« MVC in Perl (OSCON 2005) | Main | Identity Policy Templates »
Identity Rights Agreements
In my Digital Identity book, I mention that even though most people hate digital rights management (DRM) schemes on digital goods like software and music, that’s exactly what we’d all like for our identity information. For example, I’d love to be able to control how my bank uses, stores, shares, etc. my SSN when I’m forced to give it to them.
On the train from OSCON to the airport, I was talking with Doc, Dizzy, and St. Peter about identity and Dizzy brought up the idea of doing something like Creative Commons (CC) for identity—essentially a voluntary DRM not unlike a non-disclosure agreement. We started calling it an Identity Rights Agreement (IRA). Here’s some thoughts:
IRA’s should come in a limited set of configurations, like CC. This makes it easy for people to choose and become familiar with what they mean. So, they might be:
- Post publicly (broadcast)
- Share with anyone, but can’t broadcast
- Share with self and partners with which you have a legal agreement to honor this agreement
- Keep to self
- Stored encrypted
- Use for this purpose and destroy
These are just suggestions. There might be more and they certainly need better names and descriptions.
Another issue surrounds granularity. Ideally, each assertion on the identity would be able to be separately licensed. I am glad to have my URL shouted from the rooftops, but I want my phone number kept, but not shared. My SSN, I want used and then destroyed, or at least stored in encrypted form. Just off the top of my head, I think some kind of microformat would be the right thing here since it could be layered onto other mark-up and be displayable as well.
The IRAs would be voluntary in the sense that not technology or system enforces them, but they could be made legally binding by the use of electronic (not digital) signatures. By federal law, an action (clicking on a Web page, for example) can be legally binding under certain circumstances. A request for identity information could return the agreement (in machine and human readable form) and then the request for the actual identity attributes would constitute the agreement.
Certainly, much of this would have to be worked out by those more expert in the law than I. You can’t really have a functioning Identity 2.0 infrastructure, however, without some way of attaching hints and rules for acceptable usage to attributes.
Posted by windley on August 6, 2005 9:11 AM
Comment from Jaco at August 6, 2005 5:38 PM
Great post Phil!
The IRA is another good way on how to implement the human right of having or not, virtual personality.
Specifically, IRA are related with projection, one of the 3 components of a virtual personality:
http://cis-berkman.editme.com/Lexicon
Comment from Robin Wilton at August 16, 2005 5:38 AM
Phil - your post correctly brings out one of the key aspects of the online exchange of identity data.
What you've called Identity Rights Agreements are key to several aspects of identity management, namely consent, privacy and anonymity.
Try as I might, and I've been thinking about this a lot lately, I can't come up with a better model than the 3-layer SAML one used in ID-FF and SAML 2.0: credentials on the bottom, authoriszations in the middle, and 'other attributes' as a layer above that. It separates those data types which benefit from being separated, but doesn't create a needlessly complex model in the name of 'composability'.
The other benefit is that those three layers map neatly onto three corresponding "real world" concepts which underpin trust relationships:
credentials -> assertions of identity, authorizations -> assertions of entitlement, and 'other attributes' -> 'case-specific evidence on the basis of which you make transactional decisions'. Obviously that last one is a bit less snappy, but it's the one which is most contingent on the application/service in question.
Apologies for the lack of formatting, by the way; try as I might, I couldn't find an HTML tag which worked...