Arbitrage

Check out the real situation

Jamie Lewis linked to the 2005 Identity Fraud Survey Report which concludes that the risk of identity theft is greater in the physical world than in the virtual. This report has been picked up broadly in the mainstream press (USA Today, AP, Chicago Sun-Times) and I read the story as as a prominent data point for those concerned with digital identity.

Anyone who has recently re-financed a mortgage on paper or responded to a snail mailed credit card soliticitaion has felt the twinge of recognition of the real risks to your identity that are very present in the physical world. The moment you print your SSN, home address, mother's maiden name, etc.  on a piece of paper,  seal the paper in an envelope, and send it through the mail you have fed your identity assets into a system that provides little assurance, no visibility, no audit - while at the same time , it is a system that is vulnerable to the least sophisticated form of attacks - simple theft. 

The evolution of digital identity systems will give people a choice. People will have to decide what is riskier: sending a piece of snail mail containing a paper record of your identity or transmitting a digitally signed assertion (XML document) over an encrypted channel between highly trusted information systems.  Both methods of moving identity information involve risk, the question is which is more secure. I fundamentally believe the digital system is/will be more secure and this is why I advocate positioning the evolution of digital identity systems as a reform movement.

The Business Narrative for Federated Identity (via C. K. Prahalad)

To date, discussions of the business case for federated identity have tended to rely on dubious ROI logic and repeated use of the terms "sticky" and "seamless". The vendors promoting this technology - I definitely include myself here - have generally fallen into the trap of these common distinctions out of a course of habit. Using common technology marketing jargon isn't necessarily a bad thing, it just doesn't put federated identity into a compelling business story.

I had the great privilege and good fortune of meeting the prominent business professor and author C. K. Prahalad earlier this week. Some of Mr. Prahalad's current themes are centered around the Co-Creation of Value as a significant trend in business and, as is often the case when one hears a world class teacher do his/her thing in person, I came away seeing my work in federated identity technology thrown into a new and more powerful narrative.

In his book, "The Future of Competition: Co-Creating Unique Value with Customers", Mr. Prahalad brings forth a new set of distinctions for how customers and companies can interact. The quick summary is that the companies that treat customers as powerful stakeholders and provide customers with access to a network of partners are likely to prosper. The Co Creation business model relies on concepts such as nodal networks of business partners, dynamic boundaries between and amongst companies and customers, privileged access for customer stakeholders, and so on. The main idea is that moving forward winning companies will provide the possibility of rich customer interactions where customers can create and configure partner networks and help specify the nature of the services that flow through those networks.

Think of the way digital identity will flow through the IT systems that are deployed to support the mode of doing business described in "The Future of Competition" - it seems obvious that federated identity - as I define it, federated identity is the technical ability to port identity (and associated attributes) across system and enterprise boundaries via open standards - will be a core enabling technology. Chiefly because federated identity technology facilitates the system modularity required for IT infrastructure to express rich and complex customer interactions across a network of business partners. 

Doc Searls (co-author of "The Cluetrain Manifesto", e.g. "Markets are Conversations") has also connected digital identity technology to a potential shift in the customer/company relationship. In his keynote at Digital ID World in October, Doc described how personal digital identity solutions held the promise of Company Relationship Management - where the customer holds sway over the company (as opposed to Customer Relationship Management where the company scrutinizes and manipulates the customer).

C.K. Prahalad is traveling the world helping to bring into being a manner of doing business based on rich interactions between customers and companies. In doing so, he has gifted the digital identity community a powerful business narrative that sets up federated identity as a core technology.

C. K. Prahalad Trivia side-note: The C is for Coimbatore, the Indian town of his birth, the K is for Krishnarao, his father's name - thanks Economist.

Identity Rule Set

Is Kim Cameron working on Identity "Laws" or Identity "Principles"? That is a topic that is recently getting some play across a couple of blogs (e.g Craig Burton, Jamie Lewis, Shelley Powers). I categorize Kim's 7 thingys as an Identity Rule Set. This is primarily because I have been following the work of Thomas P.M. Barnett. Thomas Barnett is a strategist who has developed a widely respected interpretation for the underlying dynamics of globalization and the way globalization causes and resolves conflict around the world. <sarcasm> Granted, his problem space is significantly less complex than digital identity</sarcasm>, but that won't stop me from borrowing a distinction or two.

One of the key pieces of language Barnett uses is "Rule Set". In his view, conflicts and breakdowns occur when activity races ahead of the Rule Sets that govern that activity. This is  a pattern that can be seen in the current situation with digital identity on the Internet. Many systems and practices for dealing with identity have developed organically and tactically and the resulting breakdowns include mass inefficiencies, risk to privacy, barriers to developing new systems, etc.

What Kim is developing is a language for discussing a Rule Set that can govern the ways Identity is handled on the Internet - this is an incredibly generous and ambitious endeavor. That said, I can understand the built in suspicious reaction to his use of the term Laws.

I think Rule Set works for me - and we do need Rule Sets in this area, so in my little world...Identity Rule Set it is.

Side note: Learning and borrowing (OK, stealing) from voices like Thomas Barnett is one of the reasons I call my blog Arbitrage. He is working in a foreign market to mine, yet his methods, processes, and language can be applied in my market and add value. Blogs really facilitate this form of arbitrage – idea arbitrage.

Go Ahead, Aggregate

The recent batch identity theft at George Mason drew a predictable reaction. Jamie Lewis used the occasion to point out that aggregating data aggregates risk. This view leads many to see centralization of digital identity information as a move in the wrong direction. I have a different interpretation.

The break in at George Mason shows the value of higher degrees of centralization - if a centralized user store is more secure, more accountable, more regulated, more trustworthy, more interoperable - in short, held to higher standards - than the distributed user stores that represent the status quo - then why fear centralization? In the current identity regime, user data is stored in any number of databases managed and protected using methods very similar to those at George Mason - this is the real threat. Roll that data up into better designed aggregation points and you will have made identity more secure.

The argument that aggregated user data creates attractive targets for attacks is true. It is true in the same way that aggregating cash in a bank makes the bank an attractive target for attacks. The solution to the bank problem is not to withdraw all your cash and walk around with it in your wallet - the solution is to regulate, insure, standardize, and secure banks to high standards. The same holds true for digital identity information. It should be stored in aggregation points that we can trust.

More on how aggregation relates to personal digital identity schemes such as LID in an upcoming post...

In the interim

My work brings me back to this Sidney Harris cartoon over and over.  Most recently it came to mind while I was listening to the Dec 31, 2004 Gillmor Gang (a rewarding listen for those curious about digital identity).  The gang collectively expressed what I believe will be one of the key themes for digital identity in 2005 - conflict between solutions designed for enterprise identity and those for personal identity. Dave Winer pressed Kim Cameron about his laws and the role Microsoft will play in providing identity as an internet service. In his laws Kim goes further than any other enterprise identity architect I know of towards accomodating the privacy and complexity concerns that are top of mind in the personal identity space - and still he had to deflect doubts and suspicion (ironic that in a discussion regarding identity, Kim faced a lack of trust in his point of view because he works for Microsoft). The gang landed at an agreement that a global meta system for identity that is pluggable for personal and enterprise identity technology alike is the best path forward and that's definitely a "then a miracle occurs" moment. Until that step (rolling out a broadly accepted meta system) is made more explict we solution providers are stuck in the interim. In my day to day conversations with those looking for enterprise solutions, I am arguing that "discrete, yet extensible" is the best philosophy. In other words, break off a closed set of goals or concerns that can be addressed with some combination of SAML, Liberty, strong auth, LDAP, etc. and take pains to deploy an architecture that can be extended when the time comes.

 

more Less Databases...

Right now, you implicitly trust the skills of every dba for every database where your social security is stored. Who are they? Where do they work? How were they trained? It's difficult to say from where you are sitting, isn't it. If you are one of the 1.5 million people who had their info stored in and stolen from a UC Berkeley database, you are know more conscious of the need for reform of how digital identity is managed.

By databases here I am referring to any system that stores user data. Could be LDAP, RDBMS, Legacy - any system that stores identity information. How many  databases storing privileged identity information are connected to the network? The actual number is anybody's guess.

As the Cal story shows, each of these systems holds the potential for loss/theft/misuse/abuse of digital identity - so it follows that the sheer number of them poses significant risk. One of the great hopes of federated identity is the possibility that widespread deployment of systems that can exchange identity information at run time will lead to a decrease in the number of databases that store identity.

I'm not calling for an all out aggregation into a single mongoloid directory - but some aggregation of identity information into centralized systems would be a big step in the right direction. Each aggregation point will be held to higher benchmarks for trust, security, privacy, and open standards than any completely decentralized system can ever attain.

The current eulogies being written for MS Passport tend to dismiss the centralized model for universal identity as a threat to privacy. The fact is that without some degree of centralization it will be impossible to bring commonly recognized and trusted integrity to digital identity.

A New Frame: Digital Identity Reform

Ever heard of Frank Luntz? He is the conservative pollster and language jockey who gets paid to sell controversial political initiatives to the American public. His great contribution is word choice. A couple of his masterpieces: Welfare Reform, Tax Reform, and The Death Tax. In practical terms, there is no difference between "Welfare Cuts" and "Welfare Reform" or between "Estate Tax" and "Death Tax". The difference is in how the different words used to describe an initiative drive how the initiative is perceived/received. You can disagree with Luntz on his politics/ethics but his effectiveness provides a model that would be of some use in our ongoing conversations about digital identity.

Digital Identity is certainly controversial. Privacy is the 3rd rail in any discussion of how a universal identity system will affect users, while Liability Shifts and Trust Management are seen as non-trivial barriers to establishing portable identities in the enterprise space. Any initiative that seeks to deliver identity as a network service will inevitably bump into these and other objections.

One way of looking at Kim Cameron's laws is to see them as a set of pre-emptive distinctions that address the privacy concerns that threaten to derail a broad digital identity initiative. He's done good work inventing a common language. Another area in need of more effective distinctions is how the current state of digital identity is described.

The status quo of digital identity presents greater threats to privacy, liability, and trust than any of the currently proposed solutions. The current state of digital identity looks to me like a perfect storm: Widespread Identity siloing, weak credentials, lack of transparency, convoluted liability ownership, overwhelmed and/or incompetent IT administration and so on all combine to create the downright spooky environment in which identity transactions currently take place on the network. Yet when the conversation is framed in terms of innovation - i.e. "let's invent a universal identity system that provides x,y,z benefits" - there is strong resistance.

And so, I suggest that the current state of digital identity is badly in need of REFORM. The Liberty Alliance, SAML, SXIP, FOAF, WS-* are all initiatives aimed at reforming a badly broken system.

Digtial Identity and the Bottom Line, pt. 1

My resolution for 2005? Develop an accurate and well grounded assessment of the economic impact of digital identity.

As far as I can tell there is more than enough academic think tank brainpower being devoted to the discussion of what shape and form a universal identity system will/should take. Kim Cameron, Doc Searls, Craig Burton, et al. dish the topic daily. Mr. Cameron is currently in the process of constituting the 7 laws of identity (he's now up to law #5). The laws are a generous endeavor . They help order the conversation of digital identity by articulating many of the signifcant implications and concerns that must be accounted for in whatever architecture evolves to address universal identity. I do hope 1 of the 2 yet to be unveiled laws address the economics of digital identity - I am afraid that without some consideration for where the money comes and goes, any discussion of digital identity will be constrained to the ivory tower. Identity should not become the space program of the virtual world (i.e. an underfunded, deeply philosophical, sometimes newsworthy, often marginalized, exploratory adventure).

Identity represents a broad set of significant economic opportunities, we need to get better at explaining that to the businesspeople who will ultimately fund the universal identity system in terms they can understand - distinctions like revenue, profit, value, etc. need to be a part of the digtial identity conversation.