imho Further thoughts on Cameron's identity laws

All:

I’d like to posit the following normative principles of identity, which are implicit in most of Kim Cameron’s and other people’s recent blog discussions:

• Each person is the only legitimate owner of their identity, all manifestations of that identity, and all associated identity attributes.
• Each person must be able to exert full control over all instances, attributes, disclosure, and management of their own identity.
• Identity environments must be architected to enable each person to exert that control, while facilitating identity-based security functions (authentication, access control, etc.), ensuring permission-based identity-attribute sharing, and safeguarding personal privacy.
• Where each person’s identity information is concerned, any other party in the identity environments is either a registrar, steward, or consumer (not an owner) of such information.
• Other parties in the identity chain must ensure that their policies, procedures, activities, and operations don’t violate or compromise people’s control over their own identity information.

If we accept these normative principles of identity, then all of Kim’s and everybody else’s discussions of “laws of identity” follows logically. I still haven’t seen any clear discussion of what identity systems “failed” specifically because they violated one or more of these normative principles.

Scott Lemon (http://www.freeid.org/2004/12/05.html) came closest when he attributed the failure of Novell’s “digitalMe” initiative to violation of Kim’s “Third Law of Identity” (The Fewest Parties Law of Identity: Technical identity systems MUST be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.”).

Scott said: “It's funny how some people at Novell really thought that Novell was somehow going to become the de facto source of identity information in the world….If you try to build the ‘one big thing in the sky’, and there is a second group of people that don't like you or trust you, then they'll build their own version. Which means there will be two. If there are two, then there will be three or more ... and then things start to go in all directions. It's funny to see this even occurring in the Open Source world. People have disagreements and fork a project ... and then it get's forked again. I'm not saying this is bad at all ... it's the natural progression. So build to embrace this!”

Did digitalMe fail because non-Novell people didn’t trust Novell to aggregate/manage their identity information? Or because most Novell projects fail to achieve their grandiose objectives?

Did Passport fail because non-Microsoft people didn’t trust Microsoft as an identity aggregator? Or because Microsoft pursued a proprietary-based approach in a world rapidly moving to purely WS-* based middleware of all types, including identity middleware (a la WS-Security and SAML)?

The ultimate universal “identity service bus” will be agnostic to normative identity-governance principles. It will support the “each person is master of own personal identity domain” governance model (a la Kim) and the “each person is a serf whose identity is issued and controlled by impersonal identity domains run by business and industry” governance model that actually describes the current and likely future world more accurately.

Yeah, I’d like to be master of my own identity domain as much as you. I have a deep personal connection to this “James Kobielus” identity—it’ll be carved on my tombstone, so it, and the reputational halo surrounding it, are dear personal assets (that's why I defend them against eclipse, tarnishment, and distortion).

But, hey, you can call me Jim.

Jim

P.S. Kim: Thanks for the kind words. I'm looking to dock my identity to a new mothership. I appreciate your help in that regard.