Identify the user, not the processor

Network World, 02/08/99

Intel claimed it was just trying to enable electronic commerce. But what the company did was only marginally useful for e-commerce, scared the bejeezus out of privacy advocates, and got Intel headlined dead center at the top of The New York Times' front page.

Intel thought it would be a good thing to be able to tell one computer from another, so the company added a unique serial number to each of its new Pentium III processors. There are a number of reasons this might be useful. Intel suggested the serial number could be used to tell e-commerce users apart on the 'Net. It also could be used to track down stolen processor chips and computers. In a throwback to some mainframe software, the serial number could let vendors tie software licenses to individual machines. Because these goals seem reasonable, Intel must have been shocked by the reaction to its announcement.

Privacy groups reacted quickly and very negatively. Here was something that could become the Internet equivalent of a Social Security number - something that could be used to identify a user wandering around the World Wide Web. At the minimum, this could spawn unwanted sales e-mail and calls; at worst, it could be used to build dossiers on Internet users.

The press quickly picked up on the privacy groups' vehement denunciation of Intel's plan. Intel then wasted little time in announcing that the serial number feature would be disabled by default, and a user would actively have to turn it on.

This did not satisfy the privacy groups because browsers and other software could surreptitiously re-enable the serial number feature at any time. The privacy groups have now asked the Federal Trade Commission to force Intel to recall any early Pentium III chips that have been shipped and prohibit Intel from shipping any more with the feature.

Ironically, while a serial number is a legitimate worry to people who would like to preserve what little privacy we have left, it is not reliable enough to be used in e-commerce. E-commerce requires the identification of an individual, but a processor serial number identifies the processor in a computer. Because users switch between computers and many computers are used by multiple people, a processor serial number identifies the wrong thing for e-commerce.

It would have been far more useful if Intel had worked instead on an inexpensive and reliable smart card and reader. If PCs came equipped with such readers, users could plug in a card to identify themselves when engaging in e-commerce and not at other times. Users could anonymously buy packs of these smart cards to use in different activities or with different vendors.

Disclaimer: Education via e-commerce is a new topic at Harvard, and the university has expressed no opinion on the above.