I wrote the original post after watching the Bradley Horwitz (@elatable) - Tim O'Reilly (@timoreilly) interview re: Google+. I found Tim's choice of words about the tone (strident) and judgement (self-righteous) towards those standing up for their freedom to choose their own names on the new social network being rolled out by Google internet's predominant search engine disappointing.  His response to my post was to call me self-righteous and reiterate that this was just a market issue.

I myself have been the victim of a Google+ suspension since July 31st and yesterday I applied for a mononym profile (which is what it was before they insisted I fill out my last name which I chose to do so with my online handle and real life identity "Identity Woman") 

In the thread this morning Tim said that the kind of pressure being aimed at Google is way worse then anything they are doing and that in fact Google was the subject of a "lynch mob" by these same people.  Sigh, I guess Tim hasn't read much history but I have included some quotes form and links to wikipedia for additional historial context.

Update: inspired in part by this post an amazing post "about tone" as a silencing/ignoring tactics when difficult, uncomfortable challenges are raised in situations of privilege was written by Shiela Marie.  

I think there is a need for greater understanding all around and that perhaps blogging and tweeting isn't really the best way to address it.  I know that in the identity community when we first formed once we started meeting one another in person and really having deep dialogues in analogue form that deeper understanding emerged.  IIW the place we have been gathering for 6 years and talking about the identity issues of the internet and other digital systems is coming up in mid-October and all are welcome.  The agenda is created live the day of the event and all topics are welcome.

Here's the thread... (oldest tweets first)

 Note all the images of tweets in this thread are linked to the actual tweet (unless they erased the tweet). 

Steve, thanks for highlighting the bizarre choice to use a "lynch mob" as the metaphor to describe what is happening to Google around this issue.

From Wikipedia: Lynching is an extrajudicial execution carried out by a mob, often by hanging, but also by burning at the stake or shooting, in order to punish an alleged transgressor, or to intimidate, control, or otherwise manipulate a population of people.... Lynchings have been more frequent in times of social and economic tension, and have often been means used by the politically dominant population to oppress social challengers. 

The article on Lynch Mobs is part of the Discrimination set of articles in Wikipedia. Within sociology, 'discrimination' is the prejudicial treatment of an individual based on their membership in a certain group or category. Discrimination is the actual behavior towards members of another group. It involves excluding or restricting members of one group from opportunities that are available to other groups. An individual need not be actually harmed in order to be discriminated against. He or she just needs to be treated worse than others for some arbitrary reason.

 

From the Wikipedia article on Oppression: Indirect oppression is oppression that is effected by psychological attack, situational constraints or other indirect means. It has been a popular tactic practiced in single power, power monopoly or other authoritarian or totalitarian regimes.

The point I was making with my previous post Google+ says your name is "Toby" not "Kunta Kinte" is that Google is being discriminatory and oppressive towards people who refuse to use their "wallet names" and who choose to go by pseudonyms.  Which party in this situation is really acting like a lynch mob?

As I said in my previous post the tone of those who are suffering at the hands of this policy implemented by THE dominant search utility on the web are loud, shrill, piercing, high-pitched and rough sounding and I imagine are heard by those within Google who are receiving them as grating and obnoxious. Rather then empathizing with human pain and suffering that is reflected in the tone, Tim and others are just dismissing them and their concerns.  Here is one of the clearest posts by someone very affected by what Google is doing: To those who say they "don't get it"...(Google, G+, etc) 

Really? Google+ is effectively lynching, that is killing the digital persona's of people who's names don't conform to its policies. So what is not extreme about that? is there a middle ground when you feel your digital life is threatened? Of course the reaction of people has some edge to it because people feel that the digital identifier that is the anchor for their "digital body" could be terminated and thus puts their digital lives are at risk.  They are being a bit shrill when the talk about the issues because they are deeply personal and have real impact on their lives because it impacts their ability, their freedom to communicate.

To close, Doc Searls has a great post up about what this might all really be about Circling Around your Wallet.

  Note all the images of tweets in this thread are linked to the actual tweet (unless they erased the tweet). 

This whole line of thought to explain to those who don't get what is going on with Google+ names policy arose yesterday after I watched the Bradley Horwitz - Tim O'Reilly interview (they start talking about the real names issue at about minute 24).

More on my personal Google+ suspension that continues to Day 29.

Tim is struck by the Steve Jobs element of how Bradley and Google is talking about designing for the way the world will be not how it is....implying and even explicitly saying that in the future we will just all use our real names for everything so lets get started doing that now.   - you know happy future vision of benevolent design choice by humans of large corporate controlled digital systems.  Yes, many Googlers like Chris Messina who used to have a handle online "Factory Joe" made the conscious choice to bring it together with his "real name". For him the cost-benefit trade of for this and decided that for him it was no longer worth it. Totally fine choice for him. What is at issue is when his choice becomes all of our choice because he and others like him have the power to decide for all of us.

Young men like Chris have a lot of privilege in the world and they can do things/make choices that others have less freedom (privilege) to make without those choices affecting their lives in material ways (chances of employment, social acceptance between different contexts with different norms, having accepting family members who are not bigoted against their personal life choices).  I thought that one of the things Chris got form his years dating Tara Hunt was more of a clue about the issues that women and others who are not young white straight monogamous men living in western liberal democracy, liberal metropolises face. His posts on the topic include the following but some how...I guess he still doesn't get this issue in relation to Google (maybe he does but it seems like people who work at Google stop blogging upon their date of employ and Google employees who have spoken up on the issue have been gagged).

* Kirrily Robert: Standing out in the Crowd where he highlights these posts

• Recruit diversity
• Say it. Mean it.
• Tools. (Tools are easy.)
• Transparency.
• Don’t stare.
• Value all contributions.
• Call people on their crap.
• Pay attention.

* Future of the White Boys Clubs

* Future of White Boys’ Clubs Redux #fowaspeak

Fundamentally technology systems and techno-social systems are created by people making choices AND it is at this time in the history of the web we get to as a culture and society choose the range of options available for human expression of identity online.  IF THE PEOPLE WHO HAVE ALL THE POWER to make this choice in these digital systems have the demographic profile of Brad and Tim then we will get one outcome - it will favor them and their world view and exclude others who are different (ala the very long list of people negatively affected by real names policies). It is an abuse of power as danah boyd eloquently explains on her blog.

Tim goes on to say (at min 28) that his own reaction to "some of the strident calls for you guys [Google+] to change what you are doing" lead him to the conclusion "give me a break, lets try some different things lets figure out what we learn from them..the market will tell you what it really demands"

Lets look at this more deeply - Tim's specific labeling of the resistance to the policies as "strident" is coming from a position of power and privilege that is judging these people in a way that demeans, what they are saying.

From Wiktionary: Strident

1. Loud; shrill, piercing, high-pitched; rough-sounding

   The trumpet sounded strident against the string orchestra.

2. Grating or obnoxious

   The artist chose a strident mixture of colors.

Because the opposition is so sharp and clear - people are speaking up in shrill, piercing, "high-pitched" ways because they are being hurt so badly and deeply by requirement for real names and how suspensions are being handled.  The words of these people are being heard by Tim and others in power as grating and obnoxious because they aren't supposed to speak up...they should just accept what is happening to them right?

One response of Google+ leadership and technology leaders like Tim O'Reilly could have is to be to be empathetic, to look inward and connect to the human beings speaking and say something like:

Wow, we had no understanding of how "unfree" some people feel online and in our society broadly.

We had no idea about how many different kinds of people (who are not like us) are affected real names policies.

We didn't really realize existed, or had any needs different then ours and how can we struggle with them to make a more just society so they are not affected negatively if they were out/public about those things.

In the meantime lets really listen and get that they have real and valid needs for safety and the right to express themselves and lets and not ban them from our services for their choice not to use use their real name.

Instead Tim and others are dismissing the real hurt and anguish being felt by people saying they are being "strident" for speaking up for their right to pick their own name and to be for Google's continued insistence they have the right to decide what an acceptable name is for people.

This is about power and those who speak up to it being judged and labeled negatively for doing so. I asked in twitter yesterday if women suffragettes were strident, and were the stonewall rioters and the subsequent movement for gay rights strident? Yes they were! They were standing up for what was right and against and unjust social system that was harmful to people.  I am concerned about the rights and freedoms of nyms both because people have personal life issues they want to be free to create accounts to express/deal with AND because they have political beliefs they want to share.

Imagine if the people who were standing up and organizing for gay rights in the 60's and 70's had digital tools to do so and imagine all the major places were public discourse about this happened were in online social spaces where "real names" were required and imagine that all of their families and employers would therefore know about their status as a GAY  (LTBTQ) PERSON. Do you think we would have had the gay rights movement? Do you think it would have been possible? Do you think that enough people would have stood up knowing they would be laid off, fired, black balled, told their kids couldn't play with neighbor kids.

Many groups who are systemically and socially oppressed (yes in our modern liberal democracy there is lots of oppression going on) fear to speak up TODAY about the issues going on in the system that affect them.  Many people have ideas that would transform the social order but challenge power will fear speaking up about these new ideas if all speech in online public fora must be linked to real names seen by their real employers who could really fire/let them go.

Unless we embed the freedom to have pseudonymous speech in major online social spaces where serious public/political dialogue occurs then we risk not having a free society any more.  Free meaning the freedom to challenge injustice the freedom to seek greater accountability by those in power (government and corporate), to open up the systems that run our society.

Over the course of yesterday I continued to think more about the deeper nature of the issues going on and the fundamental nature of the power we have to name ourselves and what it means to have this freedom.  I remembered the series Roots  and suggested that young Googlers rent it from/watch it on netflix and then have dialogues about privileged and oppression.

For those of you who didn't watch it in the 70's (I was born in the 70's do didn't watch it then either),  it is the story of a Alex Haley's black family descended from a man who was stolen from his village in Africa and brought to America as a slave. He is very clear on his identity, who he is, he is a Mandinka warrior and his name is Kunta Kinte,.  One of the first things his white slave owner Master Reynolds does is rename him Toby.  He refuses to accept this new name, this identity that they have said he must take on...he does accept the name but only after great human suffering inflicted by his master to get him to comply with his wishes.

This is the sort version:

"Bonus suppression" Google runs YouTube and they took the clip of the movie scene down for "inappropriate nudity or sexual" - it has neither, it just made a dramatic point and made them look bad. In the clip Kunta Kinte is facing the camera with part of his chest showing being whipped from behind by a white man who is working for the slaveowner until he breaks. After repeating his name is Kunta Kinte when asked what his name is, he finally says... it is Toby. 

For slightly more context for the scene this is 8 min.

I highly recommend watching the WHOLE movie if you haven't seen it.

Just to be really clear for those of you who might not be tracking the point I am making. I and the other people in Google+ who choose to have handles/nyms that are persistent and that we are known by but are being rejected by Google+ are Kunta Kinte and the Google+ name police is the slave owner whipping him until he submits to calling himself Toby.

Metaphorically this IS what is going on.  "Yes" I and other people who use handles and use nyms have a choice "not to use the service" - we are technically "not slaves" like Toby is. However we have already been using Google e-mail and other services for years with the names we chose - in changing the rules on the Google plantation they have undermined the social contract that it had with existing users. Google is a major forum for expression of ideas and is THE dominant search engine (one could argue monopolistic search engine). It will be using people's +1's to determine search results and these will shape public discourse.

Many different people are now fearful of speaking up in Google+ about these issues (even if the are not affected) because they fear the will be affected (having their access to their accounts turned off). Just look at what has happened Google+ turned off Violet Blue's profile knowing full well it was her real name and people rightly so imagine this is because she was speaking out for those who were suspended and could not speak.

Back to what Tim said above - he says that "the market will decide" these things. The core issues here are freedom of speech and power within the social sphere not about "the market". It is about what is right and just in a society. The market decided that it was ok to do slavery for hundreds of years, the market decided that it was ok to discriminate systematically against black people with Jim Crow laws and the market decided it was ok to discriminate against women in professional fields like law and medicine until things changed in the 60's.

Continuing the quotes from Tim "lets the arguments be from efficacy not from self righteousness"

Let me ask you this Tim: Was Kunta Kinte being self righteous to insist on his own choice of his own name?

Update:

Tim thinks that I am being self-righteous for even asking this question. He agrees with me that Kunta Kinte is not self righteous to stand up for his name but adds that that I am self-righteous to ask this question which in this post was explicitly drawing the analogy between Kunta Kinte's struggle for his right to assert his own identity and mine along with others with handles and Nyms in relationship to Google+. The fact that he is judging us as being "self-righteous" kinda proves my point that we are challenging the the power and authority of the system and being judged negatively by the powers that be for for doing so.

Tim thinks that this issue is just a matter for the market to decide. Sadly he doesn't see it as the silencing of voices and the inability for those who are not as privileged as he is to speak with their own voice on the Google platform the dominant search utility for the web.

In the morning there was a whole much longer set of twitter responses kicked of by Kevin Marks and going back and forth with Tim O'Reilly and others.

Update: inspired in part by this post an amazing post "about tone" as a silencing/ignoring tactics when difficult, uncomfortable challenges are raised in situations of privilege was written by Shiela Marie.  

As I outline in this next section, there is a lot of meaning packed into the word “trust” and it varies on context and scale. Given that the word trust is found 97 times in the NSTIC document and that the NSTIC governing body is going to be in charge of administering “trust marks” to “trust frameworks” it is important to review its meaning.

I can get behind this statement: There is an emergent property called trust, and if NSTIC is successful, trust on the web would go up, worldwide.

However, the way the word “trust” is used within the NSTIC document, it often includes far to broad a swath of meaning.

When spoken of in every day conversation trust is most often social trust.

Trust in a social context: The typical definition of trust follows the general intuition about trust and contains such elements as:

• the willingness of one party (trustor) to rely on the actions of another party (trustee);
• reasonable expectation (confidence) of the trustor that the trustee will behave in a way beneficial to the trustor;
• risk of harm to the trustor if the trustee will not behave accordingly; and
• the absence of trustor's enforcement or control over actions performed by the trustee.

When discussing digital systems there is another meaning for trust related to cryptography and security and other policy enforcement.

Computational Trust - In Information security, computational trust is the generation of trusted authorities or user trust through cryptography.

Trusted Systems - In the security engineering subspecialty of computer science, a trusted system is a system that is relied upon to a specified extent to enforce a specified security policy. As such, a trusted system is one whose failure may break a specified security.

The choice of one individual to trust another depends on who they are, depending on the context, relationship and other factors. This can change and perhaps be tracked.

Trust Metrics -In psychology and sociology, a trust metric is a measurement of the degree to which one social actor (an individual or a group) trusts another social actor.

Trust Operates on Different Scales

In The Speed of TRUST: The One Thing That Changes Everything, Stephen M.R. Covey articulates 5 different ones. I think this model is helpful because it highlights how much trust means and how it operates differently at different scales.

Covey starts with people trusting themselves: SELF TRUST

Are we credible to ourselves?

• Do we have integrity are we congruent inside and out and walking our talk, living in accordance with one’s own values and beliefs?
• What is our intent when interacting with straightforward motives based on mutual benefit?
• What are our capabilities? Do we have the ability to establish, grow, extend and restore trust? What abilities do you have that inspired confidence, talents attitudes, skill, knowledge, style.
• What are our results? Do we get the right things done, are they done well and what is our consistency of results or tack record?

People in the Quantified Self movement are actually using digital devices and sensors to track themselves. They are using data analysis tools to see how fast they ran or what their caloric intake was. One of the reasons people track themselves to work on improving themselves, set goals and measure achievement over time. As they achieve results towards a goal they increase their credibility - their self trust.

Covey moves on to people trusting each other: RELATIONSHIP TRUST
One cultivates this kind of trust with others when one behaves consistently in ways that build trust. People are biologically wired to track behavior of others and form opinions about trustworthiness in real time, all the time balancing a wide array of variables. One way to simplify this is to imagine that with every person you interact with you have a “trust account”. The way you make deposits “In” to someone’s bank account is to have consistent behavior. Deposits are withdrawn from the “account” when someone is not consistent in following agreements.

Behaviors he believes generate trust:

• Create Transparency
• Demonstrate Respect
• Practice Accountability
• Deliver Results
• Get Better
• Extend Trust
• Talk Straight
• Listen First
• Show Loyalty
• Confront Reality
• Clarify Expectations
• Keep Commitments

People are really different: different kinds of behaviors matter more or less to an individual, and therefore a behavior’s meaning affects the current balance on any person’s given trust account account differently.

The Identity Ecosystem is an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities and the digital identities of devices. The Identity Ecosystem Framework is the overarching set of interoperability standards, risk models, privacy and liability policies, requirements, and accountability mechanisms that govern the Identity Ecosystem.

This quote from NSTIC makes a big assertion that trust is going to flow between people because they followed agreed-upon standards to obtain and authenticate their digital identities.

The implicit use case might be an individual, lets say her name is Jenna, goes to an attribute verifier service provider like her retail branch bank with attributes like drivers license, latest utility bill and her record showing she has also had a bank account with them for 5 years. The bank checks Jenna’s physical world credentials and then issue a digital token she can use to do 2-factor authentication online. The digital token, when she goes online, presents Jenna’s name as written on her driver’s license.

I see three behaviors in this use case:

Confronting Reality - there is a reality for most people in western liberal democracies that the government of the county or province you were born issued you a paper saying so, and this ironically named breeder document begets you more forms of identification. If a user has not been using their real name, they will now be forced to do so. The reality is, birthplace can have a huge effect on a person’s legal and identify reality.

Creating Transparency - Jenna has linked her “real legal name” to an account which that when she uses it will be transparent about who she is and let everyone know. This means people who look her up online can find her street address in real life. Well, it turns out this creates a vulnerability because others can find where her house is, stalk her or make threats against her.

Practicing Accountability - The ability to be accountable. If Jenna choose a criminal action online, others would be able to trace her by the real name she was using. But so too if she was mildly socially rude, people would know to withdraw from her “trust account”.

There are nine other behaviors really matter in human to human trust relationships but which are not covered in any way by the standards for obtaining and authenticating digital identities - the so-called trust frameworks.

There are other aspect that are not comparable about this scenario when you map them to how people trust one another in everyday life. I don’t trust people because I know their legal name because I checked it on their drivers license. In physical space, I see someone I know and I know it is them because they are in the same body form they were last time I saw them. This verisimilitude to the mental picture I have of them allows me to authenticate36 them visually. When I see them, I can pull up my mental trust account and see how much I have deposited in their account.

In the digital realm, I anchor my mental trust account to identifiers I hold for people in my mind. I need to have confidence that the system they use to authenticate (using a user name and password) is secure, that it isn’t someone else logging in and “being them” because they control the identifier.

When people interact with businesses, they use similar mental models for judging trustworthiness based on observed actions and experiences. The use of the phrase “trust framework” by its very name implies that those who have complied with its requirements are trustworthy because they had a standard way to obtain a digital identity and authenticate. There is a great diversity of particular behaviors that people use to make trust judgements. If people want to use one trust framework or another because they judge one or another ratings agency assesses it to be more “trustworthy” we have a very messy, convoluted conversation.

In groups of people working together: ORGANIZATIONAL TRUST
This mode of trust is about alignment of the structures, systems and symbols of organizational trust. If trust is low in an organization, then to compensate, certain behaviors or systems patterns emerge that are costly: Redundancy, Bureaucracy, Politics, Disengagement, Turnover, Churn and Fraud.

For organization there is: MARKET TRUST
The perception of a business entity in the market place is where there are all kinds of services that help consumers navigate what products to buy. Market trust is developed by repeated activity observed over time.

Beyond the business or nonprofit is: SOCIETAL TRUST
This is about giving back and contributing to the society and the commons. It is particularly important to give back to society trust assets one owns but everyone benefits from. It is vital that societal trust be maintained because other scales for trust operate at this level as a support structure. This is where there is backup when other forms of trust fail and you can trust the court system to give you fair treatment when seeking redress.

“If NSTIC is successful, trust on the web would go up, worldwide.” The trust in this sentence is at the societal level scale and I believe it is true. However the way to succeed in achieving this level of trust is not to name policy-tech frameworks throughout the system “trust frameworks”. I am very keen on NSTIC succeeding, however I am concerned that naming this critical part of the proposed ecosystem “trust frameworks” will actually generate mistrust of the system. If the term “trust framework” is the way policy-technology frameworks within the ecosystem are named and explained to the public, but people find those frameworks untrustworthy, they will suspect anything self labeled with “trust”. People will ask themselves: why should we trust a Trust Framework? Who made up the trust frameworks? Individuals will think to themselves: I am the one who decides what to trust...don’t tell me to trust something just because you call it a “Trust Framework.” Given the recent large scale institutional breakdown in trust in the banking system, consumers are skeptical of large publicly traded companies saying “trust us” we have a “trust framework” to protect you.

I highlighted the challenge with using the word, trust, for policy-technology frameworks at the NSTIC governance workshop at the beginning of June where Jeremy Grant asked me if I had a better name. I do have a better name for trust frameworks:

Accountability Frameworks.

Here is some of my reasoning:

• It is 2 words.
• It captures the heart of the intended purpose: Accountability
• Accountability is achieved in these frameworks via both technology standards and policies that are adopted and audit-able.
• Trust remains an emergent property of these accountability frameworks.
• There can be real conversations by various stakeholders who may have different needs and interests about the nature of the accountability in different frameworks. They can look to see weather particular accountability frameworks are trustworthy from a particular point of view.
• It avoids the problem of talking about the "trustability of trust frameworks".

Trust is absolutely essential in the Identity Ecosystem. People must trust that the information they share will be handled with care, respected and that human dignity is maintained by the individual actors within the Identity Ecosystem. This is achieved by having real accountability in the system around the user’s rights to use their data being respected. When the system is functioning well and accountability frameworks are followed then overall systems behavior of the Identity Ecosystem will be trustworthy.

This post is from pages 20-24 of Kaliya's NSTIC Response - please see this page for the overview and links to the rest of the posts. Here is a link to the PDF.

This is the section before: Alignment of Stakeholders around the many NSTIC Goals

This is the section after: Ecosystem Maps - Present, Evolving, Future

The National Strategy for Trusted Identities in Cyberspace paints a broad vision for an Identity Ecosystem. The strategy author’s choice to name the big picture vision an “ecosystem” is an opportunity not to be lost. An Identity Ecosystem construct will inform the choice of processes and structures appropriate to govern it.

An ecosystem is a biological environment consisting of all the organisms living in a particular area, as well as all the nonliving, physical components of the environment with which the organisms interact, such as air, soil, water and sunlight.

This definition reminds us that the context of an Identity Ecosystem is broad and goes beyond just the identities of people and devices but extends to the contexts in which they operate and interact, the network and indeed the wider world. When we discuss a person’s digital identity it should not be forgotten that we are each fundamentally biological beings living in complex social systems composed of groups, organizations and businesses, all socially constructed and embedded in a larger context, the biosphere surrounding the planet earth.

An overall Identity Ecosystem is needed because small islands of identity management online are working, but they have not been successfully woven together in a system that manages the tensions inherent in doing so to ensure long term thrivability of the overall system.

Ecosystems have individual organisms within them, interacting in various ways and together, one could say collaborating. With the overall environment, there are emergent properties and services needed to make the whole system work. In human systems, we also communicate in many more ways than with language. An Identity Ecosystem must allow be flexible enough to allow for multiple use cases that allow for different kinds of communication and contexts.

Terms in the above with references in the end notes:

Thrivability: Thrivability: A Collaborative Sketch. I was a contributing author writing the essay on Creating Appropriate Containers

What is the appropriate container to govern the Identity Ecosystem? This is a key question the governance NOI is seeking answers for Jean Russell the curator of the Collaborative Sketch defines Thrivability it this way:

Thrivability is our path out of unsustainable practices toward a world where all people have a high quality of life, a voice, and a nurturing earth supporting them. Using whole systems approach, we evolve our way of being together, of collaborating, so that our collective wisdom and action bring forth a flourishing world and thriving life.

 

Social Construction:  Individuals and groups participate in the construction of their perceived social reality. It involves looking at the ways social phenomena are created, institutionalized, known, and made into tradition by humans. The social construction of reality is an ongoing, dynamic process that is (and must be) reproduced by people acting on their interpretations and their knowldege of it. Because social constructs as facets of reality and objects of knowledge are not "given" by nature, they must be constantly maintained and re-affirmed in order to persist.

Ecosystem:  The term was first coined in 1935 by ecologist, A. G. Tansley in a paper entitled “ The Use and Abuse of Vegitational Concepts and Terms”  he described it as:

...the more fundamental conception is the whole system (in the sense of physics), including not only the organism complex, but also the whole complex of physical factors forming what we can call the environment of the biome--the habitat factors in the widest sense. Though the organisms may claim to be our primary interest, when we are trying to think fundamentally we cannot separate them from their special environment within which they form one physical system.

This post is from page 10 of Kaliya's NSTIC Response - please see this page for the overview and links to the rest of the posts. Here is a link to the PDF.

This is the section after: Ecosystems Collaborate Using Shared Language

This is completely the wrong frame to foster community collaboration.

Here is my answer to the NSTIC Governence Notice of Inquiry.

And an article I wrote on Fast Company: National! Identity! Cyberspace! Why you shouldn't freak out about NSTIC.

Interestingly in paragraph two on the White House blog it says that NSTIC stands for "National Strategy for Trusted Initiatives in Cyberspace" rather than "National Strategy for Trusted Identities in Cyberspace".

This first draft of NSTIC was developed in collaboration with key government agencies, business leaders and privacy advocates. What has emerged is a blueprint to reduce cybersecurity vulnerabilities and improve online privacy protections through the use of trusted digital identities.

The 2nd draft is posted on an DHS idea scale installation.  There will be three weeks (until July 19th) for public comments.

The Document is 40 pages long and you can download it here. This is where citability.org would have come in handy to make comments... cause commenting in a threaded discussion on idea scale about the whole document will not be easy.

We will be hosting the Internet Identity Workshop in DC Sept 9-10 (Thursday-Friday) following Gov 2.0 Summit. See the announcement on the IIW site.

The White House post talks about the Identity Ecosystem. The document uses this phrase extensively.

I am reading it now and comments will follow here over the hour.

The subtitle is good - Creating Options for Enhanced Online Security and Privacy

Executive Summary Quotes and commentary:

I thought I should also explain some key things to help understand conventional PAM then get to social web PAM in this post covering:

1. regular identity management in the enterprise,
2. regular Privileged Account Management in the enterprise
3. Privileged Account Management for the Social Web.

1) IdM (Identity Management) in the Enterprise

There are two words you need to know to get IdM and the enterprise: "provisioning" and "termination".

a) An employee is hired by a company. In order to login to the company's computer systems to do their work (assuming they are a knowledge worker), they need to be provisioned with an "identity" that they can use to log in to the company systems.

b) When an employee leaves (retires, quits, laid off, fired), the company must terminate this identity in the computer systems so that the employee no longer has access to these systems.

The next thing to understand is logs.

So, an employee uses the company identity to do their work and the company keeps logs of what they do on company systems. This kind of logging is particularly important for things like accounting systems - it is used to audit and check that things are being accurately recorded, and who did what in these systems is monitored, thus addressing fraud with strong accountability.

I will write more about other key words to understand about IdM in the enterprise (authentication, authorization, roles, directories) but I will save these for another post.

2) Ok, so what is Privileged Account Management in the Enterprise?

A privileged account is an "über"-account that has special privileges. It is the root account on a UNIX system, a Windows Administrator account, the owner of a database or router access. These kinds of accounts are required for the systems to function, are used for day-to-day maintenance of systems and can be vital in emergency access scenarios.

They are not "owned" by one person, but are instead co-managed by several administrators. Failure to control access to privileged accounts, knowing who is using the account and when, has led to some of the massive frauds that have occurred in financial systems. Because of this, the auditing of logs of these accounts are now part of compliance mandates in

• Sarbanes-Oxley
• the Payment Card Industry Data Security Standard (PCI DSS),
• the Federal Energy Regulatory Commission (FERC),
• HIPAA.

Privileged Account Management (PAM) tools help enterprises keep track of who is logged into a privileged account at any given time and produce access logs. One way this software works is: an administrator logs in to the PAM software, and it then logs in to the privileged account they want access to. The privileged account management product grants privileged user access to privileged accounts [1].

Links to articles on PAM, [1] Burton Group Identity and Privacy Blog, KuppingerCole, Information Security Magazine.

3) Privileged Account Management on the Social Web.

Increasingly companies have privileged accounts on the social web. Dell computers has several for different purposes. Virgin America, (they link to the account from their website - thus "validating" that this is their real account), JetBlue, Southwest Airlines, Zappos CEO, (employees who twitter), Comcast Cares (Frank Eliason) (interestingly comcast on twitter is blank).

Twitter is just the tip of the iceberg - there are also "fan pages" on Facebook for brands. Coca-Cola, Zappos, NYTimes, Redbull, Southwest, YouTube Channels, Dunkin' Donuts, etc, etc. on thousands of other platforms and yet-to-be-invented services.

These are very powerful accounts - they are managed and maintained by many employees around the clock and are the public voices of companies.

I have yet to see or hear of any software tools to enable enterprises to manage Social Web privileged accounts. How are companies managing access by multiple employees to these accounts?

Is there software that does this yet?

Is anyone working on these kinds of tools?

Leave your comments here or tweet with me @identitywoman

"The nation's Social Security numbering scheme has left millions of citizens vulnerable to privacy breaches, according to researchers at Carnegie Mellon University, who for the first time have used statistical techniques to predict Social Security numbers solely from an individual's date and location of birth. The researchers used the information they gleaned to predict, in one try, the first five digits of a person's Social Security number 44 percent of the time for 160,000 people born between 1989 and 2003.

This is from the Wired coverage:

By analyzing a public data set called the “Death Master File,” which contains SSNs and birth information for people who have died, computer scientists from Carnegie Mellon University discovered distinct patterns in how the numbers are assigned. In many cases, knowing the date and state of an individual’s birth was enough to predict a person’s SSN.

“We didn’t break any secret code or hack into an undisclosed data set,” said privacy expert Alessandro Acquisti, co-author of the study published Monday in the journal Proceedings of the National Academy of Sciences. “We used only publicly available information, and that’s why our result is of value. It shows that you can take personal information that’s not sensitive, like birth date, and combine it with other publicly available data to come up with something very sensitive and confidential.”

Basically it means we shouldn't be honest about our date of birth and home town on Facebook (or any other social network) or we are making ourselves vulnerable to discernment of our SSN's. I wonder if they can figure out mine? I received my as an adult when I was attending college in California.

I decided to poke around and see what Facebook had up about Identity Theft. I did find a link to this study that created a profile by “Freddi Stauer,” an anagram for “ID Fraudster,”.

Out of the 200 friend requests, Sophos received 82 responses, with 72 percent of those respondents divulging one or more e-mail address; 84 percent listing their full date of birth; 87 percent providing details about education or work; 78 percent listing their current address or location; 23 percent giving their phone number; and 26 percent providing their instant messaging screen name.

Sophos says in most cases, Freddi also got access to respondents’ photos of friends and family, plus a lot of information about personal likes and dislikes, and even details about employers.

Facebook users were all too willing to disclose the names of spouses and partners, with some even sending complete resumes. One facebook user divulging his mother’s maiden name—the old standard used by many financial and other Web sites to get access to account information.

Most people wouldn’t give this kind of information out to people on the street but their guard sometimes seems to drop in the context of a friend request on the Facebook site, O’Brien says.

According to Sophos, the results of what it calls its Facebook ID Probe has significance for the workplace as well as personal life because businesses need to be aware that this type of social-networking site may pose a threat to corporate security.

I have tried to search the Facebook blog to see what they have to say about identity theft and apparently they haven't mentioned it.

The conference took a spiritual theme at the end with the presentation by the chair of the leading private university in Taiwan with a major focus on Future Studies. Their conference coming up is Global Soul, Global Mind, Global Action.

Spiritual Technology is essential to support us slowing down enough to absorb and process the accelerating change of technical technology. Janardhan Chodagam presented about the Brahmin Kumari World Spiritual Organization and highlighted how meditation can transform deep rooted personality we don't like.

Ray thinks we are going to have sex in new ways with nanotechnology and sensations evoked with direct nerve inputs over riding our regular sensory inputs. I really can't imagine real sexual activity between real people being replaced by nanobots.

Ray highlighted some key elements of what makes human is how knowledge it transfered from generation to generation. It is this transfer of knowledge that is expanding exponentially and why computers and other tools are needed to cope.

Outer Space (the world around us: science, the natural and built environment, universal systems theory)

Human Space (the human world: our bodies, behavior, minds, human systems theory)

Inner Space (the world below: energy, small tech, computer "bodies", inner systems theory)

Cyber Space (the virtual world: computer "behavior", computer "minds", cyber systems theory)

Hyper Space (the world beyond: new paradigms, phase transitions, hyperphysics, hyper systems theory)

Relationships are the crossing of boundaries between things.
This happens within our selves and between others.
Maintaining right relationship and boundaries between these is what helps energy flow well.

I heard this talk on June 17 at the Cato Institute / The Economist Luncheon LIberty, Technology and Prosperity in San Francisco by Joel Garneau author of Radical Evolution.
Joel's introduction was given by The Economist SF corespondent.
He has five hats the most interesting of those seemed to be a TROLL as in the norse mythological figure who hangs out in the woods and looks after the forest.

He is editor of the Washington Post Style section. Is a scenario planner at the Global Business Network. He also has a consulting firm the Garneau group - with him and his best sources. He also dabbles in Academia.
He has authored three books - The

Nine Nations of North America, Edge City - life on the new frontier and the topic of today's talk Radical Evolution: The Promise and Peril of Enhancing Our Minds, Our Bodies and what it means to be human.

Joel Garneau

We are at turning point in human history because of the fundamental changes in what it means to be human in the next 10-20-30 years. The change in the technologies we are working on today is that they are not focused outward on - fire, cloths,
They are focused inward on us - Modifying our minds, memory, metabolism our kids and what it means to be human.
These changes in science have significant political implications. They are changing VC's have to look at the world.

When I heard this I mentally noted the oddity of it being the next statment. It sort of implied that there was a way in which their decisions had a profound effect on the future - and perhaps they do but should they have this big a power to shape it - how do we discuss and discern about these issues that affect the whole of society?

Their will be changes in cultures and values on our watch in real time. The future is being driven by the curve of accelerated change. How many people have heard of Moores Law - about 1/2 of the audience raised their hands. The data point on this is that normally only 10% of the audience does. We have had 29 doublings of computing since 1959 - that is 40,000,000 times.
This curve did not suddenly start out with the chip. We are in a third sort of evolution of what it means to be human. Darwin and chimps it took 8,000 years to get reading and writing.

Technosis is a great book to understand 'writing' as a technology that profoundly shaped culture.

To give perspective rail roads changed everything they touched and the number of miles of rail road miles was only 14 times.
In 1800 we started the industrial age an example of this curve is that in 1903 we had the first flight and 66 years later we were on the moon.
These changes are exponential and change all of society. This curve that we are riding - I don't see where it levels off.
The limitations are - Quantum Mechanics - The Marketplace - Human ingenuity (he sees no limits to these three)

Finally our willingness to shape culture and values. I am interested in human relationship and love and lies.
WE ARE IN A TIME OF RADICAL EVOLUTION
We are charging the shape of what it is to be human.
Fleet of technology - affect how mind, memory and metabolism works.

I spent a year with DARPA Spent Year with DARPA. They see the week link in the war fighting machine as us - humans themselves. Lets meet the first telekinetic monkey who can move objects through her thoughts.

We hook her on computer games moving a cursor with a joyce stick.
Drill hole in head near motor quartex and put in a mesh of extremely fine Wires that connect with neurons.
See the patterns in the mind when operating the joyce stick
Disconnect the joyce stick.
Just use mind to move the cursor
Hook up robot arm that moves with cursor movements.
WHY????
The defense reason that F22 is difficult to control with joyce stick. If you could control with mind <-> machine connenction. Feeding information into skull real time...blur line between made and born. That is the official reason we are doing this. The real reason is the guy who heads the lab has a daughter with ceribal palsy who can't walk on her own and what if she could control machines with her thoughts that moved he legs? This is a dramatic change in what it means to be human.
The Berry Bonds - steroid controversy - is the tip of the iceberg in terms of what does it mean to be enhanced? - what are the social implications? Should he have an asterix next to his name because he is not the same type of human being as those who's records he broke?
There will be people who are delighted to adopt these advances.
There will be NATURALS who are like todays vegetarians
The REST - for reasons of geography or economics are not enhanced and will envy and despise those who are. THIS HAS POLITICAL CONSEQUENCES.
What is driving this is GRIN - Genetics, Robotics, Information and Nanotechnology.
To be continued...

Curious about the people around you? Pantopic takes the openness, and, well, 'browseability' of an online community into the real world. Once you install pantopic, your phone becomes like a webpage that only people in your immediate area can read.

The fun part comes when you link up with pantopic groups in your area. Once you do, you'll be able to get information about who your friends are hanging out with, and where. It's going to be a few years before a lot of people have this technology. Pantopic tries to solve the saturation problem by focusing on seeing activity in your groups.

Neighbor node

One night in Barcelona last year, a young Dutchman named Antoine Hazelaar received a strange proposition from the owner of a local nightspot, the Baja Beach Club. The club had just started a new programme called VipChip, he was told, and for E125, a qualified nurse could inject a device the size of a grain of rice, a VeriChip, into his upper arm. Once implanted, it would transmit an ID number to a scanner that would recognise Hazelaar as a special customer, so he wouldn't have to wait in line and would get access to a private lounge. Since he would be one of the first people to be injected, the nightclub's management would waive the initiation fee.
ADVERTISEMENT

Hazelaar agreed. At about 8pm one spring evening, in front of a throng of journalists, he sat down on a sofa in the cavernous Baja with another Dutch expat and a Spanish woman, ready to be injected. Bandages, needles and syringes were ceremoniously laid out on a cocktail table. Thanks to a local anaesthetic, Hazelaar didn't feel the long shaft, about the size of a large sewing needle, as it entered his flesh. He didn't feel the chip either, and a year later, he still doesn't. "I forgot that I had it until you called," he said.

Now, every time Hazelaar visits the Baja, he strides past the queue outside and goes straight to the doorman, who scans his arm until his name and photograph pop up on a computer screen. When he goes through another checkpoint at the special VipChip lounge, the number under his flesh becomes a payment instrument, like a loyalty card at Starbucks.

A waitress runs a scanner over his right bicep and the cost of a drink is deducted from his account.

As it turns out, Hazelaar became one of the world's first human debit cards. But he wasn't the last. The Baja now has 90 implanted VIPs; there are 70 at its sister club in Rotterdam, which opened last November. Even though the injection now costs E1,500 per person - including a E500 drinks credit - both establishments have waiting lists. Club co-owner Conrad Chase, a former star of the Spanish version of Big Brother, says his group might expand to Valencia and Hamburg, where they will also offer VipChip membership.

Some might say that this technology was inevitable, but how has this slightly creepy device become even remotely popular? And will it one day become part of everyday life?
.....
Ultimately, the choice is fear versus fear. What makes people feel most vulnerable? A hacker running up to them with a scanner, or news stories of rampant ID theft, infant abductions, botched surgeries, convicts on the run and terrorists among us? The VeriChip may be an extreme solution for extreme times, but the days when it could be dismissed as futuristic fancy are clearly long past.

What's your measure of how complex a single-sign-on technology can be so it can be adopted broadly?

A weekend of implementation effort, maximum. Here's why: SSO only makes sense if basically everybody can implement it. That includes a lot of players, from your 401k plan (who could probably afford a lot more than that) down to the message board of the parent-teacher assocation that's run by Joey's dad on his home Linux server. Joey's dad is not going to spend more than a weekend of his time to make it work. He's also not going to go out and buy expensive software. He might download some Perl, but that's about it. Ergo: one weekend, no more.

Technorati Tags: xri/xdi, truisms

• The trusted web Anyone can save, tag, and share knowledge with their community.
• Personalized search My Web 2.0 is powered by Yahoo!'s new MyRank Search Technology, which provides personalized search results based on the shared knowledge of the people they trust.
• Control over what is shared and with whom Each page saved and tagged can be shared with the world, just with friends and their friends, or kept private.
• Structured tagging The internet is about much more than web pages - key dimensions like time and location can be as important as the content itself.
• Open APIs - Through the use of My Web 2.0's XML and RDF APIs , a whole host of new applications can be built - like what the folks in the Stanford University TAP project are working on.

http://www.ysearchblog.com/archives/000130.html