Gary T. Marx
Massachusetts Institute of Technology
Send Email | Bibliography | Tables | Notes | Back to Home Page
To paraphrase Mark Twain, reports of either the recent death or coming dominance of anonymity have been greatly exaggerated. This paper is a beginning effort to lay out some of the conceptual landscape needed to better understand anonymity and identifiability in contemporary life. I suggest 7 types of identity knowledge involving legal name, location, symbols linked and not linked back to these through intermediaries, distinctive appearance and behavior patterns, social categorization and certification via knowledge or artifacts. I identify a number of major rationales and contexts for anonymity (free flow of communication, protection, experimentation) and identifiability (e.g., accountability, reciprocity, eligibility) and suggest a principle of truth in the nature of naming which holds that those who use pseudonyms on the Internet in personal communications have an obligation to indicate they are doing so. I also suggest 13 procedural questions to guide the development and assessment of any internet policy regarding anonymity.
Keywords: anonymity, pseudonymity, identification, surveillance, privacy, electronic communication, ethics
Gary T. Marx was a fellow at the Woodrow Wilson International Center for Scholars, Washington D.C. to whom he is grateful for the wonderful environment in which this paper was prepared. He is also grateful to Terry Bynum and Ann Wood for their extensive comments and to several "anonymous" reviewers for this journal.
Versions of this paper were delivered at a conference on Anonymous Communication on the Net, Irvine, California, American Association for the Advancement of Science, Nov. 1997 and at their annual meetings in Philadelphia. This draws from a forthcoming book Windows Into the Soul: Surveillance and Society in an Age of High Technology, based on the American Sociological Association-Duke University Jensen Lectures.
"You ought to have some papers to show who
you are." The police officer advised me.
"I do not need any paper. I know who I am,"
"Maybe so. Other people are also interested
in knowing who you are."
--B. Traven, The Death Ship
A major consequence of new surveillance and communications technologies is the potential both to decrease and increase anonymity. Powerful surveillance technologies can inexpensively, efficiently and silently break through borders that have historically protected anonymity and other aspects of personal information. Anonymity may also be undermined by new biometric forms of identification such as DNA and retinal, voice and olfactory patterns. The ease of merging previously unrelated data and creating permanent records via audio and video recordings may also reduce the de facto anonymity which resulted from the absence of an observer, the failure of memory and weak means of data analysis. The "ocular proof" demanded by Othello of his wife's infidelity comes in an ever expanding variety of forms.
In contrast, new ways of communicating using encryption and through Internet services which offer the opportunity to use pseudonyms and forwarding services which strip all identifying marks, may increase some forms of anonymity. The personal identity of interlocutors is more difficult to ascertain absent other sensory cues or codes for authentication. The newness also means that neither formal nor informal norms have sufficiently developed.
The issue of anonymous communication on the net is part of a broader set of surveillance issues that includes the ubiquitous "cookies" question as well (cookies are remote programs that can monitor web page user's on-line behavior and can even invade their hard drive without their knowledge or consent). These in turn are part of the still larger issue of visibility and insulation in a society undergoing rapid technological change.
To paraphrase Mark Twain, reports of either the recent death or coming dominance of anonymity have been greatly exaggerated. We are as ill-served by sweeping statements about the end of privacy as we are about the appearance of a golden age of technologically protected communication. The systematic study of computers, privacy and anonymity is in its infancy. Conceptually the multiple dimensions involved here have not been specified, nor of course have they been measured in a systematic empirical fashion that would permit reaching broad conclusions. The situation is also dynamic --research documenting a clear problem (or its absence) can be a factor in subsequent developments.
This paper lays out some of the conceptual landscape surrounding anonymity and identifiability in contemporary society. The emphasis is on the cultural level --on normative expectations and justifications, more than on describing actual behavior. It is also on the anonymity of individuals rather than of groups or organizations (of course these may be linked as with infiltrators using pseudonyms working for false front intelligence agencies).
I offer some definitions and conceptual distinctions and identify seven dimensions of identity knowledge. I specify social settings where the opposing values of anonymity or identifiability are required by law, policy, or social expectations. I then suggest thirteen questions reflecting several ethical traditions to guide policy development and assessment in this area. While the tone of the paper is tentative in the face of the rapidity of change and the complexity of the issues, I conclude by offering one broad principle involving truth in the nature of naming that I think should apply to computer mediated personal communications.
Definitions and Concepts
Let us first define anonymity and relate it to privacy, confidentiality, and secrecy. Anonymity is one polar value of a broad dimension of identifiability vs. non-identifiability. To be fully anonymous means that a person can not be identified according to any of the seven dimensions of identity knowledge to be discussed below. This in turn is part of a broader variable involving the concealment and revelation of personal information and of information more generally.
Identity knowledge is an aspect of informational privacy. The latter involves the expectation that individuals should be able to control information about themselves. Privacy can be differentiated from confidentiality which involves a relationship of trust between two or more people in which personal information is known, but is not to be revealed to others, or is to be revealed only under restricted conditions. Secrecy refers to a broader category of information protection. It can refer to both withholding the fact that particular information exists (e.g., that a pseudonym is in use) and to its content.
Ironically anonymity is fundamentally social. Anonymity requires an audience of at least one person. One can not be anonymous on top of a mountain if there is no form of interaction with others and if no one is aware of the person. Compare the solitude of the Beach Boys' song "In My Room", a lonely, introspective, plaintive to unrequited love to Petula Clark's desire to experience the freedom of being "Downtown" where "no one knows your name". While similar, only the latter is an example of anonymity.
7 Types of Identity Knowledge
Identity knowledge has multiple components and there are degrees of identifiability. At least 7 broad types of identity knowledge can be specified. (table 1) These are 1) legal name 2) locatability 3) pseudonyms that can be linked to legal name and/or locatability --literally a form of pseudo-anonymity 4) pseudonyms that can not be linked to other forms of identity knowledge --the equivalent of "real" anonymity (except that the name chosen may hint at some aspects of "real" identity 5) pattern knowledge 6) social categorization 7) symbols of eligibility/non-eligibility.
What is the ecology or field of identity revelation/ concealment? How are these distributed in social space and time? What structures and processes can be identified? When and why does society require or expect (whether by laws, policies or manners) that various aspects of identity will not be revealed?
Under what conditions does the opposite apply --that is, when is the revelation of the various aspects of identity expected by law, policy or custom?
The lists that follow, while not exhaustive, hopefully cover the most common contexts in which anonymity and identifiability are viewed as socially desirable. I have classified these by their major justifications. 2
Rationales in Support of (full or partial) Anonymity
Here we encounter the interesting case of expectations of privacy in public (Nissenbaum, 1997). There is an irony in norms of privacy having particular cogency in public settings. While not codified, manners in public settings and in encounters with strangers limit what can be asked of the other and support what Erving Goffman terms disattending. One aspect of this is to help others avoid embarrassment and to help sustain a person's self-image and the image presented to others of being a particular kind of person, even when the facts suggest the opposite. Here we may distinguish between not having identity knowledge vs. having it, but pretending that one does not --granting a kind of pseudo-anonymity. This may be to avoid unwanted claims or to collude in helping others maintain a positive image of self. David Karp's (1973) study of the privacy sustaining behavior of patrons and employees in pornographic book stores is an example.
A related case is not taking advantage of available identity information. This factor was emphasized by Simmel (1964) in commenting on the urban dweller's tendency to screen out information and distance one'self from the abundance of sensory stimuli offered by busy city environments.
Another environment where a degree of defacto anonymity exists is in being away from home --whether as a tourist, traveler, or expatriate. Not only is one less likely to be personally known but many of the symbols (accent, dress, body language) that present clues to identity will go uninterpreted or simply serve to put one in the broad class of foreigner. Since the stranger may be seeking this anonymity, locals may have an economic or political interest in granting it. It would be interesting to study isolated areas and frontier towns in this regard. Note places such as the small western town where the fugitive in the novel Falcon and the Snowman 6 was living when he was captured, in which there is a tradition of not asking who people were, or where they came from.
Rationales in Support of Identifiability
A consideration of contexts and rationales where anonymity is permitted or required must be balanced by a consideration of the opposite. When is identifiability required, expected or permitted?
The rationales here seem simpler, clearer and less disputed. While there are buffers and degrees of identification, the majority of interactions of any significance or duration tilt toward identification of at least some form. As Scottish moral philosophers such as David Hume argued, human sentiments and social needs favor it. It is more difficult to do ill to others when we know who they are and must face the possibility of confronting them. Mutual revelation is a sign of good faith which makes it easier to trust (not unlike the handshake whose origin reportedly was to show that one was not carrying a weapon). It is a kind of sampling of one's inner-worth or an early showing of part of one's hand. It also makes possible reciprocity, perhaps the most significant of social processes. To paraphrase a line from the film "Love Story" --"being anonymous means you never have to say you are sorry" --and that of course is one of the problems.
Thinking of society without personal identities is like a modern building without a foundation. The number of contexts where it is expected and even required far exceeds those where its opposite is required or expected. Indeed failure to identify one's self often leads to suspicion rather than the reverse. As with the Lone Ranger we ask "who was that masked man?" Just try the simple experiment of wearing a hood or Halloween mask throughout the day and note how it will surface the usually tacit norms regarding identification and a variety of control responses.
Central to many of the contexts where some form of identifiability is required or at least expected we find:
You've got to accentuate the positive
eliminate the negative
and look out for Mr. In-Between
--1950s popular song
Easier sung than done. The key issue for ethics and public policy is under what conditions is it right or wrong to favor anonymity or identifiability? As the examples above suggest there are many contexts in which most persons would agree that some form of anonymity or identifiability is desirable. But there are others where we encounter a thicket of moral ambiguity and competing rationales and where a balancing act may be called for.
The public policy questions raised by technologies for collecting personal information are more controversial than many other issues such as ending poverty and disease in which the conflict involves asking "how" rather than "why". The questions raised by the concealment and revelation of personal information are like some relationships in which persons can not live with each other, but neither can they live apart. The issue becomes under what conditions do they co-exist? So it is with anonymity and identifiability. There are existential dilemmas and in many cases we are sentenced to a life of trade-offs.
I often ask my students what society would be like if there was absolute transparency and no individual control over personal information --if everything that could be known about a person was available to anyone who wanted to know. Conversely what would society be like if there was absolute opaqueness such that nothing could be known about anyone except what they chose to reveal. The absolute anonymity vs. absolute identifiability is a strand of this. Both of course would be impossible and equally unlivable but for different reasons. To have to choose between repression and anarchy is hardly a choice between a pillow and a soft place.
The hopeful Enlightenment notion that with knowledge problems will be solved holds more clearly for certain classes of physical and natural science questions than for many social questions. Certainly those who live by the pursuit of truth dare not rain on that parade. Yet there is a difference between knowledge as providing answers as against wisdom. Current debates over anonymity and identifiability in electronic communications would greatly benefit if better data were available, but the issue would not disappear because the value conflicts and varied social and psychological pressures remain.
A wonderful cartoon shows a tanker truck with a sign on the back which says "the scientific community is divided about this stuff. Some think it is hazardous. Some don't." So it is with this issue. The divisions do not reflect ignorance, stupidity, ill-will and evil on one side and empirical truth, wisdom, benevolence and righteousness on the other. Rather they reflect empirical truths on both sides and differing value priorities. Being able to disentangle these is vital for our understanding and for developing policy.
One Size Does Not Fit All: Some Questions to Inform Policy Formation
I cast a broad net above in order to help locate networked communication within a wider social context. Apart from the value conflicts, one can hardly move directly to clarion guidelines from this for a number of reasons involving the great variety with respect to:
While I don't want to suggest content for a prohibiting or unleashing policy (with one exception), I will remain true to the generalizing impulse by focusing on procedures and criteria for policy development. In that regard, the more one can answer "yes" to the following questions the better a policy regarding identity knowledge is likely to be:
These questions embody a variety of ethical rules. Questions 1-6 call for truth in the form of good science and logic. Questions 7-9 draw on utilitarianism in minimizing harm and maximizing benefits. The remaining questions (10-13) put forth ethical principles such as those involving the dignity and rights of the individual.
The complexities and varied situations should make us suspicious of sweeping imperatives. Policies must be crafted to specific contexts. In the context of one-to-one personal communications in cyberspace, I think a strong case can be made that there should be a truth in the nature of naming policy. Certainly as the above rationales suggest there are many contexts in which persons ought to be free to call themselves whomever they want (assuming they don't steal someone else's identity or use a fictitious identity for the purpose of harming or violating the rights of others). Legal name is not always the preferred form of identity. But if there is not to be honesty in identification, then there should at least be honesty in indicating that a pseudonym is used.
If one is anonymous or uses a name that is obviously not one's legal name ("Minnie Mouse" "the Red Baron", "Ernest Hemingway") or in which there is no pretense to genuine identity (e.g., initials or first names or 007) or is in a setting where all participants know the use of pseudonyms is accepted or even expected, this is not an issue. However in most other contexts of personal relations where regular sounding first and last names are used as pseudonyms, our culture has embedded "identity norms" about authenticity in personal interaction. (Goffman 1961)
Absent special conditions, people are expected to be who they claim to be. When a false name is used and discovered, as in the extreme case with con artists, the problem is not only material loss, but the sense of being duped and even betrayed. To pretend to be another is to deceive the actor and audience. It is unfair in introducing inequality into what should be an equal, reciprocal relationship (the deceiver knows your name and that he or she is deceiving you, but you don't know that, nor do you know the real name of the deceiver). I think respect for the person being communicated with and their expectation that they will not be deceived should outweigh any freedom and liberty claims of the secret user of a pseudonym.
The fact that cyberspace makes it so relatively easy to secretly use pseudonyms in personal communications is hardly a justification, even if it is a temptation. I do not argue against the use of pseudonyms or means of identification other than legal name in personal communication, but recipients of the communication should be informed when such is the case. Certainly in many contexts what matters is continuity of personhood and the validity of the claims the individual makes (whether of the ability to pay for something or their access to relevant resources or of their expertise and experience) and their legitimacy to perform a particular role. Legal name may be irrelevant but verification is not. The crucial issue then becomes authentication of the pseudonmity. Smart cards and new crypto protocols may make this easier.
Modern technology offers a variety of ways of uncoupling verification from unique identity. Validity, authenticity, and eligibility can be determined without having to know a person's name or location. Public policy debates will increasingly focus on when verification with anonymity is or is not appropriate and on various intermediary mechanisms that offer pseudonymous buffers but not full severance. Since the cognitive appetite is difficult to sate, organizations will push for more rather than less information on individuals although they will not necessarily want to share their information with each other.
But the availability of new technologies does not negate my argument against deception in those contexts where a realistic sounding name is offered in personal communication (of course one can also make problematic just when a communication is personal).
Knowing that a pseudonym is in use permits speculation as to whether or not this is appropriate and if it isn't, why the veil might be in place and discounting, or qualifying, the message. Such forewarning will often suggest the need for greater caution than when a person's actual name is used. In face-to-face interaction we have visual and auditory cues to assess strangers, even then common-sense advises caution. How much truer that is when we lack these in cyberspace and have even less grounds for knowing the identity of strangers and if they are who they claim to be. Good manners (and in some contexts the law) requires not deceiving those we interact with about our identity. If this holds for conventional interactions it should also hold for those mediated by technology. We are entitled to know when we are dealing with a pseudonymous identity in personal communications.
In presenting this paper the truth in the nature of naming argument has often been misunderstood. I am not saying that anonymous or pseudonymous communication on the net should be banned. I am saying that if the latter is present in personal communications, then the recipient has a right to be informed of it. This does not go as far as some computer networks such as the WELL which have a policy against any anonymous or pseudonymous communication. Certainly the latter can be a means of protecting one's privacy in interactions with organizations, or when one is seeking information from a web cite. Those contexts however are different from personal communications.
As the competing rationales discussed above suggest, there are value conflicts (and conflicting needs and consequences) here which make it difficult to take a broad and consistent position in favor of or against anonymity. To list only some of these:
1. Jeff Ferrell,
Crimes of Style: Urban Graffiti and the Politics of Criminality (Boston:
2. I make these
observations as a social observer and not as a moralist or empiricist (in the
sense of subjecting claims to some kind of empirical standard). I argue neither
that these justifications are necessarily good, nor that the claimed empirical
consequences (and no unintended or other consequences) necessarily follow. To
have a pony in those races requires analysis beyond the scope of this paper.
Here I simply take claimed justifications at face value and report them. This is a first step to empirically testing such claims. Three additional tasks involve a) trying to find a pattern in the attachment of moral evaluations to the various forms of behavior b) systematically relating the types of identity knowledge to the rationales c) as a citizen taking a moral position on what it is that the society has normatively offered up regarding identity knowledge.
3. See for example the
discussion in Mary Virnoche "When A Stranger Calls: Strange Making
4. See for example Gary T. Marx, “Fraudulent Identification and Biography” in D. Altheide, et al, editor. New Directions in the Study of Law, Social Control (New York: Plenum, 1990) and Ann Cavoukian, The Theft of Identity (Ontario, Canada: Office of the Privacy Commissioner, Ontario, Canada, 1996).
5. Gary T. Marx,
“New Telecommunication Technologies Require New Manners,”
Telecommunications Policy 18 (1994): 538-552.
Lindsey, Falcon and Snowman (New York: Simon and Schuster , 1985).
Top | Home page | Tables
|Bennett, C.J., 1997||"Pick A Card: Surveillance, Smart Identification and the Structure of Advanced Industrial States" paper presented at the 1997 Canadian Political Science Association Annual Meetings, St. John's, Newfoundland.|
|Bok, S. 1978.||Lying: Moral Choice in Public and Private Life. New York: Pantheon.|
|Bowles, P. 1978.||The Sheltering Sky. New York: Ecco Press.|
|Cavoukian, A. 1996.||The Theft of Identity. Office of Privacy Commissioner, Ontario, Canada.|
|Clarke, R. 1988.||Information Technology and Dataveillance. Communications of the ACM 31: 29-45.|
|Davies, S. 1995.||A Case of Mistaken Identity: An International Study of Identity Cards. Toronto: Information and Privacy Commissioner of Ontario.|
|Ferrell, J. 1996.||Crimes of Style: Urban Graffiti and the Politics of Criminality. Crimes of Style: Boston: Northeastern Univ. Press.|
|Foucault, M. 1977.||Discipline and Punish: The Birth of the Prison. New York: Vintage.|
|Gandy, O. 1993.||The Panoptic Sort. Colorado: Westview Press.|
|Goffman, E. 1961.||--Asylums: Essays on the Social Situation of the Mental Patient. New York: Anchor.|
|--1963 Stigma: Notes on the Management of Spoiled Identity. Englewood Cliffs, N.J.: Prentice Hall.|
|Karp, D. 1973.||Hiding in Pornographic Bookstores, Urban Life and Culture Jan.|
|Latane, B. And Darley, J. 1970.||The Unresponsive Bystander: Why Doesn't He Help? New York: Appleton-Century-Crofts.|
|Laudon, K. 1986.||The Dossier Society: Value Choices in the Design of National Information Systems. New York: Columbia University Press.|
|Lindsey, R. 1985.||The Falcon and the Snowman|
|Lyon, D. 1994.||--The Electronic Eye The Rise of Surveillance Society. Cambridge, England: Polity Press.|
|--and E. Zureik, (eds.) 1996. Computers, Surveillance and Privacy. Minneapolis: Univ. of Minn. Press.|
|Marx, G. 1988.||--Undercover: Police Surveillance in America. Berkeley, Ca.: Univ. of California Press.|
|--1990. Fraudulent Identification and Biography in D. Altheide, et al editor. New Directions in the Study of Law and Social Control. New York: Plenum.|
|--1994 New Telecommunication Technologies Require New Manners, Telecommunications Policy Vol. 18.|
|--1998. An Ethics for the New Surveillance. The Information Society vol. 14, no. 3|
|National Academy of Sciences. 1995.||Private Lifes and Public Policies Confidentiality and Access to Information in a Free Society. Washington D.C. National Academy of Sciences Report.|
|Nissenbaum, H. 1997.||Toward An Approach to Privacy in Public: Challenges of Information Technology. Ethics and Behavior vol. 7, no. 3.|
|Rule, J. 1973.||Private Lives, Public Surveillance. London: Allen-Lane.|
|Simmel, G. 1964.||The Sociology of Georg Simmel. Ed. K. Wolff, New York: Free Press.|
|Smith, R.E. 1996||John Marshall, Definer of a Nation. New York: H. Holt.|
|Virnoche, M. 1997||"When a Stranger Calls: Strange Making Technologies and the Transformation of the Stranger," paper delivered at Pacific Sociological Association Meetings.|
|1. legal name|
|3. pseudonyms linked to name or location|
|4. pseudonyms that
are not linked to name or location
b. audience does not realize it's a pseudonym
|5. pattern knowledge|
|6. social categorization|
|7. symbols of eligibility/non-eligibility|
|1. to facilitate the flow of information|
|2. to obtain personal information for research|
|3. to encourage attention to the content of the message|
|4. to encourage reporting, information seeking and self-help|
|5. to obtain a resource or encourage action involving illegality|
|6. to protect donors or those taking controversial but socially useful action|
|7. to protect strategic economic interests|
|8. to protect one's time, space and person|
|9. to aid judgements based on specified criteria|
|10.to protect reputation and assets|
|11.to avoid persecution|
|12.to enhance rituals, games, play and celebrations|
|13.to encourage experimentation and risk-taking|
|14.to protect personhood|
|3. dues paying and just deserts|
|4. organizational appetites|
|5. bureaucratic eligibility|
|6. interaction mediated by space and time|
|7. longitudinal research|
|8. health and consumer protection|
|9. currency of friendship and intimacy|
|10.social orientation to strangers|
|1. goals ---have the goals sought been clearly stated and weighed?|
|2. can science save us? ---can a strong empirical and logical case be made that a given policy regarding identifiability will in fact have the broad consequences its' advocates claim?|
|3. reversibility --if subsequent evidence suggests that undesirable consequences outweigh the desirable can the policy be easily reversed?|
|4. technical system strength --can the system (whether hardware, software or humanware) in fact deliver on the policy (that is guarantee anonymity or the authenticity of a communicator's identity)?|
|5. sanctioning and revelation --If anonymous or pseudo-anonymous users violate the rules are there clear standards and procedures for when they will be cut off and for when (and to whom) pseudo-anonymous identities will be revealed?|
|6. system tests --are there periodic efforts to test the system's vulnerability and effectiveness and to review the policy?|
|7. alternatives --if alternative solutions are available that would meet the same ends is this the least costly?|
|8. unintended consequences --has adequate consideration been given to likely/possible undesirable consequences?|
|9. third parties ---will innocent third parties not be hurt by the policy and if they will are there ways to mitigate the harm?|
|10. democratic party development --have participants played some role in the development of the policy?|
|11. informed consent --are participants fully appraised of the rules regarding identity knowledge under which the system operates? If they don't like the rules can they find other equivalent places to communicate?|
|12. golden rule --would the sender of the message be comfortable receiving a message in the same form if the context was reversed?|
|13. equality --is use of the form of identification equally available to all parties to the communication? Can the recipient respond in kind to the message sender?|
Top | Bibliography
| Home page
You are visitor number to this page since November 1, 1999.