Digital ID Coach

On Sharing Information

coach — Mon, 15 Feb 2010 20:46:32 +0000

Every day we visit sites, exchange email, post comments or status updates, and otherwise exchange data with lots of servers on the Internet. Much of the time we know and voluntarily offer our information, such as typing search terms to learn something, or offering our name, address and credit card to make a purchase. Our exchanges also transfer information about us that we may not be aware of, such as our IP address, our browser, and the type of operating system we’re using.

Despite our “agreeing” to various sites’ Terms of Service when we sign up for an account, we do not generally “volunteer” to be tracked, our habits quantified, categorized and sold. That raises the question: what if we could control more of what we exchanged? Would we? What would it take?

Obviously stores want to know if we are a serious customer: if we’re looking for the purpose of actually buying, if we can afford the items we’re looking at, and if they should use those items to suggest additional items we might be interested in (or if it was a gift to someone else and we have no personal interest in that item). For example, car dealers would save billions of dollars each year if they could identify serious and qualified buyers without having to create advertisements for television, magazines and newspapers, and billboards everywhere. In fact, it would probably be worth something to us as a serious shopper if we could identify ourselves as such ahead of time and especially during sales negotiations.

Like the car buying story above, scenarios are stories that we tell to help us understand complex environments. Chris Carfi did four nice overview examples in his Social Customer Manifesto’s VRM scenarios. The world of information sharing is complex in many ways: personally (what do I want to share?), politically/regulatorily, in commerce, technologically, and more.

Digital ID Coach is organizing a day-long workshop to look at this subject. We will be engaged in Rapid Scenario Development (a process that usually takes days or weeks). If you’re in the San Francisco bay area on May 16, you’re invited to join us. If not, stay tuned; we’ll be posting notes from that workshop.

Coaching moment: It’s worth thinking about how we use technology, and how it helps us do what we want to do. Technology such as computers, phones, and even programmable devices like thermostats and switches, have obvious benefits like aiding communications or saving energy. Technology also has a cost, like learning to use it or controlling things you don’t want it to do.

In the case of information technology, you’re empowered to connect to friends and resources but you also trade information about your location and other details. Since this will never be a case of only responding to your needs and never exchanging (which technically doesn’t work since the info needs to know where you are to respond to your request), we need to think about that exchange. What would help us the most? What would you be comfortable telling others about?

This is complex because it probably depends on each exchange. However, we can determine policies for general use in categories like “collect but don’t distribute without my express permission,” or “forward at will, this is something I want.” What categories or practices would you suggest?

On Data and Disclosure

coach — Tue, 15 Dec 2009 19:25:11 +0000

I like to think about ways to customize my world, and the digital world writ large, in ways that support and help us explore our unique selves. It is in our very diversity that individual strengths can play out to become our personal best, to help each other grow, and create fertile new worlds.

However, under the guise of “increased security,” we are increasingly surrounded by tools and technologies that minimize and standardize us, including video surveillance and data storage and analysis. About that last link to Google, CEO Eric Schmidt recently said “If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”

This indiscriminate personal data hoarding is both an individual and a societal problem. Schmidt’s argument that we shouldn’t have anything to hide is specious (not to mention a double standard: it doesn’t apply to Schmidt). In a 2007 paper called ‘I’ve Got Nothing to Hide’ and Other Misunderstandings of Privacy, George Washington University Law School’s Daniel J. Solove convincingly critiques that argument. Indeed we have many things to hide, like our passwords and credit card numbers, certain personal habits and preferences, things that contribute to human dignity and respect. As noted security expert Bruce Schneier writes in his essay The Eternal Value of Privacy, “Too many wrongly characterize the debate as “security versus privacy.” The real choice is liberty versus control.”

Ironically, Gary Wolf and Kevin Kelly host a blog called The Quantified Self where they report about people exploring ways to keep track of themselves. It’s a significant difference between curiosity, personal need, and voluntary disclosure that’s driving data sets, and corporate ventures like Facebook (nod to jerking you around again with recent privacy policy changes), Google (Schneier’s response to Schmidt’s quote above), and damned near every corporate site you make an account with and that tracks your every move these days.

I’m looking for examples of sites that encourage liberty and demonstrate some respect for its users/clients. I will be reporting on what I find. If you have suggestions, I welcome them.

Coaching moment: Here’s a little thought exercise. Think about a typical day in your life.

What kind of things do you do in private? These might be taking a shower, brushing your teeth, thinking about the day. Some things might be really private as in just you by yourself, and other things may be private in some context, like thinking about your day out loud with your spouse or partner. Once you get a good list, which of those things would make you uncomfortable if they were made public in some way?

Now think of the kind of things you do in public, like driving to work or the store, walking around, having a conversation over lunch. Think about stories that might be told about you from the perspective of not knowing what you were really doing. You might take clues from signs that you walk by, or maybe other people (posture, groupings, facial expressions). Can you think of any stories that are not only wrong but might hurt you?

Finally, think about your online tools. Have you actually looked at the Terms of Service or Privacy Policies that you’re agreeing to? If you knew they were disrespectful to you or even abusive of your personal self and liberty, would you stop using them? Since the answer is “probably not,” what would you suggest these companies change?

Things we don’t know

coach — Tue, 20 Oct 2009 08:01:50 +0000

It’s hardly news to admit that I don’t know everything, and I bet you don’t either. It’s probably not news to say that psychologists don’t know everything either. So it is with some amusement that I ran across this collection of 150 word posts by a group of world-leading psychologists about things they don’t know. The group of posts are part of a celebration of 150 issues of the British Psychological Society’s Research Digest. (Congratulations BPS!)

Here’s a sample post. This one is by Paul Rozin on Time management.

I generally believe that we learn from experience. However, a recent study I did with Karlene Hanko repeats a finding from Kahneman and Snell, that people are very poor at predicting how their liking will change for a new product (in our case, two new foods and two new body products) after using it for a week. We predicted that the parents of our college undergraduates would be better than their children at predicting their hedonic trajectory, but 25 more years of self experience did nothing for them. Nor for me. Every night, I bring home a pile of work to do in the evening and early morning. I have been doing this for over 50 years. I always think I will actually get through all or most of it, and I almost never get even half done. But I keep expecting to accomplish it all. What a fool I am.

Coaching moment: Take a few minutes to think about stuff that you know, and stuff that you don’t. What’s something you don’t know? What does that mean to you? (Whatever it means, it’s part of who you are.)

Portable Identities

The Right to be Yourself

coach — Mon, 19 Oct 2009 01:28:17 +0000

Sentient Developments has a thought provoking post called Cognitive liberty and right to one’s mind that talks about cognitive liberty, neurodiversity, and the right to control one’s own mind. Author George Dvorsky states that, while there may be compelling reasons why treatment might be appropriate (like for people engaged in criminally harmful behavior), it may be undesirable to “cure” those who are neurologically different (because of Aspergers or autism, for example). From the article:

Cognitive liberty is not just about the right to modify one’s mind, emotional balance and psychological framework (for example, through anti-depressants, cognitive enhancers, psychotropic substances, etc.), it’s also very much about the right to not have one’s mind altered against their will. In this sense, cognitive liberty is very closely tied to freedom of speech. A strong argument can be made that we have an equal right to freedom of thought and the sustained integrity of our subjective experiences.

Coaching moment: Your mind is a big part of what makes you unique in the world. You may choose to alter your mind by learning, drugs, television, or many other means. This is your choice. However, I doubt that many people would be supportive of a nationwide drug program to make us all the same (as if that were possible, which I also doubt).

This reminds me of a short story by Kurt Vonnegut called Harrison Bergeron. It starts out:

THE YEAR WAS 2081, and everybody was finally equal. They weren’t only equal before God and the law. They were equal every which way. Nobody was smarter than anybody else. Nobody was better looking than anybody else. Nobody was stronger or quicker than anybody else. …

The future will not be so kind as Vonnegut. We will need all forms of our diversity to tackle some of our own global problems and creations. We are better served by learning how to listen and learn from each other. Each of us is unique. Together we are still different. That is our strength if we allow for it.

On Being Personally Identifiable

coach — Tue, 15 Sep 2009 21:39:36 +0000

The Electronic Frontier Foundation has an informative article called What Information is “Personally Identifiable”? I was surprised to learn that if I know your gender, zip code, and birthday, there’s a high likelihood that I know exactly who you are.

Gender, ZIP code, and birth date feel anonymous, but Prof. Sweeney was able to identify Governor Weld through them for two reasons. First, each of these facts about an individual (or other kinds of facts we might not usually think of as identifying) independently narrows down the population, so much so that the combination of (gender, ZIP code, birthdate) was unique for about 87% of the U.S. population. If you live in the United States, there’s an 87% chance that you don’t share all three of these attributes with any other U.S. resident. Second, there may be particular data sources available (Sweeney used a Massachusetts voter registration database) that let people do searches to bootstrap what they know about someone in order to learn more — including traditional identifiers like name and address. In a very concrete sense, “anonymized” or “merely demographic” information about people may be neither.

Coaching moment: Think of how many grocery store, membership applications, and online accounts have your name, zip code, gender and birth date. Many of the contractual terms that we agree to when we apply for these services make reference to how the company plans to use their data. In some cases, they claim to use “aggregated data” which does not identify us by name. However, if we put a few of these databases together (you know this is happening, right?), there’s a lot of data available about us. Specifically.

Think about who is asking for your data, and what need they might have for it. I encourage you to think more critically about your data sharing practices. It might not be safe to think that anonymized data stays that way.

The Five A’s of Security

coach — Mon, 07 Sep 2009 16:59:01 +0000

Personal and online security is a desirable state and a complex idea. This guide offers a general overview of the main idea that, when used together, help us establish a level of security that makes us comfortable using our computer in an online world.

Awareness

The first subject in talking about security is awareness. We need to be aware, for example, that we are not always safe in the world (online and offline). When we are online, most people are aware that there are certain dangers such as viruses, phishing, and spam that threaten our safety (personal, financial, or data). Once we know that problems exist, we are more likely to learn about and take steps to avoid danger and keep ourselves safe and secure.

Authentication

Authentication is the process of verifying that you are the real you. Your friend may authenticate you to other friends by saying something like “this is my friend Chris” (or whatever your name is). You may prove that you’re who you are to a business entity by answering questions that only you would know the answer to. You are usually being authentic when you speak honestly, from your perspective, to someone you love.

Authorization

When you are authorized, you have access to a computer system. Verifying users of your computer, or your work’s computer, or any storage systems or online accounts, can help you track the activity in files and resources. An unauthorized user can be prevented from gaining access to your information. Authorization is the process of assigning permission to use certain files and resources.

Access Control

Setting permissions on files, directories, accounts, or computers can establish limits to these resources. You may wish to be the only person that read and update your personal finances, for example. This is referred to as individual read-write access (only the owner of the file can read or update). At work, your group may have access to read and maybe edit a collaborative document. Most of the web pages offer global read-only access. Individual, group, or global access can be set to allow reading, editing, and/or other permissions.

Auditing

As individual computer users, we don’t often think about the clues that we can use to track where we’ve been and what we’ve been doing. However, whenever we visit a web site, the site’s server automatically keeps a record of things like our domain name or IP #, the time and date of our request, the page or file requested, a code indicating success or error, the number of bytes transferred, and more. As the visitor, we don’t have such tracking tools (and in many cases, don’t need them). However, as our habits and travels on the Internet are increasingly scrutinized by the sites we visit, we have a stronger case for understanding what is being compiled about us.

Coaching moment: In reality, these five A’s are somewhat intertwined. For example, it doesn’t make sense to have Authentication without Authorization. Access control doesn’t happen without Authentication and Authorization, and none of these make sense without Awareness.

What does this have to do with digital identity? These are the pieces that make up our digital records, including who we are and what we’re allowed to do. Sometimes we have control over these decisions, and sometimes control is in the hands of others. It depends on the context of where we are and what we need.

What Data Can Show

coach — Fri, 04 Sep 2009 18:47:05 +0000

This video is an interesting romp through time, illustrating special effects and what can be shown visually. What does this have to do with digital identity? Several things:

The world is not always as it appears
Some people want you to see the world in a particular (non-real) way
You can show the world who you are in a particular (real or non-real) way
A personal identity is an interpretive dance between the person offering and the person accepting or using some information
Not all information (like details of how the effects were created) needs to be revealed

Coaching moment: You are, at some points in time and in certain circumstances, the director, designer, and special effects creator of your own life. You can choose what to show, what to withhold, and what parts of you become the picture that others see. For example, you may not choose to talk about last night’s bar crawl when you’re at work, being a model employee. You may choose to reveal more information about your activities to your doctor, in order to assist an appropriate diagnosis. You may choose to portray indifference and anonymity to an annoying panhandler on the street.

What happens when someone else follows you around, blowing your cover? That’s what many companies are doing now when they collect and trade your data. These companies are saying, in effect, “we know who you are, you can not hide from us.” However, what they “know” may not be true or accurate. See, for example, What the Internet Knows About You – a site that says you’ve “visited” URLs that may have only shown up on your visited pages as advertising or invisible pixels. Or take a look at your annual credit card summary to see that your favorite local hardware store is categorized as a “specialty foods” (or some other clearly erroneous) category.

Why might you care about this? Many of these companies and related trading partners are making decisions about you based on this information. They are not asking you to verify–nor are you given the opportunity to refute–inaccurate or incorrect information. Is this the kind of decision making that you want to be steering your life? (I don’t.) This is a version of making decisions about your finances based on identity theft, or about your insurability based on someone else’s records.

What can you do about it? First: be aware of this practice. Choose to work with businesses that are collaborative and will help you verify your data. There aren’t many of them yet. As they show up in the marketplace, they will need your support. Second: order a credit report from any (each) of the big three data companies. Correct what’s wrong. Know what they say. Third: Talk with your friends about this. You may be interested to learn who cares and who does not. Ultimately this is your priority, not someone else’s.

Getting to know you

coach — Fri, 21 Aug 2009 00:32:17 +0000

National ID cards and programs are problematic at best, and an ongoing nightmare for citizens and visitors alike when the programs are poorly designed. The U.S. government has made earlier attempts at developing such a program, which have failed. However, the dream lives on in the minds of certain government officials and representatives.

The Electronic Frontier Foundation (EFF) has been following these efforts for years. EFF’s Richard Esguerra has a post, PASS ID: REAL ID Reanimated that offers an informed look at the latest effort to create the next version of a national identity card.

The PASS ID Act (S. 1261) seeks to make many of the same ineffectual, dangerous changes the REAL ID Act attempted to impose. Fundamentally, PASS ID operates on the same flawed premise of REAL ID — that requiring various “identity documents” (and storing that information in databases for later access) will magically make state drivers’ licenses more legitimate, which will in turn improve national security.

An ID card is only a small part of the picture. The government program that supports the card is where the devils live. I recommend to you Bruce Schneier’s testimony to the Senate on why this whole idea is seriously flawed.

Coaching moment: Have you ever filled out a form for a new service, at a web site or store, where the form asked for information that they might not have needed for the transaction you were seeking? Long forms that ask a lot of questions about you, your preferences, your income, and other personal information, are unnecessary. If you’re just buying something, why might the vendor need your income, your birthdate, or any information about other family members?

The fact is that they often don’t need it. They’re collecting information about you because they can, and because you might volunteer it. Even when certain information is marked as “required,” it might be in your best interest to think twice about doing business with companies that would be so invasive and demanding.

Treat your personal information on a “need to know” basis. What that means is don’t give out more information about yourself than you think the companies need to know in order to carry out the transaction. If the company or form require more information than you’re comfortable giving, think hard about your future well-being as a trade-off for today’s discount. Your mindfulness is a low-cost insurance on your future.

Getting Tested

coach — Sat, 15 Aug 2009 09:15:04 +0000

CNN has an article about families in China whose children are “participating in a new program that uses DNA testing to identify genetic gifts and predict the future.” The article, In China, DNA tests on kids ID genetic gifts, careers, states that the reason for these tests is to help give children an advantage by determining what the children’s genetic profile reveals.

The test is conducted by the Shanghai Biochip Corporation. Scientists claim a simple saliva swab collects as many as 10,000 cells that enable them to isolate eleven different genes. By taking a closer look at the genetic codes, they say they can extract information about a child’s IQ, emotional control, focus, memory, athletic ability and more. …

For about $880, Chinese parents can sign their kids up for the test and five days of summer camp in Chongqing, where the children will be evaluated in various settings from sports to art. The scientific results, combined with observations by experts throughout the week, will be used to make recommendations to parents about what their child should pursue.

Coaching moment: Your DNA is the instruction book to how your body develops and works. Scientists are studying the combinations and locations of various genes to try and figure out where our health problems begin or end. In this article, the scientists are using certain tests to “determine a child’s future.” The children’s DNA map becomes part of their digital health records.

Of more interest to me was this sentence: “Examining one child’s results, he told CNN: ‘This child is very thoughtful and focused, so I suggest she go into management.’” Being thoughtful and focused might also represent the creativity of an artist, the clarity of a physicist, or the drive of a programmer. However, the notion of casting a child’s future as a manager is much more problematic because it assumes that the Chinese scientists studying these children believe that they know what “management” as a line of work will be like in the future.

Will there be a great ongoing need for managers? Will “management” add value to the world in 20-30 years? We don’t know. We do know that technology will change the way we work and communicate, which is central to “management” today.