Last week, the Credentials Community Group of the World Wide Web Consortium hosted Scott Jones, sharing his company’s work on Client-side Biometric Authentication and Identity Verification. https://www.w3.org/events/meetings/6c106024-7f5f-4297-972b-18af6432aaef/20260203T120000/ He said a lot of smart things about his company, Realeyes https://realeyes.ai/, and … Continue reading →
Last week, the Credentials Community Group of the World Wide Web Consortium hosted Scott Jones, sharing his company’s work on Client-side Biometric Authentication and Identity Verification. https://www.w3.org/events/meetings/6c106024-7f5f-4297-972b-18af6432aaef/20260203T120000/ <img fetchpriority="high" decoding="async" width="382" height="132" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/verifeye.png" alt="VerifEye Powered by Realeyes" class="wp-image-1486" style="aspect-ratio:2.8941636083816737;width:301px;height:auto" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/verifeye.png 382w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/verifeye-300x104.png 300w" sizes="(max-width: 382px) 100vw, 382px" /> He said a lot of smart things about his company, Realeyes https://realeyes.ai/, and their VerifEye offering. They are a leader in using AI and advanced biometrics for identity verification. I appreciated his discussion of how they are using real technology to improve the quality and privacy of identity assurance. In particular, I appreciate the progress towards client-side biometric authentication, which may prove a long term best-of-class approach to securing our digital identities without creating a panopticon. However, there is a fundamental flaw in their approach that deserves attention. Surprisingly, it is one that Dr Seuss’s Yertle the Turtle might have found familiar. At the end of the day, after all the privacy-engineering on the front end, Realeyes maintains their own uniqueness database. To their credit, they are refreshingly candid about charging for access. They hope to create a global database of who is human and then charge to query that database. It’s a straightforward business model that helps us better understand how such a system might be abused or otherwise cause harm. This vendor-controlled uniqueness database is the problem. Worldcoin and World <img decoding="async" width="150" height="150" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/Worldcoin_logo-150x150.jpg" alt="World Logo" class="wp-image-1487" style="width:104px;height:auto" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/Worldcoin_logo-150x150.jpg 150w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/Worldcoin_logo-300x300.jpg 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/Worldcoin_logo.jpg 480w" sizes="(max-width: 150px) 100vw, 150px" /> Realeyes is essentially following the footsteps of World https://world.org, formerly Wordcoin, the brainchild of Sam Altman as he seeks to establish “Universal proof of human, finance and connection for every human.” World is clear in the goal: “secure access to things only humans… should have access to.” The point is to create a list of who is (and implicitly who isn’t) human, specifically for the purposes of refusing services to those deemed less than human. World, of course, couches this in the context of Altman’s fear mongering about AI, but the language is surprisingly straightforward. If you aren’t deemed human by World, you will be denied services. Both Realeyes and World establish a global uniqueness database draped in the language of privacy. Both have legitimate technical innovations that improve the quality of recognition. Both have privacy innovations that reduce the unnecessary exposure of PII. Unfortunately, both are fundamentally vendor-lockin businesses that, in the pursuit of profit, seek to dehumanize at scale. Both are playing from the same playbook, overpromising privacy benefits through buzzword bingo to justify building out a global database of humanity. <img decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/privacy-funhouse-1024x559.png" alt="Not so private funhouse that lets an observer see everything." class="wp-image-1475" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/privacy-funhouse-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/privacy-funhouse-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/privacy-funhouse-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/privacy-funhouse-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/privacy-funhouse-2048x1117.png 2048w" sizes="(max-width: 1024px) 100vw, 1024px" /> At the end of the day, they each control the set of humans in their uniqueness database. Only they can audit that database. Only they can correct errors in that database. And only they control the use of that dataset in other contexts, e.g., only allowing those who have signed up for their program to access certain services. Neither are open systems; both are clearly and unambiguously a mechanism for building a proprietary database they charge per transaction to query. Global Uniqueness is the Problem, not the Goal The notion of global uniqueness makes sense naively, but when considered more thoroughly, it’s a mirage that leads good people to build bad systems. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/global-uniqueness-1024x559.png" alt="A human / robot handshake, with the human's hand stamped with a globe and the word "Unique"." class="wp-image-1482" style="aspect-ratio:1.8318878967830137" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/global-uniqueness-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/global-uniqueness-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/global-uniqueness-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/global-uniqueness-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/global-uniqueness-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> I have had multiple conversations with World and discussions with hundreds, perhaps thousands of people at the many identity conferences I’ve attended over the last decade, including the Internet Identity Workshop and the European Identity and Cloud Conference. I’m also a author, participant, and leader in the Rebooting the Web of Trust writing workshop and I’m the use case editor at the World Wide Web Consortium for both Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). In short, I’ve been exploring, curating, and documenting decentralized identity use cases for over a decade, and I have yet to find one that justifies a single universal database to uniquely identify every human on the planet for all time. World argues that Universal Basic Income is that use case. A single database that can keep track of everyone, to monitor who received their share payment in this cycle. Seems legit at first glance. But no UBI has ever been truly global, nor is a single payment-per-person-ever the payment strategy for “income”. What actually happens is that a select group of beneficiaries, chosen by funders, receive regular payments for a limited time. That’s a stark contrast to the aspirations of Realeyes and World, which identifies everyone on the planet uniquely across all time. The scope of uniqueness for UBI, even as imagined, is, in practice, limited in geography, humanity, and time. No solution will reach everywhere on the planet. Some jurisdictions will not tolerate this technology. No solution will include all people. There will be people who refuse to or can’t participate. People whose religious beliefs or physical disability preclude participating. No solution can track humans for all time. What is needed is tracking against a timeframe and cohort, e.g., membership or geography. To make matters worse, automated solutions simply can’t handle death or other life events without additional public infrastructure based on either trusted authorities asserting marriage, births, and deaths or a mass surveillance system that observes these events for automated assessment and programmatic attestation. One of the biggest problems in vital records is the erroneous perception by the bureaucracy of supposedly living constituents that are, in fact, dead. See UCL’s Ignoble Prize-winning research on blue zones. A global uniqueness database can’t, as a database, stay up-to-date without monitoring the real-world, and we really don’t want a global surveillance system just to maintain a database of who is human or not. I also don’t want a database where any particular nation-state or corporation can declare me non-human. I live where I live; why track me globally? I don’t want to be in some database that is accessible in any way to [insert name of your favorite geopolitical enemy]. What I want is to be able to voluntarily choose which digital systems I participate in, run by organizations I trust. What is needed for UBI, insurance claims, digital voting, or any other actual legitimate use of unique personhood is the assurance that, for a limited period of time, within a given population, that a specific individual receives a restricted benefit no more than once. That isn’t helped by a global database of who is or isn’t human. It’s a bizarre non-sequitur to claim that it is. For example, in UBI experiments in California payments were made to specific individuals over a limited period of time, e.g., $500/month for 24 months. No global database would determine who is or isn’t in that set of limited individuals. No global database would keep track of whom has been paid by that UBI program. Any solution that keeps those details in production longer than the limited time period of the UBI allowance is retaining personal information beyond its intended use. Rather than a system that is checked once to establish a permanent identifier for everyone for all time, functioning UBI systems need to track authorized distributions, for a limited time, to a limited population. A global uniqueness database doesn’t help do that; it increases complexity and introduces an outside party whose interests may or may not be aligned, without actually achieving its claimed goals. It’s the Locality That Matters It’s been suggested that “just about any solution is going to involve a database that is under the control of some party”. This also makes intuitive sense, as databases are where we keep track of data at scale. But what we don’t need is a global database of who qualifies as human. In fact what we need are local databases to keep track of the events and people that matter to them. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/you-are-here-1024x559.png" alt="A person looking at a sign with a map with an arrow and the words "You are here"" class="wp-image-1478" style="aspect-ratio:1.8318878967830137" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/you-are-here-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/you-are-here-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/you-are-here-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/you-are-here-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/you-are-here-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> These contextual databases are both necessary and can be constrained to ensure the appropriate privacy boundaries are respected. A database that any individual or organization asserts as definitive for everyone on the planet, is literally an attempt to centralize identification and control of our very humanity. In contrast, any decision-making entity (including humans and organizations) will have good reasons to maintain a database of the individuals it is in the job of keeping track of. For example, the American Medical Association (AMA) maintains a database of its members. But what the AMA doesn’t do is attempt to collect all of humanity into a single computational context. It does not attempt to create a global system where they alone get to decide who is human. They are creating a local system that does what they deem appropriate for their members’ needs. Context collapse is at the heart of many, if not most, privacy harms created by centralized information systems. Global uniqueness, as envisioned by Realeyes and World, forces a global context collapse for all humanity for all time. The fact is, we have NEVER had a singular information system that addresses all of humanity. Period. And we don’t want one. We really don’t. Reality itself can’t even maintain a real-time global information context thanks to the speed of light. Even time can’t be treated as a universal. It flows faster and slower based on altitude and speed. It’s crazy. Race conditions for settling global ordering means that even the best distributed system invented (bitcoin) only has probabilistic, historic commitments to truth. Even bitcoin can’t agree on which block is “at the tip” because that’s just not how it works. We have only ever worked in isolated compute contexts dealing with individual perspectives and domains. Initially that was human cognition, then we built out institutional cognition with bureaucracy. Each bureaucracy is, necessarily, a construct and result of its own information architecture. Any bureaucracy that is attempting to intercede for all humans in all contexts is a misguided attempt to establish a control structure where that bureaucracy’s rules, beliefs, and values are imposed on everyone, typically placing that bureaucracy in a position to extract rents without delivering commensurate value. There are good reasons for different people to have different beliefs and values and I find it unethical to impose the beliefs and values of any subset on everyone else. So… I don’t support any global set of supposed “truth” that is under the control of any single entity. And what is a more essential truth than whether or not someone is human? Keep Humanity Human I’m all for client-side biometrics as both World and Realeyes offer. What I’m not for is centralized lists of who is, and who is not, human. Any “uniqueness” database that isn’t specific to a jurisdiction, a community, or an initiative is an attempt to do just that: create a definitive list of who qualifies as human. Such a list of “unique” humans, used to restrict services to non-humans, will inevitably and erroneously restrict services to actual humans not on the list. In many cases, that means a loss of liberty, dignity, and basic human essentials. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/campfire-1024x559.png" alt="Welcoming friends, inviting a new person to join the conversation." class="wp-image-1479" style="aspect-ratio:1.8333760903027194" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/campfire-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/campfire-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/campfire-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/campfire-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/campfire-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> If you want to keep track of who is or isn’t (a) subject to a jurisdiction, (b) a member of a community, or (c) a legitimate participant in a particular project, that’s a legitimate list of people of interest. Different processes maintain different lists for different organizations. That’s how society organizes itself. Done well, you get a decentralized tapestry of different jurisdictions, communities, and projects, that can all keep track of their participants without interference from centralized parties. This is literally how the global world order is maintained, today. By different entities taking care of their own business in their own way. But what Worldcoin and Realeyes are banking their business model on is creating the ONE uniqueness database for everything, which they conveniently charge a fee to query. And if they succeed–when these uniqueness databases become the gatekeeper to public and private services–then those who can’t or won’t participate in their system will be treated as less than human, unable to participate as full members of our increasingly digitized society. In contrast, what we are building at the Digital Fiduciary Initiative https://digitalfiduciary.org puts a human in the loop for identity verification, in a privacy-preserving yet auditable way that can be contextualized to the highest granularity. Any individual, organization, or cross-organizational initiative is free to manage their own list of participants with robust identity assurance and rigorous authentication, verification, and validation as those participants engage digitally. Humans determine who is human, not algorithms and definitely not databases listing all acceptable humans. Eugenics, Exclusion, and Dehumanization While many who advocate for global uniqueness databases are likely unaware of the ideological foundations of the approach, it is fundamentally an exclusionary and racist solution in the long tradition of eugenics. Those who advocate for eugenics argue that humanity deserves to be intentionally improved by accelerating births of those deemed fit and restricting the role of the “unfit” in society. If you don’t meet the criteria of goodness, you are less than human and your genes should be removed from the species. These criteria typically exclude the poor, disabled, and minorities using pseudo-science to justify who qualifies as worthy of human consideration, and who are treated as animals. https://en.wikipedia.org/wiki/The_Mismeasure_of_Man The problem with proof of humanity, as imagined by Realeyes and World, is that my humanity is not subject to the judgment of any single entity. No nation-state. No corporation. No human. No one has the right, nor the authority to declare that I, Joe Andrieu, am not human. A system designed to separate humans from non-humans purely from placement on a list is a tool perfectly designed for enforcing nationalist, racist exclusion that treats those outside of the ruling class as less than human. And declaring certain classes of people as less than human is the hallmark of racist and eugenic movements. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/rejects-1024x559.jpeg" alt="" class="wp-image-1493" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/rejects-1024x559.jpeg 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/rejects-300x164.jpeg 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/rejects-768x419.jpeg 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/rejects-1536x838.jpeg 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/rejects.jpeg 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> On the other hand, every organization has a right to decide–on their own judgment–how they want to treat me. That is what we do have the right to do: decide how we are going to treat others. We might treat people differently based on where they are from, how old they are, or what positions they may be selected for, but treating people differently because some vendor decides they don’t pass muster as a human is setting up society to defer our most fundamental judgment to an unaccountable intermediary. Should a nation-state decide that they refuse to treat me in a particular way, that’s within their domain. What they shouldn’t do is rely on the unaccountable, unauditable, uncorrectable proprietary systems like those offered by Realeyes and World. The Fundamental Unknowability of Particular Humanity Compounding the moral hazards of a global database is the fundamental unknowability of the human person on the other side of a digitally intermediated interaction. While we can build these systems, populate these databases, and restrict access to services based on who appears to be in some database or not, we cannot know for certain if the party we think we are interacting with has given their authentication means to someone else: such as when we hand someone our phone after activating it with a PIN or biometric. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/no-one-knows-1-1024x559.png" alt="" class="wp-image-1489" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/no-one-knows-1-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/no-one-knows-1-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/no-one-knows-1-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/no-one-knows-1-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/no-one-knows-1-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> To the phone, the current user is the authorized user, and to the extent that the phone owner did, in fact, authorize someone else to use the phone, that secondary user is authorized to use the phone, but they are not the unique person the phone imagines it to be. Any further interactions through the phone, relying on that confidence, will inevitably be in error. This is a well known, but rarely discussed problem in digital identity. People regularly share passwords for convenience and expressions of intimacy. We let people sit at our desktop, while we are logged in to supposedly secure accounts. We hand people our phone unlocked and “authenticated”, giving full access to a range of capabilities as if they were the authorized party, even when that was never intended. Sharing our digital insurance card with the police officer during a routine traffic stop can give unintended access not just to content on the phone, but to actually act as the phone owner through that device. It is known that this is a common behavior, but because we don’t have good ways to stop it, digital identity engineers typically ignore it to address problems we have approaches to solve. Unless we physically observe the person in question, it is impossible to tell if that digital interaction is actually being driven by that particular person. Yes, you can add checks. Liveness detection is a good one. Time-limited authentication challenges is another. Proof of use of secret cryptographic information is a good and rigorous filter. But all of these are ways to increase confidence in the identity of the subject, not a way to guarantee it. Every single technique might be defeated, enabling an attacker to act as the subject with impunity. The confidenceMethod approach of the W3C Verifiable Credential community, currently under development, has set out to address precisely this problem, giving credential issuers additional ways to specify how the verifier of a given VC can increase their confidence that the current presenter has an appropriate relationship to the subjects in the credential. While we cannot know for sure who is on the other side of a digital interaction, we can use various techniques to increase our confidence that they are. Agents & Humanity Online Even if we build out these databases to their highest ambition, with World or Realeyes actually establishing a coherent system used by everyone on the planet, we still cannot guarantee that the alleged person on the other side isn’t an AI. And yet, that’s a fundamental promise of World and an implied expectation for Realeyes. The fact is, people never directly interact with the digital world. Mediated through sensors like cameras and keyboards, all digital data is subject to the errors of its sensors. I, as Joe Andrieu, never actually make a GET request to an HTTP endpoint; that’s what my browser does for me. It is literally impossible for a standard webserver to process any direct human action. All it can do is respond to signals coming in over the wire. Conceptually, we consider the browser a “user-agent” meaning that we believe it is currently operating under the direct guidance of a human user, as an authentic agent, realizing the user’s will based on gestures made in the browser itself. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/digital-claw-1024x559.png" alt="A person reaching through a digital interface, their hands becoming digital as they interact with objects on the other side." class="wp-image-1481" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/digital-claw-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/digital-claw-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/digital-claw-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/digital-claw-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/digital-claw-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> Any given HTTP request might be generated by a bot. Even within the browser, any extension or web page can trigger HTTP requests without the user realizing it. When these actions violate user expectations, it’s considered an attack, but at the core of the digital world is digits transmitted over wires. Those digits are subject to attack at the source, even if we secure them in transit. It is effectively impossible, today, to restrict colluding remote users from allowing someone else to use technology intended for them alone. Delegation to Digital Agents is Inevitable The fact is, we, as humans, are going to delegate our digital authority to software acting on our behalf. To the extent that their actions are well-behaved, meaning they cost no more than normal human activity, I believe those agents should be allowed to carry out the tasks I ask of it. No amount of remote attestation will prevent a person from giving an AI control over their digital interactions. If that means giving agents access to our cryptographic keys so they can impersonate us, people will do that. So called “proof-of-control” or “proof-of-use” challenge-response techniques create a mathematical guarantee that the current user has use of cryptographic secrets we expect the user to keep secret, but that is not the same guarantee. There simply is no known way to cryptographically guarantee that the current user is the user we expect, no matter what kind of “holder binding” techniques you try. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/delegating-1024x559.png" alt="A room full of robots, exploring digital interfaces under the direction of a person." class="wp-image-1480" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/delegating-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/delegating-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/delegating-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/delegating-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/delegating-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> Online interactions go from compute device to compute device across the network. Given current Internet architecture, we can always redirect the authentication to a proxy controlled by a colluding subject. Always. Which makes it essentially impossible to stop collusionary compromises where the data subject willingly gives their authentication capability or their authenticated device to another person. What we can do instead is use cryptography to explicitly delegate authorizations of limited scope to agents operating on our behalf, whether they are a bot or not. What we can do is ensure that the digital transmission received by an alleged specific user, has a cryptographic proof that it is acting on behalf of that user. Yes, this takes infrastructure we haven’t built yet that connects cryptographic actions to privacy-preserving in-person proof-of-humanity ceremonies, but it is at least technically possible. IMO, that’s the real solution: create privacy-preserving in-person proof-of-humanity ceremonies that generate credentials that can be used as the root identity for delegations to automated systems. In other words, instead of trying to detect AI, enable affirmative delegation by humans such that whatever software we authorize can act–and be regarded as acting–on our behalf while avoiding spam-bots and overzealous web crawlers. Digital Fiduciaries can help. Global Universal Identification Is Overkill For some things, you don’t need identification. The Red Cross famously doesn’t care if your identification documents were burned in your house fire. They will help you reestablish your life, giving you vouchers that get you into motels and gift certificates you can use to buy clothes and they don’t need to see your government ID. Their confidence is met by evaluating a real emergency and interacting with the real people affected by it, including law enforcement and first responders. For other things, even a RealID driver’s license is insufficient. If you want to fly a plane, launch a missile, or access secure facilities, additional confidence is required. Some facilities require biometric identification. Some don’t. Some require unique PINs coupled with unique digital cards. The fact is, for any given use case, secure systems are tailored to establish just the right level of oversight and assurance. In no use case do we see a legitimate need for a global human database. <img loading="lazy" decoding="async" width="1024" height="559" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/sorry-dave-1024x559.png" alt="A robot denying access, saying "I'm sorry Dave, I can't do that"" class="wp-image-1476" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/sorry-dave-1024x559.png 1024w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/sorry-dave-300x164.png 300w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/sorry-dave-768x419.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/sorry-dave-1536x838.png 1536w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/sorry-dave-2048x1117.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /> We see the honest value is in contextualized, robust identification that combines digitally defensible mechanisms (e.g., encryption, signing, proof-of-use) with real-world, in-person identity assurance to enable identity-responsive services without reliance on centralized notions of who is or is not a human. We also see the danger of building a global database far outstripping any value it might create. The real effect of these systems of global uniqueness will be to reduce the humanity of those who aren’t part of the club. That’s simply not acceptable in a free society and it certainly is not acceptable as a global imposition by any individual or organization. It’s Turtles all the Way Down On a lighter note, as I wrote this, I realized that the tireless attempts of the naive to build a single digital perspective on everyone in the world is a bit of a Yertle the Turtle problem. The only way to win is not to play that game. <img loading="lazy" decoding="async" width="769" height="1024" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/yertle-edited-769x1024.png" alt="Yertle the turtle on a tower of robot turtles." class="wp-image-1490" style="aspect-ratio:0.75;object-fit:cover;width:351px;height:auto" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/yertle-edited-769x1024.png 769w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/yertle-edited-225x300.png 225w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/yertle-edited-768x1023.png 768w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/yertle-edited.png 1153w" sizes="auto, (max-width: 769px) 100vw, 769px" /> Yertle, King of the pond, famously demanded he stand on the backs of all the turtles he could find so that he could see all that he commands, expanding his kingdom over everything he sees. He foolishly believed that if he could just see a little bit more–by making his subjects stand on top of each other’s backs–he increased his kingdom, only to find that no amount of turtles could reach a height that would bring the Moon under his domain. Digital Yertles imagine something similar: if only we could see everything in our domain, our rule will be glorious! If only we could identify everyone, including those who should not be part of our efforts, then we can finally build a system that appropriately works for every individual. It’s a slippery slope that none of us wants. If only we could see all the activity in our domain, then we can ensure all illegal activity is punished. If only we could track everything everyone does anywhere, then we can finally prevent these pesky crimes [insert favorite fear-based rallying cry] before they even happen. Imagining an “ideal information system” that tracks everyone on the planet is as shortsighted and ineffective as Yertle’s pile of turtles, as impractical and cruel as Bentham’s panopticon, and as dangerous and insidious as Orwell’s Big Brother. In short, that way lies surveillance madness. We can do better.
Insights from PII2012 The FTC Privacy Report makes it clear that context is the key to privacy. For example, notice and consent need not be presented and secured if the use is obvious from context: If you buy a book … Continue reading →
Insights from PII2012 The FTC Privacy Report makes it clear that context is the key to privacy. For example, notice and consent need not be presented and secured if the use is obvious from context: If you buy a book from Amazon, it’s clear they need an address to ship you the book. But sometimes the context isn’t clear to the average user, even when it is obvious to developers. My Mom believes she doesn’t share anything on Facebook because she mostly just comments on other people’s posts. Ilana Westerman’s work shows the same disconnect: many people just don’t see their privacy exposure because they have simplified models of their actions. They think what they are doing isn’t the risky stuff, but they rarely have the awareness of what they are really doing. Making that harder are monolithic Terms of Service and Privacy Policies that bury the details arbitrarily far away from the point of exposure, and in confusing legalese. The answer is some form of bite-size context management. For example, Smart Disclosure, which is the US administration’s language for greater clarity about risks of information sharing: One of the most powerful versions of smart disclosure is when data on products or services (including pricing algorithms, quality, and features) is combined with personal data (like customer usage history, credit score, health, energy and education data) into “choice engines” (like search engines, interactive maps or mobile applications) that enable consumers to make better decisions in context, at the point of a buying or contractual decision Or perhaps something along the lines of Personal Levels of Assurance, a term from AT&T describing piece-wise on-demand disclosure and consent. This is also the approach behind the Standard Information Sharing Label, which let’s you see in simple, consistent terms, exactly what happens with the data you are about to share, before you share it. That instance of sharing defines the context for which the information may be used, and the label makes it easy for individuals to understand that context. We aren’t compressing the entire Terms of Service and Privacy Policy for a given site, we’re presenting just the essential details about a particular instance of information sharing. Bite-size disclosure, right at the point of sharing, because nobody wants to read 47 pages of legalese. We think that’s the right model for untangling the world wide web.
From kindergarten through our professional life, sharing binds us together as friends, colleagues, and collaborators, so perhaps it should be no surprise that online sharing through services like Facebook, Twitter, and email shapes our online social life. Yet sharing online … Continue reading →
From kindergarten through our professional life, sharing binds us together as friends, colleagues, and collaborators, so perhaps it should be no surprise that online sharing through services like Facebook, Twitter, and email shapes our online social life. Yet sharing online is anything but simple. The details of what happens with the information we share is often hidden behind long, complicated legal agreements that almost no one reads. If we’re lucky, they are explained in Terms of Service and Privacy Policy documents, sometimes buried out of view, other times forced on us like ransom notes forcing us to state our compliance or leave the site. It doesn’t have to be that way. Today, at the Internet Identity Workshop, we officially launch the Standard Information Sharing Label, which makes it easy for websites to say in simple, consistent language what they do with our information, making it easier for individuals to make better decisions about the information we share online. The Information Sharing Work Group has published a draft specification defining the Standard Label as well as a Kickstarter project to finance its graphic design. The Kickstarter has a brief video explaining the effort. The official press release is here. The work is free to use and open to collaborators. In all my years contributing to the VRM conversation, few projects have made me as proud as I am of the work behind the Standard Label. Check it out. If you like it, please spread the word and consider chipping into help take this work to the next level.
Privacy issues dominate the global debate about protecting the rights of individuals online. Yet, the conversation almost entirely misses a vital point: public or private isn’t a black or white choice and it never has been. Sociologists have long recognized … Continue reading →
<img loading="lazy" decoding="async" class="size-full wp-image-960 alignright" style="margin-left: 10px; margin-right: 10px;" title="public v private" src="https://blog.joeandrieu.com/wp-content/uploads/2011/04/public-v-private.dreamstime_267400.jpg" alt="Public v Private" width="216" height="288" srcset="https://blog.joeandrieu.com/wp-content/uploads/2011/04/public-v-private.dreamstime_267400.jpg 360w, https://blog.joeandrieu.com/wp-content/uploads/2011/04/public-v-private.dreamstime_267400-225x300.jpg 225w" sizes="auto, (max-width: 216px) 100vw, 216px" />Privacy issues dominate the global debate about protecting the rights of individuals online. Yet, the conversation almost entirely misses a vital point: public or private isn’t a black or white choice and it never has been. Sociologists have long recognized that there is no single “public”, no monolithic context where social norms congeal and deviant behavior is shunned. Instead, we’ve recognized that each of us engages in multiple, distinct publics, with their own boundaries and rules of etiquette. We act one way at PTA meetings, another in Las Vegas, yet again a third way at work. These are different flavors of public behavior and yet we expect most people to respect boundaries between these areas. We manage these publics as easily and naturally as we greet a newcomer to the workplace. We do it without conscious effort, but with a sensitivity to the place and moment. We also constantly manage any number of private contexts, where certain topics and behaviors are understood to be held in confidence, from family matters and Santa Claus to corporate secrets. Just as there is no monolithic “public”, there is no single “private” domain, where insiders know everything and outsiders know nothing. We share confidences with our kids, our spouses, our lawyers, our doctors, our psychiatrists, our bartenders, our business partners, all with certain, often unstated, rules about appropriate use and redistribution. Sure, these confidences are occasionally broken, but when they are, it violates our privacy and breaks trust. Frackin’ jerks! Privacy leaks occur when information entrusted to one context finds its way into another: when our doctor’s receptionist tells our co-worker a bit too much about our visit, a boss overhears an embarrassing story about where we really were last Monday, or an ex tells her gossiping friends about our intimate moments. These context violations hurt whether they occur between “private” contexts or “public” ones. The issue isn’t whether something was said or done in “public” or “private”. The issue is the boundary breaking, the violation of expectations, and the betrayal of trust. Our worlds are not defined by a single boundary between public and private, but by a constellation of privacy, comprised of multiple, distinct contexts, each with their own set of participants and expectations. There are literally billions and billions of contexts worldwide, each of us participating in dozens, perhaps hundreds. We’ve been figuring this out for a long time. Over thousands of years, we’ve developed social norms that help us navigate different contexts. Space and time are our most common tools, marking the boundaries between strip clubs, schools, churches, homes, bedrooms, and restrooms. Don’t interrupt the magician, don’t talk during mass, don’t make personal calls on company time. Sometimes it’s topical, like spelling out “S.A.N.T.A” to keep the magic of Christmas alive. These social rules keep naked people out of the cafeteria and accountants out of our bathroom and thank goodness for that! Today, we are faced with a rapidly growing digital domain with new boundaries and connections, where uncertain rules confound expectations. In a relatively short period, huge portions of our daily lives have moved online, into contexts that lack clear social norms. These online services are often interpreted and promoted as being far more discreet then they actually are. We post a photo to Facebook to share with our friends, forgetting for a moment that co-workers or students might also see that indulgent image. We post a political rant on our blog, only to later have it come up in a job interview. Our Foursquare sign-ins get linked to Twitter without realizing it… and now our location is in the public stream for anyone to find. To make matters worse, many of these services regularly release new features or change their privacy policies… the rules are not just uncertain, they keep changing. <img loading="lazy" decoding="async" class="alignleft size-medium wp-image-959" style="margin-left: 10px; margin-right: 10px;" title="Galaxy" src="https://blog.joeandrieu.com/wp-content/uploads/2011/04/galaxy.nasa_.sig05-013_mac-300x300.jpg" alt="NGC 1566 NASA Spitzer Space Telescope Collection" width="300" height="300" srcset="https://blog.joeandrieu.com/wp-content/uploads/2011/04/galaxy.nasa_.sig05-013_mac-300x300.jpg 300w, https://blog.joeandrieu.com/wp-content/uploads/2011/04/galaxy.nasa_.sig05-013_mac-150x150.jpg 150w, https://blog.joeandrieu.com/wp-content/uploads/2011/04/galaxy.nasa_.sig05-013_mac.jpg 768w" sizes="auto, (max-width: 300px) 100vw, 300px" />Focusing on public verses private misses the point. The analog world was never that black and white, why would we expect it to be that way online? Rather than an opt-in or opt-out, track or do-not-track, we need a solution that allows us to participate with the same shades of gray we use in the rest of our lives. This isn’t about the end of privacy nor is it about the inevitability of living in public. It’s about figuring out a new set of viable contexts with clear, understandable boundaries, rules, and participants. It’s about giving people as clear and simple control over their online social contexts as we have in the analog world. We should be able to explicitly manage our online contexts: what we share, with whom, for what purpose, and with what constraints. Once we do that, the overly simplistic model of public verses private will yield to a beautiful constellation of privacy that is more understandable, more flexible, more realistic, and more empowering. So, put down your pen and step away from the regulatorium. The last thing we need is half-baked black and white thinking turned into law.
Beyond Data Ownership to Information Sharing
The question of who owns our data on the Internet is a challenging problem. It can also be a red herring, distracting us from building the next generation of online services. The term “ownership” simply brings too much baggage from … Continue reading →
The question of who owns our data on the Internet is a challenging problem. It can also be a red herring, distracting us from building the next generation of online services. The term “ownership” simply brings too much baggage from the physical world, suggesting a win-lose, us-verses-them mentality that retards the development of rich, powerful services based on shared information. Anyone up for sacred cow cheeseburgers? I’m a member–and a big fan–of Steve Holcombe‘s “Data Ownership in the Cloud” LinkedIn group and I love the efforts of the Dataportability guys and am a big supporter of the Privacy and Public Policy work group at Kantara. There is a lot of good work being done by folks trying to figure out how to give people greater control over the use of data about them (privacy) and gain access to data they use or created (dataportability). Unfortunately, sometimes the arguments behind these efforts are based on who owns–or who should own–the data. This is not just an intellectual debate or political rallying call, it often undermines our common efforts to build a better system. Consider this: Privacy as secrecy is dead Data sharing is data copying Transaction data has dual ownership Yours, mine, & ours: Reality is complicated Taking back ownership is confrontational Privacy as secrecy is dead First, the data is pretty much already out there. The issue isn’t “How do we keep data from bad people,” it’s “How do we keep people from doing bad things with data?” DRM and crypto and related technology as the sole means to prevent data leakage and data abuse are failures. Sooner or later, the bad guys break the system and get the data. Sure, there are smart things we can do to protect ourselves. Just like we wear seatbelts and lock our front doors, we should also use SSL and multi-factor authentication, but we can’t count on technology to keep our secrets. We need solutions that work even when the secret is out. In fact, privacy isn’t about information we keep secret. It is about information we have revealed to someone else with expectation of discretion, e.g., when we tell our doctor about our sexual activities. It’s no longer a secret from the Doctor, but because it is private, we have rules that keep the information from being used inappropriately. Most of the time, with most doctors, it works. Those few who break those rules are dealt with through legal means, both civil and criminal, as well as social approbation. So, because we inherently need to release data to different parties at different times, we can’t control it through secrecy alone. Instead, we need to build a framework for preventing abuse when others do have access to sensitive information. Like in the case with our doctor, we want our service providers to have the data they need to provide the highest quality services. Data sharing is data copying Second, in the world of atoms, there can only be one of a thing, which is the reverse of the world of bits. With atoms, even if there are copies, each copy is itself a singular thing. Selling, transferring, or stealing a thing precludes the original owner from continuing to use it. This isn’t true for information, which can easily be sold, transfered, and stolen without disturbing the original version. In fact, the entire Internet is basically a copy machine, copying IP packets from router to router, as we “send” images, web pages, and emails from user to user and machine to machine–each time a new copy is created whether or not the originating copy is deleted. To think of bits as if they were ownable property leads to attempted solutions like DRM that try to technologically prevent access to the information within the data, which is only good until the first hacker cracks the code and distributes it themselves. Instead, if we build social and legal controls on use, we can give information more freely, but under terms set by each individual when they share that information. Enforced by social and legal rather than purely technological means, this makes the most of the low marginal cost of distributing online, while retaining control for contributors. Transaction data has dual ownership Image via Wikipedia Third, much interesting data is actually mutually owned… which means the other guy can already do whatever the heck they want with it. Consider web attention data, the stream of digital crumbs representing the websites we’ve visited and any interactions at each: all our purchases, all our blog posts, all our searches. Everything. Some folks argue that we own that data and therefore have the right to control the use of it. But so too do the owners of the websites we’ve been visiting. We don’t own our http log entries at Amazon. Amazon does. In fact, in every instance where two parties interact, where we engage in some transaction with someone else, both parties are co-creating that information. As such, both parties own it. So, if we tie the issue of control to ownership, then we’ve already lost the battle, because every service provider has solid claims to ownership over the information stored in their log files, just as we, as individuals, own the browsing history stored on our hard drive by Firefox, Internet Explorer and Chrome. In the movie Fast Times at Ridgemont High, in a confrontation with Mr. Hand, Spicoli argues “If I’m here and you’re here, doesn’t that make it our time?” Just like the time shared between Spicoli and Mr. Hand, the information created by visiting a website is co-created and co-owned by both the visitor and the website. Every single interaction between two endpoints on the web generates at least two owners of the underlying data. This is not a minor issue. The courts have already ruled that if an email is stored for any period of time on a server, the owner of that server has a right to read the email. So, when “my” email is out there at Gmail or AOL or on our company’s servers, know that it is also, legally, factually, and functionally, already their data. Yours, mine, & ours: Reality is complicated Fourth, when two parties come together for any reason, each brings their own data to the exchange. We need a framework that can handle that. Iain Henderson breaks down this complexity in a blog post about your data, my data, and our data, talking about an individual doing business with a vendor, for example, someone buying a car. “My data” means data that I, as an individual have that is related to the transaction. It could include the kind of car I’m looking for, my budget, and estimates of my spouse’s requirements to approve of a new purchase. “Your data” means data that the car dealer knows, including the actual cost of the vehicle, the number of units in inventory, the pace of sales, current buzz from other dealers. “Our Data” means information that both parties have in common. That could be Shared Information, explicitly given by one party to the other in the course of the deal, such as a social security number so the dealer could run a credit check. It could be Mutual Information, generated by the very act of the transaction, such as the final sale price of the vehicle. Or, it could be Overlapping Information, which each party happens to know independently, such as the Manufacturer Suggested Retail Price (MSRP) of a vehicle (which we found online before heading to the dealership). The ownership of “your” and “my” data is usually clear. However, ownership of the different types of “our” data is a challenge at best. To complicate matters further, every instance of “my data” is somebody else’s “your data”. In every case, there is this mutually reciprocal relationship between us and them. In the VRM case, we usually think of the individual as owning “my data” and the vendor as owning “your data”, but for the vendor, the reverse is true: to them their data is “my data” and the individual’s data is “your data”. Similar dynamics occur when the other party is an individual. I bring my data, you bring your data, and together we’ll engage with “our” data. We need an approach that respects and applies to everyone’s data, you, me, them, everybody. In these complex Venn diagrams of ownership, it is more important who controls the data than who owns it. We’ve already lost the crudest form of control–secrecy–and we are going to continue to lose more as we opt-in to seductive new services based on divulging more and more information: our purchase history, browsing activity, and real-world location data. But we still need to control how all this data is used, to protect our own interests while still enjoying the benefits of the great big copy machine that is the Internet. Taking back ownership is confrontational © Regien Paassen | Dreamstime.com Fifth, we don’t need to pick a fight to change the game. There is a lot of data out there that many of us believe we should have control over. I agree. A lot of people argue that we should have the right to exclude other people’s use because we own the data, because it’s ours in some legal, moral, or ethical framework. The problem is, those other people already have it, and they also believe that they are legitimate owners. In fact, many of them paid for that data, buying it from data aggregators who compile all sorts of things about people, from both public and private sources. This entire ecosystem of customer data is a multi-billion dollar business and every single player “owns” the data they are working with. So if we focus our energy in claiming ownership over that same data in order to take control, we are framing the conversation as a fight, a fight against a powerful, well-healed, well-funded, entrenched bunch of opponents. Most of these “opponents” are the very people we are trying to win over to our way of thinking. These are the vendors we want to embrace a new way to do business. These are the technologists we want to transform their proven, value-generating CRM systems to work with our data on our terms, instead of their data on their terms. Arguing over ownership puts these potential allies on the defensive, when what we really want is their collaboration. From Ownership to Authority, Rights, and Responsibilities Rather than building a regime based on data ownership, I believe we would be better served by building one based on authority, rights, and responsibilities. That is, based on Information Sharing. Who has the authority to control access and use of particular information? What rights does a party have in using and distributing a piece of information? What responsibilities does an information user have to others with respect to that information? Let’s stop arguing about who owns what and start figuring out how we can share information in ways that allow everyone to win. When we collect all of our information into a single conceptual repository, and then share access to it with service providers on our own terms, we create a high quality, highly relevant, curated personal data store. This allows us to bootstrap a control regime over all of our data in a way that creates new value for us and for our service providers. Now, instead of iTunes Genius or a Last.FM scrobbler only having access to our media use with their service, they can provide recommendations based on all the information stored in our personal audio data store. We get better recommendations and they get better data to drive their services. This personal data store is entirely under the authority of the user, sharing information with service providers according to specific rights and responsibilities. The Information Sharing approach neatly sidesteps the complexities involved in privacy and dataportability issues of the information already known by service providers. These remain serious issues, worth addressing. Resolving them will require long term investment in the legal, regulatory, moral, and political systems that govern our society. Fortunately, sharing the information in our personal data store can begin almost immediately once we have working specifications. This controlled sharing of information will dramatically increase our comfort level when revealing our intentions and interests. We would have control over the use–and would be able to prevent abuse–of that information, while making it easy for service providers to improve our lives in countless ways. At the Information Sharing Work Group at the Kantara Initiative, Iain Henderson and I are leading a conversation to create a framework for sharing information with service providers, online and off. We are coordinating with folks involved in privacy and dataportability and distinguish our effort by focusing on new information, information created for the purposes of sharing with others to enable a better service experience. Our goal is to create the technical and legal framework for Information Sharing that both protects the individual and enables new services built on previously unshared and unsharable information. In short, we are setting aside the questions of data ownership and focusing on the means for individuals to control that magical, digital pixie dust we sprinkle across every website we visit. Image by hegarty_david via Flickr Because the fact is, we want to share information. We want Google to know what we are searching for. We want Orbitz to know where we want to fly. We want Cars.com to know the kind of car we are looking for. We just don’t want that information to be abused. We don’t want to be spammed, telemarketed, and adverblasted to death. We don’t want companies stockpiling vast data warehouses of personal information outside of our control. We don’t want to be exploited by corporations leveraging asymmetric power to force us to divulge and relinquish control over our addresses, dates of birth, and the names of our friends and family. What we want is to share our information, on our terms. We want to protect our interests and enable service providers to do truly amazing things for us and on our behalf. This is the promise of the digital age: fabulous new services, under the guidance and control of each of us, individually. And that is precisely what Information Sharing work group at Kantara is enabling. The work is a continuation of several years of collaboration with Doc Searls and others at ProjectVRM. We’re building on the principles and conversations of Vendor Relationship Management and User Driven Services to create an industry standard for a legal and technical solution to individually-driven Information Sharing. Our work group, like all Kantara work groups, is open to all contributors–and non-contributing participants–at no cost. I invite everyone interested in helping create a user-driven world to join us. It should be an exciting future. This material is based upon work supported by the National Science Foundation under Award Number IIP-08488990. Any opinions, findings, and conclusions or recommendations expressed in this publication are those of the author and do not necessarily reflect the views of the National Science Foundation.
Doc Searls recently brought my attention to a White Paper by Phil Windley, about his company, Kynetx. It does a good job explaining the thinking behind their architecture, and raises some questions that, for me, challenge some underlying assumptions and … Continue reading →
Doc Searls recently brought my attention to a White Paper by Phil Windley, about his company, Kynetx. It does a good job explaining the thinking behind their architecture, and raises some questions that, for me, challenge some underlying assumptions and business choices. Problem Domain The distributed nature of the web is a big part of its power–nobody needs to ask permission from a central authority to use it or create with it. However, that disaggregation limits the cohesion for sophisticated uses, leaving users to hobble together ad-hoc mash-ups of value from multiple, diverse service providers. For example, the average travel planner spends 29 days from their first query to their first purchase. No tool I know of facilitates that entire process effectively. Solving this problem in a general way—while retaining the authority of the individual and the flexibility of open systems—is perhaps the greatest opportunity for VRM. The personal data store and VRM relationship services are two prongs of an architectural shift for enabling this kind of aggregation while remaining open. Once you put the user in the driver’s seat, with coherent controls over the flow and the data, the experience can integrate around the user, even as they drive anywhere on the Internet. Solution Kynetx’s solution is built on one primary capability: A rules engine (and language) for contextual customization based on strong identity-based claims, using the user-centric Identity of Information Cards. This puts Kynetx squarely in the web augmentation service business. Adaptive Blue (and their Glue product) is perhaps the most sophisticated approach to this space, but Yahoo’s Toolbar also augments web pages, as does Skype (putting its SkypOut button on any phone # it recognizes), and the granddaddies of all web-augmentation services are the ad blocker plug-ins that remove banner ads on websites. I distinguish web augmentation from web media enhancements, like PDF and Flash and Java, in that the latter are embeddable or downloadable extensions to the core HTML/http architecture of the web, while augmentation services provide third-party manipulation of website presentation on behalf of the user. They actually tweak the web page as the user sees it, rather than offering websites a new way to package content or functionality. Web augmentation isn’t new, but it is gaining adoption and breadth. There is a low-grade market war going on in this space. While browsers define the official battleground of the World Wide Web; augmentation services are the guerilla warriors of next generation browsing. The approach that reaches ubiquity first will create significant value throughout the architecture: for users, software vendors, and service providers. So, the question that comes to my mind is where does Kynetx fit into all of this? The value proposition of a rules-engine for customization is powerful, if that engine makes it easy to leverage strong identity. Every website will, imo, want to take advantage of the unique value of user-centric identity and Information Cards in particular. However, rewriting your customization to do that will take resources and that will slow adoption. If Kynetx can simplify how websites plug- in to the Identity meta-layer that sounds like a real value. Gaps There are however, several gaps that I see in Kynetix’s approach mapped out in the white paper. First, who are the target developers: websites or Third party services. Or both? It’s not clear to me if the primary authors of KRL rulesets (and hence Kynetx’s customers) will be the destination website developers or third party augmentation services. For example, . Adaptive Blue‘s Glue augments web pages so that things like movies can be recognized across domains for social commentary, ratings, and sharing. That means that Glue modifies the presentation of web pages at IMDB, Netflix, Amazon, Blockbuster, etc. In this pattern, it is the third-party, Glue, that would be running KRL rulesets, not the websites. Is this the intended architecture for Kynetx? Is the point of the Kynetx Information Card to provide authorization by the user to allow services like Glue to augment their web experience, while the rest of the plug- in handles injection into the web page within the browser? Or, is the main point that web services themselves would leverage Kynetx’s Information Card approach to manage third party identity for customization? For example, so Hertz could seamlessly provide AAA or AARP discounts if, and only if, the appropriate AAA or AARP information cards (KIX) are presented by the user? In this case, Hertz writes the customization, but doesn’t need to know upfront what the user’s affiliations might be. If the first case is intended, the white paper doesn’t do a good job explaining how this fits into a larger, open ecosystem, nor does it highlight this unique architectural opportunity. If a user wants Orbitz to help augment its travel planning experience, even when it is at Expedia or Southwest airlines or Hilton.com, it would be great to do that in a secure, authorized, privacy-sensitive way. But it isn’t quite clear if this is the point of Kynetx’s approach. (Although it is a great opportunity, one that r-buttons and SwitchBook see in the not-so-far future). If the second case is the goal, it isn’t clear to me why Kynetx is better than other customization frameworks. With a card selector and cards issued from the right authority, users can already present AAA or AARP credentials to websites, which in turn can integrate that information into their existing CMS or other presentation code (Drupal, PHP, perl, Ruby-on-Rails, etc.). If the value proposition is in speed-to-market for identity-based customization, then the white paper needs to make that case first and foremost. If that’s the goal, then it also suggests a business model, which I talk about in a bit. It could also be that both of these are part of the approach: allowing both the website developer and third parties augment the web experience based on strong identity. This is the general idea behind r-buttons and would almost certainly speed deployment. However, the white paper doesn’t address the issues of contention when multiple providers want to augment the same page. Given the open-ended javascript functionality associated with a KIX, this could be a challenge. Second, isn’t re-aggregation actually about creating a coherent context? While the Kynetx approach allows users to present a particular relationship at a particular website, that doesn’t seem to solve the stated problem. I don’t see how it actually achieves a cross-web aggregated experience. In fact, it seems that the best aggregated experience should combine many relationship cards at many different services. In the 29-day travel planning scenario, won’t users need to send their AAA and AARP cards to every site they visit? (Or some large subset?) Does the card selector require a ceremony for every website every session? Or just once and then it is a permanent approval, such as confirming once with Expedia that the user is a AAA member? Managing this A x B complexity with A Information Cards and B websites scales poorly if every site has a distinct ceremony–and even worse if each card presented at each site is a distinct ceremony. This apparent model of KIX based aggregation seems to miss an opportunity, one that is near to my heart as the core of the Search Map architecture for User-driven Search. It seems to me that for a given web-based task–such as travel planning–what you need is a user-driven personal data store that tracks the user’s progress across the Web. This data store should be 100% transparent, 100% editable, and seamlessly transferable/accessible to authorized vendors under terms controled by the user. We call our version of this a Search Map, an electronic document that provides the user a concrete way to manage and express their Search intent. It is also a seamless way to manage and express user context. In the white paper, Phil asserts that “users are freed from managing episode context themselves” as a core benefit. But, I don’t think this is actually a benefit. Attempting to achieve that goal could end up being more patronizing than useful, following in the footsteps of “Clippy” the Microsoft Windows help agent which tried to figure out the context and help users, but failed miserably. “I see you are writing a letter. Would you like assistance?” Ack! It’s not that users don’t want to manage their context, it’s that they haven’t been given simple, value-producing tools to do so. Consider spreadsheets: it’s not that users want to balance the budget on a computer—doing budgets on a computer isn’t inherently rewarding. It’s that spreadsheets make it easy to get value out of balancing their budget on the computer. Managing KIX across 29 days of travel planning and potentially a hundred+ websites sounds like a chore… unless we have a coherent expression of the context (in something like a Search Map, perhaps) that is easy to use and immediately useful. Third, over-centralization limits scale. The Kynetx model, as I understand it, doesn’t scale to the full World Wide Web, because it centralizes two core functions: resolving requests for augmentation and the validation of injection javascript as safe, private, and secure. Both of these constrain the growth opportunity for a KRL-based approach to augmenting web services. First, it places the core usage-time server demand on a single service. Given the business model of charging for ruleset evaluations, there is no obvious incentive for Kynetx to release an open source reference implementation to make it easier for alternate KRE service providers. In fact, there is every expectation that Kynetx will be motivated to “win the market share” battle and be the primary KRE service. Which, unfortunately, makes it just another silo, and will face precisely the same sort of scaling issues that plague Twitter. Second, by making Kinetx the arbiter of “quality” it places a single entity in control ofwhat constitutes “safe”. Even with good intentions, such centralized moral authority is not just dangerous, it alienates potential innovation. Nobody wants to be forced to seek permission for their new functionality. That was, IMO, the primary reason the World Wide Web dominated AOL so quickly. The way to reach web scale is to make it absolutely trivial for /anyone/ to play the game. Several open source implementations and open standards enabled anyone who wanted to, to set up their own web server and try out the World Wide Web as a service provider. And, despite that lack of central control, lots of companies made lots of money providing enhanced software to manage those systems. So don’t fall for the illusion that central control is required or desirable for a big financial win. Signing software is understood technology; we can enable signed KIX functionality with a validated identity as a first step towards quality control. Then, by opening up the validation service–and separating it from the distribution/matching of those KIX functions, we can allow software developers and service providers the freedom to innovate and provide their own approaches to what is valid and what isn’t. Some providers will choose to accept ANY signed KIX and simply track reputation. Others will charge a fee for developers, but run through a quality control check and review. By opening it up, you allow users and developers the freedom to manage KIX quality however they like, without building a presumptive “download at your own risk” ecosystem. With Kynetx the sole authority on “quality” for KIX functionality, we would have both a technical and a political bottleneck that would retard the adoption of a generalized approach to the disaggregated web experience. [Btw, it would be great if there were a name for the javascript injected into the browser when a KRL rule fires after evaluating the context and the user identity. This is currently just the “associated KIX functionality”, which is a bit wordy.] Fourth, what about privacy and data rights management? On the whole, it isn’t clear to me what data might be sent around in the claims of various Information Cards, but there is no discussion in the white paper about the data rights associated with that information. If I’m telling Hertz that I’m an AARP member, can they use that data to start sending me junk mail or SPAM targeting AARP members? Frankly, this is a hole in the entire user-centric Identity framework. OpenID Attribute Exchange and Information Cards allow users to use a third party service for the management and presentment of minimally sophisticated facets of identity (much better than username & password), but neither inherently enables users to specify a data rights regime for the claims or attributes so provisioned. In effect, we’ve made it easy for users to provide additional data about themselves, but missed the opportunity for users to easily control the use of that data. Since Kynetx has a goal of seamlessly augmenting users’ web experience, isn’t it incumbant on them to assure that seamlessness both protects users’ right to privacy and prevents unintended over-customization based on supposedly private data? This is another manifestation of the “Tivo thinks I’m gay” problem, where Tivo analyzes viewing behavior and assumes things about the user, with no way for the user to manage their profile. The data rights problem happens because there is nothing to keep Tivo from telling Hertz, GE, or NBC they think the user is gay. The problem in the Kynetx approach happens when service providers start passing presumably private data to third parties—and users lack the means to control that leakage once the service provider knows certain data. This level of data rights control needs to be built in from the start for VRM and user-driven applications. Business Model At the core, I think the business model needs rethinking. Although a CPM-based pricing for KRL evaluations seems to align the value proposition directly with costs, it actually presents more risk and less control to potential customers than other models. It also presents greater risk and less stability for Kynetx itself. What service providers and developers want to see in a technology platform is one with a free entry point (so you can get testing and trying it ASAP, even if a production system would need a for-fee license), a constrained, predictable cost structure, and economies of scale. Charging per evaluation offers none of these. This model instead creates an artificial scarcity and then charges by the drop. What you want is to create abundance and sell buckets and hoses and pumps. Doc calls this the “because of” effect. Constraining KRL evaluation to support a pay-by-drink business model will artificially constrain adoption. Instead, run to ubiquity and sell the best tools for leveraging the system you’ve helped create. At the same time, the evaluation of rulesets will have highly variable demand, with great spikes and drops far outside of Kynetx’s control. Tying revenue to that demand volatility means an unpredictable, wild revenue profile, flattening out only with insanely large numbers of users. This works for mega services like Amazon Web Services, but for a start up moving from initial revenue to predictable cash flow, it can be unsettling. In contrast, an IDE sales model or subscription based service with monthly fees bounds developer expenses and stabilizes the revenue curve. I like the idea of KRL rulesets. Currently, SwitchBook is planning on using Javascript, RegEx, and XPath, for similar evaluations. That approach not only feels ad-hoc, it is. I’d like to see a unified approach that is flexible, cross-platform, and supported by a good development and test environment. I think Kynetx could go far by creating an open source platform for KRL rulesets, then providing a robust IDE and testing framework for those who want to manage KRL rules to meet business needs. I think this is nicely pointed to in the mention in the White Paper of A/B testing with different KRLs. This is precisely the kind of sophistication that businesses will need to make the most of KRLs and which can easily be separated from the core infrastructure that enables KRLs in an open way for everybody. Also, the consulting opportunities to analyze, customize, and manage KRL rulesets is a huge business opportunity. Doing that well is likely to remain a black art for a long time to come; helping Fortune 1000 companies do it well should be lucrative. As Dale Olds put it referring to Novel’s Bandit Project: First, enable an open identity-metasystem, then sell tools to companies to help them manage it. Collaborations I like the value proposition of platform-independent identity-based customization. It fits well with VRM’s r-buttons, MyDex’s Personal Data Store service, and SwitchBook’s Search Maps. I think there’s still some brain work to be done figuring out how we can all support each other and simultaneously build sustainable business models, but I’ve no doubt there’s a way if we all invest in exploring those opportunities. Although I focused on questions and concerns about Kynetx in this post, I have great respect for Phil and hope to work with him as both our companies–and the entire VRM community–build out viable solutions to these kinds of problems.
Majority of Americans dislike unauthorized use of behavioral data
From Yahoo News: Majority Uncomfortable with Websites Customizing Content Based Visitors Personal Profiles Level of Comfort Increases When Privacy Safeguards Introduced ROCHESTER, N.Y.–(BUSINESS WIRE)–A majority of U.S. adults are skeptical about the practice of websites using information about a … Continue reading →
From Yahoo News: Majority Uncomfortable with Websites Customizing Content Based Visitors Personal Profiles Level of Comfort Increases When Privacy Safeguards Introduced ROCHESTER, N.Y.–(BUSINESS WIRE)–A majority of U.S. adults are skeptical about the practice of websites using information about a person’s online activity to customize website content. However, after being introduced to four potential recommendations for improving websites privacy and security polices, U.S. adults become somewhat more comfortable with the websites use of personal information. Good stuff, although one should read closely to understand exactly what users dislike. Customization isn’t the problem… it’s the unauthorized invasion of privacy. The questions asked by Harris were rather leading. It would be interesting to see what people say to “if asked, would you allow a Search engine to provide enhanced results based on your behavior.” My understanding is most people do opt-in to the advanced features of Google desktop, which asks essentially the same question at install time. People don’t like surreptitious activities, but if you ask up front, it’s much easier for folks to say yes.
BT busted for unauthorized tracking of user activity
The title says it all, as reported by the Guardian: BT admits tracking 18,000 users with Phorm systems in 2006 Bummer. I kinda like BT.
NY State strikes out against unapproved privacy invasion by online advertisers
Kudos to Assemblyman Richard L. Brodsky in the NY State Assembly for taking on GoogleClick and the rest of the back-end invisible online tracking services. The NYT reports A Push to Limit the Tracking of Web Surfers’ Clicks: AFTER reading … Continue reading →
Kudos to Assemblyman Richard L. Brodsky in the NY State Assembly for taking on GoogleClick and the rest of the back-end invisible online tracking services. The NYT reports A Push to Limit the Tracking of Web Surfers’ Clicks: AFTER reading about how Internet companies like Google, Microsoft and Yahoo collect information about people online and use it for targeted advertising, one New York assemblyman said there ought to be a law. Michelle V. Agins/The New York Times Assemblyman Richard L. Brodsky, the sponsor of a New York bill to limit how companies collect data on computer users. So he drafted a bill, now gathering support in Albany, that would make it a crime — punishable by a fine to be determined — for certain Web companies to use personal information about consumers for advertising without their consent. And because it would be extraordinarily difficult for the companies that collect such data to adhere to stricter rules for people in New York alone, these companies would probably have to adjust their rules everywhere, effectively turning the New York legislation into national law. “Should these companies be able to sell or use what’s essentially private data without permission? The easy answer is absolutely not,” said the assemblyman who sponsored the bill, Richard L. Brodsky, a Democrat who has represented part of Westchester County since 1982. … “A law like this essentially takes some of the gold away from marketers,” said Joseph Turow, a professor at the Annenberg School for Communication at the University of Pennsylvania. “But it’s the right thing to do. Consumers have no idea how much information is being collected about them, and the advertising industry should have to deal with that.” This is an absolute no brainer. If you don’t have permission, don’t track users. In the physical world, we have developed fairly robust rules of social etiquette and even laws regulating this sort of behavior. Can you imagine how creepy it would be if some stranger surreptitiously followed you around, noting where you go, what products you buy, even what sections in the supermarket you lingered in? Yech! Get that stalker away from me. And yet, that is exactly what most (if not all) online ad networks do to maximize their ability to sell high margin ads targeting Internet users. It makes sense. If they can tell from your clickstream behavior that you are likely looking for a new car, then they can create a lot of value by showing you new car ads. Value for advertisers and value for you… after all, you ARE in the market for a new car, right? When it works, it’s cool. But what about when you don’t want it working? When you want a little discretion as you window shop? When you’d like some privacy? Unfortunately, it doesn’t work that way. Users can’t tell when the ad networks are, or are not, tracking–it is all invisible to them–and there’s no equivalent of a “do not call list” to turn off such tracking. The right answer is to move toward user-centric advertising, where the user is explicitly in control of all the data used to offer them ads and can even limit the types of ads shown. This resonates with Esther Dyson’s testimony to the Federal Trade Commission at their Townhall on behavioral targeting and her subsequent article at Huffington Post, where she proposed using a “Disclosure 2.0” approach to this issue. If advertisers and ad networks can create real value with behavioral tracking and targeting, then full disclosure–and even full user control–will only enhance trust and deepen the relationships between businesses and customers. The long term value of a customer depends on building viable, healthy relationships. Relationships depend on trust. By engaging openly and responsively with their customers–with full disclosure and as much user control as possible–companies can craft entirely new, more trusting and more profitable relationships while customers feel more comfortable about their personal boundaries, have increased confidence in their vendors, and get easier access to better products and services. Advertisers need to get this. Ad networks and search engines need to support it. And it may be that regulators need to enforce it. [This is precisely the sort of payoff for vendors that Project VRM is working towards.]
Europe continues to lead privacy conversation with IP ruling
The EU is years ahead of the US in user rights and privacy. For a VRM example, see the UK’s Buyer-Centric Commerce Forum. Now, according to the Washington Post, an EU judge has pushed the privacy envelope even further, saying … Continue reading →
The EU is years ahead of the US in user rights and privacy. For a VRM example, see the UK’s Buyer-Centric Commerce Forum. Now, according to the Washington Post, an EU judge has pushed the privacy envelope even further, saying “IP addresses are personal data“: BRUSSELS — IP addresses, strings of numbers that identify computers on the Internet, should generally be regarded as personal information, the head of the European Union‘s group of data privacy regulators said Monday. This will be interesting to watch…