Your ID number, please

“...and that no man might buy or sell, save he that had the mark. .. or the number...” – Revelation 13:17

The other Saturday, as I was walking into a school, the guard asked me for my RUT, Chile’s national ID number. To walk into a school!

At the pharmacy I ask for paracetamol. They offer it to me at a “sale price” of CLP 990. I accept. “Your RUT, please”, says the clerk. “I’m not giving you my RUT”, I answer. “Then it’s CLP 1,440”.

The other day we were gathering requirements at work, and we got to the point of defining how to identify users so they can log in to the system. “Let’s use the RUT”, they tell me. But why?! I ask.

The RUT, Rol Único Tributario, or the RUN, Rol Único Nacional, is a number issued by the State of Chile to each of its citizens at the moment they are born.

This identifier provides an effective way to trace, or track, every operation a person carries out.

“Your identity is your most valuable possession. Protect it. And if anything goes wrong, use your powers.” – Elastigirl in The Incredibles

People get scared when companies put together offers for them that show they have a complete trace of their consumer behavior, like what Pancho Cornejo describes.

We are the ones handing companies that ability to trace our behavior.

Why can companies do this?

Because technology gives them the ability to investigate you and know almost everything about you. In fact, any one of us has the power to learn a lot about any person, knowing their RUT or some other personal identifier

The RUT, or RUN, or whatever identifier our government assigns us, becomes a key that unlocks our behavior and our identity.

Today our identity lives in computer systems, which is why it is critical to be careful with it, because ultimately our identity is digital.

The main problem, in computing, is that systems, processes, companies and application designers violate all, or some, of the 7 laws of identity, summarized below.

1. Don’t share users’ information behind their backs.

2. Don’t ask users for more information than necessary.

3. Don’t expose users’ information unnecessarily.

4. Don’t allow the information to be logically linked by third parties, unless the user authorizes it.

5. The user must be able to choose whether the data they have stored in one system can be connected with their data in another system.

6. If the simplest way to use a tool is not the most secure one, then the tool is badly built.

7. A simple, consistent and understandable user experience is desirable, even if different technologies and identity providers are used behind the scenes.

In every case I mention at the beginning of this post, several of these laws are violated.

When they ask for your RUT, you don’t know whether that information is used to cross-reference other databases (the pharmacy case). That violates law 1.

Is the RUT necessary to use or access a system? Law 2

When you use your RUT for your credit card, to make purchases, and to get care at a clinic or a health provider, they can use the RUT as a mechanism for linking people’s information (law 4).

Etc., etc.

We must take care of our identity, and the best way I can think of is to understand the laws of identity and, based on them, lay out a strategy for defending our data.

We should favor the systems that respect these laws, and distrust all those that ask you, without you knowing the real reason, for more information than they should have.

The RUT, unfortunately, is a big mistake in our system, because its use has spread beyond its original purpose.

So the next time someone asks for your RUT, DNI or your country’s unique identifier, think twice, and don’t give it to anyone. They don’t need it (not even to log in to your bank’s website).