The data broker industry collects and links together data about millions of people in massive databases. There is no direct relationship between the companies that do this and the individuals they gather or buy information about. While there is no direct relationship in the collection of the data, brokers who are subject to the Fair Credit Reporting Act are required to provide consumers access to the information they have about them and the ability to correct it. This industry gets the data they use to compile these databases from the government, civil society, and commercial and employment contexts. They package the data about people into digital dossiers and sell them raw or in the form of scores on which they rate the subjects in their database on dimensions important to their clients (Figure 15.1).

Relationship to Other Domains

The data broker industry draws on data from all the government, commercial, civil society, and employment contexts. If the data are publicly available, the data broker companies will just take and use them. If the data are held in private databases, the companies will buy and integrate them with other data. The me and my identity and you and your identity domains have no direct relationship to the data broker industry domain because individuals do not contribute their data to, or interact in any direct way with, companies in this industry. Data brokers are vulnerable to data theft and having data breaches that end up on the illicit market.

Description

The data broker industry seems like it could not have evolved before the contemporary computer era; however, it began long before. The tracking of commercial creditworthiness began in the 1840s. The agencies doing this started tracking the personal habits of individuals in massive ledger books. By the late 1850s, they were publishing rating books on the creditworthiness of individuals. This created the modern concept of a financial identity. The history of this mass consumer surveillance is integral to the development of modern consumer capitalism.

The data broker industry domain is similar but distinct from the commercial surveillance domain. In the data broker industry domain, as with the involuntary known and involuntary unknown types of commercial surveillance, there is no enrollment process.

Employment registration the process that a new hire goes through to begin work with an employer. It starts with the application process where PII is shared from a prospective employee with an employer, there is an evaluation process where more PII might be shared and finally after a job offer is made to an employee they are enrolled in to the enterprise identity and access management system and then issued credentials (Figure 12.1).

Relationship to Other Domains

When individuals seek employment, they go through an employment registration process. They must do this before they start work and do employment transactions. In the process of going through employment registration, they present themselves and their identity, bringing the me and my identity domain into play. Individuals also need to present documents and identifiers from government registration processes. The database of employees and prospective employees from the application process is vulnerable to theft and appearance on the illicit market. Some employment data end up being circulated to data brokers.

Description

This domain is one of three focused on the employment context. In much of the industry, “enterprise identity and access management” is a term of art that combines functions from all three employment domains in this book. This context has been separated into three separate domains to clarify thinking regarding different aspects of identity management in each of them. The purpose of gathering data about employees that are stored in employer databases varies.

What Are Pre-Enrollment Processes?

During the process of seeking employment, individuals share their résumés with employers and fill out application forms. Both contain PII. Employers who regularly hire have systems to track these people and information about them. This is also called applicant surveillance. Many employers will use various types of background checks to vet people before hiring them. These type of checks require PII and the approval of the individuals. The potential employers have a database of this information about people.

Identity Proofing and Credential Verification

Once an employer has decided to hire a person, the employee goes through a process to become registered in the different enterprise systems.

Civil society surveillance is not yet widespread. However, there is more and more tracking of health care and educational activities. Professional associations may also be surveilling their members. Civil society groups may organize to perform collective citizen surveillance of corporations or governments (Figure 10.1).

Relationship to Other Domains

Individuals, while being surveilled by civil society institutions, don't necessarily know they are being surveilled and think they are just being in the me and my identity domain minding their own business. Data collected in civil society surveillance could be sold to data brokers, are vulnerable to theft, and could appear on the illicit market.

Detailed Description and Relevant Literature

Civil society surveillance is primarily voluntary and known. Patients accept wearable health-monitoring devices that collect data to be retrieved by health care providers, or the patients send the data directly to these providers. Some providers are also installing medical sensors in homes.

Some school systems have issued identification cards enabled with radio frequency identification (RFID) near-field communication (NFC) to students, which can be scanned at checkpoints or seen by sensors that can then share with administrators where students are located in a school.

There is very limited academic research about this surveillance. In one of the articles I read on the topic, I found one book that focused in this area, Under Observation: The Interplay between eHealth and Surveillance. Most of the studies within it examine patients’ acceptance of these types of technologies and their relative invasiveness.

The physical institutions of schools, hospitals, and other civil society organizations have within them a range of surveillance tools for security such as CCTV cameras. These, however, are not likely logging an individual's activity into databases with PII attached.

Can Civil Society Conduct Sousveillance?

There term “sousveillance” was coined by Steve Mann. “Sur” is a prefix that means “above,” so “surveillance” means “watching from above.” The prefix “sous” means “below.”

Commercial transactions take place when a customer transacts for goods and services with a merchant or service provider (Figure 8.1). Individuals present their credentials to the company and are able to buy goods or services and have those transactions linked to their customer record.

Relationship to Other Domains

Individuals often need to register with a commercial entity before being able to do transactions. This is particularly true for transactions that happen online. In-person transactions that involve cash require no registration. When individuals are doing commercial transactions, they are subject to commercial surveillance. Data collected in commercial transactions are often sold to the data broker industry and are vulnerable to theft and use on the illicit market.

How Do Individuals Use the Identifier from Registration for Transactions?

There are a variety of strategies that retailers and service providers use to support individuals linking their activity together into a customer record.

Service providers such as gyms ask people to preset a card with a code on it, which, when scanned, brings up a photo of the individual that the person at the desk can verify is a match.

Retailers that have enrolled people into loyalty card programs ask them to present the card again or to share a unique identifier like a phone number to bring up the customer account and record the transition in their database. With these types of systems, individuals receive rewards via a digital version of their account.

In financial services, banks issue individuals a card that can be used to transact with the bank. This card is sent to the individual's home at the address provided. This card and the number on it becomes a “what you have” authentication factor. The bank also issues a personal identification number (PIN) to individuals, which is a password that the bank asks for when the individual presents the card. This is a “what you know” authentication factor. When a card is entered into a bank machine and the PIN is supplied, the customer has shared two factors of authentication (“what you have” and “what you know”) and the bank proceeds with the transaction.

Commercial surveillance is vast as the push is to get more information about consumers and use it to shape their purchasing activity. It happens in person in stores with CCTV and sensor networks. It also happens with digital tools and services via cookies, and beacons from advertising networks in web content (Figure 11.1).

Relationship to Other Domains

Commercial surveillance happens in the context of individuals interacting with commercial entities in person or online. Individuals, when they are being surveilled, don't see the surveillance and think of themselves as being me and my identity. Therefore, commercial transactions are likely to be occurring in parallel with commercial surveillance. Data from commercial surveillance are sold to data brokers and are vulnerable to leaks and hacks and could end up on the illicit market.

What Is Surveillance in the Context of Commercial Enterprises?

This was touched on in the domain of government surveillance, but it is worth revisiting with an eye to what it means in the specific context of commercial surveillance. Lyon defines surveillance as “any collection and processing of data whether personally identifiable or not, for the purposes of influencing those whose data have been garnered.” Commercial entities are trying to observe and record personal details to manage their customers and influence potential customers.

Corporate marketing and media systems emerged out of World War II to entice people to buy things to absorb the surplus production of the economy. “Marketing evolved quickly in its period of greatest advance in the 1950s into highly organized system of customer surveillance, targeting propaganda and psychological manipulation of populations.”

The metaphors of Big Brother and the type of totalitarian government intrusion into people's lives that it would create are contrasted with the corporate surveillance as “merely interested in providing goods and services.” It goes deeper with surveillance-based reality television, which equates submission to comprehensive surveillance with self-expression and self-knowledge. Andrejevic's research shows that people's exposure to television increases their acceptance of ideas such as “the more businesses know about me the better they can meet my individual needs.”

Civil society registration happens when individuals begin relationships with any number of institutions: professional associations, nonprofit membership groups, religious congregations, sports leagues, and so forth. We also include educational and health care contexts in which people are patients and students. While some of these institutions are “for profit,” the nature of the transactional relationships suggests that it makes more sense to include these types of transactions in this domain (Figure 5.1). The first step is for the individual to go through a registration process possibly filling out forms. Once the organization has accepted those and created a record in their systems the organization issues a credential to the individual.

Relationship to Other Domains

Many civil society registration processes require claims verified by documents that are derived from government registration. Before interacting with a civil society organization in an ongoing way, a civil society transactions registration with that organization is required. Some employment registration processes require certification or verification from civil society organizations derived from civil society registration and transactions. Data from civil society organizations is sold to the data broker industry. Data is vulnerable to theft and appearing on the illicit market.

What Is the Process of Enrollment?

To register in any system, one has to first enroll in it. How does this happen in civil society institutions? For the sake of having a common vocabulary, we will call the subject a member, but they could be a patient, student, or some other term depending on the type of institution.

Our first interaction with civil society institutions is often when we are born: we become a patient in a health care institution.

When we are enrolling children in institutions, we are asked to share with the institution a copy of an “identity primitive” contained on a birth certificate. This is for several purposes including the need to know a child's real age, to know that the parents presenting are indeed the parents of the child being enrolled. These institutions may also request to see state-issued identity documents from the parents (as listed on the birth certificate) as well.

Employment transactions are all the logins and authorizations that happen when employees do their job while physically present on site, for example, entering a building for work. It also may happen when they log on to digital systems (Figure 13.1). Individuals present the credentials issued to them by the enterprise, do their work within the context of their employment and in turn are paid.

Relationship to Other Domains

Individuals who become employees and do employment transactions have to go through the process of employment registration first. Once they do employment transactions, they are surveilled by their employers. The next domain is employment surveillance. Data from employment transactions are vulnerable to data breaches and theft, and could end up on the illicit market. It isn't likely that employers are selling employment transaction data to data brokers, but they might be selling data inferred from transaction data to them. Data generated while employed and doing employment transactions might be part of me and my identity data too, in the form of work portfolios and credentials earned as part of employment. One of three types of delegation outlined in the you and my identity domain happens when employers delegate capabilities to individual employees to act on their behalf.

Description

Employment transactions are all employee activities in the context of their work that create digital records. This includes simple things like punching in to a time clock when they arrive at work and clocking out when they leave. If an employer has a door with logical access control, the employee would need to swipe their employer-issued ID card on the door to gain access.

In the process of becoming an employee, individuals are issued an identifier— an employee number. This number is what they use when logging on to the digital systems of the employer. However, this is not enough to get into the systems. They must also present an authentication factor that the employer checks, matching it against the factors of authentication that the employee included in the employee registration.

An identity management system's purpose is to regulate access to resources. Administering employees’ access to sensitive applications and data is a central challenge for today's organizations.

The Domains of Identity covers a lot of ground. The first domain pertains to the individual and their data and the second domain covers the cases where an individual acts on behalf of another. These two domains are the source of data for the next twelve where individuals register, transact are surveilled by governments, civil society organizations, commercial entities and operate within the context of their employment.

In all of the above domains, there is a relationship between the individual and the entity but in some domains the individual may not be aware of the relationship. In the case of registration and transactions the relationship is explicit and understood by both parties. In the case of surveillance the individual is being passively watched/tracked by the institution but there is a one way relationship wherein data about an individual is flowing into the data systems of an institution with or without the individual's knowledge.

With the final two domains there is no connection between the individuals involved and their data. The data broker industry collects and links together data about millions of people in massive databases and then re-sells this data. The illicit market is where the information about individuals ends up after it is stolen or hacked by criminals from databases in any of the above domains.

I wrote this book to support a whole range of stakeholders being able to understand the domains and then use it to locate different identity management problems in a landscape. I also hope that it spurs others to do research that can address the challenges within and amongst different domains with new collaborations between industry and academia.

There are several significant research directions that arise from this book including:

• (1)Looking at complex use cases through the lens of the domains.

• (2) Considering how these 16 domains interact with one another. What different types of transactions and business/society activity happen within each intersection of these domains? This matrix of domains could then be used to understand various use cases and allow for the consideration where the key-stone systems and infrastructure is missing.

There are three main types of delegation:

• 1.Person-to-person delegation.

• The primary example of this is a parent's relationship with their children or adult children's custody of their elder parents. Another case is an individual delegating a particular portion of their affairs to another, for example, delegating interacting with the tax authority to a professional accountant. In a will, one can establish who becomes the executor of one's estate after one dies. There is also the new phenomena of intimate surveillance by household members.

• 2. Person-to-entity delegation. An individual delegates something to a corporate entity (legal person). For example, an individual wanting to aggregate all their financial information. They pull it together using a service like Mint.com that logs into all their bank accounts, pulls the information, and centralizes it.

• 3. Entity-to-person delegation. Corporations delegate the responsibility to act on their behalf to particular natural persons.

It should be noted that there are special cases of delegation where the government is given responsibility for people that are not covered in this book: (4) where parental responsibilities are taken from children's parents and held by the government, for example, when children enter foster care, and (5) after a person dies without a will and/or without an executor, the government fills this role.

Relationship to Other Domains

You and my identity is where activity related to individuals who cannot or choose not to act on their own behalf interact with identity and data systems. It was important to distinguish this from the me and my identity domain because not everyone acts on their own behalf in transactions. These two domains together are the source of the interactions with the next 12 domains covering the contexts of governments, commercial entities, civil society entities, and employment.

Who Is a Natural Person?

Before leaping into the details of the description of delegated identity between people, it is worth noting that only natural persons are given the right to delegate their identities in many contexts; thus, natural personhood is a prerequisite to delegation.

Lawful government surveillance can include surveillance of the whole society by a census, labor department surveys of employment trends, surveillance as part of lawful Internet tracking, or law-enforcement surveillance via warrant access. Examples of unlawful surveillance include warrantless mass surveillance of communications, revealed by Edward Snowden (Figure 9.1).

Relationship to Other Domains

Individuals don't know they are being surveilled by the government and are just being themselves in the me and my identity domain. The data collected in government surveillance are not usually sold to data brokers, but governments buy data from data brokers to support filling out surveillance profiles.

What Is Surveillance?

Wright et al. defines surveillance as “[t] he purposeful routine, systemic and focused attention paid to personal details, for the sake of control, entitlement, management, influence or protection.”

Theorists musing about the cultural grounding of surveillance point to roots in the Western tradition that come from the “all-seeing eye” at the heart of Judeo-Christian beliefs. The all-seeing eye creates a “fear of getting caught,” and this fear is internalized by citizens as they navigate the world. If behavior can be seen, then it can be controlled to create order. This is a privileging of vision that is rooted in the Enlightenment tradition.

It is worth noting that surveillance differs from registration and enrollment discussed earlier in a range of contexts in that there is no enrollment process where individuals “sign up” and thus know that there is an entry in a database about them that will be used when they interact with the system in the future. With surveillance, individuals are tracked and their activity over time is linked together in databases.

What Are the Power Dynamics of Surveillance?

Surveillance is something that institutions do to individuals. This creates an inherent power asymmetry. Surveillance studies often reference a discussion of the panopticon design envisioned by Jeremy Bentham in 1791 and published in 1834. Modern prisons were not yet built and his diagram was a theoretical design. Simone Brown in Dark Matters: On the Surveillance of Blackness compares Bentham's drawing of the panopticon with that of the plan of the slave ship Brookes published in 1788 that was a literal prison at sea for carrying 609 people.

The illicit market is where the information about individuals ends up after it is stolen or hacked by criminals from any of the discussed domains, including data brokers. There are two primary types of illicit market activity: criminal networks and statesponsored data theft and collection. Criminal networks are more likely managing the stolen data in spreadsheets rather than “organizational databases.” Data from statesponsored theft are ending up in large databases and being correlated with other data sets from other sources, including publicly available data (Figure 16.1).

Relationship to Other Domains

Actors from the illicit market are actively involved in stealing data from all of the other domains articulated in this research.

Description of the Illicit Market

The illicit market is where data stolen by criminals from large databases of PII are traded. Just like the data broker industry, there is no enrollment process for individuals and no direct connection between individuals and the entities stealing their data. The main difference between the illicit market actors and the data broker industry is that data brokers operate legally, buying data from their sources and then reselling it to other legitimate businesses. The illicit market actors are stealing the data of people and using it for criminal activity themselves or repackaging the data to sell to criminal enterprises.

We can also compare this domain to the categories of surveillance. It is not voluntary known surveillance because people don't agree to it. If you actually know your data was stolen because of a data breach notification, your condition is similar to the involuntary known state of surveillance. Individuals who know their data has been stolen can take steps to try and mitigate harm with credit freezes and creditmonitoring services. When individuals do not know their data has been stolen, it is similar to involuntary unknown surveillance.

The information asymmetry created between an individual and the actors in the illicit market is very high. This is especially true given that it is an entirely illegal activity. So, unlike some data brokers, illicit market actors have little or no incentive to provide a way to see information they hold about individuals.

Me and my identity is the identity of the self, and each individual is the starting point for interacting with digital systems. The community of professionals focused on user-centric identity, at the Internet Identity Workshop, has this focus at the center of their work. It is in this domain that the individual might have control of their own identifiers, their own servers, and collect their own data (Figure 1.1).

What Is Identity?

Discussions about identity can get very philosophical quickly. There is an enormous body of work that covers this terrain stretching back to the origins of humanity. This description will touch on a very brief overview that is rooted in Western philosophical thought. An avenue for future research is exploring how different philosophical traditions (Indigenous, Africa, Asian, Feminist, etc.) can inform the development of digital identity systems.

Who is “me” and what does “my identity” mean?

“Me” is a “self,” that is, an individual referring to the same individual.

The word “identity” comes from the Latin word from “sameness.” This is the underlying frame of identity in the Western tradition. Locke's theory of mind articulates this modern notion of the self that is a persistent consciousness through time.

Some challenges arise applying this to digital identity because while persistent identifiers are viewable, third parties can't see into individual's persistent consciousness through time. The modern industrial states have had to invent a notion of identity that can be assigned and be based on observations by third parties over time where the observations get recorded in databases.

Individuals have identities composed of a whole range of characteristics. We interact with a wider world and project “a self” to a wider world with various actions. This dramaturgical model of human life in society was developed by Erving Goffman in his book The Presentation of Self in Everyday Life.

There are two theories that prevail in the literature about the interplay of the self in the social world. Identity Theory sees the meaning derived from roles one plays in social contexts and Social Identity Theory sees the meaning derived from belonging to groups.

Employment surveillance is something that happens in the workplace and isn't new. Taylorism was created in the early part of the twentieth century to track and shape how workers work in order to reduce employer costs and increase employee productivity. With the rise of computerized technology, its form is changing. When individuals work they are surveilled by their employers (Figure 14.1).

Relationship to Other Domains

While individuals are doing their work, all the things in the domain of employment transactions, they are potentially being surveilled by their employer. Employers in the process of hiring, which happens within the employment registration domain, may also surveil a prospective employee by researching them. Employers may also surveil employees while they are interacting in their everyday life with governments, the commercial sector, and civil society. Databases developed during the time of employment are vulnerable to theft and sale on the illicit market.

Description

We could think of employment surveillance as beginning when individuals apply for a job and the employer goes to find out more about them. A good term for this is “preenrollment surveillance” or preemployment surveillance practices. A traditional corporation pays thousands of dollars to learn a lot about a prospective employee before it makes a hiring decision.

What is surveillance in the context of the workplace? “Management's ability to monitor, record and track employee performance, behaviors and personal characteristics in real time as part of organizational processes”. Since the existence of organizations, surveillance to track what their employees are doing has been practiced. There was a particular time in the mid-nineteenth century when the expansion of the railways and other industries experienced growing organizational complexity. They used information technologies— paper, index cards, punch cards, and the telegraph—to manage the flow of information within the organization. By internalizing information about customers, pricing, and competitors, this means that firms avoid having to obtain it and they lower transaction costs.

In the contemporary system we live in today, there's a relationship between production, wages, and consumption. Fordism, the paying of wages high enough for workers to be middle-class consumers, impacts the demand side of the economy (the government does surveillance of the labor market), and Taylorism on the production side requires information for worker control.

Most individuals’ first identity-related event with an institution occurs when parents register their child's birth (on behalf of the child) in a government registration process. Individuals also register with the government at other times in their life. These secondary government registrations include marriage and death, obtaining a license to drive, getting a passport, professional licensing, and registering to pay taxes or registering to vote (Figure 3.1). The first step is filling out registration forms once the government has accepted those and created a record in their systems they issue identification numbers and/or documents to the individual.

Relationship to Other Domains

The first identity interaction people have with the state is when their parents register their birth with the state. This is an example of you and my identity where the parent is working on behalf of the organization. When the individual as an adult completes secondary registration with the state, they do so acting on their own behalf, in an example of me and my identity (while presenting the documents that originated from that first you and my identity transaction that lead to the birth certificate being issued to them).

Government registration is required before performing many government transactions that require identifiers and proof of claims that these registration processes produce. Many civil society registration processes also require proofs of claims that government registration requires. Commercial entities doing high-value transactions, restricted transactions (buying tobacco or alcohol), or transactions under regulatory requirements also need these proofs of claims from governments before individuals can register. Employers often require that employees provide proofs of various claims and particular government-issued identifiers to support taxation.

How Do Citizens Get Registered with the State?

When a child is born, parents usually register that child with the state through a process that involves filling out a birth registration form that is sent to a state birth registry, which issues a birth certificate. Birth registration is the official recording of a birth by the state. Modern nation-states establish citizenship via parents’ citizenship or via the location of the child's birth.

The Domains of Identity outlines 16 key domains where individual's personally identifiable information ends up in databases. The book enumerates the 16 domains of identity, describing each in detail along with the types of data collected in the domain, the source and key actors among whom information moves.

I wrote this book for several reasons:

• 1) to give journalists and the general public clear simple terms to understand the mechanics of and issues surrounding identity management across a range of societal contexts;

• 2) to support professionals in the fields of identity management and privacy having a common language to understand where and how different types of identity interactions are happening, and from there being more able to solve the challenges that different domains present;

• 3) to support those working in academia and the private sector having a common language to understand the landscape of issues so that academic research actually serves industry and industry work can be better understood by those researching the field; and

• 4) to support government officials and those engaged with public policy issues being able to understand the challenges that exist in different domains and be able to craft better policies to address challenges within those domains.

Everyone in our society participates in identity management on a daily basis. It is so common that we do not really think about it. As a result, the discourse about identity often conflates radically different issues. The illicit market in which personal data are bought and sold is very different from the contemporary data broker industry, but it is not uncommon for people with fears about personal data use to lump these two contexts together—forgetting that one is a legal business market and the other is a result of criminal activity. Likewise, the data from a data breach via an HVAC vendor, such as the Target breach, that end up in an illicit market is different from data from a compromised enterprise identity management system protected by weak authentication (just a password) resulting in employee's authentication credentials being stolen in a spear phishing attack.

Civil society transactions are all the interactions with civil society institutions after registration: the classes you attend and the resulting transcripts that document those transactions, the visits to the doctor, hospital and labs, the accumulation of continuing education credits (CEC) as a professional, or the participation in any regular meetings/activities and voting as a member (Figure 6.1). Individuals present their credentials to the organization and are able to transact with or receive services from the organization.

Relationship to Other Domains

Before being able to transact with civil society organizations, individuals need to go through a civil society registration process. Some employment registration processes require proof of membership in professional associations and proof of current educational attainment from the domain of civil society transactions. Data from civil society organizations are sold to the data broker industry. Data is vulnerable to theft and appear on the illicit market.

What Is the Relationship between Initial Registration and Ongoing Interaction?

During the civil society registration process, individuals are enrolled and have a unique record created for them within the system. This might be just a name or a name and birth date. However, often it involves the issuance of a member number that allows the individual to assert who they are relative to the database index.

This number allows for the persistence and connecting together of records about an individual over the time period of their interaction.

To support both in-person and digital authentications, that is, the process of checking that indeed the individual presenting again is the individual who originally registered, they are asked to enroll any one of a number of authentication factors.

It is in the process of ongoing interaction and transactions with a civil society institution that individuals are asked to authenticate with the factors that were enrolled.

How Were These Managed with the Technology of Paper?

Formerly, institutions that tracked people and their interactions did so with index cards and other paper-organizing and filing technologies.

Tracking individual's interactions with institutions over time involved a lot of paper. Health records of patients created by doctors were all paper-based and involved lots of filing and maintaining of local records at the site of treatment, not in a digital repository.