Identity Crisis

Kim Cameron has been reading Jim Harper's book Identity Crisis.

"Jim Harper really understands identification. And he is better than anyone at explaining what identification systems won’t do for us - or our institutions. He carefully explains why many of the proposed uses of identification are irrational - delivering results that are quite unrelated to what they are purported to do. In my view, getting this message out is just as important as explaining what identity will do...

I have only one criticism of the book. I would like to see us separate the notion of identity, on the one hand, and individual identification (or identifiers) on the other. We need return to the original meaning of identity: the fact of being who or what a person or thing is.

As a simple example, suppose I’m a service provider building a chat room for children, and want to limit participation to children who are between 12 and 15. Let me contrast two ways of doing this.

In the first, all the children are given an identifier. To get into the room, they present their identifier and prove they are the person to whom that identifier was given. Then the chatroom system does a lookup in some public system linking identifier and age to make the access control decision.

In the second, the children are given a “digital claim” that they are of some age, and a way to prove they are the person to whom that ”claim” was given. The chatroom system just queries the claim to see if it meets its criteria. There is no reference to any public or even private identifier.

My point is that the first mechanism involves use of an identifier. The second still involves identity - in the sense of being what a person is - but the identification, so rightly put into question by Jim’s book, has been put into the trashcan where it belongs.

The use of an identifier in our first example breaks the second Law of Identity (Data Minimization - release no more data than necessary). It breaks the third Law too (Fewest Parties - since it discloses use of information to a central database unnecessary to the transaction). Finally, it breaks the Fourth Law (using an omnidirectional identifier when none is required)."