Wave Systems Corp. (fka WAVXQ)

[Fullmoon]

Open Identity Exchange backs U.S. gov't privacy guidelines


Founding members of Open Identity Exchange include Google, Equifax, PayPal and Verizon (and Wave)
http://www.networkworld.com/news/2010/030410-open-identity-exchange-privacy.html?hpg1=bn

By Ellen Messmer, Network World
March 04, 2010 11:33 AM ET
A group called the Open Identity Exchange officially launched this week to support federal government guidelines for online privacy and security and undergo certification to assure compliance. Founding members include Google, Equifax, PayPal and Verizon, among others.
Identity fraud climbed 12% last year
According to OIX chairman Dan Thibeau, the organization was created to show support by the private sector for standards from the federal government's Identity, Credential and Access Management (ICAM) Subcommittee of the Information Security and Identity Management Committee established in September 2008 by the Federal CIO Council. ICAM, co-chaired by the General Services Administration and the Deptartment of Defense, is composed of chief privacy officers within the federal government who have agreed on a set of privacy and security policies and technologies related to online interactions with citizens.
The federal government's CIO Vivek Kundra "reached out to private industry on this," Thibeau says, noting Kundra encouraged the formation of OIX as a way to get online service providers on board with the federal government's vision for privacy and security of information related to individuals' e-mail and Web interactions.
Thibeau says federal civilian agencies, in particular, want to be able to expand electronic exchanges with citizens under the ICAM-envisioned authentication framework. The initial focus of the OIX effort is related to the simplest -- and acknowledged lowest -- level of assurance that pertains to privacy issues in interactions such as OpenID-based e-mail that citizens might use with federal agencies.
The privacy issue at stake is that federal agencies, when interacting with citizens online, do not want e-mail or Web usage information about individuals to be sold to a third party, nor should that e-mail information be used to advertise to the person, Thibeau says. The membership of the OIX formally agrees to those restrictions -- what Thibeau calls "rules and tools"-- and in addition, OIX members agree to undergo an audit to ensure compliance.
Exact aspects of that are still in review, but OIX anticipates it will publish a list of accredited auditors for this purpose, and it will be up to the OIX members to pay for this process.
Read more about security in Network World's Security section.