We had a session that highlighted all the different standards bodies standards and we are now working on getting the list annotated and plan to maintain it on the Identity Commons wiki that Jamie Clark so aptly called "the switzerland" of identity.

We have a Satellite event for sure in DC January 17th - Registration is Live.

We are working on pulling one together in Toronto Canada in

early February, and Australia in Late March.

ID Collaboration Day is February 27th in SF (we are still Venue hunting).

I am learning that some wonder why I have such strong opinions about standards...the reason being they define the landscape of possibility for any given protocol. When we talk about standards for identity we end up defining how people can express themselves in digital networks and getting it right and making the range of possibility very broad is kinda important.  If you are interested in reading more about this I recommend Protocol:  and The Exploit. This quote from Bruce Sterling relative to emerging AR [Augmented Reality] Standards.

If Code is Law then Standards are like the Senate.

Founded in 2005 by me, Doc Searls, and Phil Windley (Yes it is an odd but fun bunch), IIW is focused  on user-centric digital identity.   Registration is Open!

Internet Identity Workshop #13 October 18-20 in Mountain View

The Internet Identity Workshop focuses on “user-centric identity” and trying to solve the technical challenge of how people can manage their own identity across the range of websites, services, companies and organizations that they belong to, purchase from and participate with. We also work on trying to address social and legal issues that arise with these new tools.  This conference we are going to also focus some attention on business models that can make this ecology of web services thrive.

The NSTIC Stakeholder community has been invited.

Today it goes beyond “just” identity to be inclusive of:

• Open Standards that have been born and developed at IIW - OpenID, OAuth, Activity Streams, Portable Contacts, Salmon Protocol, SCIM, UMA... (too many to name)
• The Federated Social Web
• Vendor Relationship Management
• Personal Data Services -  collection, storage and value generation
• Anonymity Pseudonymity and Reputation Online (think Google+ controversy)
• Legal Innovation including, Information Sharing Agreements, Data Ownership Agreements and the development of “trust” frameworks (I personally prefer Accountability Frameworks for the same concept but we shall see).
• NSTIC - the National Strategy for Trusted Identities in Cyberspace (it uses the term “user-centric identity” 4 times & “citizen-centric identity” once)
• Cloud Identity and the intersection of enterprise ID and people (consumer) ID.

IIW is the place where everyone from a diverse range of projects doing the real work of making this vision happen gathers and works intensively for three days.  It is the best place to meet and participate with all the key people and projects!

Tuesday Day 1 will begin at 9:00AM with introduction/orientation followed by Agenda Creation. There will be 5 working sessions then a community dinner out on the town.

Wednesday Day 2 NSTIC Day will have agenda creation beginning at 9:00AM. There will be 5 working sessions and a demo hour after lunch. There will be a community dinner out on the town.

Thursday Day 3 YUKON Day Will begin at 8:45AM with a brief introduction followed by agenda setting. There will be 5 working sessions and we will end by 4pm.

Special Days at this IIW!

Wednesday is NSTIC Day: This simply means that if you are super keen on talking about NSTIC topics and technologies and you only have one day to attend then come Wednesday. NSTIC will be covered on all days of the conference and other things will be discussed this day too.

Thursday is Yukon Day: One of the longtime themes of IIW is how identity and personal data intersect.  Many important discussions about Vendor Relationship Management (VRM) have also taken place at IIW.  In recognition of how personal data and identity are intertwined, the third day of the IIW, will be designated "IIW + Yukon" and will stress the emerging personal data economy.  The primary theme will be personal data control and leverage, where the individual controls and drives the use of their own data, and data about them held by other parties.

This isn't social. It's personal.  This day you can expect open-space style discussions of personal data stores (PDS), PDS ecosystems, and VRM.  One purpose of Yukon is to start to focus on business models and value propositions, so we will specifically be reaching out to angels and VCs who are interested in personal data economy plays and inviting them to attend.

How does it work?

After the brief introduction on the first day there are no formal presentations, no keynotes, no panels. We make the schedule when we are face to face the first day of the conference. We do this in part because the field is moving so rapidly that we your organizing team are in no position to know what needs to be talked about. We do know great people who will be there and it is the attendees who have a passion to learn and contribute to the event that will make it.

The event compiles a book of proceedings with the notes that are gathered from the conference. You can find the Book of Proceedings for IIW7, IIW8,  IIW9, IIW10,  Satellite IIW Europe & DC-East Coast, IIW11, IIW12  here. BTW these documents are your key to convincing your employer that this event will be valuable. As attendees register we ask about topics they wish to discuss - the topics list is posted here on our wiki.

I wrote the original post after watching the Bradley Horwitz (@elatable) - Tim O'Reilly (@timoreilly) interview re: Google+. I found Tim's choice of words about the tone (strident) and judgement (self-righteous) towards those standing up for their freedom to choose their own names on the new social network being rolled out by Google internet's predominant search engine disappointing.  His response to my post was to call me self-righteous and reiterate that this was just a market issue.

I myself have been the victim of a Google+ suspension since July 31st and yesterday I applied for a mononym profile (which is what it was before they insisted I fill out my last name which I chose to do so with my online handle and real life identity "Identity Woman") 

In the thread this morning Tim said that the kind of pressure being aimed at Google is way worse then anything they are doing and that in fact Google was the subject of a "lynch mob" by these same people.  Sigh, I guess Tim hasn't read much history but I have included some quotes form and links to wikipedia for additional historial context.

Update: inspired in part by this post an amazing post "about tone" as a silencing/ignoring tactics when difficult, uncomfortable challenges are raised in situations of privilege was written by Shiela Marie.  

I think there is a need for greater understanding all around and that perhaps blogging and tweeting isn't really the best way to address it.  I know that in the identity community when we first formed once we started meeting one another in person and really having deep dialogues in analogue form that deeper understanding emerged.  IIW the place we have been gathering for 6 years and talking about the identity issues of the internet and other digital systems is coming up in mid-October and all are welcome.  The agenda is created live the day of the event and all topics are welcome.

Here's the thread... (oldest tweets first)

 Note all the images of tweets in this thread are linked to the actual tweet (unless they erased the tweet). 

Steve, thanks for highlighting the bizarre choice to use a "lynch mob" as the metaphor to describe what is happening to Google around this issue.

From Wikipedia: Lynching is an extrajudicial execution carried out by a mob, often by hanging, but also by burning at the stake or shooting, in order to punish an alleged transgressor, or to intimidate, control, or otherwise manipulate a population of people.... Lynchings have been more frequent in times of social and economic tension, and have often been means used by the politically dominant population to oppress social challengers. 

The article on Lynch Mobs is part of the Discrimination set of articles in Wikipedia. Within sociology, 'discrimination' is the prejudicial treatment of an individual based on their membership in a certain group or category. Discrimination is the actual behavior towards members of another group. It involves excluding or restricting members of one group from opportunities that are available to other groups. An individual need not be actually harmed in order to be discriminated against. He or she just needs to be treated worse than others for some arbitrary reason.

 

From the Wikipedia article on Oppression: Indirect oppression is oppression that is effected by psychological attack, situational constraints or other indirect means. It has been a popular tactic practiced in single power, power monopoly or other authoritarian or totalitarian regimes.

The point I was making with my previous post Google+ says your name is "Toby" not "Kunta Kinte" is that Google is being discriminatory and oppressive towards people who refuse to use their "wallet names" and who choose to go by pseudonyms.  Which party in this situation is really acting like a lynch mob?

As I said in my previous post the tone of those who are suffering at the hands of this policy implemented by THE dominant search utility on the web are loud, shrill, piercing, high-pitched and rough sounding and I imagine are heard by those within Google who are receiving them as grating and obnoxious. Rather then empathizing with human pain and suffering that is reflected in the tone, Tim and others are just dismissing them and their concerns.  Here is one of the clearest posts by someone very affected by what Google is doing: To those who say they "don't get it"...(Google, G+, etc) 

Really? Google+ is effectively lynching, that is killing the digital persona's of people who's names don't conform to its policies. So what is not extreme about that? is there a middle ground when you feel your digital life is threatened? Of course the reaction of people has some edge to it because people feel that the digital identifier that is the anchor for their "digital body" could be terminated and thus puts their digital lives are at risk.  They are being a bit shrill when the talk about the issues because they are deeply personal and have real impact on their lives because it impacts their ability, their freedom to communicate.

To close, Doc Searls has a great post up about what this might all really be about Circling Around your Wallet.

  Note all the images of tweets in this thread are linked to the actual tweet (unless they erased the tweet). 

One theory I have about why this works is because it is not obvious how you pronounce my name when you read it.  And conversely, it isn't obvious how you write my name when you hear it.  So the handle that is a bit longer but everyone can say spell "Identity Woman" really serves me well professionally.  It isn't like some "easy to say and spell" google guy name like Chris Messina or Joseph Smarr or Eric Sachs or Andrew Nash. I don't have the privilege of a name like that so I have this way around it.

So today...I get this

I have "violated" community standards when using a name I choose to express my identity - an identity that is known by almost all who meet me. I, until last October, had a business card for 5 years that just had Identity Woman across the top.

Display Name - To help fight spam and prevent fake profiles, use the name your friends, family, or co-workers usually call you. For example, if your full legal name is Charles Jones Jr. but you normally use Chuck Jones or Junior Jones, either of these would be acceptable. Learn more about your name and Google Profiles.

Along with making this choice these are the other equivalently bad community standards violations that can lead to Google+ account suspension:

• Nudity and sexually explicit material.
• Hate Speech
• Impersonation
• Private and Confidential Information (posting credit cards or SSN's)
• Copyright violations
• Illegal Activities
• Spam, Malware and Phishing
• Profile Picture Your profile picture should not include mature or offensive content.

So here are the rules:

Google services support three different types of use when it comes to your identity: unidentified, pseudonymous, identified. Google Profiles is a product that works best in the identified state. This way you can be certain you’re connecting with the right person, and others will have confidence knowing that there is someone real behind the profile they’re checking out. For this reason, Google Profiles requires you to use the name that you commonly go by in daily life.

So, I AM "identified" with this profile. Here is a photo business card. I believe all of the above identified guys who have those easy to "say/spell" names work on Google+ or on identity at Google.  They all have my business card and got it many years ago.

There are several issues that I have with this statement that go beyond the point being made in this post.  Believe it or not, not all people use the "same identified" name in all aspects of their lives.  Women professionals who are married quite often keep their maiden name in their professional work and in social situations go by their married names.  They actually manage their contexts by having different names.   Say they are the local pediatrician and they don't wan all their patients to know about their practice of some perfectly harmless, but not locally socially acceptable, religious belief system, but they would like the privilege of expressing, sharing links and information about that religion with other members of their religious community and not having it affect their medial practice.

People with personas - particularly long standing ones, over significant portions of a life time, are someone real. They just don't link all of their life contexts together. Whether it is participating in the Society for Creative Anachronism, being a hard core board gamer, playing WOW or other video games, being in a sexual minority community,  the list can go on and on......see the Geek Feminism list of who is harmed by real names for a relatively complete list. These real people should have the freedom to express themselves online in services like Google+. Yes, impersonators (someone pretending to be Lady Gaga or whatever) and trollers, (people just being nasty mean) shouldn't be tolerated - that comes from social moderation. Vesting of identities (in wikipedia it takes TOR originated accounts 10X as long to get full editing privileges) and reputation for persistant identities (are they good actors in the system should be the question not "is this their legal name?").

I believe that a persona should be accountable for their behavior. We need new legal innovations that support a Limited Liability Persona - if the persona defrauds someone or is cultivating hate speech or some other egregious law breaking activity then it can be "unmasked". But it doesn't mean we create an internet where the only people who are free to talk are those who use their "real names".

I wrote this post on the need for Accountability Frameworks for the web. The current trajectory from industry, encouraged by government (via NSTIC), is that only "identities that are verified to be linked to real legal names" should be trusted. They are not currently including marginalized groups and those who suffer from hardline real-names-only policies (real people from these groups, transgendered people, black people, old people, women in technology etc) in any of the development of the legal/technical/policy framework development around NSTIC.

But back to my point for now. I am being my professional self to which this name and handle are linked. That is me being me.

I consciously made the choice not  to list either of my last names in my profile headline (they are both listed in my list of "other names" so people who search by them can find me).  Neither particularly feels like me and I am thinking about changing my last name officially some time in the next few years and doing away with both.  I am not keen on having everyone get used to one (because it is on Google+) and then changing it on them shortly.  I know I am not changing my handle any time soon. I might retire it if I choose to leave working in this sector but that isn't likely for another 5-10 years.  This is what google says I must do:

Use your full first and last name in a single language.
If you use your full name, you'll help people find you online and connect with the right person. Note that professional titles such as "Dr." or "Prof." aren't allowed in the first or last name fields. If you’re referred to by more than one name, just choose one, and place the others in the “Other names” section of your profile.

I am going to stick with my identity as I choose to express it.

This issue of names and being able to choose how and where you express them is about privilege and power and who is free to speak on the internet. What the terms and conditions are of speech on the internet.  Who gets to decide you are "real" or not?  Is it going to be the state who issued you a piece of paper when you were born? (2/3+ of the world doesn't have one of those). Is it the internet service you use to get your e-mail? Is it the DMV? Or is it the people you know and know you by a name depending on the real context you are in?  If the data base society we are living in means all uses of one's "real name" can be linked together, and if all the systems and services we use decide they can only "trust" us if we tell them our "real name" then we will live in a very repressive society.

Our logo at the Internet Identity Workshop is this the "identity dog" - He is an allusion to the New Yorker Cartoon - "On the Internet, nobody knows you're a dog"

It symbolizes three human rights:

1. The Freedom to be who you want to be online, i.e., the right to anonymity and pseudonymity.
2. The Right to curate the information about yourself that can be found online.
3. The ability to express verified claims about yourself and share detailed information when you want with people and organizations.

There are many authors who have also commented on what the cartoon's deeper meaning.  I picked up Cybertypes: race, ethnicity, and identity on the Internet a few years ago. It has this to say about what it means:

On the Internet, Nobody Knows You're a Dog; it is possible to “computer cross-dress” and represent yourself as a different gender, age, or race. In millennium America, this supposedly radically democratic aspect of the Net is celebrated and frequently and unconditionally. The cartoon celebrates access to the Internet as a social leveler that permits even dogs to freely express themselves in discourse to their masters, who are deceived into thinking that dogs are their peers rather then their property. The element of difference, in this cartoon the difference between species, is comically subverted in this image; in the medium of cyberspace, distinctions and imbalances in power between beings who perform themselves solely through writing seem to have been deferred, if not effaced.

This utopian vision of cyberspace as a promoter of a radically democratic form of discourse should not be underestimated. Yet the image can be read on several levels. The freedom of which the dog chooses to avail itself is the freedom to “pass” as part of a privileged group - human computer users who can access the Internet. This is possible because of the discursive dynamic of the Internet, particularly in chat spaces like LamdabaMOO, where users are known to others by self-authored names they give their “characters” rather than more revealing e-mail addresses that include domain names.

What is privilege you ask?

Privilege is a set of perceived advantages enjoyed by a majority group, who are usually unaware of the privilege they possess.  A privileged person is not necessarily prejudiced (sexist, racist, etc) as an individual, but may be part of a broader pattern of *-ism even though unaware of it.

I believe this is true of the mostly young men making and enforcing this policy at Google. (I am consciously saying this because Google is 80% men and they are mostly young and mostly living in, what one could easily argue, is the most liberal metropolitan region of the world).  They are completely oblivious to the the privilege they have to use their real name in all aspects of their lives and not suffer at all for it.

Geek Feminism goes on to share this:

Many people, when asked to check their privilege, respond with "So? Am I meant to feel guilty? I didn't choose to be white/male/whatever." A good article addressing this is "Check my what?" On privilege and what we can do about it."

I am sticking by my name.  It's Kaliya - Identity Woman.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Update: After finishing this post it seems that just petitioning google either via their appeals process OR via sites like this might not work.

The image that came to mind to augment the online agitation around this issue is - nyms dancing on their lawns in a "march of persona's" - I articulated it in more detail here a few days later. Nymwars: IRL on Google's Lawns - I created an (organizing list here), (get updates here) - we shall see what happens.

I think people showing up on Google's doorsteps around the world and being open to dialogue might be something more tangible then just written word. Real people with real persona's (along with allies who use their "real names" everywhere) sharing real stories about how they use their persona's and why. Looking Googlers in they eye who are mostly young and male and privileged and share their stories of age discrimination, gender discrimination, sexuality choices, weird hobbies they have etc. and why they need these freedoms. Hopefully getting some more understanding of how forcing "real names" doesn't make the interewebs safer but more repressive, less interesting, and less good for their business model - because people choose to share less.

The first version of this without the visuals was "Million" Persona March on Google.

Proactive Development of Shared Language by NSTIC Stakeholders

In 2004-5 the Identity Gang (user-centric identity community) was 1/10 the size of the current NSTIC stakeholder community.  It took us a year of active grassroots effort to develop enough common language and shared understanding to collaborate. NSTIC doesn’t have 5-10 years to coalesce a community that can collaborate to build the Identity Ecosystem Framework. To succeed, the National Program Office must use processes to bring value and insight while also developing  shared language and understanding amongst stakeholders participating.

Fostering conditions for high-performance collaboration

amongst the community to emerge must be a top priority for the NPO. One way to do this is to use methods that grow shared language and understanding such as Value Network Mapping and Polarity Mapping (more on them in forthcoming posts). The NPO with just a few staff could host many small focused convenings with stakeholders locally around the country and at industry events throughout the fall. With small collaborative meetings, and proactive support of network weaving [defined by Bill Traynor summarized by Eugene on his wiki] across stakeholder groups, I believe the community of NSTIC stakeholders would be in place just like the IIW community was at the first IIW. NSTIC must support self-organizing to create a thriving ecosystem through  shared language, understanding amongst NSTIC stakeholders by January.

Origins of Shared Language for Identity Collaboration

In the Beginning...

We (the Internet Identity Workshop / user-centric identity community) have been successful over the last 6 years in part because the format of many organic opportunities has shared language to emerge leading to greater and greater collaboration. The community began when some of us found each other at Digital Identity World conferences. There were only a few very user-centric focused people and we stood out amongst the enterprise oriented attendees. We liked each other and wanted to collaborate, so we started a mailing list together. Doc Searls asked a few people to be on Steve Gillmor’s Gillmor Gang December 31, 2004 and thus the “Identity Gang” was born.

The Gillmor Gang, Dec 21, 2004.“This week The Gang digs deeper into digital identity with a panel of experts. It begins as a Kumbaya of identity vendors and technologies, but by the second half the gloves come off.”

Everyone in the identity community listened to that particular podcast as it was sent out via e-mail to our mail list. Talking on mailing lists was an easy way of talking about shared topics of interest.

Everyone’s Blogging

We were very lucky in late 2004 that a new medium, blogging, was just breaking through, providing space for us to express our points of view and connect dots between different perspectives and meanings. Doc Seals encouraged many of us to begin blogs on identity, and in 2005 the way you came to have an identity (you felt you belong and other people identified you as belonging) within the community was to create a blog and share your ideas. At that time, were over 50 blogs touching on user-centric identity ideas and concepts. Pat Patterson started an aggregate blog at Planet Identity pulling in rss feeds from all those early community members.  It has grown since then and today the has 172 blog rss feeds aggregated. The day to day conversations linked through blog posts gave us the ability was yet another way we fostered shared language.

Debates raged in these mediums about word meaning as we  sought to understand profound questions. Examples include:

• Is identity a claims or an attribute?
• What is Identity anyway?
• How is a digital identity different then an identity?
• Are identities really just identifiers?
• Why is direct identity important?
• Why is selective disclosure important for privacy?
• Is the domain name space enough or should there be a namespace for people?

Here is a post by Phil Windley after the meet up at Burton Group Catalyst 2005 discussing the terms that people were debating meaning around.

Thought leaders like Kim Cameron published his Laws of Identity in 2005 on his blog, one a week. Each week, everyone anticipated the next Law’s arrival and then people commented on Kim’s blog, wrote posts on their own blogs and discussed on mailing lists. He really listened and used the feedback from all of us in the final paper that was published. The paper’s opening thanks over 30 people for their thoughts and comments.

A key example is Aldo Casteneda’s Podcast: the Story of Digital Identity had 60 episodes recorded over 2 years. While working on a thesis for his law degree, he decided he would reach out to people blogging about user centric digital identity and related subjects to interview them. These interviews helped people connect to each other across time and space, learning more about them, sharing each person’s world view in a way that was different than reading about it on a blog or in e-mail.

Lexicon Development

Paul Trevithick led another vital community effort. He was frustrated with the experience of people talking past each other as they used different words to mean the same thing and the same words to mean different things. He had spent several years thinking about core identity ideas and concepts with a developed a vocabulary for it.  He knew that if we didn’t sync up on lexicon, we would be totally ineffective at actually communicating with one another and never be able to collaborate to get anything built.

However Paul did something more then just push for finding common definition, before the community began work on what could have been a contentious exercise. He collaborated with the community to define a goal and the methods. The dialogue around the word meaning happened to the 3 months prior IIW#1 in the fall of 2005 and at that event Paul presented the first draft of the Lexicon and asked for more feedback from the 80+ people attending.

The goal of developing a lexicon was scoped narrowly, met real needs and the goal was achieved.  The community who had been intensely debating the nuances of these words and related concepts so that it had a shared place to point to where community members had collaboratively agreed on the meanings for certain key words agreeing to stick to those meaning when writing in the future.  This solved problems everyone was having being understood and understanding and its completion was as cause for celebration. In this small success grew trust in the community and a willingness to take more effort in the future to collaborate in ways that went beyond the explicit creation of shared language.

Identity Community Development

On mailing lists, via blogs and in Aldo’s podcasts, we enjoyed talking with one another about identity, exploring how different ideas could be articulated in software and digital systems. People piped up on the “Identity Gang” list about events they were going to like PC Forum (Esther Dyson’s PC Forum conference) [see Doc's Photos from that meeting] or Burton Group Catalyst Conference.  More people pipped up, joining events and asking for meetups.  No requests were turned down for meetings. These face to face conversations were layered onto an active community conversations in written form online. We would feel just like Drummond Reed did in the story Eugene Kim told above.

From Meet-ups to the Internet Identity Workshop un-Conference

After a few of these meet-ups, we realized we needed to host our own mutli-day conference. Doc Searls, Phil Windley and I agreed to work together on the first IIW, held October 2005. The first day, presentations of papers was the normative format of presentations. We invited all technologies that were user-centric in orientation to get presented, with eight presentations that day. This was the first time these technologies had all been in one place and everyone shared what their tech did and how it worked. The first IIW event added to yet more shared language development.

I knew of this great method called Open Space Technology which let people self-organize a schedule for a conference in real time. Instead of just talking at each other for one day, why not gather again in the morning and try this format out? It turns out, that first Open Space day fostered the founding of OpenID - through the conversations leading to a shared understanding between two identity system providers (OpenID and LID/Lightweight Identity), followed by three (XRI) after which a forth joined (sxip) the different technology protocols. All four agreed to meet up again after IIW to continue shared work to do endpoint discovery for URL-based identifiers for login authentication. Through conversation at IIW, OpenID collaborators learned about the XRDS format (eXtensible Resource Descriptor Service) within another already existing standard,  XRI, and this new thing for a short time was called YADIS. It was jokingly referred to as “Yet Another Discovery Identity Service.” You can see the old site for it here http://yadis.org. Shortly after, it was agreed that OpenID was the best name amongst the bunch and so it became OpenIDv2. XRDS as evolved to XRD-Simple and then was finalized as a specification of the XRI technical committee at OASIS. It now is a key part of many other protocols such as OpenID, OAuth, and UMA.

Collaboration Doesn’t “Just Happen”

The point in sharing all these stories about evolving identity systems is to make clear the collaboration present at the first Internet Identity Workshop. It was no accident that the community worked together to develop shared language and grow understanding using in shared spaces (mailing lists podcasts, conference rooms, our own conference), with shared displays (wiki’s, white boards). We are very lucky to have Eugene Kim, a collaboration expert, give us good advice about practices (both online and offline) to use that mapped to proven patterns of collaboration.

His advice steered us away from making organizational choices for the community that would likely disrupt or inhibit collaboration, and towards methods and patterns that enhanced collaboration. I and others proactively wove the community together linking people who shared ideas and interests.

The user-centric identity community’s culture of collaboration online and at events has continued since that first IIW in part because we (myself, Doc and Phil) don’t steer the community. Instead, we make space for it to self organize and get work done with proper support.

What is special about our Events?

Since the first IIW, I have designed and facilitated over 150 participant-driven events for a variety of communities around the world. When I design an event, I ask my clients to articulate the purpose of event. I then ask to co-develop profiles of potential attendees and what the client goals are likely to be. With the data outlined, I choose methods and tools that are likely to meet the needs of the attendees and reach the goals of the organizers. There are many dozen methods to choose from,  some of them more converging then others. For example, The most amount of time I allow a mode where one person talks at people in lecture mode is 1/4 of the total conference time. Although IIW seems like it is the same every time, we always make a point of reviewing where the community is at and tweeking the design to meet the current needs.

IIW has no “steering group”

We have been very lucky to get the best advice regarding good patterns for ongoing community collaboration online, and have my talent for creating and holding space for the community to gather every 6 months at IIW and other satellite events (last fall we had DC and London).  Our culture of collaboration is valued by most as very effective. But there is no “steering group.” We  don’t set an agenda for the conference other then naming the broad theme of user-centric identity. There is no gate keeper. It is a self organizing space within Open Space principles and this has a lot of power to allow progress on the development of open and adoptable standards. The latest work to arise out of IIW is SCIM, Simple Cloud Identity Management.  You can see links on Phil Hunts blog to several posts about the conversations at the last IIW.

This post is from pages 12-16 of Kaliya's NSTIC Response - please see this page for the overview and links to the rest of the posts. Here is a link to the PDF.

This is the section before: Ecosystems Collaborate Using Shared Language

This is the section after: Alignment of Stakeholders around the many NSTIC Goals

Sidebars in the Document:

Identity Gang Lexicon

Goal

To create a minimal set of terms that enable discussion of the technical operations, technical architecture, and user experience of user-centric identity systems.

Method

1. The terms should be as few in number as possible and build on one another.
2. To be as accessible as possible we may have to avoid using single words whose meanings are either too broad or are overloaded in common usage, and instead use multi-word combinations. For example, we will define "digital identity" to have a single specific meaning and avoid using the single word term "identity."
3. If we're successful one should be able to easily visualize what the digital manifestation of a given term might be.
4. There are several other existing sources of definitions. Where these can be referenced, they should be.
5. We will use as a starting point the three terms put forward by Kim Cameron in his Laws of Identity: Digital Identity,Digital Subject, and Claim.
6. Each term will have a concise and carefully edited description. Comments on these terms should not conflict with the definition, but should provide insights on the definition from multiple perspectives. In the interest of color and nuance these comments will not be held to the same editing standards as the definition.

The LEXICON

The Lexicon was developed by the Identity Gang it is a resource for the whole community to have a shared language.The following terms and definitions have been compiled since August 2005. See also Lexicon Goal and Lexicon Style Guide.

Agent

Claim

Claimant

Digital Identity

Digital Identity Provider

Digital Subject

Entity

Identity Attribute

Identity Context

Party

Persona

Relying Party

OpenID "The Next Generation":

In my last post I said some things that some people associated with particular technologies may have interpreted in a way that I didn't intend.  I said "OpenID as we know it" was dead - but OpenID itself is very much alive and making progress to the next generation of OpenID. The work led by Nat Sakimura on Attribute Binding and the proposal to do an OpenID Connect by David Recordon have merged into OpenID-ABC.   They are making steady progress led by John Bradley and Nat with active participation from Microsoft, Google and Facebook.  My hope is that some more people from independent web perspectives - hint hint Evan and Sarah  can get involved too.

The OpenID Summit on May 2 will be a place where people are gathering to focus on the technology and progress will be made at IIW following.

Media, Trust and the Freedom to Comment:

Issues surfacing around the release of Facebook Comments and the "protection" they in theory give against trolls - articulated here on TechCrunch.

Facebook Comments homes in on trolling by forcing real identity, but the end result isn’t just the silencing of trolls, it’s the silencing of everyone.

I have been surprised by the number of projects surfacing about how individuals share and connect information about media.  Bill Densmore has had a project called CircLabs for a while. Hypothes.is is a project that I just learned about that is in the research phase.

Personal Data - Legal and Technical Issues:

The buzz around various startups in the Personal Data Ecosystem is growing. Kynetx, Phil Windley's company, has launched their new site for apps on the live web. This week TrustFabric put out Beta 3. Tara Hunt published an article about Personal Data on O'Reilly Radar.  Drummond & Joe are working on Connect.me. Azigo has new software out. Mydex has completed its community prototype in the UK. Personal.com has a site up but is not live yet. Statz.com has begun a board of trade for people's data and lets them upload their data. Folks from the Locker Project will also be attending.

Last week was Personal Data 2.0 with many sessions about key issues - it was a great warmup for IIW and precursor for the same workshop a week after IIW in London the same day as a similar conversation at the European Identity Conference.  We are hosting Yukon Day, a day we are inviting investors to, on the third day of IIW.  There are many legal issues to be discussed around data and rights. Scott David wrote a post about why lawyers should come to IIW.

NSTIC: Making it Real

The National Strategy for Trusted Identities in Cyberspace is being announced today at the US Chamber of Commerce. I wrote about why we shouldn't freak out about it after the program office was announced at Stanford. Government leaders working on actually implementing open standards for identity login at NIH and other agencies participated in our east coast satellite event last September in DC.  This coming IIW will be a great opportunity to make progress in the dialogue about the issues NSTIC raises and to get down to the nitty gritty of implementing.

The Internet Identity Workshop #12 - 2011A
May 3 - 5, 2011
Computer History Museum, Mountain View, CA

REGISTRATION

The Internet Identity Workshop focuses on “user-centric identity” and trying to solve the technical challenge of how people can manage their own identity across the range of websites, services, companies and organizations that they belong to, purchase from and participate with. We also work on trying to address social and legal issues that arise with these new tools. Emerging themes include: Trust Frameworks, the next generation of OpenID -> Connect, Identity in the Browser/Active Clients, Personal Data and a new Ecosystem around data aggregated and controlled by end users, managing, Identity in the Cloud, the Federated Social Web and emerging standards & code for that along with Vendor Relationship Management.

Something New: IIW + Yukon: One of the longtime themes of IIW is how identity and personal data intersect. Many important discussions about Vendor Relationship Management (VRM) have also taken place at IIW. In recognition of how personal data and identity are intertwined, the third day of the IIW, May 5, will be designated "IIW + Yukon" and will stress the emerging personal data economy. The primary theme will be personal data control and leverage, where the individual controls and drives the use of their own data, and data about them held by other parties.

A Warm Up Event: STLPartners/Telco 2.0 - New Digital Economics Personal Data Ecosystem Workshop April 7th is happening 1 month before IIW it is a warmup event - helping make connections to the Telecommunications space. Their European event will be in London the week after IIW.

This isn't social. It's personal. This day you can expext open-space style discussions of personal data stores (PDS), PDS ecosystems, and VRM. One purpose of Yukon is to start to focus on business models and value propositions, so we will specifically be reaching out to angels and VC's who are intersted in personal data economy plays and inviting them to attend.

A follow-up event: Digital Death Day, May 6th.

Preceding event OpenID Summit on May 2nd.

IIW is the place where everyone from a diverse range of projects doing the real work of making this vision happen gathers and works intensively for three days. It is the best place to meet and participate with all the key people and projects! As a community we have been exploring these kinds of questions:

How are social networking sites and social media tools applying user-centric identity?
What are the open standards to make it work? (identity and semantic)
What are technical implementations of those standards?
How do different standards and technical implementations interoperate?
What are the new social norms and legal constructs needed to make it work?
What tools are needed to make it usably secure for end-users?
What does user-centric identity mean for enterprises?
What are the businesses cases / models that drive all this?

Topics already proposed can be seen on the wiki. As people register they are asked to share their ideas. Anyone at the workshop can propose a topic/session.

How does it work?
After the brief introduction on the first day there are no formal presentations, no keynotes, no panels. We make the schedule when we are face to face the first day of the conference. We do this in part because the field is moving so rapidly that we your organizing team are in no position to know what needs to be talked about. We do know great people who will be there and it is the attendees who have a passion to learn and contribute to the event that will make it.

Schedule
The agenda will be created live each day by attendees present at the opening of the day.
Tuesday Day 1 will begin at 9am with introduction/orientation followed by Agenda Creation. There will be 5 working sessions. Dinner is included and served at a local restaurant.

Wednesday Day 2 will have agenda creation beginning at 9:00. There will be 5 working sessions and a demo hour after lunch. Dinner is included and served at a local restaurant.

Thursday Day 3 will have agenda creation begin at 9:00. There will be 5 working sessions and we will end by 4pm.

There is a related but different event following on Friday - Digital Death Day: What happens to your data after you die? (and other questions of online life after death.

Hotels
The Hotel Avante has given IIW as special rate and offers free shuttle service to the Computer History Museum where IIW is held.

There are a few related events:

STLPartners/Telco 2.0 - New Digital Economics Personal Data Ecosystem Workshop April 7th. Happening 1 month before IIW it is a warmup event - helping make connections to the Telecommunications space. Their European event will be in London the week after IIW.

Kynetx Impact is the developer conference for Phil Windley's company focused on how to make apps responding to data in real time.

Privacy Identity and Innovation: Building Trust in the Digital Age is happening the third week of May in Santa Clara and will likely feature many IIW community members.

You can join our Announcement list here to be notified when IIW's are coming up.

Bringing together user-centric, enterprise and government identity initiatives.

Registration is live and you can see who is registered on the page.

We have an amazing group of people registered and a really diverse range of proposed topics.

AND we have this really cool poster!

Thanks for inviting me here to speak with you today.

The purpose of my talk is to share a new possibility for the future regarding users' personal data that most have not yet explored. It sits between the two extremes of a familiar spectrum.

On one end, “Do not track” using technology and a legal mandate to prevent any data collection.

AND

On the other end, “Business as usual” leaving the door open for ever more “innovative” pervasive and intrusive data collection and cross referencing.

There is a third possibility that aligns with peoples’ privacy needs as well as offering enormous business opportunities.

A nascent but growing industry of personal data storage services is emerging.  These strive to allow individuals to collect their own personal data to manage it and then give permissioned access to their digital footprint to the business and services they choose—businesses they trust to provide better customization, more relevant search results, and real value for the user from their data.

With other leading industry thinkers, I have come to believe that there is more money to be made in an ecosystem that allows users to determine which businesses have access to what data,and under what terms and conditions, than there is under present more diffused, scattershot, and unethical collection systems. Today I will articulate the broad outlines of this emerging "personal data ecosystem" and talk about developments in the industry.

Those of you who know me will find it unusual for me to have such a keen focus on making money on user data and emerging business models.

I am, after all, known as the “Identity Woman - Saving the World with User-Centric Identity”. Since first learning about issues around identity technologies online in 2003, I have been an end user advocate and industry catalyst.

In this role, I have convened the Internet Identity Workshop every six months for the last six years. This collaborative industry event brings together independent developers, major web companies, companies who sell identity solutions to businesses, and a range of others interested in our work.

User-centric digital identity technologies are focused on making individuals/ end-users/ citizens empowered with their own identity online - to have it be persistent, autonomous, be under their control.

Many of you doubtless have recognized in our logo the allusion to the famous New Yorker cartoon, “On the Internet, nobody knows you're a dog”

To me our logo symbolizes three human rights which we believe are worth fighting for:

1. The Freedom to be who you want to be online, i.e., the right to anonymity.
2. The Right to curate the information about yourself that can be found online.
3. The ability to express verified claims about yourself and share detailed information when you want with people and organizations.

Today the personal data ecosystemin which almost everyone unknowingly participates pays no heed to these rights. Each of us emits information about ourselves, our activities and intentions, in various digital forms. This information is collected by a wide range of institutions and businesses with which people interact directly; then it is assembled by data brokers and sold to data users.

CHART from FTC

This chain of activity happens with almost no participation or awareness on the part of the data subject - the individual.

The Wall Street Journal in its “What They Know” series of articles has outlined several examples. Life insurers are beginning to explore how risk can be assessed with social networking data to screen people with unhealthy lifestyles.

RapLeaf gathers transactional and social networking data linked by common e-mail addresses to build comprehensive profiles of people. Some of its clients, such as political campaigns that solicit e-mail addresses then use the RapLeaf service to get the name of the person and personal details behind the e-mail address.

Just this week, the Washington Post reported that banks are now inserting advertisements and coupons when people are banking online to make them offers based on their purchasing behavior.

Clearly there is money to be made in collecting and selling personal data.

The community of technologists focused on user-centric digital identity has labored since 2004 on technologies like OpenID and Information Cards that have had limited success. What I have come to realize is that unless businesses see a return over and above the cost of adopting new technologies that are aligned with end-user interests, nothing will change. Being “good” for the end user is not sufficient motivation to spur an industry transformation. The business value we were missing with this these early generations of user-centric technologies must be built in to the emerging Personal Data Ecosystem.

Here I’d like to highlight a key distinction: There is a fundamental difference between being watched and being seen.

Being SEEN is an act of mutual social recognition - I see you, you see me, we see each other seeing each other - we are seen.

Being WATCHED is uni-directional. It is done without the subject – I may say “the victim’s” knowledge.

Being STALKED is what happens to someone when the watching activity is aggregated, that is when someone is followed through time and space without their awareness.

The behavioral marketing, advertising and search industries are stalking people all over the web - collecting information about them and their activities without their awareness. In reaction to these wide spread industry practices, many consumer advocacy groups have proposed the development and mandating of "Do Not Track" technologies and systems.

Governments both here and in Europe are increasingly looking at formally regulating these industries, and because of this, self-regulation is emerging. Some web companies are moving to limiting data retention. For example, Google now anonymizes data after 9 months. Previously, they anonymized at 18-24 months.

My contacts in the data broker industry concur that the writing is on the wall. They see their current business practice of selling massive amounts of aggregated data about people being regulated into uselessness. Soon they only will be allowed to hold severely limited amounts of information about people for a short amount of time.

In short, the present model of massive personal data retention and cross correlation is not sustainable. Not only are governments moving to regulating these activities, but more to my point today, it is not even the best way to get useful information about people – information that can point to services they want.

The community I am leading is approaching end-user empowerment and control by simply asking this question:

What if individuals were given the tools to collect and manage their data - their digital footprint?

By a “digital footprint” I refer not only to explicit information such as named preferences -who they call or are linked to and what they buy, but also implicit information - where they click, how long they spend on pages, and the order they move through the web.

What if there were tools and services for collecting and integrating different kinds of digital data streams – data sets that only the individual could integrate?

[This list of Personal Data Types from the World Economic Forum, Rethinking Personal Data Pre-Read Document by Marc Davis published in June of 2010]

Identity and Relationships

• Identity (IDs, User Names, Email Addresses, Phone Numbers, Nicknames, Passwords, Personas)
• Demographic Data (Age, Sex, Addresses, Education, Work History, Resume)
• Interests (Declared Interests, Likes, Favorites, Tags, Preferences, Settings)
• Personal Devices (Device IDs, IP Addresses, Bluetooth IDs, SSIDs, SIMs, IMEIs, etc.)
• Relationships (Address Book Contacts, Communications Contacts, Social Network Relationships, Family Relationships and Genealogy, Group Memberships, Call Logs, Messaging Logs)

Context

• Location (Current Location, Past Locations, Planned Future Locations)
• People (Copresent and Interacted with People in the World and on the Web)
• Objects (Copresent and Interacted with Real World Objects)
• Events (Calendar Data, Event Data from Web Services)

Activity

• Browser Activity (Clicks, Keystrokes, Sites Visited, Queries, Bookmarks)
• Client Applications and OS Activity (Clicks, Keystrokes, Applications, OS Functions)
• Real World Activity (Eating, Drinking, Driving, Shopping, Sleeping, etc.)

Communications

• Text (SMS, IM, Email, Attachments, Direct Messages, Status Text, Shared Bookmarks, Shared Links, Comments, Blog Posts, Documents)
• Speech (Voice Calls, Voice Mail)
• Social Media (Photos, Videos, Streamed Video, Podcasts, Produced Music, Software)
• Presence (Communication Availability and Channels)

Content

• Private Documents (Word Processing Documents, Spreadsheets, Project Plans, Presentations, etc.)
• Consumed Media (Books, Photos, Videos, Music, Podcasts, Audiobooks, Games, Software)

Financial Data

• Financial Data (Income, Expenses, Transactions, Accounts, Assets, Liabilities, Insurance, Corporations, Taxes, Credit Rating)
• Digital Records of Physical Goods (Real Estate, Vehicles, Personal Effects)
• Virtual Goods (Objects, Gifts, Currencies)

Health Data

• Health Care Data (Prescriptions, Medical Records, Genetic Code, Medical Device Data Logs)
• Health Insurance Data (Claims, Payments, Coverage)

Other Institutional Data

• Governmental Data (Legal Names, Records of Birth, Marriage, Divorce, Death, Law Enforcement Records, Military Service)
• Academic Data (Exams, Student Projects, Transcripts, Degrees)
• Employer Data (Reviews, Actions, Promotions)

What if individuals were given the power to SEE themselves to collect and aggregate information that no one else could ethically integrate.

What if the individual could choose to retain all the information they wanted for as long as they wanted?

This is a graph that I first saw Marc Davis (who is now a partner architect at Microsoft) share to explain today's current data environment and a future where people are in control.

This red dot shows us what’s happening today: –some data aggregators are necessarily self-regulating by limiting the amount of time they keep data, and governments are limiting data retention and anonymization practices.

The green dot shows us what WOULD happen if people were given the capacity to store and manage their own data – if they could keep as much data as they wanted for as long as they wanted. Digital footprints of a lifetime could be shared with future generations.

In a user-centric model where the individual can aggregate information about themselves, new classes of services – more specific to the individual, based on data accessed with user permission, can emerge.

The foundation of this eco-system is personal data storage services that are totally under the control of the individual. We can already see early examples of these in the marketplace.

Statz is a startup that supports you pulling in your information from different service providers:

• Mobile phone records
• Energy and utility records
• Health and fitness
• Shopping and payments
• Transportation

Statz gives you instructions on how to go into your mobile carrier or electric company and export your statements - often this involves a dozen steps and is very labor intensive - not something easy or that everyone will do.

Greplin Does Personal Cloud SearchWhen people set up their accounts they give the service access to a range of accounts - LinkedIn, Gmail, Basecamp, Flickr, etc. Then you use their engine to search across them.

Personal.com has raised 7 million in venture funding and although it does not yet have any services their website articulates clearly how personal data under the control of the user is valuable.

There are two open source projects currently active in this space - The Higgins Project and Project Danube which have code for personal data store services.

Mydex is a Community Interest Company based in the UK that has begun a community prototype that connects individuals’ personal data store accounts to local government agencies.

At the World Economic Forum in Davos next week they are having a workshop on “Rethinking Personal Data” and Harvard & MIT are showing early prototypes of personal data collection from mobile phones into personal data stores and then enabling different types of sharing.

Kynetx is developing a new language that looks at data from personal data stores and public datasets and can do real time matching based on rule sets created by the individual to surface relevant content.

With a rules engine working on your behalf with your data you could imagine a GPS Navigation system that accesses your calendar, gift recommender/reminder that looks at your friends wish lists and birthdays - it could link these all together and make helpful recommendations of where to stop to pick up a present for a friend with a birthday next week.

This example shows how this is nascent but emerging industry of personal data stores presents opportunities for the media and advertising industries.  Once people have their own personal data store and services, they can collect data over years about their behaviors, likes, interests, purchasing habits, etc. These large stores of personal data are a gold mine of information about potential commercial intent.

The Personal Data Ecosystem presents the opportunity to do targeting through access to personal data that is more accurate, more detailed, more comprehensive, data that was not accessible before, or that could not be combined with other data before.  Giving individuals choice about where they store their personal data and who has access to it, and under what terms and conditions, grows trust. This trust is hugely valuable, because over time  more and better services that combine and utilize valuable personal data can be offered.

It supports new forms of advertising and marketing by enabling trusted relationships between customers and vendors that enable “relationship marketing” and opt-in, user controlled sharing of data, permissioned communications and offers, group buying, recommendations, social and viral marketing, more efficient commercial exchanges.

Individuals could through their personal data store choose to connect to media, product and services companies directly - choosing to proactively share intent information and personal information about themselves with a direct link - just as vendors manage their relationships with customers  using CRM tools. The vision is that individuals would manage their relationship with Vendors using VRM tools - meeting in the middle and creating new value for both.

In conclusion,

On the one hand, we have industry voices calling for the current personal data ecosystem to be left as it is. While there is continuing technological innovation among the proponents of maintaining the regulatory status quo. People are being stalked more and more effectively and more ads are being served to them while they view media.

On the other side, advocacy groups are pushing for legislation that would prohibit tracking users who ask not to be tracked. However, making the choice to go this direction means that all the value in the personal data is lost because it is never collected.

The Personal Data Ecosystem offers a middle path and a better future where everyone wins, and where users’ interests are balanced with those of industry.

Industry is controlled by regulations that don't permit them to operate without notifying users that they are collecting and only collecting with users’ permission. This ecosystem gives them a way to get very good data with permission.

Users get tools to allow them to collect personal data themselves and then share what they want.

Innovators build for this ecosystem and basically make it worth users’ while to participate by enticing them with exceptional value for sharing their personal data with trusted partners.

I and others in industry are forming a Collaborative Consortium for the Personal Data Ecosystem supporting the very different industries and stakeholder groups to collaborate and innovate. A center of cooperation what will be a very competitive marketplace for services.

• We have begun hosting conversations amongst Personal Data Store Providers about interoperability (contact me if you would like to know more & get involved).
• We have an aggregate blog of leading thinkers and companies active in this space. I am co-hosting a podcast covering this emerging market with Aldo Castañeda
• We are collaboratively documenting the emerging field in a structured wiki, including people, projects, companies, standards, publications, videos and events.
• We are currently raising funds for our first major project to do a Value Network Map and Analysis of both the current data ecosystem and the emerging ecosystem market model where individuals collect aggregate and control data in their own data stores.

We are gathering at a range of events including:

• Identity Collaboration Day in San Francisco February 14th
• STL Partners New Digital Economics Conference in April - Deep dive on Igniting the Personal Dat Ecosystem on April 7 day three of their conference.
• The 12th Internet Identity Workshop in May 3-5 in Mountain View.

For more information about how you can get involved can see visit our website: personaldataecosystem.org.

I was very skeptical when I first learned government officials were poking around the identity community to learn from us and work with us.  Over the last two and a half years, I have witnessed dozens of dedicated government officials work with the various communities focused on digital identity to really make sure they get it right. Based on what I heard in the announcements Friday at Stanford by Secretary of Commerce Locke and White House Cybersecurity Coordinator  Howard Schmidt to put the Program Office in support of NSTIC (National Strategy for Trusted Identities in Cyberspace) within the Department of Commerce. I am optimistic about their efforts and frustrated by the lack of depth and insight displayed in the news cycle with headlines that focus on a few choice phrases to raise hackles about this initiative, like this from CBS News: Obama Eyeing Internet ID for Americans.

I was listening to the announcement with a knowledgeable ear, having spent the last seven years of my life focused on user-centric digital identity. Our main conference Internet Identity Workshop held every 6 months since the fall of 2005 has for a logo the identity dog: an allusion to the famous New Yorker cartoon On the internet, nobody knows you are a dog. To me, this symbolizes the two big threads of our work: 1) maintaining the freedom to be who you want to be on the internet AND 2) having the freedom and ability to share verified information about yourself when you do want to.  I believe the intentions of NSTIC align with both of these, and with other core threads of our communities' efforts: to support identifiers portable from one site to another, to reduce the number of passwords people need, to prevent one centralized identity provider from being the default identity provider for the whole internet, to support verified anonymity (sharing claims about yourself that are verified and true but not giving away "who you are"),  support broader diffusion of strong authentication technologies (USB tokens, one-time passwords on cellphones, or smart cards), and mutual authentication, allowing users to see more closely that the site they are intending to do business with is actually that site.

Looking at use cases that government agencies need to solve is the best way to to understand why the government is working with the private sector to catalyze an "Identity Ecosystem".

The National Institutes of Health is a massive granting institution handing out billions of dollars a year in funding.  In the process of doing so, it interacts with 100,000's of people and does many of those interactions online.  Many of those people are based at institutions of higher learning.  These professors, researchers, post-docs and graduate students all have identifiers that are issued to them by the institutions  they are affiliated with.  NIH does not want to have the expense of checking their credentials, verifying their accuracy and enrolling them into its system of accounts, and issuing them an NIH identifier so they can access its systems. It wants to leverage the existing identity infrastructure, to just trust their existing institutional affiliation and let them into their systems.  In the United States, higher educational institutions have created a federation (a legal and technical framework) to accept credentials from other institutions. The NIH is partnering with the InCommon Federation to be able to accept, and with that acceptance to trust, identities from its member institutions and thus reduce the cost and expense of managing identities, instead focusing on its real work: helping improve the health of the nation through research.

The NIH also has a vast library of research and information it shares with the general public via the internet.  Government sites are prohibited from using cookie technology (putting a unique number in your browser cookie store to remember who you are) and this is a challenge because cookies are part of what helps make Web 2.o interactive experiences. So say that your mom just was diagnosed with breast cancer and you want to do a bunch of in-depth research on breast cancer treatment studies.  You go to the NIH and  do some research on it, but it really requires more then one sitting, so if you close your browser and come back tomorrow, they don't have a way to help you get back to the place you were.

The NIH doesn't want to use a cookie and doesn't want to know who you are.  They would like to be helpful and support your being able to use their library over time, months and years, in a way that serves you, which means you don't have to start from scratch each time you come to their website. It was fascinating to learn about the great lengths to which government officials were going to adopt existing standards and versions of those standards that didn't link users of the same account across government websites (see my earlier post on Fast Company).  They proactively DID NOT want to know who users of their library were.

One more use case from the NIH involves verified identities from the public. The NIH wants to enroll patients in ongoing clinical trials. It needs to actually know something about these people - to have claims about them verified, what kind of cancer do they have, where are they being treated and by whom, where do they live, etc.  It wants to be able to accept claims issued by third parties about the people applying to be part of studies.  It does not want to be in the business of verifying all these facts, which would be very time consuming and expensive. It wants to leverage the existing identity infrastructures in the private sector that people interact with all the time in daily life, and accept claims issued by banks, data aggregators, utility companies, employers, hospitals etc.

These three different kinds of use cases are similar to others across different agencies, and those agencies have worked to coordinate efforts through ICAM which was founded in September 2008 (Identity, Credential and Access Management Subcommittee  of the Information Security & Identity Management Committee established by the Federal CIO Council).  They have made great efforts to work with existing ongoing efforts and work towards interoperability and adopting existing and emerging technical standards developed in established industry bodies.

Let's continue exploring what an identity ecosystem that really works could mean. The IRS and the Social Security Administration would each like to be able to let each person it has an account for login and interact with it online. We as those account holders would like to do this - it would be more convenient for us - but we want to know that ONLY we can get access to our records, that that they won't show our record to someone else.

So let's think about how one might be able to solve this problem.

One option is that each agency that interacts with anywhere from thousands to millions of citizens issues their own access credentials to the population it serves. This is just a massively expensive proposition.  With citizens interacting with lots of agencies, they would need to manage and keep straight different IDs from different agencies.  This is untenable from a end-user perspective and very expensive for the agencies.

Another option is that the government issues one digital ID card to everyone ,and this one ID could be used at a bunch of different agencies that one might interact with. This is privacy-invasive and not a viable solution politically. No one I have ever talked to in government wants this.

So how to solve this challenge - how to let citizens login to government sites that contain sensitive personal information - whether it be tax records, student loan records, Department of Agriculture subsidies, or any other manner of government services, and be sure that it really is the person via an Identity Ecosystem.

Secretary Locke's Remarks: The president’s goal is to enable an Identity Ecosystem where Internet users can use strong, interoperable credentials from public and private service providers to authenticate themselves online for various transactions.

What does a private sector service provider use case look like in this ecosystem?

When we open accounts, they are required to check our credentials and verify our identities under know-your-customer laws. People have bank accounts and use them for many years. They know something about us because of their persistent ongoing relationship with us: storing our money. Banks could, in this emerging identity ecosystem, issue their account holders digital identity credentials that would be accepted by the IRS to let them see their tax records.

The private sector, for its own purposes, does a lot to verify the identities of people, because it has to do transactions with them that include everything from opening a bank account, to loaning money for a house, to setting up a phone or cable line, to getting a mobile phone, to a background check before hiring.  All of these are potential issuers of identity credentials that might be accepted by government agencies if appropriate levels of assurance are met.

What does is a public service provider look like in this ecosystem?

The Federal Government does identity vetting and verification for its employees. Homeland Security Presidential Directive 12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors directs the implementation of a new standardized identity badge designed to enhance security, reduce identity fraud, and protect personal privacy.  To date, it has issued these cards to over 4 million employees and contractors.
These government employees should in this emerging ecosystem be able to use this government-issued credential if they need to verify their identities to commercial entities when they want to do business with in the private sector.

There is a wide diversity of use cases and needs to verify identity transactions in cyberspace across the public and private sectors. All those covering this emerging effort would do well to stop just reacting to the words "National"  "Identity" and "Cyberspace" being in the title of the strategy document but instead to actually talk to the the agencies to to understand real challenges they are working to address, along with the people in the private sector and civil society that have been consulted over many years and are advising the government on how to do this right.

I am optimistic that forthcoming National Strategy and Program Office for Trusted Identities in Cyberspace will help diverse identity ecosystem come into being one that reduce costs (for governments and the private sector) along with increasing trust and overall help to make the internet a better place.

Because of the nature of the Monday of RSA with morning and afternoon activities - we are offering Morning and Afternoon tickets ad will make the agenda following lunch for the afternoon.

You can see the topics proposed so far here on the IIW wiki.

Here is the Announcement on the IIW Site

Learning from one of the mistakes of the past - market confusion inhibiting understanding and adoption of user centric identity technologies. The Personal Data Ecosystem is going to be a "front door" for those seeking to understand the ecosystem overall with a simple message and clear picture of what is happening. It will also connect people to the community working on the aspect of the ecosystem relevant to them. Our focus is on developing the  core communities needed for success and fostring communication amongst them.  These communities include  end users, large personal data service providers, companies providing data to personal data services, developers and startups leveraging this new ecosystem, regulators and advocacy groups along with the legal community and their efforts to create the legal frameworks needed to really protect people.

We arleady have a number of projects working on key aspects around the ecosystem and we will support their success linking them together - Project VRM, ID-Legal, Project Nori, Higgins-Project, Project Danube, XDI.org and IIW (they are linked at the bottom of the Personal Data Ecosystem site),   This is a big tent ANY OTHER projects that are related are welcome.  We don't need another dot org to link efforts togethers so PDE is going to be chartered as part of IC3 (Identity Commons).

Right now the Personal Data Ecosystem site is aggregating content from blogs of those covering and building in the space.   This week we will be doing our first Podcast covering this emerging industry - Aldo Casteneda who you may remember from The Story of Digital Identity will be hosting it with me.

Next week we will be able to collect links submitted via delicious for the blog. I am working with the fabulous Sarah Dopp on website strategy and online community development and Van Riper is working with me on community management.

IIW coming up in a week is going to be a core community gathering for emerging developments.

We are really excited about all the attendee's who are registered so far. The list is diverse and interesting and includes, independents, startups, students and people from big companies. I encourage you to browse it at on the bottom of our registration page

We have one day tickets now available and regular registration ends Thursday at midnight. "IIW-Nov" is a discount code for 10% off that.

The emerging themes we have identified are reflected in the topics proposed on our wiki

• User-Centric Identity applied (OpenID, OAuth, XRD, SAML, InfoCard, Activity Streams, etc.)
• Personal Data Ecosystem
• Federated Social Web
• Vendor Relationship Management
• Active Clients (tools in the browser and other clients)
• Identity in the Cloud

We have Demo slots available for Wednesday after lunch.
There is more room for your project to share please let me know (kaliya[at]mac.com) if you are interested in doing so. I need a name, link and 280 character description by Friday October 30th.  There are about 10 requests via registration.  Here is where the description will be posted once submitted.

Schedule
Tuesday doors will open at 8AM for registration. Phil Windley will give the opening talk at 9am and we will begin agenda creation by 9:30. We will have 5 sessions per day. Dinner on Tuesday and Wednesday will be hosted and at local restaurants. You can find the schedule online. If you are wondering about how the unconference works please read this post on Kaliya's unconference blog.

I pulled these from the topics wiki

Critical Topics to discuss with peers:

* I fear that Facebook Connect and Twitter Connect are the new AOL
* current and future business cases
* Need for web agent (browser) externsions. psuedonym, NSTC
* Understanding what has stabilized about protocols so we can standardize our partners on them
* Open Identity Trust Framework
* Future of authentication from a user perspective.
* What are the components of a personal data ecosystem? What rights and protections do we need to articulate in law and enforce through social norms?
* Best applications and issues for combining social information
* how do we want to represent identity in the OS/browser
* "all sorts of ""real world users"" issues and questions"
* How to make this stuff invisible
* "what are all stakeholder identity needs; what system ""metrics"" would help them"
* how/if their ideas apply when a domain name or IP address is the only identifier
* Where do we go from here?
* "How do we start the path to laws that give power to people over ""their data""
* What's on the horizon, how are people bridging consumer & enterprise identity protocols, how does OAuth change things, what about Info Cards, etc., etc.
* zero password initiatives
* adoption of OpenID and OIX Trust Frameworks
* Personal data store interop
* "Multiple ""Identities"" and the requirement to be conscious of them"
* Full session life-cycle management
* UMA / Personal Datastore
* how to make this all user comprehensible

http://iiw.idcommons.net/Proposed_Topics_IIW11

We are doing our first Internet Identity Workshop outside of the Bay Area and our first with a theme - Open Identity for Open Governmnet.

We have over 75 people attending from around the world - you can see the names at the bottom of the registration page.

The proposed topics shared so far as attendees register can be seen here on the wiki. They are amazingly diverse and center around key issues about policy, standards, legal frameworks and the path forward for those who care about creating an identity layer/infrastructure/platform that really works for people.

The actual agenda will be created tomorrow morning at 10 am following an introductory talk by Kaliya Young Hamlin and Mary Rudy at 9am.  We will make the agenda for Friday at 9am that day.

Personally I am passionate about the conversations that will be happening about personal data stores and their evolution.

This is completely the wrong frame to foster community collaboration.

The Tenth Internet Identity Workshop in May, 2010 was the largest ever. We have had inquiries from community members on the East Coast of the US and in Europe have been lobbying us to bring the event to their locations.  We are happy to confirm that we are going host IIW's in Washington, DC  and London.

WE NEED YOUR HELP! Please take some action if you like IIW and are reading this. IIW is been about the community that attends and participates year round in the activities of groups that use the event to get real work done and move the industry and vision of user-centric identity that works for people forward.

So with these events upcoming Phil, Doc and I need your help in spreading the word to your collegues on the East Coast and in Europe who would enjoy the event.

To help you do this we have several tools and options.
Blog badges for specific events. (These are two of them their are more on the wiki)

For IIW-East September 9-10 in Washington DC

• A Venue! the Josephine Butler Parks Center (a 10min walk from the Columbia Heights Metro)
• an Invitation up online
• Registration is up here and Early Bird ends August 6th.
• an invitation designed to be send via e-mail
• RSVP on Social Networks - LinkedIN, Upcoming, Facebook

For IIW-Europe, October 11 in London we have

• A still being developed invitation up on the IIW site
• Registration is live Early bird ticket sales end August 31
• RSVP on Social Networks: LinkedIN, Upcoming, Facebook
• Twitter List (it will be a bit small until we have more registrations)

For IIW #11 in Mountain View, November 9-11

• We have a simple invitation up online
• Registration is live Super Early bird ticket sales end August 31

If you value IIW and the conversations that happen there please take some initiative and reach out to colleagues to spread the word about these events.  Because of the community focus of the events we  rely strongly on community word of mouth to let people know about them.

It would be great to have community ideas put forward for the main IIW invitation articulating the current foci of conversations.

The theme for the event is Open Identity for Open Government. You can learn more about the event on the IIW website and register over on this site.

Internet Identity Workshop comes to DC!

Theme: Open Identity for Open Government.

Register Here!

Internet Identity Workshop East (IIW-East) is September 9-10, 2010 in Washington DC  at the Josaphine Buttler Parks Center.  This event immediately follows the Gov 2.0 Summit.

The Internet Identity Workshop has been held semi-annually in California since the Fall of 2005. The 10th IIW was held this past May and had the largest attendance thus far. There have been many requests to have an IIW on the East coast, and now the Open Identity for Open Government Initiative is providing a timely incentive to have one in Washington.

IIWs focus is on “user-centric identity”, addressing the technical and adoption challenge of how people can manage their own identity across the range of websites, services, companies, government agencies and organizations with which they interact. IIW-East will focus mainly on the government adoption of open identity technologies for use by government websites.

The event has a unique format - the agenda is created live the day of the event. This allows for the discussion of key issues, projects and a lot of interactive opportunities with key industry leaders.

The event compiles a book of proceedings with the notes that are gathered from the conference. You can find the Book of Proceedings for IIW7, IIW8,  IIW9 & IIW10 here. BTW these FOUR documents are your key to convincing your employer that this event will be valuable. As attendees register we ask about topics they wish to discuss.

Providing identity services between the general public and government websites is a different problem than providing authentication and authorization services within one or a few organizations (enterprise provisioning/termination or federation between two companies or government agencies).

As a community we are exploring these kinds of issues:

Questions Agencies Face:

• How can open identity technologies enable open government
• How can agencies leverage identity credentials generated by other organizations
• How can the government  leverage the efforts of social networking sites that offer user-centric identity credentials
• What are the advantages to agencies of adopting open identity technologies
• How can open identity technologies enable your websites to move beyond brochure-ware
• How can we increase the speed in which government organizations can benefit from the use of open identity approaches
• How to manage Federated Identity on an ever increasing scale
• What are the implications of National Strategy for existing policy mandates
• Should there be integrated political architecture
• There are five distinct Cyber Security Bills in Congress now - what are the implications

Policy  Considerations:

• The relationship between FIPS (Federal Information Processing Standards) and identity management
• What are the business cases for agencies to adopt Open Identity Technologies
• What are the new legal constructs that make this work
• How to use open identity technologies to preserve privacy while providing personalization
• GSA standards for the use of open identity technology
• Data Privacy Issues
• Personal Data - how is it stored and shared with end users
• How are these new approaches regulated

Technical Issues:

• Open identity standards (identity and semantic)
• What software is available to leverage open identity standards
• How different standards and technical implementations interoperate
• How agencies can accept identity credentials generated by other organizations
• How open identity technologies can enable your website to move beyond brochure ware, without using cookies
• How to leverage open identity technologies in your technology roadmap
• How to implement Federal Identity
• Tecnlogy issues involved in implementing existing Identity Management technology
• Lessons learned - what are the most effective ways for Federal Agencies to build and employ identity systems

New Industry Developments:

• Personal Data Stores/Data Banks with our digital footprints recorded
• What new Identity Management technologies are on the horizon
• National strategy for trusted identities in Cyberspace

Please join us at the Internet Identity Workshop

To consider all these and more!

It is the best place to meet and participate with all the key people and projects such as:

• OpenID
• IMI Information Cards
• GSA approved schemas for open identity protocols
• Personal Data Stores
• NIH pilot adoption of Open Identity technologies
• Certification of industry open identity credentials
• Business models for higher LOA open identity credentials
• National Strategy for Trusted Identities in Cyberspace

Part of this presentation touched on a timeline of events in the community. Those and more are reflected on this timeline that is beginning to be developed here. IIW11 will be November 9-11 in Mountain View, CA The first ever IIW outside the Bay Area will be happening September 9-10 in Washington DC following the Gov 2.0 Summit with the theme Open Identity for Open Government. The first IIW in Europe will be happening in London likely October 9-10 (dates still to be confirmed) prior to RSA Europe. If you would like to know about when the next IIWs have registration open please join this announce list. TheIdentity Gang is the community mailing list where conversations are ongoing about identity. You can follow modest updates about IIW on twitter via our handle - @idworkshop You can see IIW 10 attendees on our registration page.

Early Bird Registration is in effect for another month. Sponsorships and "big tickets" (for those who can expense a higher ticket price but can't get actual "sponsorship budget") are still available.

Sorry but I am still learning "how" to talk to reporters. They don't like to quote me as "the identity woman" and link to my blog.

I "do" run the Identity Workshop with Phil and Doc but that doesn't make it an "advocacy group"

Identity Commons & IIW have a purpose and principles believing in user/centric identity. The power of individuals to manage and control their own identities online. We don't "advocate" for them - we create a convening space for people who want to work on this ideal.

Facebook does on some level "agree" with the idea of user-centric identity - Luke Shepard has participated in the community for quite a while & they hired David Recordon. They sponsor IIW.

I am clear that the opening up of previously controlled information with no warning "jives" with my understanding of user-centric control. It was more from my own point of view I was commenting. That is with my "identity woman" hat on... and the values I carry from Planetwork and the ASN... but the press hates that. Uggg. Chris Messina gets to be an "open web advocate"... that is what I do to but just about identity "open Identity advocate" (mmm...) but then that sounds like "just" OpenID and it isn't just about that one particular protocol. sigh.

I am still wondering - How does one "belong" and have "titles" in a way the media can GROK when one does not have a formal position in a formal organization.

sigh - identity issues.

Heidi Nobantu Saul did an amazing job collecting notes and we managed to get all session notes except a very few on the last day.

Highlights include:

• The session on Active Clients that went for several hours on Wednesday that was preceded by the presentation of an OpenID Selector by MSFT on Tuesday and followed by What should Identity Support in the browser look like? led by Johannes Ernst.
• The Conversation about Social Consent
• Action Cards continuing to develop with Kynetx & Joe Andrieu presented on Portable Contexts.
• Progress made on moving activity streams forward.
• The OAuth-WRAP conversations which are continuing.  Facebook also led a session on why they don't support today's OAuth.
• The continued evolution of WebFinger, XRD, LRDD & what is becoming know as the Hammer-Stack
• Salmon-Protocol to support comments "swimming upstream"
• The Trust Framework activity with OpenID Foundation, Information Card Foundation and the Federal Government.

The 10th Internet Identity Workshop is May 18-20.
Registration is Open Now and Extra Early Bird Rates are in effect until January 31.

Decrying redirects and iframes, Raskin tells of a brave new world where an in-browser button that defies navigational difficulties allows for something closer to true identity portability than we've seen yet:Identity will be one of the defining themes in the next five years of the Web. Nearly every site has a concept of a user account, registration, and identity. Searching for "sign in" on Google yields over 1.8 billion hits. And yet, the browser does nothing to make this experience better save for some basic auto form filling. The browser leaves websites to re-implement identity management, and forces users to learn a new scheme for every site... Your identity is too important to be owned by any one company. Your friends are too important to be owned by any one company.

Finally! They said it!

Comments in reaction to the ReadWriteWeb post highlight Information Cards & CardSpace are not mentioned - I point out in my comment that the work is all connected ant pointed to the IIW conversations about Active Clients attended by all.

Aza open their post with this paragraph:

Identity will be one of the defining themes in the next five years of the Web. Nearly every site has a concept of a user account, registration, and identity. Searching for “sign in” on Google yields over 1.8 billion hits. And yet, the browser does nothing to make this experience better save for some basic auto form filling. The browser leaves websites to re-implement identity management, and forces users to learn a new scheme for every site.

They make these key points following the images they have (you should check the images out)

• Identity is part of where you are, and what you are looking at (Amazon looks different depending on if you are signed in or not). That’s why we put it in the URL Bar.

• For most sites, you’ll probably only have one identity, so login will be a single click or automatic.
• Putting verbs into the navigation bar isn’t new. See Taskfox.
• To increase visibility, webpages should be able to make a Javascript call that opens the login/signup bubble.
• For webpages that want to own the login-process, the account creation simply acts as the ultimate form-fill. For those interested in the evolution of the idea, you can see an early mockup with comments as well as Alex Faaborg’s similiar mockups.

They also make this point...

Chris Messina and others has been advocating for a model which follows the Facebook Connect lead: a single verb, to connect. Once connected, you decide exactly what information to share in an asynchronous manner. Unfortunately this bleeds information — your name is known to all websites which which you connect. We’d like to explore what a connect metaphor in combination with the ability to remain anonymous but connected means.

I agree with the firefox folks. Having a way to do verified anonymity is essential.

"Selective Disclosure" is the name for technologies that do this.

The firefox team should check out Stefan's U-Prove Technology that may be released shortly by MSFT that acquired it over a year ago -

(seems like Stefan killed his blog when he moved to MSFT..mmm..anyways.)

Firefox folks invite people to get involved here.

Regular Registration ENDS NEXT WEDNESDAY - October 28th at Midnight. Prices go up $100 after that.

The Internet Identity Workshop #9 Tuesday - Thursday, November 3-5 in Mountain View, CA Computer History Museum

Please blog/tweet about the conference. The hash tag is #iiw , our twitter handle is @idworkshop

Proposed Topics List is here. We all make the agenda together beginning at 1 on Tuesday and again on Wednesday and Thursday morning. If you want to know more about how to prepare for an unconference check out this piece called “unconferencing” by Kaliya Hamlin (@identitywoman) the facilitator of the workshop.

You can see the specific times of sessions.

Tuesday Morning Opening talks will cover: * The Identity Trust Framework activities - Drummond Reed and Don Thibeau * Data Portability releasing their EULA work * Action Cards - Phil Windley and Paul Trevithick * Discovery etc. - Eran Hammer-Lahav * Activity Strea.ms etc. - * A VRM update * We might cover activity happening in the healthcare sector * We are working on having Vivek Kundra the CIO of the US join us via skype - as yet this is unconfirmed.

They won’t cover - OpenID 101, Information Cards 101 or SAML 101 If you are unfamiliar with these topics we recommend reading these papers/watching these videos. There is a lot of information online covering these topics on the foundations/organizations respective websites.

OpenID - http://openid.net/ OpenID video about it - http://www.youtube.com/

Information Cards - http://informationcard.net/ Video - http://informationcard.net/watch-the-video

SAML - http://en.wikipedia.org/wiki/SecurityAssertionMarkup_Language Video - Ping Identity on SAML 101

All together now - the Venn of Identity The paper - by Drummond and Eve the update - The Zen of Venn

Demo Hour: We still have Demonstration slots available you must sign up ahead of time to Demo. It is Wednesday after lunch short 5min demos will be happening throughout the hour - throughout the room. Please e-mail Kaliya[at]mac.com to get a table and more information about how it will work.

Food: I forgot to ask if there were any special dietary requirements. Please let me know if you have any - this is what we have in store for you.

Tuesday - Burrito Bar, Tied House Wednesday - Indian, Italian Thursday - BBQ Boys

Thank you to our Sponsors:

Without their contributions this conference would not be possible. (we still have sponsorship opportunities available)

<a href=”http://www.internetidentityworkshop.com/sponsors/”> <img src=”http://www.internetidentityworkshop.com/wp-content/uploads/2009/10/IIW9Sidebar.jpg”> </a>

About the Notes Taking Procedures: In our effort to document the whole confernece and give all attendees access to all the happenings in sessions we have a notes taking procedure:

If you convene a session it is your responsibility to get a note taker for your session.

The note taker needs to use the NOTE TAKING FORM - found here in digital form (the paper version will be avaliable in each break out space too). When notes are complete, the note taking form must be e-mailed to iiwnotes@gmail.com OR transfered to a USB key at Documentation Center OR if paper notes are taken transcribed by the notes taker on computers provided in Documentation Center

We will also be collecting a more immediate list of results from each session on 11x17 sheets.

We are looking forward to seeing you next Tuesday!

let us know if you have any other questions,

-Kaliya, Phil and Doc

Internet Identity Workshop number 9 is coming up in about 10 weeks. November 3-5 (Tuesday to Thursday) in Mountain View California at the Computer History Museum.

We are excited about all the developments in the industry with protocol evolution in the social web space AND larger and larger scale deployments of open identity technologies including OpenID and Information Cards.

There will be much to talk about at this fall’s event.

Early REGISTRATION is Open! UNTIL SEPTEMBER 16 then prices go up by $50-75

Early Bird Prices are....

• $274 regular tickets
• $148 for independents
• $ 50 for students

We need to get 75 people registered by September 16 to make a final confirmation for our conference space at the Computer History Museum.

Special this year we have the "BIG" ticket for those can expense $998 (but can't convince marketing to sponsor). This is a GREAT way to support IIW!

IIW is a completely community driven event - we don’t pay anyone for marketing - the community is our marketing.

Please put our LOGO ON our blog our WEBSITE.

Follow IIW on Twitter - @idworkshop

SPONSORSHIP OPPORTUNITIES ARE STILL AVAILABLE!!! Please contact Phil if you are interested in learning more phil@windley.org

JOIN THE COMMUNITY MAILING LIST

THE INVITATION TO IIW!

The Internet Identity Workshop focuses on “user-centric identity” and netizen empowerment on the social web trying to solve the technical challenge of how people can manage their own identity and social activity across the range of websites, services, companies and organizations that they belong to, purchase from and participate with.

This is where everyone from a diverse range of projects doing the real-work of making this vision happen gather and work intensively for three days. It is the best place to meet and participate with all the key people and projects. This is a comprehensive list of the technology communities that are covered.

The event does not have a pre-set agenda instead as people register they are asked what they would like to present about, learn and discuss with peers/industry experts. These are all collected here . The first morning of the conference will be introductory orientation about key projects and technologies in the community. After that the community creates the agenda itself using the Open Space Method. Dinner both Tuesday and Wednesday are a big part of the conference.

Here are links to notes that cover most of the sessions from the last two conferences IIW #8 spring of 2009     IIW #7 fall of 2008

These documents are great resources for convincing your boss of the value of this event.

The heart of the workshop is a practical idealism in working towards the shared vision of a decentralized, user-oriented identity layer for the Internet.

Because the web was built around “pages”, no tools or standards were created to control how the information about you was collected or used. At the Internet Identity Workshop we bring the people creating these tools and standards so people can safely manage their online identity and control their personal data.

It is not about any one technology – rather it is a place to discuss multiple interoperating (and possible competing) projects, standards, and networks for identity, data sharing, and reputation.

As part of Identity Commons, the Internet Identity Workshop creates opportunities for both innovators and competitors. We provide an open forum for both the big guys and the small fry to come together in a safe and balanced space.

There are a wide range of projects in the community:

• Open conceptual, community, and governance models.
• Open standards and protocols.
• Open source projects.
• Commercial projects.
• Projects to address social and legal implications of these technologies.
• Efforts to rethink the business models and opportunities available with these new technologies.

User-centric identity is the ability:

• To use one’s identifier(s) on more than one site
• To control who sees what information about you
• To selectively share presence and profile information
• To maintain multiple identities and personas in the contexts you wish
• To aggregate attention, navigation, and purchase history from the sites and communities you frequent
• To move and share your personal data, relationships, documents, and other publications as you wish

All of the following are active topic areas at each IIW:

• Improving Existing Legal Constructs Privacy Policies Terms of Service
• Creating New Legal Constructs - Limited Liability Personas, Identity Rights Agreements
• Creating New Business Models - Identity Oracle, I-Brokers
• New Citizenship Perspectives - Activism Community, Event Coordination, Community Identity and Data Sharing

The Internet Identity Workshop (IIW) was founded in the fall of 2005 by Phil Windley, Doc Searls and Kaliya Hamlin. IIW is a working group of Identity Commons The event has been a leading space of innovation and collaboration amongst the diverse community working on user-centric identity.

Web Finger was covered on Tech Crunch today with this headline - Google Points At WebFinger. Your Gmail Address Could Soon Be Your ID.

At IIW in May they had a session lead by John Panzer. The notes were not filled out that much but (All the Notes from IIW)   

but there is a white board of their conversation and a link to what google had up.

Chris Messina spliced it together

XRD the discovery protocol is part of how Web Finger works. This spun out of XRI.

Techcrunch didn't explicitly pick up on the fact that Eran Hammer-Lahev has been a key collaborator and is at Yahoo! (they did link to the mailing list where he is posting). He has been really driving XRD forward lately.

All exciting stuff.

Growing community, cultivating community, nurturing community, weaving community, building community, creating community - all slightly different metaphors describing this process that happens when people make the effort to create space (an environment) for people to meet, inviting people into the space and encouraging conversations that help connections and foster relatedness.

Community is what unfolds when people come together voluntarily, learn about one another, begin to care about one another, and start to do things together. In doing things together that are successful, trust develops and people begin to work and act together IN community, doing progressively more difficult things, becoming strong and more resilient.

Thanks to Malcolm Gladwell’s The Tipping Point we know about Connectors, Mavens, and Salespeople, social archetypes that play different roles, each with their own value in helping information flow, networks form and communities emerge.

It was great to have him articulate this i finally had a label for my own activity/passion - I have become a maven of a few things throughout the years. user-centric digital identity was a subject I really got into in 2003-4. I read everything I could about the subject as I began to meet some of the people thinking about it. I became passionate about the topic and applied my connector skills and started meeting finding people who were interested in the subject. Those who didn't know about the subject I sold them on the idea . I am not by nature a sales person about "anything" but only those things I believe in.

One can also see a community as the evolution and maturing of a network, that is the relationships between people. When beginning the links might be very weak, but in time as the potential community members get to know each other and take action together and the ties strengthen; they become a stronger and more resilient “real” community. A paper that was very influential in my understanding was Building Smart Communities through Network Weaving by Valdis Krebs and June Holley that I read in 2003 (along with every popular science book on network science out then: Linked, Sync, Six Degrees, Emergence, Nexus)

This paper investigates building sustainable communities through improving their connectivity – internally and externally – using network ties to create economic opportunities. Improved connectivity is created through an iterative process of knowing the network and knitting the network.

Knowing the network and knitting the network have been foundational in my practice of community weaving. I regularly meet with people in the community and help them get connected to others who's work is related to their goals. Two examples first RSA as often happens those new to the community "knock on my door" and ask to meet for lunch or coffee to share what they are doing and learn more about who they should connect to in the community. Mike wanted to meet with me he to share about his new company Gluu that does inter-domain identity. It was great to learn what he was up to and also share papers/doc's/projects relevant to his work and people he should meet. Yesterday I followed up with someone I invited to/and attended IIW. I spent 2.5 hours talking with Joe Johnston who attended about his efforts to bring interoperable identity (OpenID and other things) to Pachamama Alliance and other organizations with similar missions.

In terms of knowing and knitting networks between different communities/standards bodies/consortia/projects I wrote a post about Community Diplomats and Community Diplomacy last year thinking about different community-connecting roles and how if they are named they can be seen better and foster inter-group collaboration and communication.

Another essential but often un-named aspect/milestone of community development is communities development is shared language and then shared understanding. Shared Language is a prerequisite to collaboration enabling what were different perspectives and world views to sync, and then out of that it is much easier to work together. Eugene articulates three elements needed to create shared language:

• Share individual contexts
• Encourage namespace clash
• Leave enough time and space to work things out

An example of shared language that was developed in the community was the identity gang lexicon that Paul and others worked on in 2004-2005 so that when discussing different identity technologies there was at least a common language to talk about them.

Another example of the evolution of the communities shared understanding grew out of Johannes original presentation at IIW2006 with the identity triangle with three pillars - user-controlled, company controlled and then microsoft controled. He did an updated it almost a year later explaining of the community language and understanding had evolved. This starting point was moved forward by Eve Maler creating the Venn of Identity and became an IEEE paper written by her and Drummond Reed. Johannes has continued to be a wholistic thinker about the landscape and in 2008 he articulated an onion to think about which identity technologies are applicable where.

Space and Spaciousness for community to form is a key part of what the Internet Identity Workshops have been about about. We have never "set the agenda" there but instead allow anyone attending to post a session idea. We encouraged dialogue with space rather then having an agenda.   

We have an amazingly rich community fabric of working relationships that is both resilient and delicate.

I actually found this a bit surprising - remember the big debate on the Social Web TV I had with Josh Elman about "real names." He was against handles completely and felt that the big value facebook brought was "real names". I argued for handles and the freedom to choose one's "identity" on the web. I made the point that free society - having the ability freedom to have the option to have and use handles on the web NOT linked to our given/ in real life names. Another thing is that handles help us navigate namespace clash from regular names. Max from MySpace is 8bitkid not some other Max in a sea of Max's.

I ran into Josh Elman at the Building43 party and we agreed I kinda won the debate with this latest development. It seems that having peoples pages rank higher in google is helped by having readable URL's.

They of course "strongly encouraged" people to just pick a URL with one's real name and did so by "suggesting" names that were derivatives of one's name. You could override this and type in your own name choice (however defaults matter so most people will end up with names similar to their real name - rather then being asked to think up one). They give users an addressable identity.

Max Engel of MySpace became /8BitKid - his handle "everywhere"

David Recordon surprisingly didn't go with DaveMan692 - his handle most places - he is /DavidRecordon

My friend Jennifer became /dangerangel as she had originally signed up for in Facebook but they disallowed her to have it.

I just became /Kaliya (I am hoping I can get enough fans to claim /identitywoman for that persona)

What is particularly interesting is the layers of identity in Facebook.

With a Facebook URLFacebook has the one's username is not one's e-mail address as it is with Google profiles and one also has a common name (or as they say "real name") that is presented to throughout the system.

Google ironically enough they ask if you want a "contact" me button on your page that does not give away your e-mail address when the profile URL gives away your e-mail address.

Twitter has /usernames AND another display name of your choosing that is changeable (the /usernames are not). However most twitter clients display one or the other. If you are used to seeing the display name and then are on your phone that is only showing @handle /username then you don't know who is talking.

Facebook usernames is another example Twitter feature adoption by Facebook others being activity streams becoming much more like twitter streams.

I said when I first "got" twitter about 18 months ago - a big part of the value it provided was its namespace. It gave me a cool anchor on the web that allowed communication between me and others via the web.

So how is it going so far? Inside facebook reports that over the weekend 6 million folks - 3% of their userbase gut URLs. 500,000 in the first 15 min, 1,000,000 in the first hour and 3 million in the first 14 hours.

There were several examples of FaceSquating. Mike Pence took Obiefernadez's name.

Anil Dash has the funniest post ever about the whole thing. Highlight the point that users don't need facebook URL's they can just get their own domain name. He repeats this throughout the post about what these services are not telling you:

None of these posts mention that you can also register a real domain name that you can own, instead of just having another URL on Facebook.

I completely agree with him - he also misses a key point the usability of facebook is vastly higher then the usability of domain name registration, cpanel management and other things involved in getting ones own personal web presence going. DiSo isn't hear yet so we can't link to our friends without linking capability that a facebook provides. I suppose Chi.mp was trying to

He links to a post of his from December 2002 called privacy and identity control.

I own my name. I am the first, and definitive, source of information on me.

One of the biggest benefits of that reality is that I now have control. The information I choose to reveal on my site sets the biggest boundaries for my privacy on the web. Granted, I'll never have total control. But look at most people, especially novice Internet users, who are concerned with privacy. They're fighting a losing battle, trying to prevent their personal information from being available on the web at all. If you recognize that it's going to happen, your best bet is to choose how, when, and where it shows up.

That's the future. Own your name. Buy the domain name, get yourself linked to, and put up a page. Make it a blank page, if you want. Fill it with disinformation or gibberish. Plug in other random people's names into Googlism and paste their realities into your own. Or, just reveal the parts of your life that you feel represent you most effectively on the web. Publish things that advance your career or your love life or that document your travels around the world. But if you care about your privacy, and you care about your identity, take the steps to control it now.

In a few years, it won't be as critical. There will be a reasonably trustworthy system of identity and authorship verification. Finding a person's words and thoughts across different media and time periods will be relatively easy.

What people don't quite get is that if they anchor their whole online life around someone else's domain they are locked in. When I first started paying attention to user-centric identity online this was one of the meta-long term issues that the first identity commons folks (Drummond Reed, Fen Lebalm, Owen Davis, Andrew Nelson, Eugene Kim, Jim Fournier, Marc Le Maitre, Bill Barnhill, Nikolaj Nyholm, etc).

A few of them wrote a paper about it all - THE SOCIAL WEB - Creating an Open Social Network with XDI.

They liked the XRI/i-names architecture because it addressed the URL recycling problem with a layer of abstraction. All i-names also have linked to them a conical identifier - an i-number. This number is never reassigned in the global registry. However one could "sell" one's i-name (mine is =kaliya) and that new person could use it but it would have a different i-number assigned to it for that person.

This past week at the Online Community Unconference we were talking about the issue of conversation tracking around blog conversations. How an one watch/track the conversation about one's work if it is cross posted on 10 different sites OR if it is just posted in one place and one is distributing a link through 10 different channels? We never did get to an answer - I chimed in that the web was missing an abstraction layer - that if one could have a canonical identifier for a post that was up in 10 different places this would make it easier to track/see conversations about that post. What we do have now that we didn't have 3 years ago for helping track conversations across multiple contexts is OpenID at least so you can see if someone commenting in one place is the same as someone commenting in another.

There is an additional layer of abstraction in the XRI architecture that supports several things are key to helping people integrate themselves and information about themselves on thew web.

One is cross referencing - so I could have have two different (URI) addresses for the same information (in the identifier - not just mapped over one another leaving me with one address OR the other) and also have one version of my profile be the one I controlled and a different be a version that appeared in a certain social context.

There is also a concept of much finer grained data addressability and control - so I could have my home address in one place and instead of entering this into each website/services/company portal that I want to have this information - just hand them a link to the canonical copy I manage and then I don't have to change it everywhere. This is of course where the VRM folks are going with their architectures and services.

We shall see how it all evolves. That is what we do at the Internet Identity Workshop is keeping on working on figuring this all out.

DIDW reported today that Novelle launched Bandit.

Bandit is a system of loosely-coupled components to provide consistent identity services.

It implements open standard protocols and specifications such that identity services can be constructed, accessed, and integrated from multiple identity sources. The Bandit system supports many authentication methods and provides user-centric credential management. On this base of a common identity model, Bandit is building additional services needed for Role Based Access Control (RBAC) and for the emission of records to verify compliance with higher level policies.

The Bandit community does not intend to do this in isolation. We are doing our part to build foundational components of the emerging identity fabric. All components of Bandit are Open Source and we will work with industry standards and other open source projects to provide open, interoperable, decentralized, identity services.

About two weeks ago I started making a map of the history of the community. This was in part because I knew a lot of new people were coming to the workshop and I wanted to be sure they had some context of who we were and where we had come from. I translated this into an interactive wall map that allowed people to ad their own elements to the history.

On the timeline:

• Yellow diamonds are protocols
• Pink Trapazoids events that have happened on a timeline
• Purple papers are Publications white papers
• Purple 1/2 circles are podcasts.

Clusters (ot on the timeline):

• Green Parallelograms are mailing lists
• Blue pages are blogs

There are some good photos of this but I will be taking the results and putting them into Omnigraffle and then PDF too.

Tuesday Morning we got to put together the agenda. It involves everyone who wants to present putting what they want to have a session about on a piece of paper. They speak their session title to the whole room and then post it on the wall.

It wasn't until about mid day on Tuesday that I actually landed and was able to engage in the conference. The Planetwork folks talked a lot talking about the emerging 1society project.

Dinner both evenings was great. Monday was Italian and Tuesday was Thai.

The Identity Commons crowd moved things forward we have a follow up call next week.

At the very end watching and listening to Paul and Drummond go over the relationship between Higgins two projects and XRI / XDI was a great treat.

We concluded our day listening to Eugene Rant about Wikis at Wiki Wednesday. After dinner Meng told us he had founded the Reputation Gang and we invited him to be a part of the Identity Commons.

The highlight to get the essence of what happened is the closing session recorded. Here Tuesday and Wednesday.

Some high complements were given to the conference.

From Kim Cameron:

With Doc Searls and Phil Windely navigating at the macro-level, the amazing Identity Woman Kaliya orchestrated an ”unconference” that was one of the most effective events I’ve ever attended. It’s clear that creating synergy out of chaos is an art that these three have mastered, and participants floated in and out of sessions that self-organized around an ongoing three-day hallway conversation - the hallway actually being the main conference room and event! So we got to engage in all kinds of one-on-one (and few) conversations, meet new people, work out concerns and above all work on convergence. Many people told me they felt history was being made, and I did too.

Opinity's Tom Madox reflected on the conference today.

Now, before someone reprimands me for implying that there were corporate or technical bigshots in attendance, let me clarify that one. There were, in fact, luminaries of various sorts participating: A-list bloggers, well-known corporate folks, technical experts working at the forefront of innovation in the field of identity mangement ... people like that. However, and this is the point: they were not on stage, performing. They were at the tables and in the rooms, talking, listening, asking and answering questions. In terms of social interaction, the conference hierarchy was flat.

Phil Becker wrote in the DIDW newsletter:

This week I saw a significant "state change" occur in this year and a half "Identity Gang" evolution, and it tells me things are going to start to happen. Some of those involved will be happy this is so, others most likely won't be. But for those not directly involved (i.e. most of the population) it was, in my opinion, a tremendously significant moment in the evolution of the identity conversation, and one that will have many significant ramifications going forward - though these will likely take another year to become clear to those not paying close attention.

They are working on the issues of what form identity must take
to become ubiquitously deployable, become something that will be adopted
comfortably by users, and how we can ever get there from here.

The first sign that the required significant shifts are occurring is
visible in the titles of the sessions this un-conference produced on
its first day. These titles have all subtly shifted in ways that
indicate there is no longer any question that there is a single,
over-arching story behind the identity conversation, and that the
mission now is to figure out how to converge the many efforts that
are underway. These efforts were each begun with a very different
mission and with a very different use/case and problem set driving
them, and this has previously created division and competition. This
time, however, it was clear that everyone was looking for where they
should get on board, and how to avoid having their goals left out.

Technorati Tags: conference, identity, iiw2006, iiw, workshop, XDI, XRI, YADIS

To solve this problem, or pieces of it, companies and individuals have made a variety of architectural and governance proposals. Some of these include:

• The Liberty Alliance
• Microsoft'sInfoCardsystem
• Identity Commons
• SXIP
• OpenID
• LID
• XRI/XDI(i-names)
• Passel

Myself, Phil Windley, Drummond Reed, and Doc Searls are hosting the Internet Identity Workshop in Berkeley on October 25 and 26th to provide a forum to disucss these and other architectural and governance proposals for Internet-wide identity services and their underlying philosophies. The workshop will comprise a day of presentations on Internet-scale identity architectures followed by a day of structured open space to accommodate the range of topics and issues that will emerge from day one and other issues and identity services that do not fit into the scope of the formal presentations. We're hoping that adding a little more formality to the conversation will aid in digesting some of the various proposals.
We're inviting presentations for the first day on the following topics:

• Problems, issues, politics, and economics or Internet-scale identity systems.
• Architectures for Internet-scale identity systems
• Philosophies that drive architectural decisions in these systems (see Kim Cameron's Laws of Identity for an example of such a philosophy

If you'd like to present on some other topic, drop one of us a line first and we’ll see how it fits in. Prospective presenters will be asked to submit a 250-300 word abstract. We hope to accomodate everyone, but we may end up picking from the abstracts.

I'm excited about this and looking forward to it. I hope we can have a good set of presentations the first day and a solid day of discussion the second. If you're interested in this sort of thing, I hope to see you there. Please read the full announcement for some other details and register if you're coming. There is a $75 charge to cover the cost of the venue, administrative expenses, and the cost of snacks and lunch both dats.