Note: the IIW community adopted the qualifying prefix "self-" not too long after this post was first written, ie. self-sovereign technology.
Agency refers not to the intentions people have in doing things but to their capability of doing those things in the first place.
To be able to ‘act otherwise’ means being able to intervene in the world, or to refrain from such intervention, with the effect of influencing a specific process or state of affairs.
Technology must always be a component of agency as tools change our capacity to ‘act otherwise’. And it’s a component that’s all the more pervading and penetrating as the delineation of the analogue and digital dissolves, as ‘the device’ assumes an exo-brain role and as sensory ‘things’ form our exo-nervous system.
Simultaneously, I have a digital self and a self with digital presence.
Simultaneously, this is me and it is my representative, my agent.
Simultaneously, it is core to my agency and must be subject to it.
The degree to which the information technologies and services available to me are subject to my agency and subject to the agency of third parties varies. Considerably. One might postulate that it spans the entire spectrum and find no objection. Given that the distribution of technologies up and down that spectrum has varied individual and societal ramifications, it is useful to help locate any given technology on the spectrum. This question is a great start …
How might we define sovereign technology?
The question is at the heart of the hi:project and it was on a recent project call that I learned from Adrian Gropper that the 22nd Internet Identity Workshop grappled with answering it (26th, 27th, 28th April).
Adrian has translated that work into the 10 components of sovereign technology, presented here for your information / comment / critique.
The 10 components of sovereign technology
In no particular order.
1/ Policy assertions
The technology must be able to store and assert the owner’s policies.
eg. DNT, VRM, UMA Authorization Server run as a component of sovereign technology
2/ Authentication
This refers to the authentication of the owner of the sovereign technology. A range of owner authentication methods (eg. a password, biometrics) can and should be offered.
eg. FIDO
3/ Longitudinal notification endpoint
The technology should include a way to accept notifications from the services it interacts with. The technology can then decide what to do with the notifications (eg. alert the owner, modify the policies). To the extent the notification endpoint is registered with a service it provides a longitudinal context for interaction with that service. The common use of email as a pseudonymous identity as well as a longitudinal notification endpoint is convenient but it introduces privacy and spam risks.
4/ Non-repudiable link
To enable the sovereign technology to engage in non-repudiable (legally binding) transactions to the extent that the non-repudiable link is kept safely within the technology.
eg. biometric
5/ Whitelist of IdPs for RqP claims
When external requesting parties and services approach with claims, the technology must have a way to manage trust in the associated assertions. Claims may be presented in a standardized manner such as OpenID Connect or emerging blockchain-based methods. The owner should be provided with a user interface for whitelisting identity providers.
6/ Backup and recovery of the tech
Sovereign technology should be protected from loss or compromise. This can be as simple as keeping an offline copy or it can be associated with an owner-controlled voting mechanism where the owner decides the rules.
eg. M of N
7/ Delegation
The sovereign technology may be associated with a subject that is unable to operate technology (eg. parents of a minor, children of incompetent parents). In that case the technology and the protocols that it uses must support control by a custodian without confusing the identity of the custodian and the sovereign subject. We define ownership of the technology as the ability to take it off-line or delete it. A custodian is typically the owner of the sovereign technology but can transfer that ownership at will to another custodian or to the subject herself.
8/ Competence tests / partial delegation
The sovereign technology may be associated with a subject that is only partially competent to operate it. This is the case for younger children accessing web services and some elders. Sovereign technology may offer custodial features to serve this. The custodian may be a person or the state and ownership might be subject to regulation which calls into question the definition of sovereign technology.
9/ Filter for incoming data
A sovereign technology often acts as a filter for incoming data. This is related to the notification endpoint above but broader, in the sense that any interaction with a sovereign technology may change its state.
10/ Logging
A sovereign technology should provide a log of operation. The log may be private to the technology or public in order to meet trust and compliance requirements. Blockchain-based public logs, to the extent they are permission-less and governance-free meet the definition of a sovereign technology (no privacy policy) and are a significant enabler.
###
1 Pingback