15 December 1997

Date: Sun, 14 Dec 1997 16:54:29 -0700
To: cypherpunks@algebra.com
From: Tim May <tcmay@got.net>
Subject: Identity, Persistence, Anonymity, and Accountability--Part I of II

[Note: This is a two-part article I posted to the "Nym" list. I'm posting
it here as well, but not in a "cross-post" form, because it obviously
touches on many themes of interest to Cypherpunks. Declan M. has created
this new list to discuss anonymity and pseudonyms. It is, predictably,
largely duplicative of discussions on the Cypherpunks and other lists, but
Declan and others feel it is needed. It is not necessarily open to all, to
reduce the number of insults, ASCII art posts, drunken ramblings (mine
excepted), and off-topic spams and such,  so don't ask _me_ for
instructions on how to subscribe to it. Declan may send you instructions if
he wants to, of course.]

[The second part will follow this part]

There are many swirling notions of anonymity here, and a bunch of what I
think are misconceptions about the link between anonymous systems and

Some here believe accountability (which I'll define and discuss in more
detail below) is important enough to take precedence over a "right to
anonymity." I think this is confusing some important issues.

First some observations:

* The norm in most interactions is a very loose amount of formal checks of
identity credentials. Most of us never actually check the credentials of
our friends and associates. Most commercial transactions, and most travels,
involve no identity credentials whatsoever. (A point nicely make my Marc
Rotenberg today.)

* However, as we have repeated dealings with people, on lists or in person,
we begin to establish a "sense of identity" for those persons, a repeated
history. This has nothing _formally_ to do with identity credentials, but
much to do with _expectations_ about the future. Thus, in my several years
of dealing with "Black Unicorn" I have come to view him (or her, or it) as
a persistent personna. Whether or not he truly is one person, and whether I
know his (alleged) True Name, is largely unimportant.

* It is very important that even we non-lawyers keep in mind what a
_contract_ is. A contract is an offer, and an acceptance. Whether a True
Name is part of the offer, by any of the parties, is unimportant. (In terms
of enforceability of the contract, in terms of going after parties who fail
to meet the terms of a contract, some measure of identity may of course
help accountability. But this is epiphenomenol to the basics of the
contract...it's just a matter of convenience.)

* Hence the view many of us have that if Alice and Bob interact, they may
or may not use fake names, nicknames, handles, putative True Names, or even
DNA-verified biological markers. Their call.

* In cases where accountability is Very Important, as in purchases of large
ticket items, the usual method is to use strict title search companies,
specialists in tracking actual records. Title companies, in other words.
(And, even then, proofs of identity are less extreme than many
anti-anonymity advocates might think. In the purchase of three homes, I've
only had to "flash" my state-issued I.D. card. In fact, it was a driver's
license, hardly designed as an actual proof of identity. Of course, there
are certain ontological assumptions about identity in such large-ticket
purchases, such as that I.D. is backed up by other things, including
possession of a title deed.)

* The main question that involves Washington (or other lawmakers) is this:
Under what circumstances may the state compell identity to be produced?

I happen to agree with several on this list, including E. Volokh and
(actually) D Brin, that there are cases where identity can be compelled.
Even if it only means a _sworn statement_ (as in "making an X" on a
statement written by others). Applying for a passport, appearing before
court, perhaps driving on the public roads.

But note that there absolutely is no requirement in the United States for a
general form of identification. Non-drivers need not have any form of I.D.
And as we have seen in court cases, a la Lawson v. Kolender (where a black
man in dreadlocks used to like to walk the streets of San Diego...the cops
stopped him many times and jailed him for not having I.D. on him...the
court ruled that people don't have to present credentials issued by the
state to walk the public streets).

* Therefore, the issue is not of a "right to anonymity," which would
probably be as nebulous to debate as the "right to privacy" (which Bork
probably was correct in saying cannot be found in the Constitution), but,
rather, the issue of when the State may compell identity. To put it in the
blunt terms we libertarians find useful: "When can men with guns tell us we
have to produce a piece of paper with our pictures on it that they find

Possibly for the situations I mentioned above. But maybe not even in all of
those situations. (Next time I am called for jury duty, and my last time
was in 1973, I plan to take no state-issued I.D. junk with me...I will
_tell_ them who I am and leave it at that.)

* In ordinary interactions and in commercial transactions (modulo gun
purchases and a few other similar areas), identity cannot be compelled.
Alice is free to ask Bob for his name, or his blood type, or anything else
she chooses (modulo questions banned by the Civil Rights Act, disgustingly
enough), and either is free to cancel the interaction or transaction as
they wish. Contracts again: an offer made and an acceptance.

* Now if Alice wishes to _extend credit_ to Bob, or take his promise to pay
via a check or some other "delayed clearing" instruement, she is free to
request various things that will satisfy her that she can later track down
Bob and collect from him.

Importantly, this is not a _state_ function. This is still a matter of
contract. Bob is of course free to refuse to give his name and to cancel
the transaction.

* It's a fact that most vendors (Alice) are less interested in acquiring
market research data by getting True Names than they are in selling stuff.
Hence, most merchants don't care about True Names. And for online clearing
(instant clearing, as with cash or guaranteed payments sytems), names
really don't matter. Even Radio Shack, which makes a big point of asking
for names and addresses, will gladly make a sale to those who refuse to go

* There are cases where this normal "Alice doesn't care about names"
situation is distorted by other considerations. Recently, airlines have
been instructed by the FAA to do a credential check...they are happy enough
to comply, as it cuts down on the practice of companies buying advance
tickets in bulk and then deciding later who will actually use the tickets.
(I believe the pre-FAA ruling situation, where airlines didn't bother to
check I.D.s to be a good indicator of what free market forces would produce
absent such an FAA rule.)

Certain large-ticket purchases may no longer be made in cash. Part of this
is the move to control money-laundering and smurfing, and the "structuring"
laws. Black Unicorn has an amusing story of trying to buy a car in suburban
Washington, with cash (or a cashier's check, I forget which), and having
law enforcment arrive a short time later and hold him for questioning....

Likewise, it's becoming more common for motels and hotels to demand photo
I.D. Some even refuse to accept cash without a credit card (which we know
is not an actual I.D., but it sort of acts as one). I'm not sure what all
the reasons for this are. Here are some, briefly: fear of being stung by
someone who trashes the room, concern about being charged with enabling
prostitution, pressure from regulatory boards (who may be pressured by law
enforcement), or perhaps just the general attitude that "I.D. is required."

(As I've said, this attitude hasn't filtered down to ordinary daily

So, identity is not the same as accountability (though there are some
correlations). And lack of identity does not mean criminality. And most
importantly, most cases where some proof of identity is requested don't
need any state involvement in what are private transactions or contracts.
Lastly, there is no "is-a-person" (in the cryptographic sense)
credentialling system in the U.S.

In Part II of this post, I'll combine these various points, made somewhat
anecdotally here, into a more graphical form.

--Tim May

Date: Sun, 14 Dec 1997 16:57:35 -0700 To: cypherpunks@algebra.com From: Tim May <tcmay@got.net> Subject: Identity, Persistence, Anonymity, and Accountability--Part II of II As promised, here is Part II, with a more graphical analysis of the issues of identity, anonymity, traceability, accountability, and the correlations between them. Consider two principles axes: -- identity -- accountability A "0" on the identity axis means a complete lack of any identity, with no assurance whatsoever in the nickname, casual name, and certainly not in the True Name, of an entity. The canonical "Anonymous," with not even any clues as to identity. A "1" on the identity axis means a complete certainty as to whom someone is, with extensive credentials, perhaps even voiceprint, blood tests, etc. An appearance by Bill Clinton probably rates a "0.999" on this scale, as various input vectors are summed...most of my posts might be rated at "0.95," and so on. There are some meta-issues about what true names really are. Was Bill Clinton switched at birth? Did the Trilateral Commission actually kill the real Bill Clinton when he was at Oxford and replace him with a KGB lookalike? Do his footprints match that on the birth certificate on file in the Arkansas hospital? Is that stuff even what we mean by "that guy is Bill Clinton"? I won't get into these meta-issues here, but they are eventual boundary-value problems for any "is-a-person" formal system. On the "accountability" axis, a "0" means an entity cannot be held accountable. Cannot be reached, cannot be hauled into court, etc. This could be because the entity is outside a jurisdiction. Marc Rich, resident of Zug, Switizerland, is about a "0.1" on the accoutability scale. A "1" obviously represents full accountability. Clearly it is possible for someone to be high on the identity scale (like Marc Rich), but low on the accountability scale. Or, more interestingly, it is possible for a participant in a transaction to be essentially anonymous, but very accountable. This is what digital cash and anonymous escrow systems provide. Chaum's "credentials without identity" makes this clear. It is possible to present some credential for some property, such as age, without identity. (An easy to see example being admissions to bars...as ID scanning technology spreads, we would like to see methods for checking an age credential without also creating a computer record of all bars visited, number of drinks consumed, etc.) (Crime and illegal markets often work this way, too. That is, with identity not necessarily known ("Vinnie the Nose"), but with other mechanisms for ensuring accountability. The usual, but important, stuff about reputation capital. Ditto for primitve markets, with goods left in clearings...absolutely no "identity," but various mechanisms for enforcement of trading protocols (including "no future business if you screw me," which is how many markets have worked, a la the Law Merchant for international trade, which evovled into the Uniform Commercial Code.) OK, here's a diagram. Notice that the central diagonal, the "main sequence" ( a la Hertzsprung-Russell diagrams) is the correlation between "identity" and "accountability." To those who argue that accountability IS identity, this is there line. But there are many other place in this space. For ease (to me) in making this diagram, I've had to just use letters, with the legend below the diagram. ^ CASH TOTAL 1 | CHAUM | ESCROW ^ | BRIN | | DIGNYM | | CORP Accountability | | | MRICH | | ANON 0 |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 0 1 Identity --> CASH = immediate clearing, but no identity CHAUM = Chaumian "credentials without identity" (in many forms) ESCROW = leaving a deposit, or linking to another payer (an anonymous VISA card, with a deposit, works this way. Or a corporate account, card, etc., where the company backs the transaction, but identity of the participant is unknown, or poorly known) BRIN = David Brin's "accountability means identity" mapping (no doubt there are nuances to his view, but I believe this fairly characterizes the position he has described here recently) TOTAL = The total state. Eveyone in their place, every transaction logged, everyone held accountable by the State DIGNYM = Digital pseudonyms, or signed messages. Identity may be variable, from almost completely anonymous (e.g., Pr0duct Cypher) to known to some (e.g., Black Unicorn). Accountability also varies, depending on factors like jurisdiction. CORP = corporate, or collective, accounts, where identity of actual participants is poorly known, but accountability is high MRICH = identity known to high certainty, but "judgment proof" (note that this applies to many other persons, such as poor persons, who may say all kinds of libelous or actionable things, but who are not worth going after) ANON = the canonical "anonymous" message, with no identity, no accountability. Of course, there are many other examples. And each examples has "scatter." Each is a "blob," not just a point. And they can move around, as laws change. (For example, Marc Rich could quickly become "accountable" were Switzerland to change its laws about extradition.) The structure of this identity-accountability space is itself interesting, with peaks and valleys (suggesting a third axis, that of "cost" to live in these spaces....). And so on. I hope this helps clarify for you some of my thinking on these issues. i find that simplistic arguments, whether, "accountability requires identity," or "anonymity is a basic right," are not very helpful. There are clearly times when participants in a voluntary transaction want some kind of "identity credential" (especially to the extent they think identity = accountability). There may even be times when the State has a legitimate interest in compelling identity (though many of us would quibble with most such demands, and look for ways to satisfy these "is-a-person" needs less invasively than by requiring national I.D. cards and tattooes on forearms). Again, I hope this has helped. --Tim May Voluntary Mandatory Self-Rating of this Article (U.S. Statute 43-666-970719). Warning: Failure to Correctly and Completely Label any Article or Utterance is a Felony under the "Children's Internet Safety Act of 1997," punishable by 6 months for the first offense, two years for each additional offense, and a $100,000 fine per offense. Reminder: The PICS/RSACi label must itself not contain material in violation of the Act. ** PICS/RSACi Voluntary Self-Rating (Text Form) ** : Suitable for Children: yes Age Rating: 5 years and up. Suitable for Christians: No Suitable for Moslems: No Hindus: Yes Pacifists: No Government Officials: No Nihilists: Yes Anarchists: Yes Vegetarians: Yes Vegans: No Homosexuals: No Atheists: Yes Caucasoids: Yes Negroids: No Mongoloids: Yes Bipolar Disorder: No MPD: Yes and No Attention Deficit Disorder:Huh? --Contains discussions of sexuality, rebellion, anarchy, chaos,torture, regicide, presicide, suicide, aptical foddering. --Contains references hurtful to persons of poundage and people of color.Sensitive persons are advised to skip this article. **SUMMARY** Estimated number of readers qualified to read this: 1 Composite Age Rating: 45 years