The Briefing: Building Trust in Digital Identity #18

In this episode, I'll be chatting with Lord Holmes of Richmond about the UK's urgent need to to pick up the pace on the introduction of digital identity. We'll look at how generative AI is being used to fuel even more fraud, whether generative AI can actually help verification systems, and I'll give you a taster of my conversation with Josh Monk of Faculty, one of the UK's most exciting and successful AI companies around. As face verification gains traction and becomes more prevalent, Threat actors are developing more sophisticated ways to get around the systems and commit fraud. So claims the biometric company iProove. In the first iProove biometric threat intelligence report, they shed light on the key attack patterns witnessed throughout 2022. In the report, which you can download via the link in the show notes, you'll find 3 new trends that arose in 2022. A sharp rise in attacks launched against mobile web, native iOS and Android; the emergence and growth of novel face swap attacks, indicating that low-skilled criminals now have access to resources to launch much more advanced attacks; and finally, automated motion-based attacks launched simultaneously across geographical clusters. Sticking with the theme of threats for a minute, Generative AI and cloud complexity are amongst the latest weapons in attackers' arsenals, according to a recent Forrester report. Three-quarters of security decision-makers say their organization's sensitive data was potentially compromised or breached in the past 12 months alone. That's worrying stuff. But more interesting in this Forrester Top Cybersecurity Threats in 2023 report is the warning that by weaponizing generative AI and using ChatGPT, attackers are fine-tuning their ransomware and social engineering techniques. Using these large language models, attackers can scale attacks at levels of speed and complexity not possible before, reports VentureBeat, highlighting the technique of poisoning data to cause algorithmic drift. That reduces the revenue potential of e-commerce recommendation engines, for example. And Forrester rather ominously predicts use cases will continue to proliferate, limited only by attackers' creativity. It begs the question whether identity management systems can really ever keep up. Well, a video from HelpNet that I came across last week suggested that actually generative AI can help improve identity management systems The video features Peter Vailaris of OCR Labs, who explains the importance of GANs. To quote: GANs can be used to create entirely fake datasets simulating people. These datasets can be created tailored to the weakness of an algorithm. For example, if you know that your face matching algorithm, say, is weak on a particular age range of a particular gender and a particular skin tone, then you can create a large dataset to help tackle that issue without having to worry about data protection. So if your face matching is poor—black males between the ages of 60 to 75—you can use GANs to create tens of thousands of people. He goes on: people in inverted commas because they're not real, they're in order to train your algorithm. But in this way, it allows AI engineers to identify through testing and then address through training algorithmic bias. And he concludes, to quote, "That bias can be by skin tone, age, or gender. Historically, bias has been a major issue for identity providers, but now vendors like OCR Labs can achieve zero bias using GANs to help their training. Further, if you discover poor performance of your algorithms on certain features like heavy beards or thick glasses or heavy makeup, then you can create a dataset and train accordingly." End quote. Over the next couple of episodes, I'll be getting into the subject of generative AI and identity as I discuss what is happening in the field with one of the UK's fastest growing AI companies, a global human rights organization, an audience guru who is teaching prompt engineering now, and a company that makes some of the best digital people around. For now, here's a teaser from my discussion with Josh of Faculty.

I think what's really changing with generative models is that whereas in the past you had systems that could filter down a set number of options and kind of recommend the one that might be the right fit for us, in a generative world you might have systems that entirely co-create an experience, an outfit, a meal just for us. And at that point, when you are who you buy, in some sense your personality is kind of deeply interconnected, interconnected with that generation process. So You're no longer just using a dumb machine learning system to filter out the things that you don't want and buy the things that you do. The system is playing a really important role in helping you actually decide and create what you decide to purchase, whatever that is. I think in that paradigm, in that world, that idea of identity then kind of gets wrapped up in this agent or this model. That presents a really interesting question as to who we are as it pertains to what, what we decide to consume.

And finally, I got a chance to pick the brains of Lord Holmes of Richmond. Chris is Britain's most successful Paralympic swimmer, the Deputy Chair of Channel 4, and a passionate advocate for the potential of technology and the benefits of diversity and inclusion. In Parliament, Chris sits on the influential Science and Technology Select Committee, but he's previously been a member of select committees dealing with democracy and digital technologies, Artificial Intelligence, Digital Skills, Social Mobility and Financial Exclusion. And he's the co-chair of the All-Party Parliamentary Groups on Assistive Technology, FinTech, Blockchain, AI and the Fourth Industrial Revolution. In our discussion, we talk exclusively about the digital identity approach of the UK government and how it differs from, for example, that of the EU. But we spend most of our time going back to basics to talk about the importance of trust for the adoption of any digital ID solution, whether that's in the UK or elsewhere, and the urgent need to engage more of the public in the debate too.

I wonder if we should start thinking about the Financial Services and Market Bill, because I know you've put the cat amongst the pigeons a little bit lately, where you've tabled an amendment to that which is to do with digital ID. I wonder if you could just take us through that and explain why you've done it and and why you think it's so important.

The Financial Services and Markets Bill, which is going through Parliament at the moment, is probably the most significant piece of financial services legislation that we've had in a generation since FSMA 2000. So what myself and colleagues are trying to ensure is that we take all the opportunities of this bill to get financial services in the UK forward-facing, future-facing, in the best shape to deliver for businesses, for customers, for consumers in this country, and then reaching out internationally. So one of the key opportunities I believe that we have with the bill is to really highlight the issues around digital ID. In no sense do I believe there should be a separate digital ID for financial services. But the bill provided the opportunity to really raise the issue and the critical importance of digital ID, to raise it within the context of financial services, because it's a financial services bill, to really get those discussions and many of the concepts and principles and issues on the record in all the debates that we've had so far on the bill.

So what difference is it going to make to have a sort of effective digital ID system? What are we trying to achieve in the UK with that?

Digital ID is the most critical element of all of our futures and probably oftentimes the least spoken of. And oftentimes very much misunderstood and caricatured. But it's absolutely critical if we're going to take the advantages for citizen, for state, for our cities, for our communities, from all of these new technologies such as AI, such as distributed ledger and so on. We have to have an effective, trusted means of digital ID. It's absolutely essential, no less than that. And critically, if we're going to get that digital ID, we have to have trust as the cardinal touchstone at every point, because If there's no trust, there's no digital ID. If there's no trust, there's no take-up. If there's no take-up, then the advantages, the benefits of all these new technologies will just not be realized.

Maybe we should talk about that first, then this issue of trust. I'm picking up that there is a lot of fear and trepidation around the words digital ID. We saw it even recently with Blair and Hague's report and the way the media covered it. I mean, actually, they highlighted it by talking about identity cards, which actually nowhere in the report did it suggest, of course, identity cards. But of course, there is that hangover from Blair wanting identity cards in the past. And so we do feel like, I think in the media specifically, we're recycling some old ideas and fears about digital ID rather than perhaps thinking about the future of digital ID and then working back to 'What do we need?' and 'What are the technologies that are possible?' 'What's privacy-preserving?' 'What's going to be safe and secure?' And it feels to me like there is very little conversation going on about that in the public domain or the civic domain, and that is breeding mistrust. I wonder if I could have your thoughts on that and how you think we might be able to address it, if you agree.

Mistrust is certainly at the fore of so much of the debate, so much of the discourse when it comes to digital ID currently, and that's completely understandable. Understandable because there's been so little, if any, public engagement. So why, why should the public care? Why should the public feel any connection or any positivity around something that they haven't been consulted, engaged with. And I think there's really good lessons from recent history on this. So ID is so emotive and understandable, and if you put it into digital ID, it fires up all kinds of images in people's minds, again, understandably. But if we take an even more extreme example to show how we should go about enabling this discourse, this public engagement. Let's go back to IVF. Now, what could be more science fiction? What could be more terrifying than making human form in a test tube? Imagine that that suggested— why is IVF rightly now a success, rightly part of our society because of a colleague of mine decades ago, Baroness Warnock, who led exactly that, the Warnock Commission, that engagement, that public engagement with the issues around the possibilities but also the risks. What was the essence of IVF? What were we looking at here? It's why it's a success now. Take another example, similarly emotive in many ways. GM Foods. I neither say at this point whether GM is a good or a bad thing. I merely raise it for this point that there hasn't been that level of public engagement, consultation and connection to GM Foods. So still we have understandably great fear, concern and antipathy towards GM Foods. Now we're at the— still really large at the start point when it comes to digital ID, but through those two examples, we can see a clear route of how to go about this to gain a successful dialogue, or indeed not. So we know what to do, we know what we're shooting at. Ultimately, digital ID has to be trustworthy or it's nothing.

Do you think we've got the right ambassadors or the right approaches or policies? And if we haven't, and you're suggesting we haven't really at the moment, where do we find them?

I think we, we find people, great people up and down the country who are trusted, who have understanding, and who are connected into local networks, local communities, local areas, and who have the understanding of the issues around digital ID. Because again, as you alluded to earlier, it's hardly surprising that there's an issue with digital ID at the moment because it goes to the very heart of our democracy of our society, of our culture. To be free in Britain, to be free in the United Kingdom, is not to have to produce your papers when asked, is not to carry an ID card. It is so emotive, as you say, with the debates of two decades ago around ID cards— unhelpful to all of this, but understandable why people reach for those, because that's been really the high point of when ID has been discussed in this country. So it's hardly surprising that people reach this. It's why we have to create this clear narrative, neither pushing nor po-faced about digital ID, but putting the issues out there and having that discussion and crucially having that engagement.

Well, you yourself are one of these great ambassadors because you bring clarity and an ability to understand and convey what these technological concepts are, 'cause these are really sometimes very highly complex technological concepts. Could you explain to people what the UK is doing in terms of deployment and development of digital ID, and perhaps touch on the UK Trust Framework a little bit?

The UK, specifically the Department for Culture, Media and Sport, and won't get confused into departmental chains if it's likely to move and straddle across two departments with a reorganization with the digital moving across. But essentially, the government have sought to set up a trust framework, credentials-based, which will enable people to proof ID through that system. Interoperability is critical to that. And again, as you say, this thing becomes complex quickly. So for people listening, interoperability, a big word, but essentially all that means is any system which is created by any government, any organization, any state or whatever, is really pointless unless it can interact and be interoperable with all other serious digital ID systems. But to even take it to its most simple terms, because again, as you say, you can get lost in the technologies which underpin this, you can get lost in the technical descriptors around stuff. What are we really talking about here? This will be a success if the individual is able to assert their credentials, only the credentials that are needed, in a specific situation, for a specific purpose, for a specific time. So let's really unpack that. What are we talking about? Let's put it in the most obvious example. If you want to go and get a pint, you go to a bar these days, if the person behind the bar is unsure, they're gonna ask you for some form of identity. But say you pull out driving licence, passport, student card, whatever that is, they look at that, they're getting a whole heap of information on you which is utterly irrelevant. More important, it's nothing to do with them. That's your personal details, your personal data. It has nothing to do with them. They don't even need to know who you are. All they need to know at that moment is that you are over 18, thus able to order that pint, consuming that pint, end of. So with a digital ID, you could flip something over to them which would simply give them that detail. That's all that's needed. And so any system needs to be absolutely predicated on my ability to control all of those bits of information. Call them credentials, but effectively all they are are bits of my identity. Date of birth, for example, for me to decide how I deploy them, to who I share them with, and for what purpose. Citizen, me, you, anybody in control at all times of how we are able to use those elements and for the purpose that we're using them for. And in that sense, you're already starting to get a sense of, ah, okay, this can't be ever a centralized system. Centralized control, centralized, held all of our identities in one huge installation. Of course that terrifies people. It terrifies me that people could have all of that and then the uses that that could get put to. We should all be able to say, I say what, I say when, I say for what purpose. The individual in control of our digital ID. But again, it takes us right back— it's why I talk about it so much— around this public engagement and public connection, and thus the public confidence and comfort to use these systems, which will, or indeed if not got right, will not come from it. Because people have to feel that they are in control, otherwise understandably, they will rightly feel that someone else is in control, be that a big business, be that a corporate, be that a government. And again, you've lost— again, if, if that's how it's conceived of, if we had an effective system of digital ID, imagine how you could transact with the digital ID in terms of payments, looking at the whole open banking and the possibilities of open finance and what we could achieve there. All of it rightly should be tied to an effective, strong, trustworthy, privacy-assuring system of digital ID. I think the Trust Framework has a key role, and as with so many things, this is another example of how government should operate. Government has got phenomenal, in many ways unparalleled convening powers. If done right, it's got unparalleled leadership powers, and it's got unparalleled abilities to assure, to set up frameworks and have the right level of regulation and where required legislative framework put around that. And that is where government should stop. They should do all of that to have that level— effectively going right back to what's the purpose of the state. By doing that, and if they do that effectively, they will be both protecting and enabling citizens, protecting and enabling us. And then, as in any other sector, it's for businesses, third sector, any organisation, any connection of individuals to put stuff together which fits within and delivers to all of those requirements.

I wanted to ask you whether you thought there's a role for the department, the new Department for Science, Technology and Innovation. I mean, they want to put to put the UK at the forefront of all of this global innovation and technological development. Is there a role for it in, in this area or not?

There's a huge role for the new department. What I would like to see from that department is a really sharp spearhead on all of this stuff. Digital ID for sure, but across all of the opportunities for the UK through new technologies and an understanding of what's required, what part we all have to play in enabling, in empowering across all this. What are the right picks for the UK? How do we use this to truly deliver things that make sense and are credible around the Leveling Up agenda, for example? So a huge, a huge leadership role and a huge operational role to that extent for that department. It's incredibly positive that it's been set up in such a focused way, but we need to get some pace into that to get the people in it and to get on with doing things, because the potential again is huge, but we need that pace to have that department doing things in this area. And as I've said throughout, All of this relies on effective, trustworthy digital ID. If we think about the metaverse, for example, the opportunities there are immense. Yes, it's very, you know, low use at the moment, but that is going to develop at pace, and we all need to have again the comfort and the confidence to operate, to transact, to relate in that space. What are 3 key elements I believe that we need for the metaverse to succeed for us? For it to succeed for us, well, you need tokens, you need wallets, crucially you need digital ID.

It's interesting you said leveling up. I've got on my notes here Shouldn't digital ID have been part of the Levelling Up agenda? You know, because if you think of it in terms of, you know, not just financial inclusion, but inclusion, as you mentioned, with democracy and everything, it would have been a good idea, wouldn't it? Or maybe it is within the Levelling Up agenda. It would have been a good idea to really make it a fundamental of that Levelling Up agenda.

It needs to be far more brought to the fore. Of all of the discussions around Levelling Up, because whatever specific element of exclusion that you take, digital ID would help. So if we think about financial exclusion, the causes of financial exclusion, what that then means for those individuals who find themselves at the sharp end effectively shut out. And again, it's a debate which has been far too dominated by, well, we just need to get all those people to have a current account. Well, maybe 30 years ago that debate might have had some strength to pin it to current accounts. But now when one imagines what's possible, particularly through mobile technology, we could far more effectively financially enable and financially include, and a digital ID would be and is core to that. So I agree entirely that any discussion around levelling up needs to have that understanding of how empowering an effective means of digital ID would be.

Let's turn a little then to think about the UK and its approach versus some of the other approaches because you mentioned sort of centralized versus decentralized. I guess we can think of that on a continuum. And then we've got the old Verify federated sort of system, RIP. RIP Verify. But the UK, it seems to me, and correct me if I'm wrong, but it seems to me that the UK has taken, I guess, quite a commercial approach in a way, that in a sense, it's leaving it to markets, in a sense. Okay, it's creating a trust framework so that individual organizations in the private sector can start to create their wallets or their apps or their reusable ID solutions, for example. And then consumers or users would come in and choose some of those and over time, build up their own, I guess, ecosystem, digital identity ecosystem. So the UK is leaving it to sort of the standards and allowing the market to create the solutions to an extent. Whereas if we look at something like the EU, the EU, bless them, is putting this into, you know, it's giving it all the whole legal weight. It's putting it into legislation, creating these wallets where you're really embedding a digital identity service into the digital infrastructure of daily life, if you like. And they're enshrining it law, as they love to do, but you've got a government-issued digital credential and digital wallet, and they are building up an interoperability across the different markets in the EU. I guess yet to be proven whether that's going to go smoothly or not, but it's a, it's a very, very different approach. And I wondered if you could just speak to that. Maybe you have a preference for those approaches, or maybe you think there are pros and cons to each, but I'm also quite interested interested in how you think those are going to operate together as well, because there is an interoperability question around that, I think.

You highlight exactly the point. It's always very interesting to watch how different jurisdictions go about any particular issue. So there are issues around the EU approach, there are issues around the UK approach, and that issues the third set of issues in terms of how those two approaches will interact with one another. First things first, the EU approach is going to be interesting because by going through a heavier system of legislation and all of that sort of wraparound is at least interesting when you set that against the level of citizen engagement, public discourse that there's been, and indeed more personally, I suppose, hasn't been across the block on those issues. So again, back to that issue of public engagement. Without that, it almost is insignificant what approach any jurisdiction takes because it's certainly not going to be optimal. The UK approach has, I believe, more potential because it has that sense of a proliferation of possibilities that can— not inevitably will, but can— come through, through having such an approach. But again, as with the EU commentary, without far greater public engagement and connection to what's trying to be done here, it may well not fly particularly high. But what is likely to happen, I think, and it's similar to the approach that's been taken with other elements of the financial services regulatory and legislative framework where we can compare and contrast the UK and the EU, what's likely to happen if it's got right in the UK, is that through the engagement of— the far greater engagement of the private sector, it's likely that we'll see examples, pockets of good practice, pockets of uptake, which then become part of that engagement story, that engagement journey So in that sense, it feels a more promising approach, I think, that we're taking here. It feels more of an approach which fits with how we do things in the UK. It feels more potentially dynamic. But as I say, I caveat everything with it doesn't much matter which of the approaches you take. Without that constant commitment to public engagement to enable discourse and understanding, neither approach will get anywhere near optimal.

One of the things I feel that might be waiting in the wings is the, the big tech solution. So we've already got wallets and apps with, you know, Google and Apple, etc., and it's so much easier easier and more convenient, isn't it, to use the existing digital infrastructure we've got, the things that we're, we're already habitually using. But of course, if potentially, if we were to start using credentials and wallets with Apple or Google, they've got the possibility of locking us into their services, and then we haven't got the sort of interoperability and the choice, the consumer choice that we, we would like to have with our own sort of self-sovereign or privacy-protecting user-centric kind of service. I wonder if you have any points of view on big tech and its possible entry into this area.

Very much so, and you, you put your finger on exactly the issue, as should always be a key driving force for anything at any stage. Doing nothing is not an option, and it should never be an option. We have to individually and collectively choose, decide, determine, and move forward with whatever the issue may be, because if we don't, it will be winner takes all in any particular environment. And Digital ID could go the same way as search, for example. And if we go back to Sir Tim Berners-Lee, in many ways one of the greatest philanthropists ever, to give that technology to the world, it was never given to just become a means of commodification, selling, SEO, and so on. And ID, if left to that environment, will just become commodified. So you will have an ID, and then you'll be tied into that particular ecosystem, whichever entity it is, and you'll find those walls and those perimeters pretty impenetrable, you'll be in that environment. And we're all susceptible to this. For ease, we'll go, oh, well, we'll take their service on insurance, on dog food, whatever it is, because we'll go— but that sense of being able to type, it's, it's the absolute antithesis of interoperability. And really, going to the essence of interoperability, what are we really talking about? We're talking about freedom. This whole issue of digital ID rightly and very quickly should take us into the very essence of the human condition, what it is to be human, what kind of societies do we want to construct. Freedom is absolutely critical to understanding this because if we find ourselves locked into one of those ecosystems, that's not freedom. And to put it in these terms, it's not interoperable. So all of that is quite a long, a long way round of saying we cannot afford to not act and to not act and to not engage at pace on this, because otherwise we will lose, and digital ID won't become an emancipating, a self-sovereign, an enabling aspect of our very human existence. It will become a commodified play as so much of our personal data— yes folks, it's our data— how that has so badly gone over the last couple of decades.

Exactly. I wonder if, just to finish off, I could just ask you, to that point actually, whether you think there are any lessons, good or bad perhaps, or any insights from other places around the world, other jurisdictions, I mean, we've talked about the EU, of course, but we've got the Nordics who tend to embed their digital identity in the banking system. It's associated very much with the banking industry. And then we've got, I guess what I might call kind of startup nations. We've got like Estonia and even Jersey doing some really interesting things with digital ID. But you may, you may have more examples or have a different taxonomy. Are there lessons from these different jurisdictions that we can learn from?

It's interesting how many jurisdictions have gone into this through financial services, and it sort of makes sense because for better or worse, financial services payments proliferate through so much of our lives and our daily experience. Estonia is a good example, particularly in terms of leadership. Why has Estonia been able to get to the place they've got? Because they had a leader who had a background in technology, understood what could be achieved, got a debate going, demonstrated what could be done, and without in any sense underplaying what has been achieved there, demonstrated what could be done when you've got a level of scale where you can really get after this stuff. So Estonia, it's impressive what's happened there, and it's not to decry what's been achieved, but once you remember it's the size of Leeds, so we have a very different scale issue here. It doesn't mean that principles change when you have scale, but scale brings complexity, as we all know. I believe things only really succeed when they're built with the context, the economic, the political, the cultural, the societal context that we have in the UK. So it's clear where we would get this wrong. We would get it wrong if we went for a more command approach. A more designated approach, should we say, to put it no more stronger than that. But if we have an approach where we understand how UK legislation, how the great good fortune of having common law in this country works, how we operate as devolved nations, how we approach connectivity between individual and the state. If we understand all of those elements, the potential that we have enabled through Digital ID is nothing short of completely reimagining that relationship between citizen and state for the benefit of and for the betterment of both.

Well, that is a brilliant way to end this episode. I do sort of cheekily want to ask you one very quick thing, which is, in the next 12 months then, what would you prioritize? What's the one thing that needs to happen from the government or from civic society to make this a reality? Pace.

Everybody needs to be seized of the opportunity And urgency isn't the right word, and it certainly shouldn't be panic or fearful, but it should be a sense of purpose, pace from government, from individuals, from organizations, from communities.

Well, thank you, Chris, for such an inspiring and yet equally reassuring chat on digital identity. It's been a privilege to get to speak to you. Thank you. Complete pleasure.

Thank you very much indeed. And for anybody out there, comments, thoughts, please do be in touch. Love to hear from you on LinkedIn.

So that wraps up this briefing. We've covered generative AI and how it might affect identity verification, for good or bad. We've hinted at some new threats to biometrics. We've had the inside track on digital ID in the UK from Lord Holmes, and you've had a sneak peek into the next episode on generative AI, where we debate the implications for both consumers and citizens. Until next time on The Future of You, this has been The Briefing.

Thank you for listening to The Future of You, hosted by me, Tracey Follows. Tracey Follows. Check out the show notes for more info about the topics covered in this episode. Do like and subscribe wherever you listen to podcasts. And if you know someone you think will enjoy this episode, please do share it with them. Visit thefutureofyou.co.uk for more on the future of identity in a digital world and futuremade.consulting for the future of everything else. The Future of You podcast is produced by Big Tent Media.