Posted 9:27 AM (1) comments

Which ox are you goring?

ProjectVRM's Joe Andrieu has a long, but not necessarily rambling, post today buttressing his (and the project's) stand on data sharing.

He makes some great points, such as that many people confuse privacy with secrecy. And that transactional data is owned by all parties to the transaction separately and mutually. He totally misses some points, such as confounding Digital Rights Management with meat space copyrights.

But where he really got me was right near the very end of his screed where he says:

"Because the fact is, we want to share information. We want Google to know what we are searching for. We want Orbitz to know where we want to fly. We want Cars.com to know the kind of car we are looking for.
We just don’t want that information to be abused. We don’t want to be spammed, telemarketed, and adverblasted to death."

But the reality is that we will be "spammed," telemarketed and adverblasted whether or not the party doing the marketing knows what we want or not. Advertising should be about letting me know the possibilities that might interest me. And the only way that can happen is if the advertiser knows my likes and dislikes, wants and needs. Isn't that the premise of VRM, that we (the users) tell the vendors what we want and they then compete to fill our need? How can they do that without telling us of their offers, and isn't that advertising? Targeted advertising, targeted directly at the person(s) who are looking to buy.

Rework the post, Joe. There are too many good points to be spoiled by such a bad ending.

Labels: privacy, sharing, VRM

Posted 9:06 AM (3) comments

It's OK, we're co-related

In responding to my "violent agreement" post, Kim Cameron goes a long way towards beginning to define the parameters for correlating data and transactions. I'd urge all of you to jump into the discussion.

But - and it's a huge but - we need to be very careful of the terminology we use.

Kim starts: "Let’s postulate that only the parties to a transaction have the right to correlate the data in the transaction, and further, that they only have the right to correlate it with other transactions involving the same parties."

Which would mean, as I read it, that I couldn't correlate my transactions booking a plane trip, hotel and rental car since different parties were involved in all three transactions!

But he goes on to say: "...the individual would have the right to correlate data across all the parties with whom she interacts."

So which is it - do the parties have the right to create correlations among all partners, or not? Remember that, at least according to US law, a corporation is treated as "an individual."

In the end, it isn't the correlation that's problematic, but the use to which it's put. So let's tie up the usage in a legally binding way, and not worry so much about the tools and technology.

In many ways the internet makes anti-social and unethical behavior easier. That doesn't mean (as some would have it) that we need to ban internet access or technological tools. It does mean we need to better educate people about acceptable behavior and step up our policing tools to better enable us to nab the bad guys (while not inconveniencing the good guys).

Labels: context, digital identity, VRM

Posted 9:44 AM (0) comments

Kim Cameron: secret RIAA agent?

Kim has an interesting post today, referencing an article ("What Does Your Credit-Card Company Know About You?" by Charles Duhigg in last week’s New York Times.

Kim correctly points out the major fallacies in the thinking of J. P. Martin, a "math-loving executive at Canadian Tire", who, in 2002, decided to analyze the information his company had collected from credit-card transactions the previous year. For example, Martin notes that "2,220 of 100,000 cardholders who used their credit cards in drinking places missed four payments within the next 12 months." But that's barely 2% of the total, as Kim points out, and hardly conclusive evidence of anything.

I'm right with Cameron for most of his essay, up til the end when he notes:

"When we talk about the need to prevent correlation handles and assembly of information across contexts (for example, in the Laws of Identity and our discussions of anonymity and minimal disclosure technology), we are talking about ways to begin to throw a monkey wrench into an emerging Martinist machine. Mr. Duhigg’s story describes early prototypes of the machinations we see as inevitable should we fail in our bid to create a privacy enhancing identity infrastructure for the digital epoch."

Change "privacy enhancing" to "intellectual property protecting" and it could be a quote from an RIAA press release!

We should never confuse tools with the bad behavior that can be helped by those tools. Data correlation tools, for example, are vitally necessary for automated personalization services and can be a big help to future services such as Vendor Relationship Management (VRM) . After all, it's not Napster that's bad but people who use it to get around copyright laws who are bad. It isn't a cup of coffee that's evil, just people who try to carry one thru airport security. :)

It is easier to forbid the tool rather than to police the behavior but in a democratic society, it's the way we should act.

Labels: digital identity, reputation, VRM

Posted 3:12 PM (0) comments

The Diamond Framework

Paul Trevithick has done us all a great service: he's provided a matrix of terms from the major authentication/identity systems making up what's loosely called "user-centric" identity and equated the varying terms (each identified with a letter) to facilitate conversations about the varying protocols, systems and technologies. A wonderful effort coming, as it does, on the opening day of the spring Internet Identity Workshop.

Would that, in this best of all possible worlds, the various evangelists for these systems could adopt Paul's terminology.

Labels: Oauth, openid, SAML, user centric, VRM