In 2005 Kim Cameron warned us what would happen if we did nothing about identity.

We look at the problems and how to make his 7 laws of identity real and work for the mess we're now in.

Kim Cameron in 2025. Image courtesy of Doc Searls on Flickr
$9 Trillion
The global cost of fraud online in 2024 up 80% since 2019.
400k
Trafficked people forced to scam online in camps on the Thai - Myanmar border.
17.4 Billion
User records exposed by hackers in the first 6 months of 2025 alone.

" The Internet was built without a way to know who and what you are connecting to. This limits what we can do with it and exposes us to growing dangers. If we do nothing, we will face rapidly proliferating episodes of theft and deception which will cumulatively erode public trust in the Internet. "

Kim Cameron
Architect of Identity, Microsoft Corporation
The Internet isn't a Vault

The Internet isn't a Vault

Why is it seemingly so easy to industrialise fraud and identity crime? The problem is incredibly complex and has its roots back as far as the 18th Century. Decisions taken over decades in good faith have layered one upon the other to create the mother of all unintended consequences.

Read more
Two Decades of Neglecting the Digital Identity Crisis

Two Decades of Neglecting the Digital Identity Crisis

Kim Cameron's work was foundational, but a lot has happened in the intervening 20 years. Now not only do we need to implement his rules, we have to solve the problems caused by doing nothing for twenty years.

Read more
The Future of Trust

The Future of Trust

In his paper, Kim Cameron called for an identity layer for the internet. Self has spent six years researching and developing a solution to that challenge. Here, we look at what that is.

Read more

Blog

Secure in Name Only
Secure in Name Only
Exploring how metaphors like “vaults,” “keys,” and “wallets” shape our sense of safety—and the risks that confidence creates.
Are we getting closer to a true identity layer?
Are we getting closer to a true identity layer?
Initiatives like W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) are moving us toward an identity layer
The internet was built for machines not people
The internet was built for machines not people
The internet has no built-in identity layer — it only knows devices and keys, not people. Everything we call “online identity” is an application-level patch, and that’s why the web’s trust and security problems are so persistent.‍