Sunday, September 09, 2007

Verification is Insurance!

It's probably bad form to quote myself, but I think that the message should be spread through all means: Linden Lab's planned verification is not the "end of the world as we know it". What Linden Lab is effectively doing is buying some insurance against lawsuits!

You might have read elsewhere the huge drama about Robin Linden's series of blog entries on Identity Verification Coming To Second Life. If you have missed it, understand that LL will very shortly put a new system in place, where you can optionally go to a special web page, which ties into Integrity' system, and re-type your RL name and addresses, add a number from a valid ID card (which varies from country to country; for the US, you're allegedly supposed to put the last four digits of your SSN), and that's it: your avatar will be instantly "verified".

Very briefly, two points are important to remember:
  1. Linden Lab does not know what information you're sending to Integrity, so they are unable to know what RL data you're actually providing to them.
  2. Integrity has no clue on which avatar is doing the request. All they know is that "someone from Linden Lab's Second Life" is asking to get verified, but they don't know who it is.
Most important is to understand that Integrity apparently gets all their data from publicly available databases. That means that they are not asking you for any data that they don't already have. And they're not passing that data to Linden Lab, either. All they're doing is a check on their databases, see if the addresses match with your ID card, and send back an "ok" to LL. There is no point of "fearing a third party that will now know your ID" — they already have it stored on their databases!

So this is quite different from what certification authorities like Verisign (or even PayPal) are doing, who require you to send them data — usually by fax, in extreme cases through a notary public, or any other form of "real" communication — in order to verify your identity. Integrity works the other way round: first they collect all the data from those "publicly available databases" and store them on their servers. And then they resell the service of allowing people to know if their users do, indeed, match to the data they have — without revealing what data there is.

It's also important to see through the smoke and mirrors. Linden Lab doesn't really "care" about avatar verification; the whole "story" of "more trust in SL" is, frankly, pretty irrelevant. It's a nice pink & fluffy story for children. What they really want is something way more interesting. As part of Integrity's service, they accept the liability in case of a mismatch in their data. This means that if a minor is "checked" by Integrity (because they're using their parents' ID card), and the parents sue LL for some silly reason, Integrity will pay the costs. It's a risk business. Or, if you wish, Integrity is in the business of selling lawsuit insurance.

This is what you should have in mind when clicking on that checkbox. Forget LL's "change of the world". Forget Big Brother, 1984, or oppressive tyranny in a world where everybody knows who you are and what you're doing. You're completely missing the point! What LL is doing is buying insurance, since they're scared of those crazy individuals with nothing else to do but filing lawsuits against LL and getting a pro bono lawyer willing to spend a few hundreds of thousads of US$ in court just because of the huge media splash. LL can't afford to continue to operate with all those lawsuit-trigger-happy fanatics who live in our era and age. So they pushed all responsibility towards a third party. Like they have their servers insured at their co-location, they're now getting insurance against lawsuits, too.

You have to admit that is pretty clever of them. And for us SL residents it also means that we can sleep in peace knowing that people won't be able to sue LL so easily any more.

But LL is not an Evil Corp™. They even tell us more: if you flag your content, and keep your land parcel blocked to unverified avatars, we'll extend the protection towards you, too. This is what scares the merchants who fear that nobody is going to use verification, thus forcing them either to block unverified avatars (and lose customers), or risk the liability of having minors showing up, or, well, shut down and go. In the short term, losing customers might be unavoidable — but in 2008, we'll have another 10 million fresh users who will all be verified since their rezdays, and they'll be the good customers of the few adult content providers that had the courage to remain in SL for a few more months instead of packing and going.

Incidentally, you now know why LL shut down gambling: Integrity's insurance does not work (yet) for gambling sites. So now you know: no, it wasn't the FBI that forced gambling out of SL, but a requirement of Integrity's contract with LL. And the good news: Integrity's own political agenda is to lobby for a change in legislation that allows verified adults to gamble online while keeping children out. Of course, they're promoting their own service here, and they will be able to insure those sites then. I have no idea how strong this lobby might be, but you have to admit that it's a pretty cool idea — no matter your personal feelings about the "morality" of gambling. All that Intergrity is claiming is that the US could make a few billions out of taxes from Internet gambling, so long as they could guarantee no access to minors.

For a more thorough analysis, feel free to read my own blog.


  1. Good writing. But you forgot to mention that you are wanna-be linden, and perhaps the biggest linden sympathizer on the grid.


  2. Good writing. But you forgot to mention that you are wanna-be linden, and perhaps the biggest linden sympathizer on the grid.


  3. That's a good explanation, Gwyneth. Much of the hysteria about verification has come from a complete lack of understanding the process.

  4. the tap house: Ah, not really, you misunderstand my purpose. Sure, like almost everybody in 2004, I used to fancy working for Linden Lab, like, I imagine, a lot of people from those days. I even applied for a job there, three times I believe, but then let it go when it was clear they didn't want me :)

    These days, however, I found out that LL's own corporate culture is not something I would enjoy to live under. So, instead of working for Linden Lab, I rather prefer to work with them in Second Life. I hope the difference is clear ;)

    As for being the biggest Linden sympathiser on the grid, you do me a great honour indeed, and I'm definitely not worthy of such an honour!

    And I'm certainly a Leibnizian — "We live in the best of all possible grids" ;)

  5. Ah, Flip, but isn't that always the case? :)

  6. I understand your point, but I think it's a little bit expensive for such a specific insurance. Why pay and create controversy over a service like this which will only protect them if a minor is misidentified as an adult?

    It would seem to me that buying a liability policy would be better as it would cover much more then a single kind of lawsuit.

    What you mentioned may be part of the why, but I don't think that's the whole reason.

  7. So this is insurance to cover Linden's ass in lawsuits. I understand that. But where is my insurance from Identity Theft?

    We only have LL's word on this, and Integrity's, a company well known for selling on data and data mining.

    While that might be all public databases, that opens the question of European Data Protection Laws, and where is my protection when I send those details through the internet?

    Even though LL and Integrity may be on the up and up, that's open transmission of data which can be intercepted before it gets to them because they want me to send it.

    And the point everybody has been missing, is it it's okay to verify on the last 4 digits of US SSNs, why is it not okay to verify on last 4 digits of passport number? Why do I have to send the whole thing (which I won't be doing)?

    And lastly, if they are all public databases you can look up, then what is to stop me looking someone up, and supplying that data? This whole thing verifies absolutely nothing, and is non-US data gathering, pure and simple.

    It's unworkable, erroneous, highly fishy and stinks.

  8. Thanks for the information on topics.I was excited for this article.
    Thank you again.

    Insurance information for good ideas.

  9. Kfz Versicherung4:30 PM, May 26, 2008

    Very good Blog. My Favorit. I have this blog booknarket. Thanks

  10. Linden Lab's planned verification is An unnecessary feature which will cause significant in-world upheaval.

    Great post,