Re: [projectvrm] A VRM/PDS dream come true :-)

[Liz Coker < >]

A couple of things call out for more clarity:

KC - Disagree that positive evolution is competitive.  Evolution occurs because we cooperate.  Business models that do not include a high level of cooperation are unlikely to succeed.   

I believe that evolution occurs because we adapt.  Sometimes that means cooperation, sometime it means we compete, or invent something entirely new.  Lately this seems to take the hybrid form of what marketers call "coopetition."  A highly uncomfortable relationship for many organizations but a pretty standard way of doing business for companies who participate in a standards setting process or must integrate into a larger solution.

I'd argue that VRM is not about a new business model.  To me it is about new digital tools to support an existing "offline" social and business interaction model.  In an offline world, I don't need anything but my common sense and an understanding of cultural norms to effectively engage with others.  Trust decisions may be instinctual or earned.  Since we are talking about "soulless" bits and bytes, instinct is not feasible, so we are trying to create "rules and tools" to hold accountable those "entities" with whom we enter into a two-way interaction. Since trust is built over time, we need our own "personal policy engines" to engage in whatever interaction or transaction we see fit, until (and if) we can set rules to "earn/learn" that trust via repeated interactions/transactions.  A more nuanced version of what business is already doing to manage corporate data access. 

Liz

-----------------------------------------------

Elizabeth Coker 

Vice President, Marketing
3PMobile
Boulder, CO  USA


Improving the Mobile Web Experience

Office:  303.938.1769
Email:   " style="color: blue; ">

Web site:  www.3pmobile.com

CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain information that is confidential or legally privileged. Any unauthorized review, use, disclosure or distribution of such information is prohibited. If you are not the intended recipient, please notify the sender by telephone or return e-mail and delete the original transmission and its attachments and destroy any copies thereof. Thank you.

From: Kevin Cox < "> >
Date: Sunday, July 7, 2013 3:13 PM
To: John Wunderlich < "> >
Cc: Joyce Searls < "> >, Alan Mitchell < "> >, Matt Hogan < "> >, Daniel Kaplan < "> >, ProjectVRM list < "> >
Subject: Re: [projectvrm] A VRM/PDS dream come true :-)

KC: John the way I interpret your comments we are in agreement.   I have put my comments with KC and a different colour.

On Mon, Jul 8, 2013 at 3:01 AM, John Wunderlich < " target="_blank"> > wrote:

Kevin;

See my in-line responses below.

As a general comment I would argue that Internet commerce accelerates the tendency towards sectoral and industrial consolidation. This in turn leads to asymmetric power relations between the customers in their millions and the vendors in their dozens. Thus the necessity for regulatory intervention to ensure that the rules of the game establish more equal power relationships between service users  and service providers. This is how I see VRM, as a way of realizing a more equal power relationship.

KC - Agreed 

{begin deliberately provocative suggestion} 

The use of evolutionary comparisons suggests that there is competition between various commercial entities (presumably the ones that are 'evolving') to pass down their successful genes, which would be business process and/or business models that generate competitive advantage. 

KC - Disagree that positive evolution is competitive.  Evolution occurs because we cooperate.  Business models that do not include a high level of cooperation are unlikely to succeed.   

If the above comparison of evolution (biological genes = commercial processes) is the the case, maybe what we need to look at it is the tax code. Nothing impacts business process profitability more than taxes. As a thought experiment imagine what the impact on data collection would be if there were a tax on the amount of data collected from an individual regardless of consent. Not proposing, just saying' that such a revenue stream would a) give the state regulator both the income and the information it would need to enforce data protection regulations and b) motivate enterprises to be frugal in the collection of personally identifiable information. 

KC - Agree that we need mechanisms to pay for the establishment and maintenance of identity.  Taxes can be used - as can the providers of identity services fixing prices and then being taxed on excessive profits. 

 

{end of deliberately provocative suggestion}

The systems under which organizations currently operate have 'evolved' to enable profit maximization and are focussed on delivering shareholder value on a quarter by quarter basis using back end payments for front end services. This means that attempts to enable user control over their own data, or to put limits on the uses to which organizations put collected data, are castigated as inhibitions on innovation. If VRM is to work then innovation (AKA profitability) needs to be disconnected from monetizing personal data as an object and connected instead to a process of transparently monetizing expressed intent. 

KC - Agree.  

 

JW

On 2013-07-05, at 12:53 PM, Kevin Cox < " target="_blank"> > wrote:

John,

Regulatory controls tell the players the rules of the game.  However, we know that there is always profit to be made in breaking the rules and getting away with it.

Regulators generally recognize this, but also have to move forward on the presumption that people organizations will follow the rules of the game. 

 In designing social systems that are able to evolve we must build in social mechanisms that make it highly likely that breaking the rules will be discovered and punished by exclusion. 

No sure that we can 'design' social systems, as the rule of unintended consequences too often creeps in.

KC - Design was the wrong word.  Build with intent is perhaps a better phrase.    

Examples:

Working rules and social enforcement exist around spam. The rules are set in regulations around spam in many countries and the participants, including ISP's accept and enforce or support rules. In addition the vast majority of users work within the rules.

An example of nonworking rules would be anti-piracy rules. Breaking the rules is more the standard than the rules, and there is little effective punishment.

KC - Spam is controlled by the tools we use not by the regulations.  

KC - Piracy on the Internet is not the right word as it is completely different from piracy on the high seas. The interests of the content providers and consumers do match. Piracy occurs when there are middle men who create unjustified and unnecessary costs in matching customers with providers.

The difference between the two, or at least one difference, is in whose interests the rules were made. There is a common interest between the users and suppliers in the case of email (spammers are unwelcome interlopers, whereas there is a divergence of interests between the content providers and content consumers in the case of privacy) 

 

VRM works if the vendors can be confident in the identity of the customer, and if the customers can be assured of the identity of the vendors.  Vendors can refuse to deal with people they cannot trust - while customers will refuse to deal with vendors they cannot trust.  Trust is broken when the rules of commerce are broken.

VRM works and trust can be built, I would argue, when the vendors and customers have a common interest. There is a common interest when there is a commercial relationship between the two where one wants to buy what the other has to sell. Your argument about customers and vendors fails when it comes to 'free' services because customers are, in fact, the advertisers and data aggregators that pay for the services provided. The fact that there is a trusted relationship between service provider and advertiser is the problem. So for these free services, your argument suggest to me that there needs to be a three way transitive trust relationship - Advertisor/Aggregator <-> Service Provider <-> Service Consumer.

KC: VRM gets rid of the middle man and enables suppliers to hire advertisers to persuade people with intent - rather than try to generate intent.  Aggregation is better driven by the customers - not by the vendors.

If you look at successful living systems then this principle is everywhere.  Darwin had it right when he talked about survival of the fittest.  Those who interpreted him by thinking that the fittest were the fittest in a competitive sense were wrong.  The fittest are those who best fitted into the environment and cooperated with other entities in the environment so that they were able to survive and pass on their genes.  

The best solution to passing on genes isn't always cooperation. Both symbiosis and parasitism work in evolutionary time. VRM is an argument for symbiosis (mutual benefit), but the current model is parasitic. 

KC: Agree.   

Humans have made the evolutionary step of being able to create environments in which to live and evolve.  The environments we create that best survive are those where the forces of cooperation and the interests of the group outweigh the forces of competition and self interest.  To see how this works read "Super Cooperators - Altruism  Evolution, and why we need each other to succeed" by Nowak and Highfield."

In the world of commerce knowing who the other party is so you can refuse to deal with them is the reason why VRM enables self regulation through exclusion.  Stop cooperating and give individual entities the ability to stop dealing with the rule breakers enforces compliance.  Trying to enforce compliance of rules by force does not work in the interconnected world of commerce. Excluding rule breakers from a profitable participation does work. 

Kevin

On Sat, Jul 6, 2013 at 1:09 AM, John Wunderlich < " target="_blank"> > wrote:

Kevin;

 

The devil is in the details. The assumption that I made, but did not state, was that if the data subject scatters their information across multiple silos but continues to want the convenience of a unified [free] service model to present their identity, then the same API's and infrastructure that provides the convenience to the data subject provides the opportunity for attackers to aggregate that data for their own purposes. This is the the problem that you addressed in your response.

Thanks,

JW

PS. What with constraints on my time I'm not always able to keep up with this list, so this may already have been covered. I kinda grok the technical side of what needs to happen for VRM to heave itself from concept to reality, but there is another side that I'm still unclear on. Once personally identifiable information has been released from a silo to a data processor, it requires both technical and non-technical controls to ensure that the data subject's privacy wishes are observed. It occurs to me that that the various forms of the GPL license cover this in a different venue (i.e. maintaining open code). Has there been discussion or examples of a Gnu Privacy License to attach to software and/or data stores that collect, use, and disclose personally identifiable information - to ensure that data will only be processed for purposes that have received user consent, for example. Again, apologies if this has been dealt with.

On 2013-07-04, at 5:49 PM, Kevin Cox < " target="_blank"> > wrote:

John,

Keeping data about ourselves in silos is the standard method of protecting privacy.  It is a good principle and works.

To do this we need to make it difficult for others to match and move data about us across silos.

In the scheme we are building silos will give us id numbers BUT the number will only be used and known by the silo. We will not even know the number.  This builds in privacy into the system because it becomes difficult to match data about us across silos.

The system will make it easy for information about us to be passed between organisations if it is passed "through us" and will make it difficult and in many cases illegal if it is passed without our knowledge.  Again this builds in privacy into the system.

To make this happen we need secure reliable ways to allow ourselves to be identified.

That is what we are doing and it will make it easy to implement VRM systems.

Kevin

On Fri, Jul 5, 2013 at 12:15 AM, John Wunderlich < " target="_blank"> > wrote:

Kevin;

Scattering your data across the web is also fundamentally flawed, it seems to me. It is a variant of 'security through obscurity' and relies upon the difficulty of connecting to, and linking, multiple sources. There should be a Moore's Law for re-identification and identifiability, because I suspect that it does become twice as easy to re-identify and link someone's personal information every eighteen months or so.

On 2013-07-03, at 6:56 PM, Kevin Cox < " target="_blank"> > wrote:

This shows that the idea of keeping all your own personal data in your own vault is fundamentally flawed - if you want to keep things private.  If you want privacy you want others to store information about you in their own data stores.  That way our information is scattered around the internet and to at it someone has to break into all those stores.  Of course we want to be able to access it when we need to but let others keep it and let them take responsibility for looking after it and keeping it from others.  This the system we have at the moment with one difference.  Today we do not have access to our own information.  Tomorrow we will and VRM will become a reality.

Kevin

On Thu, Jul 4, 2013 at 12:11 AM, Joyce Searls < " target="_blank"> > wrote:

Time to review the Onion video from 2011, that Doc used in several speeches at that time :)

http://www.youtube.com/watch?v=kVX7K4gAKas

J

On Jul 3, 2013, at 9:01 AM, Alan Mitchell < " target="_blank"> > wrote:

> I love the 'key partners' bit!
>
> A
>
>
> On Wed, Jul 3, 2013 at 1:37 PM, Matt Hogan < " target="_blank"> > wrote:
> We actually put out something similar a few weeks ago. I figured I'd share it with the group given the nature of the thread.
>
> http://getprsm.com/
>
>
> 2013/7/3 Daniel Kaplan < " target="_blank"> >
> We dreamt it, they made it happen. 'Nuff said:
> http://prism.andrevv.com/
>
> Cheers,
>
> Daniel
>
> --
>
>
> ----------------------------------------------------------------------------------------
> FING - association pour la Fondation Internet Nouvelle Génération
> The Next-Generation Internet Foundation
> Daniel Kaplan - " target="_blank"> - +33 6 8962 9968
> http://www.fing.org  /  http://www.internetactu.net
> Paris : nouvelle adresse - 8 passage brulon - 75012
> Marseille : CMCI, 2 rue Henri Barbusse - 13001
> ----------------------------------------------------------------------------------------
>
>
>
>
>
> --
> CEO/Founder
> DataCoup, Inc.
> Datacoup.com
> @matthewphogan
> @datacoup
> 415-533-7492
>
>
>
>
>
> --
> Alan Mitchell
> Strategy Director, Ctrl-Shift
> T6 3rd Floor West Wing
> Somerset House
> London, WC2R 1LA
>
> Mobile: +44(0)7711 899 784
> Skype: alansmitchell
>
> www.ctrl-shift.co.uk
> Twitter: 321Ctrlshift
>
>
>
>
>