Information Sharing – joeandrieu.com
type: channel
description: My personal space
date: 2013-04-24T06:52:22Z
update period: hourly
update frequency: 1
update base: 2000-01-01T12:00+00:00
generator agent: https://wordpress.org/
items: Destroying contract law: CISPA violates more than privacy
items: Badges for the Standard Label Kickstarter
items: Rethinking Context
items: It all starts with sharing…
items: Trust Me… Things Change.
items: Constellations of Privacy
items: Facebook as Personal Data Store
items: Looking for feedback on pRFP and Information Sharing
items: Asymmetry by Choice
items: Beyond Data Ownership to Information Sharing

Destroying contract law: CISPA violates more than privacy
type: item
creator: Joe Andrieu
date: 2013-04-19T16:42:03Z
subject: Information Sharing
subject: privacy
subject: ProjectVRM
subject: regulatory
subject: Shared Information
description: Don’t let Congress undermine our best free market tool for fixing our relationships with companies. The US House of Representatives just passed a bill (CISPA, aka HR264) that explicitly allows companies to ignore their privacy agreements in the name of … Continue reading →
encoded: Don’t let Congress undermine our best free market tool for fixing our relationships with companies. The US House of Representatives just passed a bill (CISPA, aka HR264) that explicitly allows companies to ignore their privacy agreements in the name of cybersecurity. Here’s the Huffington Post report: http://www.huffingtonpost.com/2013/04/18/cispa-vote-house-approves_n_3109504.html SOPA. The Monsanto Protection Act. CISPA. Regulatory capture of the worst kind. Please get the word out. Fight this thing. If we can’t even depend on the blatantly one-sided Terms of Service and Privacy Policies of our service providers, entire fields of solutions evaporate. Efforts to improve, fix, clarify, negotiate or automate the privacy and service agreements will be essentially worthless if Congress is willing to give corporations a free pass. “Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes … share such cyber threat information with any other entity, including the Federal Government.” Enshrining corporate protections like this in law isn’t just a privacy problem. It undermines the very notion of contract as a mechanism for constructing agreements in a free society. This is unaccepatble. Fight CISPA. Call your senator. Call the white house. Blog it. Tweet it. Repost this. Tell everyone.

Badges for the Standard Label Kickstarter
type: item
creator: Joe Andrieu
date: 2012-05-23T19:31:03Z
subject: Information Sharing
subject: Shared Information
subject: badges
subject: Kantara
subject: kickstarter
subject: standard information sharing label
subject: standard label
description: We’ve been asked if we have any badges to help promote our Kickstarter for the Standard Information Sharing Label. The answer is now yes! If you’re a backer or just want to help promote the idea, put these babies on … Continue reading →
encoded: We’ve been asked if we have any badges to help promote our Kickstarter for the Standard Information Sharing Label. The answer is now yes! If you’re a backer or just want to help promote the idea, put these babies on your website or blog or Twitter or Facebook and help get out the word! We have less than two weeks left to rally support for a radical new way for companies to communicate about what they do with the information we share online. Once we finish the Kickstarter, the link will go directly to our new website and will help promote the use of the Standard Label for websites everywhere. Feel free to download the image or just use the URLs as SRC tags. We’ve also provided example HTML that links directly to http://standardlabel.org.

Rethinking Context
type: item
creator: Joe Andrieu
date: 2012-05-15T18:02:01Z
subject: Information Sharing
subject: Shared Information
subject: context
subject: FTC privacy report
subject: personal levels of assurance
subject: privacy
subject: smart disclosure
subject: standard label
description: Insights from PII2012 The FTC Privacy Report makes it clear that context is the key to privacy. For example, notice and consent need not be presented and secured if the use is obvious from context: If you buy a book … Continue reading →
encoded: Insights from PII2012 The FTC Privacy Report makes it clear that context is the key to privacy. For example, notice and consent need not be presented and secured if the use is obvious from context: If you buy a book from Amazon, it’s clear they need an address to ship you the book. But sometimes the context isn’t clear to the average user, even when it is obvious to developers. My Mom believes she doesn’t share anything on Facebook because she mostly just comments on other people’s posts. Ilana Westerman’s work shows the same disconnect: many people just don’t see their privacy exposure because they have simplified models of their actions. They think what they are doing isn’t the risky stuff, but they rarely have the awareness of what they are really doing. Making that harder are monolithic Terms of Service and Privacy Policies that bury the details arbitrarily far away from the point of exposure, and in confusing legalese. The answer is some form of bite-size context management. For example, Smart Disclosure, which is the US administration’s language for greater clarity about risks of information sharing: One of the most powerful versions of smart disclosure is when data on products or services (including pricing algorithms, quality, and features) is combined with personal data (like customer usage history, credit score, health, energy and education data) into “choice engines” (like search engines, interactive maps or mobile applications) that enable consumers to make better decisions in context, at the point of a buying or contractual decision Or perhaps something along the lines of Personal Levels of Assurance, a term from AT&T describing piece-wise on-demand disclosure and consent. This is also the approach behind the Standard Information Sharing Label, which let’s you see in simple, consistent terms, exactly what happens with the data you are about to share, before you share it. That instance of sharing defines the context for which the information may be used,…

It all starts with sharing…
type: item
creator: Joe Andrieu
date: 2012-05-02T15:37:26Z
subject: Information Sharing
subject: ProjectVRM
subject: Shared Information
subject: User Driven
subject: Vendor Relationship Management
subject: IIW
subject: iiw14
subject: information sharing work group
subject: ISWG
subject: Kantara
subject: Kantara Initiative
subject: label
subject: legal
subject: notice
subject: open standard
subject: open standards
subject: privacy
subject: privacy policy
subject: standard information sharing label
subject: standard label
subject: terms of service
subject: terms of use
subject: TOS
subject: TOU
subject: VRM
description: From kindergarten through our professional life, sharing binds us together as friends, colleagues, and collaborators, so perhaps it should be no surprise that online sharing through services like Facebook, Twitter, and email shapes our online social life. Yet sharing online … Continue reading →
encoded: From kindergarten through our professional life, sharing binds us together as friends, colleagues, and collaborators, so perhaps it should be no surprise that online sharing through services like Facebook, Twitter, and email shapes our online social life. Yet sharing online is anything but simple. The details of what happens with the information we share is often hidden behind long, complicated legal agreements that almost no one reads. If we’re lucky, they are explained in Terms of Service and Privacy Policy documents, sometimes buried out of view, other times forced on us like ransom notes forcing us to state our compliance or leave the site. It doesn’t have to be that way. Today, at the Internet Identity Workshop, we officially launch the Standard Information Sharing Label, which makes it easy for websites to say in simple, consistent language what they do with our information, making it easier for individuals to make better decisions about the information we share online. The Information Sharing Work Group has published a draft specification defining the Standard Label as well as a Kickstarter project to finance its graphic design. The Kickstarter has a brief video explaining the effort. The official press release is here. The work is free to use and open to collaborators. In all my years contributing to the VRM conversation, few projects have made me as proud as I am of the work behind the Standard Label. Check it out. If you like it, please spread the word and consider chipping into help take this work to the next level.

Trust Me… Things Change.
type: item
creator: Joe Andrieu
date: 2011-04-22T08:24:32Z
subject: Information Sharing
subject: Personal Data Store
subject: Shared Information
subject: User Driven Services
subject: Vendor Relationship Management
subject: consent
subject: revocation
subject: trust
description: Trust is complicated. But for some reason, online trust mechanisms assume it is outrageously simple. For example, firewalls imply that once you’re in the network, you’re trusted. It’s baked into the framing of the problem. Similarly, Trust Frameworks assume that … Continue reading →
encoded: Trust is complicated. But for some reason, online trust mechanisms assume it is outrageously simple. <img decoding="async" class="alignleft size-medium wp-image-980" title="black and white handshake" src="https://blog.joeandrieu.com/wp-content/uploads/2011/04/black-and-white-handshake.dreamstime_18851240-300x225.jpg" alt="black and white handshake" width="210" height="158" srcset="https://blog.joeandrieu.com/wp-content/uploads/2011/04/black-and-white-handshake.dreamstime_18851240-300x225.jpg 300w, https://blog.joeandrieu.com/wp-content/uploads/2011/04/black-and-white-handshake.dreamstime_18851240.jpg 480w" sizes="(max-width: 210px) 100vw, 210px" /> For example, firewalls imply that once you’re in the network, you’re trusted. It’s baked into the framing of the problem. Similarly, Trust Frameworks assume that once you are in the Framework, you’re trusted (although you could build a framework that is dynamic). Even a user directed approach like Facebook Connect assumes that once you click “allow”, you trust that website to use your information appropriately, essentially forever… even if you revoke that permission later. Trust isn’t broad-based and it isn’t static. It is directed and dynamic. Think about it. We don’t trust our accountant to babysit and we don’t trust our babysitter with our finances. Trust is given for specific purposes and in specific contexts and it changes as quickly as we can fire that babysitter. <img decoding="async" class="alignright size-medium wp-image-983" title="multiple multi color handshakes" src="https://blog.joeandrieu.com/wp-content/uploads/2011/04/multi-multi-color-handshakes.dreamstime_4062545-300x300.jpg" alt="multiple multi color handshakes" width="180" height="180" srcset="https://blog.joeandrieu.com/wp-content/uploads/2011/04/multi-multi-color-handshakes.dreamstime_4062545-300x300.jpg 300w, https://blog.joeandrieu.com/wp-content/uploads/2011/04/multi-multi-color-handshakes.dreamstime_4062545-150x150.jpg 150w, https://blog.joeandrie…

Constellations of Privacy
type: item
creator: Joe Andrieu
date: 2011-04-10T17:45:46Z
subject: Information Sharing
subject: Shared Information
subject: User Driven Services
subject: Vendor Relationship Management
subject: context
subject: privacy
subject: public v private
description: Privacy issues dominate the global debate about protecting the rights of individuals online. Yet, the conversation almost entirely misses a vital point: public or private isn’t a black or white choice and it never has been. Sociologists have long recognized … Continue reading →
encoded: <img loading="lazy" decoding="async" class="size-full wp-image-960 alignright" style="margin-left: 10px; margin-right: 10px;" title="public v private" src="https://blog.joeandrieu.com/wp-content/uploads/2011/04/public-v-private.dreamstime_267400.jpg" alt="Public v Private" width="216" height="288" srcset="https://blog.joeandrieu.com/wp-content/uploads/2011/04/public-v-private.dreamstime_267400.jpg 360w, https://blog.joeandrieu.com/wp-content/uploads/2011/04/public-v-private.dreamstime_267400-225x300.jpg 225w" sizes="auto, (max-width: 216px) 100vw, 216px" />Privacy issues dominate the global debate about protecting the rights of individuals online. Yet, the conversation almost entirely misses a vital point: public or private isn’t a black or white choice and it never has been. Sociologists have long recognized that there is no single “public”, no monolithic context where social norms congeal and deviant behavior is shunned. Instead, we’ve recognized that each of us engages in multiple, distinct publics, with their own boundaries and rules of etiquette. We act one way at PTA meetings, another in Las Vegas, yet again a third way at work. These are different flavors of public behavior and yet we expect most people to respect boundaries between these areas. We manage these publics as easily and naturally as we greet a newcomer to the workplace. We do it without conscious effort, but with a sensitivity to the place and moment. We also constantly manage any number of private contexts, where certain topics and behaviors are understood to be held in confidence, from family matters and Santa Claus to corporate secrets. Just as there is no monolithic “public”, there is no single “private” domain, where insiders know everything and outsiders know nothing. We share confidences with our kids, our spouses, our lawyers, our doctors, our psychiatrists, our bartenders, our business partners, all with certain, often unstated, rules about appropriate use and redistribution. Sure, these…

Facebook as Personal Data Store
type: item
creator: Joe Andrieu
date: 2010-12-20T11:24:30Z
subject: Information Sharing
subject: Personal Data Store
subject: ProjectVRM
subject: Facebook
subject: Facebook Connect
subject: I Shared What?!?
subject: PDS
subject: Vendor Relationship Management
subject: VRM
description: With over 150 million people using Facebook Connect every month at over 1 million websites, Facebook has ushered in a new era, as the world’s largest personal data store. Personal Data Stores Personal data stores allow individuals to share online … Continue reading →
encoded: With over 150 million people using Facebook Connect every month at over 1 million websites, Facebook has ushered in a new era, as the world’s largest personal data store. Personal Data Stores Personal data stores allow individuals to share online data with service providers. Facebook Connect users can give third-party web sites like Digg, Amazon, and YouTube access to information stored at Facebook, turning Facebook into a personal data store for over 500 million people. What makes personal data stores special is the seamless sharing with websites for real-time personalization of the web. It’s more than just file back-up or synchronization. It’s not just publishing “content” to our friends or the public. Personal data stores allow us to bring our information to websites when we want to. It’s a way to treat the user as the point of integration. Personal data stores can be anywhere, shared with websites whenever we want. Consider giving FedexKinko‘s a link to a Flickr account so they can download photos to print a new calendar. Or giving a new doctor permission to access our personal health history rather than filling out a paper form while we sit in the waiting room. Or giving a website access to our Outlook contact list on our desktop computer so they can give us birthday reminders and gift suggestions. The key is user-managed access, wherever the data lives. Facebook Connect gives this kind of access control over all the data we store at Facebook, enabling web-wide personalization built around the individual. Mash-ups In recent years, mash-ups and real-time APIs have made it easier and easier for companies to combine information from different services into a single user experience. Instead of building bigger and more complicated proprietary data silos, companies take advantage of services like Google Maps and IP-address geolocation, using real-time information to enhance their websites. Some service are even built around other companies’ data: Twitter clients like…

Looking for feedback on pRFP and Information Sharing
type: item
creator: Joe Andrieu
date: 2010-09-07T21:14:36Z
subject: Information Sharing
subject: Personal Data Store
subject: ProjectVRM
subject: Shared Information
subject: Uncategorized
subject: ISWG
subject: Kantara
subject: pRFP
description: At the VRM+CRM workshop last month, we (the Kantara ISWG) released two papers for comment. One on the Personal Request For Proposal (pRFP) Engagement Model and the other the Information Sharing Report. The first is a look at a the … Continue reading →
encoded: At the VRM+CRM workshop last month, we (the Kantara ISWG) released two papers for comment. One on the Personal Request For Proposal (pRFP) Engagement Model and the other the Information Sharing Report. The first is a look at a the negotiation stage in the Car Buying Engagement Model, which paints a detailed picture of one person’s experience through the entire Customer-Supplier Engagement Framework for a new car. Think of this as “car buying VRM style.” In the pRFP Engagement Model, we do a deep dive on how Sally would use a pRFP broker to buy a new car. The second is a report placing Information Sharing in the global context. Based on a comprehensive literature review by Mark Lizar, the ISWG takes a look at the historical conversations about privacy and data protection to illustrate how we see Information Sharing as part of an emerging solution to managing the increasing risks and challenges of individuals sharing personal information online. If you have an interest, please take a look and give us some feedback. We’ll be incorporating input from the comment period starting next week, September 13, 2010. Extended to September 27, 2010. I hope to hear from you.

Asymmetry by Choice
type: item
creator: Joe Andrieu
date: 2010-08-24T12:42:40Z
subject: Information Sharing
subject: Personal Data Store
subject: ProjectVRM
subject: Shared Information
subject: User Driven Services
subject: Vendor Relationship Management
description: Perhaps the most powerful form of asymmetric information is missing from JP Rangaswami’s post addressing whether the web is making us dumber. I agree with the core point of JP’s article, but I think he oversimplifies the argument on asymmetry … Continue reading →
encoded: Perhaps the most powerful form of asymmetric information is missing from JP Rangaswami’s post addressing whether the web is making us dumber. I agree with the core point of JP’s article, but I think he oversimplifies the argument on asymmetry in a way that misses something important about the power of information. JP defines four types of informational asymmetry, which he argues is key for information to have power: Asymmetry-by-access — You can get it, they can’t. Asymmetry-in-creation — You create it, you can control access or have unique benefit from it. Asymmetry-in-education — The information may be symmetrically available, but only “experts” can make effective use of it.This could also be called asymmetry-by-capability: the capability to utilize information more effectively than others. Asymmetry-by-design — Take abundant information and design a system to create scarcity. For example, the iPhone (or Android) app store as the only – (or dominant) way to get new apps on your phone. JP goes on to argue that This approach, asymmetry-by-creation, and its alter ego, asymmetry-by-design, are about creating artificial scarcity. This is fundamentally doomed. I’ve said it many times. Every artificial scarcity will be met by an equal and opposite artificial abundance. With all due respect, I must politely disagree. At first, I thought it was a flaw in the argument about asymmetry, but then I realized it was perhaps because I was considering a fifth asymmetry that simply didn’t fit JP’s mold. Asymmetry-by-choice – The information is shared with mutual agreement by all parties to respect certain limits, typically requested by the discloser, although often required by regulators. This asymmetry is typically bootstrapped from asymmetry-by-creation and maintained as asymmetry-by-access. One example: I tell my therapist things because I know they won’t get revealed. The therapist agrees to keep that information in confidence because she knows that if she doesn’t, I won’t reve…

Beyond Data Ownership to Information Sharing
type: item
creator: Joe Andrieu
date: 2010-01-21T22:32:19Z
subject: Information Sharing
subject: Intention Economy
subject: Personal Data Store
subject: ProjectVRM
subject: Shared Information
subject: User Driven Services
subject: Vendor Relationship Management
subject: CRM
subject: data ownership
subject: Doc Searls
subject: privacy
subject: project VRM
subject: User Driven
subject: VRM
description: The question of who owns our data on the Internet is a challenging problem. It can also be a red herring, distracting us from building the next generation of online services. The term “ownership” simply brings too much baggage from … Continue reading →
encoded: The question of who owns our data on the Internet is a challenging problem. It can also be a red herring, distracting us from building the next generation of online services. The term “ownership” simply brings too much baggage from the physical world, suggesting a win-lose, us-verses-them mentality that retards the development of rich, powerful services based on shared information. Anyone up for sacred cow cheeseburgers? I’m a member–and a big fan–of Steve Holcombe‘s “Data Ownership in the Cloud” LinkedIn group and I love the efforts of the Dataportability guys and am a big supporter of the Privacy and Public Policy work group at Kantara. There is a lot of good work being done by folks trying to figure out how to give people greater control over the use of data about them (privacy) and gain access to data they use or created (dataportability). Unfortunately, sometimes the arguments behind these efforts are based on who owns–or who should own–the data. This is not just an intellectual debate or political rallying call, it often undermines our common efforts to build a better system. Consider this: Privacy as secrecy is dead Data sharing is data copying Transaction data has dual ownership Yours, mine, & ours: Reality is complicated Taking back ownership is confrontational Privacy as secrecy is dead First, the data is pretty much already out there. The issue isn’t “How do we keep data from bad people,” it’s “How do we keep people from doing bad things with data?” DRM and crypto and related technology as the sole means to prevent data leakage and data abuse are failures. Sooner or later, the bad guys break the system and get the data. Sure, there are smart things we can do to protect ourselves. Just like we wear seatbelts and lock our front doors, we should also use SSL and multi-factor authentication, but we can’t count on technology to keep our secrets. We need solutions that work even when the secret is out. In fact, privacy isn’t about information we keep secret. It…