In any case, I think Jennifer’s provided a wonderful articulation of the promise of personal clouds and also of the pitfalls to watch for as this new market segment takes off.

I’ve done very few blog posts this year due to the speed at which I’ve been running with Connect.Me and Respect Network (more about that at the end of this post). But three weeks after it ended, I’m doing a writeup on the last Internet Identity Workshop because, out of all 14 IIWs to date, this one gave the strongest signals the industry is breaking out.

Here were my five key takeaways:

#1: Personal Clouds Have Arrived

Once a decade comes on of those moments when you know that a corner has been turned and a new market is going to happen. For example, when I first saw a personal computer in 1976 and realized I could use it for writing, I knew I had to have one. And so did millions of other people.

Another was the first time I tried a mouse-driven graphical user interface.

A third was the first time I held an iPhone in my hand. As I played with the touch screen and launched apps. I knew right then and there that it was going to be a monster. All the power of a computer in your pocket and always on the network to boot.

Now it’s happened again—but this time with a product you can’t see or touch. Phil Windley’s white paper From Personal Computers to Personal Clouds summarizes the premise in one sentence: the next major advance in personal computing and communications is the personal computer in the cloud. There were at least four personal cloud sessions at IIW, including one led by Johannes Ernst in which a set of architects debated the precise meaning of the term like a set of lions sparring over a pride.

There’s no doubt in my mind: personal clouds are coming like a giant gathering storm, together with personal channels (more on those soon). They will be the central organizing construct of the personal data revolution just like PCs were the central organizing construct of the personal computing revolution.

#2: The VRM Wave is Breaking

Although it started a good five or six years offshore, the VRM wave led by Doc Searls is starting to strike the coastline. It isn’t just the publication of Doc’s book, The Intention Economy—although like tsunami warning siren, it does provide a very loud wakeup call to the residents of the sleepy coastal villages of e-commerceland.

And it’s not just because this was the first time there was a continuous string of VRM sessions playing throughout IIW like a Labor Day Weekend marathon of Grateful Dead songs.

For me, the strongest evidence was packed house the final morning of IIW in the “VRM: How Will It Break Through?” session led by Mydex chairman William Heath. In this session there were three major insights:

1. First, William talked about the midata initiative in the UK and Jennifer Cobb talked about the SmartDisclosure initiative in the US. In both cases, the government is taking the first step in spurring industry to “do the right thing” in giving back personal data to the citizens so they can reuse it to their and everyone’s benefit. I pointed out that the trend is not just with the government; in France the Mes Infos project is doing the same thing in the private sector. As I heard from the leaders of Mes Infos directly during a meeting last month in London, they want to beat the government to the punch.
2. Secondly, David Blumberg, Managing Partner of Blumberg Capital (and an investor in one of the companies in the space, Trulioo) articulated a core VRM value proposition for vendors: “Companies who really care about the lifetime value of the customer will be the biggest beneficiaries of VRM.” As Doc has said for years, those companies will embrace VRM as the next major step for CRM. CRM vendors: are you listening?
3. Lastly, at the conclusion of the session, William shared his own analysis. He drew a simple four square matrix on the board in which the two columns were People and Organizations and the two rows were Money and Do the Right Thing. He then asked the question: in which quadrant is the VRM breakthrough likely to come? Will it be people doing it for money? Organizations doing it for money? People asking for it because it is the right thing? Or organizations doing it because it is the right thing? After sharing a story about the BBC deciding a major new web product should have all its visitors store their media preferences in a Mydex PDS, William concluded that it will be Door #4. The breakthrough will be organizations who share personal data back with individuals—who start storing data in the individual’s personal cloud rather than their silo—simply because it is the right thing. Because it will ultimately produce the greatest benefit for everyone.

By the end everyone in this session was positively vibrating with excitement. Ironically, I don’t know how many who attended it knew that William was the founder and CEO of Kable, the leading government IT analyst company in the UK, which he subsequently sold to The Guardian several years ago before taking on the job of building Mydex as a Community Interest Company. So this was the insight of a highly experience professional analyst who has been living and breathing this space for the last four years.

Personally, I think William nailed it, and I told him so afterwards. Companies choosing to do the right thing because they know it is in their customer’s best interests—and thus ultimately in their own best interests—will be where the dam breaks.

And when the water starts pouring through, watch out.

#3: OpenID Connect Is Connecting

As one of the founding board members of the OpenID Foundation—and subsequently of the Information Card Foundation—and then helping birth their lovechild the Open Identity Exchange, I have been close to the OpenID drama since it started in 2005. And frankly I was one of those who all but left it for dead two years ago when even the OpenID board admitted that Facebook Connect—at the time being installed on more than 10,000 websites a day—was kicking OpenID’s butt.

I had become convinced that social logins—as the precursor to trust frameworks (see below)—were unstoppable. So I was as skeptical as anyone about the proposed metamorphosis of OpenID  into OpenID Connect (which Kuppinger Cole analyst Dave Kearns has accurately characterized as being so different than the original OpenID  that it is “OpenID in name only”).

I was wrong. By going back to the drawing board and putting together the best of OpenID, SAML, Information Cards (and even a touch of XDI—see below), OpenID Connect is out-Facebooking Facebook. And because it is now built on top of the industry standard OAuth, which as Kuppinger Cole analyst Craig Burton says is becoming the key to the API Economy, OpenID Connect suddenly looks like it could become the open, multi-provider, interoperable version of social login that can work Web-wide.

A special shout out to John Bradley, Mike Jones, and OpenID Foundation Chair Nat Sakimura for their persistence in making this happen.

#4: XDI is Coming in from the Cold

OpenID Connect is only the first step. While it could finally standardize and democratize social logins, it doesn’t tackle the harder problem of semantic data management, including portable data, portable permissions, and interoperable data dictionaries.

That would be a job for XDI. It has long been the dark horse in this race. 8 years in gestation at OASIS, it barely survived losing the ardor of two waves of early proponents. But its slavish adherence to developing a simple, globally-addressable graph model for data is finally starting to pay off.

At the same time the market has “grown into” the XDI problem space, particularly the very hard problems of creating an interoperable personal data ecosystem where app developers can gain permissioned access to personal data without needing to know its specific location or native format, and individuals can switch accounts between personal cloud providers the same way they can switch banks or switch mobile carriers today.

This explains why there were more XDI sessions at this last IIW than ever before, and they went deeper into the real problems XDI can solve.

Make no mistake, as co-chair of the OASIS  XDI Technical Committee, I can assure you there’s still an enormous amount of work to be done—a complete set of XDI 1.0 specifications are still at least six months away. But we’ve turned a corner and momentum is increasing. I predict that within a year there will be the same non-stop track of XDI sessions at IIW that there was for VRM this time around.

#5: Trust Frameworks are the New Network

Two years after the establishment of Open Identity Exchange, the first international non-profit home for open identity trust frameworks, there are still only two operational trust frameworks listed (the U.S. FICAM trust framework and the Respect Trust Framework).

What happened? Where are all these promised trust frameworks? Did someone miss the train?

In fact, “train” is an appropriate analogy. A trust framework is a lot like a large locomotive. It takes a good long time not just to build one, but to get it on the tracks, load the train, and get up a head of steam.

And yet, just like it was obvious that it would take railroads to civilize the American Wild West, it was taken as a given at this IIW that trust frameworks would be necessary to civilize the Internet Wild West. Nearly every IIW session I attended presumed the use of a trust framework.

Why? Trust frameworks are the new network. That was the assumption underlying my co-founding Respect Network Corporation with Joe Johnston and Marc Coluccio in late 2010. We felt a trust framework for personal data and relationships—in which the trust model was based on p2p reputation—was the key to unlocking decentralized data sharing on an open standard relationship network. Connect.Me is that reputation system and Respect Network is that relationship network.

Only time will tell if we were right. But if the current focus on giant centralized social networks continues on the natural Internet progression towards standardization and decentralization—as brilliantly articulated in two blog posts from Phil Windley (Facebook Domination Isn’t Essential—It’s Not Even Likely and Moving Toward a Relationship Network), then indeed trust frameworks will be the new network.

All I can say is: don’t miss the next IIW.

Phil sums it up perfectly:

Just like we have a standard label for drugs so that people can more easily understand how to take a drug and what it does, we should have a standard label for sites that want you to share your personal information.

It won’t get us everything that the Respect Network will, but it’s a good step in the right direction. Move your cursor right on over to the project and show you care about seeing what’s really happening with your personal data.

(And what better time to show your support for the standard label than during Privacy/Identity/Innovation 2012 going on right now in my home city of Seattle. Hats off to Natalie Fonseca and Marc Licciardi for an outstanding set of talks on the first day.)

PLOA is the outcome of Jay’s analysis about how a large identity provider (IdP) like AT&T should go about providing not just a user-centric identity system, but a developer-friendly and relying party-friendly system (relying parties being the sites that actually need the identity assurance). There’s an entire white paper about it on the Open Identity Exchange site, of which AT&T is an executive member.

But the biggest challenge with PLOA has been that it’s a worldview shift about how identity assurance really needs to work. As such, it solves so many related problems together that it’s hard to sum it up in a nutshell the same way you can for OpenID (“lets you use one username and password across all OpenID-enabled sites”) or OAuth (“lets you give access to your private stuff online without giving out your password”).

After seeing Jay’s demo, the lightbulb finally hit for me: PLOA is Need to know for assurance. It’s a clear way for any relying party to find out just what they need to know about any particular user — for any particular interaction/transaction in any particular context — in as lightweight and user-friendly a way as possible. It does this by:

1. Decoupling assurance — what a relying party needs to know ABOUT you — from authentication — the act of proving you have a valid identity credential.
2. Standardizing how a relying party can ask a third party (the IdP) for just what it needs to know about you to give you the service you are requesting – nothing more.
3. Standardizing how the IdP — and the application developer creating the user experience — can obtain the necessary assurance data needed from you if it doesn’t already have it.
4. Giving you complete control over this process, so you can revoke the assurance data and permissions you have given to IdPs if you want to.

By breaking down assurance into small, discrete, bite-size chunks, each of which is transparent and subject to user permission, PLOA makes identity assurance lightweight, modular, contextual, and privacy-friendly.

That’s a good thing. Now what PLOA needs is:

1. Binding to a standard wire protocol, e.g., JSON over HTTP/S.
2. Publishing by a standards body.
3. Adoption adoption adoption.

Jay knows I believe PLOA is a great fit for the XDI protocol, since the main XDI binding is JSON over HTTP/S, and sending/receiving XDI triples in JSON is about as lightweight and modular as it gets. But that’s just one of many options for a PLOA protocol.

From my perspective, what’s exciting about PLOA is that it’s a perfect fit for where we are headed with the Respect Network (more about that coming soon — for now just see the Respect Trust Framework). So keep an eye on it – for identity assurance, it’s just what you need to know.

UPDATE: Jay advises me that he will be giving demos of PLOA at two upcoming AT&T meetings in NYC on April 19 and NOLA on May 7.

10:15PM Tuesday March 27, San Francisco, across the street from Alexander’s Restaurant at 4th & Brennan. I slipped into the driver’s seat of my rental car after dinner with Phil Windley and Doc Searls, took one look in the rear view mirror, and instantly knew the hole that had been blasted into my digital life.

Yes, both bags were gone. And with them my MacBook Pro, my iPad 2 (new at Christmas), all my digital road warrior gear, and all my clothes and toiletries.

The physical loss is bad enough – it’s already been days of work restoring all the equipment, with more to go. But the worst part is the digital loss. Some of the files and pictures (no, not everything was backed up, and yes, now I finally DO have Time Machine installed) are gone forever.

What kept it from being completely devestating is the amount of my digital stuff that is already in the cloud - Dropbox, iCloud, Gmail, and assorted other mail servers. While I was already a huge advocate of the cloud — see my series on the personal cloud — now I’m going to be an absolute raving lunatic about it. I want the same protection for my digital life as I have for my house and home and possessions in my physical life. And I want a personal cloud infrastructure (and trust framework) that will give it to me — and ensure that I can maintain control over it.

The irony is that I was talking with Iain Henderson of The Customer’s Voice about the theft and he pointed out that if I’d had a personal cloud, actually filing the insurance claim  (and proving that I had ownership of the different assets stolen) would be almost trivial. He even sent me these example screen shots from The Customer’s Voice to illustrate.

Thanks, Iain – now I’m REALLY determined to bring personal cloud infrastructure to life. (More about that coming soon from my talks at the European Identity Conference starting April 17.)

To help explain what a Trust Anchor vouch really means, Connect.Me is inviting the first Trust Anchors (667 at this count) to do a Ten for Trust post: a list of the first ten (or more) people that we are giving a Trust Anchor vouch to, and why.

Here’s mine (yes, it’s 11 – I can’t count). One note: I’m disqualifying family (I’m saving my wife’s thank-you for the Oscars — I just hope I can be as eloquent as Meryl Streep thanking her husband) and also my Connect.Me co-founders Joe Johnston and Marc Coluccio.

Steve Wilmart. This is the guy I credit for my mental model of a Trust Anchor: a human being that I would simply trust to do the right thing anytime anywhere anyhow. Steve was the very first employee at my previous company, and worked steadfastly through thick and thin, up and down, never wavering from doing the right thing and best thing for the team — and for the customer.

Bill Griffin. My closest childhood and lifelong friend. I see at most annually because he lives in Jakarta. But every time we reunite it is as if we’d just left off the last conversation. Bonds like that take a lifetime to form and are stronger than steel. I would trust Bill with my life.

Bob Martin. Bob and I became good friends in Alaska, and given that he still lives there, I haven’t seen him in a decade. But he is a frequent visitor to my email inbox, and it always makes me smile (he has a broad but very discriminating sense of humor). Bob treats everyone he knows with fairness and generosity, and I would do any favor he asks at the drop of a hat.

Kaliya. Identitywoman. Say no more. As her friends like to say, Kaliya is a force of nature, and by that I mean specifically Mother Nature, i.e., she will only do what’s good for this world. She will brook no other option. When I co-founded Connect.Me and Respect Network, she was the #1 person I had to convince that you could actually do good in the world and make money at the same time.

Scott David. When we had the idea for the Respect Trust Framework, Scott was the reason we believed it could become legal reality. He sees the law not as constraint but as sculpture. When he hosted an XDI retreat on his own dime in his own condo with a group of techies he barely knew, I knew he was “all in” when it came to what it would take to build a real global trust network.

Doc Searls. The concept of VRM exists in the world the way it does because of Doc. And it will stay true to that vision because of him (his book The Intention Economy comes out this spring). It’s not just his thinking, it’s his personal insistence on meaning, independence, and authenticity not just in commerce but in life. (As another testament, Doc didn’t “level up” to trust anchor until I pointed out to him that he’d vouched for 3 people and been vouched for by 82.)

Phil Windley. As co-founder of Internet Identity Workshop, author of Digital Identity and The Live Web, and developer of his own rules language, Phil has educated me more than anyone about the power of reputation systems done right. But it is his tremendous personal character and warmth that will win anyone over. He’d bike 100 miles for you — and then serve you toast with warm honey from his own bees.

Steve Fulling. Phil’s partner-in-crime could never be a criminal. He simply wouldn’t know what to do. He runs a right ship with right folks who will figure out how to do the right thing. If he says he’s going to do something, you can trust he’ll do it. Period.

Craig Burton. I don’t know anyone who has undergone more adversity in his life yet stayed true to his vision of building the network humanity really needs. Craig is lighter fluid for imagination; a piledriver for innovation; and a bulldozer for timidity. And he has a heart as big as the Utah mountains.

William Heath. William’s in London so I get to see him only rarely, but each time is a treat. His blog, Ideal Government, says it all — he really believes in the ideals that governments, civil servants, citizens, and businesses should all aspire too. His deep belief in digital rights led him to join Iain Henderson, Alan Mitchell, and David Alexander in fashioning Mydex based on the Community Interest Corporation model. Nobody has the community interest more in mind than William.

Iain Henderson. Iain has had the VRM bug in his blood since he realized that CRM would forever be broken if it didn’t truly connect to the customer. That was 12 years ago, and he has never looked back. He won’t compromise on the principle that the customer comes first – he wants to give The Customer’s Voice. And he won’t stop until they have it.

P.S. More to come – once you start dwelling on who you have built trust with and why, it starts to snowball. So I’ll be doing several more rounds of Ten for Trust.

So he’s weighed in (hint: along with the Attorney Generals of the United States) on Google’s new privacy policy.

Read it. It’s even more important than you think.

Thanks for summarizing the problem so nicely, Phil. And a tip ‘o the hat too to Cory Doctorow, whose talk on the subject Phil credits as well.

Incidentally, Phil’s point that we don’t need new laws governing technology, we need to enforce existing laws about harmful behaviour, explains why Connect.Me created the Respect Trust Framework. It is the legal fabric of a “purposeful network” where the incentives are so strong not to violate the trust of others that we will not have the kinds of rights violations that SOPA and PIPA are trying, misguidedly, to address.

My experience with routinely dropped calls has been just as bad as anyone else’s, so ever since Verizon got the iPhone I was convinced I’d switch when I upgraded (the rest of my family has been on Verizon for years).

But in the end, my grandfathered data plan plus the convenience of being able to use voice and data at the same time plus the investment AT&T is making in 4G made me decide to stick it out another 2 years.

So I really, really wanted to believe AT&T is at last getting its act together.

And then I receive this post-sale email from AT&T with the subject line Let’s Talk about your new iPhone. In the body they offered links to a host of helpful tools:

Thinking it would be wise to watch a tutorial (just to see if there’s anything else I should know about my new 4S that my 16-year-old son — or the wonderful Siri — hasn’t already showed me), I clicked the first link.

The result was not the iPhone tutorial I expected, but a generic web page titled Cell Phone and Interactive Device Tutorials. I think to myself, “That’s dumb – why not just link directly to the iPhone tutorial like the link said?” But what the hell, maybe AT&T’s websites are so poorly designed that they didn’t allow internal linking. So I dutifully clicked the Manufacturer drop down to choose Apple, and…

…WTF??? NO APPLE!!!!!!!

Poof. There went the tiny puff of faith I had left in the AT&T turnaround.

I mean, COME ON, AT&T, DO YOU HONESTLY EMPLOY NO PROOFREADERS FOR AN EMAIL YOU SEND TO ALL NEW IPHONE CUSTOMERS WITH A LINK TO AN IPHONE TUTORIAL THAT DOESN’T EXIST???

Please tell me what happened here. I invite anyone from AT&T to reply as a comment to this post so I and anyone else reading this will have some clue what’s going on with you.

Sincerely,

– A Customer Who Really Wants to Believe He Didn’t Just Throw Away 2 More Years of Service