The Big Fix #4: Make Internet Identity Bullet Proof

The head of the CIA undone by email, anonymous trolls ruling Reddit, fakery on Facebook and false Sandy news on Twitter. Identity on the internet is a mess.
For all of Facebook‘s slant towards using real identity—”The name you use should be your real name as it would be listed on your credit card, student ID, etc.,” it tells its users—anonymity and pseudonymity have their legitimate uses. To add to the confusion, many services on the internet are now nested within one another, making it very difficult to really keep track of the level of privacy that will be applied to any discreet bit of you own personal data or content.
That a distinguished public servant is ending his career prematurely, not because of any professional mistake or breach of national security, but because he did not use truly private means to communicate with his lover, is disturbing. I’m not defending General Petraeus’ morality, but it is not material to his job performance, so I don’t really need to know about it. In cases where it is within one’s rights to keep secrets, the proper mode of internet identity is true anonymity.
There are other cases where one wants to maintain an identity online that is other than one’s true identity. Sometimes we want our views or works considered on their own terms, uncoupled from the baggage our real identity. Like an author writing a series of books on the side of what they are best known for, the pseudonym offers an alternate, but persistant identity.
But Jaron Lanier, Douglas Rushkoff and the other digital humanists are correct to say that online discourse is best when we express ourselves in our own name. We have something at stake—our name, our reputation, the institutions we represent. We are more likely to think twice before we flame in our own name.
But the fact that we have a “real” life and a “real” name shouldn’t limit the polymorphous perversity of who we can be online. Nor should we restrict our pursuit of knowledge about a medical condition, legal situation or political group for fear of those queries will become associated with our public record. Why is all of this information here, all of these alternate models of reality, all of these unanswered questions, if not so that we can play with them freely—assuming we’re not hurting anyone by doing so?
Every social network solves this problem in its own way. Reddit stands by anonymity and the culture is so strong that its community boycotted Gawker for exposing the identity of a popular (though controversial) moderator, the ur-troll violentacrez. Twitter allows for pseudonymity, but also certifies the identities of well-known tweeters. Facebook considers a bit less then a tenth of its members to be “false or ‘undesirable.’” Google+ uses the easy-to-understand concept of circles to help you understand who you are sharing with at any given time. But there is no one company that has taken on the task of helping people to manage online identity in a cohesive way, and there are no accepted standards for what our full range of identity rights, privileges and responsibilities are.
If you look up “online identity management” on Wikipedia, you get a page that discusses personal branding and reputation management. These are important in a professional context for people and for companies, but I am after something much more integral than that.
User interface design and strategic planning consultant Scott Jenson just wrote a post about “The Internet of Things” (IoT) in which he enumerates the rights that a smart device should have:

• To have access to the internet
• To be discoverable by anyone or anything nearby (without necessarily being on their subnet)
• To be able to broadcast information on what it does
• To offer up a web page to do whatever the hell it wants to do
• To offer up a RESTful interface of actions that it is capable of doing
• To optionally require a secure connection/login

This is an interesting and important topic, but before we can deal with the rights of things, we need to deal with the rights of the people who use those things. If we don’t hammer out the ground rules for “The Internet of People” (IoP) first, we run the risk of turning the IoT (more on this from Jenson here) into some strange version of corporate personhood.
So, without further ado, here are my specifications for what an articulate IoP would look like:
Identity: Every person should have the ability to use their real name and image(s) of their choice in any online venue that supports it. Additionally, each unique identity needs to be matched with some sort of encrypted verification key and/or biometric signature so that, in situations that require it, identity can be verified.
Pseudonymity: Some online venues will support persistant aliases. Although these pseudonyms may confer a high level of anonymity, their very stability will mean that there is no way to assure that the assumed name will not become associated with the real name in a public way at some point. Many online venues that currently support pseudonyms link them to “real name” email accounts, so whatever the terms of service may say, there is an linkage that can be exposed and personal data that can be associated.
Anonymity: The only way to assure complete anonymity is for identity to be transitory. The Electronic Frontier Foundation, for instance, supports a project called Tor that protects online identity by routing traffic through different randomly selected pathways for each communication. If anonymity may seem to allow troll-like behavior in our privileged society, it can also allow survival for political dissidents in less privileged circumstances. Moreover, our view of the web is increasingly shaped by what Google and other large internet companies believe we want to see—or marketers are paying for us to see. Adopting a truly anonymous identity online, in venues that support it, strips away that filter.
I have emphasized in these descriptions that different online venues will set their own policies about which types of identity they will support in which circumstances. I believe that an individual should be free to choose their mode of identity at any point, and changing modes should be voluntary, instantaneous and effortless. Similarly, content and service providers should have clear guidelines for their identity expectations of their customers. Governments should take the lead and make their own content and services both least restrictive and most secure, depending on the nature of what is offered or required. Businesses should be as free as possible to set their own polices and alter them (clearly and consistently) to better achieve their objectives.
But the real point is that only through actively managing our online identity, and being prompted to clarify our position many times a day, will we understand that identity is a construction, and a voluntary one at that. It is with this freedom that we can both keep our secrets and take responsibility for our own speech. Until the rules are clear and the tools are ubiquitous and frictionless, we will continue to make mistakes like Petraeus did by using Gmail to communicate with Paula Broadwell. And we will make those other mistakes, too, of not being as fully ourselves online as the world needs us to be.