Who owns your identity?

This week, danah boyd got a nasty sur­prise: Her iden­tity on the pop­u­lar Tum­blr blog­ging ser­vice had been dis­ap­peared, reas­signed to a cor­po­ra­tion with a sim­i­lar name to the nick­name danah often uses in the online realm. While danah is a pop­u­lar researcher with a wide fol­low­ing and tum­blr quickly reacted and helped her out, the issue high­lights a trou­bling sit­u­a­tion in the online world: who owns your identity?

I’ve decided to explore this in a 3 part series: In this entry, I present a brief his­tory of online iden­tity own­er­ship; in the next entry, I will com­pare and con­trast the Face­book and Twit­ter TOS agree­ments; and in the last entry, I will look at the dif­fer­ent approach peo­ple and com­pa­nies are tak­ing to man­ag­ing those issues.

Online iden­tity before the web

In the early days of the com­mer­cial inter­net, online iden­tity was largely defined by which han­dle you were using on a vari­ety of community-related ser­vices. You may have dis­cussed things on usenet, an internet-wide ser­vice for dis­cus­sion, or chat­ted on IRC, an internet-wide cha­t­room, but the fact was that nei­ther of those ser­vices were owned by cor­po­ra­tions. As a results, the mores dic­tat­ing behav­ior on such net­works were more a ques­tion of com­mu­nity stan­dards than any­thing else. Because the com­mu­ni­ties were “rel­a­tively” small (and by rel­a­tively, I mean in rela­tion to the size of online com­mu­ni­ties today), things worked out mostly OK.

While the inter­net itself had some internet-wide com­mu­nity tools, a few smaller micro-communities existed within that wider realm. Groups like the west-coast based WELL (Whole Earth ‘Lec­tronic Link) or the east-coast based ECHO (East Coast Hang Out) were even smaller groups with­out legal con­tracts but with estab­lished com­mu­nity norms for behav­ior. With com­mu­ni­ties num­ber­ing in the thou­sands, things were still man­age­able with­out contracting.

Enters the web

But then came the web and things got a lit­tle fuzzier. With the devel­op­ment of the web, two major new things hap­pened: first, it became eas­ier to nav­i­gate the inter­net, increas­ing the num­ber of peo­ple with access to inter­net resources from the low mil­lions num­bers to sev­eral bil­lions today. Sec­ondly, and prob­a­bly because of this increase in pop­u­la­tion, the num­ber of cor­po­rate inter­est want­ing a web pres­ence exploded to the point of near ubiquity.

But with this came a first set of chal­lenges. Inter­net Ser­vice Providers, the com­pa­nies that offered access to the inter­net started pro­vid­ing indi­vid­ual users with the right to pub­lish on the inter­net. How­ever, along with those rights came the con­cept of “Terms of Ser­vices” (TOS for short) which defined what could and couldn’t be said on the ser­vices. These types of restric­tions led some peo­ple to start think­ing about what they needed to do to pub­lish con­tent on servers other than those ISPs.

Most of the peo­ple from that gen­er­a­tion found the answer in own­er­ship of a domain name. But own­er­ship is an incor­rect word as it is impos­si­ble to own a domain name. Today, one reg­is­ters a domain, which means an indi­vid­ual or cor­po­ra­tion is given the right to lease that domain name for a period of time from an accred­ited entity. So, for exam­ple, if I die and no one renews the lease on TNL.net, some­one else could take it over.

This is far from an ideal sce­nario but it is, unfor­tu­nately, the best sce­nario cur­rently avail­able in terms of con­trol­ling one’s iden­tity on the inter­net. Domain name reg­is­tra­tion is the clos­est thing any­one has to being able to own­ing their iden­tity on the internet.

On to hosted services

While own­ing one’s domain name increases the level of con­trol over what and how a per­son is rep­re­sented online, it also means an increased amount of work in terms of ensur­ing that all the back-end pieces that make this stuff works are work­ing. An aver­age pres­ence on the inter­net prob­a­bly includes an email address and a web server. This means that some­one who wants that basic set of ser­vices will need a sys­tem to run an email server to send and receive emails, and, at a min­i­mum, a web server to serve pages, and a con­nec­tion to the net­work. If the per­son wants to use soft­ware for a blog, he/she may also need a data­base and other com­po­nents to make things work.

Unless you’re a mas­sive geek or a large cor­po­ra­tion, you’re unlikely to own all those com­po­nents your­self. The amount of work required to keep such sys­tems run­ning is often higher than could be jus­ti­fied for a sin­gle user.

So a new group of ser­vice providers emerge to pro­vide increas­ingly turn-key solu­tions to put behind one’s own domain name. Those com­pa­nies, called hosted providers, can pro­vide one with email ser­vices, web ser­vices, tele­com ser­vices, etc… and all come with sets of legal con­tracts that high­light how those com­po­nents can and can­not be used. This rep­re­sent a return to the Terms of Ser­vices approach pro­vided by ISPs in the 1990s and, while the con­tracts are gen­er­ally fine for most peo­ple, they can have impact on ser­vices that are sit­ting on the bleed­ing edge of speech.

For exam­ple, it was the TOS put in place for Pay­pal and Ama­zon that were cited by those respec­tive com­pa­nies when they decided to cut off Wik­ileaks. Whether or not wik­ileaks actions were legal in the United States didn’t mat­ter in those cases as the com­pa­nies decided to make their own value judge­ments as to what to do with such a com­pany. To say that such actions can have a chill­ing effect on free speech is merely to point out the obvious.

… and on to the social web

For many years, I’ve restricted my par­tic­i­pa­tion in a lot of social web com­po­nents and warned oth­ers about what I see as an area that is ripe for abuse. Much as domain names were the way  to side­step some of the issues asso­ci­ated being hosted on a par­tic­u­lar ISP’s web­site, I worry that the “gated com­mu­nity” approach to a lot of web ser­vices is an area that ought to con­cern more peo­ple. A quick look at the Terms of Ser­vices of two of the more pop­u­lar social ser­vices out there can raise some red flags (my next entry looks at Twit­ter and Face­book and their treat­ment of users).

At issue here is the fact that social ser­vices are largely host­ing you. You, as an indi­vid­ual or cor­po­ra­tion, get a com­plete infra­struc­ture and, in exchange, only have to sup­ply con­tent. The ser­vices then can reuse that con­tent in a num­ber of ways and decide whether you are wor­thy or not.

This rep­re­sents some pretty legal tricky grounds as indi­vid­u­als and cor­po­ra­tions are now forced to swim in the same waters and the social ser­vices prob­a­bly should study the cor­pus of laws estab­lished around domain names to fig­ure out a model based on legal prece­dence. While that sys­tem is not per­fect, it is the clos­est thing we have to a work­ing model that bal­ances out tem­po­rary own­er­ship with high level of rights for holder of that tem­po­rary ownership.

Ulti­mately, iden­tity own­er­ship is bound to become one of the hot topic in the inter­net space as it touches on so many facets that there is no sil­ver bul­let solu­tion that will make every happy: the chal­lenge is in find­ing a com­pro­mise that will be agree­able by a major­ity of people.