Category: People

The core of his argument was that when sharing is expensive, or when it makes an individual less well-off, then people don’t share. Society has to deal with this, trade being the root of our prosperity, so it develops trust networks to connect more trading partners and collect more information about those trading partners. Sam had a useful way of thinking about this, which was the idea of what he called “social hacks” to deal with the historical problem that the speed of bits and the speed of atoms are different (I might disagree with the shape of his pseudo-graph, but I think his points hold). These hacks (diplomas, badges, dress codes and banking) help us to get by, but they are by no means optimal.

However, we now have what Sam called the “superpower” of being able to instantly communicate with anyone else on Earth so we will no longer need those hacks. I may be paraphrasing incorrectly, but I think his way of looking at the existing business models around identity as being hacks in response to incomplete identity, credential and reputation information is a good way of framing some problems and a very helpful way of exploring the solutions that new technology can present. I strongly agreed with his big picture technology roadmap and have written before about about the “William Gibson World” where all of the technologies that will have any impact on corporate strategies to any foreseeable horizon already exist, something I always emphasise when we are working on client roadmaps. The trick is to look out of the corner of your eye and see where the technologies are being used for purposes that might disrupt business models, not to imagine new technologies. Given my predilection for using Dr. Who as my design authority, I also enjoyed Sam’s choice of common culture SF narratives to describe the future! His view is that the current generation is moving toward a “Borg system” not a “Hal system”, so new business opportunities are about the mass sharing of structured data.

Anyway, on to some of Sam’s key points, all of which were excellent:

1. Information will centralise and cluster. (APIs are better than protocols.)
2. We will share a lot more about ourselves. (Economics, not culture, will dictate this.)
3. Everywhere will become local. (“I want to go where everyone knows my name” Cheers-style.)
4. Only poor people will own things. Rich people will just rent whatever they want.
5. Social capital will get ever more fungible, so (for example) going to Harvard will mean less than it does now, which means that it will be worth less than it is now. You can see exactly where this headed. Just look at the way we use LinkedIn right now. In the old world, I would use the social hack of finding out which university your degree came from as a sort of proxy for things I might want to know about you, but I no longer need to do that because I can go via LinkedIn and find out if you are smart, a hard worker, a team player or whatever. So there’s no premium for you learning, say, biochemistry at UCL rather than Swindon Polytechnic: so long as you know the biochemistry, my hiring decision will be tied to your social graph.
6. The cost of using social capital for transactional purposes will fall below the cost of trust intermediaries such as notes and coins, so there will be no need for cash any more. In other words, identity is the new money.

(When Sam put up that last point I nearly cried, because earlier this year I was commissioned to write a book on exactly that topic! I thought I was the only genius that had realised that trade based on social graphs would eliminate physical means of exchange, so now I am crushed. Back to the drawing board, even though I hadn’t actually drawn very much so far.)

The argument here is, to my mind, unanswerable. Suppose I am wandering through Woking market and I want to buy a doughnut. I give the trader £1. The trader doesn’t have to trust me, he only needs to trust the £1, and the cost of failing to detect that my £1 is a counterfeit is quite small (despite the large number of fake £1 coins in circulation in the UK) compared to the cost of establishing my trustworthiness and creditworthiness. Other traders deal with this problem by paying banks and card schemes to manage the problem for them, but this costs them money. But now I imagine that I wander up to the trader to buy a hot dog and through his Google Glasses my face is outlined in green, which means that the system recognises me and that I have good credit. The trader winks at me, and a message pops up on my phone informing me that I am being charged £1. I press “OK” and we go about our day.

More than £4m worth of fake one pound coins have been seized by detectives.

[From Police Seize Record Haul Of Counterfeit Coins – Yahoo! News UK]

Until the invention of the mobile phone and its connection with the interweb tubes, I think it was reasonable to assume that for small transactions there was no way of using identity, credentials and reputation in small transactions, which is why it made sense to continue to use notes and coins to settle retail transactions. But now? The replacement of notes and coins in this way all hinges on the trader recognising me. Once this has been achieved, the issue of trust can be instantly resolved by computations across the social graph. If I understood correctly, this is why Sam said that “trust & trade” is the layer above the basic “recognition & memory”.

Money is technologically equivalent to a primitive version of memory.
Kocherlakota, N. “Money is Memory”. Journal of Economic Theory 81, p.232-251(1998).

Is it possible to imagine a trust and trade layer based on the social graph rather than third-party credentials? Yes. I remember that at the excellent Nixon McInnes “Social in the City” seminar last year, Will McInnes made a really important point right at the beginning of the day. “Who do we trust”, he said. “We trust people like ourselves.” Quite. And I also remember that in the discussion on trust at the Digital Agenda for Europe Assembly for 2012, I got into a mild argument with someone in the break, because I said that the idea of sticking web badges on sites (“this is a trusted European e-commerce merchant” badge, as an example) was ridiculous, and a strangely Victorian approach to vetting tradespeople. We need those badges as a pre-networked society substitute for actual information about trust. (Clearly, what Sam would label a “social hack”.) Once the social graph enables you to determine trust, they don’t make any sense. Look at it this way. Why would I care whether a hotel has the “British Tourist Board Seal of Approval” (I’ve no idea whether this exists – I just made it up) when I can go on Trip Advisor to see what everyone thinks about it? Or, more especially, I can go and see what my friends, my work colleagues and in general, people like me think about it?

I don’t know about Sam’s thought experiment of New Jersey suburbs becoming cool, but I thoroughly enjoyed his session and greatly appreciated his window into the kind of thinking that is going on in Facebook.

Incidentally, Sam referred in passing to “peak cash”, which I thought was such a nice idea that I have sworn to plagiarise it mercilessly. I’m working on a blog post around this for next week sometime.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

As Sheryl Sandberg said this week, when caller ID first came out, it was declared a violation of privacy.

[From Fear For Your Safety, Not Your Privacy | TechCrunch]

That’s because caller ID is a violation of privacy. Which is why you can turn it off. If I’m phoning British Gas customer service, I can leave caller ID on and benefit from the efficiency that having my Calling Line Identifier (CLI) connect to their CRM brings. But if I’m phoning the council to complain about the crack house next door, then I might decide to remain anonymous and turn it off. If I want to avoid the near-contininous stream of calls from ambulance-chasing lawyers about PPI, I might want to screen incoming calls by CLI (although this is a useless strategy against spammers because they use international “out of area” codes). Bear in mind, too, that spoofing caller ID is trivial, so it doesn’t deliver any actual security. If it wasn’t trivial to spoof it, there would be no need for legislation such as

The Truth in Caller ID Act of 2009, which was signed into law Dec. 22, 2010, prohibits caller ID spoofing for the purposes of defrauding or otherwise causing harm.

[From Caller ID and Spoofing | FCC.gov]

Thanks goodness there’s a law against such spoofing, because it means that no-one does it. No, wait… that’s not really true. No one does it except for criminals who are, for example, spoofing bank numbers to make phishing attacks or in more sinister enterprises such as getting people raided by SWAT teams by making bogus emergency calls that appear to come from the victim’s address (“SWATting”). So I call the police using your home phone number in the caller ID and tell them that someone has gone postal in the house, at which point heavily armed law enforcement officials storm your house and (hopefully, from my point of view, shoot you). This just happened to the well-know blogger Brian Krebs.

His office phone rang while he was vacuuming, but he ignored it. That, it turns out, was an unfortunate choice, given that the call came from law enforcement who were trying to verify what would turn out to be a spoofed emergency call showing Krebs’s number on caller ID.

[From Hackers launch DDoS attack on security blogger’s site, send SWAT team to his home | Naked SecurityNaked Security]

In other words, CLI is about convenience. It doesn’t deliver security. Worse still, it delivers “anti-security” because people believe it delivers security when it doesn’t. CLI did develop an acceptable privacy settlement – since you can turn it off – and people started to use it despite the lack of security. I can’t be bothered to look, but I’m sure page 697 of my phone company terms and conditions says that I’m not allowed to spoof CLI.

“The name you use should be your real name as it would be listed on your credit card,” Facebook says.

[From Facebook’s fake-name fight grows as users skirt the rules | The Verge]

Why? It’s of no help to anyone: anyone except marketers who are being sold the data, that is. My friends know that Leadbelly Gutbucket is me, and so they friend me and we use and enjoy Facebook together (as I do, in fact). But the corporations don’t know that this is me, unless I choose to tell them. I don’t believe that any name I see on Facebook is real. How would Facebook know? They didn’t do an Experian check on me when I created my account.

“Pretending to be anything or anyone is not allowed.”

[From Facebook’s fake-name fight grows as users skirt the rules | The Verge]

This is a completely different point. And Facebook are completely right about this: you shouldn’t be able pretend to be anyone else. Personation is obviously wrong. For example, did you see the Italian “Catch me if you can” story? It is a super tale of fake identity updated for the modern age.

A man who posed as an airline pilot and traveled in the cockpit of at least one plane was arrested in Turin Airport using forged identity cards and wearing a pilot’s uniform… The 32-year-old, whose real name was not released, allegedly created a fake identity as a Lufthansa pilot named “Andrea Sirlo,” complete with a Facebook page that included fake flight attendant friends… The national military police tracked down the suspect from photos on his Facebook profile, in which he is shown posing in uniform and sunglasses in front of airplanes.

[From Fake Italian pilot traveled in cockpit, police say | Reuters]

But if I create a Facebook account in the name of David Beckham and then IM a transfer request demanding a move to Swindon Town, is that really impersonation or just a joke? One more point. The real names fuss is not a Facebook phenomenon and I don’t mean to suggest it is. If you want a non-Facebook example you need look no further than our own legislature.

an embarrassing photograph emerged which showed him wearing the name-tag ‘Michael Green’ – an alter ego used by the MP when posing as a self-help guru – at an internet conference in the US in 2004.

[From Maybe it’s because I’m a Watforder: ‘Double life’ Tory chief can’t decide if he was born in London or Herts | Mail Online]

I’m not sure I’m against alter egos. What is the problem with having a “pen name” for the novel that you are writing? And how you can you “pose” as a self-help guru. Surely he was just practicing what he preaches. If I say that I’m a self-help guru, then I am. Now, you may want to see some credentials or learn about my reputation as a self-help guru, but in a world where you do not need my name as an (imperfect) proxy to those details, what does the name matter?

There are many points to be made from these stories, but the main ones I want to make are that the whole identity thing is more complicated than it seems and it needs new thinking and a new narrative and that reputations are more important than names and finding a way to securely manage credentials and reputation is the way forward for the new economy. To my mind, these are critical components of the new digital wallet, because virtual none of your day-to-day transactions depend on your name.

In the end, I decided it would be too boring to tread too much of the same pseudonymity ground as I did my last TEDx talk (which now has almost 173,000 views, I’m rather excited to report!) so I’ve gone for a more sweeping topic: “Identity is the New Money”. Look forward to seeing you at the Modern Jago in May!.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Andy Smith, internet security chief at the Cabinet Office said real names and addresses could increase security concerns. He advised users to submit “fake” details as this was a “sensible thing to do”.

[From Whitehall official: ‘Give fake details to protect online identity’ – Public Service]

Andy is spot on, although possibly unaware that providing fake details is in direct violation of Facebook’s policy. His advice will indeed lead to less identity theft, and we don’t have to guess at that because (as I will discuss later) we have the data. Still,

Simon Milner, Facebook’s head of policy in the UK and Ireland, was not particularly happy at Smith’s comments. He apparently had a “vigorous chat” with the Cabinet Office official afterwards to persuade him to revise his view.

[From Top civil servant calls for Brits to fake online identity – Cabinet Office says it’s the only way to be safe | TechEye]

However vigorous Mr. Milner’s chat might have been, there are almost no circumstances where it is necessary to use real names and we only use them now because we lack a proper identity infrastructure. By and large, we use the real name as a proxy to the attributes that are actually needed to execute a transaction. Andy’s comments elicited an immediate and vituperative response from noted internet security expert Helen Goodman MP.

Ms Goodman, shadow culture minister, told BBC News: “This is the kind of behaviour that, in the end, promotes crime.

“It is exactly what we don’t want. We want more security online. It’s anonymity which facilitates cyber-bullying, the abuse of children.

“I was genuinely shocked that a public official could say such a thing.”

[From BBC News – Give social networks fake details, advises Whitehall web security official]

Ms. Goodman’s confused opinions on security and privacy — and the false dichotomy implicit in the security vs. privacy paradigm she draws on — are representative of the shallow thinking and lack of informed discussion in this area.

How Helen Goodman voted on key issues: Voted very strongly for introducing ID cards.

[From Helen Goodman MP, Bishop Auckland – TheyWorkForYou]

I wasn’t able to assess her background in online security and identity management from her online biography, but I’m sure her opinions must be founded on some knowledge of the field.

Helen… went to Somerville College, Oxford, where she read Politics, Philosophy and Economics. After leaving Oxford, Helen’s first job was as a researcher for Philip Whitehead MP. She became a civil servant at the Treasury in 1980 and rose to become Head of the Central Strategy Unit in 1995… From 2002 until entering Parliament, she was Chief Executive of the National Association of Toy and Leisure Libraries.

[From Biography » Helen Goodman MP – Working hard for all in Bishop Auckland]

In an age where government seems more and more to be about sentiment and sensitivity rather than evidence and knowledge, I suppose her comments are unsurprising. I’m not for one moment suggesting that Ms. Goodman’s concerns are not wholly real and heart felt. I’m sure they are.

Mrs Goodman, MP for Bishop Auckland, in the North-East of England, said she had been contacted by constituents who have been the victims of cyber-bullying on major social networking sites by people hiding behind fake names.

[From BBC News – Give social networks fake details, advises Whitehall web security official]

I don’t doubt that this is true. But so what? People bully under their real names too, and it doesn’t make any difference. If they have broken the law, they can easily be traced, since the interweb tubes will lead the plod directly to them. Or, indeed, directly to the plod.

A man arrested over claims that he tormented a mother with abusive online messages is a serving police officer.

[From Police Officer Arrested Over Internet Troll Abuse Of Woman, Nicola Brookes]

I’m not picking on Ms. Goodman here, just using her to illustrate a point. After all, her fellow old Oxfordian and noted internet security expert The Honourable Edward Vaizey MP agrees with her that the Cabinet Office’s advice is incorrect, leaving us none the wiser as to the government’s actual policy on this (hint: it doesn’t have one).

Culture minister [The Honourable Edward] Vaizey said he had not seen Mr Smith’s remarks but told the BBC that he “wouldn’t encourage people to put false identities on the internet”.

[From BBC News – Give social networks fake details, advises Whitehall web security official]

The Honourable Edward’s plan to make it easier to track down people through interweb tubes may not be driven by commercial interests, but it certainly aligns with them.

Randi [Zuckerberg] and I share a passion to end cyber bullying and protect kids online. However, our approaches to online safety differ greatly.

Randi Zuckerberg wants to end online anonymity.

[From Facebook’s Randi Zuckerberg Wants to End Online Anonymity: Free Speech or Real Names?]

Look, I’m not here to shill for Andy Smith. Andy and I have disagreed about things before, and while I make not comment on whether he is an Epic F***ing Secure Hero or not, he certainly is an internet security expert. His comments were informed and relevant and exposed the lack of policy integrity. I don’t know why politicians don’t take the time to think this through. They always reach for the same knee-jerk response: some sort of internet passport or driving licence so that you can tell who is posting abuse about government minister on The Daily Telegraph web site (hint: me).

if there was an Internet Driving License that you had to use to log in to web sites, that would almost certainly make the situation far worse, since these website would now know exactly who you are, and this information would then be freely obtained by perverts, the secret police, News International or whoever else wants to pry. Why is this better than anonymity (which doesn’t exist anyway – look what happened to the not-Anonymous-at-all hackers).

[From Let’s not panic about online identity]

Since I wrote this, incidentally, some pretty convincing evidence has come to light to support my view. South Korea has rescinded its “real names” law.

In 2007, South Korea temporarily mandated that all websites with over 100,000 viewers require real names, but scrapped it after it was found to be ineffective at cleaning up abusive and malicious comments (the policy reduced unwanted comments by an estimated .09%).

[From Surprisingly Good Evidence That Real Name Policies Fail To Improve Comments | TechCrunch]

In fact the results of the “real names” law were predictably perverse. Identity theft went up, because real identities were stolen from the thousands of web sites that now had to ask for them and store them. And since people became used to be asked for their real identity, it was easier for dodgy web sites to get them to hand them over!

if you make people smear their “real” identities all over the internet because of such a policy, thus delivering the “over–identification” noted above, then that will make identity theft worse.

[From Real names, real problems]

I fully expect The Honourable Edward Vaizey MP to begin drafting another law shortly. After all, if we are not allowed to mask our real  identities online, why should we be allowed to mask them offline either? In a country covered by CCTV cameras, it seems perverse that people should be allowed to, for example, wear masks of celebrities (or, indeed, anyone else) in public places. The steady advance of automated face recognition technology means an inevitable identity Chernobyl.

Any science fiction film that doesn’t show everyone wearing burkhas in public will look as dated as Soylent Green.

[From Never mind real names, what about real faces]

Look. I don’t mean to suggest that Ed and Helen are idiots. That’s clearly not true. But what I am suggesting is that we need a better-informed public discussion and debate to determine public policy and the balancing of interests between competing pressures needs to be made explicit. How should we determine whether Mumsnet or the EFF are right? In back rooms or in public consultation (by which I mean consultation in public, not with the public – I don’t really care what they think since they are almost completely uninformed).

We (the public) have no idea what we want. We want anonymity for Syrian dissidents but not for pedophiles. We want anonymity for hospital nurses blowing the whistle on incompetent surgeons but not for looters. We want anonymity for celebrities in some circumstances but not others. Most of all, and most paradoxically, we want the authorities to spy on other people but not on us.

[From We don’t know whether we want real names or not]

So what I want to know from the Honourable Edward Vaizey, Helen Goodman MP and the Cabinet Office is this: what is the policy, and what is the strategy to implement it? And if you’re short of an idea or two about a vision for online identity in the 21st century, why not put your feet up, get a cup of tea, and cop a load of this. The security vs. privacy balance is only for people who haven’t put any intellectual effort into this serious, important and urgent area of public policy. Joanna Geary sums up the situation very nicely in her “Comment is Free” piece today.

A Whitehall adviser has been slammed for telling people to make up data. But less anonymity doesn’t equal more security

[From Being wary of handing over personal details to websites isn’t ‘outrageous’ | Joanna Geary | Comment is free | guardian.co.uk]

Hear, as they say in Parliament, hear.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers