The Future of Digital IDs in Financial Services and Beyond (at Secure the Village)

Good morning, everyone. Welcome to the Friday, November 20th Financial Services Cybersecurity Roundtable meeting of Secure the Village. Today we are going to be hearing about identity and authentication, both issues and technology solutions that can be very helpful for financial services. Our speaker today is Aidan McCarty from UnumID, and I think it's going to be very interesting. Just to provide an overview, we are a group that is comprised of folks from the financial services industry and industry and interested parties law enforcement, regulators, and others. And really anybody is welcome to attend. I'm John Coleman. I've been in banking a long time and my fellow coordinator of the meeting is Josh Peplo from American Business Bank. You want to say hi?

Hi, Josh.

Hello, everyone. Great. And so I'm going to turn it over to Stan Stahl. Of course, Stan is the founder of Secure the Village. He's going to talk a little bit about Secure the Village and some of the things that are going on within the organization and other events that we have coming up. Stan?

Super, thanks John. Yeah, it's a pleasure. Welcome everybody this morning, Friday, November 20th, the Friday before Thanksgiving. So yes, we're Secure the Village. We are a community-based response to the cybercrime and privacy crisis. The idea of turning people and organizations into what we call cyber guardians, literally from the boardroom to the living room when you look at the challenges that we face if we want a cybersecure global village. We're a 501(c)(3), and we're extremely grateful to the CPA firm Miller Kaplan. They're our platinum sponsor, and it's their support that makes not only this event but all of our work to secure the— as I said, secure the global village, make all that a reality. You've just heard from John and Josh real briefly, and they'll be back. And Josh, we do need to get a photo of you on this, so please, at some point when you get a moment, send one over. We'll drop it in. As John said, we're going to hear from Liam in a little bit. I'll turn it back over to you, John, before we do that. But Uh, just before we, we do that, uh, we, we host a whole lot of different webinars. Uh, there's one every month that's devoted just to the general subject of information security, uh, management. And, uh, that one, our next meeting, uh, says December 10th, and my guest is going to be Scott Parangelo. I host that, that meeting. I'm actually speaking at the Insurance Brokers Cybersecurity Roundtable That's going to be on December 15th, and I'm going to be talking to insurance brokers about what their clients, what their customers need to know about information security management. We're going to go over the NIST Cybersecurity Framework and related stuff so that basically the owners of companies who are looking at cyber insurance can get a better understanding of what it is to manage cybersecurity so that even though they have the insurance as a backstop, they never want to use it. And John, you're going to host again December 18th is our next financial services roundtable. So with that, who we are, some of the things we do besides these webinars, we have a newsletter, a news, you know, cybersecurity news of the week and weekend patch report that comes out every Sunday afternoon. And you can sign up for that. That's free, doesn't cost anything. And it's a compendium of about 25 news stories that I curate every week. Beyond that, you know, you can follow us on LinkedIn. You've got our newsletter. We've got online events very much like this one. We've got a whole set of educational resources on our website. A leadership council. John and Josh are both not only on the leadership council but actually on our board of directors. And we invite you, if you're in the space of cybersecurity, please join our leadership council. Literally, it takes the village to secure the village, and, and, and that's what we're about. We're soon to come out with our new website. This will be out pretty soon, next few weeks. I think we're going to go live, live with this. So, uh, Uh, let me with that, John, turn it back to you to introduce Liam, and then I'll finish up. I've got a couple of more slides to finish up with at the end.

Great.

Um, screen sharing.

Great. And, um, before introducing Liam, Josh, you want to just mention the speaker next month? So, uh, the speaker next month is going to be Ryan Tracy. He's a Deputy DA with the LA County District Attorney's Office, and he heads up, is one of the heads of the Cyber Crime Division investigating cyber crime against, you know, individuals and businesses. And he's going to give us kind of an outlook on what their office is seeing right now, hopefully a case study or two, and really give us what is facing LA area businesses and people as this threat continues to grow and grow and just does not seem to stop.

It's only getting worse.

So I think that'll be kind of a good update on, on what's happening in our area, not nationally, but just in the LA area. Great. And then looking forward to January and February, we're going to have speakers from banks who will be talking about online fraud and money laundering, and also a gentleman who is the Chief Information Security Officer from Fremont Bank. He will be talking about just information security issues that not only— they're not unique to banks, they certainly apply to other businesses, but bankers will be able to relate to them.

Okay, great.

So once again, our speaker today is Aidan McCarty.

He—

unfortunately, his brother isn't here. The two of them have been the guys that have— you're the founders of Unimind, correct, Liam?

That's right, yeah. We're almost indistinguishable. Yeah, look the same.

Yeah, we almost wondered if you were twins when we first met. But anyway, um, take it away. I'll just let you, um, pick it up and And run.

Sounds great. Well, it's great to be here. This is going to be a freewheeling talk about digital identity, which is a topic that I think is absolutely fascinating and is going to be one of the biggest transitions in the next decade or two in terms of technology. At least that's our view. We think that this is going to transform a lot of industries. The challenge of establishing real identity online is surprisingly difficult. And if you can achieve it, it opens up many new opportunities that today haven't really been possible. So I have some slides here, so I'm going to go ahead and share my screen. Okay, so I think everyone can see this. Okay, so, you know, the name of our company is UnumID, and that sort of encapsulates what it is that we're trying to do here. This is not so much about exactly what we're doing, though I'll include a lot of that as I go. This is just about the topic of identity broadly and a lot of the things that we think about in the big picture terms of where this could go in the next several years. So this image on the right is, of course, very provocative, and it captures where we think things are headed, which I'll get to very shortly. So I think, you know, in one of the slides you saw that I have a physics background, so I'm going to use some examples from science to motivate some of this. Necessity is the mother of invention is one of these age-old aphorisms that I think is certainly very true. One of my favorite examples of this is the standardization of time. So for most of human history, there was absolutely no reason to standardize clocks from one place to the next, because if you were walking from one town to the next, or if you were riding on horseback, it didn't really matter if one town was 2.5 hours ahead of the other town. If they had idiosyncratic ways of recording time. As soon as you had railroads, though, that people could ride on to go to meetings and spend half a day in a different place, it became essential to standardize time. And in fact, it was the railroads themselves who did this. So Greenwich Mean Time was the creation of the Railway Clearing House in the 1840s. And this is what led to our modern notion of clocks and time zones and all of this that today seems so obviously necessary. but that for most of human history was not at all necessary. And this is, of course, the history of technology in so many ways. A couple other examples that are still rooted in science but moving closer to digital identity: the internet itself was born out of a need to share scientific research. So this was ARPANET, developed by DARPA, and this is the origin of TCP/IP and similar protocols that allowed computers to talk to each other, which again today seems like an obvious thing you'd want to do, but for the first several decades of work in this area, it wasn't really clear that that would become such an important use for computing. And then of course, Tim Berners-Lee and the World Wide Web. This was born out of his frustration that he couldn't access content distributed across multiple computers very easily. And so he proposed the World Wide Web in '89 as a way of doing that. And this was at CERN, which today is the biggest physics experiment in the world. I wanna make the claim that identity is in very much the same category. So this is not obvious. If you look up identity document on Wikipedia, as one example, there's this really quite amusing paragraph in the history section that, you know, the first passport was in 1414. And then for the next 500 years, most people did not have or need an identity document, which again, today is sort of hard to imagine because we all carry around driver's licenses and passports and so on. Everywhere we go. But if you think about it in the broader scheme of things, anthropologists tell us that human beings can only know 150 other people. If you're in a small group, a socially cohesive unit, there's no need for a paper document issued by some authority to show you that you're actually who you say you are. There's just simply no use for that. And that was true for most of human history. But in the modern world, we have a very different situation, which I'm calling a web of avatars. So in many talks about digital identity, you'll see this fantastic cartoon from The New Yorker. On the internet, no one knows you're a dog. Of course, they don't know if you're a cybercriminal either, which is part of the problem. But, you know, the reality is that dogs didn't evolve for the internet and neither did people. And so we face this dramatically different situation in the online world than we human beings were developed for. In '89, again, Berners-Lee proposed the World Wide Web. He published the first website in '91. By 2000, there were already 17 million websites. Last year, there were 100 times as many, and now 58% of the global population is using the World Wide Web. The level of exponential growth here is pretty staggering. Interestingly, more than half of the time that people spend online is interacting with other people just in the most basic sense. You write emails. On social media. And of course, now digital banking and other activities are largely interacting with other people, and you're trying to, to move things around. And yet, in the U.S., as one example, there are on average 130 accounts registered to even just one email address. And I, of course, as probably many of you do too, have more than one email. And so you have several hundred accounts that some way loosely correspond to you as a person. And yet it's very difficult to establish that robustly. As one example of this, Facebook, always a good example for problems in technology, removed 2.2 billion fake accounts in the first quarter of last year. It only has 2.4 billion active users. One way to see how easy it is to make fake Facebook accounts is to just look at the price. If you look this up, they cost about 5 cents each. Which shows you how difficult it is to prevent fraudulent accounts. And this is on a social network that at least claims to have pretty strict real identity policies as compared to many of its competitors. And so the challenge here is massive. And a lot of the effort, especially in regulated industries like financial services, goes into establishing real identity. So we'll get into things like know your customer, KYC, later on, but that's just one specific example of this much bigger problem of how do you know who you're interacting with on the internet. And I want to keep us at 10,000 feet for a little longer and ask, well, why is this? And I'm going to call this a scarcity of scarcity and highlight a difference between digital assets and offline physical assets. Digital assets have near limitless abundance. So if you create an online account or an email or a profile, you can create billions of copies of that account, essentially instantly, for essentially no cost. There's this just limitless abundance of digital assets in general, which of course makes it outside of the scope of traditional markets, because there's no price, there's no lever for control here, and traditional regulation. This is a problem when it comes to identity, because how do you establish this massive number of accounts when there's only one person in the real world? We see this as fundamentally a difference between atoms and bits in the most abstract sense. So going back to this idea that for most of human history, you didn't need this notion of identity at all. One reason for that is that offline identity, so to speak, with real people is trivial. There's only one you. You're not going to be cloned. You have these built-in private keys, so to speak, in the form of biometrics and behaviors. And you are your own wallet. You carry that around everywhere you go. And so you don't even think about identity most of the time, because if I know you as a person and I see you in a room, I know it's you. I don't really have to wonder too much. The online world, as I've been emphasizing, is just so different. It's, it's radically different. There's so many versions of who you are, all these siloed accounts with contradictory information that has some fragment of you, that has some loose correlation to you as a real person. And things like private keys, literal private keys, are these messy bits of code that people can't carry around easily. You need some sort of external wallet, like a hardware key, to carry this around. It's just extremely difficult. Interestingly enough, as a bit of an aside here, this is a similar problem in other emerging technologies. So I make this comparison sometimes between online identity and online money. In online money, you have the exact same problem. How do you prevent duplicate tokens? When you're faced with this world of abundance, you have to create scarcity somehow to create online money. And that's what Bitcoin was invented to solve. Online identity is a similar thing where you're trying to prevent cloning duplicate identities. And it's even more difficult because you ultimately have to prevent cloning online and then relate that back to a person in the real world. This is what we are building Moonam ID to do. This is why we think that this is such an interesting area of technology, because it's a very hard problem. If you can help solve it, you make a big leap forward in terms of what is possible in online services. Financial services is one of the best examples, because the need for real identity is so, so high, both because of regulations and just because of business needs and the incentives around attacks. So now I'll take us away from the very big picture view to some specific examples and a term that I'm sure everyone here is very, very familiar with— authentication. Ugh. Authentication today is a complete mess. I'm sure all of us have gone through every one of these flows. You have authenticator apps with these codes that change every 10 seconds. You have SMS 2-step authentication where you receive a code by text. You have CAPTCHAs and knowledge-based authentication and secret backup phrases and all these things. And the reality is that none of these work that well. All of them have known problems. NIST recommends against many of them. And they're frankly just extremely inconvenient. And again, it's somewhat of a mystery as a normal person. You know, when I ask people who don't work in this space about this, I think everyone's somewhat baffled as to why this is so necessary. And again, it's going back to this idea that in the normal real world, you don't think about identity. Why is it so hard on the internet? And why are all of these methods that are being used all over the place really not very effective? One way to think about why that is is to think about attacks. So this is, you know, cybersecurity forum. Let's look at this from a security perspective. A fun way to look at this is that the attacks are moving up the stack to the most vulnerable part in my opinion, which is people. You know, more older attacks largely focused on the infrastructure, the technology itself, and not to say that that's not happening now, but so many attacks these days are focusing on tricking human beings into doing things they shouldn't do. So I just for fun Googled banking technology stack, and this is one of the first pictures that came up. And this company in particular has this interesting way of portraying it as, there's this planet with this core and this magma and the crust of all these different pieces of the tech stack. But I think they're missing the most important part, which is the people living on the surface of the planet, because those— that's the part of the stack that is most vulnerable to fraud in many ways. So I'll, I'll address two specific examples of that that I'm sure everyone is very familiar with. One is SIM swapping, the other is phishing. These are both examples of what you might call behavioral fraud or social engineering attacks. Again, focusing on people as the weakest link. So in the case of SIM swapping, most financial services today are still relying on things like one-time passwords sent over SMS. My own bank is doing this, so I, I go through this flow all the time. The problem is that you're tying a user's identity to their phone number, not their physical phone. And you're relying on this third party, the telco, to do this. And a lot of the issues that you can very easily, through simple social engineering, beat this method of authentication. So if I'm an attacker, all I need to do is bribe an employee at the phone carrier to redirect the number, and now I can receive these one-time passcodes. I can break into users' accounts and so on. Phishing is somewhat similar in the sense that it's also aimed at tricking people. So you're creating a site that looks valid that actually isn't, and you're convincing people to hand over secrets like passwords and one-time passcodes and things like that. So both of these attacks are fundamentally relying on the idea that people are very easily fooled, and we have the, the power in these traditional authentication systems in the sense that we have the secrets. We're using things like passwords. And we're— we have these phone numbers that we're using to authenticate. If we have control over that and don't really understand what's going on, it's very easy for attackers to convince us to do things we shouldn't, like type in the password into a site that isn't actually the bank's website. So I'll come back a little bit later to some specific ways of preventing these sorts of attacks and behavioral fraud more broadly. But for now, I just want to highlight the problems that occur when people are the fundamental blocker between safety and, and attacks. And of course, data breaches are another version of this. So there are two problems here, and this is of course a club you don't want to join. The first problem is that identity verification today largely relies on collecting vast amounts of personal data. And so to know who I am, you're going to ask me for all kinds of information, a scan of my driver's license, my legal address, uh, you know, other accounts I may have, my date of birth, my Social Security number, all this data, and you're going to make me go through all these flows to prove that I really am who I say I am. There are one issue of that is that you have to store that data somewhere, and so you create these honeypots where attackers have all the reason in the world to, to want to hack into. And the other problem is that these databases are secured by the same relatively ineffective methods as everything else is. Most data breaches are caused by compromised credentials in one form or another. That's often things like stolen passwords or phishing employees to let them— to give an attacker access to databases that they should not be giving access to. And so these— there's this incentives problem fundamentally because you have both this huge increase in liability from all this personal data being stored in vulnerable places and the very authentication mechanisms that are meant to prevent problems in the first place are making those very databases vulnerable. And so a lot of the time, we describe this as you're sitting on a gold mine. When you talk to a financial service, and everyone knows this, but I think it's an interesting way of portraying it, It's not just money that is a valuable asset that financial services in particular have. It's verified user data. This is a goldmine in the sense that everyone wants it. Attackers clearly want it, given the data breaches that everyone's so aware of, but also legitimate organizations want it. Verified user data is very hard to come by. Verifying user identity is quite difficult to do. And so with any goldmine, you know, you obviously want to protect it from theft. But one of the things that we think will become more obvious in the next couple of years is that you should also be putting it to use. That right now, this is seen as a sunk cost to do know your customer verifications, for example. And seen differently, this is a huge asset that is currently largely unused. When a bank verifies my identity and goes through all of the inconvenience and cost of doing so, No other company can currently benefit from that, which is this huge inefficiency because everyone is starting from scratch trying to figure out, is this really Liam on the other side of the screen or is this someone else? And so one of the trends that we're seeing is emerging technologies are allowing companies like financial services to put these gold mines to use by allowing other organizations to leverage verified user data with full user consent, where it ultimately ties back to the same person in the offline world. So I want to take a brief detour before I get back to that particular development and talk about some things that I think anyone who's a little bit familiar with this has probably heard of. One of them is biometrics and artificial intelligence. This is a huge trend in the space of, for example, voice recognition. The idea being that if you call into your bank's call center, wouldn't it be great if You didn't have to answer all these questions and about where you live and your social security number, and you could just, based on the sound of your voice, authenticate to the bank. This is largely based in what you might call artificial intelligence. Usually it's some sort of machine learning approach that recognizes that this is your voice and not someone else's, creates a unique code based on that. There are some fundamental problems with that though, and I think the easiest way to see this is to take the biological metaphor a little further. All of these types of authentication are fundamentally arms races. And so if you do any research, even for 10 minutes on the internet about voice recognition, you'll see that the opposite side of the coin is voice synthesis, and that the machine learning methods that recognize voices are just as good at synthesizing voices. So from a few seconds, clip, you can generate audio that sounds extremely convincingly like my voice, and you can make it say whatever you want. And so you can very easily imagine where this is headed. An attacker, all they have to do is spam call me, get 3 seconds of audio from me, and now they can synthesize my voice and defeat these emerging authentication methods. And so fundamentally, all of these biometrics have this arms race problem of how do you stay constantly ahead of the game so that you're not losing to the attackers trying to defeat these methods. There's one subtlety though that I think often goes overlooked. Many biometrics are cloud-based evaluation. So meaning there's some sort of data collection, like with a voice recognition, it's the pattern of audio. With face recognition, it's some sort of visual input. That's then sent to a cloud backend and evaluated there. There's also a different approach which everyone's super familiar with, which is device-based evaluation. That's things like Face ID on your iPhone. These are fundamentally different from a security perspective because when it's all remote cloud-based evaluation, an attacker can spoof that from halfway around the world. There's no physical access required to the device. And so, you know, your pattern of facial recognition, if I'm able to spoof that data, I can from the other side of the planet, convince the cloud backend evaluating this, no matter how sophisticated the AI, that I am actually you and I can remotely access your account. That's different than device-based authentication because that's fundamentally evaluated locally on the phone. And so typically you require physical access to the device. There are still vulnerabilities. For example, someone could hold me at gunpoint and make me do Face ID to get into my iPhone, but they would have to actually be physically near me, which makes large-scale attacks much more difficult. So I just want to highlight that as an interesting subtlety to some of these biometric approaches, that when biometrics are evaluated on device, they can be a lot more powerful because they require this physical presence, not just data that can be spoofed from anywhere. So one approach you might take to trying to get out of this arms race dynamic is asymmetric cryptography, which is not a new thing. You know, everyone knows about this, especially people in security. But I include this rather hideous image on purpose because I looked up on Google Images again public key cryptography just to see what would, what would show up, and I got this mess of diagrams. And I think this shows that cryptographers and psychologists never seem to talk to each other. That's my main takeaway. Is that this is explaining a deep technology that you have to know a lot about to understand. This is so far away from an intuitive gist that a normal person could understand, so far away from usable technology. So the question is, how do you leverage the extreme power of this relatively simple cryptographic concept to provide better authentication that does not have these arms race problems and so on? But do it in a way that people don't have to do this. They don't have to read these diagrams and learn about public key cryptography, which is never going to happen. That's a major challenge. The biggest part of that challenge is what do you do with the private key? How do you store this securely? How do you make sure that a single person has their private keys in their control and can use them without resorting to a massive education program about public key cryptography? And what I want to convey to you is that we think that there's a huge infrastructural change that's going on that is starting to make this uniquely possible. What that looks like is mobile. Today, 5 billion people have a phone. That's 96% of American adults and 99% of adults below age 50. More Americans have a phone than have a driver's license. Which, you know, is part of why we're sort of portraying this as your phone can be your ID. But the reason phones are relevant is that if you think of it in terms of infrastructure, we are all carrying around in our pockets a device that can securely store private keys. There's a secure hardware element in that device that's isolated from the rest of the phone that generates key pairs that even the phone manufacturer themselves cannot access. This is a radical change in the world because it allows normal people to just have cryptographic primitives in their pocket that they can now use to do things without even understanding necessarily what's going on. Even 5 or 10 years ago, this would not have been possible. The iPhone was released in 2007. That's not very long ago. And it's taken not that long, but, you know, 13 years to get to the point where we have this kind of penetration in the market of people having phones. And even, you know, most of the most modern smartphones have this sort of built-in secure hardware elements. And that's what uniquely enables things like public key cryptography behind the scenes. And of course, there are some other trends that are making this more likely to happen. One is that younger digital native generations are entering the financial markets and every other market. As you can tell, I'm a relatively young person, and I can tell you our generation expects to be able to do everything online through our phones. The idea of going into a bank branch, the first thing anyone my age will ask is, why am I doing that? You know, why can't I just do it remotely unless there's something that I really have to be in person for? And so in-person banking is likely to be a thing of the past very soon. And of course, COVID-19 has just dramatically accelerated this because everyone has been forced to do things remotely. But fortunately, this is happening at a time when there's a giant infrastructural change that allows remote things to be done more securely than ever before. And so, you know, with our company in particular, the way we portray this is your phone will be your ID card. You can transform this thing in your pocket that you carry with you everywhere into a virtual ID card that has your identity data that you can cryptographically prove you have control over and do things like show that you've been KYC verified by your bank or show that you have, you know, at some point a valid government ID stored on your device or that you have a verified phone number. It could be anything at all. And so this is something that, you know, we're providing as a product that can be embedded in other people's apps, but the fundamental driving force of this is your phone can be your virtual ID card. This is a very natural concept. One is that identity looks like this today. There's all these paper documents. And everyone knows that this is not as good as it can be. In the modern world, we expect things to be able to be digital. And I fully expect that eventually, to go back to this provocative image at the beginning, we can replace this with a digital ID card. Whether it's UnumID or not is irrelevant. I think this is where things are headed. One of the reasons it's been harder than, say, replacing your credit card is that identity is not a binary. It's not, are you who you say you are, yes or no? It's, is this your valid address? Is this your bank account? Do you have a birth certificate from this state? And who says so, and with what confidence? So there's this giant collection of different things forms of identity data. And what I'm showing here is, is just some very small subset of the digital version of this. In the offline world, yeah, you have a health insurance card and a passport and a driver's license, but you don't have hundreds of them. In the online world, you have literally hundreds or thousands of these types of things. Every service you interact with has a notion of your identity. They have data about you that is unique to your account. And yet it's not in any way accessible to any other entity. And so the problem of consolidating all these, you know, 130 accounts per email in the US into one identity is very difficult to do, but you can imagine the power of doing that. It makes it possible for you to show who you are online and show anything about yourself with cryptographic proof behind it. And of course, this is a natural trend. You know, I use Apple Wallet these days. My credit card is on my phone in digital form. I just do Face ID and I pay for things at stores. Eventually, it'll probably not even be credit cards. It'll be some sort of digital currency, whether it's a cryptocurrency or a central bank version of that. So already the phone is starting to replace the wallet in that sense, the payment part of the wallet. We think that it will ultimately replace the identity part of the wallet as well, your government IDs, and of course, all of the other digital IDs that you have. So I want to now show a slide of terms, not so that you can read it, but so you can understand why this is hard to communicate. These two slides show a bunch of terms that we wrote out for someone we were talking to, to explain what all these pieces of jargon mean. And the issue is there are so many words in this space— authentication, authorization, credential, account. It's just a mess of terms. And it's very difficult to communicate what exactly the future of this looks like with these existing terms. So we actually invented our own, which I think captures where we think this is headed. It's Sharified identity or shared verified identity. The concept here is that again, if you consolidate all of these disparate sources of identity data on the internet and even offline data, you can have one identity, a one-to-one connection between a person in the offline world in the world of atoms, and an identity in the online world, the world of bits. If you can establish that one-to-one connection and consolidate all of each person's data on their device that they control, and then they can prove to other people they control, now you have something truly powerful. It's not to say that you can't have this one identity online correspond to many accounts. Of course you can. You can share different pieces of data with every account you interact with. But fundamentally, it can all resolve back to a single identity that is attached to a real person. So instead of a zillion fake Facebook accounts, you can have pseudonymous accounts that relate ultimately to a real person. And there can be audit trails of how these relate to better stop things like misinformation. And there's so many possibilities for this type of thing. And so not to make this too much of a sales pitch, but this really is, we think, the future of this, and it's in our, our logo, you know, this idea of linking together all these different parts of your online identity into one thing that you can then cryptographically prove you have control over. So, you know, I want to stress this notion of local aggregation because you might wonder, you know, is it really that important to have this, you know, combination of different pieces of identity data? Why not just continue this system that we have today where it's really one-off relationships. You know, I have an account with my bank, I have an account with, uh, you know, my mutual fund provider, I have an account with my social media site, and they're all sort of these independent things. But there are so many good reasons to, to explore how you can combine them, and I just want to call out a few on this slide. So what we're proposing here is imagine you have all these different types of identity verification, like a scan of your driver's license from company A and facial recognition from company B and on and on, all the different types of verifications that you could do. If you have a record of that on your device or you're provisioned by your device, you can then share different pieces of that with, you know, bank call center or with KYC data with some fintech company. You can pre-populate forms at a health clinic. The possibilities here are really quite endless, but the advantages to businesses are are huge. The verifications, for one thing, can be changed over time. So I talked before about this problem of the arms race in biometric checks as one example. This is not just a problem in the sense that it's dynamic, so you have to stay ahead of the curve. It's a problem because if you're the company consuming that verification, you have to figure out what to do when that voice recognition algorithm gets beaten. You don't want to have to form entirely new business relationships, new partnerships with different providers every single time that happens, because it's going to happen all the time. And so it's very useful to have this layer, this sort of aggregation layer, where you can easily swap in and out different types of verifications depending on the context and what you're trying to do, and depending on how robust these things are over time. The second motivation here is that you can combine verifications. So one way of seeing this is from the security perspective. So I often use, again, a biological metaphor here. There's this notion in biology of an antibiotic cocktail being better than any one antibiotic. As one famous example of this is with HIV, where the best approach is to combine many different antiviral drugs to treat HIV because the combination of them is so much better than any one of them will ever be. Identity is very similar. If you're trying to make make sure that this person is who you say they are, you want this combination of several independent checks. Today, that's very hard to do because if I sign up for a bank account, that bank starts from scratch. They know nothing about me. And so they have to walk me through this very arduous flow of, you know, 10 minutes to several days depending on the level of check where I enter all this information that I've already entered 100 times elsewhere. I verify it with their internal processes or third party that they're paying to do it. And they go from 0 to 100, or at least they try. Imagine how much better it would be if they could consume verifications that have already been done from all these other independent companies for a fraction of the cost with much higher confidence because there's this aggregation, this combination of different verifications. And the last reason to do this is that we live in a world now where privacy and security are essential. And I'll get into this a little bit more later, but This is data aggregation in a very specific sense. It's per user. So you can do this on a user's device or provisioned by their device so that they have control over their data. It's per person. It's not in these giant databases vulnerable to breaches. So this is sort of an approach that the more privacy and security regulations come out, the more attractive this is, the more likely this is to happen, just given even the regulatory environment. The simplest case of this, you know, I'll draw analogy now to big tech. Google and Facebook, as two examples, faced very similar dynamics that modern financial services and other regulated industries face today, where they have— they had these giant gold mines of verified personal data. You know, in their cases, it was largely things like verified emails and, you know, friend networks. They originally were just single websites, really. I mean, Google was a search engine, Facebook was a social network. Today they're much, much more than that. They are gateways to the internet because of Sign in with Google and Sign in with Facebook. And the way we view this is this was Google and Facebook using their gold mines of verified personal data to become essential way beyond their niches. So they were saying, okay, well, we're gonna offer to all these sites the ability to have instant account creation with just a verified email address because it's better for the user, it's really fast, very easy, and it's better for the site because they don't have to go through the email verification process or take the risk of not verifying the email and then have all these bot accounts. And that made Google and Facebook literal gateways. You know, you would never delete your Google account because you've used it to sign in to dozens of different websites. So that is sort of a root of who you are on the internet. And of course, financial services and regulated industries are like this, but to a much greater extent, because the value of the data is so high, the level of verification is so high. And so, you know, when we talk, for example, to small fintech companies, they would love to purchase a KYC verification that a bank already did about this user that wants to create an account. Because it means instant account opening for them and much higher verification than they can afford for a lower price. But today, this, this just isn't possible. So I'll get into a little bit later how we think that this can become possible. But the point is that this is a trend that big tech tapped into many years ago at this point, but that we think many other industries can leverage with this new technology. So I talked before about how this is a goldmine of verified personal data, and of course one thing you want to do is secure the goldmine. You want to prevent these credential-based attacks. You don't want stolen passwords being the reason that you end up on this chart of the world's biggest data breaches. And yet that's what keeps happening. Every single week there's another article about a giant company that had these problems. And so I'm going to just show you a very brief demo of one approach here that we're taking to try to do this. Again, it's not so much about this particular approach as it is about the broader trend of technologies that are making these sorts of things possible that we think are very exciting. So I'll move over to this screen. So this is a demo of just our little site here, Acme Inc. On the left is my phone screen. This is my actual phone. I'm just mirroring it here so you can see it. And I have the Acme app, and imagine this is a bank. So normally when I would go to the Acme website, I would need to sign in in the traditional way. So for my own bank, US Bank, what I do is I enter my username and password. I then get a one-time passcode sent by SMS. I type it in and I'm authenticated. This has known problems like SIM swapping, and yet this is the, the norm today. You would much rather have public key cryptography like I talked about before. The issue being, how on earth do you deal with the private key? With modern phones and modern apps, you can do it very easily, and it looks just like this. To sign in with multiple factors of authentication, all I have to do is scan this QR code and do Face ID in the app, and I'm instantly authenticated and logged in. This is, in fact, 3 factors of authentication in a fraction of a second with no shared secrets. Because what's really going on behind the scenes is in part that there's a private key stored in the secure hardware of my phone, and there's a cryptographic signature being generated and shared with the Acme Inc website so that it can check that it's really me. That's combined with biometrics, it's combined with existing account data. This is way more secure than things like SMS one-time passcodes, and it's also really easy. All all I have to do is scan the QR code and do Face ID. It's extremely simple. And this works in lots of other ways as well. You can get a push notification or SMS, which is the same basic process where I get a push, I do Face ID, and again, behind the scenes, there's all this cryptography going on that makes this possible. And one of the big benefits is that it also prevents other types of behavioral fraud. So phishing is one example. Phishing is not that hard because if you're my bank, an attacker can just look at your site and create a website that looks very similar and send me phishing emails that look like it's from my bank. And even for a user like myself that literally works in the space, sometimes I don't really know, like, what is this email from who I think it is? It's hard to say. And I spend a lot of time trying to make sure that it really is. In this case, the authentication is going both directions. And so phishing is just not a possibility. So to make that more concrete, this QR code is not just any QR code. It's cryptographically signed with the bank's private key. And so my app behind the scenes is checking that it really is from Acme Inc. So an attacker could create a site that looks convincing, but I, as the user who doesn't know any better, when I try to scan the code, nothing's going to happen. Because my app is going to check the signature and realize that it's not a valid code. Furthermore, there's nothing to share. There's no secret. There's no password. There's no passcode even. So I'm not sharing anything with this website that could be phished. So it fundamentally protects me against many of these forms of behavioral fraud and, in many ways, improves the user experience. So as we like to say, the sign-ins there are changing. We think that floppy disks are a thing of the past. Your kids don't know what these are. We think their kids won't know what username and password logins are. This is clearly an approach that has been hanging on for dear life for many decades at this point that we think is about ready to start changing. New technology like modern smartphones that can store private keys enable better forms of authentication that are frankly better for the user also. They don't have to remember these passwords and rely on that as their, main source of security. This is also a huge deal in preventing data breaches, because again, so many data breaches fundamentally result from stolen credentials from employees or phishing emails sent to employees to get them to hand over sensitive information. When they can't hand over things, you're fundamentally better protected. So now to go back to this idea of verified identity, you might ask, you know, okay, I can see why this is useful, Why would you want to do this? I can see that. But why has no one done it? This doesn't seem that surprising. And we see that there have been 3 core problems. And these are really significant problems that, again, technological and regulatory changes are making very different. So the first problem is coordination. This notion of allowing people to sort of have this identity on their device that they can share with all these other entities is a coordination problem. This is a marketplace. You need some sort of horizontally integrated provider. A single company can't do this. We actually know this from in-depth conversations with big banks, some of whom have tried to do something similar. We know of, I think, 3 or 4 at this point that tried to enable this sort of functionality, but without working with other companies. The problem they run into is that no company has enough coverage to completely service the market, because you have to work together. You have to have either a horizontally integrated provider or some kind of consortium that allows you to reach a wide enough market. You know, one bank has a lot of customers, but not enough to make this workable beyond their base. It's also just building those consortiums is hard. There's a lot of bureaucracy in these traditional models. It's just not what these banks are fundamentally doing as their main business. So it's orthogonal to what they're trying to do. The second issue is privacy. So a lot of traditional approaches to this, things like shared KYC, which has been a dream in financial services for a long time, traditional approaches largely revolve around sharing user data. Imagine if you could just connect databases from multiple banks together and they could all sort of benefit from the shared resource. The problem there is we live in a different world. GDPR, CCPA, similar regulations prohibit that. You can't just share user data from database to database anymore. And so these traditional models of doing things are not really that valid anymore. You need a different way. You have to somehow bake user consent into the process fundamentally to comply with this. So a lot of these dreams of sharing data have been shot down by the fact that the world is changing, and I think for good reason. There's a lot of problems with sharing user data like that. And then the last problem is security. So even if you were to share user data, how do you know that it corresponds to a person? You know, if my bank sends a KYC verification of me to a fintech company, how does that fintech company know that that's about me? How do they know that I'm the one on the other side of the screen and not an attacker who's impersonating me? I can go on to a site like Equifax as an infamous example. I can type in my information and I can get a ridiculous number of data points about who I am from their database, but so can an attacker. There's no notion of a connection between data in the online world and a person in the offline world. And so unless you can create that connection, there's no security because all you're doing is you're sort of getting information about an account without knowing the person that it corresponds to. And so, you know, this is what we're working on. I— to give you the big picture view of why we think this can change, there are now— there's a possibility to coordinate across all these different companies and even across different industries. We've seen a lot of appetite for this. The problem is that there needs to be a tech provider to do it because you need a fundamental platform play here. On the privacy front, this emerging technology makes possible architectures that just simply couldn't exist before. For example, the idea of storing each user's data locally on their device or in cloud backups that they control, that they provision through their device with private keys stored on that device. That's a radically different way of operating, but it, it removes much of the liability that exists in these traditional approaches. There's no need necessarily for a giant database of plaintext user data. There's no need to try to, you know, figure out how to add consent after the fact. User consent is just foundational to the whole thing. You can't share data without giving consent, without doing a biometric tied to your device. And on the security front, this emergence of critical infrastructure as we see it, smartphones that everyone establish this relationship between a person in the real world and their data in the online world. Because I have a phone in my pocket at all times, I can establish that relationship over time. And so a company can be very confident that I'm the same person that I was before when I created the account. And a separate company I share my data with can verify that it really is me. It's not someone impersonating me. So anyway, that's my talk. I think this, to me, is an emerging space of technology that is incredibly exciting. And if you just simply imagine what would be possible if you had something like this, one identity, that you could have all of your information in one place and share it with all these different entities, what business models become possible, what sort of online interactions become possible with that sort of dramatic shift in technology. So thank you very much for all of your time. Would love to answer any questions about this or just open the discussion.

Outstanding. Very, very interesting. And I'm going to jump right in with a couple of questions. So this concept of a sort of consortium or how could— financial institutions or any businesses that have a need for KYC share this, um, does that imply some sort of a central registry or a standards-based process for KYC that everybody can agree on? How would that work?

Yeah, so there's— I think there's two elements of that. One is where do you put the data And two is, how do you standardize the data? So where do you put the data? I think a lot of people think of this in terms of, so you're proposing PayPal for identity, where there's going to be basically a big database of everyone's information in one place. And you're going to have an account with this new provider that's now going to enable this. That's not what we think is most likely to happen. It's certainly not how we're approaching it. It could happen that way. I mean, it could be that there's a trusted provider that basically just has a giant database of all this identity information. Information that allows these interactions. But the problem with that is there's unbelievable amounts of liability with that approach, and you have to have extremely high trust. And so the only way that would work is if a company with existing relationships that many entities trust can essentially convince all these banks and other regulated industries to provide this data and put it into a database. And when we talk to big companies in financial services, as one example, they don't want to do that. You know, they don't want to hand over plaintext user data to some third party who may or may not be storing it securely. That just seems like a terrible idea to them. But the misconception is that that's the only way to do it. And what we see as so exciting is that because of this infrastructure change with smartphones, you don't have to do it that way. You can have the central storage involve no sensitive data whatsoever. So in our architecture, as one example, we never interact with plaintext user data at all. It's, you know, the only data we interact with is encrypted before we ever receive it. Users' data can be stored either on their own device or in a personal backup that they control. So there's literally no interaction with PII, even though we're providing this coordination service that allows multiple entities to share data. So, you know, that's kind of a subtle point, but we see it as fundamental to the value proposition here that you're not saying we're going to create an even bigger database, an even bigger honeypot that can be breached.

Interesting. And then also, how— so is this like fundamentally different or actually more similar to something like Apple Pay?

Apple Pay is an interesting example. It's not that similar. It sort of seems similar. But to give you a sort of a high-level view of Apple Pay, at least as I see it, Apple Pay basically takes a credit card. Like, you know, in my case, it's— I have a Visa card. You scan it into your phone. There's a backend process where they talk to the issuing bank. I think Visa is involved. And then the payment process is mitigated by the device biometric. So in that sense, it's similar. There's this device biometric process going on to make sure that it's really you holding your phone. And then there's some interesting things like aliasing the credit card number so that it's— you're not ever sharing this persistent credit card identifier. You're sharing this one-time use thing. The reason it's different is one, it's payment, so it's not identity per se. And two, it's sort of leveraging existing infrastructure. So it's a digital version of a credit card. I think the next phase will very likely be— I'm not sure on what timeline, but will very likely be eliminating credit cards altogether or some sort of new version of that. With digital currencies, you don't need the same type of infrastructure that you would with a credit card. So it would make more sense if you could start from scratch to just say Apple Wallet, Apple Pay, is not like this credit card on your phone. It's just a wallet for currency that you store and you can use in stores and online.

Well, I'll tell you, this is— it's interesting because, you know, this is going back to earlier in your presentation when you were talking about, you know, the adoption of smartphone technology and whatnot. The interesting thing is that unlike a lot of technologies, The penetration into third world countries and with poor people is actually really, really good because they didn't have the physical infrastructure of telecommunications and all that. So they were very quick to adopt wireless and smartphones as their primary means of communication. So the TAM, or total addressable market, as you say, is really, really interesting both up and down economically and geographically.

Exactly. I think it's— no one could have predicted this, I think. Maybe Steve Jobs, but I doubt it. I mean, I think the idea that 13 years on from introducing the first smartphone, this many people have a smartphone. I mean, it's incomprehensible. I mean, the amount of time people spend on their phones, it's unbelievable. I don't go anywhere without my phone. But that's part of the point is because I don't go anywhere without my phone, I'm just frustrated that I can't use it as my form of identification. It would be so much better. It would be more secure, easier to use. It makes all the sense in the world. It's a big lift to get there. So I think the phone itself is just the infrastructure. There's so much else to do. But I think in terms of, as a startup, founder, you look for big waves of technology. You want to see this kind of inevitability. You think this will happen. And personally, I think this is in that category, where it's hard to imagine something like this not occurring. Whether we'll be part of that, who knows. Whether it will take the form I'm describing exactly, I don't know. But the idea that there's so many phones out there that everyone has with them all the time, it just makes all the sense in the world to make it an ID card.

So last question, um, uh, and you pronounce it Unum, Aidan, not Unum?

Unum, yeah.

Unum, yeah. Uh, so you guys are pre-IPO, correct?

Yeah, no, we're, we're an early stage startup. We're a small team. Uh, we started this 2 to 3 years ago depending on where you count. Um, so we're, we're early stage. We're just starting to get into our first pilots and that kind of thing. So yeah, it's very early days with this tech. Very exciting.

And do you see adoption in a— do you have a lot of interested people and have any of the major institutions decided to do pilots with you? Or can you discuss that?

Yeah, no, we have tons of interest. Franklin Templeton just became an investor, so they're super interested. They want to do a pilot. Lots and lots of big companies, I think, have been interested in this space for a while. One of the interesting trends we've noticed is when we were talking about this, say, a year ago, it was on people's radar. People were thinking about it, but it wasn't top priority. COVID-19 has changed that dramatically. People see this as essential now because part of it's just you're being forced to do so many things virtually. The level of behavioral fraud that's happened as a result of remote work and remote access to bank accounts from the consumer side, it's just staggering. And everyone's trying to figure out how do you stop this? How do you make the account onboarding flow easier? All these things. And I think the pandemic has really highlighted both the need for it and the opportunity. Like, hey, if we get out front on this, we can have a piece of this giant trend in the world. So the interest level has really skyrocketed in the last even just 6 months.

Yeah, interesting. And I just, you know, we consciously with the Financial Services Cybersecurity Roundtable sort of strive to not, you know, look like a, you know, that we're having vendors come in to pitch their products. In your case, this was fascinating because it was, you know, Authentication is huge, obviously, in financial services. This is, you know, an intriguing new paradigm and whatnot. So for us, the subject matter was really on the money, and the fact that, you know, you happen to be also a company offering a product was no problem at all. So we were really happy to hear about both, you know, concept and the product. So I just want to—

Yeah, well, I appreciate that. I mean, I, you know, it's not— I could talk about this all day. You know, we find this fascinating. You know, I mentioned things that we're doing along the way because it's what I think about all the time, but it's not meant to be a sales pitch, really. This is— I think it's so exciting. I see this as an incredibly interesting space of technology. It's going to change a lot. I really believe it will. And so I enjoy talking about it, and I really appreciate you having me on.

Absolutely. Stan or Josh, anything?

Yeah, I'm happy to jump in. First of all, Liam, again, thank you for speaking because I found what you're talking about both fascinating, both at a philosophical level, if you will, but also down at ground level. Philosophically, this whole idea, your metaphor of a small town, where everybody knows everybody, and therefore authentication, if you will, is obvious. I walk into a store, you know, I've lived in that small town all my life, the storekeeper knows who I am. It's like easy. The storekeeper doesn't have to take a picture of me, send it off to some centralized authority and say, hey, is this Stan? Get an answer back and says, yes, it is. Good, now they can interact. I mean, it's just, it's That's not how it works. So I find that very, very fascinating. The other thing that you said, the distributed versus centralized identity management, I think one of the things we're learning with disinformation and fake news and all of that, the fake Facebook sites that you illustrated, centralized identity management is dangerous. Philosophically, democratically, if you will. It's dangerous. So having it distributed, you're not putting all the keys to the kingdom, if you will, into one centralized place. And then to me, that's absolutely vital. But now a question down at ground level, if you will. So let's say I'm using UnumID And I've, on the one side, I use it to tell my bank who I am. And I do that with one email address that I use for my banking and things like that. And then I go off to my, let's say, my gambling website. And now I've got a user ID that's very different. It's a one-time, it's an email account that I never use for anything but these nefarious things that I do online, uh, what's to prevent the gambling website to get information about my banking information? Because it's all living inside my iPhone, my smartphone, and when I make available what I do to my gambling website, how do I limit that? How do I, how do I make sure I control that, not the not the gambling site.

Yeah, it's a fantastic question. This is— a lot of times in the community, people talk about this in terms of correlation. How do you prevent indirect knowledge of some other part of your activity or your identity from a source that you don't want it to be known from? So one approach is this aliasing that is becoming very common, things with Apple Pay and now Sign in with Apple. Creates an alias of your email that forwards to your email. It's not your actual email. So things like that are relatively simple but can do a lot. There's an equivalent of that in this space where you can call them— the technical jargon is pairwise unique, but the idea is that you're sharing not just this persistent identifier, but a one-time use unique identifier, which with each service that you're interacting with. And so, you know, we often talk about one identity, UNUMID, which is where it routes to, but it doesn't mean that you have to share the same persistent identifier with every relationship you have. So in your example, you wouldn't share any common information between those two sites. The fundamental goal for the site is really just to know that you're not a bot, to know what they need to know about you. And so you can provision access to that very precisely so that you don't have this problem of they can sort of indirectly figure out what's going on. I think that's a really important thing to stress, because it's not to say— it's one of the most common examples, Social Security numbers. What a disaster that we use these as identifiers. A lot of the problem is that they're persistent. You can't get a new one. I think technically you can, but it's a complete nightmare. We don't want to create a digital version of that, because it would be even worse. The point of this is, is to very explicitly avoid that, to your point.

Yeah, so what's that look like in— so I'm now engaging with this gambling website, let's say, so I'm going to use this. What do I have to do at the backend on the smartphone so that when I go to the gambling site, it gets this information A, B, and C? When I go to my banking website, it gets information F, G, H, and I? How's, how's that managed?

Yeah, so I'll give you two intuitive ways of thinking about this that I think will get the gist across. Uh, one is that, you know, we're talking about everything in terms of key pairs, like private keys and public keys. This is a huge, a much better approach if you can do it. If you have a smartphone, you can, because you can securely store these private keys, you know, use them for various things without exposing them. But it doesn't mean you have to have one key pair that you use for everything. So, you know, one way to think of it is you have unique key pairs for every relationship. So that, that itself should not reveal anything about a relationship you have with other services. The other part of it is, you know, controlling which data you're sharing. This is already in existence in many familiar forms. So when you do log in with Facebook, as one example, you can check and uncheck, you know, I don't want to share my friends list. It's pretty primitive. You know, it's not very elaborate at this point. But you can certainly have that kind of coarse-grained control over what you share. And in this model, you can do very similar things. Another level of that is, you know, longer-term service that we want to try to provide is helping people do that, right? Like understanding this site is asking for a lot, you know, let's put some friction into the user flow so that they don't just accidentally share over like all their information, right? That's very important in a digital context because it's so easy to do. So I think there's always this balance between friction and usability, and sometimes friction is useful. So I think part of it is that, and in a broader sense, there's also a security element, which is if you're going to share really sensitive stuff, you should go through additional checks, additional authentication checks, right? So we've talked to government, for example, people are very interested in using this kind of thing for security clearances, like really high-level stuff. And in that case, you would want to do more than Face ID, right? You want to do additional checks so that if you're going to share this very sensitive data, you can be more sure that it's really you and that you really choose to share that.

Yeah, yeah, that's good. And it actually leads me to my last question. So when I, I started in the field 40 years ago looking at, okay, What are the weaknesses in a security solution? I'm a mathematician by training, so it's kind of, you know, logically find weaknesses. So what happens, for example, if someone hacks the phone? You get a phishing attack, let's say you click the link, whatever, and now your phone gets taken over. You're authenticated to the phone, so the phone's live, so to speak. But then you've got this agent acting unbeknownst to you on your behalf, now going off and stealing information and so on. And that more generally, where do you see— and you may not know the answer to this yet, I mean, it may not have surfaced in the research— but where do you see the potential weaknesses in this solution, or knowing that, quote, there are no silver bullets?

No, there certainly aren't. And, you know, we try to be very, like, explicit about what we see as the weaknesses. I am really glad you asked this. As one example, I mentioned in the talk, if you held me at gunpoint, yeah, I can't stop you there, right? Like, that's— you're gonna get me. And the, you know, so it's not to say that there aren't weaknesses. That's a very obvious one. The advantage of that one is you can't do that at scale. So you're not gonna hold a million people at gunpoint. And so part of the approach here is to say, what we wanna do is make it way harder to do remote attacks at scale, 'cause that's really the problem. These one-off attacks are not good, but they're much, much less of a problem. In terms of why the phones are this infrastructure change that make this better, a lot of it is that this secure hardware is isolated from the rest of the phone. This is really important subtle detail that, you know, you have these secure hardware elements that even Apple, who made my phone, when I create a key pair in that secure hardware element, they can't access the private key. Yeah, an app can create signatures using the private key, but they never access it. And so it's isolated from the rest of the device. It's only very loosely tied to the OS. And so it would take basically a zero-day vulnerability to expose that in any sort of remote way. So even if someone had access to my device, they need physical access to do things like access the secure hardware, because fundamentally that's going back through the device biometrics, which are properly understood as a kind of convenient alias for your passcode. So that's why if Face ID fails, you ultimately fall back to your passcode. And so, you know, they'd also have to know that. They'd have to have a way way to remotely create that. So there are vulnerabilities in the sense that if there's some fundamental issue in all of the hardware and software, you can't get around that. But it's vastly more difficult for an attacker to breach that than these traditional systems, where it's like, they use their passwords on this other site, so we'll harvest that and type it in.

Super. Thanks, Liam. John, you want to—

I was just going to say, on a fundamental level, kind of going back to Stan's original question, it really, really makes important, you know, some of the more basic security features that you have around your phone, such as, you know, a locking screensaver, you know, so that if you do lay your phone down or whatever, you know, somebody can't just come along and pick it up. Yeah, Face ID is the best solution, but so many people rely on a, you know, 4-digit code that's somebody's birthday, and, and that's just not really a good idea. So that's kind of where some of the work that we do in Secure the Village on a very basic level is to try to keep repeating those messages that basic security processes are really, really important, just at the individual level, you know, starting very early in life and all the way through to, you know, older folks that might be picking up a smartphone for the first time, that sort of thing.

Yeah, it's such a good point. I mean, the education part I think is essential. And I think in some ways, when I look back through the history of a lot of this stuff, there has been this massive public education on many topics indirectly. And I think that's starting to happen with some of the security stuff where people are used to the fact that they unlock their phone with a biometric. This is a pretty dramatic shift in the world. I mean, if you had said 20 years ago that that's what you're going to do every day, hundreds of times, I don't think anyone would have understood what you even meant. I think one of our hopes is that as these things become more available and the security controls are proper, in the sense that you can't— if you have an app using this type of technology, it locks after a few seconds. It doesn't allow you to simply leave it out and have someone take it. That there are additional checks beyond just things like Face ID, which is like the most minimal version you could have, that that'll start to sort of educate people indirectly, even if they have no understanding of the low-level details, which they shouldn't have to, that it will make people a little bit more aware, or at least sort of force them to act in more secure ways. But I, I couldn't agree more. This education is so crucial. One of the things I love about Secure the Village as a— even just a term, but certainly on the website as well, is this focus on the human elements. Like, I think sometimes security gets too technical, and not all security problems are technical. A lot of them are human problems. Like, how do you get people to understand the basics and to think of it as a community effort to secure systems? And I really love that emphasis because I think it's often overlooked and very, very important.

Yeah, yeah, definitely. Yeah, thanks for, thanks for that shout out, if you will. You're absolutely right. I mean, this is the whole from our perspective, from the boardroom to the living room. I mean, everybody's got a role to play here. And as you were talking, the image that I was having was, well, back it up 100, 110 years ago when the automobile was first coming out. Nobody knew how to drive these things, but we kind of learned. And you had to get out in the front and crank the engine to get it started, and, you know, things like that. And now, yeah, we have to learn to drive. It's not an automatic thing. I mean, I did when I was 15, 16 years old, you know, took driver training and, you know, went out on the road and avoided killing myself and any others. So here we are. But into, you know, but it's automatic now. I mean, you just, you learn to drive. You don't need to know what's under the hood. To drive successfully. I mean, yes, you need to know how to read the gauges, you know, do I have enough tire air in my tires and, you know, things like that. But, you know, you don't need to know how an internal combustion engine works or how a battery works or how a motor works or anything. You just drive. And ultimately, we have to get to the same place with our technology where all the kinds of things you're talking about, this identity, who are we, It's just we take it for granted because it's there. It's just like we take for granted if I turn on the water faucet, water comes out. If I flip the light switch, the lights go on. And if I pick up my phone, I'm authenticated. It's duh, simple like that. That seems— that's the future. And we're moving into that.

I think it's the perfect analogy because there's the two components of that is One, you had to get your license. So there's an education component that's fundamental. And I think, you know, in the same sense, if you're a government employee with top secret clearance, like, you know, you should, you should learn about it. You should get some sort of education process, you know, not for everyday use necessarily, but I, you know, that's a key piece. And then the other thing that I think is just so fundamental, and I think about all the time, is abstraction. You know, a lot of the time, uh, You know, I admire the community of people sort of working on this stuff. Unfortunately, a lot of times it gets so technical. I think people forget it's not about the technical details from a user perspective. Like, you want to hide as much as possible. The car is this just magnificent example where you have this incredibly complicated machine and there's 3 degrees of freedom. I push the accelerator, I push the brake, and I turn the wheel. That's all I have to do. That's an amazing accomplishment in user experience. I'm sure they didn't use the term at the time. And I think the same is true with security stuff where you want to make it as abstracted away as possible so that people can safely operate this, you know, very complicated machine of modern cryptography and a very powerful machine without killing themselves or killing others, like you said.

Yeah. Yeah.

Great. Well, that's a great session here. Thank you so much, Liam. Terrific. Interesting presentation, and we'll be watching for great things to come with UnumID, and we'll have you back in the future at some point, hopefully, to talk a little bit more. Stan, do you have anything that you want to say?

Yeah, let me, let me just take it on, you know, kind of take it home, uh, go back to sharing my screen. Uh, again, who we are What you see there is Steve Kranz's book. When I talk about from the boardroom to the living room, Steve's our living room guy. He's written the book Cyber Guardian: A Secure the Village Guide for Residents. I just want to encourage everybody to follow us, join us, join with us. We're all about, as I said, how do we, you know, we want our vision is a cyber secure global village, and it takes a village to secure the village. That way. So kind of that, that's who we are. Um, want to just, you know, remind you again, we're coming out with a new website. I'm so excited. I've begun working the last couple of weeks now that the design is finished. It's up in, uh, kind of near production mode. We're filling it in, we're, uh, putting— getting the resources linked into it and things like that. So, uh, it should be live real soon. I'm excited by that. The other thing, totally separate from cybersecurity, if you will, is the security of who we are as a people. And I've got a book on Amazon called The Agnostic Patriot: A Citizen Searches for the Soul of America. It's a series of essays that I wrote beginning the Thanksgiving after 9/11 and extending out through the last July 4th Independence Day. And I call it The Agnostic Patriot because my only axiom, if you will, is the Declaration of Independence. We hold these truths to be self-evident, that we're all created equal. And I try to take that perspective, right, left, liberal, conservative, Republican, Democrat. We're all created equal. What is— what are the implications of that? What are the philosophical, practical implications? So I, I call that out to you if you're of interest. Beyond that, here's some contact information if you want to call me. Reach Josh, John, or me. Josh is Vice President of American Business Bank. John's the Director at AuditOne. And of course, I'm President of Secure the Village, and I'm also the Director of Information Security Management at Miller Kaplan. If you've got my contact information, please don't hesitate to reach out. If you've got any questions, any concerns, any interest, or whatever, feel free to reach out to all of us. And I want to finish up just with one of my favorite motivational quotes of Bobby Kennedy. If we're going to secure the web, if we're going to reach this place of, you know, kind of solid identity vantage, right, taking, moving from UNAM to the bigger problem of identity management, authentication, and so on, like what you guys are so beautifully doing, those are accomplishments. Those don't happen just because we, oh gee, it would be nice. Those happen because men and women and, I mean, everybody puts their energies into making stuff happen. So Liam, I want to thank you for making stuff happen here. You know what UNUM is doing is an achievement, and John and Josh and everybody involved with Secure the Village, thank you all for that. And with that, John, let me give it back to you to take us home.

Great.

Really, that's all.

Please join us next month when we have a speaker from the LA County District Attorney's Office, and watch for the event information on the Secure the Village website. If you have not signed up or joined our mailing list, you can send an email to any one of us through and we will add you to the mailing list so you can find out about upcoming events and receive the weekly report that Spann was mentioning. So that's it. Thanks again, Liam, really appreciate it. And we'll sign off here.

Great, thank you all.

Great, thanks everybody.