Critical Social Infrastructure: Responding to Attacks on National ID Systems

Eva Galperin, Maya Indira Ganesh Over the last year the world has witnessed a series of security breaches that have compromised massive repositories for personal information: the Equifax hack that compromised the should-be-secret social security numbers of over 140 million Americans; a breach of India’s Aadhaar biometric ID database of  1.2 billion citizens; the hack of the South Korean ID database; the 2015 US Office of Personnel Management hack; the effects of WannaCry on the British National Health Service; of vulnerabilities in Estonia’s ID chip card. And there is no guarantee there won’t be more in the future. The breaches and hacks of these databases tend to be discussed in terms of implications for personal privacy, and cybersecurity since data is viewed as a commodity to be bought and sold. Many of these databases are in fact public assets. How does the notion of ‘critical infrastructure’ scale beyond physical assets like bridges and roads or water supply systems? How do we rethink design, ownership, liability and security when large national databases are viewed as critical social and public infrastructure? As a national ID number is used to access a variety of services, we seek to show how this layer of ‘social infrastructure’ creates challenges for a variety of industries, social and public systems. We will parse tensions - and competing interests - at different levels of the infrastructure stack. Panelists will map the technical, social and personal impacts of database compromise, and in doing so will look at the role of various stakeholders and response strategies, as well as address what governments and individuals can do to take preemptive security measures.  As these systems do not offer citizens a way to ‘opt-out’, discussion will discuss philosophical notions of privacy and security, and try to rethink ethics and accountability in these contexts. The panel will also  assess the new challenges these large hacks have for digital security trainings and infosec best practices at the individual and organizational level given the increasingly asymmetrical power dynamics between citizens, states, corporations, and large digital artifacts like databases