Day: April 12, 2005

Identity Woman has been telling us for some time about Daniel Solove's amazing book, The Digital Person.

Of course a lot of books have come out recently which discuss privacy issues – even making the cover of last week's New York Times Book Review section (William Safire discussing No Place To Hide and Chatter).

But Solove's work is in a class by itself.

In an argument worthy of George Lakoff he convinces us that privacy advocates need to move beyond the secrecy-based “Big Brother” metaphor, and embrace the metaphor of Kafka's “The Trial” – a novel in which the subject is arrested for charges which constantly elude him, put forward by unknown accusers who remain just out of sight – a situation which might be remedied at any moment should the bureaucratic process, which of course is undefined and impenetrable, wend its way to a positive conclusion (naturally it doesn't).

Solove argues that, in general, superdossiers are assembled not by punitive central government authorities, but by an uncontrolled and unknowable web of commercial actors whose self-interest lies in knowing-us-to-death.

Solove wants us to move away from the paradigm where an affront to privacy is defined as revealing something secret. After all, things like our names, sex, age, address and profession are in some sense public information (i. e. are published in public documents). If an invasion of privacy consists only in revealing secret information, then third parties who make personally identifying information available to others do nothing wrong, when in fact the construction of superdossiers that remain out of our control is fundamentally dehumanizing. He demonstrates clearly that the secrecy approach has failed to produce rational outcomes in many legal cases.

His main interest lies in updating the “legal architecture” protecting privacy in the United States. (The book includes an interesting discussion of the similarities between physical, software, and legal architecture).

Recently Solove has teamed up with Chris Jay Hoofnagle of the Electronic Privacy Information Center West Coast Office to author the Regime for Privacy Protection. This document proposes a series of concrete measures the authors see as practical ways of addressing privacy concerns of the modern technological period.

Identity colleague Chris Ceppi reviews “the regime” this way:

As someone who feels very strongly that the technical innovation surrounding digital identity is best seen as a reform effort, I was delighted to come across this extremely thorough and hopefully influential study of identity and privacy published by Daniel Solove and Chris Hoofnagle.

Solove and Hoofnagle's Model Regime presents a clearly defined set of problem descriptions and proposed regulatory remedies for a whole set of privacy concerns currently plaguing digital identity – it is a good bet that their thinking will find its way into the technology that is deployed in this reform effort.

Of particular interest is the historical context they provide for the development of privacy legislation. If you have ever wondered how in the world the Social Security Number was allowed to proliferate as a universal identifier used by businesses, you'll be heartened to learn that restricting the use of SSN by businesses was proposed for inclusion in the 1974 Privacy Act – but the restriction on SSN use did not make it into the final Act. Ouch

As much as I think Chris understands policy issues, I don't think anyone could be more wrong than he is in eliding the role of technical innovation in achieving the new architecture Solove is looking for. Legal remedies will not be plausible without the right technological infrastructure. We need everyone to understand this. It is what underlies the historical urgency of the present identity discussion. And it explains why identity architecture must make possible specific capabilities, like formal ways to demonstrate the contract under which a user has made information available. We must think about the long term.

Readers of this blog will be aware of my conclusion that the technical designers of the identity metasystem need to avoid architectural decisions which impose their prejudices on it. Instead we should provide the framework in which various kinds of technologically and operationally unrelated identity providers suitable to specific contexts can be selected by users who are effectively given ultimate freedom of choice.

This kind of technological freedom puts the levers of technology in the hands of citizens and thereby allows the normal processes of legal architecture to reach out into the newly evolving technology realms.

I trust that one day legal and techological architects will meet up to further discuss these issues.

Andrew Layman, who is one of the key forces behind the WS-* set of industry standards, asked me recently if taxonomically speaking there was an activity called “phraud” that encompassed both “phishing” and “pharming”. And I thought he was joking!

But the concept struck me as a simplifying principle that would clean up a lot of slideware, so I asked if I could attribute the new category to him. Then a couple of days later, he sent me this etymologically satisfying email:

“It is such an obvious joke that I doubted I was the first one to think of it, so I searched the web for “phraud” and discovered lots of hits, most of them ambiguous, but clearly I’m not the first person to use that word.

“Interestingly, I also think they shed some light on the plausible origins of the term “phishing.” It appears that in the subculture of people who like to steal services from the phone company and the like, it is conventional to substitute ‘ph’ for ‘f’ a lot. Probably originating from ‘phone freak’ becoming ‘phone phreak’ and thence to all similar transformations. So luring people, that is, fishing, would quickly become ‘phishing’.”

I had actually had the same intuition. In fact I became sufficiently fascinated by the strange destinations associated with ‘phraud’ that I successfully avoided my growing pile of urgent tasks for several hours while exploring how far back its usage goes.

And then I hit the mother load. I mean a world where ‘Ph’ is hegemonic. A place where everyone has a ‘Ph’ D. Just look at this:

==Phrack Inc.==

Volume One, Issue Eight, Phile #2 of 9

==Phrack Pro-Phile V==

Written and Created by Taran King

June 25, 1986

Welcome to Phrack Pro-Phile V.Phrack Pro-Phile is created to bring information to you, the users, about old or highly important/controversial people. This month, I bring to you one of the most influential users of our times and of days of old…

An article on an identity system called (control yourselves) ISDN includes this quote from Mr. R., an AT&T supervisor:

“One of the controlling factors behind The Integrated Services Digital Network is the simple fact that AT&T, MCI, and other long distance companies are losing MILLIONS to Phone Phraud.”

Another “phile” which has not had the requisite cosmetic application of ‘Ph’ begins:

This file will detail the use of a rural junction box to fraud the phone company and make all the free phone calls you want to BBS or AE by.

Seems like Andrew hit the nail on the head.