Craig Mundie: Claims, Privacy and Everything

Today I re-viewed the Craig Mundie keynote from the RSA 2008 conference.

Many things were said that I liked:

• Recently, a few weeks ago, we announced that we had acquired Credentica, and their U-Prove technology, which we think is going to be an example of a way to realize this requirement where we can tease apart some of the individual claims around identity or elements of identity and present them individually, and therefore be able to prove certain pieces of information without disclosing too much.
• ...I think on the consumer side there are two things that I hope will come together in a positive way. We put the CardSpace mechanism into Vista as a baby step in a way of introducing a GUI that people would be more familiar with, like they use credit cards and driver's licenses....
• ...more...

It is really good to hear that top management of Microsoft supports all this. Interesting to call CardSpace a "baby step". I am sure that was not intended to downplay the great work the CardSpace team did but to acknowledge how much work is still to do to create the need-to-know Internet.

There is one thing though where Mr. Mundie fell back into pre-"beyond fear" thinking. He gave the following example:
"CRAIG MUNDIE: I think that's true, and certainly this comes down in a sense again to the choice question, not just the choice to participate but you have to be able to identify the regions or the zones, if you will, of the Internet where the ground rules are complete anonymity, and likewise society I think will increasingly demand that they know that there are certain places where identities are really well known.

So, for example, if you're putting together an online playground for young school kids, you really want to know about all the identities of the people who have access to that. You don't want people lurking in your playground if you don't really know who they are in a reliable fashion.

So, I think that much as happens in the physical world, we will cone to understand that there are certain places where you're not expected to have to be identified, that you enjoy the ability to move around."

This example is not a good one. In the physical world I don't know what the identities of the fellow parents on the playground are and I think that the identity of the people in an online playground does not need to be known to the people visiting this online playground either. I think that a "is in custody of a child"-claim would be good enough to be acceptable on the online playground (or an "is a child"-claim). Sure there are differences between a physical playground and an online playground but throwing liberty out of the window when fear is involved happens just too often.

I would do Mr. Mundie wrong if I claimed that he meant to say "Society needs Microsoft CardSpace to protect our children". I apologize for even writing that conceived allegation. "Child abuse", "terrorism" trigger peoples fears and, hop, out goes our liberty.

That said...
Maybe later we can say: "CardSpace was a small step for Microsoft, but one giant leap for mankind"...

have fun! See you next week at IIW2008a.