Burton Group Identity Blog

The Limited Liability Persona

We've been promising to introduce you to our concept of a "Limited Liability Persona" for some time now; Lori Rowland first introduced the idea in a Burton Group telebriefing on Internet Identity. Jamie Lewis previewed the concept for a wider audience at Digital ID World 2006, and Mike Neuenschwander gave you a preview in his recent blog entry on the Laws of Relation. Now it's time to dive into the idea in depth.

Corporations were invented during the age of exploration, when the risk associated with mounting an expedition to foreign lands was so high that no single person - even a rich noble - could underwrite a venture without running the risk of total financial ruin.

The fundamental ideas underlying the corporation are (1) the notion of a legal person distinct from a "natural person", (2) perpetual lifetime, and (3) limited liability.

Limited liability was critical to the idea of the corporation, because it allowed investors to put a strictly limited amount of money into a risky enterprise without having to take the chance of losing everything.

We're in a new age of exploration now - the Terra Incognita we're exploring is the Internet. It's a risky place. You could lose your identity, your privacy, even your bank account. In this new age of exploration, we need a way to invest a little of ourselves in an online venture (a purchase, say, or an online game, or maybe a social network) without taking the chance of losing everything. But individuals, who bear a lot of the risk in this new world, don't have many liability limitation tools available to them. This means, among other things, that when individuals deal with corporations online, the corporations assume less liability than the individuals do - a relational asymmetry which creates risks like those Mike discussed in his recent entry here.

Here at the Burton Group we've spent the last couple of years thinking about ways to help you build an identity you can use online without losing everything. We've come up with an idea we think is interesting; we call it the "Limited Liability Persona", or LLP. We know that the acronym (LLP) can easily be confused with the similar notion of a Limited Liability Partnership - so we're open to new names. If you've got a good one, drop us a line.

The basic idea is that an LLP would be a legally sanctioned and recognized virtual person in which you could "invest" some of your financial or identity resources, while holding the rest of your resources back so that they're not exposed to online risk. Once you created an LLP, you'd have the legal right to use it as an online "alter ego", even in commercial transactions. You can't really do this today; if you use an identity other than your own in a transaction, it's usually called "fraud" (but not always; people in the witness protection program, for example, are given government-sanctioned alter egos which they can use to avoid various privacy and safety risks).

What are the details? Well, since LLPs don't really exist yet, it's hard to be too specific. But in principle an LLP is a legal entity with a name:

1. Created by an action of a court
2. Owned by one or more individuals
3. With its own resources distinct from those of its owners
4. In which owners can invest new resources
5. With its own "identity attributes" distinct from those of its owners
6. Whose actions are legally distinct from those of the owners
(though the owners may be held accountable for those actions)
7. Whose resources may be transferred to its owners
8. Which can be sold by the owners to new owners
9. Whose existence can be terminated by its owners

What good is such a thing? Let's look at a couple of scenarios.

In the first scenario, I want to buy a bottle of wine over the internet from eBooze.com. eBooze can't sell me the wine unless they can confirm that I'm old enough to buy it legally (since I'm in the USA, this means I have to be 21). eBooze has a bit of a problem here; they've got to confirm my age, but who can they ask? They can ask me, but if I'm really a 16-year-old who's planning a party while his parents are out of town, there's a chance I won't tell them the truth (you'll have to trust me on this one...) They can ask the Texas DPS, which issued me a driver's license, but the DPS isn't in the business of answering questions like these. They could ask my parents, but they'd have to know how to find them.

Here's an example of what one online wine retailer actually does to address the age-verification problem - they leave it up to the UPS driver to confirm my age:

"By finalizing my order, I certify that I am at least 21 years of age. An adult signature (someone over 21 years old) will be required at delivery."

It's pretty much the only option until someone sets up an online age-verification service. But now imagine that I create an LLP. To do this, I have to file paperwork with a court in my state. The court can do a lot to verify my age. It can require me to present driver's license or maybe even my birth certificate. It can require me to appear in person, and can check to see that the picture on the license looks like me. It can mail something to the address on the driver's license and see if I receive it. And, of course, the court can refuse to add the identity attribute "over 21" to my LLP unless I jump through all these hoops.

Once I have my LLP with the "over 21" attribute, I can visit the wine merchant's site and the merchant can be assured - by the court which created the LLP - that it's dealing with an entity which can legally order and receive alcohol. Note that I do not have to give the merchant my date of birth, and I don't have to produce any documents attesting to my age; the LLP's "over 21" attribute already does that, and its authenticity is attested by the court which created it (in a way that's consistent with my notion of an Identity Oracle. And here's another good thing - the court can also make me sign a statement agreeing not to provide anything inappropriate to minors as a condition of creating the LLP. This allows ME to assume liability for the actions of the LLP. This lets eBooze off the liability hook when it's dealing with LLPs - which is a good reason for it to prefer doing business with LLPs to doing business (in a privacy-intrusive way) with plain old humans.

In the second scenario, I want to be able to buy things online, but I don't want to expose my personal bank account to online thieves and fraudsters.

So instead of using my own bank account and credit card for online purchases, I head down to the courthouse and set up an LLP. I take the LLP "articles of embodiment", with the court's seal, down to my bank. I give the banker $2000 and the LLP paperwork, and ask him to set up an account in the LLP's name, and issue a secured credit card (with no overdraft protection) in that name.

This gives me an online identity with a $2000 line of credit. I can't overspend, because the bank will decline my transaction if there isn't enough money in the account to cover the attempted purchase - so the most I can possibly lose to an online scam is $2000. If I spend $1000 and want to spend another $1500, I have to transfer some more money into the LLP's account. And, of course, my own personal bank account and credit card information never have to be used on the Internet.

The idea can be extended much further. I can create "accounts" for things other than money. I could create an "account" with a subset of my personal information - so, for example, I could let the LLP have my state of residence and age, but not my name, religious affiliation, union membership, sexual preference, or criminal record. This puts a barrier between my online persona and my real self - and it limits both my liability and my exposure to risk. It's important to note that the LLP protects me against various attacks on my identity and resources by hackers, phishers, and other bad guys, and it also protects me against disclosure of a lot of my private information to commercial entities like online retailers. It does not, however, keep my personal information secret from the government. But it still does protect against certain forms of government data collection: the government can't compel a retailer to disclose information about me if I never gave the retailer the information in the first place because I was using an LLP identity instead of my own personal identity for a transaction.

LLPs don't exist today because the necessary legal structures haven't been set up - though we might be able to start experimenting with the idea using existing Limited Liability Partnership or Limited Liability Corporation structures. It'll probably turn out that the existing structures are "too heavyweight" and have some characteristics which make them hard to use to build Limited Liability Personas with all the characteristics we want. But the necessary legal structures can be put in place if we need them, and we can think of lots of good reasons they should exist and no good reasons they shouldn't. We'd love to hear your thoughts on the subject. You'll be hearing more of our thoughts soon on this blog.

[posted by Bob Blakley]

In America, who’s watching the watchers?

The initiation of a joint ANSI and Better Business Bureau effort to establish guidelines or standards to prevent identity theft (Identity Theft Prevention and Identity Management Standards Panel (IDSP).) appears to represent another case of business protecting itself. On the surface, the list of participants (TransUnion, ANSI, BBB, AT&T, ChoicePoint, Citi, Dell Inc., Intersections Inc., Microsoft, Staples, Inc., and Visa U.S.A.) does not include anyone who could be viewed as a consumer advocate, and this could be the fly in the ointment. To achieve a sense of privacy, the individual in question needs appropriate control of his or her associated identity information. So long as businesses view identity information as their own information assets, privacy is a pipe dream. Businesses, and government, need to change their perspective from one of owners, to one of stewards of personally identifiable information (PII). This corresponds to Bob Blakely’s 2006 Catalyst presentation and Mike Neuenschwander’s recent post about the Law of Relational Symmetry, where, ideally, the balance of control is effectively shared.

The issue hitting home is one that a friend of mine recently discovered. He was surprised to learn how much PII is actually available on-line. He expressed his dismay to all of his friends and asserted how he’d take this issue to his congressman. My response was; “Too late, you have no right to privacy in this country.” The information is out there and freely available, or available (like Social Security Numbers) for a fee. Going to Congress may get traction, perhaps for the wrong reasons. Like business, government is in the business of collecting and leveraging this information for its own purposes, not protecting it from misappropriation and misuse.

Today, the strength of control over information is not in the hands of the individual, it is in the hands of the aggregator. What constitutes value in the relationships of identities with business and government is in their interaction. A secondary, fairly invisible market exists in the management, analysis, exchange and sale of identity information. Privacy policies have been highlighted to protect consumers in web-based transactions, but this is the tip of the iceberg in terms of the overall identity information market, which falls under the auspices of a patchwork of regulations, if at all.

The issue to individuals is the unintended and unapproved use of PII. The pendulum of control needs to swing in their direction. The challenge is organization. There are few (if any) advocates for individuals with the power or funds to affect change. Even with the Health Insurance Portability and Accountability Act (HIPAA), the real benefits are to the health care and insurance providers, not necessarily the patients it nominally protects. Individuals also don’t see the lack of control as something to lose sleep over, until something annoying or catastrophic occurs, at which point the burden of recovery lands squarely in their lap. It is then that they realize that the treatment and handling of identity information, like weapons, needs to be controlled, and that they need to be an active participant, if not the key controller in the process.

Identity information can be measured as a tangible asset, and the challenge is control. HIPAA is about control, so is the U.S. National Do-Not-Call list (notwithstanding the recent deluge of calls from political candidates). What is missing for my friend and for all of us is the ability to exert influence in a consolidated and effective manner. The time is coming when the paying for the cost of an advocate for individuals will be a more effective investment than paying for credit reports, fraud insurance, recovery from identity theft, and similar expenses associated with identity information charged to the consumer. It is interesting that the same people who profit from collecting this information today want to profit from allowing us to protect it, rather than share the profits. It’s another indicator for wresting control from business and the government.

A highly successful model for the balance of control is a lobbying organization like the National Rifle Association. One doesn’t have to advocate their cause or the positions they represent in order to acknowledge their effectiveness. A small but highly vocal community has essentially held regulation and control in check, in opposition to a variety of constituencies. For example, when one buys a firearm in the United States, detailed background information about the buyer is collected by the dealer and exchanged with the federal government for a go/no go decision on the purchase. This information is only kept on line for a matter of days, then deleted, in part because of the influence of the NRA to prohibit gun and owner registration. This also supports the idea that some of this information is transactional and should not remain available indefinitely.

If we view identity as an asset that needs protection, regulation, and control, it becomes apparent that individual control over personal information is viable and necessary. It comes down to recognition of the problem and clear objectives to establish and maintain the rights of individuals. The damage that the lack of control over identity information can cause is apparent. The mechanism for developing an individual advocacy also exists. The present lack of inclusion of an independent advocate in “industry” initiatives will help to make it a priority.

[posted by Kevin Kampman]

Second Life’s Second Chance

In today’s modern Information Age it is hardly possible to open a news magazine without being inundated with headlines detailing the latest data security breach or identity theft. As an online consumer I have become somewhat numb to such announcements. Perhaps it is the pure volume of the announcements, but more likely it is my perceived risk or lack thereof. It appears that I am not alone in this sentiment. Consumers share more information electronically then ever before and seem unwilling to adopt stronger authentication mechanisms such as smart cards.

Although I am at least partially impervious to these headlines, one in particular captured my attention. In September, Linden Labs reported a database security breach. According to the company, the database was accessed through a “0-Day Exploit.” The breach potentially exposed customer data including unencrypted names and addresses, and the encrypted passwords and payment data of Second Life users. The company was unable to determine the individuals whose data was compromised. In response, Linden Labs required all users to change their passwords before logging onto their accounts and launched further investigations into the cause of the breach.

At first glance, this breach does not seem out of the ordinary. To understand its uniqueness you must first understand the nature of Second Life. Since its inception in 2003 the virtual world has grown to include over one million virtual inhabitants. Second Life users create Avatars (virtual personas) that conduct business, buy land, build wealth, and socialize much like real human beings. Each Second Life user account may consist of multiple Avatars, which in turn own multiple plots of land and businesses. Real- world businesses (e.g. Wells Fargo, Reuters, Nissan) are advertising and selling goods in Second Life’s virtual world. Second Life currency (called Linden dollars) can be exchanged for U.S. dollars, “virtually” turning it into a real world economy. According to this Reuter’s article, up to 135.5 million Linden dollars (about US $500,000), changes hands every day among Second Life’s 900,000 registered users.

Perhaps the most significant security risk associated with the Second Life database breach was not the exposure of Second Life end-user credit card data, but the unauthorized access to a world of wealth – albeit a virtual one. By obtaining a user’s authentication information, intruders have access to the user’s virtual persona, land, and businesses, which can all be sold or traded for U.S. dollars. Second Life users volunteer real world personal data (i.e. name, address, credit card data) allowing them to participate in an anonymous, virtual world. As with many virtual games and online communities, Second Life users freely participate under the blanket of anonymity. But what happens when the two the worlds collide? Where does the liability end?

Second Life offers its users a sense of anonymity by requiring users to create avatars—which have virtual lives separate from users of the game. Under the guise of an avatar, users often participate in risky behavior—such as divulging sensitive information and being more open about their buying patterns, social behaviors, business ideas, and relationships – that they would not likely do in their “real” lives. Accordingly, the breach at Second Life may prove more than just a financial loss for affected users: it has potentially unmasked the avatars by exposing data that linked users’ previously anonymous avatar accounts to their real-world identities. By associating the two identities, the breach uncovered potentially sensitive data (volunteered under the cloak of anonymity) and compromised users’ privacy.

As Shakespeare so eloquently put it, “What’s in a name? that which we call a rose By any other name would smell as sweet.” As the tragic ending of Romeo and Juliet demonstrates, perhaps there is too much in a name (or an identity), particularly in a virtual world. I am known as “wife,” “mom,” “co-worker,” “teacher,” “friend,” “customer,” and I am sure a few others I don’t care to admit. But in each of these roles I am uniquely different. In my day-to-day interactions I combine these identities into a common context at my discretion only. As the web evolves into a more user-centric model, one must be granted the same level of control over their online identity as is afforded in face-to-face human interactions. Users must have ownership over the information they share about themselves, with whom it is shared, and in what context it is used. A user’s identification (authentication data) can no longer equate to and expose the user’s complete identity or personal history. The success of a user-centric web depends on active user involvement; risks must be mitigated to encourage such use.

To date, Second Life has not reported any malicious activities caused by the breach. They have a second chance. But perhaps the second chance is really ours as Internet users. We have a chance to evaluate how we participate in such communities, and whether the web will evolve into a user-secure environment.

[posted by Lori Rowland]