11 Mar · Sat 2006
How many politicians does it take...
My definition of 'Identity'... one year on
Two things seems to be implicit 'rules of blogging': the first is that blogs open with a disclaimer saying "I'm not sure why I'm doing this, but here goes..."; the second is the "Happy Birthday Dear Blog" anniversary entry. This is the latter.
Happily enough, I had the chance to talk through various identity-related topics with a respected former colleague, Peter Dare at IBM, a few days ago. He probed my thinking on 'what is identity?', deftly led me to consider it from a slightly different perspective, and prompted me to write this as a result. As it is basically a review of one of the ideas I outlined back on Day One of this blog, the fact that it has happened (near enough) one year down the line is serendipitous. Thanks, Peter, and I hope this is useful.
In that early blog entry, I set out the idea that when we talk about "identity", what we're actually doing is "asserting that x is identical with y", where x is 'the person to whom a set of credentials was issued' and y is 'that person at a later date, presenting the credentials as proof... of identity'. I still think that's a good model for what's going on, but it's not the whole story.
The point Peter made, among others, was that one can also think of someone's identity as the 'arc of life events' which is unique to that person and which, as one might put it, 'makes them who they are'. This is a much more common-sense definition of 'identity', and I don't disagree with it at all. When any of us thinks 'what is my identity?' we tend to think of it in terms of 'those events, attributes and characteristics which define me and only me'. That might include having a particular date of birth, name, pair of parents, school history, scar from a childhood bicycle crash, and so on.
In normal life, one's view of the identity of, say, a neighbour, is an accretion over time of various small pieces of data. So when someone asks you "Who is Mr Smith", you might say "he lives two doors down from me; he has grey hair and glasses, and walks with a limp because his knee was damaged in an acccident at work years ago; that's why he retired; he's got a red Honda; I often see him on the way to the supermarket; his son works at the bank". Those are all things from Mr Smith's 'life arc', as seen from my perspective. With any luck, they might be enough for you to realise who I'm talking about... in other words, to identify him.
If you asked Mr Smith to describe himself, the account he gave of his identity might coincide with some of the things I mentioned, but equally it might not, and yet it would (unless he was lying) be a valid account. So the problem here is one which Bob Blakley has also alluded to, which is that in one sense 'identity is a story', and as such can be very subjective, varying from person to person and from time to time. Well, that's not what we want as the basis for assertions of identity; we want objectivity, reliability, repeatability... so what bridges that gap?
The definition I originally gave said that, when we assert the identity of a person, we are actually asserting that the person presenting a particular set of credentials is the same as the person to whom those credentials were issued. I also said that assertions on the basis of credentials therefore form a 'base layer' on which one can build assertions of entitlement, and assertions about other attributes. But, as the discussion with Peter helped clarify, the attributes which appear on my credentials are 'things from my life arc'. So the bridge between 'identity as a subjective story' and 'identity as something susceptible of objective proof' is this: when we issue someone with robust credentials (such as a passport) we establish a set of 'points on their life arc' which are objective and definitive, and we then encapsulate them in the form of a credential which does two things:
- it protects the integrity of that information over time, against tampering or falsification;
- it provides some verifiable link between the credential and the person holding it (such as a photograph or a signature).
If the photograph matches the person presenting the credentials, or they can reproduce the signature, and if the credentials have not evidently been tampered with, then we tend to rely on them as proof of identity. (Until the risk of forgery or impersonation outweighs the likelihood that they are genuine). As I say, this doesn't contradict the model I set out originally, but it helps to clarify the status of credentials as 'a subset of attributes from your life arc, substantiated, and encapsulated in a form which allows them to be reliably presented over time'. Credentials are certainly not the only way of describing someone's identity; they are not even the only way of proving it... but they are a (relatively) convenient and objective way of supporting assertions of identity over time.


