‘Trusted Identities’ Plan Needs More Public Feedback
We've been working to put together comments on the government's National Strategy for Trusted Identities in Cyberspace (NSTIC) plan, as I mentioned earlier this month. The initial NSTIC plan has been criticized as vague and short on details – and the comment period is ending on Monday.
Although work on NSTIC started on June 25th, CDT and others from industry and public interest groups have been working with those developing the strategy for some time. The public draft differs in a few significant ways from the previous, nonpublic drafts, so CDT and others are working hard and pushing the deadline to complete our analysis. Extending the deadline is one of the more popular suggestions now on Ideascale site set up by the government to take public comments. Last I checked, this suggestion had three times more votes than other ideas (but for some reason isn’t showing up on the front page).
We joined EFF, the ACLU and Liberty Coalition in calling for an extension of the public comment period; we're not alone, many other groups are asking for the same thing. We believe those working on the plan are dedicated to a vision of a diverse, rigorous identity ecosystem that spans government, industry, and citizen interests. Meanwhile, we are committed to the development of a document that fully reflects the privacy, security, and implementation challenges that an identity system must face.
It is clear that the Administration is genuinely interested in receiving detailed comments about the NSTIC plan. Extending the comment deadline is an excellent way to help ensure the best possible suggestions get submitted. CDT, EFF, ACLU and Liberty Coalition sent a letter to White House Cybersecurity Coordinator Howard Schmidt today asking for a 90-day extension of the commenting period. That letter says in part:
The NSTIC outlines an ambitious identity management strategy for the United States, but public discussion has been extremely limited. The NSTIC is a very significant policy document that may have an impact on Internet commerce, online speech, identity management, identity trust frameworks, and online anonymity… the current public comment period is insufficient for a policy document of this magnitude… We are concerned that the NSTIC is silent on an implementation timeline and other significant details currently missing from the draft.
CDT and Partners Urge Passage of the California Location Privacy Act of 2025 (AB 322)
Location data is particularly sensitive, and when collected across time it can reveal a broad range of intrusive insights such as medical conditions, sexual orientation, political activities, and religious beliefs.
CDT and Allies Urge FCC Not to Violate Privacy of Cell Phone Buyers
CDT and EPIC led a coalition of 15 organizations in urging the FCC not to require phone companies to collect government IDs, physical addresses, and alternate phone numbers from every phone subscriber in the country.
As Brussels starts emptying for the summer, the risks of frontier AI models continue to capture the attention of policymakers as a key chapter of the AI Act becomes enforceable, and disclosure rules around the use of AI systems and AI-generated content are further clarified.
