One of the challenges with the whole NSTIC thing is that it has a bunch of different parts. I wrote up this description as part of our What could Kill NSTIC paper.

NSTIC National Program Office. The NSITIC NPO operates within the Department of Commerce’s National Institute of Standards. It is lead by Jeremy Grant. The office has several full time staff and they are responsible for the transition of NSTIC from a US government initiative to an independent, public- private organization. They’re smart, talented, and they care.

Identity Ecosystem Steering Group (IDESG). The NPO invited many people, NGOs, government bodies, and companies to participate in building an identity ecosystem in the Identity Ecosystem Steering Group. All the people and organizations who sign up to be a part of this are together called “The Plenary.” The NSTIC NPO wrote IDESG’s charter and its first bylaws.

IDESG Management Council. The IDESG management council is elected by the members of the plenary who self-selected into stakeholder categories. Each stakeholder category elects a delegate to the Management Council. The entire plenary also elects two at-large positions and two leadership positions. The management council can create sub-committees to get its work done. I’m chaired one that collected holistic ecosystem pictures, for example.

Committees within the IDESG Plenary. These committees do the actual work of making the identity ecosystem’s vision a reality. New committees can be proposed by any member. Committee membership is open to all plenary members. The work and activity of the committees is shared openly. A few of the active committees are working on standards, privacy, trust frameworks, accreditation, and nymrights.

The Secretariat. The NSTIC NPO awarded a $2.5 million dollar contract to provide support services to the Identity Ecosystem Steering Group. Trusted Federal Systems won the contract to act as the IESG’s “Secretariat.” They coordinate meetings, manage listservs, and the like.

NSTIC Pilot Projects. In early 2011, the National Program Office put forward $10 million in funding for five pilot projects that worked to solve some of NSTIC’s challenges. Grants were awarded in September 2012 and run for one year. The pilot projects were set up before the IDESG existed and the IDESG had no input into the selection of the the winning pilots. 187 different initial pilot projects applied for grants, 27 were selected to submit full proposals, and five were selected. Applications for a second round of pilots are coming in Q1 2013.

My colleague at the Personal Data Ecosystem Consortium, Phil Wolff, hosted sessions at the last two IIW's that invited community consideration of the risks to NSTIC. He has put together a paper that outlines the results of these two sessions that were titled "Death to NSTIC" the white paper is "What Could Kill NSTIC: A Friendly Threat Assessment". He has a video about it and you can download it from our website. 

It also has a Bonus Section I wrote that:

• Explains some of the background of NSTIC

• Articulates the 6 main parts of NSTIC and what they do

• Explains the relevance of NSTIC to the companies in the Personal Data Ecosystem Consortium.

I'm planning on running for Mayor * again (a position on the NSTIC Steering Group Management Council) - this time for a different "municipality" (delegate representative).

Currently I am the Consumer Advocate delegate - I'm going to shift my membership and join the IDESG with my hat as Executive Director of PDEC and run for the Small Business and Entrepreneur delegated on the Management Council.

If you want to be a part of the IDESG and VOTE in this round of elections you MUST register by February 14th.  

Go to KaliyaforMayor.org to learn more about my campaign & register to vote OR just go to their site if you are new. If you registered last election you have to submit the new/updated membership agreement including signing it and sending it in.  Send an e-mail to:  administrator@idecosystem.org update your registration.

If you want updates from me put your e-mail here 

Why the shift in my mayoral race to a new stakeholder delegate category. Simply it creates greater alignment with the main focus of my day to day work on two fronts.

• PDEC is a trade association of entrepenuers from around the world working developing personal clouds and services.
• I myself am a small business owner Unconference.net is my conference design and facilitation business

It seems like it was just yesterday that I ran for Mayor * (The Consumer (and Citizen) advocacy delegate on the management council of the Identity Ecosystem Steering Group for the National Strategy for Trusted Identities in Cyberspace) but that was in August. Another round of elections is happening this spring.

I have been to all the Management Council meetings even those that happened at 3am local time when I was in China in September. Much of the energy and attention in this first period of of NSTIC was on the governance of the steering group but now we are focusing on getting real work done.

In December I was asked by Brett McDowell chair of the Management Council to chair a sub-committee of the Management Council focused on collecting Holistic Pictures.  We have completed our work you can see it here.

I also have been helping people who were involved in the NymWars who have an interest in ensuring that NymRights issues are represented within NSTIC.

Recently within NSTIC there has been a focus on business models for businesses and overall market models. I think that PDEC companies have a lot to offer in this effort and are really making privacy protecting, end user empowering business models.

Second Challenge:  How are we meaningfully and regularly checking in with those outside the community of self selected stakeholders - to regular citizens who have to use the currently broken systems we have today and hopefully will be enthused and inspired to adopt the outcomes of this whole effort?

The openness of NSTIC overall was inspired by the Open Government memo (http://www.whitehouse.gov/the_press_office/TransparencyandOpenGovernment)  signed first day in office. It inspired a lot of my colleagues in the dialogue and deliberation community. (Yes, I have another life/carreer doing facilitation see http://www.unconference.net)

They went to work figuring out how to be sure that coherent resources and tools were available to those who were now mandated to "do" open government and have more public participation would have really good resources available.  Tom Atlee the person I co-wrote the Governance section of my NOI was one of the leaders of this working with the NCDD (the National Coalition for Dialogue and Deliberation) to define 7 core principles of public engagement.

Blog post that outlines them: (http://ncdd.org/rc/item/3643)

Read the rest of this entry »

I am posting to this blog the two posts I made to the NSTIC IDESG governance list on Tuesday. Here is the first one on Governing "us" (that is the word "us" not U.S.)

I only got on the [governance] list over the weekend despite raising my hand to be a part at some point in the Chicago meetings.

I am working to track all that is being discussed and I also want to breath and step back a bit. I want to share two bigger challenges and perspectives.

First Challenge how are we we connecting/structuring and governing the interested stakeholders who ARE showing up to engage.  How are we as Bob just asked creating ways, systems, processes and tools forward to create alignment and agreement?

Second Challenge  How are we meaningfully and regularly checking in with those outside the community of self selected stakeholders - to regular citizens who have to use the currently broken systems we have today and hopefully will be enthused and inspired to adopt the outcomes of this whole effort?

They are two quite different but related challenges. This e-mail will deal with challenge 1. The next one with Challenge 2.

Read the rest of this entry »

In my governance NOI response I proposed several different methods be used to solicit input from a wide variety of stakeholders and bring forward from those processes clear paths for making a real strategy that take input from a wide range of stakeholders.

When the first governance drafts came out of the NPO, they articulated that the steering committee would operate via consensus BUT then it also articulated a whole set of voting rules for NOT abiding by consensus.

When I asked about their choice of using the term consensus to define a particular methodology - they came back and said well we didn't actually mean to suggest the use of a particular proces.

But consensus IS a process method I said...and they said we didn't mean to proscribe a method. So we were sort of in a loop.

Now that we are in this stage that is considering governance and systems for the community of self identified stakeholders (and people beyond this group who will be the users of the outputs).  What I don't know is if people really know what real consensus process is or if we have anyone who is experienced in leading actual consensus processes? It keeps feeling to me like we are using Roberts Rules of Order and then getting everyone to agree - thus having "consensus".  That isn't consensus process.

Tree Bressen who was the leader of the Group Pattern Language project (I participated along with many others in its development) has an amazing collection of resources about conensus process including a flow chart of consensus process and Top 10 mistakes to avoid them.

Are we using consensus process?

One of the big issues of our democracy today (in the liberal west broadly) is that we have this tendency to believe that "voting" is the thing that makes it democratic. Voting is a particular method and one that by its nature sets up an adversarial dynamic. There are other methods and ways of achieving democracy and we can go well beyond the results of our current systems by using them. Tom has done a lot of research into them over the years at the Co-Intelligence Institute and has published two books The Tao of Democracy and Empowering Public Wisdom. 

I am glad methods outside what has been the normative frame of "Roberts Rules of Order" as Democracy are being considered...however we need to be clear on what processe we are using.

This past weekend I finally got onto a bunch of mailing lists for NSTIC including the governance one. (you can too)

It is a generally accepted best practice that governance systems should be developed by the communities that need to live by them. With NSTIC the stakeholders were handed a charter and bylaws created (primarily driven by the vision of one guy) in the NSTIC National Program Office.  They kept saying "there is consens" around the charter and bylaws...but there wasn't they were sort of thrust upon us and not developed by us.  We chose to accept them for now and are now in the process of re-visiting the bylaws handed to us and we agreed to for a short period to get things going.

The draft by-laws include a privacy standing committee that has veto power over the outcomes of Identity Ecosystem Steering Group.

One theory about why this is, I have heard more then once from industry folks involved with NSTIC, is that the privacy constituency "got" this committee and its veto power as a deal to participate in NSTIC.  We don't know ... cause the process of how this idea of having this committee have a veto was not transparent or open.

If we are committed to actually having a consensus based process then no one group committee needs a veto.

I said on the chat during the call that there was a misttrust issue.  I don't trust giving the privacy advocates a veto in part because they don't currently show up and engage with industry in the development of the tools and technologies.  I have regularly invited privacy advocates to participate in the Internet Identity Workshop and I regularly have those invitations declined. I will call out the specific groups the ACLU of Northern California and the EFF.  (Having received a cool shoulder from them I haven't pursued inviting other groups however the woman from the World Privacy Forum who spoke today on the governance call would be great to have at IIW) Both claim "nonprofit" poverty and say lack of budget to attend such events. (IIW has an early bird ticket price of $150 and includes three meals a day for three days....so its not expensive). Both have multi-million dollar budgets and choose not to invest, as part of how then spend their resources, on showing up in forums like IIW with industry "making the sausage" of open standards for how identity will work for people on the internet.

Organizations like this tend to spend their money on lawsuits against companies who have violated privacy. I don't disagree that EPIC and other groups should be holding Google and Facebook accountable for changing their settings in ways that violated user expectations and therefore one version of waht privacy is. However if that is all they do...(sue and file complaints with government agencies) then it is like investing in prisons instead of schools.  If you invest in schools you won't need prison's later to hold the citizens who become criminals because they didn't get a good education.

If they chose to invest in the fora where technical standards are made and work with industry to ensure that the interoperable systems they design are in alignment with core functional requirements that give people control of the flow of information about them in digital systems (what we might call privacy). Then they wouldn't have to file so many law suits down the road cause they would work well.

There is also the issue that "Privacy" isn't ONE THING.

See: Solove - Taxonomy of Privacy 

Until it is clearer what the groups who are pro-privacy mean and how they see it being instantiated in the standards that becoms the code that will be the basis for the ecosystem.  It feels really hard to engage or trust them with a veto.

My fear is that a structure for IDESG that includes a privacy committee with a veto will continue to foster the current pattern of of industry interaction. The privacy interested groups will stay away from really engaging with technology developments as they are done BECAUSE they have a veto over them .. at the end of the process. They will stand on the sidelines and then swoop in and kinda "gotcha" those in industry who have been working together.

Update August 18th: 

Thank you to all the people and organizations who vote for me in the NSTIC election - I WON! .  I ran with my association to Planetwork and I am the Consumer and Citizen Advocate delegate for the next 6 months on the Management Council of the Steering Committee of the National Strategy for Trusted Identities in Cyberspace. You can learn more about my candidacy and the election on this post.  You can track the group/community progress at IDEcosystem.org.

I will be working hard with the AARP to grow the number of citizen and consumer advocate groups who are participating in the NSTIC process.

Original Post:

I'm Running for Mayor NSTIC!
Learn how to vote for me and get involved at Kaliya for Mayor .org

Here is the video!

Read the rest of this entry »

So it's NSTIC election time!

I'm running for the Consumer (And Citizen) Advocacy delegate position on the Management Council of the Steering Committee for the National Strategy for Trusted Identities in Cyberspace!  Learn how to vote for me and get involved at KaliyaForMayor.org and see my campaign video.

I, like many in the identity community, have been paying attention to and tracking this since the first draft of the proposal two summers ago.

They wrote a draft we gave input. They announced they would be launching a strategy in Silicon Valley then they launched the Strategy.

They wrote a Strategy and then hosted a Governance  and Privacy technical "workshop".   Both were poorly designed and kinda ineffective but non-the-less well intentioned. 

They asked us how it should be governed with a "Notice of Inquiry" about that last summer (I submitted my ideas    others did too).

The technical meeting about NSTIC was woven in with IIW #13 last fall.

They had a briefing about the Grants for pilot projects (I attended via webinar).

They ( the NSTIC National Program Office) put forward a charter and by-laws. They have an Identity Ecosystem Steering Group webinar.

Kaliya "Identity Woman" Hamlin, Executive Director of the Personal Data Ecosystem Consoritum is speaking on a panel at RSA about NSTIC.

It is moderated by Jeremy Grant the head of teh NSTIC Program Office and includes fellow panelists Michael Barrett from PayPal, Jim Dempsey from the Center for Democracy and Technology and Craig Spiezle fromt eh Online Trust Alliance.