Bredemarket content marketing services for small businesses in and around Ontario, California (The September 1 iteration)

There’s a sentence on the home page for Bredemarket that you may have glossed over, but it’s one that’s been on my mind for the past year.

Bredemarket presently offers its services to identity/biometrics, technology, and general business firms, as well as to nonprofits.

In this post, I’m going to zero in on a small subset of the third market, “general business firms,” and see how Bredemarket can help them.

Read on if you own a small, arty business in the Emporia Arts District of Ontario, or perhaps a larger, less arty business north of Holt in Ontario, or perhaps even a business in Upland or Montclair.

Identity/biometrics and technology are good to go

These markets are intentionally expressed in a particular order.

  • It’s no surprise to anyone that reads my content that I’ve listed identity/biometrics first. After all, I’ve spent over 25 years in the identity/biometrics space, and therefore feel justified to self-reference as the biometric content marketing expert and the biometric proposal writing expert.
  • Technology is second on the list. As a matter of fact, Bredemarket’s first customer was a technology firm. And while I can’t necessarily speak to technology in the same depth that I can devote to identity and biometrics, I can clearly help technology clients with their content marketing and their proposals.

Getting more specific about “general business”

Which brings us to general business firms. (This post won’t even touch the fourth market, nonprofits.) This is obviously a broad category. Even if you don’t count sole proprietors (such as myself) or freelancers, there are somewhere around 7.7 million businesses in the United States. (This figure is from 2016; I’m not sure if it’s gone up or gone down in the last five years.) Now if you include sole proprietors in the total, then you’re talking about 32 million businesses. (This particular number may have actually increased over time.)

And the vast majority of those millions of businesses aren’t working in identity, biometrics, or even technology.

Obviously I can’t target them all. Well, I could try, but it would be a little ridiculous.

So what if I took a subset of those 32 million businesses and tried to see if Bredemarket could serve that subset?

The local small business persona

When you want to market to a particular group, you develop a persona that represents that group. You can then develop a profile of that persona: the persona’s needs, aspirations, and expectations; the persona’s underlying goals and values; and perhaps some other elements. The persona may be developed via extensive research, or perhaps via…a little less quantification.

So I began musing about a small business owner in my hometown of Ontario, California. Perhaps someone whose business is located here.

For those who aren’t from around here, the Emporia Arts District is in downtown Ontario, California, west of Euclid and south of Holt. While much of the activity is concentrated in the set of lofts/working spaces whose entrance is pictured here, there are also surrounding businesses that can be considered part of the district. And of course you can walk east of Euclid and north of Holt and find a wider variety of businesses.

From https://www.emporiaartsdistrict.com/

But I concentrated on the businesses in the Emporia Arts District, noting that they’re…well, they’re arty. Let’s put it this way: my stick figures would not be attractive to them.

I did not draw this myself. Originally created by Jleedev using Inkscape and GIMP. Redrawn as SVG by Ben Liblit using Inkscape. – Own work, Public Domain, https://commons.wikimedia.org/w/index.php?curid=1692938

Looking at my two general offerings, proposal services and content marketing, it’s fairly unlikely that my proposal services would interest this crowd. If these business ARE submitting proposals, they are most likely applying for federal, state, or local grants, and that’s somewhat outside of my area of expertise.

(Tangential comment to those who click on links: having fun is good.)

But can my content marketing services provide value to the businesses in the Emporia Arts District (and elsewhere in Ontario and the surrounding cities)?

I realized that I DID have something to offer here.

What if your local business needs a short text piece?

After all, my writing services can be fairly flexible. While I originally envisioned that my Bredemarket 400 Short Writing Service could apply to content such as blog posts or LinkedIn posts, it could just as easily apply to a general brochure of 400 to 600 words with customer-provided pictures of artwork, classes, clothing, haircuts, or whatever.

Chances are it will be a little more exciting than this.

Or maybe not. (The story behind the piece of content above, developed when my business card order got delayed, is told here. Storytelling is good.)

The same overall process can apply to a small craft brochure just as it can apply to a discussion of the benefits of using an Adobe-trained marketing systems consultant. In either case, the engagement would start with a series of questions:

  • What is the topic of the content?
  • What is the goal that you want to achieve with the content?
  • What are the benefits (not features, but benefits) that your end customers can realize by using your product or service?
  • What is the target audience for the content? (I’m not the only one who’s establishing personas.)
  • There are other questions that I may ask, but you can see the whole process here.

Once these major items are established (starting off a project correctly is good), I can get writing, you can get reviewing, and I can provide you with the final product. You can then post an electronic version of the content on your website, or you can hand it out to people who stop by your business or loft or farmer’s market stall or whatever. (Intangible and tangible content are BOTH good.)

What if your local business needs a longer text piece?

Maybe 400 to 600 words isn’t enough. Maybe you want a longer piece, such as an entire product/service catalog, or a catalog listing a whole slew of businesses (maybe all the businesses at a farmer’s market).

I can help with that too. My Bredemarket 2800 Medium Writing Service, originally intended for longer white papers, can be repurposed for other types of content.

As you can guess, the target number of words for my service is 2800 words, or up to 3200 words.

The process can be a little more intricate also. Because there is more text to review, the review cycles can be longer. And I may ask a few more questions at the beginning. But in essence it’s similar to the process for the shorter writing service, with basic questions about the topic, goal, benefits, and target audience. You can see the entire process here.

What if you want more than 600 words, but less than 2800 words?

I’ll work with you. (Flexibility is good.)

If you can use one of my content marketing services, what are the next steps?

The next step is to contact me.

So what is Bredemarket going to do next?

Share this online in places where you may see it. (Targeted content distribution is good.)

After that, repurpose (repurposing is good) this long, meandering blog post into some other type of content that I can distribute to businesses in the Emporia Arts District…or north of Holt…or in Upland or Montclair. Blog posts are transitory, and I’ll often express something in blog form and then pin it down in another format later.

Perhaps you can do the same, once I’ve created content for you.

IATA endorses the EUDCC. But will it matter?

In a Bredemarket blog post in February 2021, I quoted something that I wrote in 2013 in one of my personal blogs, Empoprise-BI.

I’m sure that many people imagine that standards are developed by a group of reasonable people, sitting in a room, who are pursuing things for the good of the world.

You can stop laughing now.

As I noted back in 2013, and again in February, there are many instances in which standards do not evolve from a well-designed process. In reality, standards emerge via that process that I referred to in February as “brute force.”

By イーストプレス – 「ゴング格闘技」＝1951年のブラジル地元新聞からの転載, Public Domain, https://commons.wikimedia.org/w/index.php?curid=13320163

For those who are not familiar with the “brute force” process, I’ll provide two illustrations.

  • If a lot of people like something, it’s a standard.
  • If a trillion dollar company likes something, and I like something different, then the thing that the trillion dollar company likes is a standard.

If two trillion dollar companies like two different things…it can get messy.

Back in February, I was just beginning to talk about something that I called “health passports” at the time. Later, I personally decided that “health passports” is a poor choice of words, and have instead gravitated to using the phrase “vaccine certificate.”

Regardless, my concern back in February was that there were all sorts of these things floating around. Even back then, Clear had its own solution, IATA had one, IBM had one, iProov had one, Daon had one, and there were many, many more.

So what happens if I have a Clear vaccine certificate but the airline or building that I’m approaching supports the iProov certificate? Can the iProov certificate read the Clear certificate? Or do I have to get multiple certificates?

This post looks at a new development in the vaccine certificate brouhaha. I’m not talking about what vaccines are honored by the vaccine certificate, but about acceptability of the vaccine certificates themselves. In particular, I’m talking about acceptance of one certificate, the EU Digital COVID Certificate (EUDCC).

Because one big player is getting behind it.

From https://ec.europa.eu/commission/presscorner/api/files/attachment/868508/Digital%20Green%20Certificate_en.pdf.pdf

How do international air transport folks feel about the EUDCC?

While the EUDCC can conceivably be used for a number of use cases, such as entering a private business like a restaurant, one of the most popular use cases for the EUDCC is to board an airplane that is crossing an international border.

So if there was an organization that was dedicated to the business of flying airplanes across international borders, and if that organization thought that the EUDCC was pretty cool, then that endorsement would have as much pull as Google (and Facebook) endorsing a web image format.

Enter the (drumroll) International Air Transport Association, which issued a press release on 26 August.

The title?

“IATA Backs European Digital Covid Certificate as Global Standard.”

From https://www.iata.org/en/pressroom/2021-releases/2021-08-26-01/

Now those who read my February post will recall that IATA was one of those groups that was already developing its own vaccination certificate. So how does the EUDCC compare with the the IATA Travel Pass?

The DCC…is fully supported by IATA Travel Pass.

But in addition to mere self-interest, there is another reason why IATA is endorsing the EUDCC: it’s supported by a lot of countries inside the EU, and other countries are looking at the EUDCC as a model.

The EU DCC is implemented in the 27 EU Member states and a number of reciprocal agreements have been agreed with other states’ own vaccination certificates, including Switzerland, Turkey, and Ukraine. In the absence of a single global standard for digital vaccination certificates, up to 60 other countries are looking to use the DCC specification for their own certification. 

Oh no, I’m just looking

However, it’s one thing to be “looking” at something, and another thing entirely to actually “do” something.

Before assuming that the EUDCC will become the de facto DCC, consider how two countries in particular will approach it.

This image or media was taken or created by Matt H. Wade. To see his entire portfolio, click here. @thatmattwade This image is protected by copyright! If you would like to use it, please read this first. – Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=5004719

One of those countries is my own, the United States of America. While one can argue whether or not the U.S. enjoys the same level of power that it enjoyed immediately after the end of the Cold War, it is still a major player in world economic and travel affairs. And regardless of who the President of the United States is at any given time, the U.S. has often decided to go its own way. Couple this with the power of individual U.S. states in my country’s federal system, and it’s quite possible that even if the U.S. goes along with IATA, and some form of the EUDCC is adopted by our Transportation Security Administration, that does not necessarily mean that the same certificate can be used as it is in Europe to grant access to museums, sporting events, and concerts.

By Severin.stalder, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=39661035

The other country that may have an issue with the EUDCC is China. If the United States is potentially a waning world power, China is potentially a gaining world power. The relationship between China and the rest of the world varies from time to time and from issue to issue. China may decide that it’s not in its best interest to adhere to an international standard for certifications of COVID vaccination, testing, or contraction. And if it’s not in China’s best interest, China won’t do it.

So before declaring that IATA endorsement of the EUDCC settles the issue…we’ll see.

The (possible) Afghan data treasure trove doesn’t just threaten the Taliban’s enemies

Recent events in Afghanistan have resulted in discussions among information technology and security professionals.

Taliban fighters in Kabul, Afghanistan, 17 August 2021. By VOA – https://www.youtube.com/watch?v=nAg7egiXClU, Public Domain, https://commons.wikimedia.org/w/index.php?curid=109043891

One August 17 article from the Intercept hit close to home for me:

THE TALIBAN HAVE seized U.S. military biometrics devices that could aid in the identification of Afghans who assisted coalition forces, current and former military officials have told The Intercept.

This post talks about the data the Taliban could POTENTIALLY get from captured biometric devices and other sources, and how that data could conceivably pose a threat to the Taliban’s enemies AND the Taliban itself.

What data could the Taliban get from biometric devices?

The specific device referenced by the Intercept article was HIIDE…and let’s just say that while I don’t know as much about that device as I should, I do know a little bit about it. (It was manufactured by a company that was subsequently acquired by Safran.)

HIIDE. From https://www.nist.gov/system/files/documents/2021/03/23/ansi-nist_archived_vermury-bat-hiide.pdf

Another source implies that the Taliban may have acquired another device that the Intercept DIDN’T reference. The Taliban may not only have acquired live HIIDE devices, but also may have acquired devices from another company called SEEK.

SEEK. From DOD Biometrics. Reproduced at https://defensesystems.com/articles/2014/03/18/dod-biometrics-ng-abis.aspx

(Yes, folks, these devices are called HIIDE and SEEK.)

At the time that this was revealed, I posted the following comment on LinkedIn:

Possession is not enough. Can the Taliban actually access the data? And how much data is on the devices themselves?

Someone interviewed by the Intercept speculated that even if the Taliban did not have the technological capability to hack the devices, it could turn to Pakistan’s Inter-Service Intelligence to do so. As we’ve learned over the years, Pakistan and the Taliban (and the Taliban’s allies such as al Qaeda) are NOT bitter enemies.

As I said, I don’t know enough about HIIDE and SEEK, so I’m not sure about some key things.

  • For example, I don’t know whether their on-board biometric data is limited to just biometric features (rather than images). While there’s the possibility that the devices stored biometric images, that has a drawback because of the large size of the images. Features derived from the images (which are necessary in matching anyway) take up much less storage space. And while biometric images are necessary in some cases (such as forensic latent fingerprint examination), there’s no need for images in devices that make a hit/no-hit decision without human intervention.
  • In addition, I don’t know what textual data is linked to the features (or images) on these devices. Obviously the more textual information that is available, such as a name, the more useful the data can be.
  • Also, the features stored on the devices may or may not be useful. There is no one standard for the specification of biometric features (each vendor has its own proprietary feature specification), and while it may be possible to convert fingerprint features from one vendor system to be used by another vendor’s system, I don’t know if this is possible for face and iris features.

Best-case scenario? Even if the Taliban or its friends can access the data on the devices, the data does not provide enough information for it to be used.

Worst-case scenario? The data DOES provide enough information so that EVERY PERSON whose data is stored on the device can be identified by a Taliban-equivalent device, which would presumably be called FIND (Find Infidels, Neutralize, Destroy).

I’ll return to that “every person” point later in this post.

But biometric data isn’t the only data that might have fallen into the Taliban’s hands.

What data could the Taliban get from non-biometric devices?

Now Politico has come out with its own article that asserts that the Taliban can potentially acquire a lot of other data. And Politico is not as pessimistic as the Intercept about the Taliban’s tech capabilities:

That gives today’s technologically adept Taliban tools to target Afghans who worked with the U.S. or the deposed Afghan government with unprecedented precision, increasing the danger for those who don’t get out on evacuation flights.

Before looking at the data the Taliban may have acquired, it’s useful to divide the data sources between data acquired from clients and data acquired from on-premise servers. HIIDE and SEEK, for example, are clients. (I’m only talking about on-premise servers because any data stored in a US government cloud can hopefully be secured so that the Taliban can’t get it. Hopefully.)

Unlike HIIDE and SEEK, which are mobile client devices, the Politico article focuses on data that is stored on on-premise Afghan government servers. It notes that American IT officials were more likely than Afghan IT officials to scrub their systems before the Taliban takeover, and one would hope that any data stored in US government cloud systems could also be secured before the Taliban could access it.

So what types of data would the Afghan government servers store?

Telecom companies store reams of records on who Afghan users have called and where they’ve been. Government databases include records of foreign-funded projects and associated personnel records.

More specifics are provided regarding telecom company data:

Take call logs. Telecommunications companies keep a record of nearly every phone call placed and to whom. U.S. State Department officials used the local cell networks to make calls to those who were working with the United States, including interpreters, drivers, cooks and more…

And mobile phone data is even more revealing:

Cell phones and mobile apps share data about users with third-party apps, such as location data, that the Taliban could easily get…

The geolocation issue has been known for years. Remember the brouhaha when military users of a particular fitness app effectively revealed the locations of secret U.S. military facilities?

Helmand province in Afghanistan. Photograph: Strava heatmap. Reproduced at https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases

In locations like Afghanistan, Djibouti and Syria, the users of Strava seem to be almost exclusively foreign military personnel, meaning that bases stand out brightly. In Helmand province, Afghanistan, for instance, the locations of forward operating bases can be clearly seen, glowing white against the black map.

Now perhaps enemy forces already knew about these locations, but it doesn’t help to broadcast them to everyone.

Back to Afghanistan and other data sources.

Afghan citizens’ ethnicity information can also be found in databases supporting the national ID system and voter registration.

This can be used by digital identity opponents to argue that digital identity, or any identity, is dangerous. I won’t dive into that issue right now.

Politico mentions other sources of data that the Taliban could conceivably access, including registration information (including identity documents) for non-governmental organization workers, tax records, and military commendation records.

So if you add up all of the data from all of the Afghan servers, and if the Taliban or its allies are able to achieve some level of technical expertise, then the data provides enough information so that EVERY PERSON whose data is stored on the servers can be identified by the Taliban.

Before we completely panic…

Of course it takes some effort to actually EMPLOY all of this data. In the ideal world, the Taliban would create a supercomputer system that aggregates the data and creates personal profiles that provide complete pictures of every person. But the world is not ideal, even in technologically advanced countries: remember that even after 9/11, it took years for the U.S. Departments of Justice, Homeland Security, and Defense to get their biometric systems to talk to each other.

Oh, and there’s one more thing.

Remember how I’ve mentioned a couple of times that the Taliban could conceivably get information on EVERY PERSON whose data is stored on these devices and servers?

One thing that’s been left unsaid by all of these commentaries is that this data trove not only reveals information about the enemies of the Taliban, but also reveals information about the Taliban itself.

  • The HIIDE and SEEK devices could include biometric templates of Taliban members (who would be considered “enemies” by these devices and may have been placed on “deny lists”).
  • The telecommunications records could reveal calls placed and received by Taliban members, including calls to Afghan government officials and NATO members that other Taliban members didn’t know about.
  • Mobile phone records could reveal the geolocations of Taliban members at any time, including locations that they didn’t want their fellow Taliban members to know about.
  • In general, the records could reveal Taliban members, including high-ranking Taliban members, who were secretly cooperating with the Taliban’s enemies.

With the knowledge that all of this data is now available, how many Taliban members will assist in decrypting this data? And how many will actively block this?

Oh, and even if all of the Taliban were completely loyal, any entity (such as the Pakistani Inter-Service Intelligence) that gets a hold of the data will NOT restrict its own data acquisition efforts to American, NATO, and former Afghan government intelligence. No, it will acquire information on the Taliban itself.

After all, this information could help the Pakistanis (or Chinese, or Russians, or whoever) put the, um, finger on Taliban members, should it prove useful to do so in the future.

Then again, Pakistan may want to ensure that its own digital data treasure trove is safe.

And now I’m unboxing tangible collateral

Yes, this is post five in a series.

We”ll start with the end result, and then detail how it got here.

(Yes, I know an unboxing post is supposed to save the final result of the unboxing until the end, but I got excited. I’ll repeat this picture at the end to keep the story straight.)

I created tangible collateral

As I detailed in the third post in the series, back on August 9 I was preparing to attend my first in-person event in a long time.

I’m going to an in-person event next week. For my younger readers (i.e. those who developed awareness after 2019), an “in-person event” is something where you are actually in the same room as the people that you are meeting, rather than looking at them in boxes on your computer screen

Who knew that this was the future of communication? By screenshot, Fair use, https://en.wikipedia.org/w/index.php?curid=34177604

After registering for the event, I realized that I had never printed business cards for Bredemarket. So I designed one on Canva and ordered it that same day, August 9.

I waited for tangible collateral

Canva filled the order and turned it over to a delivery service on August 10. I won’t name the delivery service, but it does business with the federal government and has an express business in addition to its ground business.

And the delivery service provides some good tracking of all the packages that it handles. I’d simply reproduce the tracking entries, but the most recent stops are first, which doesn’t lend itself to storytelling. So I’ll just reproduce selected stops on the way.

Tuesday, August 10, 2021
8:30 PMHENDERSON, NVLeft FedEx origin facility
6:32 PMHENDERSON, NVShipment exceptionBarcode label unreadable and replaced
6:05 PMHENDERSON, NVArrived at FedEx location
3:06 PMHENDERSON, NVPicked up
8:05 AMShipment information sent to FedEx

That’s actually pretty nice, I thought at the time. The order was fulfilled within a few hundred miles of Bredemarket’s world headquarters in Ontario, California, and would certainly arrive in time for my in-person meeting.

Wednesday, August 11, 2021
1:05 AMBLOOMINGTON, CAArrived at FedEx location

Very nice. Bloomington is within 20 miles of Ontario, so obviously I should expect my business cards to be delivered by the end of the week.

Friday, August 13, 2021
11:55 PMDEMING, NMIn transit
10:52 AMBLOOMINGTON, CADeparted FedEx location

Um, wait a minute. (Only now did I realize that this transit happened on Friday the 13th. Figures.)

I won’t reproduce the next few entries, but suffice it to say that as of 3:12 pm Central Time on Saturday, August 14, the package arrived at a location in Fort Worth, Texas.

By Tuesday, August 17, my package was still in Texas, and obviously wasn’t going to make it in time for my Wednesday night meeting. As I noted in the fourth post in the series, however, I had a workaround.

So that’s what I handed out on Wednesday, August 18. (Well, the first person only took a picture of the handout rather than taking the handout himself, because he prefers intangible things.)

At one point my expected delivery date was Thursday, August 19. That date came and went without business cards, but at least I got a podcast episode out of it.

Late that night, with my package still in Texas and no updated arrival date, I contacted Canva (even though it wasn’t Canva’s fault) because there wasn’t an efficient way to contact the delivery service. At the time I wondered if the package were truly lost and if I’d need Canva to replace it. I received an email from Canva that pretty much said to wait and see what happened.

Our records show that your print order…is currently in transit to your shipping address….

For a more detailed information about the delivery status, we highly suggest reaching out to the carrier since the order was already dispatched.

However, at the same time that I was filing things with Canva, I was also tweeting about it. And for those who don’t realize this, the social media people for many companies are proactive and really want to help.

Here to sort this out for you, John! Could you DM us your ticket ID (JTP-###…)? We’ll take a look! ^cv

The tweet actually contradicted the email (which said to contact the delivery service). But by the time Canva tweeted the request for my ticket ID, the delivery service had updated my status.

From https://twitter.com/JEBredCal/status/1428688071277432840.

(And yes, I was checking Twitter before 5:00 am. Normally I don’t, but by this time I was really getting bugged about my wandering business cards.)

Later that day, my package finally left its Texas location. I had a momentary fear when it departed…a fear that people who live in Ontario, California will easily understand. Was my package headed back toward Ontario, California…or on its way to Ontario, Canada?

Thankfully, my package was in Deming, New Mexico on Friday evening, so at least it was headed in the right direction.

By Saturday, August 21, the package was back in Bloomington, California. But where would it go next?

Oh, and to top things off, in the middle of this I received a phishing attempt at one of my non-Bredemarket email addresses. Obviously this had nothing to do with my REAL shipment, but I still found it pretty funny.

Just in case anyone is unclear about this, the email DIDN’T really come from DHL. And if DHL were to ask US customers to pay a fee over the Internet, that fee wouldn’t be charged in Australian dollars.

Back to the question of where my package would go when it left Bloomington. Did my package have a lover in Deming, New Mexico that it wanted to visit for a third time?

Sunday, August 22, 2021
8:51 AMCHINO, CADelivery exceptionFuture delivery requested
7:46 AMCHINO, CAAt local FedEx facility
5:35 AMBLOOMINGTON, CADeparted FedEx location

Chino is even closer to Ontario than Bloomington. This was a positive move.

Let me explain the “future delivery requested” part. I was promised at one point that the package would be delivered on Sunday, August 22. Unfortunately, my business address (a UPS Store, competitor to the delivery service) is closed on Sunday.

Apparently the delivery service realized this too late, and told me that the package would be delivered Tuesday.

Then I was told that the package would be delivered Monday.

Monday, August 23, 2021
1:24 PMOntario, CADeliveredSignature on file
5:41 AMCHINO, CAOn FedEx vehicle for delivery
4:20 AMCHINO, CAAt local FedEx facility

I drove to my business address and proceeded with the unboxing.

Remember the August 10 entry that mentioned the replacement of the unreadable barcode label.
As is usual for shipments, the actual shipment box was placed in a larger box. This time I was thankful for this.
Completing the story, here’s the business card again.

So that’s done. And since I’ve never really used business cards all that frequently, this order should last me a while.

When is my next in-person event?

(Bredemarket Premium) Bredemarket tips for aspiring biometric freelancers (the 8/23/2021 11:45am edition)

So I just wrote a post that contained general tips for freelancers. But before launching into the meat of the post, I said the following:

I almost considered putting the Bredemarket Premium tag on this and making you pay to read it, but I’m not THAT much of a freelancing expert. (Yet.)

After I completed that post and shared it on Twitter, LinkedIn, and Facebook, I returned to my Bredemarket Premium idea. While my tips in the other post can help general freelancers, there are some things that I can share that are specific to BIOMETRIC freelancers.

This is NOT an example of biometric enrollment, but the entry device is secure from network attacks. By Rita Banerji – flickr, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=18222218

So, here goes.

Subscribe to get access

Subscribe to Bredemarket Premium to access this premium content.

  • Subscriptions just $5 per month.
  • Access Bredemarket’s expertise without spending hundreds or thousands of dollars.
Subscribe

Bredemarket tips for aspiring freelancers (the 8/23/2021 10:15am edition)

I have marketed myself as the biometric content marketing expert and the biometric proposal writing expert.

Now I’m marketing myself as the freelancing expert.

“But John,” you may ask, “how can you do this? Yes, you are making money freelancing, but there are freelancers who are making a LOT more money than you are, who are working from exotic locales and are well known.”

Well, at least the locale is exotic, even if the hardware is very 20th century and the scribe only has anonymous Wikipedia/Flickr fame. By Rita Banerji – flickr, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=18222218

Before I succumb to imposter syndrome, let me assert that I DO have some tips to offer based on my experience. Frankly, all of us do. Even if you’ve only been freelancing for a week, you’ve probably learned something that someone who has never freelanced would NOT know. So share it.

Before you read my tips, note an important point. I’ll caveat my tips by stating that MY experience may not necessarily apply to YOUR experience, and that sometimes it’s good to ignore the experts (or so-called experts). You need to do what is best for you.

How do I know that I have tips to offer?

Because someone whom I met via the Freelancers Union (see the link on the word “ignore” above) just asked me for advice, and by the time I was done answering her questions, I had written a LONG email.

So I figured that I’d share parts of the email (the portions that were NOT specific to her) with you.

I almost considered putting the Bredemarket Premium tag on this and making you pay to read it, but I’m not THAT much of a freelancing expert. (Yet.)

We’ll get to the whole topic of personal pictures later. This picture was taken in 1980 or 1981, but doesn’t necessarily reflect my business or show my expertise. (And yes, I’m terrible at darts.)

As I said, these are edited versions of my responses to the Freelancers Union contact, with some additions as I thought of other things. (I forgot to mention to my Freelancers Union contact that repurposing is important, and iteration is important.)

So, here goes.

If I offer multiple, potentially very different services, is it too overwhelming to list all of my services on a single page?

For purposes of this discussion, I’m going to assume that the “single page” is a LinkedIn company page or a Facebook business page. (In many cases, it’s best to separate your freelancing page from your personal page. Again, some disagree with me.)

If you think that all of your multi-services are too much to list on one page, then you have the option of creating “showcase” pages to highlight specific aspects of what you do. For example, if you wanted to differentiate two different sets of services, you could create two separate showcase pages.

Using myself as an example, I have segmented my customers into markets: the identity (biometrics / secure documents) specific market (my primary market), the general technology market, and the general business market. I don’t even target the general business market on LinkedIn (I do on Facebook), but I’ve created showcase pages for the other two.

The Bredemarket Identity Firm Services page on LinkedIn. Of course, your view of this page will vary; I doubt that 116 of the showcase page’s followers are in YOUR network.

I have a similar structure on Facebook.

In addition, my website also has targeted pages. I won’t show examples here (EDIT: I didn’t share links in my original email to the contact, but I did share links in this new post), but I have a page that’s just targeted for general identity, multiple pages targeted for the biometric aspect of identity, one targeted for the content marketing aspect of biometrics, one for the proposal writing aspect of biometrics, etc. Therefore, if I’m talking to someone about biometric proposals, I can just send the link to the biometric proposal writing expert page.

I actually market on Twitter (@jebredcal), but I don’t go into that level of segmentation there. In fact, my Twitter account isn’t even solely devoted to my consulting. In that case, I don’t feel it worthwhile to create segmented Twitter accounts for my various submarkets, but it may be different for others. 

However you slice and dice your market, dedicated pages for specific market segments allow for a more targeted experience. And the good thing is that it’s all free. (I actually pay for my website, but it could be free if I were fine with a mycompany.wordpress.com URL.)

How do I compensate for my liabilities?

TL;DR talk about your strengths.

In my case, I compensate for what I don’t do by emphasizing what I do.

I did not draw this myself. Originally created by Jleedev using Inkscape and GIMP. Redrawn as SVG by Ben Liblit using Inkscape. – Own work, Public Domain, https://commons.wikimedia.org/w/index.php?curid=1692938

For example, I do NOT create graphics (stick figures exhaust my capabilities), so my marketing materials emphasize my creation of text.

In addition, as I stated earlier, I emphasize the markets that I DO address – I talk a lot about biometrics/secure documents/identity, some about technology, and a little bit about general business.

And I don’t talk about graphics at all. (Whoops, I guess I just did.)

I’d like to use a photo of myself to personalize my service. What photo should I use?

If I were you, I’d take a minute to think about the picture you want to use. How will this picture show that you are the best provider for your specific service in the entire universe? What should be in the background?

  • For example, if you’re a master coder, should you have a computer screen behind you with something specific on the screen?
  • If you’re a writer, should you have a bookcase or perhaps an entire library behind you?
  • If you’re a certified forensic expert, should you show a murder scene behind you? (Maybe not.)
By FBI – http://www.fbi.gov/news/photos, Public Domain, https://commons.wikimedia.org/w/index.php?curid=18500900

Look at it from the point of view of a potential customer – would I want to do business with this person? 

Of course, different marketing efforts call for different pictures. I actually had a reason to use the 1980-1981 t-shirt picture that I posted toward the beginning of this post: I was talking about the fact that I have been writing since my college days. And at other times, I use a Users Conference picture in which I am talking about a smartphone app that I populated. It just depends on the context.

What question from the Freelancers Union contact received a response that I am not posting here?

She asked one additional question about other reasonable ways to get her service out there. With one exception, I chose not to post my full response to that question here for two reasons:

  • First, my response contained some very specific details about the nature of my business that I have chosen not to share with the general public. If you really want to hear that part of the discussion, I’ll create a Bredemarket Premium post and make you pay to read the response.
  • Second, my response was a very good example of “your mileage may vary.” For example, I noted that I have not had success with a particular freelancing service, but noted that many other people HAVE had success with that same service.

So what’s the exception? In response to a specific comment that my contact made, I offered this response:

You never know when your existing network will yield opportunities.

I’m not going to print the rest of the paragraph from my email to my contact, but suffice it to say that the majority of Bredemarket’s business has been won as a result of people who knew me at IDEMIA, MorphoTrak, Motorola, or even Printrak.

  • Some worked with me and became “free agents” at the same time that I did.
  • Some worked with me but left long before I did.
  • Some used to work for competitors.
  • Some are now working for large companies, others small companies, and others are sole proprietors.
  • In some cases my contact directly asked me to consult, while in other cases the my contact talked to other people (sometimes in other companies) who asked me to consult.

In the end, you never know when those contacts you made months or years or decades ago may result in something new…not just in business, but in life.

P.S. One more thing: content calendars.

A second “biometrics is evil” post (Amazon One)

This is a follow-up to something I wrote a couple of weeks ago. I concluded that earlier post by noting that when you say that something needs to be replaced because it is bad, you need to evaluate the replacement to see if it is any better…or worse.

Fair use, https://en.wikipedia.org/w/index.php?curid=17499683

First, the recap

Before moving forward, let me briefly recap my points from the earlier post. If you like, you can read the entire post here.

  • Amazon is incentivizing customers ($10) to sign up for its Amazon One palm print program.
  • Amazon is not the first company to use biometrics to speed retail purchases. Pay By Touch, the University of Maryland Dining Hall have already done this, as well as every single store that lets you use Apple Pay, Google Pay, or Samsung Pay.
  • Amazon One is not only being connected in the public eye to unrelated services such as Amazon Rekognition, and to unrelated studies such as Gender Shades (which dealt with classification, not recognition), but has been accused of “asking people to sell their bodies.” Yet companies that offer similar services are not being demonized in the same way.
  • If you don’t use Amazon One to pay for your purchases, that doesn’t necessarily mean that you are protected from surveillance. I’ll dive into that in this post.
From https://techcrunch.com/2021/08/02/amazon-credit-palm-biometrics/.

Now that we’re caught up, let’s look at the latest player to enter the Amazon One controversy.

Yes, U.S. Senators can be bipartisan

If you listen to the “opinion” news services, you get the feeling that the United States Senate has devolved into two warring factions that can’t get anything done. But Senators have always worked together (see Edward Kennedy and Dan Quayle), and they continue to work together today.

Specifically, three Senators are working together to ask Amazon a few questions: Bill Cassidy, M.D. (R-LA), Amy Klobuchar (D-MN), and Jon Ossoff (D-GA).

And naturally they issued a press release about it.

Now arguments can be made about whether Congressional press releases and hearings merely constitute grandstanding, or whether they are serious attempts to better the nation. Of course, anything that I oppose is obviously grandstanding, and anything I support is obviously a serious effort.

But for the moment let’s assume that the Senators have serious concerns about the privacy of American consumers, and that the nation demands answers to these questions from Amazon.

Here are the Senators’ questions, from the press release:

  1. Does Amazon have plans to expand Amazon One to additional Whole Foods, Amazon Go, and other Amazon store locations, and if so, on what timetable? 
  2. How many third-party customers has Amazon sold (or licensed) Amazon One to? What privacy protections are in place for those third parties and their customers?
  3. How many users have signed up for Amazon One? 
  4. Please describe all the ways you use data collected through Amazon One, including from third-party customers. Do you plan to use data collected through Amazon One devices to personalize advertisements, offers, or product recommendations to users? 
  5. Is Amazon One user data, including the Amazon One ID, ever paired with biometric data from facial recognition systems? 
  6. What information do you provide to consumers about how their data is being used? How will you ensure users understand and consent to Amazon One’s data collection, storage, and use practices when they link their Amazon One and Amazon account information?
  7. What actions have you taken to ensure the security of user data collected through Amazon One?

So when will we investigate other privacy-threatening technologies?

In a sense, the work of these three Senators should be commended, because if Amazon One is not implemented properly, serious privacy breaches could happen which could adversely impact American citizens. And this is the reason why many states and municipalities have moved to restrict the use of biometrics by private businesses.

And we know that Amazon is evil, because Slate said so back in January 2020.

The online bookseller has evolved into a giant of retail, resale, meal delivery, video streaming, cloud computing, fancy produce, original entertainment, cheap human labor, smart home tech, surveillance tech, and surveillance tech for smart homes….The company’s “last mile” shipping operation has led to burnout, injuries, and deaths, all connected to a warehouse operation that, while paying a decent minimum wage, is so efficient in part because it treats its human workers like robots who sometimes get bathroom breaks.…

But why stop with Amazon? After all, Slate’s list included 29 other companies (while Amazon tops the list, other “top”-ranked companies include Facebook, Alphabet, Palantir Technologies, and Uber), to say nothing of entire industries that are capable of massive privacy violations.

Privacy breaches are not just tied to biometric systems, but can be tied to any system that stores private data. Restricting or banning biometric systems won’t solve anything, since all of these abuses could potentially occur on other systems.

  • When will the Senators ask these same questions to Apple, Google (part of the aforementioned Alphabet), and Samsung to find out when these companies will expand their “Pay” services? They won’t even have to ask all seven questions, because we already know the answer to question 5.
  • Oh, and while we’re at it, what about Mastercard, Visa, American Express, Discover, and similar credit card services that are often tied to information from our bank accounts? How do these firms personalize their offerings? Who can buy all that data?
  • And while we’re looking at credit cards, what about the debit cards issued by the banks, which are even more vulnerable to abuse. Let’s have the banks publicly reveal all the ways in which they protect user data.
  • You know, you have to watch out for those money orders also. How often do money order issuers ask consumers to show their government ID? What happens to that data?
  • Oh, and what about those gift cards that stores issue? What happens to the location and purchase data that is collected for those gift cards?
  • When people use cash to pay for goods, what is the resolution of the surveillance cameras that are trained on the cash registers? Can those surveillance cameras read the serial numbers on the bills that are exchanged? What assurances can the stores give that they are not tracking those serial numbers as they flow through the economy?

If you think that it’s silly to shut down every single payment system that could result in a privacy violation…you’re right.

Obviously if Amazon is breaking federal law, it should be prosecuted accordingly.

And if Amazon is breaking state law (such as Illinois BIPA law), then…well, that’s not the Senators’ business, that’s the business of class action lawyers.

But now the ball is in Amazon’s court, and Amazon will either provide thousands of pages of documents, a few short answers, a response indicating that the Senators are asking for confidential information on future product plans, or (unlikely with Amazon, but possible with other companies) a reply stating that the Senators can go pound sand.

Either way, the “Amazon is evil” campaign will continue.

And now I’m waiting for tangible collateral

I guess this is the fourth post in a series. See posts one, two, and three.

I’ll quickly sum up all of those prior posts to say that I ordered some business cards.

Anyway, I have finally ordered some business cards, which should arrive before my in-person event next week.

I was able to follow the progress of my order via a handy dandy link to the shipper’s website. I won’t name the shipper, but it does a lot of federal business and offers a variety of services, including express services.

Initially the service said that my cards wouldn’t arrive until this week, but then the anticipated delivery date was revised to Tuesday, August 10.

So I watched as my package moved from Henderson, Nevada to Bloomington, California, less than 20 miles from Bredemarket’s world headquarters.

The package stayed in Bloomington for a few days before moving again.

To Deming, New Mexico.

My last report indicated that the package had arrived in Fort Worth, Texas, and would be delivered by Thursday, August 19.

The day AFTER my meeting.

I guess I should have ordered business cards a year ago. Oh well, better late than never.

But I have a workaround. I’ve created a handout that includes an image of my business card.

It won’t fit in a business card holder, but it’s better than nothing.

Incidentally, I haven’t bothered to upload the PDF of this particular data sheet to the Bredemarket website, since it’s really intended for in-person distribution. If you want to find out about the Bredemarket 400 and Bredemarket 2800 services, you can skip the QR codes and just use these links:

And there’s one service that I DON’T mention on this particular sheet (except for my reference to “other services”) because it’s not of primary interest to the market I’m addressing in my meeting this week. However, if your needs don’t fit into a standard package, Bredemarket can offer services at an hourly rate. This service (Bredemarket 4000 Long Writing Service) doesn’t have a PDF handout, but does have a web page.

Which I just updated with the details from my revision to my content creation process.

Again, better late than never.

Update on Covishield and the EUDCC, as long as you can prove you were born

It’s been a while since I looked at issues regarding the European Union Digital COVID Certificate (EUDCC).

From https://ec.europa.eu/commission/presscorner/api/files/attachment/868508/Digital%20Green%20Certificate_en.pdf.pdf

And there are a ton of ramifications and unintended consequences.

Covishield and the EUDCC

When I last looked at the EUDCC, I examined its effect on travel from people outside of the European Union. The question at the time was what would happen to people who were vaccinated with something other than the European Medicines Agency-approved vaccines, thus rendering them ineligible for the EUDCC.

In particular, people who were vaccinated with the Covishield vaccine were not eligible for the EUDCC. Depending upon whom you asked, Covishield is either just the same as the EMA-approved AstraZeneca vaccine (now referred to as “Vaxzervria” in EU-speak), or it has a radically different manufacturing process that disqualifies it from automatic acceptance.

This non-recognition of Covishield has a great impact on African nations, because that vaccine is popular there. However, EUDCC disapproval has been offset by the actions of several individual countries to recognize Covishield as a vaccine. For example, Greece recognizes ten vaccines (including Covishield) as opposed to the EU’s four. Of course, you have to go through additional paperwork to get authorization to enter a specific country.

But Joseph Atick notes that there’s another issue that adversely impacts the ability of Africans to enter Europe.

Linking a vaccination to a person

Assume for the moment that you have received an EU-authorized vaccine. This is only part of the battle, because the act of vaccination has to be tied to you as a person.

Dr. Joseph Atick of ID4Africa. From https://id4africa.com/the-general-secretariat/

And Atick notes one complicating factor in making that link:

One of the biggest barriers to setting up these systems—and one that could greatly complicate digital health certificates – involves traceability, which for an official digital ID means documenting one’s birth event.

In Africa, not everyone has a birth certificate, and many struggle to trace their identity to the birth event.

If you cannot prove to the satisfaction of the European Union (or whoever) that you were the actual person who received a vaccine, then you may face barriers to entering Europe (or wherever).

And what are the ramifications of this?

A digital health certificate has appeal as an efficient and effective way to manage COVID-19 risks. But if we don’t pause now to consider the implications of getting it wrong and look for ways to get it right, these marvellous digital innovations could also be supremely effective at creating a binary world of those who can prove their COVID-19 risk status and those who cannot.

The requirement for a digital identity

Oh, and there’s another issue that Atick didn’t address, but which bears noting.

All of the health vaccination solutions listed above assume as a given that people will be the owners of a unique, government-authorized digital identity.

As I’ve noted elsewhere, there are people who are fervently opposed to this.

In my country, both some people on the left and some people on the right believe that “governmental digital identity” naturally equates to “governmental digital surveillance,” and that governments shouldn’t be abusing the data that they can obtain from all the vaccinations you get, all the places you travel, all the things you buy, and all the other things that you do.

(Well, except for voting. Some on the right fervently believe that government identities are essential to voting, even if they’re not essential to any other activity.)

But are people truly banned from travel?

So where does this leave the people who cannot prove that they were vaccinated with an authorized vaccine, or perhaps were never vaccinated at all?

In many cases travel for the unvaccinated is not banned, but they have to go through additional hoops to travel. Using one example, unvaccinated U.S. citizens can travel to Austria if they “have recovered from COVID-19 in the past 180 days; or present a negative COVID-19 PCR or antigen test result procured within 72 or 48 hours of travel.” For more country-by-country specifics as of August 13, click here.

But how will the unvaccinated get to Europe, or anywhere else?

But on the other hand, a vaccination in and of itself is not a guarantee that you can travel. Norway has a long list of requirements that an incoming person must satisfy, vaccination or not. This isn’t the time for an American to go on a sightseeing tour to Oslo.

Or Pyongyang.

So a binary division into the “travels” and “travel nots” may not become a reality. Instead, it will be a gradation of travel allowances and non-allowances, based upon a variety of factors.

In this post, “NGI” stands for Non-Governmental Identity

I admit to my biases.

As a former long-time employee of a company that provides finger and face technology for the Federal Bureau of Investigation’s Next Generation Identification (NGI) system, as well as driver’s license and passport technology in the United States and other countries, I am reflexively accustomed to thinking of a proven identity in governmental terms.

Because the government is always here to help.

From World War II. By Packer, poster artist, Artist (NARA record: 8467744) – U.S. National Archives and Records Administration, Public Domain, https://commons.wikimedia.org/w/index.php?curid=16929857

What this means in practice is that whenever I see a discussion of a proven identity, I reflexively assume that the identity was proven through means of some type of governmental action.

  • Perhaps the identity was tied to a driver’s license identity maintained by a state agency (and checked against other states via AAMVA’s “State to State” to ensure that there are no duplicate identities).
  • Or perhaps the identity was proven via the use of a database maintained by a government agency, such as the aforementioned NGI or perhaps a database such as the CODIS DNA database.

However, I constantly have to remind myself that not everyone thinks as I do, and that for some people an identity proven by governmental means is the worst possible scenario.

Use of DNA for humanitarian efforts

Take an example that I recently tweeted about.

I recently read an article from Thermo Fisher Scientific, which among other things provides a slew of DNA instruments, software, and services for both traditional DNA and rapid DNA.

One of the applications of DNA is to prove family relationships for migrants, especially after families were separated after border crossings. This can be done in a positive sense (to prove that a separated parent and child ARE related) or in a negative sense (to prove that a claimed parent and child are NOT related). However, as was noted in a webinar I once attended, DNA is unable to provide any verification of legitimate adoptions.

By Nofx221984 – Own work, Public Domain, https://commons.wikimedia.org/w/index.php?curid=7429871

Regardless of the purpose of using DNA for migrants, there is a certain level of distrust among the migrants when the government says (presumably in Spanish), “We’re the government. We’re here to help.” You don’t have to be a rabid conspiracy theorist to realize that once DNA data is captured, there is no technical way to prevent the data from being shared with every other government agency. Certain agencies can establish business rules to prevent such sharing, but those business rules can include wide exceptions or the rules can be ignored entirely.

Therefore, Thermo Fisher Scientific decided to discuss humanitarian DNA databases.

As a result of migration, human trafficking and war, humanitarian databases are a relatively new concept and are often completely separate from criminal databases. Research has shown that family members may distrust government databases and be reluctant to report the missing and provide reference samples (1). Humanitarian databases are repositories of DNA profiles from reported missing persons, relative reference samples, and unknown human remains and may be managed by non-governmental organizations (NGOs), though in some instances they may be managed by a governmental institution but kept separate from criminal databases. Examples of humanitarian databases can be found in the United States (NamUs, University of North Texas HDID), Canada (Royal Canadian Mounted Police), Australia (National DNA Program for unidentified and missing persons) and internationally via the International Commission on Missing Persons (ICMP).

As you can see from the list, some of these databases ARE managed by government police agencies such as the RCMP. But others are not. The hope, of course, is that migrants would be willing to approach the humanitarian folks precisely BECAUSE they are not the police. Reluctance to approach ANY agency may be dampened by a desire to be reunited with a missing child.

And these non-governmental efforts can work. The Colibri Center claims to have performed 142 identifications that would not have been made otherwise.

Reluctance to set national standards for mobile driver’s licenses

Because of my (biased) outlook, mobile driver’s licenses and other applications of government-proven digital identity seem like a wonderful thing. The example that I often bore you with is the example of buying a drink at a bar. If someone does this with a traditional driver’s license, the bartender not only learns the drinker’s birthdate, but also his/her address, (claimed) height and weight, and other material irrelevant to the “can the person buy a drink?” question. With a mobile driver’s license, the bartender doesn’t even learn the person’s birthdate; the bartender only learns the one important fact that the drinker is over 21 years of age.

Some people are not especially wowed with this use case.

The DHS Request for Comment has finally closed, and among the submissions is a joint response from the American Civil Liberties Union, Electronic Frontier Foundation (EFF), & Electronic Privacy Information Center (EPIC). The joint response not only warns about potential misuse of government digital identities, but also questions the rush of establishing them in the first place.

We believe that it is premature to adopt industry standards at this time as no set of standards has been completed that fully takes advantage of existing privacy-preserving techniques. In recent decades we have seen the emergence of an entire identity community that has been working on the problems of online identity and authorization. Some within the identity community have embraced centralized and/or proprietary systems…

You can imagine how the ACLU, EFF, and EPIC feel about required government-managed digital identities.

Is a Non-Governmental Identity (NGI) feasible and reliable?

Let’s return to the ACLU/EFF/EPIC response to the DHS Request for Comment, which mentions an alternative to centralized, proprietary maintenance of digital identities. This is the alternative that I’m referring to as NGI just to cause MAC (massive acronym confusion).

…others are animated by a vision of “self-sovereign
identity” that is decentralized, open source, privacy-preserving, and empowering of individuals. That movement has created a number of proposed systems, including an open standard created by the World Wide Web Consortium (W3C) called Verifiable Credentials (VCs)….

DHS should refuse to recognize IDs presented within centralized identity systems. If a standard digital identity system is to be accepted by the federal government, it must be created in an open, transparent manner, with the input of multiple stakeholders, and based upon the self-sovereign identity concept. Such a system can then be used by federal government agencies to view identity credentials issued by state departments of motor vehicles (DMVs) where doing so makes sense. If standards based on self-sovereign identity are not considered mature enough for adoption, efforts should be directed at rectifying that rather than at adopting other systems that raise privacy, security, and autonomy risks.

For all practical purposes, the chances of the ACLU/EFF/EPIC convincing the Department of Homeland Security to reject government-proven identities are approximately zero. And since DHS controls airport access, you probably won’t see an airport security agent asking for your Verifiable Credentials any time soon. Self sovereign identities are just as attractive to government officials as sovereign citizens.

Who issues Verifiable Credentials?

As ACLU/EFF/EPIC noted, Verifiable Credentials are still under development, just as the centralized system standards are still under development. But enough advances have been made so that we have somewhat of an idea what they will look like. As Evernym notes, there is a trusted triangle of major players in the Verifiable Credentials ecosystem:

From https://www.evernym.com/blog/gentle-introduction-verifiable-credentials/. Fair use.

There are a number of directions in which we can go here, but for the moment I’m going to concentrate on the Issuer.

In the current centralized model being pursued in the United States, the issuers are state driver’s license agencies that have “voluntarily” consented to agree to REAL ID requirements. Several states have issued digital versions of their driver’s licenses which are recognized for various purposes at the state level, but are not yet recognized at the federal level. (The purpose of the DHS Request for Comment was to solicit thoughts on federal adoption of digital identities. Or, in the case of some respondents, federal NON-adoption of digital identities.)

Note that in the Verified Credentials model, the Issuer can be ANYBODY who has the need to issue some type of credential. Microsoft describes an example in which an educational institution is an Issuer that represents that a student completed particular courses.

Without going into detail, the triangle of trust between Issuers, Verifiers, and Holders is intended to ensure that a person is who they say they are. And to the delight of the ACLU et al, this is performed via Decentralized Identifiers (DIDs), rather than by centralized management by the FBI or the CIA, the BBC, B. B. King, Doris Day, or Matt Busby. (Dig it.)

But NGIs are not a cure-all

Despite the fact that they are not controlled by governments, and despite that fact that users (at least theoretically) control their own identities, no one should think that digital identities are the solution to all world problems…even when magic paradigm-shifting words like “blockchain” and “passwordless” are attached to them.

Here’s what McKinsey has said:

…even when digital ID is used with good intent, risks of two sorts must be addressed. First, digital ID is inherently exposed to risks already present in other digital technologies with large-scale population-level usage. Indeed, the connectivity and information sharing that create the value of digital ID also contribute to potential dangers. Whether it is data breaches and cyber-intrusions, failure of technical systems, or concerns over the control and misuse of personal data, policy makers around the world today are grappling with a host of potential new dangers related to the digital ecosystem.

Second, some risks associated with conventional ID programs also pertain in some measure to digital ID. They include human execution error, unauthorized credential use, and the exclusion of individuals. In addition, some risks associated with conventional IDs may manifest in new ways as individuals newly use digital interfaces. Digital ID could meaningfully reduce many such risks by minimizing opportunity for manual error or breaches of conduct.

In addition, many of these digital identity initiatives are being pursued by large firms such as IBM and Microsoft. While one hopes that these systems will be interoperable, there is always the danger that the separate digital identity systems from major firms such as IBM and Microsoft may NOT be interoperable, in the same way that the FBI and DHS biometric systems could NOT talk to each other for several years AFTER 9/11.

And it’s not only the large companies that are playing in the market. Shortly after I started writing this post, I ran across this LinkedIn article from the Chief Marketing Officer at 1Kosmos. The CMO makes this statement in passing:

At 1Kosmos, we’ve taken our FIDO2 certified platform one step further with a distributed identity based on W3C DID standards. This removes central administration of the database via a distributed ledger for true “privacy by design,” putting users in sole access and control of their identity.

1Kosmos, IBM, and Microsoft know what they’re talking about here. But sadly, some people only think these technologies are “cool” because they’re perceived as anti-government and anti-establishment. (As if these companies are going to call for the downfall of capitalism.)

Which identiy(ies) will prevail?

Back to governmental recognition of NGI.

Don’t count on it.

Anticipated DHS endorsement of government-issued digital identities doesn’t mean that NGI is dead forever, since private companies can adopt (and have adopted) any identity system that they wish.

So in truth we will probably end up with a number of digital identities like we have today (I, for example, have my WordPress identities, my Google identities, and countless others). The difference, of course, is that the new identities will be considered robust – or won’t be, when centralized identity proponents denigrate decentralized identities and vice versa.

But frankly, I’m still not sure that I want Facebook to know how much I weigh.

(Although, now that I think about it, Apple already knows.)

By Apple Inc. – http://www.apple.com, Fair use, https://en.wikipedia.org/w/index.php?curid=43953320