options for managing the economy), business implications (in reducing costs and reshaping retailing) and social implications (because the costs of cash fall disproportionately on the poor while the benefits mainly accrue to criminals of various sorts).
Finally, because it’s fun. Everyone uses cash without really thinking about it, so picking on cash as a way of exploring the impact of new ways of thinking about identity is practical, understandable and (I so desperately hope) entertaining for the non-specialist.
With an effective identity infrastructure in place, there will be no need for a single medium of exchange, no need for fiat currency. If you know all of the counterparties to a transaction, and can establish their ‘credit’, then there is no need for cash. Identity substitutes for cash: when I go into Waitrose and pay with my John Lewis MasterCard, it’s an identity transaction. The terminal in Waitrose establishes that I have access to a line of credit that means that Waitrose will be paid. No actual money moves between my card and the Waitrose till. On the other hand, when I buy an apple from a market stall and pay for it with a pound coin, the stallholder doesn’t need to waste any time or money trying to establish who I am, because he doesn’t need to trust me. He just needs to trust the pound coin, which he self-assays. It’s not that there are no counterfeit pound coins, because there are, but that there are too few of them to disrupt commerce (and, to be honest, if you give the smallholder a counterfeit coin and he later detects the fraud, he will probably just palm it off onto someone else).
When managing reputation is efficient and implicit, the pound coin becomes uneconomic and so does everything that goes with it: the cash register, the ATM, the security guards. If you don’t need cash registers and ATMs, then the costs and complexity associated with handling currencies collapse. If it becomes my mobile phone talking to the chap at the market stall’s mobile phone, then there’s no reason to restrict our commerce to sterling, or euros, or, for that matter, any fiat currency. We can use Bitcoins or Microsoft Money. We can use kilowatt hours or Brixton Pounds. We can use gold-backed e-Dinars or trade-backed barter currencies. We can use Dave’s Dollars.
If you don’t like their money, you can start your own. If the identity and authentication infrastructure is in place, it will be easy. Focusing on money, then, I think I can say that the impact of the new identity will be profound: so profound, in fact, that identity will be the new money.
Implications
So I argue here that identity becomes the key to transactions and a crucial individual resource that needs to be looked after by responsible organizations. We all need to start planning for the transition to identity-based transactions.
There is the social impact to be considered. We need to find a way for the infrastructure to deliver privacy and security to individuals and organizations. There should be no further discussion of the ‘balancing’ of privacy and security as if there is an unavoidable trade-off between them. We need both.
The business impact will be, inevitably, creative destruction at the heart of capitalism. New businesses, and new business models, will spring up to use the new technology and the new social graph.
Finally, the technological impact will shape the trajectory of new products and services. If there is some form of utility identity infrastructure that, as I hope, delivers both privacy and security to people, devices and organizations, then it should be standardized and accessible for open, transparent and non-discriminatory use.
This book ends by considering these impacts, and making three practical and positive suggestions for policymakers.
Chapter 2
Identity is broken
I am not made like any of those I have seen. I venture to believe that I am not made like any of those who are in existence. If I am not better, at least I am different.
Jean Jacques Rousseau (1712–78)
A letter in the Daily Telegraph’s ‘Money’ section (2 October 2009) sprang out at me because it exemplified the problem of identity in modern life. The letter came from someone who had tried to open a bank account with HSBC, but who didn’t have a current passport or driving licence. She wrote: ‘When I explained this at a branch, it was suggested that I ask the police station for proof of identity.’ She dutifully went to the local constabulary, who told her that they had never heard of such a thing unless she had a criminal record. Thinking it seemed odd that you can only have a bank account if you have a criminal record, she returned to the branch to be shown a list of documents that the bank would consider acceptable for the purposes of account opening, and this time they suggested a letter from Her Majesty’s Revenue & Customs (HMRC). She reports ‘I duly went to the local tax office, where the assistant said she wished banks would stop sending people there... they would not waste public money providing such letters for banks.’
The letter goes on to list the documents that she had presented and had had rejected by the bank: an out-of-date passport, a birth certificate, a current payslip from an employer (the local council, for which she had worked for more than two decades), a work ID card (complete with microchip), utility bills, statements from another bank, house deeds and a voting card. Any one of these would have got you a job with the bank, but not, it seems, an account.
In a way, oddly, banks don’t really care about your identity. They care about the credit history of whatever persistent persona you present to them. They are complying with stringent ‘know your customer’ (KYC) regulations. These have nothing to do with any real identity security. At the moment, if you come and open an account with, say, a North Korean passport, the bank cannot possibly know whether it is a genuine passport or not, but it doesn’t matter, since the obligation on them is simply to keep a copy of it. If they do this, and the passport subsequently turns out to be false, it’s not their problem.
On a practical, prosaic, day-to-day basis, identity is broken and we need a new model.
Police dog
Identity has been broken since the earliest days of the online world. Remember that old cartoon, ‘On the Internet, no one knows you’re a dog,’ from the New Yorker in 1993? When I first started going to Internet conferences, this was in every presentation, including mine, but I was using it make a different point, which was that although in cyberspace, no one knows you’re a dog, no one knows you’re with the Federal Bureau of Investigation (FBI) either. Come to that, no one knows whether you’re a real person or a police-controlled software agent, cruising the Net looking to ensnare miscreants in dirty deals! I said this many years before reading that this is exactly what law enforcement agencies were doing, going undercover with false online profiles to communicate with suspects and gather private information, according to an internal Justice Department document.13 I’m not being critical: I want the police to use the Internet to catch the bad guys.
The point is to flag up that the legitimate interests of law enforcement must be taken into account when we begin to think about how identity should work. This task is actually quite difficult, because the way that identity works in the virtual world is not an analogue of the mundane world.
Multiple personalities
When it comes to the virtual world, multiple personalities are both real and actually desirable. Using different ‘personae’ across different types of transactions will become natural to us. Just as you use a different email address for work and personal messages, you will use a different identity in work and personal situations. This is a good thing; having only one identity that you have to use in all situations is not.
Travellers to Iran are forced by police at Tehran airport to log in to their Facebook accounts. Their passports are confiscated if they have posted criticism of the regime, which makes me wonder
