My interest is in what follows Facebook, which I think must be its disintermediation by all of us reclaiming our personal data, possibly through our embracing the very HTML5 that Roger loves so much. The trend is clear from “the computer is the computer” through “the network is the computer” to what’s next, which I believe is “the data is the computer.”

It’s nice to see more and more folks understanding the need for us to reclaim and control our personal data.

This diagram is from the Unisys Security Index Survey.

Panelists are:

Evan Prodromou from Status.net a personal publishing platform

Tara Hunt from Buyosphere.com a tool for gaining value from your purchasing data

Eric Lagier from MemoLane a tool for visualizing posts to social media sites (twitter, flicker,facebook).

I found this post on WIRED by Bruce Sterling commenting on the conference and standards in general. “*If “code is law,” then standards are like the Senate.”

I couldn’t make it all the way to Taiwan but recorded this presentation.

Augmented Reality and Personal Data on Vimeo.

Here is a video of Christine talking about what Augmented Reality “is” – in part it is the cyber colonization of the real world.

The primary outcome of the event was the creation of the SWAT0 test to implement key aspects of the idea of the federated social web in real code:

There are two users on two different code bases following each other. User one posts a photo to their social site and user two on their own social site sees this photo flow past in a stream of activities from their “friends” they comment on the photo (on site 2) this comment then flows back to where the original photo was posted and is seen by the user posting.  All of this could be public.

Several code bases achieved the goal.

The W3C began a social web incubator group 2009 and met weekly via conference call for over a year interviewing key leaders and innovators to understand the range of activities ongoing in this space.  They wrote a final report that can be found here.

Working with the momentum around these efforts and seeking to be more inclusive the W3C opened itself up for these efforts to move forward and founded a community group.

This year they convened the Federated Social Web Summit, Europe to reflect on progress over the past year and to look ahead.  They choose to spend half the time presenting from the position papers submission and half the time using Open Space Technology a method to make the agenda live at the event. It supports self organizing to move real work forward – agenda and notes here.  I volunteered to help facilitate the open space.

A diverse range of projects represented at the event - more to follow about some of then in future posts.

Update from Identity Associates:

I had the opportunity to attend much of the two day NSTIC Privacy Workshop held in Cambridge Massachusetts this week.   I haven’t been following this NIST-backed effort as closely as I probably should have, so the workshop in Cambridge was a perfect opportunity to catch up with NSTIC, at least through the lens of privacy.

A few observations:

• Once again, Identity Woman, aka Kaliya Hamlin, seems to be two steps ahead.  Will the Personal Data Ecosystem Consortium trump traditional standards processes by leveraging the entrepreneurial energy of competing startups?  Running code FTW?

Seth says:

We need software on our phones that can remember where we go and what we do, software for our browsers that can create profiles that save us time and money, and most of all, software for our email that gets ever smarter about who we are and who we’re connecting to.

This was particularly timely as I was my way to Boston to present at the NSTIC (National Strategy for Trusted Identities in Cyberspace) Privacy Workshop about the Personal Data Ecosystem and the emerging market-based solutions for privacy that we are starting to see emerging.

Here are some of the companies in the Startup Circle that are working on aspects of making Seth’s vision real:

Azigo has a browser plugin that allows individuals to collect their browser history, access their “interest profiles” from ad networks, and create their own interest profile that resides on the browser that they manage.  The user can choose to share a profile with media sites they visit and support relevant ads being displayed. It also stops existing tracking and beacons.

egoArchive is based in Vienna and supports individuals collecting the contents of all the web pages they visit and social media streams.

The data locker and vault services that are under development such as Singly and Personal will enable individuals to collect this data.  Personal is in private alpha and has a sophisticated user interface to help manage profile sharing.

Seth summarizes Richard Thaler’s article in the New York Times piece from April Show Us the Data. (It’s Ours, After All.):

He argues that you (not some company) ought to own your caller history, your credit card history, etc. If it was available to you as a machine-readable file, you could easily submit it to another company and see if there was a better deal available. You could make your preferences and your history (you, basically) portable, and others could bid for a chance to do better for you.

We agree with Richard that individuals should have the right to copies of all the data generated from transactions and that individuals should be the ones to link together diverse data sources.

Today’s Story:

Vienna, Austria, June 7, 2011. Somebody’s watching you… and we’re not talking about a stalker.

Your interests and browsing patterns, your family relationships and lists of friends, your recent purchases, your income and investments, your job and academic history, and your health – all are of great interest to companies that make it their business to get to know you better.

This isn’t a bad thing, considering that most of the time your preferences are used to help you find more of the things you already like, make your choices easier, solve your medical problems safely, facilitate communication, and help in other life-improving ways. Imagine trying to send webmail without an address book, for example — or applying for a job without a resume.

I suggested that in a Personal Data Ecosystem, apps makers could take data from their users and send it straight through to the users' Personal Data Stores (PDS). That way if the app or hardware changed or ceased to support their old systems, the user would have their old data to play with in their PDS. And I talked about open formats for the data (think.. what about an open format for Heart Monitor data, where you pulse is described and you can take that data anywhere). Services could think about just providing a great service, instead of trying to manage all the user data storage and security. Users would control their data in their Personal Data Stores/Lockers/Banks, and I said that a bunch of companies were building these PDSs, including Sing.ly which is building the Locker Project.

Sing.ly happened to have someone there, Jared Hansen, who is a developer in the open source project. And there was a guy from Basis, Bashir, who is building hardware (like a wristwatch) that you monitor things like your heartrate with.. though it does monitor many other things as well on your body. We also had a couple of health researchers there, plus other health and wellness companies looking at data, as well as Ian Li, of Carnegie Mellon who is researching data collection and normalization, and a woman from the EFF. And we had a couple of users who talked about what users need.

After a few minutes, Bashir from Basis explained their dilemma around the hardware which isn't all that profitable for them. So initially they were questioning what to do with the data and how to monitize the company. Should they sell the data, or give it to users, or charge uses for it, or give it away to developers who could create a great ecosystem by building lots of apps, thus driving more sales? And who's data is it?

WOW. WOW!!!!

So we were off an running, with the impromptu Basis use case of how to get the value of the data, include the user and let the user have choice and autonomy, and how to leverage what is being done out in the marketplace and with developers creativity with data. Oh.. and don't forget about participating in microformats and Activity Streams creation to make bottom up grass-roots standards for the data formats and exchanges.

We talked through what it would mean to give away the data, support users and ask them if they wanted their data included in studies, get additional revenue for Basis while maintaining the inclusion of the user in the process and what developers could and should do. We brainstormed a lot of things, and covered the good and bad points of how it would all work and how to support Basis' market model while still being good and fair to the users.

I have no idea what Basis will do, but I would love it if they would join the Personal Data Ecosystem Consortium in the Startup Circle, to help build out ways to make a user centric data system for user's wellness data collected with Basis hardware.

What an amazing opportunity Basis has for doing the right thing for users, and leading the wellness and personal data ecosystem by creating a win-win for themselves and users. They could create a new market for wellness data, that is user driven.

Frankly, we need more discussions like this. It's not about Do Not Track models where we kill all the data plus the value of it, and it's not about "business as usual" where the user isn't included and businesses do whatever they want with user data.

It's about creating markets that do right by users and have companies making money ethically and conversing with us in the market.

Thanks to everyone who came! We had many representatives of the relevant stakeholders and the discussion was enlightening and rare.. but one I hope to make more common in the near future!

Risks

Lack of adoption. NSTIC relies on the private sector to invest and build identity infrastructure. There’s a real chance that this could happen slowly or unevenly. We’ve seen great technologies wither when they don’t reach critical mass. 

Impatience for learning curve. We learn by doing and we learn more from problems and failures. NSTIC as a whole could be unfairly discredited after some projects or products fail for technical or business reasons. 

Usability failures. Great products fail on even minor user experience defects. We know very little about what great user experience looks like for this next generation of personal data control.

Interop failures. Systems that should work together in theory may not in practice. Sometimes this is technical philosophy, ego, fuzzy specs, culture gaps, or regulatory differences, and local optimization.

Overscope. We’ve all seen protocols that work at first, become burdened as new features pile on, and lose their clarity and momentum as a result.

Phishing and Malware ($). We know that bad actors will follow the money, as they have from email to search to social media. Stakeholders could lose faith and abandon trust frameworks.

Perversion of principles ($). NSTIC lists core principles. Those principles will be eroded, if not attacked, unless monitored and defended.

Overpromising (by Tech to Policy). Silicon Valley has a tendency to tell Washington that technology offers silver bullets to huge problems.

Dystopian fear. Maybe your government really is out to get you, but dark overwhelming fears could slow or stop the project.

Waiting for winners. One strategy for risk is to wait for a handful of leaders to emerge before joining. This stifles investment, experimentation, and deep learning. The ecosystem needs pioneers and early adopters before winners can emerge.

Regulatory blocks. National and local laws and regulations may interfere with the ability of the ecosystem to grow. Privacy laws, liability, and antitrust rules could stall engineering, investment and adoption.

Uncertainty over liability. However the ecosystem works out liability, uncertainty about the resolution threatens investment.

Short attention span. This is not a weekend project. Will the ecosystem persist until it becomes mainstream?

Hype cycle. Many technologies don’t survive the hype cycle’s peak of inflated expectations or the trough of disillusionment.

Chicken vs. Egg. The system needs governance, startups, large corporate and government users, and the public to buy in. Nobody wants to jump in first.

Prevention and Mitigation Actions

Highlight small successes. We should celebrate small, incremental successes more than big-bang moments. Don’t oversell or overpromise.

Industry Marketing and PR. The ecosystem needs its own media and voice to respond to concerns, to put forth a common vision, to reach out to newbies and decision makers, to evangelize the benefits of the approach.

Share community UX experience. We could plan and pool knowledge and experiments as a community of practice. Where a Google might not be able to try different login UIs , variation being perceived as phishing, smaller companies can experiment and share results, leading to convergence and adoption. 

Cultivate Engineering Focus. Keeping designers and engineers focused on current release cycles helps a developer community avoid feature creep and intriguing digressions.

Foster Interop Testing. Other industries develop standards for testing interop, hold interop workshops and set up backchannels for feedback. We just need a convening body to coordinate tests.

Formulate, publish and update a Clear/Graded Roadmap. Short term plans with long term visions. Plans to reach specific business and technology milestones. Long term visions for where those protocols and practices should go. Clearly communicated and widely agreed upon so the industry avoids forking, surprises, and hype.

Industry association outreach. The NSTIC strategy depends on achieving a critical mass of adoption within various communities. Many are represented by industry associations or professional organizations. Outreach services could provide education, evangelism, engagement and help with rough spots in adoption.

Recruit legacy identity authentication communities. NSTIC is not the first attempt to solve these problems. A look at NIST SP 800-63 shows existing identity and security standards have communities of their own, including tens of thousands of implementers. Outreach can smooth the way for education and adoption.

Security Council. It’s not too early to start a security conversation within the NSTIC ecosystem. At a minimum, we could start a working group to prepare for the first wave of phishing and identity theft.

Government Affairs. Governments are huge stakeholders in NSTIC. Not just US federal government agencies but US state and local governments. There is every reason to expect this program to be transnational so governments around the world are also stakeholders. They will want to understand the policy implications of the rapidly changing technologies, and the effect rules, regulations, directives and laws will have on the ecosystem. Effective communication and advocacy on behalf of the industry, especially for the many small startups and the interests of individuals who lack a voice, could keep government perspectives and actions cordial and supportive.

OIX Risk Wiki. OIX has an active security thread on its wiki.

Risk, Response, Community and PDEC

So this brings to mind three roles for PDEC, the Personal Data Ecosystem Consortium: Communicate, Convene, and Community.

Many of these responses involve marketing communication functions on behalf of the community’s stakeholders. As listed above, industry marketing and public relations, government affairs, highlighting small accomplishments, publishing a roadmap, are the kinds of things a consortium can do well. Speakers bureau, anyone?

Similarly, bringing people together to talk and work is another role for PDEC. We can serve some of our outreach goals by inviting people and organizations to join in projects and conversations. For example we could invite identity providers and relying parties to interop workshops. We might host security roundtables and mailing lists.

Last, today’s identity ecosystem doesn’t have a real voice for individuals, a way for people to talk about this topic. PDEC might offer community services to help people talk to each other, with the industry, and with other stakeholders.

The “Death to NSTIC!” motto, all in fun, reminds us bad things happen and preparedness is part of planning.

I want to thank the IIW folks who crowded into room E for their work, as reported here. I also want to thank the Identity Commons for creating an environment where IIW and PDEC can emerge. 

A bit of Context
Obviously, this diagram is a little cynical, but not too far off from how we manage personal data online today. But there are a lot of proposals on the table to fix this dilemma. One is Do Not Track which industry sees as something they can self-impose on an *opt-in* basis (for themselves) and opt-out (for the users) and self-regulate by having advertising trade org.s monitor compliance, with the FTC stepping in as necessary. There are also a number of DNT bills introduced in Congress and various hearings on tracking where the FTC would regulate implementation. And Johns Kerry and McCain have introduce a Rights and Responsibilities proposal in the Senate, that instead of Do Not Track (Kerry’s LA, Danny Sepulveda told me DNT is a waste of time) suggest ways that data collectors would have to be responsible with our data. However, that bill lets 3rd party marketing, data tracking and Facebook’s privacy bending ways totally off the hook. Both of these plans / legislative initiatives completely ignore the more than 40 startups and companies building for the Personal Data Ecosystem where users would collect their own data, and make use of the value, which the World Economic Forum recently said was “a new asset class”.

That said, the rest of this post describes the Tracking DNT panel at Morris + King the other night.

Tracking Do Not Track
Tuesday night I was on a panel at Morris + King, an PR firm in NYC, called Tracking Do Not Track. Our hosts: Andy Morris and Dawn Barber (who co-founded NY Tech Meetup with Scott Heifferman) were very good about putting together a diverse group of people to talk about Do Not Track and the various issues with personal data and the advertising industry that have so many talking these days. My guesstimate was that about 100 people attended, mostly from industry (tech & advertising).

Our group included:
Brian Morrisey (Editor in Chief of Digiday, an ad industry trade publication) as Moderator
David Norris (CEO of Blue Cava)
Dan Jaffe (Exec VP, Govt Relations for the Assoc of National Advertisers – ANA)
Helen Nissenbaum, Professor, Media, Culture & Communication at New York University
and me: Chair of the Personal Data Ecosystem Consortium

We started off with Brian’s question: who are you, what do you do in a nutshell, and what do you think of the state of online privacy these days?

I was first.. and gave a quick explanation of PDEC which is to say that we offer a middle way between Do Not Track (DNT) and what is going on now online (Business as Usual). Our middle way offers a market solution to users’ wanting control of their data, and the tracking and digital dossier building by shadowy companies to stop..we don’t believe DNT will work and don’t support it, though we do see that some kind of “Rights and Responsibilities” legislation would help create a level playing field for any company that collects personal data. Those rights and responsibilities for personal data collectors needs to include giving user’s a copy of their data, so they can then put them into personal data stores (or banks, lockers, etc) and then use the data as the person sees fit.

Oh, and I said the state of online privacy was pretty dismal, though I was optimistic because it feels like this year, it’s actually possible to get personal data some basic protections similar to HIPPA or FCRA where user’s can get their data, and we can make the Personal Data Ecosystem emerge as a market solution that finally works for people. Granted, it’s a 5-7 year proposition to really create a new market, but we can actually start this year because of the 40 or so startups that are funded and building pieces of the PDE and the push in the US Government to do something about the dismalness of online privacy.

Helen Nissenbaum, whom I’ve admired for years for her thoughtful approach to privacy and usability, agreed that privacy online was pretty bad, and explained her work around Adnostic, a “privacy preserving targeted advertising” system made with some Stanford folks.

By far, the best comment Helen made all night was that tracking and aggregating data that pivots on people is not ethical, that it’s bad for people and for the incremental 1% improvement we might see in targeted advertising, it’s not worth the incredible intrusiveness of tracking. In particular she said, “Anonymization does not change intrusiveness.”

Dan Jaffe spoke next, and surprise, agreed that online privacy is not good, but talked about how publishers need to support their businesses and that behavioral advertising is helping them do it, and that Do Not Track should be self-regulated by the industry because they know their business best. And government has a tendency to screw up regulations and therefore, we should let advertisers figure out what works.

Next up was David Norris, who agreed with my use of the word, “dismal” to describe online privacy and said that Blue Cava was supporting a self-regulatory model because they didn’t feel that Do Not Track as proposed for legislation was a good idea.

We chatted about the viability of Do Not Track, and with Norris, Jaffe and me all agreeing it wasn’t a good idea. However Jaffe said he didn’t like the idea of any regulation, that the industry could do it themselves, and that my “data rights and responsibilities” support for legislation would be just as bad for data collectors.

Folks in the audience, like Esther Dyson, pushed back on Jaffe, saying that she wanted the ability to choose where and when her data was out at some vendors site, and that’s why, she said, “I’m supporting Mary and her organization” because it’s a market model that gave her choice.

I was very pleased to hear her endorse us (thank you Esther!)

In the end, I think we got our message out which is that tracking individuals is a bad thing, that users should be the only ones tracking themselves across sites, but that sites can track within the site to optimize business. And that users should have a marketplace to trade data, like they do in mileage accounts, and choose when they trade, as partners, and not have it done for them in secret as is the case now. And that we want to see users data protected with a basic set of rights, like Health, Education and Financial data currently is now.

Curiously, Dan Jaffe made a comment about HIPPA, the health data protection law, suggesting that users get their health data so maybe they could get their personal data too. Given that that is a law, and he was opposed to regulation of any sort otherwise, I wasn’t sure what to make of this.

However, I was really pleased with the opportunity to talk about PDEC, the startups and tech efforts to create a personal data ecosystem, and to provide a different view than the usual support for Do Not Track as we try to figure out what is best for our society.

Thanks Andy and Dawn for inviting me!

Source Documents

• The FTC White Paper itself:  ”Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Business and Policymakers”, preliminary FTC staff report, December 2010
• The FTC page listing all responses to their White Paper. This page lists links to a short web page for each response. Many of the pages then link to one or more PDFs submitted by that respondent.
• Our page combining all the responses. This single page conveniently contains the text of all the response web pages, and also directly links to all 201 submitted PDFs for easier downloading.
• Spreadsheet with additional data on the responses. This spreadsheet allows for quick scanning of all the responses, allows for the resorting of responses by any column (such as type of responder, or by alpha-name or by date of submission). You can also download the data in the spreadsheet and create whatever other forms you wish from it.

Statistics

There were 452 responses, compared to 100 responses to the Department of Commerce Green Paper; however, over 250 of the FTC responses were from individual citizens, most brief and supporting Do Not Track or
criticizing tracking in general and other privacy violations; only a few of the Commerce responses had been from unaffiliated individuals. Almost all early responses were from individuals; organizations tended not to submit until close to the deadline, unless to simply request an extension. Many responses supported opt-in (positive consent) rather than an opt-out system like Do Not Track.

Over 60 of the FTC responses were from trade associations, over 60 from private companies, over 25 from publicly traded companies, over 25 from think tanks or advocacy groups, over 10 from academics, and over 10 from governments.

In 83 cases the same organization or individual responded to both DoC and FTC. Many organizations submitted similar documents to both, or a single document, or even sent the FTC a completely unmodified document still referring to Department of Commerce in the text.

AT&T requested “The DNT mechanism should not unduly burden businesses which have direct customer relationships particularly where businesses that have no relationship with the customers frequently engage in the most aggressive tracking” while others

Spatial Treatment?

About 50 responses were from the geospatial community concerned that strict new regulation would place an unreasonable burden on their industry, apparently triggered by the call for special protection of and affirmative consent for “precise geolocation data” on p. 61 the White Paper. The paper did not define the phrase “precise geolocation data”, and respondents worried that new regulations could even extend to a requirement for permission from each person whose property is visible in an aerial map. Many responses, often from the same template, requested that FTC define the phrase, or specifically exempt maps. Other than MAPPS, all of these responses were from small businesses and individuals who had not responded to DoC.

Personal Health Data

Wolters Kluver Pharma, supported by Genetic Alliance, defended the use of prescription data that has been de-identified up to the standards defined by HIPAA, something that the Supreme Court later ruled in favor of on April 26th, against the efforts of the Obama Administration and 35 states to require doctors’ permission.

Vocabulary

Surprisingly, there are only 3 mentions of “user-centric” in all the responses - 2 mention “user-centric privacy framework” without elaboration, and Ann Cavoukian’s Privacy by Design document lists it as one of the seven principles. ”Personal data ecosystem” is mentioned only by Semcasting, DoubleVerify, and USACM.

Overall, we saw entities with business based upon tracking personal data from individuals come down on the side of either self-regulation or no-regulation at all. And typically, as in the DOC response analysis, we found that advocacy groups typically came down in favor of some kind of enforceable regulation that would protect individuals from tracking if they do not want it. Very few offered a different solution as the Personal Data Ecosystem Consortium does, where we support user rights and data collector responsibilities, coupled with a market solution where startups and existing companies provide the tools and exchanges for users to collect their own data and share it as they wish, with autonomy and control, in those marketplaces and exchanges.

This podcast has limited audio quality.  We decided to post it anyway because we thought it was important to share.  We are still working out technical kinks.

Aldo hosted the Story of Digital Identity (Stodid) Podcats for several years but stopped after finishing his joint JD/MBA degree and beginning a job. Kaliya is the Executive Director of the Personal Data Ecosystem Consortium, and the co-producer and facilitator of the Internet Identity Workshop (IIW).