The Discussion: Inside the EU's Digital ID Wallet #17

Welcome to The Future of You. In this week's episode, we take a deep dive into digital wallets. Regular listeners will know that I usually have two guests on to discuss an area of identity that is undergoing digitization. It could be conceptual, such as digital twins or second selves, or it could be technical, such as biometrics or reusable digital IDs. When I spoke with Andrew, I had intended for him to be one of two guests, but our conversation on the European Identity System ended up covering both the technical aspects as well as the ethical and conceptual. And I have preserved the whole conversation. So Andrew gets an episode all to himself. It makes sense because this is an important topic, both in newsworthiness and in terms of citizenship. The public need to know more about digital identity systems and to be encouraged to engage, in my humble opinion. So this episode is perfect for that. Andrew runs the European commercial business for Jen's new Digital Trust Services unit. And he's also responsible for GEN's eIDAS strategy, which makes him one of very few experts in this area who can convey in clear and simple terms what eIDAS is, how it works, and why we need it. Or more accurately, why the European Union needs it. I have also included a link in the show notes to his articles and blogs on the subject should you want even more detail. In this show, we cover the difference between identity cards and digital wallets, and the key role of verifiable credentials; what the implications are of choosing the right versus the wrong way to prove your identity; why digital credentials are more secure than paper documents; trust lists; the future of trust, both within and outside of the EU, and interoperability across nations and regions; self-sovereign identity; the spectre of Big Tech; and the future of credentials in general. I hope you find it as absorbing as I did. For now, over to Andrew to explain why we shouldn't be talking about digital identity, but we should be talking about digital wallets. Andy, thanks for joining me on the podcast. It's great to have you here.

Thank you very much. Nice to be on.

What I really, really want to talk to you about is eIDAS and what's happening in Europe with wallets and digital credentials, but I wonder, before we start that, whether we could just get from you a point of view about why digital identity is so important in 2023 and beyond and what your views are around it, because obviously you've been working in this space for a very, very long time.

Yeah, I think what we're looking for is a return to normality, if you like. So the way that we used to identify ourselves is we would carry our own documents with us, like a passport, driving license, even a credit card, a gym membership. You carry them physically with you and you go and present them where you needed to present them. And once you present them, you get them back and you go off and do your thing. And then this digital age came upon us and there wasn't an equivalent of doing that. So what would happen is instead this new paradigm emerged where you go and sign up for an account somewhere with someone. And they would hold your information. Then you'd have to sign back into them, but you couldn't then use that information anywhere else. And we've become beholden to these account holders that have our information. And rather than me wandering around with my own digital equivalents of my paper documents, my plastic documents, instead I have to sign into someone who then does something on my behalf. So it's a strange way that things have evolved in the digital world because there hasn't been a way for us to carry our own digital documents with us. That we've got this bizarre thing with accounts and then you've got passwords and then you've got two-factor authentication and click all the squares with bridges in them and et cetera, et cetera. And it becomes very, very annoying very, very quickly. So What we're looking for is a way to get back to how we were before, but in the digital world.

Mm. So can you understand why some people are suspicious when they hear the words digital identity, particularly in the UK, where we've never had an identity card? Very different with our common laws to the sort of Napoleonic laws. Do you have any sympathy for that point of view?

Yeah, I think firstly, we need to knock on the head this identity card 'And instead think of digital equivalents of the documents I already use that I'm comfortable with.' And once you think of it like that, you think, yeah, why haven't I got a digital version of my passport? You give me a physical one, you get a physical ID document, well, why can't you have a digital one at the same time? Okay, you're paying for it anyway for a passport, driving license, and so on, birth certificate. So I think there's a difference between this concept of an ID card, and we'll talk about that more when we go into the world of IDaaS, and digital credentials. So I think we need to get away from thinking about ID cards and digital ID and get towards thinking of digitized versions of the credentials you've already got. And once you think about it like that, you think, well, it's just the same thing I've got now, and I can present it in the same way, but with with better privacy and better security. And that then is a bit of a game changer. But to know that, you need to know about the space, I guess.

That's really interesting you say that because I'd written down here actually, should we start thinking about the credentials economy rather than digital identity as a way to try to explain some of this? Because I noticed when the Blair-Hague report came out and it was reported in the UK media, the UK media immediately, all of the headlines were about a digital identity card. And it so obviously wasn't. I mean, they literally talk about a wallet. It wasn't a digital identity card. So I wonder if we should just get into that then. But before we do, could you explain the UK's approach to digital identity? Well, at the moment, and how that might be different to what Europe are doing. And then we can get into, you know, explaining a bit about what the eIDAS system in Europe is all about.

Yeah, I'll have a go. So the UK had an attempt to provide people with digitized identity information. It was called gov.uk Verify. And that involved the government contracting with a bunch of identity verification partners who would do some quite stringent ID checks in order to then create for you an account that you could log into and then verify yourself to other websites and so on. Called federated identity is the approach. Now, the irony of doing that is the government was paying these identity providers to verify documents that the government had themselves issued, which is somewhat insane. So the government issues a physical document, and then pays an identity provider to verify that document the government has issued. So that identity provider can suddenly set up an account for you. Anyway, it didn't work. Not surprisingly, a lot of people spent a lot of money to create systems to support it, and it just didn't happen.

The take-up was very small, wasn't it?

It wasn't that small, but the usage was very limited because there was only one type of dataset. There was one fairly small dataset. Which is usable only in a relatively small number of use cases. Whereas compare that with an open world of digital credentials that we're going to talk about, where, you know, with my physical wallet, I can put any bit of paper in there I want to. The digital credential world is much more like that. So now the UK government's moved away from this VeriFi program to a new approach of creating a trust framework that says, you can get certified as an identity provider by following these rules. And that's resulting in organizations being certified as trustworthy enough, if you like, to follow the rules and provide identity verification services. Very, very different to eIDAS.

Okay, so what is the most significant difference? Is it that it's a government-issued wallet with eIDAS and it's the private sector who are taking part and being held to these standards. Is that the difference or is it something else?

Yeah, there's quite a few differences. So firstly, IDAS is the biggest digital credential initiative in the world at the moment. And it's a lot more defined. So part of it is legislation. So there's legislation going through the European Parliament at the moment that will enshrine in law the legitimacy of a government-issued digital credential. And also all of the processes around issuing that credential and certification of wallets, et cetera, et cetera. So there's a legislative approach that will give an IDAS government-issued credential called a PID, by the way, personal identity data. It will give that legal legitimacy. And it has other legal weight as well, such as, although I should point out the legislation is moving around still at the moment, but organizations being mandated, or let's say strongly encouraged to actually accept these IDaaS credentials as well. So private sector organizations. As well as public. So that's one angle of it, is it's being enshrined in law. The second angle of it is the technical operation of this credential ecosystem is being defined at a very precise level. It's still early days, and one of the complexities of IDAS is the legislation and the tech are moving at the same time parallel to each other. And that makes for quite an interesting environment because the tech has to reflect the legislation and implement it. And the legislation can only legislate for things that can be implemented technically. So there's quite a lot of jostling going on at the moment. But essentially, IDAS is creating both the technology stack and the regulatory stack for this Europe-wide digital credential ecosystem. And very interestingly, whilst it's being led by governments, it is open completely to the private sector as well. Because this is IDAS 2.0. IDAS 1.0 was a bit like GOV.UK Verify. It's very restrictive, hard to get into, federated identity mechanism that didn't have many uses outside some restricted government use cases. Whereas IDAS is much more of an open ecosystem where they're putting in provision to allow anyone to add any credential of any sort, within some limits, into this IDaaS wallet. So it's really a full end-to-end ecosystem solution.

How are they managing the fact that different countries have different identity systems already? Are they, are they insisting that they all move to one new system, or is this a new system that is encompassing and very forgiving of different versions, if you like?

Yes, so one of the drawbacks is that there will be implementation at the member state level, and that could allow for variances to come into this, what would otherwise be a nice cohesive interoperable ecosystem. However, they are setting down a standard for what an identity credential looks like. So this will be your official government identity credential. Okay, so there are standards about how that is going to be set up and who can issue it and how you get certified to issue it and the meaning of it and the data in it and so on. So there is a lot of standardization happening. There is also the creation of a reference implementation of the IDAS wallet, which will be open source and can then be taken and implemented by each member state. Accordingly. So member states can either build their own, they can subcontract to somebody else, or license somebody to create one or more wallets. So it's quite an interesting situation at the moment, where there is, in a typical EU way, a really strong desire to have commonality and interoperability across all member states. But there are some gotchas for local implementation, and it remains to be seen how those play out.

Now, when you say issued with a credential, how do I get that government credential? Do I have to go and show my birth certificate somewhere? Is it replacing what would have been an identity card unique number? What is the credential?

Well, the first thing to recognize with it, with IDAS, is you can get your IDAS wallet and you can fill it with all sorts of credentials without ever having to go and see the government. Okay, so you can use it without putting any government credentials in it, and that's a huge leap forwards. I wrote an article on this called No PID, No Problem. So you could actually use, use it without one of these PIDs. The PID, however, is a bit like going and getting your passport or going and getting a birth certificate. You know, it's an official government document, albeit in digital format. And the data that's in it, there's a mandatory data set and then a bunch of optional elements. So there's things like your name, your date of birth, Interestingly, a unique citizen ID number, which we should come on to about unique reference numbers shortly. So there's some mandatory attributes as part of it. And in order to get it, there will be processes in place that follow a level of assurance high, as it's called, to go and obtain it. So how that is implemented, again, it can vary country by country. And it will be fairly frictionful to obtain one of these, which is by design. You don't want to just have people being able to fake it very, very easily. It will involve production of evidence that you are who you say you are. So this is already in place with IDAS 1. This level of assurance trying to get an IDAS 1 account with an identity provider. Here, when you run through similar processes by showing various documentation and so on, And then rather than getting an account with an identity provider, you'll be issued that PID credential into your wallet. But yes, it is worth emphasizing that you'll be able to use your wallet without having a PID in it. When your wallet does get a PID, and PID's such a horrible expression, isn't it? Personal identification data, identity data. Once you have got that, your wallet, it goes into a different state, which is called a valid state. Becomes a sort of government authenticated, if you like.

Okay. How are the Nordics doing this? Because their identity systems seem to me to be much more affiliated to the banks and has come out of the banking industry. So how is that going to work if they, if some or all of them become part of IDAS?

Yes, well, we're working very closely with Nordic governments. Myself and some chaps from the government of Sweden set up a large-scale pilot consortium called the EU Digital Identity Wallet Consortium, or EWC for short, which now includes a number of other governments as well. This is getting European Commission funding to run large-scale pilots of IDAS2. That includes the Finnish government as well, for example. So they're looking very closely at this. It also includes a number of BankID-type providers as well. And I think you need to look at different sorts of use case. So BankID is typically used if you, I don't know, if you go to a retailer, for example, and you need to identify yourself, you can have login with BankID. So it's a federated approach. You go to your bank or the BankID provider, you log in there, and they go back to the retailer and say, yes, Andy is Andy. In this new world, you'll be going to them with a credential that says Andy is Andy. And there's nothing stopping the bank ID providers issuing credentials into your IDAS wallet.

So let's talk about the wallet then. What's in and not in the wallet? Can anything, anything possible be in the wallet now? Is that how much IDAS has evolved?

Yeah, I think so. Theoretically, Yes, without going into the depths of the technicalities of it, the team who are doing the design, which is called the Architecture Reference Framework, have been really responsive to feedback from the industry and folks like me and so on, who say, look, don't make this a government-only thing because it will fail if you do that. You need to open up for innovation. And the way you do that is you allow organizations to have credentials for anything within this wallet. So, so the way they've done things is they've created two configurations within the wallet so far. There could be more than two. The first configuration is one that's really dedicated towards official government credentials, and the second configuration is much more flexible and includes W3C Verifiable Credentials. In fact, the first config includes that as well, but it allows a lot more flexibility around who the issuers of those credentials can be, how they're locked into the wallet and so on. So it really opens up for innovation. It's early days yet. I mean, there is no wallet, there's no IDaaS wallet yet. There is a consortium which has been commissioned by the European Commission to build the reference implementation, which will be open source, so anyone can play with it and try it. And the actual wallets themselves, they will have to be certified as conforming to a set of specifications and capabilities. So you're not going to be able to have Andy's little backstreet hacking organization creating an IDAS wallet just, you know, from nowhere. Any wallet that a PID is going to be issued into is going to have to be a certified IDAS wallet.

Who's going to do the certification?

Yeah, so there are certification bodies in member states already that will do that. And again, rules still coming out for exactly how that's going to work and what the certification will look like. But the idea is to give citizens a really good level of trust that this is a legitimate wallet, and it will behave in the right ways. And that leads on to a number of other implications for what the right ways might be and what happens when things go wrong. So I think to bring that together, you're going to be able as a European citizen to get from your government or a government-approved supplier an official digital wallet. With certain capabilities in it that will be usable for public and private sector use cases, which opens it up for all sorts of use cases that us in the sort of digital credentials, self-sovereign identity world have been looking for, for ages.

Do you consider IDaaS to be fully self-sovereign then?

I don't think so. If you think of a spectrum from a fully centralized account, uh, like Facebook or Apple or Google, where they, they control it, or Twitter, where they control the whole thing, um, and they can turn you off at any time, to full self-sovereignty, where there is no central control, everything is decentralized. Then any solution implemented is going to sit somewhere along that spectrum. And with IDAS, we're seeing quite a degree of centralization coming in around the governance of the IDAS ecosystem. Someone is going to need to manage this trustless. Somebody is approving a wallet. Um, somebody is, uh, defining the fact that a PID has legal status and something happens if it goes wrong. So there is a, a degree of centralization. That's even before we come on to the technology and who runs the verifiable data registry and who runs the trust lists and so on. So it's definitely not at the extreme SSI side of the spectrum, but it's a long, long way from the centralization side of it. I think we need to see the implementation a bit more and see how different member states implement to determine how centralized it becomes. But the big difference is that you're getting your data deployed into your wallet that is on your device that you then manage. That's a big, big difference from having your data held hostage, if you like, in some central database. You're getting given a copy of it that you can use at different places, and you shouldn't be able to be tracked when you're using it, and you should have full privacy when you're using it. So from that perspective, it is much more down the SSI side of things. But the human governance and regulations and so on will pull it back from full SSI infrastructure.

Can you give us a use case on, you know, who would be a verifier and who would be an issuer and what actually happens in the use of the wallet and the showing of a credential in a situation, like an everyday situation?

Yeah, I think the easiest way to think of it is what have you got in your wallet at the moment? So let's say I've got my employee ID from my organization. So in that situation, in order to issue that ID card, that physical ID card, the employer has to know who I am and, you know, have a picture and all of that kind of information. And then they print out and issue that employee ID card to me. So instead of printing it onto a physical piece of plastic, they can take exactly the same data and put it in a credential and send it into my wallet. And how that might look is, on a work system I'm already authenticated into, let's say, you scan this QR code to get your employee ID on your phone, and you scan it with your wallet app, it pings up and it says, here's your employee ID, and you're done, right? When you want to use it, let's say your booking a flight with your employer's travel agency and you need to prove that you're an employee, they might have a QR code there that says scan this to prove who you are. That sets up a connection with your wallet. Your wallet will then pop up and say, please share the fact you're an employee of GenDigital. And you don't get to know any other information, but I just share that and they get that and they can verify it's authentic. So that might be an employee ID use case. You might have another use case, which is a construction worker needs to prove they're certified to run a tower crane, for example. So they go to their new site, they've got a wallet full of credentials. One of them happens to be their tower crane certification issued by the Tower Crane Certification Board, wherever that may be. They go to the new construction site, there's a foreman there who's got his phone, and he pops up a QR code saying, please provide your credentials. The tower crane driver His phone goes ping, foreman wants to know this, this, this, this, and this. Do you want to share it? You say yes. So you're sharing under your control. You share the data to them. They get lots of, they get a picture of your face, the certification, and most importantly, they're able to see that the training authority that issued this certificate is the one that has actually signed and okayed it. So that might be another use case. So it's, you know, in this world, many, many use cases, anywhere where you're proving who you are or what you are or what you're entitled to could be used. And what's more interesting is if you have to prove that you're a tower crane driver that works for a particular employer, it's going to be very interesting to see how the wallet tech is going to come along to allow you to combine multiple data attributes from different credentials together to do those things that are really painful for us often. Like, have you got a bank account? What's your address? What's your, I don't know, Social Security number? Bringing lots of different identity elements together or entitlement elements, whatever they may be, to prove in one go something that typically, with paperwork, would take you ages.

This is very important, isn't it? Because what it's doing is verifying that you're a person and then verifying some facts about that person. But not identifying the person. And I think this is where one of the misunderstandings about this particular model of digital identity anyway comes, that people think they're going to lose their anonymity or potentially they're going to be tracked. I mean, maybe you can talk to that for me, but that somehow they're going to be identified as a particular person, whereas that's not what's happening here with this system, isn't it?

That's right. It's a really important point to make. This digital approach is actually much more private and secure than a paper-based approach. So a good example is the well-overused "Are you over 18 to enter a nightclub?" type thing, where normally you might go up and have to show your driving license. And I've experienced in various different countries, you show a driving license, they actually take a picture of you, of the driving license, so they can prove that they checked who you are, but all they're looking for is the date of birth, but then they've got your home address and they've got your picture, etc. And it's really, that's really dangerous because there's no other way to handle it with physical plastic driving license unless you have, carry a little card with you with little cutout windows on it to put over the top of it, which they probably wouldn't accept anyway. In the new world of digital credentials, you can do what's called selective disclosure. And you can reveal only the attributes you need for a particular transaction. So in that example, I could reveal a picture of my face and not even my date of birth, but an over 18 or an over 21. So this capability is actually in the legislation. It says things like selected disclosure must be supported, and that makes it really powerful and a lot more private than actual paper documents that everyone is already comfortable with. It enables you to prove things about yourself without revealing too much information that you don't want to reveal.

Now, what about tracking? Is that possible at all with the, with the technology and the regulatory framework?

There's been a lot of debate about this. Some of the initial legislation drafts included unique identifiers for the wallet. So that's like in your physical wallet having a serial number on it that every time you use it you have to share. That would be very, very bad because that is a unique tracking number that follows you everywhere. And everywhere you used your digital wallet, organizations would see 12345 and they would associate that with Andy Tobin. And then the next one I went to, if I was using selective disclosure, they would associate it with a man who is buying some camera equipment, for example. And then the next place is a man who's over 18, who's buying some Finnish gin. So you could start to build up a picture because that unique number ties everything together. There was a lot of pushback against that from folks like myself and other people who are steeped in this world of the danger of unique identifiers. So, and happily I can report that that has been taken out. I need to check the legislation again to make sure it doesn't go back in. And I think we need to differentiate really clearly between unique identifiers in a credential as an attribute, like, for example, a passport number, and unique identifiers in the, what I call the metadata, the protocol, the information exchange that you can't see, you don't have any control over. So of course, there will be unique identifiers in credentials because you have a driving license number already on your physical credential, you have a passport number on your passport, you have an employee ID number, etc. But if you're using selective disclosure, you're able to share details from your passport without necessarily sharing that passport number. Of course, if you were crossing a border, by law, you would have to share your passport number, but it's very different with an official border crossing type example like that versus, you know, me at a shop. So there will be unique identifiers in credentials as attributes. And that is actually part of the PID. There's a unique identifier, citizen ID number in the PID. But that doesn't mean you share everywhere. The danger is about unique identifiers in metadata, like a wallet ID. For example, that are shared everywhere you use your credential and that act as a unique correlator for you. And that's very much like a supercharged version of a Google ad cookie or ad ID. So we need to make sure that doesn't happen. Unique identifiers in metadata are really bad. They can be used to correlate you and track everything you do. So it looks like they won't be those will not exist in the IDAS world, which is great news. But again, still early days as the— there is no wallet yet, so we can't check this. So we need to see what the first version of the reference implementation of the wallet looks like to verify that that is the case.

Without any unique identifier in the metadata like that, can the government identify your wallet and then, like, revoke it? I mean, do they have that power, or is it really not within their gift to do that the way in which it's been structured and set up?

Yeah, you're hitting on the exactly the right points here, Tracey. So one of the reasons they wanted a unique identifier in the wallet is so they could revoke wallet. And a number of us were aghast at that because my wallet, as we now know, is going to contain all sorts of credentials. Not just government ones, but private ones to me, employee ID, et cetera, et cetera. So the government revoking my wallet would be a bit like me reaching into your pocket and taking your physical wallet with all of the stuff in it, just to revoke your driving license. Okay. So rather heavy-handed and not very sensible. So that looks like it's gone away as well. What's in its place is change of wallet state. Okay, so your wallet can be operational, in which you can put any private sector credentials in it that you want, but when you put a PID into it, the wallet becomes a new state called valid. It becomes a legally valid thing. So there was a really long, interesting argument, discussion, debate around whether you revoke the credential or you revoke the wallet. And thankfully, revoking the credential has won out, which is definitely the way you should do it, because it allows the other credentials to operate. So if the PID is revoked, then the wallet changes state from valid to operational. It doesn't mean nothing else can be used, it just means you haven't got a PID in there, okay? And that's a really important differentiator. There's no detail yet on how revocation is going to happen. And revocation itself is a really tricky thing to get right because revocation can be a privacy-leaking process. If I publish somewhere a list of all the revoked PIDs, then anyone could look at that and go, hey, Tracey Follows Follows has been revoked. Oh dear, that's naughty. What's she been up to? Right? So you can't publish a list anywhere in the open like that. So the question is then, if I'm using my PID somewhere, how does someone check if it's revoked or not? Well, they need to check a list somewhere. How do they check that list without revealing all of the data in the list? Okay. And without, when you share your PID, if you share the metadata, a revocation ID for that PID, that's a unique identifier in the metadata. And as we know, you shouldn't do that. So there's a bit of work to do on revocation. There are some really interesting anonymous revocation protocols out there. This is a really thorny area, but it's one where IDAS is going to stimulate a huge amount of innovation because, you know, there's so much to be gained here that there will be amazing cryptographers working on this, mathematicians figuring out how to do it, make it work at scale of hundreds of millions of people and so on. So it's going to be amazing to see what evolves over the next couple of years.

Yeah, it is. Yeah, it's just going to be a big new ecosystem and new industry, isn't it? Like, when the car was first invented, it was just the car, wasn't it? And then, you know, MOT certificates needed to be done, so then you've got people setting up garages and stuff, and the whole system then flourishes, doesn't it, as new services, I guess, start to be added on as you start to realise what is required to like maintain it. Is this the end of passwords and usernames and username identifiers? Can we do without these and do away with them now?

So the answer is, I'm going to say yes, because if you have a digital wallet of this sort of capability, you can absolutely get rid of usernames and passwords. And the wallet itself acts as a two-factor authentication device as well. Okay, so it is definitely possible. It also will let you sign digitally signed documents like contracts as well. As you know, at the moment it's a bit ludicrous. You get a PDF and you can scroll on it with your finger, right, and send it back. So there will be an ability to sign as well. So once you can digitally prove who you are, there's two steps here essentially. There's one which is onboarding. So you onboard to a a new, I don't know, so you're online shopping, it's a retailer or it's your employer or something, you onboard by proving various things about you from data you have in your wallet. Just like you go in your filing cabinet and you pull out bits of paper to prove you've got some A-levels, whatever it might be, university degree, et cetera. So you use that information to onboard digitally in 10 seconds rather than 10 days. And then once you're onboarded, the wallet will enable you to be recognized instantly when you go back. So it's perfectly feasible for, let's say you're onboarding to that retailer, for that retailer to give you a credential into your wallet to say you're a customer. And then when you go back, you just say, well, here I am, here's the credential you gave me previously that says I'm a customer with this customer number and delivery address, et cetera. So absolutely, getting rid of usernames, passwords, capture codes, etc., is definitely, is definitely on the cards.

Are we going to need to use a biometric or maybe even more than one biometric?

The answer to that is yes. It will depend on the seriousness of the transaction you're doing, the level of assurance required. So the wallet, you'll need to open your wallet with probably the on-phone biometrics. Okay. But there may be other situations where, as you execute the transaction, you need to know that the person who is executing it, that has hold of that wallet at that time, is the right person. So it's a remote transaction typically, and you need to make sure Andy is Andy who is pressing his finger. You know, I can register other people's fingerprints or faces on my phone if I want to. So at that particular moment in time, you want to check that the person holding the phone is the right person. And for that, you can do a biometric comparison with a passport photo, for example, that is also digitally held in the wallet and send an okay back. So not 100% sure if that's going to be implemented in IDaaS yet, but I can see it happening for those high assurance transactions.

And anonymity, is anonymity going to be possible everywhere? That you would want to be anonymous without any restrictions?

So that is the plan. So in the legislation, there are a number of clauses in there that reinforce that. Now, for particular use cases, you will have to reveal who you are, and that's, that's fine. So if I'm— I want delivery to my address, I'm going to need to give them my address. Right. But if there are transactions where that's not necessary, then it will definitely be possible for you to just share the minimal amount of data you need. Now, what's going to be really interesting is how the legislation manages what relying parties or, you know, what relying parties can ask for. So the relying party is the organization that's asking you for the data. There is talk of relying parties having to register somewhere with someone somehow, okay, in order to be able to send requests to, to an IDAS wallet. So that's going to be really interesting to see how that merges. I think it would be sensible to have organizations register if they're asking for what might be deemed sensitive data, like data from your PID. But if I'm just a gym and I want your gym membership card, then that's probably fine. So I think we'll see different levels of relying party registration from none to quite a lot. And as you said earlier, it's part of this ecosystem evolving. There's going to be a registrar somewhere. How does a relying party apply? What do they say about what data they want? Who do they apply to? Does it cost them any money? Who is the registrar? Who pays them? How do they work? There's going to be a list of relying parties somewhere. Where's that list? Who runs it? How secure is it? If someone hacks it, what happens? So this concept of what's called trusted lists, which is, is built into IDAS, is really important. If there's a trusted list for relying parties, who operates it and what controls are there on it? Because there'll probably also be a trusted list for issuers. So who is allowed to issue a PID? As a hint, that would be a government in a member state. But if there's a trusted list and someone hacks it and adds Andy Tobin's corner shop as a trusted PID issuer, then it's going to be really bad because I'll be issuing PIDs for 20 quid a time and becoming very rich. So trusted lists are, under the skin, the thing that is going to act as a centralizing function, right? So someone's going to run these trusted lists somewhere. And it's an area which, if I was an attacker, like a hacker of some sort, I don't go for your wallet, I go for the trusted list so I can fake a bunch of other wallets and things.

Should the UK just have gone with the IDAS system? And may it do that in the future if the approach it's got at the moment ends up not living up to expectations?

Well, I think you can imagine lots of scenarios where a European with an IDAS wallet comes over to the UK and wants to prove something about who they are. So it would make sense for UK organizations to be able to request data from IDAS wallets, which would mean they probably need to be on some trusted list somewhere. So, so that would make an awful lot of sense. Then you've got the opposite action where a UK person goes to Europe and they want to prove digitally who they are. They don't appear as as sort of second-class citizens. It would apply to anyone— an American, someone from Bolivia, someone from India— any, you know, goes to Europe and is locked out of this world of really slick, fast, secure transactions. So it remains to be seen a little bit on that. Certainly the EU is really leading the way here. The UK government is involved in the large-scale pilot consortium that we've set up. So DCIT, I think they're called now, no longer DCMS. We did invite them in to participate and they have joined in very willingly to see how things are operating. So I think that country, EU to outside EU integration is going to be a really interesting one. It's going to be hard enough just getting member states in the EU to work together to make this happen, let alone anyone outside. So I think the UK government's doing the right thing at the moment, which is joining in with a consortium that is working on this to see how it's operating and determining what their, their process will be from there on. So certainly very, very ambitious. I could see the UK and other organizations joining in with their own EIDAS-type capabilities. And there being some global trust list somewhere, like there is for passports, right, with ICAO. So why not for digital wallets? Again, someone's got to run that, right? So work out who's going to run that thing.

And then someone's got to oversee the running of it.

Yeah, exactly. There you go. So I think the opportunity exists, and I think that the EU is doing the right thing in setting up the IDAS wallet as an open-source capability so everyone can look at what it's going to look like and use it if they want to. And then the decision can be made down the line whether to integrate different trust ecosystems together.

It's an interesting future that we're heading towards with all of this. And as you've pointed out, there are lots of things that we don't know yet because it's all in play. But I know that you've noted in some of the stuff you've written on this topic that if this doesn't pan out in the way that you have brilliantly explained on this podcast, that Big Tech will step in and fill the vacuum. And that's a very different future, isn't it? How would that, just in summary, how would that play out in terms of some of the aspects we've just been discussing here, anonymity, getting rid of passwords, interoperability? Would it work at all?

Well, that again is a really good question, Tracey. Big tech is already there. So you have your wallet on your Google, your Android phone, or you have your wallet on your Apple phone. And then you have other wallets, like you can have a Google Wallet on a Samsung phone or a Samsung Wallet, not so much on the iPhone side of things. And you think, well, what are the drivers there for these folks doing this? Well, if they own your identity, let's put it that way, if they own your wallet, if you can't easily transfer out your stuff and put it somewhere else, then you're going to stay with them. And the question for people is going to be whether that's a comfortable thing or not. Now, at the moment, it's the easy thing because sure, you're in the Apple ecosystem, for example. Great, you've got an iPhone, you've got a MacBook. I've got my wallet and it works on them all. And it's great. Well, the reason it works like that is because Apple wants to sell you more shiny things. People might think, well, they're great because they're not selling my data. Well, they do have quite a big advertising business as it happens, but they are selling you more and more very highly priced shiny things that don't interoperate with anything else. And then you've got Google on the other side who are an ad-driven business who are looking at how they can sell your data for ad revenue. And that's just two examples. What would be really interesting would be if Apple and Google and others like Meta and so on, if they IDAS-enabled their wallets and got them certified. That would be really interesting because the legislation would force data portability, for example, and openness. So I kind of can't see it happening because they're all about lock-in, whereas IDAS is all about openness. We will have to make IDAS really attractive for people. At the moment, my Apple Wallet or my Google Wallet, they just work really easily. I can put various credentials in, boarding passes and all that kind of stuff. There isn't really any selective disclosure. There's not really the ability to combine different data elements. For sure, they know every time you use it. So you need to make the IDAS wallet as beautifully simple and easy and elegant to use. And there is no focus in the IDAS world at the moment on that user interface, which is a big gap, needs to be filled in, right? Lots of focus on the legislation, lots of focus on the underlying technology, no focus on whether I see a big green tick or it's blue or it's in the right, you know, a nice font to read, etc. So that's a huge gap. And if it's built by techies, it's not going to look beautiful.

It's going to be hugely bureaucratic, isn't it? And it's going to look like a bureaucracy has done it, designed it, because it will have, right?

Well, this is the thing. Yeah, it doesn't have to. But at the moment, nobody is putting a design language around it. So yeah, that is a big gap needs to be filled. And I think the European Commission is saying, well, here's some open source stuff for a wallet, you paint it blue and whatever. But I think citizens will be seeking a familiar, consistent user interface that fills them with trust and simplicity. So they reach for their IDAS wallet rather than their Google or their Apple, rather than the inbuilt operating system wallet. So that's a really big challenge. If that can be overcome, usage is going to skyrocket. Be really epic.

That's a fascinating possible future because, I mean, I can see them obviously charging every time you want to use a credential, um, something like that. But also, you know, they'll just revoke things, won't they? And we've seen that with PayPal, we've seen it with other tech platforms, we've seen apps, um, taken off the whole platform because they haven't behaved in the right way, or they don't have the right opinions, or their users aren't behaving in the right way. And that to me is, is more terrifying, I think, than any of the alternatives apart from the Chinese system. As we go towards ambient and spatial computing and we're spending more time in, let's say, mixed reality, and obviously we are talking about 2030 and beyond now, you won't have a smartphone device with an app on it, will you? So where will the credentials go? What will they be like?

Right, that's another really good question. Where will they go? So, IDaaS already allows for a cloud-based wallet or a hybrid wallet. So you can have what's called a full-edge wallet where all the credentials and keys are on the phone. A hybrid wallet where some elements of that, like some of the keys that unlock the main content are on the phone, but the actual credentials are in a cloud somewhere, which just means someone else's data center. You need to know who that cloud is. Now you can have a full cloud wallet, which is, you know, everything is, is in someone else's data center. So it's a really interesting one to see how this is going to play out. It becomes much easier for synchronizing across multiple different devices if you've got a hybrid or a cloud-style wallet. So as you go into a metaverse or mixed reality situation, firstly, there's a really important role to prove who you are in, in a digital environment as well as, as well as a physical environment, like a, you know, retail shops and so on. So it's just as important skill to identify yourself effectively there or prove things about yourself in such virtual environments. So the question then becomes, if you're going to go down the route of a cloud or a hybrid wallet, who's going to provide that for you? And how much do you trust them And how do you avoid it just being a Google or a Facebook providing that and locking you in? And some of the legislation around IDAS is about preventing that from happening, about allowing you to select a different wallet and use a different one, but with the same underlying technical protocols to make it interoperable. There are certain things with IDAS that you can't move from one wallet to another. So you can't move a PID from one wallet to another because it's locked into, it's locked into the wallet. So interesting. There's latitude to allow for cloud-based wallet scenarios, but then you've got to figure out who the cloud provider is going to be and how to regulate them and so on.

Then I'm on Amazon Cloud, aren't I? And AWS, and then I'm locked in again.

Yeah. Well, the thing is, the legislation should prevent that from happening. But then people go down the easiest route, don't they? And you might find that accidentally it's all on AWS. So, yeah, very interesting one.

So a final question for you then, Andy. What is your vision for 2030? Where will we be with digital ID by 2030? And what would be like the priority things that have to happen to make sure that that's achieved in reality?

So where will we be 2030? Well, I think IDAS is creating a huge wave of interest in this digital credential world. Previously, it was companies like Evenim, where I used to work, who were plowing this furrow of saying, look, there's a better way. And a lot of that work that the early pioneers have done is starting to pay off now. With things like eIDAS. So I think it really is setting the scene for what a digital world will look like that encompasses trust and privacy. So I think that's really good. And I think in 7 years' time, every organization will be issuing and verifying digital credentials, whether it be private sector or government sector. I think that there'll be a bit of a balance of power that moves back to users. So rather than this, you go here and create an account thing, they'll be feeling much more in control of who they're sharing data and for what and being able to manage that situation. People are already getting used to digital wallets. The whole COVID thing made people a lot more used to scanning QR codes for things. That's sunk into the psyche of people. It's, I'll hold my phone up to a thing, right? That theater of doing that has now happened. And that is the primary way that you initiate a trusted digital connection as well. So the groundwork is there. IDAS is coming along with this huge wallet initiative. There are other huge wallet initiatives happening as well. There's all sorts of other things going on. But even if IDAS doesn't work, the cat is out the bag and it's happening anyway. So I hope it does work. Because that combination of carrot and stick, right? The legislation, you must do it like this, here's what happens if you don't, plus the carrot of vastly improved business processes, much better user privacy, much better user convenience without getting hacked and phished all the time. That carrot and stick approach is really, really good. I think it's going to lead to huge take-up. Lots of hurdles to jump through. This large-scale pilot that we're involved in, we've got 2 years to have thousands of users using this stuff. And yet we haven't even got a wallet. Nobody's got a wallet yet. So lots and lots to do, lots of innovation to come out. And I think really IDAS is triggering a huge mainstream effect, going from small startups like Evernym was Evnim's now been bought by Avast, got bought by Norton. It's a core part of our strategy, is this. It's, um, there's other organizations doing the same. So it's a really significant leap forward in this wave towards a digital credential world that frees us up from subservience to big tech and account providers.

Well, Andy, thank you for bringing so much clarity to what is really a very complex highly technical topic for most, you know, ordinary humans to understand. So it really helps a lot with, I think, civil engagement and public discussion on this. So can't thank you enough for that. Thank you.

You're very welcome, and great questions as well.

Thank you for listening to The Future Review hosted by me, Tracey Follows. Check out the show notes for more info about the topics covered in this episode. Do like and subscribe wherever you listen to podcasts. And if you know someone you think will enjoy this episode, please do share it with them. Visit thefutureofyou.co.uk for more on the future of identity in a digital world, and futuremade.consulting for the future of everything else. The Future of You podcast is produced by Big Tent Media.