings.

Re:4th Amendment violation?

[stubear]

Wow, yet another Slashbot who apparently has never read the U.S. Constitution. What a shock. For your education, and hopefully hundreds of thousands of other clueless Slashbots worldwide:

Amendment IV

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (emphasis mine because you apparently missed that word)

Note the word unreasonable. In the case of a federal job, it is not unreasonable to expect that the persons working there be required to undergo some form of background security check and be required to pass through one or several layers of security before entering the premises. There is no subversion of the U.S. Constitution here and no need for the Supreme Court to become involved. It is also quite likely that this situation could never be used to track terrorists or subversives because they would likely fail the security check before even getting the job.

Re:4th Amendment violation?

[XMilkProject]

They aren't making you do it. You can do it if you want to participate in the government job, which would be a privilege, not a requirement.

For instance, I worked on an Airforce base, and had to get a security clearance, they took plenty of fingerprints and other things, as well as interviewing family, girlfriends, teachers, etc. They also monitor your credit, and other such things.

Of course I was giving up almost privacy, but this was a choice I made to work on a peice of software which was classified as secret. I was not required to do so.

Re:4th Amendment violation?

[/dev/trash]

That's odd. Why would your girlfriends matter?

Re:4th Amendment violation?

[XMilkProject]

They are surprisingly detailed in their background check. For instance, someone I know had their clearance revoked because his fiance had been a member of what could be considered a socialist organization while she was in highschool (and she was nearly 50 at the time of the investigation).

They basically are searching for any association between you and various factors that they consider 'signs' of a likelihood that you might betray your country. So if your dad donated money to a political group 20 years ago that they consider anti-american, you'll never have a security clearance.

A problem I had, was that I had an unpaid cable television bill from many years ago, which I suppose to them was a sign that I might have a history of money problems, which might mean that I would accept a bribe for government information. It took me a while before my clearance was approved.

Of course I am not saying there is a problem with the process, as there are very rarely issues with 'leaks' of secret information relative to how many people have access to it.

Re:4th Amendment violation?

[DarkVader]

Actually, the word unreasonable was meant to apply to the standard required to obtain a warrant.

The theory in the constution was that NO search would be carried out by the federal government without a warrant.

This has, of course, been thouroughly perverted today.

Re:4th Amendment violation?

[StikyPad]

Well, it's not really the President; he just signs the laws. Congress can pass whatever law they damn well please, constitutional or otherwise. The strength/weakness of judicial checks are such that the S.C. can only review laws, and only when a legitimate case is brought before it. The effect is that it can take years (although it can be much quicker) for an unconstitutional law to be struck down. Further multiply that with the difficulty in bringing a suit against the government to court at all, and the Constitution is more of a "rough guideline" of congressional power.

Executive orders are another problem, but it's unlikely (though possible) that a national ID card system would be enacted by executive order.

Re:4th Amendment violation?

[/dev/trash]

So one late payment could screw up clearance? Sheesh, could anyone get clearance.

Re:4th Amendment violation?

[rkcallaghan]

Is there a point that invades privacy too much? I'm sure there is. Fingerprints, retical scans, and other harmless, non-intrusive collections of data are not in that list. They aren't consenting to a wiretap or letting the government read their mail/email, they are just proving they are who they are, daily, with little hassle.

I heard almost that exact quote said to me almost 15 years ago, only they were saying they were sure that updating your residence info to the DMV wasn't it, after all it is not like the government wants retinal scans or fingerprints.

~Rebecca

Re:4th Amendment violation?

[Metasquares]

I don't know what level clearance your friend was going for, but they only go back 7-10 years for the ones on the SF86. ...Or that's what they say, anyway :)

Re:4th Amendment violation?

[stubear]

Actually, no it wasn't, it was meant to apply to the searches and seizures themselves. It was ten left to juries to determine if teh search was unreasonable or not. The language is very clear here, as it is throughout the entire doucment, being argued completely before all state delegates would agree to its terms. There was no spirit of the law because there was no room at the time the Constitution was written for spirit of anything. If it wasn;t spelled out clearly then it was gong to fail utterly. The Articles of Confederation was clearly not going to be a very lasting legal basis for the colonies to maintain a sustainable seperation from England and something had to be done about that. But don't believe me, read America's Constitution by Akhil Reed Amar, a Yale law professor and arguably onf of the foremost Constitutional scholars.

Static bad; biodata static :. biodata bad.

[Errandboy of Doom]

Aren't static keys always inferior to dynamic keys?* (Isn't that why we're supposed to regularly change our passwords?)

Isn't biometric data static?

So why is anyone interested in biometric security?

Isn't it (perhaps counterintuitively) an inherently insecure means of indentification, by its very nature?

I must be missing something.

*(Maybe this is because anything can be duplicated and forged, given enough time. Changing your key a lot makes forging impractical?)

Re:Static bad; biodata static :. biodata bad.

[maxume]

Simply, this is better than a card without the fingerprints. See:
http://it.slashdot.org/comments.pl?sid=176330&cid= 14646699

for why it is more 'trustworthy'. As long as the data is signed and the data stored isn't sufficient to generate fingerprints from, a biometric card like this does a pretty good job of ensuring that the card was issued to a person with matching fingerprints.

As far as biometrics providing 'static' versus 'dynamic' keys, if the card stores a salted hash of the actual data, then the keys are dynamic enough to be re-issued. New salt every month or whatever, for newly issued cards. As long as your secret sauce^h^h^lt stays secret, it's fine.

How sure you are that only authorized cards are issued(how secure is your trust mechanism) isn't really part of evaluating the card. It might make the card impractical, but it doesn't change the fact that it is better.

Identity is *hard*. I like to think of my drivers license as a symbol of the fact that the State of Michigan believes I am who I say I am. Other peoples drivers licences are either symbols of the same, or that they were willing and able to pay to fake it. I know I am me, and I know I obtained the license, so I don't have to make the exception for mine being fake. You still do. It is still useful to issue them, as it allows other people to say 'Michigan is careful enough that I can trust that card this much' and use it as my identity with lower risk(probably) than just using whatever I say.

Re:Static bad; biodata static :. biodata bad.

[qodfathr]

Actually, some biometric data, fingerprints included, is not static, at least as far as much as the current reading technology is concerned.

Over time, our fingerprints do change -- the lines become broader, for example. A system which is required for the entire population (children included) needs to be able to compensate for the fact that for nearly the first two decades of life, our hands are physically growing.

In fact, many fingerprint systems start to fail after 6 MONTHS of deployment due to changes in user's fingerprints brought on by heat, humidity, water retention, etc. Our fingerprints are much more dynamic than people realize, and often these changes result in the minutia match score falling below the match threshold (i.e. lots of false negatives).

Some companies have fingerprint reading technology designed from the ground-up to deal with these kinds of issues; Liska Biometry comes to mind.

Re:Fingerprints- Come on read the summary at least

[ScrewMaster]

So, if I were a secure cow, would that be a roast beef or a corned beef hash?

Cripes, it's way past lunchtime ... no wonder I'm thinking about food.

Are you a "federal employees and contractors"?

[Browzer]

If you are, how is this any different than for example the generic attire/monkey-suit your employer expects you to wear?

If you are not a federal employee and/or contractor, please have a sit and keep your mouth shut.

Thank you.

P.S. Why does everything on slashdot has to be blown out of proportions?

Security by obscurity

[truthsearch]

NIST has published the biometric data specs on the new Federal ID cards

So much for security by obscurity! C'mon people, haven't we learned anything from Microsoft's security model??? /end_sarcasm

Re:India's richest temple has already implmented t

[Anonymous Coward]

Biometrics is widely used in India's richest temple at Tirupati(which is also worlds richest one). Infact, if the devotees have to get into the temple, they have to get their finger print copied to a database using biometrics and they are alloted a time to enter the temple. This is because over quarter million people daily visit the temple and crowd control is a big job for the administration.

As opposed to, say, a simple low-tech reliable cheap solution with no privacy issues, like tickets?

So what happens if...

[Teresh]

What happens if someone reverse-engineers the technology to get my fingerprints out of my card? Am I going to be charged for any crimes this person then goes and commits with my prints?

Social Engineering

[Doomedsnowball]

Shoot... people are still the weakest link in any security system involving semi-intelligent primates. Even if TFA is talking about merely ID'ing someone accurately, there will always be a system to circumvent "the system."

Amputees?

[Anonymous Coward]

What will happen if it is required to have these biometrics, and someone is an amputee? I'm just wondering if biometrics will absolutely be necessary in the future, i.e. to unlock encryption, or if this is just meant as a formality.

I But ticket aren#t tied to you

[aepervius]

So if you break the "Do and Don't" (see the web site of teh GP) of them temple, well though luck for official if they are using ticket, they won't be able to easily kick you out next time you come or filter you out. But I guess this can be easily done with a finger print : I can imagine the next time the pelerin comes up and the system helpfully offers a pop up which says "was too long. Did speak loudly." he will be refused entrance. This is the advantage of biometric over simple ticket.

Because you cannot forget it.

[khasim]

The only advantage biometric data has is that the user cannot lose it or forget it.

Other than that, if someone is watching you authenticate, it might be possible for them to see you using a fake finger or something.

Re:Because you cannot forget it.

[drDugan]

i love it when people keep missing the difference between data and physical things.

to "lose" a physical thing mean you don't have it and (maybe) someon else does, or it's missing

to "lose" data means you do or don't still have it but someon else certainly does have it

this an important, and subtle difference, and why there is such a huge series of arguments over IP

saying that one "can't lose" biometric data misses the OP's point. one certainly can lose biometric data. if I put my fingerprints on the glass the fed gives me during the interrogation, I've lost my biometric fingerprint data to them

Re:Because you cannot forget it.

[mattpalmer1086]

The advantage biometric data has is it is the only thing that is (hopefully) uniquely bound to the individual to whom you want to control access to something. This has the advantage that the individual can't (accidentally or otherwise) pass their access key, or password to someone else, and neither can it be stolen - as long as liveness is part of the measurement. Of course, then we have coercion... nothing is perfect.

It is often combined with other forms of authentication material (something you know, something you have).

Minutia Templates

[Epicyon]

What is being stored is the mathmatical representation of the fingerprint, not an image of the fingerprint itself.

It is not possible to recreate the image of a fingerprint from the template.

Re:Minutia Templates

[pesc]

What is being stored is the mathmatical representation of the fingerprint, not an image of the fingerprint itself.

True. To get the image of the fingerprint, it is much easier to actually lift it from the surface of the card, since the owner has probably touched it before you stole it.

Since you leave your fingerprints on anything you touch, are you going to wear gloves 24/7 when you get your biometric card to try to keep your fingerprints "secret"?

You can't get the fingerprint out of the card

[Anonymous Coward]

What is stored for biometric data is not an image of the fingerprint or anything like that. It's actually a hash of your fingerprint. Ideally, it would be a one-way hash (such as a cryptographic hash of your password stored in the .shadow file on a linux box). It should be "hard" (in the CS/math sense of the word) to find an actual fingerprint that will recreate the hash.

Re:Are you a "federal employees and contractors"?

[Reaperducer]

P.S. Why does everything on slashdot has to be blown out of proportions?

Because whether the information is right or wrong, Slashdot makes money on the page views. They're not the drug dealer. They're not the cop. They're the informant that makes money from both sides.

Move to New Hampshire

[takeya]

Move to New Hampshire, if this passes: http://generalcourt.org/bills/2006/HB1582

And if you're up for it, join the Free State Project.

I'm so glad I live here... and so glad that that bill is on the table, and has a lot of support.

Project website

[Midnight Warrior]

For those seeking to follow the actual PIV program for federal employees/contractors, check out their home page.

Why would you want to verify MY info?

[DaedalusHKX]

I've been using CASH... you need to verify nothing. You and your draconian pigs are demanding too much of me. I will give you cash, and you will give me what I'm PURCHASING from you. I don't need to finance a fucking eggroll! You don't need to know why I'm buying 10 fucking pizzas!! If I'm diabetic and buying sugar, that is MY problem. Maybe I want to die. Who are you to push your draconian and religious bullshit on me?? As long as I don't dump oil into the oceans like your fine christian values oil tycoons (whitehouse.gov) then perhaps you can fuck off and let me live a free life!

Debit cards only for minor things like food and other less "traceable" things I always make sure to buy PORK on a CC so that they know I'm not a muslim... and therefore I cannot be falsely accused of terrorism... we all know how easy it would be to remove a dissenting voice on grounds of "conspiring with enemy because they disagree with fanatical christian pigs" type thing)...

All in all, I buy mostly in cash, especially books. No membership clubs or any such shit. (And the times I've used one, I use a fake phone number... go figure eh?)

I Hate traceability because it does EXACTLY what government control mongers want. Reduce responsability by users, it reduces accountability, and overall increases nothing but convenience for the money printing gods of our world.

I would prefer to never see another consumerist pig tell me how they want to identify me... fuck you... and I'll bring my own cup, just gimme my fucking coffee thank you. (Actually speaking of which, I'd like to see more shops offering larger discounts for being responsible and bringing your own damn cup...)

~D

Re:Why would you want to verify MY info?

[Original Replica]

you must work for the Post Office.

Re:Why would you want to verify MY info?

[DaedalusHKX]

That sucks... why say that and not post any supporting evidence or arguments?

At least add some opinion, so I know what your comment was based on.

~D

Quality of the card is irrelevant

[XMilkProject]

It really doesn't matter how secure the card system is. Why would I try to crack the card when I could just offer a small sum of money to the nice lady working the security desk, and making the cards?

Or if she's got too much integrity for that, I suppose I could just kidnap her son/daughter? I'm quite confident she'd make me a card then. And I didn't need any technical skills either.

Maybe I just catch all the security guards while they are at lunch and bribe them to go ahead and let me in without a card? I'm quite confident for the right sum of money they would help me out.

The point i'm making is that all these technological means are only to stop the unmotivated criminal, which is why the level of security on them is only marginally important. For anyone that is sufficiently motivated, the card is irrelevant.

Kinda like having locks on all the doors of your house when there are glass windows all the way around. The lock keeps the neighbor kid from wandering into your home, but anyone who actually wanted to go inside could do so with a rock, probably more quickly than you could unlock your door with a key.

Re:Quality of the card is irrelevant

[Intellectual Elitist]

> Why would I try to crack the card when I could just offer a small sum of money to the nice lady working the security desk, and making the cards? Or if she's got too much integrity for that, I suppose I could just kidnap her son/daughter? I'm quite confident she'd make me a card then.

Because the PIV system is designed so that a single corrupt person in the chain can't wind up issuing a valid credential. The person who sponsors your application is different from the person who collects your biometrics, who's different from the person who puts together your physical card, who's different from the person who checks your biometrics against the final card and issues it to you. You'd have to bribe at least a couple of people in that chain in order to get an illicit card that actually worked.

Re:Quality of the card is irrelevant

[Anonymous Coward]

No single individual can issue a PIV card. It requires multiple authenticated individuals. One of those individuals may be the individual running the security desk, but they cannot create cards on their own. This is basic security practice folks.

Bribing all the guards may work but securely archived video surveillance would show the incident.

You're right that no security system is perfect but this card is part of a deliberate effort (a Presidential Directive no less!) to set the barrier in resources and sophistication higher than in the past. It is improved security, not perfect.

CBEFF?

[nurb432]

Just the fact that such a standard even exists is rather scary.

Who wants to take odds on how long before these ID cards are made manadatory for all US citizens? "for our safety".

Re:CBEFF?

[/dev/trash]

Like Drver's Licenses are now? Oooooo, no Big Brother is watching me.

Avoidance

[nurb432]

If you read the story more closely its only for Federal employees and contractors, for now.

That will of course be expanded in the future, but for now just avoid being employeed at the federal level and you are set.

Cart before the horse

[schwit1]

This card is supposed to contain fingerprints as an important part of ensuring a person's ID, but as far as I know there is NO federal standard for matching/comparing fingerprints. The boondoggled Mayfield case should be proof enough that as fingerprint IDs are not ready for prime time.

Lessons From The Brandon Mayfield Case

Re:Cart before the horse

[Intellectual Elitist]

> This card is supposed to contain fingerprints as an important part of ensuring a person's ID, but as far as I know there is NO federal standard for matching/comparing fingerprints.

There's no mandated matching algorithm, but there are minimum performance requirements for fingerprint authenticators before they can be certified. See NIST SP 800-76 [PDF] for details.

How does this prevent fake IDs?

[Chuck_McDevitt]

What stops me from making a fake ID card, that says I'm somebody else, but with MY fingerprints encoded in the card. So, when I go to use the card, they look at the fingerprint data on the card, compare to my actual fingerprints, and suddenly I've "proved" I'm the right guy.

Re:How does this prevent fake IDs?

[Intellectual Elitist]

> What stops me from making a fake ID card, that says I'm somebody else, but with MY fingerprints encoded in the card.

The fingerprint minutiae templates are digitally signed and protected by a PIN, and the cards are only issued by approved PIV Issuers who have to get all of the data used on the card through a secure network that you wouldn't have access to. And even if you did, you'd have to corrupt at least two of the major players in the issuance process in order to create a fake card.

Re:How does this prevent fake IDs?

[Anonymous Coward]

What stops you? Your fingerprints won't be signed by the government.

An the card isn't just a picture and biometrics, the biometrics is an incidental feature to the core PKI certificates. To do anything interesting you'd need those certs.

Another poster wrote that signing doesn't help because you'd need to be online to validate. Interesting, but wrong. Validating a signed fingerprint requires the public key of the signing authority, which does not change frequently and can be stored in offline devices.

Beast, Mark of the

[JackDW]

Here, for perhaps the first and only time, you may be lucky that your country is run by fundamentalist Christians. The same logic that drives them to kill abortionists and ban good science also tells them about the Mark of the Beast. Whatever the mark was supposed to be, its aim was exactly the same as the aim of a mandatory ID card: centralisation of control.

Good

[/dev/trash]

Think how much prices will go down when retail theft is eliminated.

Re:Good

[DrSkwid]

Not one pence.
The price of goods is what people will pay, not what they cost to sell.
This is called the Elasticity of Demand.

Re:Good

[Anonymous Coward]

errmmm, I think you might want to check that your humour detector is functioning correctly.

Re:Good

[/dev/trash]

So the signs I see in Wal-mart: "Keep prices down, don't shoplift." are a lie?

Re:Good

[binkzz]

Yes. Companies will sell at the highest possible price they can get you to pay. If they don't have to lower prices, they certainly won't. Shoplifting causes considerable dents in profits to companies like Walmart, but if all shoplifting stops, Walmart's prices would remain the same.

One certainty in life is a company like Walmart's greed.

For another thing, why should you care about keeping the price down when you shoplift?

Re:Good

[DrSkwid]

Good boy, keep doing what they tell you and you'll be okay.

Re:Good

[/dev/trash]

exactly. What's the use of being a when yu ananannnnakakNO CARRIER

Re:No thank you MOD UP

[drDugan]

The world needs more people with your understanding and convicition. I too will not be getting another passport (when my current one runs out) or any biometrically - linked ID card if the current trends continue. I will chose not to drive to avoid this.

This is yet another example of where technology advances will support inflexibilty in rule enforcement. (other examples include red-light camera, DRM, etc.) In each example, human judgement is being taken out of the loop in the enforcement of a particular rule. Next it will be a machine that decides if you are who you say you are, not a person looking at you, knowing you, or judging the picture on a badge. This is yet another hook in someone that brings us a step closer to the possibility of tyranny.

As long as all the rules are fair, equally enforced, and democratically supported -- then there is no problem with machines enforcing the rules. The problem is that more often than not, none of these factors apply and rarely do any of them apply. Rules are often created arbitrarily by property owners / corporations (like EULAs), supported by small fractions of the people they affect (speeding laws), or simply conflict with other accepted rules (copyright/DRM and fair use).

Re:this schmuck

[RobertLTux]

as it so happens in a few cases even a random string of letters/numbers could be very identifiable take my case if you look robertltux is used as a login name on quite a few different sites (its the one i always try to grab) now if "robertltux" says xyz chances are very good that I am the one that said it now an AC is one of thousands (or it could be said one of six billion) but how many of me are there?

Drver's Licenses

[nurb432]

At least those are state based, and not used to track your day to day movements.

Yes i know there is talk of going to a federally based ID instead, with realtime tracking of citizens. But we arent there, yet.

Re:Are you a "federal employees and contractors"?

[Anonymous Coward]

Is the federal government, my federal government, having a policy it plans to implement? Is this a policy of my government? Is this political? Is this something I see as wrong and would like to stop my government from doing? Then, yes, I will stand up and speak, you dumb fuck. You can sit down and STFU. There, there, be a good little sheep. Maybe later tonight you'll be picked for pleasuring the herder. That's what you're waiting for, right? Some good oh-so-consensual loving from your master? Do be good and obey. You'll like it.

Lets see, parent thread is related but FB and OT??

[DaedalusHKX]

I swear, if someone acts outraged, they get modded down.

If someone blows up 100 thousand innocent lives in Iraq and Afghanistan as part of a mismanaged campaign to spread religious "democracy" to countries antithetically opposed to "real" freedom, then they almost make it to Time's man of the century.

I am noticing a bit of "lets be pussies and maybe the christian fanatics in Washington DC will notice us" (before their jackbooted ubersoldat's cave our faces in)

BACK TO TOPIC... READ THE POST ABOVE, READ THE ARTICLE AND MOD THE PARENT APPROPRIATELY!!! It is neither OT, but a bit FB maybe. Overall, if nobody gets angry, nothing ever gets done. You all would know that if you lived up to the Founding Fathers' rebellious attitudes. We need some muck rakers since the news organizations SUCK!

~D

Re:Fingerprints- Come on read the summary at least

[Scarletdown]

So, if I were a secure cow, would that be a roast beef or a corned beef hash?

And taking it even further...

If you were a secure cow in Amsterdam, would that then be a roast beef or a corned beef hashish?

Thanks,

[Errandboy of Doom]

Illuminating response.

need networked readers to instantly revoke access

[Anonymous Coward]

Data integrity is only part of the picture. These are access cards so readers do need to be networked -- because that's the only way to universally revoke a card's ability to grant an individual access -- remember these are supposed to become the universal government building/room/computer access cards and you do NOT want a delay in revoking the access of a fired California-office CIA agent's access to Washington-area headquarters just because you're gambling they are not motivated to take a cross-country plane to use their card before their status change catches up with the East-coast card readers.

Re:India's richest temple has already implmented t

[JimBobJoe]

This is because over quarter million people daily visit the temple and crowd control is a big job for the administration.

I rather doubt that it works very well. The American Association of Motor Vehicle, in a 2004 policy document, noted that the best fingerprint scanning equipment (used to just take one fingerprint and compare it to a fingerprint already in the database) can, at their best, work at a ratio of 1 to 10,000. (Meaning that once you get over 10,000 fingerprints, you incur the wrath of Type I and Type II errors, depending on how you've configured things.)

In case any one is interested, AAMVA is interested in biometrics only when they are reliable at 1 to 300 million.

Yes I am.

[WallaceAndGromit]

Yes, I am a US government employee, and this does bother me. I can honestly say that I was not aware of this change to ID requirements before reading this thread, and will distribute this thread to my colleagues at work, whom I believe would also be bothered by it.

You can not trust any information on this card

[atchijov]

I think biggest problem with having biometrics "on-card" is that it is impossible to guarantee authenticity of the data. We are comparing person finger with finger stored on the card. Without communicating with some sort of centralized facility, we only can confirm that these two fingers match. One may argue that data can be signed with some really long certificate/key (as they are in NIST standard). But then you will need to verify certificate, which in turn will require "... communicating with some sort of centralized facility...". If we assume that we are going to have private part of certificate available "locally", than we will have two more problems. First one is physical security. Device which contains this certificate can be stolen and certificate extracted. Second one is inability to implement "aging" of certificates. No mater how long it is, if certificate stays valid "forever", it will be cracked.

So basically the only way to go is to assume that we can not trust any information on card. And verify fact that finger (and other biometrics) scanned at entry point match with finger (and other biometrics) stored in centralized data base for the person to whom this card was issued to. The only information we are using is some sort of ID. And this ID by itself does not provide any authentication. It just used to get proper biometrics records so we can do "match" instead of "search"

Reading through some other posts, I learned that fingerprints on the NIST card will be protected by certificate AND pin. Here we have another problem. One of the most important features of biometrics (at least for private sector) is that people will not need to remember passwords (and IT departments will not need to spend endless hours/$$$$ to reset these passwords). Once you introduce PIN, you will re-introduce problem of people forgetting such pin.

Re:You can not trust any information on this card

[mattpalmer1086]

No. This is not true. With a PKI, at some point you have to trust someone. This can be a list of the public keys of a very small set of "root" certificate authorities, which can be stored locally, meaning no central communication required.

The private key is not required locally and is not embedded in the certificate. The private key is used to sign a certificate, and it never leaves the possession of the entity it belongs to. A public key lets you validate that the signature is correct (only the person with the matching private key could have produced it).

Public key cryptography changes the problem of having to previously share a secret with everyone you want to communicate with (symmetric crypto) to one of trusting that the public key of an entity you are dealing with is correct. This can be postponed indefinitely, with chains of certificates and signatures vouching for each other, but at some point you have to trust that a public key you use to validate the signature on a certificate is correct.

Read up on it, it's really fascinating.

Government inspired by media

[po8]

It's nice to see our government working to make this vision a reality.

Have they made a working fingerprint scanner yet?

[Joce640k]

a) Fingerprints are easy to steal...much easier than, say, a wallet and you can't tell they've been stolen.

b) The state of the art in fingerprint scanners are still fooled by lumps of silly putty with fingerprint pictures on them.

http://www.google.com/search?q=fingerprint+scanner +jello+putty

Do you think we should tell people? Or should we just cough up the tax dollara for yet another useless "security" scheme, like we always do?

Fachism creep

[Oldsmobile]

Parent is right. This is the first step towards a national ID system. Another is the PASS card required for travel to Mexico or Canda.

I live in a country with a national ID system, but I'm American and still really worried about this. I think we're talking about two different cultures here. In a European country, ID's have strongly agreed upon usage and there is a culture of checks and balances, your personal information might be known by the government, but strong rules based on tradition control the use of that information. No such thing in the States, where these systems are basically being implemented to increase control over the populace.

I call this one an example of "Fachism Creep".

Middle Fingers

[coinreturn]

They can put my two middle fingers on the card.

Drat I guess this means

[colk99]

As I am a federal employee I will be getting one (I work for the USPS)

*cough*

[loqi]

Minority Report actually featured iris scans, not retinal scans (which are scans of the retina, not retena). But by all means, feel free continue to lecture the "sheep".

Re:*cough*

[markdavis]

Actually, you are probably right about it being an iris scan. But doing that to a moving target from dozens of feet away, various eye position, varying pupil size, glasses, etc is probably just as unrealistic/impossible.

Oh, and if the sheep didn't need lecturing, then we would have far less problems. If are aren't a "sheep", then do ignore the posting- wasn't meant for you. But by all means, continue to nit pick on postings.

Re:*cough*

[loqi]

But doing that to a moving target from dozens of feet away, various eye position, varying pupil size, glasses, etc is probably just as unrealistic/impossible.

This actually made me laugh out loud. Impossible? You must be the most technologically pessimistic /.'er in history. None of the factors you mentioned are even remotely any kind of fundamental barrier. Unrealistic? Minority Report features telepathic mutants who can predict the future, and is set what, something like 30-50 years in the future? It's a complete straw man to assume that people are equating Minority Report to modern technology in the first place.

Oh, and if the sheep didn't need lecturing, then we would have far less problems.

Please, grow up. Your use of the word "sheep" is not only practically devoid of content, it's also chock full of self-important arrogance. "Oh, the sheep are so stupid! If only everyone was as smart as me!" If you are actually a remotely intelligent person, the least insightful thing you could be doing (yes, even less so than bothering to address some netizen about the failings of their public writing) is complaining about how dumb everyone else is. Please spare the rest of us (intelligent and otherwise) from the sight of your wanking.

Re:*cough*

[markdavis]

>Your use of the word "sheep" is not only practically devoid of content, it's also chock full of self-important arrogance. "Oh, the sheep are so stupid! If only everyone was as smart as me!"

I never called people stupid nor implied I had all the answers. But there is a large segment of the population that does exactly what they are told without questioning anything. I see it all the time. I don't have all the answers, but I do hope to at least incite people to think about the ramifications of their choices. Sure, I could have done it better, but it is a slashdot post, not an article or book!

>If you are actually a remotely intelligent person, the least insightful thing you could be doing (yes, even less so than bothering to address some netizen about the failings of their public writing)

Oh, savior of the mediocrity, seems to me that you are more interested in picking on spelling and word choice than addressing content. Maybe if you stuck to the topic and less to personal attacks and I worked more on better word choice, then we wouldn't be wasting time on this exchange.

Re:Are you a "federal employees and contractors"?

[Anonymous Coward]

If you are, how is this any different than for example the generic attire/monkey-suit your employer expects you to wear?

If you are not a federal employee and/or contractor, please have a sit and keep your mouth shut.

Thank you.

P.S. Why does everything on slashdot has to be blown out of proportions?

There's a difference between wearing the mandated uniform and having the uniform identify you.