Digital Identity and Self Sovereignty with Kaliya Young & Lucy Yang #7

Welcome to The Future of You. Today I'm joined by Kahlia Young and Lucy Yang. In 2005, Kaliya co-founded the Internet Identity Workshop with Doc Searls and Phil Windley to bring together talent dedicated to designing and building identity systems that empower individuals. 5 years later, she founded the Personal Data Ecosystem Consortium to help individuals with the tools to collect, manage, and gain value from their own personal data as they interact with all kinds of digital systems. She's an internationally recognized expert in self-sovereign or decentralized digital identity and has been named one of the most influential women in tech by Fast Company magazine, amongst others. Lucy Yang is an entrepreneur, MBA, and business advisor experienced in taking ventures off the ground and leading their strategic growth. She has a wealth of management experience in startups across edtech, healthtech, blockchain, digital identity, and personal data management. And much of her current focus is advancing the adoption of the verifiable credential and decentralized technology for COVID and public health. Kalea and Lucy now work together in their shared consulting practice, helping organizations of all sizes adopt, develop, and invest in decentralized identity and relevant technology. Now, I will say this discussion gets quite technical, but I think it's really important that digital identity and technical tools like verifiable credentials need explaining in a simple way so that more people can understand them. And the more people that understand them, the more people will have a good informed point of view about digital identity. So in a time of great concern about digital identity, this is a very important conversation. If you want to know more about SSI, Self-Sovereign Identity, identity, decentralization, and the emergence of COVID passes, but to put them in a greater context, then this is the episode for you. Let's tune in to Kaliya and Lucy as they discuss with me digital identity and self-sovereignty. Welcome, Kaliya and Lucy. It's fantastic to have you here, two experts in the field which we are going to dissect, which is digital identity and specifically self-sovereign identity, but we'll get onto that in a minute, I think. I wondered if we could just start the conversation by broadly explaining to the audience why identity is such an issue in the digital world. What's different about it to the physical world? And perhaps you could explain to us a little bit of the background or the context as to why we need digital identity or we should be talking about it.

I think one thing is we already have digital identities because our contemporary systems are run using computers. So almost every institution you interact with— your soccer club, your church, your school, your doctor's office— they all have computers, and you have a digital representation in those digital systems. And so it's kind of a misnomer to go like, oh, this is new. What's new is we also have little computers in our pocket now called phones, and we're trying to rebalance how we use these digital devices and tools and computers that we have to connect to these other systems that have digital representations of us for decades. So that's, that's the, the challenge we have. And particularly, we've also had a way that digital identities have been created where we get assigned identifiers by these systems. And because of that nature of that assignment, those entities that give us identifiers, like our email address or our username in a particular context they can also take those away from us. So how do we have autonomy and empowerment in ways that mean the institutions we're interacting can't just take the identifiers away from us?

Mm, I see. Of course, when we all started to use the internet, we, I suppose, did become aware that there isn't really an identity layer on it, is there? Or maybe there are many, many, many numerous millions of identity layers. I don't know what you think, Lucy. Do we need an identity layer on the internet or are they there in various forms already? It's just that we don't have any control over them.

Thanks, Tracey, for the question. So this is exactly what I was thinking about, the layer that is missing that actually I learned from Kaliya and the way I come from a business kind of background. So the way I'm looking at it, right, is like we had, we already have identity, we already have a way where multiple ways of managing identity, physical identity before We have digital identity, right? But have we actually looked at how identity is done since we have internet, since we have devices, right? I think the fact that there is something missing, I'm not sure if one layer or several layers are missing. The fact that there's no layer about users and user can identify or how like user can have control of their identity the way they do with their physical identity, at least, is a question that isn't worth asking now that pretty much most people are on the internet or using devices somehow.

Exactly. So when somebody turns up looking like a cat in that hearing that that guy had, he had the FaceApp on, they look like a cat. That really brought to life that old saying. I mean, no one knows if you're a cat or a dog on the internet, right? Kind of brought it to real life, I think. So what's been happening? Because Kahlil in particular, I know you've both been working in this area for a while, but Kahlil in particular, real pioneer, uh, in this area. What's been happening over the last sort of 15 to 20 years? Has there been much progress made?

Yeah. I mean, I've been hosting a conference that's coming up this week called the Internet Identity Workshop for, we're going on to 17 years now. And our community, the first things that we innovated, we imagined, you know, everybody would have this new— what we were developing, and they'd have autonomy and control. And we ended up building a set of protocols called OpenID and OAuth that did make the internet a little better. You didn't have to have a totally separate, different account for every website you went to. You could use accounts from one system and another system and not have to create a new one. But it ended up fueling what in our technical lingo we call identity providers. So often when you go to the web on websites and you see log in with Google or log in with Facebook or log in with LinkedIn or GitHub, those are identity providers. And you're sort of disintermediating yourself from the website you're connecting to with those services. But it's convenient and people are using them, and, and we invented that. And then in the last 6 years or so, we've innovated in a next generation of technologies that have more hope for user empowerment called decentralized identity, or self-sovereign identity, depending on your preferred political perspective on what it means, but really trying to separate out the attributes about people that they might want to share and creating new tools for that to happen.

Yes, so in my book I tell the story— in fact, I open on the story of when I got locked out of my Facebook account. So it was back in 2016. Seems a long time ago now, and I was receiving emails to my email address but referring to me as Byron Lawworth. And the messages were saying, from Facebook, well, you should really update your status, Byron. Look what all your friends are doing, Byron. And I would look to the friends and they were just a bunch of sort of half-naked 30-something-year-old males. Unfortunately, they weren't my friends. But I discovered, hang on a minute, something's been compromised here. I didn't know if it was my email address, I didn't know if it was my Facebook account. So I tried to log into Facebook and they wanted my passport and my driving license to verify me. And when I scanned in my passport, Facebook came back and said, "No, you're not Tracey Follows." So this is what really started me to think, well, hang on a minute, who is verifying me? And not only who can I trust for authentication and verification, but who trusts me? Because I had my passport, which was, according to me, was, you know, my only real official documentation. They'd asked for it, I'd scanned it in, and it just didn't seem good enough. Now, it just became clear to me that somewhere along the line I wasn't machine-readable and I didn't really know why. And I think what's been created with Byron Laworth and some of my content on my Facebook feed, as was, is a synthetic identity, interestingly, because I've seen it pop up somewhere else. But the point is, how does self-sovereign identity or decentralized approach that you've just been outlining, Kaliya, to either of you? How is, how would that then rectify or avoid that kind of situation which, which I had with Facebook, for instance?

So the challenge that you present is not necessarily an easy one to solve. I think in a future time when SSI is more mature, you would probably have quite a few credentials in your digital wallet that have your name and information about you that you could prove you're you. You might have your university degree, you have a course you took last year. You might have some sort of government-issued ID in a digitally native form, not a paper form that you're scanning in. You might have proof of things you purchased that you— and you could go, hey, I'm really me. Here's this stack of proofs that I have that are digitally signed and that the verifier— in this case, you're talking about trying to prove to Facebook who you are— could use cryptographic algorithms to go check on the validity of the information you presented, and also check that the entities that are issuing those documents are in trust frameworks that they agree, that they think have merit. So, you know, like you know, there's this challenge of how do you believe any institution that's saying something, right? And this is sort of going deep into the problem, but we do this with things like schools. There's certification bodies that go through and accredit schools, and there's sort of fake schools that pop up and say, "I'm a school," but they're not accredited by the real body that kind of does that. And so Trust frameworks do that, but at a larger scale for more types of institutions so that we can have confidence in the assertions by various institutions in this new digital decentralized world that we're building. So Facebook would check both that the information you shared hadn't been tampered with and that the entities issuing it had come from trust frameworks that they recognize.

Yeah, because one of the interesting things is if we think of Facebook as a sort of third party, they've potentially, or somewhere along the line has potentially got a copy of my passport, haven't they? Because I scanned it in. I guess this is one of the things when we want to use some of these services now without some of the new technological tools you're talking about, some of the processes, there's copies of our identities sort of floating around all over the place, whether it's at banks, utility bills, all those sorts of things. I think people kind of forget that, don't they, when they think about a digital ID or even an ID in general, and they're trying to weigh up the pros and cons of some of the, the new concepts around digital ID. They forget that actually we've got loads of personal information being stored or, or thrown away, or we don't really know what's happening to it with lots of third parties in all sorts of places, right?

And this challenge that we have today in how identity works is that knowing information about a person means you are the person is part of our problem. It's what we have to unravel and unpack. And one of the great features of verifiable credentials, the core standard that's a part of self-sovereign identity, is that when you hold a verifiable credential in your wallet, and you share information with a verifier, you do so in a way— it's called a verifiable presentation. And yeah, they have the data on, on your credential, like your name or your birth date or whatever attributes you want to share. But the way that they hold the information, the way it's encoded, means they can't kind of copy it and replay it to someone else and pretend to be you. Because only you have the original verifiable credential and you don't actually share it. You share a presentation of it that's unreplayable in a copycat attack. So if this was used at scale, it would end a significant portion of identity theft and identity fraud as we know it.

Right. And what are the differences between attributes and verifiable credentials?

So if you're thinking about like a physical ID, right? When you get to your driver's license, you pretty much get entire driver's license in a card. And then whenever you need to use it, you need to actually show your entire card, right? There's no, you can't hide certain kind of like data points that only show like what you want to show. But the benefits with using Verifiable Credentials is like you still get kind of like a digital card into like something like you have and you have that entire thing. But when you're sharing it, you don't necessarily have to share everything. So it allows you to share only the data points that are needed for a particular verification. For example, if you're going to a liquor store, you only have to show like your age, right? If you are like above like the age that you can buy alcohol, and that's, you know, obviously they still need to know if it's you, probably need to see like the photo of you and then see, okay, you're over like 21, you're over like 18. So that's kind of the attributes of the each kind of data attributes on a particular card that you can actually selectively sharing. So that's what Clea is, you know, was referring to. And one thing I would love to add in terms of the, you mentioned like the prior kind of sharing data. I think one thing SSI is trying to kind of do is to have that kind of a channel between whoever give you the information, also whoever is taking your information. So you have that kind of entire history yourself. So as user, you know, oh, I've shared the same with someone before, and there's that channel can kind of exist, and you can, you have that kind of secure way of communicating with, with a particular organization. And also, as a user, I have a way to verify if, you know, if Facebook wants to check my information, if that is Facebook or not. It's the same the other way around, stays the same, right? So I think the entire kind of process of thinking about creating an account, right? And also like in exchanging information will be different from what we're looking at today.

Yeah. So my understanding is somebody, somebody is looking to verify one of your credentials, let's say, rather than you in a sense. And they put in a proof request. Is that right? And you'd send a proof response and then they can check all the things that you guys were just saying, like when was it issued? Who issued it, has it been modified or revoked or whatever? And then what happens then? Is it accepted? What's the bit in the process then that kind of just goes, okay, then that's, that's going to move forward and that's been verified?

It depends on how exactly, you know, kind of like what the verifier wants, but no, and in general, what they need to know is first is the information, the data, not necessarily the entire credential, but every data point they're getting, it can potentially from different credentials or different cards, right? But they want to know, are all those information coming from trusted sources, right? At least the organization's institutions, the verifier, whoever is taking your data, do they trust organization, right? So that's one thing. Another thing is, are these information are being tempered or changed?, right? And it is exactly what is initial to credential in the first place. And also, is this information still within kind of a time range, right? A certain criteria is like you have, for example, like if it's a card, it's come from a driver's license, right? Has your driver's license expired? If certain credentials, right, your, the data it's from is being revoked, right? So that's all these kind of validity questions and as well as Once you get the data, the verifier gets the data, they also have to see if the data actually meets the requirement, right? If the age actually meets the age that a person is allowed to get into liquor, to buy liquor. So that's on high level what kind of like the checking and verification process will take place.

That's very clear. The reason I asked, partly the reason I asked the question is because when I try to explain this to people who aren't involved directly in like the technicalities, as I'm not either, there's a kind of response which is, oh yes, but it's it's all on the blockchain, isn't it? And that means that everything's stored and everything's immutable, and then people can track you and know what everything you've done, where you've been, how you've used these verifiable credentials. So I wonder if you can— I can see Kaliya shaking her head, I know. So I wonder if you can set this to rest once and for all and perhaps explain to people why that's not the case.

So there are certainly projects and entities running around the internet and saying they do all sorts of things. So we aren't necessarily— like, the folks you're, you're hearing that from may be accurate in the sense that there are projects that do crazy things on blockchains. What we're talking about with self-sovereign decentralized identity and the communities that we work with they're really focused on developing open standards. That is basically a recipe book that anyone in the whole world can follow. And though that's, that's what we're talking about, is those recipes for verifiable credentials and another recipe for decentralized identifiers. And the recipe for verifiable credential in its best form means that an issuer packages up a credential for an individual They give it to the individual, it sits in the individual's wallet, and then the individual decides where and when they share the information. And the only thing that really, if anything, goes on a blockchain or gets posted publicly on the internet— I mean, that's what putting it on— is the anchor decentralized identifier for the issuer so that when this credential is presented in the verifiable presentation form, that verifier can go find that cryptographic key material that's hosted with the DID and use it to do the math they need to figure out the validity of the credentials. But nothing other than that anchor decentralized identifier for the issuer goes on the blockchain.

And one thing I would love to add is blockchain is not necessary at all in SSI. So like Kuya mentioned, somewhere it needs to be an anchor, like the identifier needs to go. Blockchain is an option, and certainly especially is a kind of early on kind of popular option. But now we're certainly not talking about blockchain as the only solution for people to anchor the DID. There are so many other ways of doing it. So it's, and also not to mention that the data itself, like personal data doesn't go on blockchain and shouldn't go on blockchain, you know, in the community we're in.

What would be another, if it's not too technical, what would be another way of doing it then?

So there's a DID method called DID Web, and it's actually one that the US government is using, and it's a way to put the key material anchored in I believe it's in the DNS record. So DNS is the lookup system for when you go find the address of a domain name, like your computer goes finds where, where on the internet your web address is. And so it's a way to anchor it there. Yeah. So that's, that's another popular place.

Great. And so we've talked a little bit about, well, a lot about verifiable credentials, talked a little bit about DIDs. You've mentioned wallets. My question is, how many wallets will someone have? Is there a limit? Is it going to be an ecosystem? How do you imagine this will work with lots of wallets or one wallet with lots of verifiable credentials?

So I think that, you know, I recently read a tweet that said, thou shalt keep your cryptocurrency wallet and your wallet for verifiable credentials separate. I, I kind of agree with that. It's trying to do too much cryptographic work all at once too early on to try and have those all be in one. In an ideal world, you could have one wallet that interoperates across all the issuers that you have and all the verifiers you want to talk to, and we'll see if that's possible. I mean, I think there's a lot of noise in the market right now, and hopefully within the next year and a half it'll settle down and there'll be some wallet conformance tests, and most folks will build wallets that align with that, and most issuers will issue to a wallet that aligns with that and verify subsequently. We're also seeing the EU actively work on the development of wallets for their citizens. And hopefully that will also sort of spur alignment and reduce the need for multiple wallets.

Now, I'm glad you've mentioned the EU because I was going to ask you both about eIDAS 2, I think, isn't it? Because it's, it's, it's phase 2. I've been watching several sort of presentations and chats and seminars around this, and they do refer to it as self-sovereign. Or decentralized, but I'm wondering, is it? Is it a decentralized system they've got going across Europe with Phase 2 or Mark 2, or is it sort of decentralized across centralized entities? Because obviously each country has its own identity system, doesn't it? And then there's the kind of bringing them together, I think, over eIDAS. Maybe I've misunderstood. I wonder if you could just break down what is EIDAS and whether it truly is decentralized or not?

Well, it helps to understand what EIDAS 1 was. So EIDAS 1 was an aspiration to have digital identities issued by governments accepted by other EU governments, and they came to the conclusion that each country was going to do digital identity in their or do identity proofing in their own way and issue documents that would be accepted within their country, and then other EU countries would recognize it. You ended up with about a massive middleware, about 200 different schemes. I think there's only 35 countries in Europe, or like, it was a giant convoluted knotted mess. And really the only It was only about government-to-government acceptance. But most of what citizens use their government-issued identity documents for is not to cross a border and show it to another country. It's to show it to the doctor, to the school when you're registering your kid. You're showing it to lots of private, non-governmental entities who want to just know, know what the government said about you. Like, are you really that person?

Person.

Yeah, okay, you know, what is eIDAS 2? We'll find out in the next year as it rolls out. I believe the aspiration is to support the kind of interoperability that SSI has, where you can receive a credential from authoritative sources like the government that you happen to be a citizen or a resident of a particular country, and then you can use that across the EU for a whole variety of reasons, including other EU governments and the private sector to do business?

I think the current conversation regarding like eIDAS 2.0 is, I think the private sector is already involved that perspective, especially if we're looking at some of the EU funding projects where they're talking about building wallets, right, EU-wide, in collaboration among member states. I know like the private sector is already involved, like Clea said, right? It's not only about kind of cross-border government identity kind of sharing exchange, but also about how individual citizens can use government-issued and trustworthy identities to interact with private sector players who provide their day-to-day services. And actually, this is also kind of going back to your earlier question about wallets. I think we need to look at wallets not only from what kind of technical solutions, but also business solutions. Comparing with what we have today, right? I think there will be a lot of wallets in the sense that the brand of the wallet will be different. Like what we're having today, we have like Apple kind of wallet where it's more kind of a universal wallet where you can have many different kind of IDs, identities in it. At the same time, you also have actually the application you're using, like company branded one, because I think companies want to have that kind of relationship with our client instead of pointing their clients through an universal wallet, they're probably like, there's something unique they're providing through their own application, which also includes a digital wallet in it that can hold credentials.

Right.

But at the same time, like, the credentials can also be carried to other kind of, for example, to Apple Wallet, if their client or their user wants to kind of use it in Apple Wallet. I think what really matters is actually the underlying technology, right? Like everyone is using if that thing allows people to take their credentials outside of a branded wallet or outside of general wallets and actually use elsewhere. And also if the verification mechanisms of different credentials are interoperable, that can verify different kind of credentials. I think that's looking at the technology and also the actual kind of interfaces kind of separately, but also connected. So that's how I would encourage people to look at it.

Because I was thinking about what I use. So let's say I've got an Evernym, a IOTI, I've got my e-residency for Estonia. Yeah, all of these have got different verifiable credentials in them, but then the UK government are also creating their One Login Pass, which I think is to— I was just saying improve on Verify, but that's not difficult— to improve on the old system, the Verify system. And so then will I have a a login or an identity for that and also an ecosystem of wallets or apps where I have verifiable credentials for other things. I'm wondering about your views on how the ecosystem will shake out. I mean, you just said about Apple as well. Of course, Apple are doing the mobile driving license in the States. So, you know, is it going to be an ecosystem of government and private sector? And some of the big platforms offering wallet capabilities? How, how do you see it evolving over time?

I think at least at this point, my view is there will be a lot of different kind of wallets and government ones and more like UOT is more like, I think the service provider in the sense that there are certain companies instead of having their own wallet, rather like let's use UOT wallet, probably easier for our customer.. And also there will be kind of branded wallets like the company application because their clients are not only looking for wallet functionality, right? They're also value-added service that a company want to provide to their client. It's pretty much the wallet as just some small portion of it. I do see all kinds of wallet exist, which will be confusing to, to individuals for sure to begin with, but how these wallets will kind of like merge will evolve down the road. That's a question mark for me as well. But we're already using a lot of apps these days. I would treat the company-branded apps like what you're using now. It's pretty much the mechanism of probably exchanging. A digital identity will be different as a building functionality. And I think the government one is kind of a relatively new one because I'm not using any kind of government kind of one, but I would see more kind of government services consolidating probably into one wallet, right? That kind of scenario. But yeah, it's still like quite— things are pretty fragmented now. So I'll see how things pan out. But I think as a starting point, there will certainly be a lot of wallets out there in the market.

I mean, that's good in a way, isn't it? Because that means that the market's still open to the most innovative, convenient, user-centric solutions, I guess, and one hopes that the best ones will win out in the market, although I'm sure there's lots of other power plays. I don't know, Kalea, if you have anything to, to add to that about the ecosystem.

So I'm really a strong believer in open standards and trying to get alignment, and I think there are large players trying to do their own thing and create lock-in. So this is what I would say right now is the big danger with particularly Apple and Google's control of the mobile operating platform, that they're going to push to be like, trust us, put it in our wallet. Mm-mm, we need to choose our wallets on your platform because then they can't lock us in and they can't control the ecosystem.

Because then we might as well have had a centralized system rather than a decentralized one, mightn't we?

Yeah, or I mean, you know, it's very possible that you can end up in a system where verifiers have to pay every time. There's just like some real problems of where it could go in terms of lock-in and costs that aren't necessarily seen now until the lock-in happens. And it's like, oh, now you have to pay for that.

So is it better for people to start adopting, you know, proper self-sovereign applications and solutions quickly, or is it, is it just going to go at its own pace, this change?

I mean, the issue is that these are ecosystems, as you said, and ecosystems that involve fairly large entities that move really slowly and with decision makers who don't necessarily understand the decisions that they're making. So I think it behooves us to improve our communication and our persuasive arguments to those decision makers about the critical importance of open standards, about conformance, and even testing around open standards. I mean, the US government's really led the way in terms of cultivating ecosystems of startup companies that are interoperable. In fact, they don't get paid on their US government contracts unless they're interoperable with each other. And can prove it. And we need other governments to do that type of thing and to join in pushing for these open standards-based ecosystems. This is what we often— isn't really understood by the general public audience, really, is that the internet was so successful because HTML was 100% open. Anybody could build to it. And you got this enormous flowering of opportunity and potential. And verifiable credentials is a standard like that. It has very broad expressive capacity. It can communicate incredibly serious things like your national security clearance level, blah, blah, blah. And it can also communicate that you went to yoga class yesterday. You know, like, doesn't matter. It's a data format, right? And what we as humans and our institutions and networks do with that data format is really up to us. But we can't get there if all of these credentials are special and unique flowers. Then it's like, you know, 100 wallets and confusion, and we're sort of back to where we started, right? So the open standards are important. If I had a magic wand, I would build a movement of netizens who are like, open standards, give us open standards so that we prevent large company lock-in into their preferred way of doing things and stifle the innovation from all the creators that want to or could be doing a particular thing.

Hmm, very interesting. So should we really be, as we're promoting and publicizing this and telling people who aren't necessarily on board yet and we're, and we're trying to persuade them, should we be talking as much about open standards as verifiable credentials or self-sovereign identity then? You know, because that's what's going to discriminate. That's what's going to bring about a better system overall, isn't it? If people understand, and I think they do understand open standards much more than perhaps some of those other terms.

Maybe. I mean, we have this challenge with the mobile driver's license standard is also a quote unquote open standard, although it's developed entirely in secret in an institution with really weird practices. And has within its architecture a phone home loop so that when you present your mobile driver's license, you're not actually presenting the information on your driver's license. You're giving the police officer a token to go look it up in the database of the government. Oh, so that is the case where you could compare these two quote-unquote open standards and say which one has a better architecture for privacy and for people.. And I would argue the Verifiable Credentials standard does, because it doesn't have an optional phone home loop to ping the state government database.

Got it.

Because if you have that kind of loop in your system, then the government can track everything you're doing and where you go, because it's an authentication loop back to the government. Another example of a project that is open source and aspiring to provide or be an anchor for identity services globally is a project called MOSSIP, the Modular Open Source Identity Platform. Sounds great, right? Love open source, sure, but it's based on the Aadhaar model, which is the model in India where you biometrically authenticate every time you use your ID, or you use an optional— there's another loop that's like a mobile phone loop, but that's still telling the government everywhere you use your ID. So these systems wrapped up in words of goodness like open source, and in the case of the Mobile Driver's License Center, there's an open center, have bad architectures for the values that we hold in Western Europe and in the United States of Western liberal democracy. Liberal meaning we are free to do what we want without the government seeing everything. And we need our digital architectures and our open standards to reflect those values in them.

Understood. Yes, very much so. And we saw some of the dangers as well, didn't we, in Afghanistan of sort of biometric-related identity systems. Do you remember when some of those systems were left behind?

Sure. I, I don't know if that's the best comparison to make. Again, almost all Western liberal democracies have photos of all of their citizens in some type of database somewhere. Photographs or biometrics, right? So the state of California has my photo because I have a state of California driver's license, and it's how we do what we call in the business identity binding. So it binds the information on the artifact to me, the person. So I think it's complicated, right? It's more about the everyday operation of a system. My paper driver's license from the state of California does not ping the state of California every time I use it. My digital version of the same thing should not ping the state of California every time I use it. It doesn't mean the state of California shouldn't have my photo somewhere.

Yeah, I think that's what people want to know. I think that, that allays a lot of fears, uh, that people have. Lucy, am I right in thinking that you're based in, um, Canada?

Yes, Toronto.

Toronto. Yes. So what's happening in Canada? Because there's quite a lively digital identity ecosystem there, isn't there?

There's a lot of innovation Yeah, we're not working kind of directly with Canadian government, but being in Canada, I'm certainly aware of, like, there's a lot of initiative, I think, both federally and provincially are related to digital identity. And also, like, you probably know, like, there are already existing systems, for example, like in British Columbia, they have built kind of their citizen, BC Citizen Card, some kind of like citizen kind of identity. Into their existing system using self-sovereign identity, as well as there's an organization kind of level network that using self-sovereign identity verifiable credentials to give to like businesses so they can identify business like in a more trustworthy way, right? There are initiatives like this, like in Canada that are going on. And also like, I know a lot of like more kind of like just the driver's license, like in Ontario where I'm in, I think they're also looking at using verifiable credentials as well as other kinds of digital identities. So I would say Canada is certainly kind of a leader in this space. And also like there's an organization called DIACC, Digital Identity and Authentication Council of Canada. So they're being quite active working with government, with the industry to coordinate like the private sector profile of the pan-Canadian trust framework. Framework, which the government is— the federal government is actually leading the public sector profile. So this is a really, really big and important work. And as Kalia mentioned earlier, like the trust framework is actually the kind of key pieces. You can't just have technology without governance, right? The proper governance to guide who was doing what. You also need to have policies in place, the level of assurance of identity, right? Are used properly. So these kind of the trust framework are led by both the government and associations like DIAC in Canada are quite pioneering work. I believe many other governments are following and having conversations with the Canadian government about it.

That's very interesting. Now I understand that you've been working on the verifiable credentials for COVID, haven't you? You've certainly been looking at how to advance the adoption of those. In fact, I wanted to ask you both about about two possible use cases, which is sort of COVID credentials, if you like, or immunization certificates. I don't know how you're thinking about them. And then central bank digital currencies. I wanted to ask you if these types of digital identity that you are working on are very important underpinnings to either one or both of those. I wonder if you could just start by telling us a little bit about the work you might have been doing with COVID certificates?

So I got into the COVID work because like the self-sovereign identity community organized a community called COVID Credentials Initiative, or like very early on, like in COVID, like March 2020. The idea is like we have done that elsewhere and we feel like these technology can provide value in the fight against COVID. And initially we were thinking about how we can have more kind of tech, more kind of standards, right? Like the, both at the public sector and the private sector can adopt to use like the credentials, the verifiable credentials for a variety of use cases, you know, including like test results, vaccine certificate, even like the providers, right? Who like the doctors and nurses who have like the kind of the right credentials to do certain kind of things to access certain kind of facilities. So there are all this kind of things we're exploring early on. And to a point we realize it's very, very difficult in the sense that I think healthcare is quite complicated space and it also have a lot of existing infrastructure, what we call like legacy systems, right? Bringing new technology in a very, very kind of in an emergency situation, right? It's not easy. In a sense, you have to think about how this new technology can work with existing systems and how these entities who are not quite adapt to these new technology, how they can get on board. And especially when it involves the government, right? The government can't just like, let us take something new and then use it because it just involves too much security, all this understanding and buy-in internally in the government. And also as technologists, especially initially, we're mainly technologists, how we can make sure technologies are also built together with stakeholders, not only the health sector, but also the legal professionals, right? The ethical ethics. So people are familiar with ethics and all the other things. They have their say to guide the use of technology. So this is quite a complicated process to a point where we realize the thing for COVID is not It's not like how like verifiable credentials can be fully where the SSI model can be fully kind of established. This is a good kind of long-term, as you mentioned, there's immunization record that can also use the same infrastructure. So COVID is literally just a starting point for us to look at if we want to bring in what we believe a good technology into an existing system, where it should be the starting point. So I think that's what we learned a lot, like through doing the COVID work, why, where should be the starting point of bringing this new technology into the existing systems and start kind of creating awareness and education and also market buy-in of these. So that's, yeah, I will pause here and see if Kaliya have anything she wants to add.

I think that there is, you know, pick up on what you were talking about, central bank digital currencies. I think there's a lot of questions like our current, the banking system as it exists today, requires know your customer, and that's a government requirement. You cannot open a bank even in the farthest reaches of the farthest country. And this all happened after 9/11. It wasn't— before 9/11, there was, there was significantly less regulation in this regard. And it comes about from a quasi-governmental entity called FATF, which was set up to sort of put in these norms around know your customer and basically say if you don't conform to the norms, you can't plug into the global banking system. And it's— that's the way it is. So now there's these conversations about cryptocurrencies and cryptocurrencies managed by governments and sort of asking this question, okay, how does does the KYC regulation interact with this new digital world? And honestly, I don't know. It's not my area of expertise. I'm not the person who pays attention to that. I would strongly recommend, if you want to explore that realm, to invite somebody like David Birch on your podcast. But this is the thing, is there's this, there's a super strong fear reactivity to digital identity things. And I think rightly so. Like, one of the reasons I work on this and I know so much about it, because I was like, oh, if this goes wrong, it could be really scary and I want to help it go in the right direction. I think it's important to learn more about the things that worry you and get engaged in shaping the future of technology. That's another thing is this is kind of fatalism, like, oh, these giant entities are in the control and coming to get us and like They're just trying to do their job. And there's a set of rules that we have today that might make sense in the future and they might not. And we as humans who are smart, intelligent beings who get together and make decisions together can shape the future together. And that's one of the funnest things that I've experienced in, in this work is helping a community of really smart, super caring, very values-oriented people try and shape the standards for digital identity. And we're getting together this week at the Internet Identity Workshop, and we'll see, see what the next iteration of what we work on is.

I'm so glad you've said that, because I think a lot of people are using phrases like, well, the COVID certificate is the Trojan horse for a digital identity, thinking about a sort of global digital identity, that there's some sort of sort of centralized top-down enforcement of something. And I think you, both of you, have made it very clear that that's nothing to do with what we're talking about here at all. And then a lot of people are saying, well, we have to have a digital identity because they, they want to bring in a central bank digital currency. And I think people are— yes, you're right, that they're rightly worried because it's very difficult as a technical subject to get one's head around as a member of the public. This is why I think this conversation is so important and so useful for people, because you're explaining it in ways that we can all understand. Yes, there are the technicalities, but you're also drawing a distinction between the technicalities and the standards and our values and the ways in which certain people might choose to use control or not. So the COVID certificate is interesting to me because really there's nothing wrong with the COVID certificate. It's the fact that you know, it's mandated, you are given permissions or not, you know, you can go to a restaurant if you have one or not. It's those sorts of societal and policy agendas that are placed sort of alongside the actual technological immunisation certificate. It's not the technology itself necessarily, is it? It's the way in which it may be applied or some of the premises that might be put around it. And I think I think what you've both managed to do is really draw that out and explain to people the beauty, really, and the simp— I know I'm going to say simple, you'll probably laugh at this because I know it's highly complex, but when you talk about the philosophy rather than just the technology of self-sovereign identity, it does feel a very aesthetically simple, beautiful solution, really, that can, as you say, ensure that we are still free as citizens, as users, to go about our business, but also to be verified and for us to verify others. Is that fair?

Yeah.

And so I wonder, as we sort of just conclude this discussion, one question that does come up a lot is about anonymity. In a world of self-sovereign identity, will we have, uh, one and only identity? Will we the possibility of anonymity. Will we in fact be able to employ pseudonymity in some places if we want to or not? I don't know if you could just talk us through those concepts and how they might fit with self-sovereign identities.

It's a great question, and I'll bring it back to a question you asked at the beginning, which is what is this digital identity thing and what's important about it, I think, and different than our physical identity. So When we choose to participate in different activities in the physical world, when we go to church on Sunday and we go to our strange hobby club in the afternoon on Sunday, and then we go to work on Monday morning, and then we do some volunteer work in the evening on Monday, we separate all those contexts physically and we probably use the same name. But when we do that online, when we use the same name across very disparate contexts, contexts that we may not want linked together, or worse, the same identifier, like the same email address or the same handle from that one account, Facebook, across all these places. We're merging contexts for ourselves that we might not want merged. And back to our values, if we believe people should be able to go to church on Sunday and not have all the folks in that context to see their volunteer work on Monday or their strange hobby in the afternoon the next same day. Like, we have to give people the freedom to use different identifiers in different contexts online because that's how you separate context in the digital space, not by physically moving around, right? So one identifier that you're forced to use all places is a recipe for disaster online and creates really high risk for vulnerable people. You know, there's folks talking about sort of a pseudonym generating service where you're known to the service, where your government, you know, the name on your government ID is known to them, but they issue you a pseudonym that then you could go use at other places. And unless you do something wrong, nobody ever comes and knocks on the door and finds out your name. But if you do start to do something inappropriate that's illegal, then they could go back to the service that generated your pseudonym and like get it. So there's like interesting ideas about how to both support anonymity or pseudonymity and accountability in the digital world. And I think we need to look at more of the— look at more seriously that at that. I mean, you could see this also in like the dating realm where people, especially women, do not reveal their real identity in those realms, but they're willing to be accountable and they'd like the men that they're trying to date to also be accountable in these systems, right?

So it's about the context, isn't it?

Isn't that not a kind of technology question? It's more of like, if I understand correctly, technology— there's capability, right, to absolutely we should do that. It's a matter of like where we should do what, which comes back to like the kind of the governance, like the policies, what the rules should be, right? What is the right thing to do? How to use technology? Like, right. So that's how I see it.

I think that's right.

Okay.

Well, we're coming to the end of our time together. So I just have one final question for you both actually, which is what's your action for identity? We're just going to take a quick break and we'll be back in one second.

The Future Review is sponsored by Future Made Consulting. Writing for outlets like Forbes, Reuters, to Coolhunting and Wired means I'm always on the lookout for those who can inspire me on alternative futures and work with me to activate them. That's why I tap into the brains at Future Made, a network of established professionals in research for strategic thinking. They help me spot trends, roadmap innovation, and fully prepare for what comes next. They've worked with a host of global brands, businesses, and organizations, whether it's consulting, speaking, or curating future on projects big and small. They even do training to teach you these skills too. Whether you're a CEO, CMO, or just in the business of starting up, Future Made can help you grow business, design product, and make decisions, all with the future in mind. Find out more at futuremade.consulting. Made with the future in mind.

Okay, Kaliya and Lucy, I'd like to ask you both They can be the same answer or different. What are your actions for identity? What would you like to see? Or what do you think must happen next?

So I alluded to this earlier. I'd love to see a social movement of concerned citizens who are educating themselves and also engaging with the issue, but not like in a hysterical way, but in a proactive movement-building way. So those of us values-based technologists who are really trying to shape the future in a positive way have some backup.

Yeah, I would really love to see business people like me to actually understand what is like the, like, not inside out, but at least get dive a little bit deeper into how digital identity technology got to where it is today and which kind of help us understand, like, if we're building new businesses around these technologies, what we need to do, what is the right thing to do from a business standpoint of view.

Absolutely brilliant answers. Well, I think we've done quite a bit today actually to maybe play a small role in this emerging social movement and also explain to people or explore with people, you know, what's the right thing to do. I can't thank you both enough actually for taking the time in such a considerate manner to explain really highly complex technical systems in very simple ways that the general public can pick up and understand. And actually when they understand it, I'm sure they want to be more involved in it. That's how I felt. The more I was starting to understand it, the more I realized that I want to be more engaged and involved in it. So I hope this podcast episode will play a small part in that. Can't thank you enough. Thank you both, Kahlia and Lucy.

Thank you, Tracey, for having us.

Thank you, Tracey.

I'd really like to take a moment to thank everyone who has downloaded, subscribed, and left a 5-star rating, which helped Apple Podcasts recognize The Future of You as one of the best new shows in tech. And if you haven't left a rating, please do, and do visit thefutureofyou.co.uk if you'd like to sign up to our newsletter covering all things identity in a digital world.