I was recently editing my long “ecological identity” paper from last year and I was reminded how we tend to complicate identity when we speak about it. Here’s a passage from that paper, which argues that the language we use is important. I contend we don’t need to introduce new technical definitions around identity. Furthermore, I think if we returned to plain language, we might actually see federated identity differently.
Why for instance do orthodox identity engineers insist that authentication and authorization are fundamentally different things? The idea that roles are secondary to identity dates back to 1960’s era Logical Access Control. It’s an arbitrary distinction not usually seen in the the real world. Authorization is what really matters in most business, not identity. For instance, no pharmacist identifies a doctor before relying on a prescription; the prescription itself, written on an official watermarked form confers the necessary authority. Context is vital; in fact it’s often the case that “the medium is the authentication” (with apologies to Marshall McLuhan).
What follows is extracted from Identities Evolve: Why federated identity is easier said than done, AusCERT Security Conference, 2011.
The word “identity” means different things to different people. I believe it is futile quoting dictionary definitions in an attempt to disambiguate something like identity (in fact, when a perfectly ordinary word attracts technical definition, it’s a sure sign that misunderstanding is around the corner). Instead of forcing precision on the term, we should actually respect its ambiguity! Consider that in life we are completely at ease with the complexity and nuance of identity. We understand the different flavours of personal identity, national identity and corporate identity. We talk intuitively about identifying with friends, family, communities, companies, sports teams, suburbs, cities, countries, flags, causes, fashions and styles. In multiculturalism, whether or not we agree on the politics of this challenging topic, we understand what is meant by the mingling or the co-existence or the adoption of cultural identities. The idea of “multiple personality syndrome” makes perfect sense to lay people (regardless of its clinical controversies). Identity is not absolute, but instead dilates in time and space. Most of us know how it feels at a high school re-union to no longer identify with the young person we once were, and to have to edit ourselves in real time to better fit how we and others remember us. And it seems clear that we switch identities unconsciously, when for example we change from work garb to casual clothes, or when we wear our team’s colours to a football match.
Yet when it comes to digital identity — that is, knowing and showing who we are online — we have made an embarrassing mess of it. Information technologists have taken it upon themselves to redefine the meaning of the word, while philosophically they don’t even agree if we should possess one identity or more.
We don’t need to make identity any more complicated than this: Identity is how someone is known. In life, people move in different circles and they often adopt different guises or identities in each of them. We have circles of colleagues, customers, fellow users, members, professionals, friends and so on — and we often have distinct identities in each of them. The old saw “don’t mix business and pleasure” plainly shows we instinctively keep some of our circles apart. The more formal circles — which happen to be the ones of greatest interest in e-business — have procedures that govern how people join them. To be known in a circle of a bank’s customers or a company’s employees or a profession means that you’ve met some prescribed criteria, thus establishing a relationship with the circle.
Kim Cameron’s seminal Laws of Identity define a Digital Identity as “a set of claims made by one digital subject about itself or another digital subject”. This is a relativistic definition; it stresses that context helps to grant meaning to any given identity. Cameron also recognised that this angle “does not jive with some widely held beliefs”, especially the common presumption that all identities must be unique in any one setting. He stressed instead that uniqueness in a context might have featured in many early systems but it was not necessarily so in all contexts.
So a Digital Identity is essentially a proxy for how one is known in a given circle; it represents someone in that context. Digital Identity is a powerful abstraction that hides a host of formalities, like the identification protocol, and the terms & conditions for operating in a particular circle, fine-tuned to the business environment. All modern identity thinking stresses that identity is context dependent; what this means in practical terms is that an identifier is usually meaningless outside its circle. For example, if we know that someone’s “account number” is 56236741, it’s probably meaningless without giving the bank/branch number as well (and that’s assuming the number is a bank account and not something from a different context altogether).
I contend that plain everyday language illuminates some of the problems that have hampered progress in federated identity. One of these is “interoperability”, a term that has self-evidently good connotations but which passes without a lot of examination. What can it mean for identities to “interoperate” across contexts? People obviously belong to many circles at once, but the simple fact of membership of any one circle (say the set of chartered accountants in Australia) doesn’t necessarily say anything about membership of another. That is to say, relationships don’t “interoperate”, and neither in general do identities.