They typically buy iTunes gift card codes, usually in $50 to $200 amounts. They then sell the codes — which can be used like cash to buy music and videos — at a steep discount, openly on the Internet.

If only these hackers could ensure their victims were from the landed class, they might be considered modern-day Robin Hoods. Alas, they’re garden variety thieves.

But what I liked about the article is that it captured the truly appalling apathetic attitude from Apple and financial institutions, who attempt to lay responsibility entirely on consumers:

Apple says there is little it can do about iTunes account hijacking. The company advises victims to change their passwords and contact their financial institution about being made whole.

Change their passwords? What good will that do? As the article points out,

iTunes logons also get stolen and sold off by hackers who spread computer infections containing keystroke loggers that capture logons as you type them.

So the hackers will capture you newly typed password, too.

Calls to your financial institution will likewise be met with a “talk-to-the-automated-hand” sort of attitude. After all, why should these guys care if you get hacked? These hackers drive up revenues by getting you to spend money that you wouldn’t have otherwise! Some economists would even argue that this kind of coerced economic activity is good for the economy!

Unfortunately, there’s very little consumers can do to protect themselves. How would you even know if you have a keylogger watching you all the time? Thanks to the lack of transparency in Windows and Mac OS, it’s difficult to tell when some rogue application is watching your every move. And of course, Apple shouldn’t be storing “credit and debit card, checking account and PayPal information” on their site. For their part, financial institutions need to come up with a better form of micro payments than opening a multi-year tab at iTunes on your personal credit card or PayPal account.

But will consumers care enough to boycott iTunes? Doubtful. So in the meantime, I recommend befriending a hacker.

Given the subject of my presentation two days later—”trust” in the cloud—I couldn’t resist goading Gunnar a bit by countering that the bike’s security in fact passes muster. Here’s my argument:

According to Murphy’s Law, this bike should be stolen. And yet, there it is. Someone even took a picture or it. Is there something else going on here that’s keeping the bike from being stolen? I think so. In fact, I offer a special exception to Murphy’s Law. I call it “Mikey’s Law” and it goes like this:

Just because something can be stolen doesn’t mean it will be.

Perhaps in the society where the owner lives, simply putting a lock around something expresses one’s wishes for the item not to be taken—and that’s sufficient security because others respect that wish. People may even help you enforce your wish for respect of personal property by taking pictures and looking out for would-be thieves. Sounds like the kind of place where I’d like to live, in fact.

Idealistic? Perhaps. But for most of us it’s also part of our everyday experience. After all, do you lock up all of your valuables all of the time? Can you leave your wallet or purse in your office and expect to come back an hour later and find them just where you left them? In many cases, in fact you can. And that’s a good thing.

My point is that security practitioners are inclined to propose the “security society” as the ideal model for public safety. In a security society, citizens can’t trust others, fear that bad things always will occur, and lock up everything of value. In my view, the security society is the model of last resort. Where we “live” we should instead aspire to create a cooperative society, one based on trust rather than distrust. Yes, bad things will happen in the cooperative model, just as they do in the security society. But then again, all hell won’t break lose either, as some would have us believe. And even if the incidence of theft if a security society and a cooperative society were roughly the same, in which place would you prefer to live?

I am here at the invitation of Golan Levin, director of the studio and, back in the day, a former colleague at Interval Research. The fellowship is funded by the National Endowment for the Arts.

Golan told me I could do anything I wanted, and so I invited Robin Gianattassio-Malle to come work with me on inventing a better way to help people learn and think about the consequences — both risks and benefits — of innovations in science and technology. We want to go beyond the usual binary, “fawning or damning” approach that dominates media coverage today, to actually informing people about these incredibly complicated issues.

I’m really excited about this project. It’s the first time in a long time I am going to have the opportunity to roll up my sleeves and do what I do best: to help people understand complexity in a way that is engaging, helpful and accurate. We are going to have to confront some tough design issues, but between us we have an amazing network to draw from.

Robin and I will be working at the STUDIO with two other fellows — Kyle McDonald and Jacob Tonsky — both of whom are wicked smart and from whom we expect to learn a lot.

We will be building a prototype over the next few weeks, and I will be posting updates about our progress. Yeehaw!

A Governance Template, Not a Trust Framework

OIX is a kind of standards body where techies from various industries come together to prescribe satisfactory methods for identification, so that these IDs can be used across websites. From the OIX site, the process is as follows:

… policymakers representing a trust community (e.g., government, industry association, professional society) start by developing a trust framework specification. This document defines the identity proofing, security, and privacy policies that must be followed by identity service providers to reach a specified level of assurance (LOA). In some cases it will also specify the data protection policies that must be followed by both identity service providers and relying parties to reach a specified level of protection (LOP).

Lastly, the trust framework defines the qualifications necessary to be an assessor for the trust framework—a person or a company who has the professional experience necessary to assess whether an identity service provider or relying party is in compliance with the policies specified for a certain LOA or LOP.

Next the policymakers contract with a trust framework provider (TFP) to operate a certification program for the trust framework. A TFP who operates by the OITF model performs the following functions:

1. Publishes the trust framework so it is publicly accessible.
2. Accepts listings from assessors who meet the qualifications specified in the trust framework.
3. Accept listings from identity service providers (and in some cases relying parties) who are successfully certified by a qualified assessor.
4. Publish updates to the trust framework as it is revised, and periodically renew certifications of participants as required by the trust framework.

Lastly, the OITF model includes roles for auditors and dispute resolution service providers to assist in ongoing assessment of trust framework participants and resolution of any disputes that may arise.

(Side Note OIX: also don’t abuse the word “lastly.”)

Apparently OIX just hosts the party and provides the napkins (for sketching), but little else. Defining the standards is up to the policy makers and certifying compliance is up to a Trust Framework Provider (TFP)—whatever that is.

Identification isn’t Trust

I suppose that, if successful, OIX will improve the way digital IDs are used. That’s not altogether a bad thing, but it’s also not trust.

By analogy, imagine that, in order to improve the effectiveness of TSA screeners, the government sets a policy requiring travelers to present both a driver license and passport at the airport. Does it follow that everyone inside the secure area of the airport will trust each other? If the TSA screener clears someone, does that mean the screener trusts the traveler? Or that the screener trusts the ID? Do the IDs foster any kind of trust at all?

If there’s one thing I’d like to get through to techies who work these protocols, it’s this: identification isn’t trust. Please find another word to describe what you’re doing.

Would you feel happy for your friend? Or would you feel used? After all, your friend took the initiative; she took the risk (after all, what if someone got sick and decided to sue her?); she organized the event; she provided the venue. In short, your friend was the entrepreneur; she “owned” the party. And if that’s not to your liking, what’s stopping you from throwing a party of your own?

But you may still experience a sense of betrayal that comes from feeling obliged to attend an event for friendship’s sake—an event that ostensibly was just a party but turned out to be a fundraiser for your friend’s spoiled kid. In addition, your attendance at the party mandated the attendance of your spouse, prompted you to buy a new dress, and encouraged your mutual friends to attend as well. So you also unwittingly marketed this fundraiser for an over-privileged kid. And of course, since the food was sub-par, you feel taken by your own friend.

Stone Soup 2.0

This modern retelling of the Stone Soup fable is a commentary on capitalistic society, one in which the Pot & Stone owners walk away with most of the soup. Or more literally, American capitalism is a system that distributes the greatest rewards to owners of infrastructure. In this economic arrangement, business owners have much greater control over the value created by the business than do the contributors. This reward structure is said to encourage private enterprise and competition, which eventually will produce the greatest good for the largest number of people.

But the Law of Relational Symmetry tells us that the party in control of the relationship will exploit the other participants. In today’s businesses, owners control the most important aspects of the relationship, such as the ability to set compensation, benefits, and terms of employment. Contributors usually have to sign away their rights to any intellectual property they create to their employer. And often, contributors sign non-compete agreements that restrict their movements after refusing to work under unfavorable terms. With no ability to hold property (intellectual property in this case) and an acute need for income and healthcare, workers in today’s society need jobs the way Victorian women needed husbands.

So while capitalism is undoubtedly the best system practiced on a massive scale for producing wealth, it is nonetheless a system of exploitation and produces less than optimal results for all parties.

Who Benefits when the Masses Believe in Capitalism?

Choosing an economic system isn’t an academic discussion for much of the world. When confronting the difficult realities of capitalism, emerging economies often choose another route. Even the EU had to face sobering statistics in capitalism’s approach to wealth while forming its economic policy. The Guardian recounted many of the challenges the EU faces in adopting capitalistic ideals:

Today, while corporate profits are soaring around the world, 89 countries find themselves worse off economically than they were in the early 1990s. Capitalism promised that globalisation would narrow the gap between rich and poor. Instead the divide has widened. The 356 richest families on the planet enjoy a combined wealth that now exceeds the annual income of 40% of the human race. Two-thirds of the world’s population have never made a phone call and one-third have no access to electricity….

Our business leaders decried the corruption that permeated the old centralised communist regimes, while many engaged in equally egregious corporate corruption, bringing down some of the world’s “most trusted” companies….

Left to its own internal logic, the unfettered market leads not to a bigger share of the economic pie for all but a “winner takes all” endgame….

But capitalism does not fairly distribute the fruits of economic progress. That’s because the logic in the boardroom is always to cut production costs in order to maximise profits and shareholder value. This means reducing, whenever possible, the share of the gains that goes to workers, as well as cutting the expense of preserving the natural environment upon which all future economic activity depends.

In short, capitalism works really well for a small portion of the population. The “surplus value,” as Marx described it, always goes to the owners of infrastructure.

But the fact that capitalism makes some people richer than others isn’t really the issue. If contributors all benefit from an enterprise and if access to ownership is open to everyone, then societies generally welcome such an economic arrangement. But when wealth is transferred to a select few either institutionally or by outright deceit, trust erodes and the basis for prosperity vanishes.

The Velvet Rope and the American Dream

In American society, who are the owners? Is business ownership really open to anyone with an American dream? Can anyone be an owner? Can everyone be a business owner?

The prerequisites for ownership are said to be egalitarian, but in practice they’re not. The seeds of ownership require opportunity and circumstance, but maintaining ownership requires something else entirely. And the nature of business ownership makes owners a self-selected group. The most successful business owners are those who know how to inspire fanatical contribution to “the dinner party” while maintaining a stingy budget. Not everyone is cut out for that.

Economic systems that predate capitalism were of course overtly exploitive. In feudal society, the lord could simply coerce the peasantry to surrender goods and provide service. But in a society with government of the people, by the people, and for the people, economic coercion is subtle (or rather, more passive aggressive, as shown in the movie Office Space).

The “Stone Soup 2.0″ fable also portrays how natural instincts for trust are first institutionalized and then exploited for someone else’s gain. Some business owners use friendship or tribal connection to inspire contribution, as in the party example above. Some create a sense of “family.” Some create the illusion of ownership (“son, as project manager, you own this product!”) Some create the aura of grandeur. All of these methods draw contributors into a narrative that helps them believe they are doing something important, rewarding, and fun. The narrative also distracts contributors’ attention away from the fact that they are simply taking part in a fundraiser for an over-privileged kid. This is the way of the world.

Of Owners and Contributors

In most of today’s enterprises, contributors deliver much more value than the owners. Most of the value in Facebook comes from ordinary users and from thousands of engineers now working on the platform. The code that the original owners developed has long since been replaced. In the NFL, where salaries seem fantastic compared to a middle-class incomes, it’s still the franchise owners who profit the most. Similarly, in Hollywood, actors make much less than the studios (also see a similar article in USA Today).

Nothing draws into focus the differences between ownership and contribution like a corporate acquisition or public offering. The classic example is that of Jim Clark, who took Netscape public—which enabled Mr. Clark to build his dream boat Hyperion, but left everyone but a select few at Netscape with almost nothing. (For more detail on this story, see Michael Lewis’ book, “The New, New Thing: A Silicon Valley Story.” Ironically, one of Clark’s motives behind founding Netscape was to fleece venture capitalists and bankers who had devoured most of the profit from his previous company, Silicon Graphics.)

I think of the 50-or-so startups I’ve watched in the digital identity industry as they’ve gone through various phases. And I think of Burton Group, a company I worked at for eight years, as it was acquired by Gartner for $56 million. In every case, contributors and inventors were lured by the idea that they were part of something great and that they would find riches at the end of the trail. But in every case, the spoils of acquisition went to only a select few—those with a stake in the business and those arranging the financing.

The Effects of Capitalism on Trust

The roles that contributors, customers, and owners are obliged to assume in a capitalistic society strain and erode bonds of trust. The hopelessly co-dependent nature of owner-contributor relationships makes the relationship durable, but strained. This type of relationship engenders obsequiousness of Lilliputian proportions.

Perhaps this situation is a natural outcome of the human condition, because exploitation certainly wasn’t introduced by capitalism. James commented on this very issue 2,000 years ago:

Suppose a man comes into your meeting wearing a gold ring and fine clothes, and a poor man in shabby clothes also comes in. If you show special attention to the man wearing fine clothes and say, “Here’s a good seat for you,” but say to the poor man, “You stand there” or “Sit on the floor by my feet,” have you not discriminated among yourselves and become judges with evil thoughts? … But you have insulted the poor. Is it not the rich who are exploiting you?

But as trust in society’s institutions erodes, revolution isn’t far off. Yeats said it better:

Turning and turning in the widening gyre
The falcon cannot hear the falconer;
Things fall apart; the centre cannot hold;
Mere anarchy is loosed upon the world,
The blood-dimmed tide is loosed, and everywhere
The ceremony of innocence is drowned;
The best lack all conviction, while the worst
Are full of passionate intensity.

Solutions for Trust and Collaboration

The solution for sustainable trust isn’t simply to shuffle ownership from one group to another, or to shift ownership onto government or to the proletariat. Unless the game itself is altered, the names will change, but the roles will remain the same. Instead, our aim should be to mature the game of American Capitalism rather than to supplant it.

To make societal structures trustworthy, they must be fitted with features that promote trust. Just as modern buildings are designed to be resilient to earthquakes and to suppress fires, society’s institutions can be fitted with fail-safe mechanisms that improve confidence. We can also design features that promote sociality and collaboration, while thwarting gaming and corruption.

Elinor Ostrom proposed a theory of the conditions that improved the likelihood of multilateral, durable collaborative action (or what I like to call “trust”). Ostrom claimed that trust greatly improves under the following conditions:

Participants perceive they will be harmed in some way if no action is taken (shared conflict)

A fair solution can be found through which all participants will be affected in similar ways by the rules (symmetry)

The durability of the relationship is believed to be high (low defection rates among participants)

The cost of participation is reasonably low

Most participants agree on norms for reciprocity and trust

The group of participants is stable and, preferably, small

Ostrom further claims that ongoing governance of a shared resource is sustainable if the following design principles are adhered to:

Exclusion – The group must be able to guard the resource from free loading, theft, or vandalism.

Rationality – The agreed upon rules must be attuned to the context of the resource

Involvement – Members have avenues to participate in modifying operational rules

Monitoring – Effective monitoring and auditing or policies

Enforcement – Sanctions can be imposed on violators of the rules

Arbitration – Appropriators have access to low cost, but effective conflict resolution

Autonomy – The rights of appropriators to devise their own institutions are not challenged by external governmental authorities

(The above lists are adapted from “Governing the Commons: The Evolution of Institutions for Collective Action” Ostrom, Calvert, Eggertsson)

Such principles enable pro-social behaviors to emerge in individuals, creating the cohesion necessary for collaboration.

This post is already much too long to discuss practical application of these principals. However that’s the topic of many past and future posts, so keep reading and commenting!

Wall Street tactics akin to the ones that fostered subprime mortgages in America have worsened the financial crisis shaking Greece and undermining the euro by enabling European governments to hide their mounting debts.

As worries over Greece rattle world markets, records and interviews show that with Wall Street’s help, the nation engaged in a decade-long effort to skirt European debt limits. One deal created by Goldman Sachs helped obscure billions in debt from the budget overseers in Brussels….

In 2001, just after Greece was admitted to Europe’s monetary union, Goldman helped the government quietly borrow billions, people familiar with the transaction said. That deal, hidden from public view because it was treated as a currency trade rather than a loan, helped Athens to meet Europe’s deficit rules while continuing to spend beyond its means.

As the Times article later calls out, the rest of Europe is livid. Countries like Germany are likely going to have to flit the bill for this—just as they were nearly finished paying for reunification with East Germany. An article in Der Spiegel (link refers to the English version) discusses bluntly Goldman’s role in the shenanigans. According to the Spiegel article:

In the Greek case the US bankers devised a special kind of swap with fictional exchange rates. That enabled Greece to receive a far higher sum than the actual euro market value of 10 billion dollars or yen. In that way Goldman Sachs secretly arranged additional credit of up to $1 billion for the Greeks.

This credit disguised as a swap didn’t show up in the Greek debt statistics. Eurostat’s reporting rules don’t comprehensively record transactions involving financial derivatives…. Goldman Sachs charged a hefty commission for the deal and sold the swaps on to a Greek bank in 2005.

In an interview between a Spiegel reporter and HSBC chairman Steven Green, the tension is palpable. The interviewer begins with the question “Mr. Green, when was the last time you were ashamed to be a banker?” The interviewer goes on to ask, “You are not just the group chairman of Britain’s HSBC, the world’s largest private bank. In your free time, you also serve as a lay preacher in the Anglican Church. Have you ever prayed: ‘Please God, rescue capitalism’?”

As the Spiegel interview bears out, yelling at the bankers is a cathartic (a nice Greek word) but fruitless exercise. Like Iago in Shakespeare’s Othello, bankers respond with complete dispassion when discussing the suffering they’ve enabled and insist on the legality of the trades and their innocence in these matters. Back to the Times article:

Wall Street did not create Europe’s debt problem. But bankers enabled Greece and others to borrow beyond their means, in deals that were perfectly legal. Few rules govern how nations can borrow the money they need for expenses like the military and health care. The market for sovereign debt — the Wall Street term for loans to governments — is as unfettered as it is vast….

In Greece, the financial wizardry went even further. In what amounted to a garage sale on a national scale, Greek officials essentially mortgaged the country’s airports and highways to raise much-needed money.

Does trust depend on a society’s ability to create a law for every possible act of treachery? Could Moses have brought down the 10,000 commandments from the mountain? Maybe over-the-counter derivatives trades are legal by some literalist interpretation of securities law. But clearly the people who wield the power of such financial instruments pose greater risks to society than Jihadists. In my view, these kinds of over-the-counter trades ought to be illegal and subject to the worst kinds of penalties on the books.

Governments continue to develop identity systems, commercial sites increasingly add social networking features, and new cloud services strain existing modes of online trust. I’m looking forward to a very interesting year!

“We’re preprogrammed to reach out,” Dr. de Waal writes. “Empathy is an automated response over which we have limited control.” The only people emotionally immune to another’s situation, he notes, are psychopaths.

Dr. Michael Tomasello, one of the researchers cited in the NYT article, explains that “we are both selfish and altruistic at the same time.” Some of the altruism in humans comes from what Tomasello describes as “shared intentionality.” Again from the article:

The shared intentionality lies at the basis of human society, Dr. Tomasello argues. From it flow ideas of norms, of punishing those who violate the norms and of shame and guilt for punishing oneself. Shared intentionality evolved very early in the human lineage, he believes, and its probable purpose was for cooperation in gathering food. Anthropologists report that when men cooperate in hunting, they can take down large game, which single hunters generally cannot do.

I’m sure this view of human nature feels intuitive to most people, but Western traditions haven’t given these ideas much play. Perhaps the current economic crisis will inspire policy makers and economists to re-evaluate the philosophical underpinnings of capitalism.

But narrowing the topic to the field I work in (digital identity and internet security), I wonder 2 things: How can we provide for shared intentionality on the Internet? And how do we also imbue applications and other non-human actors on the Internet with similar instincts?

Comments welcome!

The NYT cited Robert Shiller’s comment on the award:

“It is part of the merging of the social sciences,” Robert Shiller, an economist at Yale, said of Monday’s awards. “Economics has been too isolated and these awards today are a sign of the greater enlightenment going around. We were too stuck on efficient markets and it was derailing our thinking” ….

The committee, in effect, said that [current economic] theory was too simplistic and ignored the unstated relationships and behaviors that develop among companies that are competitors but find ways to resolve common problems. “Both scholars have greatly enhanced our understanding of non-market institutions” other than government, the committee said.

“Basically there is a common understanding that develops even among competitors when they are dealing with each other,” Mr. Shiller said, adding “when people make business contact, even competitors, they can’t anticipate everything, so an element of trust comes in” ….

In its announcement, the committee said Ms. Ostrom “has challenged the conventional wisdom that common property is poorly managed and should be either regulated by central authorities or privatized. Based on numerous studies of user-managed fish stocks, pastures, woods, lakes, and groundwater basins, Ostrom concludes that the outcomes are, more often than not, better than predicted by standard theories.”

As some of you may know, Ostrom’s work is the inspiration behind this blog (for example, see my comment at the end of this post) and my work on the Limited Liability Persona at Burton Group (for example, see the references to Ostrom in this report). So I find it remarkable and reassuring that her work is now being recognized on a global scale.

So, once a gain: Congratulations, Elinor!