In Context

Below is a version 0.1 ecosystem map of providers of four things: source code, communities, technical specifications and products that you can use right now. All are about promoting dignity–”the state or quality of being worthy of honor or respect”–of individuals. In place of dignity I could have used other words like autonomy, independence, re-decentralization, personal sovereignty, etc. Anything to do with today’s status quo web of centralized, websites and services is out of scope. My personal bias towards user-managed identity and personal data ownership/control is also noted.

Some terminology:

• Cloud-Free (P2P): Minimal or no dependency on cloud-based services
• Federated Cloud: Multiple independently hosted servers/services interconnected using common protocols
• Hostable: Can be self-hosted or hosted by a 3rd party provider of your choosing
• $: Paid service

Hyperlinked version of the above (even cooler!)

I missed this post on Life Management Platforms (LMPs) by KuppingerCole a year ago. Martin writes:

Life Management Platforms will be among the biggest things in IT within the next ten years. They are different from “Personal Data Stores” in the sense of adding what we call “apps” to the data stores and being able to work with different personal data stores. So they allow to securely working with personal data by using such apps which consume but not unveil that data – in contrast to a data store which just could provide or allow access to personal data. They thus are more active and will allow every one of us to deal with his personal data while enforcing privacy and security. Regarding “Personal Clouds”, that might be or become Life Management Platforms. However I struggle with that term given that it is used for so many different things. I thus prefer to avoid it. Both today’s personal data stores and personal clouds have a clear potential to evolve towards Life Management Platforms – let’s wait and see. I’ve recently written a report on Life Management Platforms, describing the basic concepts and looking at several aspects like business cases. This report is available for free.

The key sentence is:

“They are different from “Personal Data Stores” in the sense of adding what we call “apps” to the data stores”

I agree with this need to add apps to PDSes. This is similar to what we worked on back in the heady Information Card days. In 2009 when we saw that getting adoption of pure InfoCards was going to be a long march, we tried to add the concept of “apps” to the data held in the InfoCard (or better yet “pointed to it by an r-card). We called them app-cards–a superset of InfoCards. We decided to integrate Kynetx‘s KRL technology to implement these apps. Which means the apps got executed in the cloud.

I share Drummond’s perspective on this issue. When I describe the concept of a Personal Data Store to techies I’m constantly having to explain that it’s about centralizing control over personal data, but not centralizing its location.

David Siegel calls it a Personal Data Locker, others Personal Data Space or Personal Data Vault. W3C folks are working on Personal Data Wiki. I was just on a VRM call today. At Drummond’s suggestion a bunch of us are going to try to create wikipedia entries, and hopefully a diagram (as Iain Henderson suggested) that define some common terms. It would be helpful at this early “market development” stage to have a common set of terms that developers and techies can understand. Here are my contributions:

Terms:

• Personal Data Service (PDS) – A service that enables the user to participate as a peer within a distributed personal data ecosystem. A PDS provides one or more of the following services: (a) a web portal that provides a dashboard view of the user’s data, the ability update self-asserted data, and a way to manage authorizations (e.g. using something like an UMA Authorization Manager) and set policies under which 3rd parties gain access to portion of the user’s information, (b) supports a Discovery API that allows you to be discoverable by other people, organizations, apps and exchanges whose inquiries that meet criteria you specify, and (c) provides an identity provider (IdP) endpoint (e.g. OpenID OP)
• Attribute Data Service – Service that (A) locally stores your self-asserted data attributes, makes them available via APIs, and supports active clients. Ideally these self-asserted data are stored in encrypted form using a key that the PDS operator does not know. It also (B) maps data from both external data services (e.g. Facebook, etc.) as well as from external Personal Data Services (e.g. your friend’s PDS or a PDS managed by your favorite telco), makes it all available via APIs (e.g. XDI, SPARQL, oStatus, etc.), and supports active clients.
• 3rd Party App – A web app that consumes data from the PDS. These include information refineries –a kind of app that reads datasets from the PDS, refines them, and writes them back to the PDS user. The refinery process includes analytics, inferencing, segmentation, etc. Refineries generally to create higher value, more refined data from the more raw forms of data, while often also making the data sets less personally identifying. These also include information exchanges–a kind of PDS App that is involved in creating personal data exchanges analogous to a stock exchange. An exchange itself is a platform that supports yet another layer of apps above it [this is not shown above].

Couldn’t resist drawing a picture:

Comparing two “standards” stacks and one implementation project (Higgins):

Kudos to the WSJ for publishing these articles. It takes guts to shine  light on a topic that’s sure to cause heartburn in the CEOs of some of Wall Street’s Internet darlings. And the IAB. Do I sense moral courage? What’s the world coming to! Have a look…

From the Sites Feed Personal Details To New Tracking Industry July 30th:

The largest U.S. websites are installing new and intrusive consumer-tracking technologies on the computers of people visiting their sites—in some cases, more than 100 tracking tools at a time—a Wall Street Journal investigation has found.

The tracking files represent the leading edge of a lightly regulated, emerging industry of data-gatherers who are in effect establishing a new business model for the Internet: one based on intensive surveillance of people to sell data about, and predictions of, their interests and activities, in real time.

….

If “you were in the Gap, and the sales associate said to you, ‘OK, from now on, since you shopped here today, we are going to follow you around the mall and view your consumer transactions,’ no person would ever agree to that,” Sen. George LeMieux, R-Florida, said this week in a Senate hearing on Internet privacy.

Active clients and personal data stores resolve these thorny privacy issues in the best way possible. Why? because they shift of control of  capture and disclosure of a person’s data to the person.

The online advertising industry will eventually get there. The FTC will too. The EU is getting there fastest. See for example, Making the FTC Look Tame: The EU Targets Behavioral Profiling in the July 26, 2010 in Privacy & Security Law Report:

Last month, Europe took a major step toward a notice and opt-in regulatory model for behavioral advertising. On June 22, the Article 29 Working Party, the EU-level data protection advisory body comprised of representatives of all EU member state data protection authorities, issued a detailed and very restrictive opinion on online behavioral advertising. The opinion requires network advertisers to obtain user opt-in to placement of advertising cookies on user devices, to provide prominent notice of profiling, and to erase cookies periodically. It also requires website publishers to inform the visitors about the ad network used and the profiling that takes place. The Working Party will reach out to industry stakeholders and invites public comment and a “dialogue” with industry regarding how to implement the broad principles it articulates in the opinion

And then again on the same day (July 30th) from the WSJ: The Web’s New Gold Mine: Your Secrets. A Journal investigation finds that one of the fastest-growing businesses on the Internet is the business of spying on consumers. First in a series.

And checkout the excellent What They Know tool. Graphics, data, explore!

On the morning of July 5th I had breakfast with Iain Henderson and David Alexander of Mydex. And then, within 5 minutes of walking in to the IoS meeting I met Serge, Sampo and Graham. Between meeting them on the one hand and the breakfast on the other I knew the whole trip was worthwhile. It’s a great pleasure to spend time with people who share the vision of giving individuals more control over their own personal data. We all had a chance to share what we’re all learning about creating Personal Data Stores, VRM (TRM?), user managed identity, data portability, etc.

Check out Internet of Subjects. This is a new effort that deserves our support. I particularly like the fact that it’s not based in the (privacy-challenged) US. The effort is being indirectly supported by EU investments in TAS3, a project that I’m only now learning about.

Here’s a quote from Graham Sadd’s post about the IoS meeting:

Serge Ravet, CEO of EIfEL, prefaced the Eifel Learning Forum with the inaugural Internet of Subjects Forum to an international audience in London yesterday. The plenary presentations were made by Sampo Kellomaki, Chief Architect at Symlabs, Graham Sadd, Founder & CEO of PAOGA (read interview) and Paul Trevithick – Founder of Higgins Project and CEO of Azigo.

Well, here’s a new organization, iosf.org, that I should have known about. I hope I can get to their event. It’s on July 5th and I have to be in Paris on the 6th for an Information Card workshop with FC2. Hmmm…should be possible.