CDR: Re: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)

[Tony Bartoletti]

At 07:09 PM 10/18/00 -0700, Ed Gerck wrote:
>Tony,
>
>Your examples were so bad!
>
>;-) of course, I meant "good" as in that new IBM commercial where the IBM 
>guy says that
>the IBM laptop is "bad" ;-)

Thanks :)

>"identifty theft" -- which simply is not a theft, it is impersonation.  Of 
>course, I
>continue to hope that we in crypto don't have to use "identity theft" as 
>well. But,
>should they can continue to use it?
>
>Some lawyers don't think so, including Mac Norton in this list who wrote:
>
>  Speaking as a lawyer, one of "they,", they should not continue to use
>  it.  Identity theft might be accomplishable in some scenario, one in which
>  I somehow induced amnesia in you, for example, but otherwise the use of
>  the term to cover what you rightly point is simply impersonation, does a
>  disservice to my profession as well as yours.

There is "my sense of my identity", which works for me in many ways.  Short of
amnesia or devious brainwashing, that identity cannot be lost, stolen, or even
diminished or tarnished in any way without "my consent".

There is "other's sense of my identity" which works also for me in important
ways. It gets me recognized, allows me access, etc.  When I am maliciously
impersonated (impersonation itself not a crime I think) then the quantity we
call "other's sense of my identity" has been polluted, vandalized, and in the
most plain of terms, I have lost the facility of that identity needed in my
relationship to others.  And someone else has gained from its use.

Technically, one can argue that this is not "theft" of one's identity.

(Would you grant it is "misappropriation of one's identifying attributes"?)

But "impersonation", while very accurate, describes a method more than it
does the crime itself, much as "discharging a firearm" is accurate, but
says nothing about the intent, the target, or the damages.

The term "impersonation" can apply to a role, as in impersonating a
police officer or a doctor.  In such (ironically "impersonal") cases,
no individual police officer's or doctor's identity (or character or
reputation) is in any way involved.

This being the case, how to distinguish (give a name) to the crime that
DOES involve usurping the identifying attributes of a individual person,
to the diminishment of their character or reputation?

Even "identity impersonation", while more specific, does not carry the
connotations of criminality.  (If I am invited to the wedding of a distant
obnoxious relative, and pay a friend of mine to impersonate me at that
wedding, I may be guilty of poor ethics, but I don't believe I have
violated any criminal statute.)

So we come down to "unauthorized malicious identity impersonation".

Doesn't quite roll off the tongue ...

Cheers!

___tony___


Tony Bartoletti 925-422-3881 <azb at llnl.gov>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900