I also indicated that whereas the lavender roles receive a lot of attention in the community, the other colors do not. In this post, I’d like to take a look at what I’m calling a “Claim Broker” by outlining what a Claim Broker might do, why it is necessary, and some of the challenges a business like this might face.

As I wrote in part 1 of this series, much of this thinking was spurred by a talk Bob Blakley gave on the role of Relationships in the Identity industry at Burton’s Catalyst this summer. In that talk, he focussed on the need of what I’m calling a “Claim Holder” to develop a strong relationship with the Subject whose claims they are responsible for. This, of course, makes sense, because the stronger the relationship, the better the claims will be. When I began to think about this, however, I began to wonder if the MAJOR barrier to a broader adoption of Identity technologies was the weakness of THIS relationship.

To give an example of this, I have a pretty strong relationship with Netflix as my “movie” Claim Holder. I also have a strong relationship with Fandango. Now the question is, do these organizations really need to improve their relationships with me? They could (and probably should–particularly Fandango), but my relationship with THEM isn’t what’s preventing me from sharing the claims they have about me with other organizations. The relationship that is missing, is the relationship between THEM and OTHER ORGANIZATIONS.

Now there are good reasons these sites don’t have relationships with other websites (or each other as far as I can tell):

1. It’s not their core business. Their core business is and SHOULD BE fostering a relationship with ME.
2. The other organizations that would be interested in their data are likely competitors.
3. Establishing these relationships is expensive and doesn’t scale for a single Claim Holder.
4. There is no obvious financial incentive for establishing these relationships.

The point being, if the Identity industry waits around for Claim Holders to rise up and become Identity Providers, the Identity industry will be waiting for an amount of time approaching never. It makes no sense for a Claim Holders to enter into this business. The above conditions are PERFECT, however, for a Claim Broker:

1. A Claim Broker’s core business IS to establish relationships between Claim Holders and Claim Consumers.
2. A Claim Broker can act as a NEUTRAL broker of trust between competitors.
3. The economies of scale work for a Claim Broker by multiplying the value of each relationship they create.
4. Part of a Claim Broker’s job is to assess supply and demand and to set prices.

Let me unpack these points above beginning with the idea that this industry needs a strong sales organization DEDICATED to building relationships between Claim Holders and Claim Consumers. I see a real gap between these two kinds of organizations that is going to take a TON a sales work to close. Claim Holders often view their customer data as the core of their business that provides them with a competitive advantage against existing businesses and a barrier to entry for new ones.

Claim Consumers, on the other hand, are ill-equipped to make use of these claims and don’t fully-understand the value of the data they would receive. Not only that, but this is all a very new and weird idea for both of these businesses, and any time you have to explain a NEW business model, you are facing an uphill sales challenge. The point being, this is an entirely non-trivial sales challenge that will need to be handled by a large and sophisticated sales organization.

The second point is that this sales organization can’t be an existing Claim Holder. There is no way that Netflix is going to convince Blockbuster that they, as Netflix, could act as a fair and neutral broker for Movie Claims. Google won’t convince Microsoft. Facebook won’t convince MySpace. If there is any hope of these organizations forming relationships, it will have to be through a neutral third party whose ONLY job is to maintain those relationships.

The third point is just a classic example of Network dynamics. If I’m Netflix, and I go out and establish a relationships with every website that could consume my Movie Claims, there is no way I can justify the cost. If, as a Claim Broker, however, I represent Netflix, Fandango, Moviefone, Blockbuster and every other movie Claim Holder, each Claim Consumer relationship I establish is MULTIPLIED in value by the number of Claim Holder relationships I have.

The fourth and final point is that before any Claim Holder will ever pay attention to this industry, someone will have to take the risk to develop relationship with Claim Consumers and establish a market price for the data the Claim Holders have. This, I believe, is the most pressing issue facing the Identity industry and one that is receiving WAY too little attention.

The industry continues to gloss over this fundamental question with the same tired examples of Credit Scores, Age Verification, and Address Verification. Certainly there are businesses here, but the one (Credit Scores) is already established and at best subject to slightly better margins using Identity 2.0 technologies and the other two (Age and Address Verification), in spite of reassurances that regulation will drive adoption, have been functioning across the entire spectrum (youth social sites, porn, and liquor for Age and e-commerce for Address) for a decade now without strong verification.

I am NOT arguing that these industries wouldn’t benefit from stronger claim validation, I’m simply saying that I haven’t seen enough leg work done on the sales side to give me any comfort about how MANY interested Claim Consumers there are or how MUCH these organizations would pay for stronger claim verification. And this is the state for the OBVIOUSLY valuable claims. What about the more esoteric visions that are driving much of the energy around Identity technologies?

How many Claim Consumers are there for Movie Claims and how much would they pay? What about for my music preferences? Or my Social Graph? I’ve seen virtually no work done on this and the little I’ve done hasn’t been encouraging. The basic idea, is that the Claim Consumers could use these claims to provide a more tailored experience to their visitors. To do this, they would need to incorporate this into some sort of recommendation engine technology. I’ve spoken to some of the recommendation engine companies and their customers. The picture I get is this:

1. Explaining the value of this technology even to large sophisticated Claim Consumers is VERY challenging.
2. The technology is non-trivial to implement and a major integration headache for Claim Consumers.
3. The QUALITY of the recommendations mean very little in terms of lift (the increase in sales post implementation).

In fact, if I were a recommendation engine company, I’d build a simple web service that was easy to implement that recommended socks and underwear at the end of each purchase. The point being, that for these more general “customized web” use-cases for Identity Claims, there is little indication that ANYONE is willing to pay ANYTHING for the data.

So what are some of the tough questions facing a fledgling Identity Claims Broker:

1. How much value can Idenity 2.0 technologies provide to the more mature Claim Holder/Consumer relationships?
2. Will the gap between the value of the Claims to the Holders and the value to the Consumers ever narrow sufficiently?
3. When will the adoption of recommendation engine technology be widespread enough to provide a large and ready market of Claim Consumers.
4. How expensive will it be to sell Claim Holders/Consumers on a novel business that they both have reason to be skeptical of?

As I hope the above makes clear, there is a LOT of work to be done on the relationship between Claim Holders and Consumers. Furthermore, it is my opinion that this work should be done PRIOR to building a ton of great technology to enable it. I’ve built revolutionary technology before assessing the need for it WAY too many times before to do it again. Nothing is more depressing than spending the inordinate amount of care that it takes to build quality software only to discover that there isn’t enough pain to justify the expense of convincing entrenched industries to use it.

What do you think? Does anyone have a better sense of how many Claim Consumers are eagerly awaiting validated claims? Does anyone know how much they will pay? Drop me a note or a comment if you do.

1. What other relationships are missing from the Identity scene that might be inhibiting its development?
2. What other information would be valuable in Bob’s “Relationship Data Object” besides the nature of the relationship between the Subject and the IP?

In other words, Bob spent a lot of time talking about the relationship between the IP and the Subject, but I want to know if there are some other relationships, the neglect of which, might be a greater inhibitor to this industry moving forward. Also, if we do find some other relationships that need to be accounted for, what implications does that have for the “Relationship Data Object” Bob sees as the tradeable asset in the industry?

Now since my thoughts about this have been in some way inspired by an analysis of Bob’s talk, I want to keep with that theme and AVOID doing something with this series that both Bob and I have a tendency to do, and that is to “bury the lead”. In other words, Bob and I both like to keep the “cool” idea that we think we have until the end of a paper. This is a lot of fun as an author because it let’s us build up some suspense. The problem with this is that the subject matter of Identity is obscure enough on its own, and by trying to be clever, we can very easily lose our audience. It’s kind of akin to trying to build tension when writing an API–it may be the wrong literary device for the subject.

Having said that, let me introduce the diagram below:

This diagram outlines what I see as a more fully fleshed out Identity “stack”. The roles in carnation (OminGraffle’s term, not mine) show the roles that the Identity community spends a lot of time talking about. The roles in other colors are the roles that get less attention. Now before I go on, let me make clear that I’m not really introducing anything novel here. I’ve heard all these other roles discussed before (and I’m sure that upon publishing this, I’ll learn there are entire projects dedicated to them!). Nonetheless, for all the talk and work going on around the carnation roles, these equally important roles seem to get short shrift (for reasons that are not too surprising and that I shall endeavor to explain).

More importantly, I believe that each of these roles is a NECESSARY component of the Identity stack, if Burton’s vision of an “Identity Oracle” or Microsoft’s vision of “Minimal Disclosure” is going to be realized. Further, I also believe that each of these roles is probably better handled by DIFFERENT kinds of organizations. The good news if this is indeed a more accurate picture of the IP is that there are a NUMBER of potential business opportunities surrounding the Identity space. The bad news is, I don’t think the industry has done enough legwork to determine if there is enough DEMAND at all for claim-based Identity to justify the incredible resources necessary to create any one of these businesses.

In my next post, I’m going to take a look at the business in the exploded Identity stack whose role it is to DETERMINE the supply and demand of claims, namely the baby blue (or Sky in OG speak) “Claim Broker”.

Which brings me to the point of this piece: Relationships and Identity. I heard Bob Blakley give his talk on needing to introduce a Relationship entity into the identity discussion for a second time (see my brief summary of the first time here). As I listened to the talk, I noticed that Bob was subtly equivocating between two definitions of the word relationship as the talk progressed. It was interesting because Bob’s typically very precise with his language. When someone like him begins to equivocate, it’s typically because there’s some unconscious energy surrounding the word that’s trying express itself, but because it isn’t fully conscious, it sort of slides out at the seams.

These unintentional expressions are the stomping grounds for Freudian analysis because usually what’s seeping out is repressed and in the highly repressive Victorian era in which Freud lived, these energies were often repressed to the point of disease. The trick for the analyst has always been (at least) two-fold: to notice these moments of seeping intent AND to allow the PATIENT to interpret that intent without introducing too much of the analyst’s own perspective into the interpretive process (this is called projection and a BIG no-no).

The second trick is often much harder than the first. Fortunately for me, however, I’m less interested in analyzing why Bob’s leaking “Relationship” energy (though that would no doubt be great fun!), as I am in riffing on the energy in a more jazz-like way by letting it combine with my own thoughts about building a business in this space. In other words, I’m going to EXPLICITLY project.

To understand Bob’s first use of the word “Relationship”, let’s go back to the simplified diagram of the identity provider I’ve used ad nauseum in this blog:

Here we see a person (Subject) trying to get some information to a website (Relying Party) that they currently have entrusted to a third party (the Identity Provider). Bob starts his talk addressing the relationship between the Subject and the Identity Provider. His first point is that Identity Providers need to focus on building QUALITY relationships between them and their subjects, since, as he’ll claim, that’s ultimately what they are selling.

This makes complete sense and is an important point. Who we are is always defined in context. My relationship with my wife is entirely different than the one I have with my coworkers. Because of this, in a very real sense, I am a DIFFERENT person with them than I am with my wife (though I try to be less bifurcated than most, which has some interesting ramifications for both my work AND my marriage!). Regardless, the point is, the context of your relationship with your IP will DEFINE what KIND of identity about you that they possess and that relationship should be made explicit when they share that identity with a Relying Party.

The confusing equivocation comes when Bob explains his “Relationship” data object, which I have reproduced below:

This is a fictional example Bob envisions coming from Facebook. Confusingly, the example is of a claim that Facebook has between him and a coworker, namely that they are friends. Now this is a NEW kind of relationship (between two people), which I would argue is actually the CLAIM of this relationship data object (namely that Bob and Lori are friends). So Facebook is claiming that Bob and Lori are friends, but for this to be a true RELATIONSHIP data object in the sense Bob was talking about in the beginning of his presentation, the top of the card should read “Relationship: Three year member of our casual social network” rather than “friendship”, which is really part of the claim an only coincidentally a “relationship”.

In other words, the thing that makes a data object a “Relationship” data object, is not if the claim is about two people, but rather that in addition to any claims, it ALSO contains details about the context between the IP and the subject within the data object itself–in this example this could include the duration of the relationship (three years), how frequent it is (every day!), and how serious it is (just for fun). Now this is in some ways just a case of a bad example on Bob’s part that probably confused his audience, but I bring it up because incongruities like this get me actually THINKING, and as I thought, two important questions came to mind:

1. What other relationships are missing from the Identity scene that might be inhibiting its development?
2. What other information would be valuable in Bob’s “Relationship Data Object” besides the nature of the relationship between the Subject and the IP?

These questions are, of course, only tangentially related to Bob’s original discussion, but like I said, exegesis is just a path to interesting thinking rather than an end in itself for me. In my next post, I want to begin to unpack some of that thinking, because I think it’s important for the business of Identity (Relationship?) moving forward.