Privacy is an Inside Job

The Searls Wanigan, 1949
Ordinary people wearing and enjoying the world’s original privacy technology: clothing and shelter. (I’m the one on top. Still had hair then.)

Start here: clothing and shelter are privacy technologies. We use them to create secluded spaces for ourselves. Spaces we control.

Our ancestors have been wearing clothing for at least 170,000 years and building shelters for at least half a million years. So we’ve had some time to work out what privacy means. Yes, it differs among cultures and settings, but on the whole it is well understood and not very controversial.

On the Internet we’ve had about 21 years*. That’s not enough time to catch up with the physical world, but hey: it’s still early.

It helps to remember that nature in the physical world doesn’t come with privacy. We have to make our own. Same goes for the networked world. And, since most of us don’t yet have clothing and shelter in the networked world, we’re naked there.

So, since others exploit our exposure — and we don’t like it — privacy on the Internet is very controversial. Evidence: searching for “privacy” brings up 4,670,000,000 results. Most of the top results are for groups active in the privacy cause, and for well-linked writings on the topic. But most of the billions of results below that are privacy policies uttered in print by lawyers for companies and published because that’s pro forma.

Most of those companies reserve the right to change their policies whenever they wish, by the way, meaning they’re meaningless.

For real privacy, we can’t depend on anybody else’s policies, public or private. We can’t wait for Privacy as a Service. We can’t wait for our abusers to get the clues and start respecting personal spaces we’ve hardly begun to mark out (even though they ought to be obvious). And we can’t wait for the world’s regulators to start smacking our abusers around (which, while satisfying, won’t solve the problem).

We need to work with the knitters and builders already on the case in the networked world, and recruit more to help out. Their job is to make privacy policies technologies we wear, we inhabit, we choose, and we use to signal what’s okay and not okay to others.

The EFF has been all over this for years. So have many developers on the VRM list. (Those are ones I pay the most attention to. Weigh in with others and I’ll add them here.)

The most widely used personal privacy technology today is ad and tracking blockingMore than 200 million of us now employ those on our browsers. The tools are many and different, but basically they all block ads and/or tracking at our digital doorstep. In sum this amounts to the largest boycott in human history.

But there’s still no house behind the doorstep, and we’re still standing there naked, even if we’ve kept others from planting tracking beacons on us.

One of the forms privacy takes in the physical world is the mutual understanding we call manners, which are agreements about how to respect each others’ intentions.

Here at Customer Commons, we’ve been working on terms we can assert, to signal those intentions. Here’s a working draft of what they look like now:

UserSubmittedTerms1stDraft

That’s at the Consent and Information Working Group. Another allied effort is Consent Receipt.

If you’re working on privacy in any way — whether you’re a geek hacking code, a policy maker, an academic, a marketer trying to do the right thing, or a journalist working the privacy beat — remember this: Privacy is personal first. Before anything elseIf you’re not working on getting people clothing and shelter of their own, you’re not helping where it’s needed.

It’s time to civilize the Net. And that’s an inside job.

__________________

*If we start from the dawn of ISPs, graphical browsers, email and the first commercial activity, which began after the NSFnet went down on 30 April 1995.

 

 

 

New Rules for Privacy Regulations

The Wall Street Journal has an informative conversation with Lawrence Lessig: Technology Will Create New Models for Privacy Regulation. What underlies a change toward new models are two points: the servers holding vast user databases are increasingly (and very cheaply) breached, and the value of the information in those databases is being transferred to something more aligned to VRM: use of the data, on a need to know basis. Lessig notes:

The average cost per user of a data breach is now $240 … think of businesses looking at that cost and saying “What if I can find a way to not hold that data, but the value of that data?” When we do that, our concept of privacy will be different. Our concept so far is that we should give people control over copies of data. In the future, we will not worry about copies of data, but using data. The paradigm of required use will develop once we have really simple ways to hold data. If I were king, I would say it’s too early. Let’s muddle through the next few years. The costs are costly, but the current model of privacy will not make sense going forward.

The challenge, notes Lessig, is “a corrupt Congress” that is more interested in surveillance than markets and doing business. Perhaps that isn’t a problem, according to an Associated Press poll (which has no bias, of course!):

According to the new poll, 56 percent of Americans favor and 28 percent oppose the ability of the government to conduct surveillance on Internet communications without needing to get a warrant. That includes such surveillance on U.S. citizens. Majorities both of Republicans (67 percent) and Democrats (55 percent) favor government surveillance of Americans’ Internet activities to watch for suspicious activity that might be connected to terrorism. Independents are more divided, with 40 percent in favor and 35 percent opposed. Only a third of Americans under 30, but nearly two-thirds 30 and older, support warrantless surveillance.

Right. After all, who needs business?

Electronic Health Records and Patient-Centric Design

CIO’s story Why Electronic Health Records aren’t more usable offers an interesting perspective on the current (improved?) state of affairs in medical care records. From the article:

The American Medical Association in 2014 issued an eight-point framework for improving EHR usability. According to this framework, EHRs should:

  • enhance physicians’ ability to provide high-quality patient care
  • support team-based care
  • promote care coordination
  • offer product modularity and configurability
  • reduce cognitive workload
  • promote data liquidity
  • facilitate digital and mobile patient engagement
  • expedite user input into product design and post-implementation feedback.

Nevertheless, it does not appear that EHR vendors are placing more emphasis on UCD. The Office of the National Coordinator for Health IT requires developers to perform usability tests as part of a certification process that makes their EHRs eligible for the government’s EHR incentive program. Yet a recent study found that, of 41 EHR vendors that released public reports, fewer than half used an industry-standard UCD process. Only nine developers tested their products with at least 15 participants who had clinical backgrounds, such as physicians.

Note that this situation is not due to a lack of user-centric efforts to make medical records more useful. Indeed there are several efforts underway, including HealthAuth, Kantara’s Healthcare ID Assurance Working Group, Patient Privacy Rights, HEART working efforts with OAuth and UMA, and more. As the article noted, there are regulatory complications as well as crazy-complicated workflow requirements imposed by the software designers/vendors. We need a shift in focus here.

Volvo’s In-Car Delivery Service

In Volvo launches in-car package delivery service in Gothenburg, Volvo’s new service “lets you have your Christmas shopping delivered directly to your car.” Intriguing idea that saves on parking hassles like those people who are waiting/idling around the favored spots.

With just days to go before Black Friday and Cyber Monday – the busiest online shopping days of the Christmas season – Sweden’s Volvo Cars has unveiled a brand new way to take some of the hassle out Christmas shopping.

The premium car maker has launched the world’s first commercially available in-car delivery service by teaming up with PostNord, the Nordic region’s leading communication and logistics supplier, Lekmer.com, the leading Nordic online toy and baby goods store, and Mat.se, a Swedish online grocery retailer, to have Christmas toys, gifts, food and drinks delivered to its cars. …

The Volvo In-car Delivery works by means of a digital key, which is used to gain one-time access to your vehicle. Owners simply order the goods online, receive a notification that the goods have been delivered and then just drive home with them.

Alas, not available everywhere. Yet.

Data Privacy Legal Hack-A-thon

Customer Commons is supporting, and board member, Mary Hodder, is hosting the Bay Area event. Additionally, there are NYC and London locations. Please join us if you are interested:

Data Privacy Legal Hackathon 2014
Data Privacy Legal Hackathon 2014

This is an unprecedented year documenting our loss of Privacy. Never before have we needed to stand up and team up to do something about it. In honour of Privacy Day, the Legal Hackers are leading the charge to do something about it, inspiring a two-day international Data Privacy Legal Hackathon. This is no ordinary event. Instead of talking about creating privacy tools in theory, the Data Privacy Legal Hackathon is about action! A call to action for tech & legal innovators who want to make a difference!

We are happy to announce a Data Privacy Legal Hackathon and invite the Kantara Community to get involved and participate. We are involved in not only hosting a Pre-Hackathon Project to create a Legal Map for consent laws across jurisdictions, but the CISWG will also be posting a project for the Consent Receipt Scenario that is posted in on the ISWG wiki.

The intention is to hack Open Notice with a Common Legal Map to create consent receipts that enable ‘customisers’ to control personal information If you would like to get involved in the hackathon, show your support, or help build the consent receipt infrastructure please get involved right away — you can get intouch with Mark (dot) Lizar (at)gmail (dot) com, Hodder (at) gmail (dot) com, or join the group pages that are in links below.

Across three locations on February 8th & 9th, 2014, get your Eventbrite Tickets Here:

* New York City * London, UK * San Francisco *

http://legalhackers.org/privacyhack2014/

This two-day event aims to mix the tech and legal scenes with people and companies that want to champion personal data privacy. Connecting entrepreneurs, developers, product makers, legal scholars, lawyers, and investors.

Each location will host a two-day “judged” hacking competition with a prize awarding finale, followed by an after-party to celebrate the event.

The Main Themes to The Hackathon Are:

  • Crossing the Pond Hack
  • Do Not Track Hack
  • Surveillance & Anti-Surveillance
  • Transparency Hacks
  • Privacy Policy Hack
  • Revenge Porn Hack

Prizes will be awarded:

  • 1st Prize:  $1,000
  • 2nd Prize:  $500
  • 3rd Prize: $250

There are pre-hackathon projects and activities. Join the Hackerleague to participate in these efforts and list your hack:

Sponsorship Is Available & Needed

Any organization or company seeking to show active support for data privacy and privacy technologies is invited to get involved.

  • Sponsor: prizes, food and event costs by becoming a Platinum, Gold or Silver Sponsor
  • Participate: at the event by leading or joining a hack project
  • Mentor: projects or topics that arise for teams, and share your expertise.

 

Contact NYC sponsorship: Phil Weiss email or @philwdjjd

Contact Bay Area sponsorship: Mary Hodder – Hodder (at) gmail (dot) com – Phone: 510 701 1975

Contact London sponsorship: Mark Lizar – Mark (dot) Lizar (at)gmail (dot) com – Phone: +44 02081237426 – @smarthart

The Internet of me and my things

Let’s say this key ring is yours and you’ve lost it.

If somebody scans the QR code with their smartphone, they will see a message from you. The message can say whatever you want (such as, “Help! I’ve misplaced these, please call or text me at this number”), and you can update it any time, because the information is in your personal cloud.

You can host your personal cloud yourself, or you can have it hosted elsewhere, such as at SquareTag, the brand name on the tag you see here. SquareTag is a service of Kynetx, the company behind the personal cloud concept. (Disclosure: I’m an advisor to Kynetx.) But you can use anybody’s. SquareTag is not a silo, and Kynetx is not out to trap anybody. Quite the opposite, in fact. Kynetx is out to give you tools to connect to your world of people and things.

Phil Windley is the co-founder of Kynetx and father of the personal cloud concept. In Personal clouds as general purpose computers, Phil says personal clouds are “the successor to the personal computer,” adding, “In the personal-cloud-as-personal-computer model, owners of a cloud control it in the same way they control their computer. They decide what apps to install, what services to engage, and how and where the data is stored.”

Most of the clouds we hear about today are the big centralized kind managed by companies such as Apple, Google and Amazon. Some of these industrial clouds are pure utilities, doing storage and compute work. That’s the case with, say,  Amazon and Rackspace. Nothing wrong with these, just as there is nothing wrong with electrical systems or storage facilities. Other clouds, however, are out to control you and your life — for both your good and theirs. Apple’s iCloud is one example. You can get it only from Apple, and it is not substitutable (as would be, say, a storage facility). In spite of the fact that Apple makes PCs and other personal devices, the company and its iCloud come from an old-school mainframe assumption: that one central server (or service) should contain and control what is done by many different clients. The technical term for this architecture is client-server. The vernacular term is calf-cow. You’re the calf. Apple is the cow. In the calf-cow system, you are always dependent, never fully independent.

With personal clouds you are independent. Your personal cloud is yours alone, to keep track of any thing, person or event in your life — and to manage your interactions with them. Such as, IF my keys are scanned, THEN display this message.

In an interview five years ago with Phil WindleyCraig Burton called every person an “enterprise of one.” In the past several years Phil and other developers (especially his colleagues at Kynetx) have been working on ways not only to make every person into that “enterprise of one” with connections to keep track of and control every thing of theirs as well. They are doing this through a general purpose platform called a personal cloud. You should have one, and so should the things you care about.

The design of the Internet in the first place is one of a boundless variety of end-points, with no central control of what those ends can do. Each is simply an address. Any end can connect with any other end. We have a similar system in the world called conversation. Anybody can talk with anybody else, or shake hands. They can also engage in business, and form relationships that last for moments or years. With personal clouds, things as well as people are brought into the Internet’s conversational and relational end-to-end system.

Take for example your car. Let’s say you put a SquareTag on the dashboard, next to the vehicle ID number. You can set up your car’s personal cloud so that all somebody scanning it sees is that it’s your car (or whatever you choose for it to say). But you can also scan the tag every time you have the car serviced, be taken to the car’s personal cloud, and enter whatever you like about the service event, or click on a private link that takes you (alone) back through your notes on the car’s service history. You can also set it up so the service station or dealer can connect their service records to yours, so when you look in your car’s personal cloud, you can also see those other service records. All you need for doing that are logical connections between the car’s tag cloud and the clouds of the other places where data is kept. With a squaretag, it isn’t necessary for any of your things to be “smart.” Instead the smarts are located in those things’ personal clouds.

There is no limit to what we can do with personal clouds because all of them are by nature independent, just as atoms are independent. And, just as certain kinds of atoms bond well with other kinds of atoms to form molecules, certain kinds of personal clouds (such as those of things we possess) will bond well with other kinds of personal clouds (such as human beings with possessions).

Likewise each of our personal clouds can, by mutual agreement, be social in the true and literal sense of the word — just as we are in the physical world. We won’t need to be social only inside corporate systems like Twitter’s and Facebook’s. There will still be administrative identities in the world (such as the ones on our drivers licenses and in employers’ HR systems), but among our sovereign selves we can choose to identify ourselves any way we wish. (Which others can, of course, accept or not.)

While personal clouds today are programmed with an open source language (KRL, for Kinetic Rules Language), and executed on an open source rules engine, what makes them interoperable are a new open standard: the evented API. Open standards are what allow closed (or open) things to connect and do things with each other. For example, it doesn’t matter whether you are reading this on a Linux, Mac, Windows, iOS or Android device. Open standards make it possible for all those things to communicate with each other.

We are at the earliest stage of where personal clouds will eventually go. What we can say with confidence, however, is that they will some day be the way each of us controls our lives, our personal data, our possessions, and our relationships with each other and our things.

We are born as sovereign beings, yet live in a networked world. The Internet as it was designed in the first place respected that. For most of the last two decades, however, we forgot that and built industrial-age systems that subordinated individual sovereignty and autonomy to the conveniences of large companies and governments. We built systems for capturing and controlling people and their things. There was lots of good stuff that could be done with these systems, but they were done at the expense of liberty and freedom for individuals and their possessions. Personal clouds not only promise that liberty and freedom, but provide the means for accomplishing it.

What we do with personal clouds is up to each of us — and to the countless new businesses that will show up to help out. When they do, you can bet a whole new boom of possibilities will show up too. The difference with this boom, however, is that each of us will be in charge of ourselves and what’s ours. That’s new. And it will never get old.

 

Wallets are personal

wallet-smallA lot of big companies are eager to get their hands in your pockets — literally. They want your mobile phone to work as a digital wallet, and they want the digital wallet app you use to be theirs.

Naturally, this looks like it should be a big business — and to some degree it is already. But it also hasn’t met promotional expectations. This became clear a few days ago, when comScore released Digital Wallet Road Map 2013, a $4995 report on the digital wallet business. In a press release highlighting the report’s findings, Andrea Jacobs, comScore Payments Practice Leader, said “Digital wallets represent an innovative technology that has not yet reached critical mass among consumers due to a variety of factors, including low awareness and a muddied understanding of their benefits.” Here’s how the release unpacks that:

The current digital wallet landscape remains fragmented among providers because of low consumer adoption outside of PayPal, with only 12 percent of consumers claiming to have used a digital wallet other than PayPal. However, study results indicated that the digital wallet market opportunity could eventually reach 1 in 2 consumers as consumers become more aware of the offerings and educated on their benefits.

Consumer Awareness and Usage of Digital Wallet Offerings
November 2012
Source: comScore Digital Wallet Road Map 2013
Digital Wallet Percentage of Total Respondents Aware of Digital Wallet Percentage of Total Respondents Who Used the Digital Wallet
PayPal 72% 48%
Google Wallet 41% 8%
MasterCard PayPass Wallet 13% 3%
Square Wallet 8% 2%
V.me by Visa 8% 2%
ISIS 6% 1%
Lemon Wallet 5% 1%
LevelUp 5% 2%

One clear barrier to use of digital wallets is that the concept is often difficult to convey and prone to misinterpretation. Even after being asked to review the websites of particular digital wallets, respondents across all wallet brands still scored an average of just 45 percent in terms of demonstrated level of understanding.

Here’s the problem: wallets are personal. Even if you have a wallet with a brand name on it (say, Gucci or Fossil), it isn’t their wallet. It’s yours. What you keep in it, and how you use it, are none of their business. In fact, those companies would never think of making it their business, because all they’re providing you is a place to put your credit cards, your cash, or whatever other flat things you feel like carrying around in your pocket or purse.

So far, all the digital wallets out there are not yours. They belong to some company. You merely use the app. The wallet is their business, not yours. In this respect they aren’t much different than credit cards or various loyalty cards, which are things you put in your wallet; not the wallet itself. The wallet itself should be agnostic, if not oblivious, to what you put in there. It should be like a toolbox, where you can store lots of different tools, made by lots of different companies, made for serving different purposes.

All the digital wallet companies in comScore’s chart have isolated, proprietary and silo’d ways of providing payment benefits to users. Imagine buying a tool box from Sears that could only hold its own brand of tools, which would only work with devices from companies that were partners of Sears. That’s what we have with digital wallets so far. It’s the same problem we had with online systems (AOL, Compuserve, Prodigy, etc.) before the Internet came along. They were closed silos.

The Net works because it is a general purpose system. It isn’t run by any one company. Likewise, PCs are also general purpose systems. The company making them doesn’t insist that it only works with certain other partner companies. In that respect it’s open, just like the wallet in your pocket or purse. Smartphones, on the other hand, are general purpose to a more limited degree. Apple tells you what apps can and can’t run on your phone. Google makes sure some of  its own apps (such as its wallet) run only on Android phones — or run better on Android than on Apple’s or other companies’ phones (as it did for years with Google maps for Apple).

I suggest that the digital wallet might be best thought of as something that’s part a general-purpose thing called the personal cloud.

Your personal cloud is your personal space, which you run for yourself in the networked world. In it you define the ways that your personal data interacts with the world of things, and of services from companies and other entities. That may sound complicated, but it’s actually no different than the personal space you call your house, your car, and your body. In fact, you can think of a personal cloud as something akin to all three, but in the networked world rather than in the physical one. For more on this read Phil Windley, starting here; and follow what Kuppinger-Cole says about Life Management Platforms (which I recently visited here).

So, to sum up, the main thing wrong with digital wallets today isn’t what they do. It’s that they are called “wallets.” Instead they should be called what they really are, which is payment services. (Yes, they do more, but the main thing they do is facilitate transactions.)

The notion that something so personal as a wallet should be provided for you, as a service, by a company, is typical of the calf-cow thinking that has dominated computing for the duration. There is nothing wrong with this, if it’s still 1995. But it’s now 2013, and it’s time we moved on. And, to do that, I’d like to see real digital wallets — personal ones — come up as a feature of personal clouds. So, let the conversation begin. Then the development.

Bonus link: Google’s Wallet and VRM.

 

 

 

 

 

Discounts are free if your time has no value

“Love it or hate it, Black Friday is all about the deals,” AdAge says, in Target, Amazon, Poised to Win Black Friday. That love/hate conflict speaks to the mixed blessings (and curses) of tying a store’s — or a whole market’s — success to “deals” alone. The bargains, for both retailers and customers, can be Faustian.

Exhibit A: Kmart.

Back around the turn of the millennium, I attended a retail conference where two of the speakers were myself and Lee Scott, then the CEO of Walmart. We represented the bookends of demand and supply: as a co-author of The Cluetrain Manifesto, I represented the customer. As CEO of the world’s largest retailer, Lee represented his whole industry.

The location was Lucerne, and the lunch was boxed. It was a nice day, so my wife and I took our boxes outside and sat at a small table near the lake. Lee came over and asked if he could join us. I said sure, and then used this rare opportunity to pump the dude with questions. My first was “What happened to Kmart?” — which was then closing stores and heading toward bankruptcy.

His answer: “Coupons.” Some large percentage of Kmart’s overhead, he said, was devoted to publishing what amounted to its own currency, and then dealing with numerous effects, which only began with the time wasted by handling that currency at check-out. In addition to inconveniencing everybody involved, couponing also had the effect of “downscaling” the demographics of the customer base to a caste then known to the trade as “coupon-clippers.” (This population has now become so large — and expert — that the reality TV show Extreme Couponing persists into its third season.)

Walmart, Lee explained, minimized its dealings with coupons — and even advertising, which was limited (by decree of the late Sam Walton) to some small percentage of the company’s overhead. Instead they let the company’s tagline, “Everyday low prices,” do most of the work. (That tagline was also Sam’s.)

When I asked Lee if there were any large retailers he thought did an especially good job, he singled out Costco, which also succeeded through simplification. (Yes, they do publish and take coupons, but it’s a side thing, rather than the main thing. As a Costco customer you don’t need coupons to obtain the sense that you’re paying a low price for the goods they sell.)

Retailing has long had its time-sucking frictions. When I was growing up, in the 1950s and ’60s, the big one was stamps. The main driver of the trend was S&H Green Stamps, which had many competing imitators. The original idea was for retailers to differentiate from other retailers by offering sheets of stamps with every purchase, which customers could paste into a booklet, which they would later trade in for an outdoor grill, a door mat, or some other item from a catalog. It’s been said that S&H at its peak issued more stamps than the U.S. Post Office, and that the largest press run in human history was the 1966 Green Stamps catalog. Eventually, however, nearly every store offered the stamps, differentiation ended, and whole fad collapsed.

Today we have a similar fad with loyalty cards. Never mind that most retailers (or so it seems) now have them, but that they have costs to both retailers and customers. Here are just a few:

  • Maintaining two or more prices for items throughout the store
  • Forcing both personnel and customers to attend constantly to the differences in prices on “discounted” items
  • Partially or completely obscuring what the “real” price might be. Is the non-discounted price a surcharge for non-card-carrying customers? Probably, if the “regular” price for a dozen eggs is $3.99, and the “discount” price is $1.99 — when, say, Trader Joe’s (which has a single non-discount price for everything) wants $1.99 for the same eggs.
  • Maintaining “big data” systems for tracking customers and “personalizing” offers for them.
  • Obscuring the real value of goods gets even more than it already might be.
  • Coercing loyalty rather than earning it, causing emotional dissonance that can damage a company’s brand value.

All those practices, and many more, are both normative and highly rationalized within retailing today. Yet the notable exceptions, such as Trader Joe’s, reveal how much time, money and effort by both sellers and buyers in systems that are essentially coercive.

What would happen if we began to respect time as our most essential value? Would we have discounting at all? Not sure, which is why we need to talk about it. There are real costs to discounting. If our time has any value at all, then discounting is not free. And the hidden costs may be far higher than the obvious ones.

Free vs. Followed

grasped hand The fight between the free market and the followed market is about to begin. And the way to bet is on the free market, because it’s what we know works best. Also because the followed market is nuts.  It only persists because it’s normative at the moment, and an enormous sum of investment is going into improving what’s most nuts about it: following people around and constantly guessing at what they might want (or trying to make them want something some algorithm thinks it might be able to make them want).

Let’s look at those norms a bit more closely. In the followed market, we —

  • Maintain separate logins and passwords for every site and service with which we do business, which might number in the hundreds
  • “Agree” to terms of service and privacy policies that we don’t bother to read because we have no choice but to accept them if we want to use the offered services
  • Acquiesce to stalking by sites and their third parties, even as we travel out of those sites and around the Web

In the physical world where the free market remains defaulted, you are free to be who you say you are (or to remain anonymous — that is, nameless in the literal sense), and to arrive at whatever terms are agreeable to you and the sellers you engage, with minimal coercion. This is what we enjoy when we walk through a bazaar, down Main Steet, or through a shopping mall. We don’t have to become a member of Nordstrom, or Trader Joe’s, The Container Store, or the corner grocer, to shop there, or to buy anything from them. And, when we do, we usually assume that we are not being tracked by the store after we leave.

In the followed market, we are free to choose between captors who make all the rules. Our personal identity is the separate one we have with each of them, and which they administrate. Our relationship with each of them is fully contained within their separate silo’d systems. Worst of all, we are stalked after we leave, as a matter of course. “Social” sites such as Facebook aid in surveillance by making it easy for us to spill all kinds of personal data — about ourselves and our contacts — when we “login with Facebook” elsewhere.

And its getting worse.

On July 30, 2010, The Wall Street Jounal inaugurated its What They Know series (http://wsj.com/wtk) with The Web’s New Gold Mine: Your Secrets, by Julia Angwin. Here were the key findings she reported:

• The study found that the nation’s 50 top websites on average installed 64 pieces of tracking technology onto the computers of visitors, usually with no warning. A dozen sites each installed more than a hundred. The nonprofit Wikipedia installed none.

• Tracking technology is getting smarter and more intrusive. Monitoring used to be limited mainly to “cookie” files that record websites people visit. But the Journal found new tools that scan in real time what people are doing on a Web page, then instantly assess location, income, shopping interests and even medical conditions. Some tools surreptitiously re-spawn themselves even after users try to delete them.

• These profiles of individuals, constantly refreshed, are bought and sold on stock-market-like exchanges that have sprung up in the past 18 months.

The new technologies are transforming the Internet economy. Advertisers once primarily bought ads on specific Web pages—a car ad on a car site. Now, advertisers are paying a premium to follow people around the Internet, wherever they go, with highly specific marketing messages.

On the 17th of this month, in Online Tracking Ramps Up, Julia begins,

Online tracking on 50 of the most-visited websites has risen sharply since 2010, driven in part by the rise of online-advertising auctions, according to a new study by data-management company Krux Digital Inc.

The average visit to a Web page triggered 56 instances of data collection, up from just 10 instances when Krux conducted its initial study, in November 2010. The latest study was conducted last December.”The main reason for the difference is live online auctions of data about you:

Krux estimated that such auctions, known as real-time bidding exchanges, contribute to 40% of online data collection.In real-time bidding, as soon as a user visits a Web page, the visit is auctioned to the highest bidder, based on attributes such as the type of page visited or previous Web browsing by the user. The bidding is done automatically using computer algorithms.

On June 26, the Journal published On Orbitz, Mac Users Steered to Pricier Hotels, by Dana Mattioli, who writes,

The Orbitz effort, which is in its early stages, demonstrates how tracking people’s online activities can use even seemingly innocuous information—in this case, the fact that customers are visiting Orbitz.com from a Mac—to start predicting their tastes and spending habits.

Imagine walking with a friend down 5th Avenue in New York and attempting to have a conversation about the totally different scenes both of you see when you look into the stores you pass or enter together. One of you sees hats in a store window while the other sees shoes. One sees a door where the other sees a wall. One sees a counter of candies while the other sees an aisle of garden tools. When one of you pauses to look at the cosmetics counter, the colors of lipstick suddenly change, because the store — or its third parties — know it’s you and start making guesses about what you might want, or that the companies paying for shelf space in the store hope to make you want. When the other looks at the store directory, she finds that the departments have been re-arranged. Now the shoe department is to her right when it used to be to the left. The dress shoes are now in the back, and all of them are red and black. Athletic shoes are now in front, because she paused to look in the window of a sporting goods store back up the street.

Whether or not this kind of personalization works is beside a more essential point: that in today’s online marketplace we are being followed constantly, with at most only our tacit approval. Without the conscious involvement of fully human customers, operating as free and independent actors possessing full agency, the online environment has gone insane. That is, without coherence, or grounding in reality. It makes sense only to the vendor’s side of the marketplace, and even there it’s not fully together. Writes Julia Angwin in her most recent story,

More than half the time, Krux found that data collectors were piggybacking on each other. For example, when a user visited a website that had code for one tracking technology, the data collection would call out to and trigger other tracking technologies that weren’t embedded on the site. As a result of such piggybacking, websites often don’t know how much data are being collected about their users.

‘It may be the first medium where the buyers have more information about the price, the value and the amount of inventory than the seller,’ said Krux President Gordon McLeod.

In the free market, as it has been understood since our ancestors first traded shells for seeds, certain things are stable and well understood. These include not only the physical nature of locations, but social norms and protocols for interacting with each other, which begin with the assumption that the other party is a free, independent and sovereign being who controls what is public and what is private about themselves. (Which is why, for example, we tend to wear clothes in public and live in enclosed spaces.)

In the free market it would be absurd for a guy from a store to put a hand in your pocket and hold onto your leg while you walked around, saying “Don’t mind me. I’m just here to see what you’re up to. Actually I don’t want to know your name, but just to track what your body is doing so you can get the best advertising and product offerings, based on what some machines think at the moment would be best for you and for us. It’s for your own good.” Or, more literally, to do the same with an invisible robot tick that attaches to your body and sucks out your data. But in the followed market, that stuff is normative in the extreme. And it works well enough, so far, at least for the advertisers and their intermediaries, that it persists in spite of its absurdities.

The followed market will fail not only because it is absurd and offensive to human sensibilities, but because it is not as effective as the kind of simple human interactions we were all built for in the first place. We don’t have those online yet — not in the commercial space comprised of billions of competing silos. But we will. Count on it. The Web we know is just seventeen years old (dating back to the first graphical browsers in 1995).

In a general way, what the free market still lacks online is a build-out of capabilities on the customers’ side to match the build-out of capabilities on the vendors’ side. That’s what ProjectVRM has been working toward for the past six years. The result so far is a growing list of developers, projects and prospects for major breakthroughs in customer capacity to assert independence, establish privacy boundaries, and deal with vendors as self-empowered equals and not as vendor-defined and -controlled dependents.

Customer Commons’ mission is to preserve and improve the free market, both online and off, by helping customers become free and independent participants in that market. So, while ProjectVRM remains focused on development and developers, Customer Commons is focused on putting those developments to work for customers — and for giving customers a way to participate in that development, and to lead it forward.

And we welcome your help with that.