The Discussion: Digital Identity - State of the Nations #15

Today we're in conversation with David Birch and Cameron D'Ambrosio. Dave is an internationally recognized thought leader in digital identity and digital money. And Cameron, a senior principal at Liminal, advising companies on the technologies and insights shaping digital identity today. He's also the host of the State of Identity podcast, which I've had the pleasure of being on. I've lost track of the amount of negativity and fear about digital identity in my timelines. People have already chosen their camps. It's the best thing since sliced bread because it will pave the way for more seamless services as they continue to be digitised. Or it's a plan to sign us up to digital slavery, where we are all surveilled 24/7 in a technocratic nightmare. What continues to strike me is how unpopular my own view is with both groups, because I don't fit into either. I can see how a world of digitised public services requires digital identity, at the very least in order to limit fraud and protect digital and physical property and other assets. Even to protect the digital self. But I wouldn't want to sign up to any system. We need one that is privacy-protecting and preserves user autonomy at all times. My worry is that those shouting down the concept of digital ID at all are wasting the precious time we have to decide which is the best system and to advocate for that. By not engaging in the technicalities, and the alternative approaches, we could end up with completely the wrong system for our country, culture, and commerce. It's time for civil society to properly engage. So in this episode, we get the overview of the digital identity landscape. We cover the push towards integrated identity platforms, the demand for reusable identities, and the supply of digital identity credentials. From both big tech and government agencies. The landscape is currently a mix of decentralised and centralised approaches, with the EU in particular claiming to take a self-sovereign identity approach. But does it? Especially in the specific case of the UK, we look at the need for improvement, the importance of convenience for mass adoption, and the idea of custodial self-sovereign identity. One thing all three of us agree on is that trust is a crucial factor in the implementation of digital identity systems in the West today. Hi, Cameron. Welcome to the Future of You podcast. Thanks for joining me today.

Thank you so much for having me. Really excited to be here.

Well, you are the person I always want to speak to when I want to know what's happening in the market for digital identity and where the big trends are. So could you just paint a picture of the digital identity landscape and, um, what aspects there are that make up this, this ecosystem?

Technically speaking, we really like to anchor our perspective around digital identity on the landscape, and that landscape is anchored on what we call the consumer digital identity lifecycle. So starting with how an identity is created, how the attributes tied to that identity are then verified, You can think about the creation of an identity as someone almost handing you a blank driver's license. The verification would be, let's fill those fields in, like your name, like your date of birth, like a photo, like a biometric, have those stamped onto that credential indelibly in some regard. Then you move into authentication. So we've created an identity, we've populated it, you've come in once. Now after you leave, how can we let you back in again and trust all those things we shared about you or that you shared about you? And make sure that it's not someone else imposting you. This historically was the domain of username and password. Now, obviously, we're moving to whether it's FIDO2 passkeys, whether it's biometrics, location-based authentication, browser fingerprinting, all of these things, you know, continuing to expand on the capabilities of where passwords originally brought us. Then once you've authenticated yourself, it's about authorization. So How do we give consent or permission within a system for people to do things? You know, a prime example of this would be you log into a bank, right? For online banking, authorization is about the fact that I only see my account and balances and not Tracey Follows. And then finally, federation, which is how can we kind of encapsulate all of these things that have created this digital identity that I've been using those verified attributes that are tied to me, my methods of authentication, the associated authorization privileges that are tied to my account. Can we make those portable and bring those along with us? This is obviously, you know, tying into where we are in 2023. I think this is the area where we are seeing the most rumbling, if you will, the most exciting developments tying all of these different facets of the lifecycle together. Because historically we have seen piecemeal point solutions out in market and it has been on the enterprise, it has been on the government, it has been on the end platform to stitch those things together into a viable digital identity experience, for lack of a better word. And I think, again, to put a pin in this and maybe let you redirect some of my ramblings in a more cohesive way, We are seeing in 2023, uh, an intense push towards what we at Liminal call integrated identity platforms. The notion that we are moving from these point solutions that are maybe just offering something like passwordless authentication, or just something like document verification, or just something like biometrics, into solutions that tie all of the different toolsets, technologies, and capabilities and integrations required to make the full lifecycle, you know, work within the confines of a platform, offer a single integration that's going to bring all these things together and hopefully drive where we all, you know, want to be. I think, you know, aspirationally speaking, which is a unified digital identity that is privacy-preserving, user-centric, but able to be used across varying degrees of identity assurance. So something as simple as anonymously proving that you're over 21 in order to buy a bottle of wine online, all the way up to, you know, a bank-grade KYC for something like starting a company, incorporating it, and then opening a bank account for that corporation.

What a fantastic overview. Thank you very much. I think particularly for people who don't have much technical background in digital identity, That explains it really, really well. And it feels to me like there's a big shift towards like building the proper infrastructure rather than just having, you know, random apps on loads of different platforms that one might use once and maybe never even use again. Is this the vision for reusable identity as the language states it?

The fundamental questions any platform is trying to figure out to some degree when you're interfacing with it are, Okay, is there a real person at all behind this device or behind this session? You know, so making sure it's not a bot. Then moving beyond that, it's okay, is this person an actual legal person who exists? So can we go to a database of some sort that's authoritative to say you're claiming to be Tracey Follows? Does Tracey exist at all, or is this like a synthetic identity, someone who's been made up completely? And then the last piece is, Okay, you're claiming to be Tracey and we've proven that Tracey is a real person. Now, are you actually Tracey or are you, you know, an identity thief, an imposter? The problem with the market right now is every single, you know, organization that has a need for any of these levels of increasing identity assurance is having to do it all themselves. Now, obviously, from an efficiency and cost standpoint, That's extremely ineffective. You know, everyone is having to pay for a single-use identity verification, which is creating, you know, a negative externality for ecosystems as a whole. Right. Everybody's spending money they don't need to be. But more critically, tightening regulation and shifting consumer awareness, increasing consumer awareness of data privacy concerns. You know, who has my data? How is it being stored? Are really creating a massive liability for these organizations. They don't want to be stewards of your identity data in a meaningful way beyond what they have to do for legal and regulatory reasons, because it is just creating too much of a headache. They don't want to have to put all these controls in place for CCPA and GDPR. And even if it's not a regulatory constraint, they don't want to have the cybersecurity risk. You know, you can be held liable depending on the jurisdiction, criminally and/or civilly for leaking this information out if you get hacked. And, you know, the amount of cybersecurity threats are only increasing. Uh, nation-state caliber tools are in the hands of more people than ever. Uh, these data lakes have turned into kind of toxic waste dumps, if you will, that are just— they're not good for anyone, right? So I think all of these trends are pushing towards the desire to establish reusable identities. And then on the other side of that equation, right, if that's the demand side of the ledger, on the supply side, we have both big tech in the form of Apple and Google, as well as nation states or coalitions of nation states like the EU, or in the US at the state level, organizations at the government level looking to put digital identity credentials tied to an authoritative issuing source in the hands of consumers. Because these governments see the writing on the wall. They're realizing by making the identity records that, that they store, that are the only authoritative, like true authoritative source of truth for identity verification, enabling direct access is only going to drive better outcomes for society. It's going to reduce fraud. It is going to drive better user experiences when governments look to transition to digital services, right? Obviously the government wants you to pay your taxes digitally as opposed to sending a manila envelope full of paper in, because it saves them time and money. Digital identity is a necessary component of that. So I think, you know, in 2023 we're seeing both the supply and the demand sides of that ledger. Really fill up with excitement and progress towards getting reusable digital identities out into the market and usable.

One of the things I've been trying to understand is to navigate through the market for this, though, because even in the UK, we've obviously got the government system of OneLogin, which to some extent replaces our— what we would have known as the government gateway system., and will allow us to access lots of public services that the government makes available to us. Separately, we've got this burgeoning sort of private marketplace of companies and entrepreneurs and startups starting to offer apps where we've got a wallet and we can keep biometrics or credentials, the likes of Yoti and others. And of course, you just mentioned we've got eIDAS in Europe. And I know in the States, and maybe you can explain what's happening in the States, we've got the mobile driving license. I'm not entirely 100% clear whether these are all very similar systems or there's quite big differences, which are truly decentralized, which aren't. Could you simplify it for people or maybe even just explain what the differences and the similarities are between some of those sorts of systems in, in this new integrated marketplace?

You know, in a nutshell, I think there's two main approaches, right? And, and this is obviously a gross oversimplification to some degree, but I think you called this out and it's worthwhile anchoring here, which is you have a truly decentralized approach on one end of the spectrum. Self-sovereign identity is the industry term, uh, is sometimes used. That's a, the notion of a blockchain approach, the foundational characteristics of true SSI being Your identity wallet is like a Bitcoin wallet. Only you can create it. There is no central authority that can revoke it or access it. And I think more critically, similar to a Bitcoin wallet, like if you lose the secret key to access it, there is nobody who's going to come to, to bail you out.

Right.

On the exact opposite end of that spectrum would be a fully centralized system run by a government agency or a private enterprise, and you have a digital identity. But that's similar to— and this is, you know, gross oversimplification again, but it's like a Facebook account, right? It's run on somebody's servers. They are a super admin, which means at a fundamental level, they are going to be able to reset your password for you. But also what comes along with that is theoretically the notion that they could cut off your access, revoke it, modify, view your data, etc. I think what we're seeing out in market is a spectrum of solutions that maybe play not quite at each of those extremes, but somewhere along the line. I'll start with Europe. They are very much anchored with this EIDAS and with the, you know, I've been calling it UD, which I don't know, maybe EUDI is how folks are saying it in plain speech, but this European Union digital identity ecosystem they're building up. They have taken a very self-sovereign identity-centric approach. The true self-sovereign identity heads, who I think are a bit more ideological about these questions, would strongly dispute that anything with direct government involvement can truly be self-sovereign because they, you know, they object to that notion. But the EU is kind of taking it as close to that principle as you can get, which is We are going to build the ecosystem around blockchain-based, user-centric wallets that are wholly in control of the end user. Only they can read and access their data and give permissions for other folks to access it. But critically, they are building the frameworks to allow for direct verification of the initial identity. You know, when the identity is created within the system and you need to verify those attributes. Are you Tracey Follows, are you Cameron Follows, what's your birthdate, what's your nationality, you know, are you, are you French, are you Spanish, etc. Integrations to allow direct access to those authoritative government sources, which personally speaking, this is my opinion, I think is the right compromise, right? Because as much as we all dream of this true notion of self-sovereign identity and complete independence of our identity from any government authority, at the end of the day, we live in a world where you need an authoritative government backing to give weight to your identity because otherwise it's meaningless.

Yeah, it's not anchored, is it?

Then, you know, if I, I appreciate the concerns around, well, what if the government takes away access to your EID? But, you know, if the United States revokes your passport because you're persona non grata for whatever reason, I think you have bigger problems than I can't open a bank account digitally using my EID because they revoked my wallet, right?

So would that be a custodial wallet, the EIDAS one, or Or not, in that it's kind of a decentralized solution, but really somebody's looking after it for you because you don't have your own servers, your own keys, that sort of thing. Is, is it that, or is custodial wallet something different?

Again, they have built, you know, kind of privacy by design into the core of the ecosystem, which I think is really a heartening and exciting development. So, right, if that's where we are on one end of the spectrum with the EU, I will place kind of where we're seeing United States advancements somewhere shifted more towards that centralized approach. We do not have any federal legislation that has passed around digital identity. There is a bill that rattled around the Senate, and its status is currently a bit up in the air, but we have kind of seen in classic US fashion, uh, a piecemeal state-by-state approach to identity. Now, for your international listeners who maybe aren't quite as familiar with this, in the US we have this fundamental aversion historically and culturally in this country to any sort of official federal identity document, despite the fact that we as American citizens are all issued what's called a Social Security card and Social Security number, which is our de facto national ID number, but also treated as the secret PIN code for proving that you're in control of that associated identity. So it's somehow supposed to be both the username and the password, but also we're not supposed to use it as a form of identity. And so we've had states step into the void where all 50 states issue driving licenses, and those have become the de facto national identity card. And the government, through legislation like the Real ID Act, has really tightened the issuing standards at the state level for those credentials so that they can be used for nationally important use cases like air travel. Right. So we've backed into attempting to get a unified national ID card standard through state-level guidance on how states issue a driving license, which again is ridiculous because the assumption that you have to drive in order to have a valid identity is absurd on its face. How this is translated to the EID or mobile driver's license realm is somewhat predictable, which is every state is kind of winging it and going their own way currently. So we have a, a children's treasury of different approaches at the state level. You have some states like Louisiana, for example, that have issued their own state-run and funded app that lets you convert your driver's license into a digital driver's license and then can be used for use cases like in Louisiana, age assurance. Uh, they passed a law restricting access to pornography for anyone under the age of 18. Many popular porn websites like Pornhub require you to use your Louisiana digital driver's license in order to perform age verification. The other approach you're seeing is states that are choosing to ride with big tech. Uh, so Maryland, for example, has announced that they are supporting both the Google and the Apple mobile driver's license ecosystems that those big tech firms are standing up. That's going to allow you to basically onboard yourself to Google or Apple's identity wallet solution and turn your physical ID document into a digitized version. Both of these, again, in thinking about this spectrum we created with fully independent, decentralized SSI on one end and fully centralized on the other, uh, these are much more skewed towards the centralized versions. Again, whether it's the state-level app, which has, uh, again, centralized issuing authorities and revocability around it, or, uh, the big tech approach, which again inherently is putting, uh, control of that credential at the whims of those big tech platforms.

Yeah, you've made me think to ask you actually about Facebook. Do you have any insight into what they're planning? Because obviously they've come out and said they are hoping to bring in, um, well, verification as they call it. Um, do you have any insights into what they're planning to do or how they might be going about it?

Well, um, I do. I have many thoughts here. You know, the first is, and this ties back to Twitter as well, you know, what has been leaked from Facebook, or Meta I should say, across, you know, Instagram and Facebook, is they want to make identity a premium product, which I think in many ways I fundamentally disagree with. And I think it's a Well, both from my personal perspective as well from a business perspective, I think that's a fundamental mistake. This notion that, you know, you have to pay in order to get trust and safety out of the platform is ridiculous. You know, imagine if— and well, I believe Uber did do this by tacking on like a rider safety fee, but imagine if when you got into an Uber it said, hey, uh, do you want to pay an extra $5 to make sure that your Uber driver isn't a criminal or drunk driver? You know, that would be absurd. And I think people would rightfully object to that. I hope that Facebook's announcement and Twitter's announcements that they're going to have these premium products that mean you pay a monthly fee and only in exchange for paying that monthly fee can you tie your account to your real identity. I really hope that's the, the world that, that we don't end up living in. But, you know, let's see how— let's see how the market responds. I hope that, that people are going to push back against that and say, this is something that we think should be done for free. Now, obviously you have a business to run and do you need to make people pay for access to new and exciting features? Certainly there's an argument to be made there. I would argue that at the fundamental level, you know, are you a real person and are you the identity you're claiming to be should kind of be table stakes for operating one of these accounts. And I do think with the major, major global push around age verification for social media applications in particular, it's going to make it a lot more challenging to monetize identity as directly because these platforms are, are really struggling hard right now with how they're going to meet these age verification mandates at scale. Uh, I don't think anybody's really cracked that nut. Proverbially speaking. And obviously that's a fundamental identity question in and of itself, right? In order to answer, is this user above 18 or not, you need to answer, are you a real person? And then get at some semblance of, and who is the person behind this device? And are they who they are claiming to be? You know, are you an actual 13-year-old or are you a 13-year-old who's trying to claim you're your dad? Sitting at your dad's computer.

Dave Birch's thoughts on social media verification have been pretty clear for a while.

A long time ago, I, I think I quite accurately predicted that the most valuable credential would just be that you're a person, not that you're Tracey Follows or English or living on Earth at the moment, right? But the fact that you're a person, and in, in a, you know, I think ChatGPT has accelerated this into the, the mainstream. So I mean, Mr. Musk was getting very exercised about this last year about not knowing who, who were bots and who weren't. Um, so the possession of this is a person credential becomes absolutely vital.

I was going to ask you what you think Twitter and Facebook should do in terms of Well, Facebook's talking about verification. I think Musk talks about authentication.

I personally think they should decouple it. I mean, like, I don't care what Twitter thinks about you. You know, what I want Twitter to do is to maintain the social network, you know, run the tweet system essentially. It shouldn't be up to Twitter to say whether you're a person or not. So what should happen is I go to create a Twitter account or I go to log into Twitter the next time. Twitter bounces me to my bank. I do my, you know, strong customer authentication, two-factor login to the bank. And the bank sends Twitter a credential which says this is a person. End of. That's it. Doesn't say which person it is. Not relevant. Now Twitter can put a tick next to my name that says this is a person. None of their business who I am, right? If I want to put another tick next to my name in a different color, which means I run a business, or a tick in a different color which says, you know, whatever, somebody else provides it. It's not up to Twitter to go out and find out those things. So, you know, and so you end up— they have this kind of black and white verified, not verified. Facebook are going to introduce the same thing. But actually, it's kind of two levels. There's There's, am I a person, which Twitter wants to know. There's, am I Dave Birch, which might be relevant in some cases. Maybe I want to be Dave Birch on Twitter. I don't have to be, but maybe I want to be. And then there's, am I this Dave Birch? And Twitter have no idea whether I'm this Dave Birch or not. And it's expensive and time-consuming to find out, which is why the whole blue tick thing is a bit of a mess. The people that I know I'm this Dave Birch are, for example, LinkedIn. Or consult Hyperion or, you know, whatever. So that credential should come from them, not, not from— you see what I mean? Like, you get, you get credentials from the people that know them. In the case of Facebook, it's the other way around. So Facebook want me to pay them to provide—

this is hilarious, isn't it?

Prove that I'm a real person. It's the other way around. Facebook should be paying me to prove that I'm a real person because I'm far more valuable to Facebook Why should it be up to Facebook to work out whether you're a person or not? That could be done by getting you to log into your bank or whatever else. And the whole real names thing, I mean, I know that's not the subject of today's discussion, but the whole real names thing opens up an absolute can of worms. I am militantly against real names policies. They always end in tears.

Can you explain what that is, Dave? What is a real names policy?

Well, the real names policy is so, for example, my Facebook account isn't in the name Dave Birch. And so if you search, if you search for me on Facebook, you won't find me. But all of my friends know what my Facebook name is, and that's fine because, you know, we post pictures of the cats and whatever, and it's fine, you know. But there was an interesting example I was reading a couple of days ago about Cambodia, where they enforce the real names policy with the obvious purpose of capturing and detaining people who posted So once you've got a list of all the real names, if someone's posting in not a real name, you know it's not a real name, you know it's a pseudonym because you've got all the real names. So then you can go after the pseudonymous accounts, bully Facebook into giving you the details, and then you can arrest people and do whatever you like with them. So real names don't work. And also a lot of the value in social networks, you know, and you know, you have to be careful about this thing because I think about it I mean, I don't want to, but as my kids would point out, I am a person of privilege. You know, I don't care about my name being known on Twitter. And but there are a great many reasons why a great many people would prefer to communicate pseudonymously. You know, if you're taking part in a Facebook support group for, you know, to take a very obvious and emotive example, if you're in a Facebook support group for women who are escaping abusive relationships, forcing you to do that in your real name is really a rather poor strategy, I think. And also, you know, the idea that names are identifiers anyway is stupid. Like, you know, I logged into some, you know, National Savings, you know, you log in, you use your name and your date of birth to log in. I don't doubt for a moment that those aren't unique. But I mean, there's lots of people called Dave Birch. Your name is not an identifier. It's a It's just another attribute. And you can do this kind of probabilistic combination of attributes to try to identify somebody uniquely. But in a properly functioning digital ID system, it would be much better to have the uniqueness maintained separately from the attributes, which, which, you know, was one of the sort of proposals around the idea for a national entitlement system rather than a national ID system, which was my contribution to the last consultation.

Digital ID is starting to take off in the UK, but it's happening amongst businesses out of necessity. Just think about hiring processes, which can be pretty tortuous, and they do depend now on surfacing the truth in a digital environment. Right to work checks that employers now need to carry out require companies to prove an employee's nationality and eligibility to work. This can be bureaucratic. However, if it can be done digitally with remote right to work checks being carried out by, for example, the Post Office, these reusable digital identity apps certified through the UK government's Trust Framework can allow an employee to use their passport and add a facial biometric and therefore have their identity verified within a matter of minutes. According to Eleanor Hull, the Identity Services Director at the Post Office, this has resulted in the processing of thousands of digital right to work checks every single week, with one of her client organisations reporting that they can now process 1,800 checks in the same time. That it previously took to process one. From gaming to banking to retail and any other industry, HR departments can now hire employees much easier and quicker than before. But it's not going to stop at right to work. Tenant onboarding requires ID checks and the signing of important documentation. Now it can be done at the touch of a button, as prop tech firm Openbrix just found out when they recently announced their partnership with the OT, helping to streamline the process, improving the user experience, and limiting the amount of physical documentation. But first, let's take a step back and see what Dave Birch has to say about all this. What is the status of digital ID in the UK? Have we in fact made any progress at all?

Well, where we are is, you know, to be honest, a bit of a mess. It feels like we're making no progress. At all. My wife was just turned down for a savings account at a bank here because her driving license had expired. And it wasn't clear to me why the ability to drive is related to the ability to save, but whatever. Meanwhile, I read in the newspapers that, you know, a money laundering Russian arms dealer gets to pass KYC by using his mom's gas bill from St. Petersburg. So where we are is frankly a mess, hence my inexplicable optimism. So in other words, I do actually think some things are bubbling along. The pressure, certainly in the UK where fraud is completely out of control, it's the biggest crime and we have all of this authorized push payment fraud and all sorts of scams and people and And it's getting steadily more annoying for an average member of the public. You know, I tried to send some money by Barclays, my bank. I tried to send some money the other day. Barclays blocked it, presumably because of some sort of money laundering, you know, whatever. So, you know, normal members of the public are being steadily more inconvenienced. And yet fraud is out of control. It's not impacting the bad guys at all. We have a sort of optimally bad situation at the moment. But, you know, you've got the European Digital ID wallet pottering along. You've got things like Sign in with Ethereum coming out of the cryptocurrency space. You've got more and more, you know, for example, just before I was talking to you, I was moving some money using Wise and they're a good example. They don't use stupid SMS things anymore or sending you text messages. It's all done in-app. I am slightly baffled as to why Facebook is capable of sending me encrypted and digitally signed messages so that Facebook know only I can read them and I know they came from Facebook. And yet, and I won't name them, but I had an email a couple of days ago from a financial institution about some data they needed saying, oh, by the way, you know that it really came from us because we've included the last 3 letters of your postcode. I mean, seriously. So it's a mess, but actually I'm optimistic. I think things are actually about to improve.

And how engaged do you think the public are, particularly in the UK? We're talking really, how engaged are they in some of these changes? How much do they understand the technical details?

I think the thing is for getting mass acceptance of a better infrastructure, It's really all about convenience. You saw this back in the days of when, remember when Apple first introduced Touch ID? And I remember people saying, oh my God, you know, so yeah, I read somewhere that someone in Japan can make a fake fingerprint and all they've got to do is steal your phone and take the fake fingerprint. I'm like, I know, you know, but the alternative is worse. So, so the, so The reason why that caught on wasn't because it offered people better security, but because it offered them more convenience. And we have to get the European Digital ID Wallet or, you know, a UK equivalent into that kind of space. I'll give you an example. I was counterfeited on Instagram recently. So somebody made up a fake Instagram account and took my icon and took all of my pictures and then started sending messages to my followers. You know, saying, well, have you thought about investing in this cryptocurrency? You know, which luckily a couple of people emailed me and said, is this really you? And of course it's not. I would never advise people to invest in anything. And the point is, how is it that you don't know whether a message came from me or not? You know, a couple of generations after we invented digital signatures and encryption, it just doesn't work for the So we have to get to the point where it becomes convenient. So basically when I get a message from, you know, somebody, my bank or whatever, or Meta or, you know, like my app should know whether it really came from them or not. And if the digital signatures all check out, it can display the message in green. And if they don't, they can display them in red, you know. I mean, I wish they could do that same thing for text messages as well. So you knew whether it really came from the bank or not. Of course they can, they just don't implement the technology to do it. So, you know, the route in the mass market is not trying to explain keys and certificates and asymmetric encryption and whatever to the general public. The way is to make it convenient. And I think that means wallets. I mean, I'm probably a bit of a one-trick pony on this at the moment, 'cause I see several trends pointing towards wallets from different directions, payments direction, from the identity direction, from the credentials.

On wallets, eIDAS, the European scheme, obviously they're using a wallet, aren't they? And verifiable credentials. They're saying it's a self-sovereign model. Is it? Could you explain to people what you think the model is and whether it really is self-sovereign? What is self-sovereign? Can we even ever get to that point?

Look, you know, I come from a technical perspective. Tracey Follows. So to me, it's quite straightforward. It's all about control of the keys. If you have the key, it's self-sovereign. If somebody else has the key, it's not self-sovereign. And of course, the people that are fans of self-sovereign say, well, you know, you should put people in control of their own identity. You know, you should put people in charge and that sort of thing, which of course is dumb. I mean, this is because the people saying it are sort of 21-year-old MIT computer science undergraduates who have no experience of the real world. Putting people in charge of their identity is absolutely insane because the first thing they'll do is give it to Facebook for a Mars bar or something, you know. So putting people in charge of their own identity is ludicrous. So, so, and also, I don't want the key. You know, I'm a normal, average member of the public, tragically for the state of our country. And I don't want the key. I lose my car keys. You know, it's— I'm not even joking. It took me 15 minutes this morning looking because I couldn't find where I have a little wallet that's got my American Express card and whatnot in it. I couldn't find it this morning, took me 15 minutes. At least I can find my car keys now 'cause I've got an Apple AirTag on them so I can find those. But you really think I want to look after the keys that are the heart of my online future exit? Of course I don't. I want a responsible, regulated institution I can sue to be in charge of them. And for most people, the obvious candidate is the bank. So the way we get round this is by the idea of custodial self-sovereign identity. So in other words, we use the technologies of self-sovereign identity 'cause we like keys and verifiable credentials and all these sort of things. They're nice and they solve the problem and they work well at a technological level. And then, which of course is meaningless in the general population. So we have to solve it at the mass market level. And we do that by making the keys custodial. So in other words, The bank has the key. And the thing is, so for example, when I drop my phone down the toilet, instead of my whole life stopping, I can get a new phone and go to the bank and get my keys back. And banks know how to securely transport keys and store them in secure hardware because they do it all the time. You have a chip and PIN card in your pocket. I mean, how do you think the keys got into that chip and PIN card? You know, it's the same technology. So custodial SSI, I think, is the way forward on this. Now, if some people want to, you know, custody their own keys, good luck to them. They should be absolutely allowed to do that. And if I want to, you know, if I want to create an identity and take the private key and, you know, put it on a USB stick and wrap it up in tin foil and bury it near the lake near where I live under a tree that I will memorize using a mnemonic that I'll write on a piece of paper and give to my sister in a sealed envelope in the event. Well, good, fine. That's absolutely fine. I mean, don't go whining, you know, when it ends up in landfill or whatever and you can't get it back. Don't go complaining, you know, but, but for population scale solutions, it has to be custodial. And there's two separate parts to that, I think, because one of the reasons why people you know, write outraged letters to the Daily Telegraph about digital identity they don't understand is because they don't understand the difference between identities and credentials. So whether I've got the private key or not is irrelevant in the use of the credentials. So, 'cause credentials are wrapped around public keys, not private keys. So if I tell you that I can drive, you should quite rightly ignore me. If the DVLA tell you that I can drive, you can probably take that on trust. What the DVLA is providing you with is a credential. That credential will contain a public key. How do you know that it belongs to me? Well, you can force a cryptographic challenge against that public key, which can only be answered by the owner of the private key, i.e., me. So you know that it's my driving license, essentially. Now, uh, you are not going to mention anything to the general public about credentials, keys, public and private, nonces, and all this sort of stuff. You're just going to tell them, look, if you have one of these wallets from your bank or Tesco or, you know, whatever, and you go to the pub, you know, it will automatically see whether you're over 18 or not. And that will manifest itself as in you tap your phone on something and either the bouncer sees your face on his phone, which means you have got— you are over 18, you're not barred, whatever. Or he'll see a red cross, in which case you can't get in, computer says no. It's got to operate at that kind of level, you know. Last month, Tony Blair, who used to be a Prime Minister, and William Hague, who used to be not the Prime Minister, published a report on, I can't remember what it was called, but it was something like, why is this country such a mess?

It was A New National Purpose: Innovation Can Power the Future of Britain.

You know, one of their core recommendations is we've got to get the identity infrastructure sorted out, and I agree with them completely. And it was interesting interesting to see how that language has, has evolved since the original Blair ID card proposals, because, because it explicitly says in the report, we're not calling for an ID card, we're calling for an identity infrastructure. I think that's right. And, and there are plenty of people— I'm not the only one, by the way— there are plenty of people who would know how to build such an identity infrastructure in a privacy-enhancing way. And, you know, and actually, to be fair, if you look at what's going on with the European Digital ID Wallet, because they're building it around verifiable credentials, you know, they're heading in that same direction as well.

It's very interesting you say that because I was going to ask you exactly that. I mean, what they say in the report is, to quote, "Implementation of a single digital ID for all residents, allowing them seamless access to services as in other technologically advanced places in the world." but also states that the, rather than creating a marketplace of private sector providers to manage the government-issued identity credentials of citizens, the government should provide a secure, private, decentralized digital ID system for the benefit of both citizens and businesses. And my question to you was going to be, what they seem to be recommending sounds very like eIDAS, I think, but it seems to be recommending against the way the UK have started to go with the approach around the private sector providers who are, who are creating their own apps.

Yes, so I think what they're saying is that the, the, the root or the core identity should be government-provided so that— but you wouldn't actually use that in most cases. So, so the way it would work is, you know, you, you get a government digital identity, so a private key essentially, which is then loaded into your smartphone or, you know, whatever it is. So then I go to see the doctor and to get to see the doctor, I need an NHS identity. So I use my government identity to get my NHS identity. Now, to me, member of the public, I don't see this as being a separate verifiable credential, you know, using a public key, blah, blah, blah. I don't see any of that. I just see, I tap and now I'm in the NHS. What's happening under the hood is that a pseudonymous NHS identity is being generated against that now and then attributes can be attached to that as you go on. Or to take a more private sector example, you know, I go to British Airways and I get my British Airways identity, which is a credential which contains my British Airways frequent flyer number and all that sort of thing. But now I can do this all online and effectively because they've got the government digital identity. So, so, so I don't use my government digital identity to book a flight. I use my British Airways identity to book a flight. But to get my British Airways identity, I use my government identity. Now, if I want to tell British Airways and Sainsbury's that these two identities are the same person, that's entirely up to me. That's my But you should construct the system in such a way that because the keys that will show up in those identities are different if the system's designed properly, you know, British Airways and Sainsbury's can't collude behind my back to see which, which, where are the shared keys between the two people. That wouldn't work. If I tell them this is me for the purposes of Nectar or Avios or whatever, that's fine. But they shouldn't be able to do it behind my back. So I think what Blair and Haig are saying actually does make sense. So you need an underlying core digital identity to make it efficient for you to get the other identities that you actually need on a day-to-day basis. And it's up to the industry to design that infrastructure so that it can't, you know, look at what happened in Australia. I mean, I'm because I've been writing a lot about this recently. So Australia is a very good— they've had a couple of massive data breaches, you know, Optus, the telco, and everybody's passport details got stolen. And you think, well, hold on, why is the phone company got copies of your passport details? Of course, it's some idiotic government regulation about KYC and all this sort of thing. But now imagine it in the model that Blair and Haigh are sort of talking about. So I go to the phone company, the phone company need to know that I'm a person, that I'm resident in the UK, that I've got a bank account, you know, all this sort of thing. So they basically obtain those credentials. But we're intelligent about how we design and implement those credentials. So in general, what those credentials are providing is proof that the data is there, but not the data itself. You know, you can provide a cryptographic proof that I'm a British citizen, without having to store a picture of my passport. So I present my, you know, I need to get my telco thing sorted out. So I present, I don't know, my bank identity or what, it doesn't matter, you know. And they say, oh, you've got to prove that you're British. I don't know why you would have to do this, but, but let's say for some reason Virgin need to know that I'm a British citizen. So I present them with a credential from the passport office which says I'm a British citizen. It doesn't say who I am or, you know, it just says I'm a British citizen. And again, this all has to happen under the hood. You know, this, you know, consumers don't get involved in these. Consumers just have their wallet. They can go to the doctors, they can pay their phone bill, they can do whatever else they need to know. But under the hood, you know, we need to make sure it works in a privacy-enhancing framework.

So where does OneLogin fit into all of this then?

Well, that's a different thing. That's, that's basically, that's the single sign-on for government services, which again, in itself is a good idea. I'm not quite sure how far they've got. I sort of lost track of things a bit because it was, it was in the department for something or other and then it was the, then it was in the DCMS and then they were going to have a joint DCMS Cabinet Office thing and then they moved it into the, I don't know, the Ministry of Meat and Two Veg or whatever it is at the moment. So I've sort of lost track a bit on where all these things are, but I think there's going to be a single sign-on for government. Services, which completely makes sense. You know, I was at a, I was at a conference a couple of days ago. They were talking about, it's to do with fraud detection actually, but it doesn't matter. The point holds. And one of the panelists was from Finland and she thought it was astonishing that apparently in Finland when you move house, you log in somewhere and say that you've moved house and that's it. And they tell, you know, the gas company and the phone company and the post office and whatever. And it's all, I mean, she thought it was baffling here that you didn't have an identity to log into government services. And so I actually am very positive about, you know, when you look at what's happening technologically around EU ID wallets, custodial self-sovereign identity, this kind of thing, zero-knowledge proofs, this stuff about all of these things are kind of really providing a much bigger toolkit And then you've got people like Blair and Hague saying at a much higher level, actually society needs these things. You know, if the government proposed introducing, you know, the Chinese digital identity system or even the Indian identity system, you know, I'd be writing stern letters to the Telegraph as well. These originate in different cultural contexts and they're not appropriate for us. Absolutely, I agree with that completely. Does that mean we shouldn't have digital identity? Well, of course not. You know, and so I think, you know, if you look at the sort of bell curve, it's probably pretty polarized. You know, like you've got 5% of people who are militantly against identity, whether they understand it or not. You've got 5% of people talking about the Daily Telegraph again, who sort of remember fondly the paper identity cards that we had in the war and were rather sorry to see them go in 1954 and would like to have them back again. And most people in the middle haven't got a clue. And if it makes life easier for them, they'll use it. And if it doesn't, they won't. End of.

Every time Tony Blair gets up, which is really quite often, to talk about, well, we all need digital identity. Unfortunately, he is not a trusted person to deliver that. And so every time he speaks on digital identity, certainly in the UK anyway, actually the trust seems to reduce every single time. So I don't think it's doing the sector any favors. I do think it's interesting that we don't really have, at the moment, the right kinds of ambassadors for the audience, I think. So it's difficult to communicate them a trustworthy message.

You stole my thunder with the Tony Blair joke. I was about to make that exact same comment, right? These systems are only as good as the trust placed in them. And I think it's a perfect example of we need to think long and hard, and I think these platforms need to think long and hard about Who are these ambassadors that are going to be used to bring these to market? And in an era where unfortunately, I think public trust in anything, quite frankly, is at an all-time low. I mean, it feels like you can't walk down the street and ask 10 people what color the sky is without getting some divergent answers in some regards. So I think this ties back into this notion of this education piece. How we are rolling these platforms out, how we're messaging around them, is going to be really, really critical because— and this is something that I neglected to hit on when kind of talking about this current landscape— whether it's the EU with EIDAS 2.0 and eID or the US and that nascent federal legislation that I referred to that was in the Senate committee, you know, both of these major ecosystems that are being talked about are explicitly stating, uh, that they are going to be opt-in, right? Um, I do not foresee any future within either the US or the EU where there is the political will or feasibility to make adoption of digital identity credentials mandatory. Um, that's enshrined specifically in the eIDAS 2.0, the latest draft, as well as in what I would expect to see out of any federal legislation or, quite frankly, state-level legislation, which is this enshrined right of I do not wish to have a digital identity credential and will not be forced to adopt one. So I think what this long tail of consumers who refuse to adopt digital identity over a physical identity credential, you know, how big and how long that long tail lasts is going to be up to us as an industry to, to your point, pick the right messengers, nail this consumer education piece, and really make sure that, you know, we're designing these ecosystems in ways with fundamental privacy built in at the ground level, and then explain that in a way that people can understand and with a trusted messenger so that they actually, you know, believe these assertions.

So where does that leave us in the digital identity landscape? What do you think lies ahead?

I think, look, you know, keep an eye on the continued development of the UD, European initiatives in particular, and big tech here in the US. You know, I think those are really the leading indicators of how ready are we as a market for the adoption of EID. For mobile driver's licenses and, and look to see, right, how are consumers responding to this? What is the state of this consumer education? Uh, because I think that's going to be a major bellwether for how aggressively this growth curve starts ticking up. So I think this is going to be a really impactful next 12 months. Uh, and maybe we can circle back sometime in the future to check in on some of these predictions and see how we did.

Thank you for listening to The Future of You hosted by me, Tracey Follows. Check out the show notes for more info about the topics covered in this episode. Do like and subscribe wherever you listen to podcasts. And if you know someone you think will enjoy this episode, please do share it with them. Visit thefutureofyou.co.uk for more on the future of identity in a digital The World, and FutureMade.consulting for the future of everything else. The Future Review podcast is produced by Big Tent Media.