I've been delivering the closing keynote at Digital ID World (DIDW) since October 2002, when the show began. I've given it five times so far. From the beginning I've had a case to make. Here it is:

Andre Durand of Ping Identity Corp., on whose advisory board I now serve, inspired this thinking in 2001, when he was putting the company together. I wrote about Andre and Ping in “Identity from the Inside Out”, in the May 2002 issue of Linux Journal. In it I describe Andre's three-tier view of identity:

When Andre laid this out for me the first time, I knew instantly that we could liberate markets simply by developing the means for individuals to assert their sovereign identities. It was a moment of revelation—like Neo had, just before he said “It's about choice” to the architect of The Matrix. In fact, The Matrix, one of my favorite movies ever, suddenly made sense as an allegory for the false world invented by marketing, where consumers live in blissful ignorance of their role as batteries whose energy maintains that world.

By the middle of 2004, however, I had begun to lose faith. Even Ping Identity was caught up with the rest of the supply side in a conversation about federation. In an interview last year, Eric Norlin, Director of Marketing at Ping Identity, said federation “leaves the distributed environment as it is, but seeks to let end users link together those pieces and still have control over their privacy, what gets shared, and how.” He said the Liberty Alliance spec, for example, “is purposefully designed to be opaque. [It] tries to accomplish one thing...to allow one end user to link one account to another account. But in order to protect the privacy of the end user...neither side of that account—either Company A or Company B—would know who the end user is that is being passed between them.”

I've summarized this as “large companies having safe sex using customer data”.

Federation is a big company concern, essentially a silo-to-silo “solution”—so far. Liberty Alliance isn't the only consortium devoted to federation. The other big one is WS-I, where WS stands for Web services. WS-I was founded by Microsoft, IBM and Verisign, partly in response to the Liberty Alliance, which was founded by Sun, partly in response to Microsoft's Passport. Anyway, the more I heard about federation, the more depressed I became about the prospects for Independent Identity.

Then, during LinuxWorld Expo in August 2004, I met Kaliya (“Identity Woman”) Hamlin at a San Francisco Giants baseball game. She told me she worked with Identity Commons, a grass-roots organization with a market-opening plan that leveraged some standards, notably XRI and XDI, and encouraged new ones, such as i-Names. A series of conversations with various Identity Commons people armed me with plenty of fodder for my keynote at DIDW in October 2004. I wrote up the story behind that keynote in “What's Your i-Name?”, my column for the January 2005 issue of Linux Journal. In that piece, I made something of a bet about Independent Identity: “We're not going to get that from the big vendors, for the same reason we didn't get Linux from big computer makers: big suppliers in any category have trouble pioneering anything that's good for everybody and not only for them.”

I was wrong about that. When the conversation started to heat up after DIDW, the Neo role was being played by a character with the unlikely title of “Architect”, working inside the most unlikely company of all: Microsoft. Kim Cameron is his name, and his architecture is the Identity Metasystem. Note that I don't say “Microsoft's Identity Metasystem”. That's because Kim and Microsoft are going out of their way to be nonproprietary about it. They know they can't force an identity system on the world. They tried that already with Passport and failed miserably.

Kim came to Microsoft by way of acquisition, when Microsoft bought Zoomit, a Toronto company specializing in the “metadirectory” field. I came to know Kim through Craig Burton of The Burton Group, back in the early 1990s. Craig and his organization saw non-interoperable directories as a problem that could be solved only by a system that was intentionally inclusive and respectful toward all directories and their countless differences. Craig labeled the required system a metadirectory and called for vendors to fill the market's need for one. Kim and Zoomit stepped forward and developed a metadirectory product, along with a lot of deep thinking about directories and related issues, including security and identity. During that time I became good friends with Kim, an occasional consultant to Zoomit.

Microsoft acquired Zoomit at about the time it was becoming clear that Passport was failing. At Microsoft Kim took a leading role in re-thinking the company's approach to identity. It became clear to him that taking a “meta” approach would open a whole new marketplace—for Microsoft and everybody else:

Craig Burton took a natural interest in Kim's identity work at Microsoft. Before DIDW/2004, Craig began telling me that Kim's architecture had the potential to seed and support—in an open way—the kind of grass-roots movement I'm looking for.

So I made sure Kim got to connect with the other grass-roots advocates attending the conference: Drummond Reed, Fen LaBalme, Mark LeMaitre, Kaliya Hamlin, Jan Hauser and Owen Davis of Identity Commons and also, for several on that list, of Seattle-based Cordance; Dick Hardt of Sxip; Marc Canter, currently of Broadband Mechanics but perhaps best known as a founder of Macromind, which later became Macromedia; Simon Grice of MiDentity; and Phil Windley of Brigham Young University, also the former CIO of Utah and the author of a new book from O'Reilly on digital identity. All are open-source and open standards advocates, and all consider open-source involvement essential to the success of whatever it was Kim and Microsoft had in the works, which still wasn't clear at the time.

An informal group began to form. Meetings followed in Seattle and other places. And right after DIDW/2004, Kim also began posting his Seven Laws of Identity. He did this on an installment plan to give everybody time to talk about each one before moving on to the next. His First Law appeared on November 16, 2004, and his Seventh Law appeared in March 2005. In summary form, here they are:

The Laws serve two purposes. The first is to guide conversation and development in an emerging marketplace. The second is to guide conversation and development inside Microsoft. Kim says he often finds himself saying stuff like, “No, that would break the Fifth Law” or “That misses the point of the Seventh Law.”

Microsoft is and will remain an issue. In October and November 2004, Marc Canter and others wondered out loud about how we could ever trust the company or its partners, such as Sun Microsystems. Craig Burton acknowledged the problem in a December 4th blog posting:

Perspective: Craig fought Microsoft when he was at Novell in the 1980s—and usually won. One high-level Microsoft executive told me years later that Craig was perhaps the only leader at a competing company that truly understood how to compete and win against Microsoft. Craig continues:

The most significant push-back we received was from Dave Winer, whom Kim considered to be an important role model. Dave had success at launching standards, including XML-RPC, SOAP—which Dave and his company, Userland, co-developed with Microsoft—and RSS, and he made it all happen without the clout of a large organization behind him. RSS was an especially interesting case, because it established a service, syndication, that is rapidly moving toward ubiquity.

On his blog, Scripting News, Dave wrote:

I didn't think identity was spoiled in the least. But I also realized something. Identity needs a Dave Winer: an independent developer and free-range technologist who tirelessly advocates something that can work for everybody.

On December 30th, Steve Gillmor called. He was hunting up guests for the “Gillmor Gang” scheduled the next day: New Year's Eve. I suggested bringing in the “Identity Gang”—or as many as wanted to come on the show. Steve said yes, and I sent out an e-mail to nine people, including Dave Winer, whose experience, example and skepticism I thought were essential. To my surprise, nearly all of them, including Dave, agreed and took part in the show.

The conversation was all over the place. But it served as a public meeting to which many could listen and link. The “Identity Gang” show was energizing. Starting on January 1, 2005, I saw Independent Identity issues being discussed—not only in blogs and podcasts but in trade pubs and in halls at conferences—with considerable optimism. In the past, discussions always seemed to go sideways into energy-draining digressions on privacy, crypto and other muddy subjects, such as “Microsoft Sucks”.

Kim bled off a lot of steam by publishing his Fifth Law on New Year's Day. Craig Burton wrote this about it:

The Identity Metasystem looked to each of us—so far as we could understand it, which wasn't enough—as though it had the makings of a Net-native system that would embrace and accommodate everybody's separate efforts. It helped especially that Drummond Reed and the Identity Commons people already were figuring out ways of working with the Identity Metasystem.

Kim also demonstrated InfoCards, a Microsoft identity implementation that can work within the Metasystem. Everybody was eager to think about or find other implementations—so nobody would confuse the InfoCard implementation with the Identity Metasystem architecture. At one point I asked if it was possible for InfoCards, or anything Microsoft was doing in the Identity Metasystem framework, to plug in to Firefox. Kim said, “Yes, of course.” I invited Mitchell Baker to the next meeting we held, and she and Kim agreed that it ought to be workable.

The Identity Gang has grown since then. DIDW gave us a room to use on May 8th, the day before the show started. About 40 people met all day around a large table. Kim explained the Identity Metasystem in more detail than we had heard before. There was a lot of discussion, including plenty of skepticism, but more than enough positive energy to keep everybody interested.

Since then, Kim and his team have published a whitepaper titled “Microsoft's Vision for an Identity Metasystem”. The paper outlines the architecture in some detail. Here are the key paragraphs:

Figure 1 shows the graphic illustration.

Figure 1. The WS-* Architecture

The Independent Identity would be one of the ID providers, part of the metasystem. It could be hosted locally, on a Linux box in the clouds, on a phone—wherever someone wanted to put one.

I've told Kim that he and Microsoft need to do more before my constituency—the Linux and Open Source development communities—takes a serious interest in the Identity Metasystem. I said, “If you don't have an open-source license or if you start talking about IP Frameworks, my readers will leave the room.” The term IP Frameworks was used by somebody from another part of Microsoft, in respect to the WS-* standards process. Kim replied:

As for open-source licensing, Kim has said encouraging things to me privately, but for now there's nothing to report. I'm hoping, for everybody's sake, there will be an accepted open-source license or licenses in place by the time you read this.

Meanwhile, everybody in the open-source camp seems to be scratching their own itches, each in their own simplifying way.

Open ID says, “This is a distributed identity system, but one that's actually distributed and doesn't entirely crumble if one company turns evil or goes out of business.” Its identities are URL-based.

LID's goal is to “empower individuals to keep control over and manage their digital identities, using VCards, FOAF and GPG. It is very REST-ful and fully decentralized. It is also a great mechanism to add accountability to REST-based Web services, even if no (human) digital identities are involved.” Johannes Ernst, one of LID's creators, says “it's the simplest scheme there is, so simple that, just like a few other folks have done already, you can probably implement it yourself over the weekend and add five new profiles to it that we didn't even think of.” There are several LAMP and J2EE implementations available for download.

Sxip is more ambitious and has several parts. Sxip.net (Sxip Network) is “a simple, secure and open digital identity network that offers a user-centric and decentralized approach to identity management. This key piece of Internet infrastructure, based on a network architecture similar to DNS, can be used by people to develop their own identity management solutions, enabling distinct and portable Internet identities.” Sxip.com (Sxip Identity) “provides identity management solutions that leverage the Sxip Network and drive Identity 2.0 infrastructure. Sxip empowers individuals to create and manage their on-line digital identities and enables enterprises to instantly provision and manage their users.” Sxip.org provides developer resources, including a Subversion code repository.

Moebius “builds on the success of e-mail-based identity systems by adding a few important but incremental improvements while laying the foundation for more advanced identity systems in the future. Moebius is more convenient to use, easier to deploy and safer for all concerned, without requiring expensive investments in new infrastructure or adoption of untried, centralized identity systems.” Editors' Note: Moebius has changed its name to Passel.

There are other open-source and Linux-related efforts around identity, and I'm sure this article will flush out those who feel offended by their exclusion. I invite them to join the Identity Gang or whatever name it uses by the time you read this.

Things are moving so fast, in so many directions at once and with so many individuals involved, that it's impossible to cover the subject completely. This piece sets a record of frustration for me, personally. I've been working on it since January, and I've rewritten it countless times. I was going through a series of rewrites when I missed my deadline last month. And I almost decided to make it a Linux Journal Web site piece several days ago, when I still wasn't sure if Kim and his Identity Metasystem would take the heat from interested skeptics like Julian Bond and Dave Smith—or from those of us (a percentage that rounds to “everybody”) who see a lock-in agenda behind every Microsoft move. So I posted some tough public questions on IT Garage. Kim has met every challenge with grace, humor and backbone. I'm sure he needs all three to make this project fly inside Microsoft.

I also want to thank Microsoft for giving Kim a way to apply his genius. If this thing flies, high fives are due all around.

The best any of us can do is stay true to our own principles and purposes. Kim's are embodied in his “meta” understanding of the world. The man is the best includer I've ever known. Microsoft is lucky in the extreme to have him working there. Mine are embodied in an NEA understanding of the Net—as something Nobody can own, Everybody can use and Anybody can improve.

There is an improvement I want to see, and it's something only Independent Identities can produce. I want anybody to be able to pay for anything on a voluntary basis, because I believe the voluntary ability to pay whatever one wants is at the heart of a free and open marketplace. I also believe we haven't experienced that power since the Industrial Revolution put huge suppliers in charge, even of democratic governments. We certainly haven't had it since the invention of the price tag.

I'm not saying I want to turn every store into a commodities pit where everybody haggles over prices. I'm not saying “Let's get rid of fixed prices.” I am saying, let's give consumers the power to be customers. I am saying, let's start by making this work in markets where no prices have yet been set, where sellers and buyers don't yet have the means for discovering what their goods are worth, where—because that mechanism is absent—most of the goods are free, as in beer.

I have two markets in mind: “podsafe” (non-RIAA, Creative Commons-licensed) music and podcasts. I would like to be able to express my willingness to pay for music I like and for podcasts I like and to do that at my discretion, quickly and easily. And, to extend that ability to other services that welcome voluntary payment, such as public radio and TV, churches, charities and so on.

I would like that capability to be built in to my browser, as a plugin probably, and my RSS aggregator. Later, I'd like to see it in cell phones and other mobile devices.

I would like the Open Source community to step into those markets with me and say, “We have a way that anybody can pay anybody for anything, on their own or mutually agreeable terms.” And free has to be an alternative. Free still has to be okay.

You might say I'm talking about a more robust shareware market here. One where suppliers don't beg or cajole, make goods scarce or call those who get goods for free “pirates”. I'm talking about making the Net as open and responsible as a farmers market: a place where customers are as unlikely to filch from an artist's site as they are to take an apple from a farmer's cart. And where artists of all kinds still can give away all they like.

Can this be done? I don't know. I can think of a hundred reasons why it can't. I'm sure the rest of you can think of more. Between me writing the last sentence and this one, Johannes Ernst wrote this to me:

I want to give the old choose-your-silo system a bad case of Innovator's Dilemma. We need something disruptive here. Something simple and new. An invention that mothers necessity.

We won't get it if we get bogged down in long-winded digressions about privacy and crypto and the big awful companies that want to keep their hands—oops, credit and membership cards—in our pockets. Those are legitimate and necessary concerns, but they are secondary to the purpose of establishing methods and protocols and technologies for the assertion of Independent Identity. And for changing the world by saving markets from the producerist mentality that has kept everybody, producers included, in darkness for more than a century.

I also feel certain that forces far more nefarious than Microsoft are hell-bent on putting the Net genie back in the telco and cableco bottles—and turning it into the distribution system for “protected content” they imagined when they made sure the “information superhighway” had asymmetrical driveways to every “consumer's” home.

If we don't want that, we have to show we're customers and not just consumers. And real customers don't just shop in silos.

Resources for this article: /article/8401.