Digital Identity and Self Sovereignty with Kaliya Young & Lucy Yang #7

WEBVTT
00:00:20.160 --> 00:00:21.679
Welcome to the future of you.
00:00:22.079 --> 00:00:25.440
Today I'm joined by Kalia Young and Lucy Yang.
00:00:25.760 --> 00:00:38.640
In 2005, Khalia co-founded the Internet Identity Workshop with Doc Searles and Phil Windley to bring together talent dedicated to designing and building identity systems that empower individuals.
00:00:38.880 --> 00:00:52.240
Five years later, she founded the Personal Data Ecosystem Consortium to help individuals with the tools to collect, manage and gain value from their own personal data as they interact with all kinds of digital systems.
00:00:52.479 --> 00:01:03.520
She is an internationally recognized expert in self-sovereign or decentralized digital identity and has been named one of the most influential women in tech by Fast Company magazine, amongst others.
00:01:03.840 --> 00:01:11.599
Lucy Yang is an entrepreneur, MBA, and business advisor experienced in taking ventures off the ground and leading their strategic growth.
00:01:11.840 --> 00:01:19.840
She has a wealth of management experience in startups across ed tech, health tech, blockchain, digital identity, and personal data management.
00:01:20.000 --> 00:01:28.319
And much of her current focus is advancing the adoption of the verifiable credential and decentralized technology for COVID and public health.
00:01:28.640 --> 00:01:40.560
Khalia and Lucy now work together in their shared consulting practice, helping organizations of all sizes adopt, develop and invest in decentralized identity and relevant technology.
00:01:40.799 --> 00:01:55.680
Now I will say this discussion gets quite technical, but I think it's really important that digital identity and technical tools like verifiable credentials need explaining in a simple way so that more people can understand them.
00:01:55.840 --> 00:02:02.719
And the more people that understand them, the more people will have a good informed point of view about digital identity.
00:02:02.959 --> 00:02:08.800
So, in a time of great concern about digital identity, this is a very important conversation.
00:02:09.039 --> 00:02:21.919
If you want to know more about SSI, self-sovereign identity, decentralisation, and the emergence of COVID passes, but to put them in a greater context, then this is the episode for you.
00:02:22.159 --> 00:02:29.280
Let's tune in to Khalia and Lucy as they discuss with me digital identity and self-sovereignty.
00:02:32.879 --> 00:02:34.639
Welcome, Khalia and Lucy.
00:02:34.879 --> 00:02:46.240
It's fantastic to have you here, two experts in the field which we are going to dissect, which is digital identity and specifically self-sovereign identity, but we'll get on to that in a minute, I think.
00:02:46.479 --> 00:02:55.919
I wondered if we could just start the conversation by broadly explaining to the audience why identity is such an issue in the digital world.
00:02:56.080 --> 00:02:58.639
What's different about it to the physical world?
00:02:58.719 --> 00:03:07.199
And perhaps you could explain to us a little bit of the background or the context as to why we need digital identity or we should be talking about it.
00:03:08.000 --> 00:03:18.000
I think one thing is we already have digital identities because our contemporary systems are run using computers.
00:03:18.639 --> 00:03:35.680
So almost every institution you interact with, your soccer club, your church, your school, your doctor's office, they're all have computers and you have a digital representation in those digital systems.
00:03:36.000 --> 00:03:40.560
And so it's kind of a misnomer to go like, oh, this is new.
00:03:40.800 --> 00:04:02.639
What's new is we also have little computers in our pocket now called phones, and we're trying to rebalance how we use these digital devices and tools and computers that we have to connect to these other systems that have digital representations of us for decades.
00:04:03.039 --> 00:04:29.360
So that's that's the challenge we have, and particularly we've also had a way that digital identities have been created where we get assigned identifiers by these systems, and because of that nature of that assignment, those entities that give us identifiers like our email address or our username in a particular context, they can also take those away from us.
00:04:29.680 --> 00:04:42.480
So, how do we have autonomy and empowerment in ways that mean the institutions we're interacting can't just take the identifiers away from us?
00:04:43.279 --> 00:04:43.759
I see.
00:04:44.000 --> 00:04:51.519
Of course, when we all started to use the internet, we I suppose did become aware that there isn't really an identity layer on it, is there?
00:04:51.680 --> 00:04:56.399
Or maybe there are many, many, many numerous millions of identity layers.
00:04:56.480 --> 00:04:58.000
I don't know what you think, Lucy.
00:04:58.800 --> 00:05:04.720
Do we need an identity layer on the internet or are they there in uh in uh various forms already?
00:05:04.800 --> 00:05:07.199
It's just that we don't have any control over them.
00:05:07.519 --> 00:05:08.879
Thanks, Research for the question.
00:05:08.959 --> 00:05:17.920
So this is uh exactly what I was thinking about the layer that is missing that uh actually I learned from Kalia and the way I'm I come from a business kind of background.
00:05:18.000 --> 00:05:30.480
So the way I'm looking at it, right, is like we have we already have identity, we already have a way or multiple ways of managing identity, physical identity before we have digital identity, right?
00:05:30.560 --> 00:05:39.600
But but have we actually looked at how identity is done since we have internet, since we have devices, right?
00:05:39.680 --> 00:05:45.040
I think the the fact that there is something missing, I'm not sure if one layer with several layers are missing.
00:05:45.199 --> 00:05:59.680
The fact that there's no layer about users and user can identify how like user can have control of their identity the way they do with their physical identity, at least is a question that is worth asking.
00:05:59.839 --> 00:06:04.480
Now that pretty much most people are on the internet are using devices somehow.
00:06:05.360 --> 00:06:06.000
Exactly.
00:06:06.240 --> 00:06:18.959
So when somebody turns up looking like a cat in that uh hearing that that guy had, he had the face app on that look like a cat, that really brought to life that old saying, I mean, no one knows if you're a cat or a dog on the internet, right?
00:06:19.839 --> 00:06:21.920
Kind of brought it to real life, I think.
00:06:22.079 --> 00:06:23.040
So what's been happening?
00:06:23.120 --> 00:06:30.399
Because Kaleir in particular, I know you've both been working in this area for a while, but Khalil in particular, real pioneer uh in this area.
00:06:30.560 --> 00:06:33.759
What's been happening over the last sort of 15 to 20 years?
00:06:33.920 --> 00:06:36.079
Has there been much progress made?
00:06:36.480 --> 00:06:47.040
Yeah, I mean, I've been hosting a conference that's coming up this week called the Internet Identity Workshop for we're going on to 17 years now.
00:06:47.279 --> 00:07:00.079
And our community, the first things that we innovated, we imagined, you know, everybody would have this new what we were developing, and they'd have autonomy and control.
00:07:00.639 --> 00:07:08.480
And we ended up building a set of protocols called OpenID and OAuth that did make the internet a little better.
00:07:08.560 --> 00:07:13.920
You didn't have to have a totally separate, different account for every website you went to.
00:07:14.240 --> 00:07:28.079
You could use accounts from one system and another system and not have to create a new one, but it ended up fueling what in our technical lingo we call identity providers.
00:07:28.240 --> 00:07:52.000
So often when you go to the web on websites and you see login with Google or login with Facebook or login with LinkedIn or GitHub, those are identity providers, and you're sort of disintermediating yourself from the website you're connecting to with those services, but it's convenient and people are using them, and and we invented that.
00:07:52.160 --> 00:08:11.920
And then in the last six years or so, we've innovated in a next generation of technologies that have more hope for user empowerment called decentralized identity or self-sovereign identity, depending on your preferred political perspective on what it means.
00:08:12.240 --> 00:08:23.439
But really trying to separate out the attributes about people that they might want to share and creating new tools for that to happen.
00:08:24.000 --> 00:08:30.000
Yeah, so in my book, I tell the story, in fact, I open on the story of when I got locked out of my Facebook account.
00:08:30.160 --> 00:08:33.840
So it was back in 2016, seems a long time ago now.
00:08:34.000 --> 00:08:40.399
And um I was receiving emails um to my email address, but referring to me as Byron Loworth.
00:08:40.639 --> 00:08:45.039
And the messages were saying from Facebook, oh, you should really update your status, Byron.
00:08:45.120 --> 00:08:46.879
Look what all your friends are doing, Byron.
00:08:47.039 --> 00:08:52.879
And I would look to the friends, and they were just a bunch of sort of half-naked 30-something year old males.
00:08:52.960 --> 00:08:54.399
Unfortunately, they weren't my friends.
00:08:54.480 --> 00:08:58.799
Um, but I discovered, hang on a minute, something's been compromised here.
00:08:58.879 --> 00:09:02.399
I didn't know if it was my email address, I didn't know if it was my Facebook account.
00:09:02.559 --> 00:09:08.240
So I tried to log in to Facebook and they wanted my passport and my driving licence to verify me.
00:09:08.399 --> 00:09:14.159
And when I scanned in my passport, Facebook came back and said, no, you're not Tracy Follows.
00:09:14.559 --> 00:09:19.039
So this was what really started me to think, well, hang on a minute, who is verifying me?
00:09:19.279 --> 00:09:24.720
And not only who can I trust for authentication and verification, but who trusts me?
00:09:24.960 --> 00:09:31.120
Because I had my passport, which was according to me, was uh you know my only real official documentation.
00:09:31.200 --> 00:09:34.159
They'd asked for it, I'd scanned it in, and it just didn't seem good enough.
00:09:34.320 --> 00:09:41.440
Now it just became clear to me that somewhere along the line I wasn't machine readable and I didn't really know why.
00:09:41.919 --> 00:09:53.679
And I think what's been created with Byron Loworth and some of my content on my Facebook feed as was is a synthetic identity, interestingly, because I've seen it pop up somewhere else.
00:09:53.840 --> 00:10:10.720
But the point is how does self-sovereign identity or decentralized approach that you've just been outlining, Calia, to either of you, how is how would that then rectify or avoid that kind of situation which which I had with Facebook, for instance?
00:10:11.120 --> 00:10:16.240
So the challenge that you present is not necessarily an easy one to solve.
00:10:16.399 --> 00:10:30.960
I think in a future time when SSI is more mature, you would probably have quite a few credentials in your digital wallet that have your name and information about you that you could prove you're you.
00:10:31.279 --> 00:10:44.000
You might have your university degree, you might have a course you took last year, you might have some sort of government-issued ID in a digitally native form, not a paper form that you're scanning in.
00:10:44.399 --> 00:10:51.360
You might have proof of things you purchased that you and you could go, hey, I'm really me.
00:10:51.840 --> 00:11:23.360
Here's this stack of proofs that I have that are digitally signed, and that the verifier, in this case, you're talking about trying to prove to Facebook who you are, could use cryptographic algorithms to go check on the validity of the information you presented, and also check that the entities that are issuing those documents are in trust frameworks that they agree that they think have merit.
00:11:23.840 --> 00:11:31.919
So, you know, like you know, there's this challenge of how do you believe any institution that's saying something, right?
00:11:32.159 --> 00:11:36.639
And this is sort of going deep into the problem, but we do this with things like schools.
00:11:36.799 --> 00:11:50.000
There's certification bodies that go through and accredit schools, and there's sort of fake schools that pop up and say, I'm a school, but they're not accredited by the real body that kind of does that.
00:11:50.240 --> 00:12:07.039
And so trust frameworks do that, but at a larger scale for more types of institutions, so that we can have confidence in the assertions by various institutions in this new digital decentralized world that we're building.
00:12:07.360 --> 00:12:20.639
So Facebook would check both that the information you shared hadn't been tampered with and that the entities issuing it had come from trust frameworks that they recognize.
00:12:21.120 --> 00:12:30.879
Yeah, because one of the interesting things is if we think of Facebook as a sort of third party, they've potentially, or somewhere along the line, has potentially got a copy of my passport, haven't they?
00:12:31.120 --> 00:12:32.720
Because I I scanned it in.
00:12:33.120 --> 00:12:48.799
I guess this is one of the things when we want to use some of these services now, without some of the new technological tools you're you're talking about, some of the processes, you know, there's copies of our identities sort of floating around all over the place, whether it's at banks, uh, utility bills, all those sorts of things.
00:12:49.120 --> 00:13:01.600
And I think people kind of forget that, don't they, when they think about a digital ID or even an ID in general, and they're trying to weigh up the pros and cons of some of the new concepts around digital ID.
00:13:01.679 --> 00:13:10.799
They forget that actually we've got loads of personal information being stored or thrown away, or we don't really know what's happening to it with lots of third parties.
00:13:11.200 --> 00:13:13.039
In all sorts of places, right.
00:13:13.200 --> 00:13:26.399
And this challenge that we have today in how identity works is that knowing information about a person means you are the person is part of our problem.
00:13:26.720 --> 00:13:28.879
It's what we have to unravel and unpack.
00:13:28.960 --> 00:13:48.000
And one of the great features of verifiable credentials, the core standard that's a part of self-sovereign identity, is that when you hold a verifiable credential in your wallet and you share information with a verifier, you do so in a way it's called a verifiable presentation.
00:13:48.559 --> 00:13:57.440
And yeah, they have the data on your credential, like your name or your birth date or whatever attributes you want to share.
00:13:57.840 --> 00:14:10.639
But the way that they hold the information, the way it's encoded, means they can't kind of copy it and replay it to someone else and pretend to be you.
00:14:10.960 --> 00:14:23.279
Because only you have the original verifiable credential, and you don't actually share it, you share a presentation of it that's unreplayable in a copycat attack.
00:14:23.519 --> 00:14:32.720
So if this was used at scale, it would end a significant portion of identity theft and identity fraud as we know it.
00:14:33.120 --> 00:14:33.440
Right.
00:14:33.679 --> 00:14:38.720
And what are the differences between attributes and verifiable credentials?
00:14:39.120 --> 00:14:47.039
So if you're thinking about like a physical ID, right, when you get to your driver's license, you pretty much get entire driver's license in a card.
00:14:47.200 --> 00:14:51.840
And then whenever you need to use it, you need to actually show your entire card, right?
00:14:51.919 --> 00:14:57.360
There's no you can't hide certain kind of like data points and only show like what you want to show.
00:14:57.600 --> 00:15:08.159
But the benefits with using virtual credentials is like you you still get kind of a like a digital card into like something like you you have and and you have that entire thing.
00:15:08.320 --> 00:15:12.480
But when you're sharing it, you don't necessarily have to share everything.
00:15:12.720 --> 00:15:18.240
So it allows you to share only the data points that are needed for particular verification.
00:15:18.399 --> 00:15:23.200
For example, if you're going to a liquor store, you only have to show like your age, right?
00:15:23.600 --> 00:15:36.720
If you're like like above like the age that you can you can buy alcohol, and that's you know, obviously they still need to know if if it's you probably need need to see like the photo of you and then see, okay, you're over like 21, you're over like 18.
00:15:36.879 --> 00:15:44.480
So that's kind of the attributes of the each kind of the data attributes on on a particular card that you can actually selectively sharing.
00:15:44.639 --> 00:15:48.080
So that's what what Clea is, you know, was referring to.
00:15:48.320 --> 00:15:53.759
And one thing I would love to add in terms of the the you mentioned like the prior kind of sharing data.
00:15:53.919 --> 00:16:04.960
I think one thing SSI is trying to kind of do is to have that kind of a channel between who whoever gives you the information, also whoever is taking your information.
00:16:05.120 --> 00:16:07.279
So you have that kind of entire history yourself.
00:16:07.360 --> 00:16:19.840
So as a user, you know, oh, I've shared this thing with someone before, and there's that channel can kind of exist, and you can you have that kind of a secure way of communicating with a particular organization.
00:16:20.000 --> 00:16:28.879
And also as a user, I'll I have a way to verify if you know if Facebook wants to check my information, if that is Facebook or not.
00:16:28.960 --> 00:16:31.759
It's the same, the other way around stays the same.
00:16:31.919 --> 00:16:32.080
Right.
00:16:32.240 --> 00:16:36.960
So I think the entire kind of process of thinking about creating an account, right?
00:16:37.039 --> 00:16:42.720
And also like in exchanging information will be different from what we're looking at today.
00:16:43.120 --> 00:16:43.360
Yeah.
00:16:43.440 --> 00:16:52.960
So my understanding is somebody, somebody's looking to verify one of your credentials, let's say, rather than you, in a sense, and they put in a proof request.
00:16:53.200 --> 00:16:53.919
Is that right?
00:16:54.080 --> 00:17:04.799
And you'd send a proof response, and then they can check all the things that uh you guys were just saying, like when was it issued, who issued it, has it been modified or revoked or whatever.
00:17:04.960 --> 00:17:06.480
And then what happens then?
00:17:06.640 --> 00:17:07.839
Is it accepted?
00:17:08.000 --> 00:17:15.119
What's the bit in the process then that kind of just goes, okay, then that's that's going to move forward and that's been verified?
00:17:15.519 --> 00:17:35.119
It depends on how exactly, you know, kind of like what the verifier wants, but no, and and in general, what they need to know is first is the information, it's the data, not necessarily the entire credential, but every data point they're getting it can potentially be from different credentials, right?
00:17:35.200 --> 00:17:36.240
Different cars, right?
00:17:36.319 --> 00:17:41.519
But they want to know are all those information coming from trusted sources, right?
00:17:41.680 --> 00:17:47.359
These the working nations institutions, the verifier, whoever is taking your data, do they trust working nation?
00:17:47.599 --> 00:17:47.759
Right.
00:17:47.839 --> 00:17:48.880
So that's one thing.
00:17:49.039 --> 00:17:54.000
Another thing is are these information are being tempered or changed, right?
00:17:54.079 --> 00:17:57.759
And it is exactly what is initial to the credential in the first place.
00:17:58.000 --> 00:18:01.920
And also, is this information still within kind of the time range, right?
00:18:02.000 --> 00:18:07.759
The certain criteria is like you have, for example, like if if it's a card, it's come from a driver's lessons, right?
00:18:07.839 --> 00:18:10.319
Has your driver's lessons expired?
00:18:10.640 --> 00:18:14.640
If certain credentials, right, your the data is from is being revoked, right?
00:18:14.720 --> 00:18:25.680
So that's that's all these kind of validity questions, and as well as once you get the data, the verifier gets the data, they also have to see if the data actually meets the requirement, right?
00:18:25.759 --> 00:18:30.000
If the age actually meets the age that the person is allowed to get into a liquor, to buy a liquor.
00:18:30.240 --> 00:18:35.759
So that's on high level, what kind of like the checking and verification process uh will take place.
00:18:36.319 --> 00:18:37.039
That's very clear.
00:18:37.200 --> 00:18:52.720
The reason I ask partly the reason I asked the question is because when I try to explain this to people who aren't involved directly in like the technicalities, as as I'm not either, there's a kind of response which is, oh yes, but it's all on the blockchain, isn't it?
00:18:52.880 --> 00:19:03.599
And that means there's everything stored and everything's immutable, and then people can track you and know what everything you've done, where you've been, uh how you've used these verifiable credentials.
00:19:03.839 --> 00:19:08.880
So I wonder if you can, I can see uh Kellya um shaking her head.
00:19:08.960 --> 00:19:09.359
I know.
00:19:09.440 --> 00:19:17.519
So I wonder if you can set this to rest once and for all and perhaps explain to people why that's not the case.
00:19:18.079 --> 00:19:25.359
So there are certainly projects and entities running around the internet and saying they do all sorts of things.
00:19:25.680 --> 00:19:36.160
So we aren't necessarily like the folks you're you're hearing that from maybe accurate in the sense that there are projects that do crazy things on blockchains.
00:19:36.480 --> 00:19:51.359
What we're talking about with self-sovereign decentralized identity and the communities that we work with, they're really focused on developing open standards that is basically a recipe book that anyone in the whole world can follow.
00:19:51.519 --> 00:20:00.000
And though that's that's what we're talking about is those recipes for verifiable credentials and another recipe for decentralized identifiers.
00:20:00.240 --> 00:20:19.839
And the recipe for verifiable credential in its best form means that an issuer packages up a credential for an individual, they give it to the individual, it sits in the individual's wallet, and then the individual decides where and when they share the information.
00:20:20.000 --> 00:20:36.000
And the only thing that really, if anything, goes on a blockchain or gets posted publicly on the internet, I mean, that's what putting it in a is the anchor decentralized identifier for the issuer.
00:20:36.559 --> 00:20:54.960
So that when the credential is presented in the verifiable presentation form, that verifier can go find that cryptographic key material that's hosted with the DID and use it to do the math they need to figure out the validity of the credentials.
00:20:55.200 --> 00:21:02.079
But nothing other than that anchor decentralized identifier for the issuer goes on the blockchain.
00:21:03.680 --> 00:21:09.039
And one thing I would like to add is blockchain is not necessary at all in SSI.
00:21:09.200 --> 00:21:15.359
So, like Clea mentioned, somewhere it needs to be an anchor, like the identifier needs to go.
00:21:15.440 --> 00:21:17.359
Like blockchain isn't an option.
00:21:17.599 --> 00:21:28.319
It certainly especially is a kind of an early on, kind of popular option, but now like we're certainly not talking about blockchain as like the only solution for people to anchor like the DID.
00:21:28.480 --> 00:21:30.640
There are so many other ways of doing it.
00:21:30.880 --> 00:21:40.960
So it's uh and and also not to mention that the data itself, like personal data, doesn't go on blockchain and shouldn't go on blockchain, you know, in community we're in.
00:21:41.440 --> 00:21:46.319
What would be another, if it's not too technical, what would be another way of doing it then?
00:21:47.119 --> 00:21:59.200
So there's a DID method called DID web, and it's actually one that the US government is using, and it's a way to put the key material anchored in, I believe it's in the DNS record.
00:22:00.160 --> 00:22:13.519
DNS is the lookup system for when you go find the address of a domain name, like your computer goes finds where where on the internet your a web address is.
00:22:13.599 --> 00:22:16.000
And so it's a way to anchor it there.
00:22:16.480 --> 00:22:20.000
Yeah, so that's that's another popular place.
00:22:21.440 --> 00:22:21.839
Great.
00:22:22.000 --> 00:22:27.279
And so we've talked a little bit about, well, a lot about verifiable credentials, talked a little bit about DIDs.
00:22:27.440 --> 00:22:28.960
You've mentioned wallets.
00:22:29.359 --> 00:22:32.240
My question is, how many wallets will someone have?
00:22:33.839 --> 00:22:34.960
Is there a limit?
00:22:35.119 --> 00:22:36.720
Is it going to be an ecosystem?
00:22:36.880 --> 00:22:42.480
How what how do you imagine this will work with lots of wallets or one wallet with lots of verifiable credentials?
00:22:42.960 --> 00:22:55.920
So I think that, you know, I recently read a tweet that said, doubt shall keep your cryptocurrency wallet and your wallet for verifiable credentials separate.
00:22:56.079 --> 00:22:57.599
I I kind of agree with that.
00:22:57.680 --> 00:23:03.599
It's trying to do too much cryptographic work all at once too early on to try and have those all be in one.
00:23:03.839 --> 00:23:14.079
In an ideal world, you could have one wallet that interoperates across all the issuers that you have and all the verifiers you want to talk to.
00:23:14.400 --> 00:23:17.119
And we'll see if that's possible.
00:23:17.279 --> 00:23:22.960
I mean, I think there's a lot of noise in the market right now.
00:23:23.680 --> 00:23:41.440
And hopefully within the next year and a half, it'll settle down and there'll be some wallet conformance tests, and most folks will build wallets that align with that, and most issuers will issue to a wall wallet that aligns with that and verifyers subsequently.
00:23:41.680 --> 00:23:50.079
We're also seeing the EU actively work on the development of wallets for their citizens.
00:23:50.559 --> 00:23:58.160
And hopefully that will also sort of spur alignment and reduce the need for multiple wallets.
00:23:58.559 --> 00:24:04.240
Now I'm glad you've mentioned the EU, because I was going to ask you both about EIDAS two, I think, isn't it?
00:24:04.319 --> 00:24:06.079
Because it's uh it's it's phase two.
00:24:06.559 --> 00:24:16.000
I've been watching several sort of presentations and chats and disseminars around this, and they do refer to it as self-sovereign or decentralized.
00:24:16.240 --> 00:24:23.279
But I'm wondering is it is it a decentralized system they've got going across Europe with uh Phase 2 or Mark II?
00:24:23.359 --> 00:24:27.119
Or is it sort of decentralized across centralized entities?
00:24:27.359 --> 00:24:32.240
Because obviously each country has its own identity system, doesn't it?
00:24:32.400 --> 00:24:35.680
And then there's the kind of bringing them together, I think, over EIDAS.
00:24:35.920 --> 00:24:36.960
Maybe I've misunderstood.
00:24:37.039 --> 00:24:44.559
I I wonder if you could just break down what is EIDAS and whether it truly is decentralized or or not.
00:24:45.279 --> 00:24:49.200
Well, it helps to understand what EIDAS 1 was.
00:24:49.920 --> 00:25:01.599
So EIDAS 1 was an aspiration to have digital identities issued by governments, accepted by other EU governments.
00:25:01.839 --> 00:25:15.759
And they came to the conclusion that each country was going to do digital identity in their, or do identity proofing in their own way, and issue documents that would be accepted within their country, and that other EU countries would recognize it.
00:25:16.079 --> 00:25:23.279
You ended up with about a mass of middleware, about 200 different schemes.
00:25:24.079 --> 00:25:27.359
I think there's only 35 countries in Europe or whatever.
00:25:27.519 --> 00:25:36.240
Like it was a giant, convoluted, knotted mess, and really the only it was only about government-to-government acceptance.
00:25:36.559 --> 00:25:47.359
But most of what citizens use their government-issued identity documents for is not to cross a border and show it to another country.
00:25:47.920 --> 00:25:55.279
It's to show it to the doctor, to the school when you're registering your kid.
00:25:55.519 --> 00:26:03.359
You're showing it to lots of private non-governmental entities who want to just know what the government said about you.
00:26:03.519 --> 00:26:04.720
Like, are you really that person?
00:26:04.880 --> 00:26:05.680
Yeah, okay.
00:26:05.839 --> 00:26:07.680
You know, what is EIS2?
00:26:08.000 --> 00:26:10.880
We'll find out in the next year as it rolls out.
00:26:11.039 --> 00:26:28.079
I believe the aspiration is to support the kind of interoperability that SSI has, where you can receive a credential from authoritative sources, like the government that you happen to be a citizen or a resident of a particular country.
00:26:28.240 --> 00:26:38.720
And then you can use that across the EU for a whole variety of reasons, including other EU governments and the private sector to do business.
00:26:39.119 --> 00:26:55.920
I think the current conversation regarding like EIDAS and 2.0 is I think that the private sector is already involved, that perspective, especially if we're looking at some of the EU funding projects where they're talking about beauty wallets, right?
00:26:56.160 --> 00:26:58.880
EU-wide, you know, collaboration among member states.
00:26:59.119 --> 00:27:01.200
I know like the private sector is already involved.
00:27:01.279 --> 00:27:02.240
Like Clea said, right?
00:27:02.319 --> 00:27:17.839
It's not only about kind of cross-border with government identity kind of sharing or exchange, but also about how like individual citizens can use government-issued and trustworthy identities to interact with private sector, like players who provide their day-to-day services.
00:27:18.079 --> 00:27:22.960
And actually, this is also kind of going back to your earlier question about wallets.
00:27:23.200 --> 00:27:33.119
I think we we need to look at wallets not only from what kind of technical solutions, but also business solutions comparing with what we have today, right?
00:27:33.519 --> 00:27:40.799
I think there will be a lot of wallets in the sense that the brand of the wallet will be different, like what we're having today.
00:27:40.880 --> 00:27:49.599
Like we have like an Apple kind of wallet where like it's more kind of a universal wallet where you can have many different kinds of like IDs, identities in it.
00:27:49.759 --> 00:27:59.440
And at the same time, we also have like the is actually the application you're using, like company branded one, because I think companies want to have that kind of relationship with our clients.
00:27:59.519 --> 00:28:11.920
Instead of like pointing their clients to a universal wallet, they're probably like, okay, there's something unique they're providing through their own application, which is also includes a digital wallet in it that can hold credentials, right?
00:28:12.000 --> 00:28:21.519
But at the same time, like the credentials can also be carried to other kind of, for example, to Apple wallet if their client or their user wants to kind of use it in Apple wallet.
00:28:21.759 --> 00:28:26.160
I think what really matters is actually the underlying technology, right?
00:28:26.319 --> 00:28:37.200
Like everyone is using if that thing allows people to take their credentials outside of you know a branded wallet or outside of general wallets and actually use elsewhere.
00:28:37.359 --> 00:28:44.400
And also if the verification mechanisms of different credentials are interoperable that can verify different kinds of credentials.
00:28:44.559 --> 00:28:52.160
I think that's you know, looking at the technology and also the actual kind of you know interfaces kind of separately and also connected.
00:28:52.240 --> 00:28:55.279
So that's that's how I would encourage people to look at it.
00:28:56.160 --> 00:28:58.720
Because I was thinking about what I use.
00:28:58.799 --> 00:29:05.359
So let's say I've got an Everym, a YoT, I've got my e-residency for Estonia.
00:29:05.519 --> 00:29:08.880
Yeah, all of these have got different verifiable credentials in them.
00:29:09.039 --> 00:29:21.920
But then the UK government are also creating their one login pass, which I think is to say, improve on verify, but that's not difficult, improve on the old system, the verified system.
00:29:22.079 --> 00:29:32.799
And so then will I have a a login or an identity for that, and also an ecosystem of wallets or apps where I have verifiable credentials for other things?
00:29:32.960 --> 00:29:38.079
I'm wondering about your views on how the ecosystem will work out.
00:29:38.400 --> 00:29:43.279
I mean, you just said about Apple as well, and of course, Apple are doing the mobile driving license in the States.
00:29:43.440 --> 00:29:53.359
So, you know, um is it going to be an ecosystem of government and private sector and some of the big platforms offering wallet capabilities?
00:29:53.440 --> 00:29:56.799
How how do you see it evolving over time?
00:29:58.000 --> 00:30:12.799
I think, at least at this point, I'm my my view is there will be a lot of different kinds of wallets and government ones and more like YoT is more like I think the service provider in the sense that there's certain companies instead of having their own wallet, right?
00:30:12.880 --> 00:30:17.039
They're like let's use YoT wallet, probably easier for our customers.
00:30:17.200 --> 00:30:24.799
And also there will be kind of branded wallets like the company application because their clients are not only looking for wallet functionality, right?
00:30:24.880 --> 00:30:29.440
They're also value-added service that a company wants to provide for their client.
00:30:29.599 --> 00:30:32.720
It's pretty much the wallet as just some small portion of it.
00:30:32.960 --> 00:30:48.160
I do see all kinds of wallets exist, which will be confusing to individuals for sure to begin with, but how these wallets will kind of like merge or evolve like down the road, that's that's still that's also that's a question mark for me as well.
00:30:48.400 --> 00:30:51.359
But you know, we're already using a lot of apps, right, these days.
00:30:51.519 --> 00:31:03.759
I would treat like the kind of company branded apps like you know what you know you're using now is pretty much the mechanism of probably of exchanging a digital identity will be different as a building functionality.
00:31:04.000 --> 00:31:17.279
And and the I think the government one is a kind of a relatively new one because I I'm not using any kind of government kind of one, but I will see more kind of government services consolidating probably into one wallet, right?
00:31:17.440 --> 00:31:18.640
That kind of scenario.
00:31:18.880 --> 00:31:23.279
But yeah, it's it's still like quite things are pretty fragmented now.
00:31:23.359 --> 00:31:25.119
So I'll see how things pan out.
00:31:25.200 --> 00:31:29.599
But I think to as a starting point, there will certainly be a lot of wallet out there in the market.
00:31:30.000 --> 00:31:31.440
I mean, that's good in a way, isn't it?
00:31:31.599 --> 00:31:39.200
Because that means that the market's still open to the most innovative, convenient, user-centric solutions, I guess.
00:31:39.359 --> 00:31:44.559
And one hopes that the best ones will win out in the market, although I'm sure there's lots of other power plays.
00:31:44.880 --> 00:31:49.039
I don't know, Khalia, if you have anything to add to that about the ecosystem.
00:31:50.000 --> 00:31:58.720
So I'm really a strong believer in open standards and trying to get alignment.
00:31:58.960 --> 00:32:06.559
And I think there are large players trying to do their own thing and create lock-in.
00:32:07.119 --> 00:32:22.079
So this is what I would say right now is a big danger with particularly Apple and Google's control of the mobile operating platform that they're going to push to be like, trust us, put it in our wallet.
00:32:23.519 --> 00:32:35.359
We need to choose our wallets on your platform because then they can't lock us in and they can't control the ecosystem.
00:32:35.920 --> 00:32:41.440
Because then we might as well have had a centralized system rather than a decentralized one, mightn't we?
00:32:41.839 --> 00:32:42.240
Yeah.
00:32:42.480 --> 00:32:51.519
Or I mean, you know, it's very possible that you can end up in a system where verifiers have to pay every time.
00:32:52.240 --> 00:33:06.880
There's just like some real problems of where it could go in terms of lock-in and costs that aren't necessarily seen now until the lock-in happens, and it's like, oh, well, now you have to pay for that.
00:33:07.440 --> 00:33:18.720
So is it better for people to start adopting, you know, proper self-sovereign applications and solutions quickly, or is it is it just going to go at its own pace, this change?
00:33:19.279 --> 00:33:31.440
I mean, the issue is that these are ecosystems, as you said, and ecosystems that involve fairly large entities that move really slowly and with decision makers who don't necessarily understand the decisions that they're making.
00:33:31.680 --> 00:33:49.920
So I think it behooves us to improve our communication and our persuasive arguments to those decision makers about the critical importance of open standards, about conformance and even testing around open standards.
00:33:50.079 --> 00:33:57.839
I mean, the US government's really led the way in terms of cultivating ecosystems of startup companies that are interoperable.
00:33:58.000 --> 00:34:03.359
In fact, they don't get paid on their US government contracts unless they're interoperable with each other and can prove it.
00:34:03.599 --> 00:34:11.920
And we need other governments to do that type of thing and to join in pushing for these open standards-based ecosystems.
00:34:12.079 --> 00:34:31.039
This is what we often isn't really understood by your, you know, the general public audience really is that the internet was so successful because HTML was 100% open and anybody could build to it, and you got this enormous flowering of opportunity and potential.
00:34:31.280 --> 00:34:33.920
And verifiable credentials is a standard like that.
00:34:34.079 --> 00:34:43.280
It has very broad expressive capacity, it can communicate incredibly serious things like your national security clearance level, blah, blah, blah.
00:34:43.519 --> 00:34:47.280
And it can also communicate that you went to yoga class yesterday.
00:34:48.000 --> 00:34:50.320
You know, like doesn't matter.
00:34:50.480 --> 00:34:52.320
It's a data format, right?
00:34:52.400 --> 00:34:59.840
And what we as humans and our institutions and and networks do with that data format is really up to us.
00:35:00.320 --> 00:35:06.559
But we can't get there if all of these credentials are special and unique flowers.
00:35:06.800 --> 00:35:12.800
Then it's like, you know, 100 wallets and confusion, and we're sort of back to where we started, right?
00:35:13.360 --> 00:35:15.199
So the open standards are important.
00:35:15.360 --> 00:35:39.840
If I had a magic wand, I would build a movement of netizens who are like, open standards, give us open standards so that we prevent large company lock-in into their preferred way of doing things and stifle the innovation from all the creators that want to or could be doing a particular thing.
00:35:40.800 --> 00:35:41.599
Very interesting.
00:35:41.840 --> 00:35:57.039
So should we really be as we're promoting and publicizing this and telling people who aren't necessarily on board yet and we're and we're trying to persuade them, should we be talking as much about open standards as verifiable credentials or self-sovereign identity then?
00:35:57.199 --> 00:35:59.039
You know, because that's what's going to discriminate.
00:35:59.119 --> 00:36:02.320
That's what's going to bring about a better system overall, isn't it?
00:36:02.400 --> 00:36:07.599
If people understand and I think they do understand open standards much more than perhaps some of those other terms.
00:36:08.320 --> 00:36:08.800
Maybe.
00:36:09.039 --> 00:36:27.360
I mean, we have this challenge with the mobile driver's license standard is also a quote unquote open standard, although it's developed entirely in secret in an institution with really weird practices, and has within its architecture a phone home loop.
00:36:27.599 --> 00:36:33.599
So that when you present your mobile driver's license, you're not actually presenting the information on your driver's license.
00:36:33.679 --> 00:36:38.880
You're giving the police officer a token to go look it up in the database of the government.
00:36:40.400 --> 00:36:49.760
So that is the case where you can compare these two quote-unquote open theaters and say which one has a better architecture for privacy and for people.
00:36:49.920 --> 00:36:58.880
And I would argue the verifiable credential standards does because it doesn't have an optional phone-home loop to ping the state government database.
00:36:59.199 --> 00:36:59.599
Got it.
00:36:59.840 --> 00:37:10.719
Because if you have that kind of loop in your system, then the government can track everything you're doing and where you go because it's an authentication loop back to the government.
00:37:10.880 --> 00:37:28.800
Another example of a project that is open source and aspiring to provide or be an anchor for identity services globally is a project called MOSIP, the modular open source identity platform.
00:37:28.960 --> 00:37:30.239
Sounds great, right?
00:37:30.880 --> 00:37:32.880
Love open source, sure.
00:37:33.119 --> 00:37:56.400
But it's based on the ADHAR model, which is the model in India where you biometrically authenticate every time you use your ID, or you use an optional, there's another loop that's like a mobile phone loop, but that's still telling the government everywhere you use your ID.
00:37:56.639 --> 00:38:19.920
So these systems, wrapped up in words of goodness like open source, and in the case of the mobile driver's license standards as an open standard, have bad architectures for the values that we hold in Western Europe and in the United States of Western liberal democracy.
00:38:20.079 --> 00:38:27.760
Liberal meaning we are free to do what we want without the government seeing everything.
00:38:28.239 --> 00:38:36.320
And we need our digital architectures and our open standards to reflect those values in them.
00:38:37.039 --> 00:38:37.679
Understood.
00:38:37.840 --> 00:38:38.960
Yes, very much so.
00:38:39.119 --> 00:38:46.400
And we saw some of the dangers as well, didn't we, in um Afghanistan of sort of biometric-related identity systems.
00:38:46.559 --> 00:38:49.039
Do you remember when some of those systems were left behind?
00:38:49.760 --> 00:38:50.079
Sure.
00:38:50.239 --> 00:38:53.679
I I don't know if that's the best comparison to make.
00:38:54.079 --> 00:39:01.280
Again, almost all Western liberal democracies have photos of all of their citizens in some type of database somewhere.
00:39:01.840 --> 00:39:03.920
Photographs are biometrics, right?
00:39:04.079 --> 00:39:14.079
So the state of California has my photo because I have a state of California driver's license, and it's how we do what we call in the business identity binding.
00:39:14.239 --> 00:39:19.360
So it binds the information on the artifact to me, the person.
00:39:19.840 --> 00:39:22.159
So I think it's complicated, right?
00:39:22.800 --> 00:39:26.239
It's more about the everyday operation of a system.
00:39:26.559 --> 00:39:32.559
My paper driver's license from the state of California does not ping the state of California every time I use it.
00:39:32.800 --> 00:39:38.159
My digital version of the same thing should not ping the state of California every time I use it.
00:39:38.239 --> 00:39:41.519
It doesn't mean the state of California shouldn't have my photo somewhere.
00:39:41.840 --> 00:39:43.920
Yeah, I think that's what people want to know.
00:39:44.000 --> 00:39:47.840
I think that that allays a lot of fears uh that people have.
00:39:48.000 --> 00:39:51.760
Uh Lucy, am I right in thinking that you're based in um Canada?
00:39:52.079 --> 00:39:53.199
Yes, Toronto.
00:39:53.519 --> 00:39:54.239
Toronto, yes.
00:39:54.320 --> 00:39:55.920
So what's happening in um Canada?
00:39:56.000 --> 00:40:00.239
Because there's quite a lively digital identity ecosystem there, isn't there?
00:40:00.320 --> 00:40:02.159
There's a lot of um innovation.
00:40:02.559 --> 00:40:17.679
Yeah, I I I we're not working kind of directly with Canadian government, but being, you know, in Canada, I'm certainly aware of like there's a lot of initiative, I think both I think federally and provincially uh are you know related to digital identity.
00:40:17.920 --> 00:40:46.559
And also like you probably know like there are already existing systems, for example, like in British Columbia, they have built kind of their citizen, like BC citizen cars, some kind of like citizen kind of identity right into their existing system using using self-sovereign identity, as well as there's an organization kind of level network that using self-sovereign identity, virtual credentials to give to like businesses so they can identify businesses like in a more trustworthy way.
00:40:47.119 --> 00:40:57.360
There are initiatives like this, like in Canada, that are going on, and also like I know a lot of like more kind of like the driver's lessons, like in uh in Ontario where I'm in.
00:40:57.440 --> 00:41:04.159
I think they're also looking at using virtual credentials as well as other kind of digital identities.
00:41:04.400 --> 00:41:15.679
So I would say Canada's certainly kind of a leader in this space, and uh and also like the there's an organization called DIAC, Digital Identity and Authentication Concept Canada.
00:41:15.840 --> 00:41:30.719
So they're being quite active working with government, with the industry to coordinate like the private sector profile of the Pan-Canadian trust framework, which is that the government is acting, the federal government is actually leading the public sector profile.
00:41:30.800 --> 00:41:33.760
So this is a really, really big and important work.
00:41:33.920 --> 00:41:39.119
And as Clea mentioned earlier, like the trust framework is actually like the kind of key pieces.
00:41:39.280 --> 00:41:42.320
You can't just have technology without have without governance, right?
00:41:42.400 --> 00:41:45.039
The proper governance to guide who is doing what.
00:41:45.280 --> 00:41:49.760
You also need to have like policies in place, the level of assurance of identity, right?
00:41:49.920 --> 00:41:52.159
Are are using pro are used properly.
00:41:52.320 --> 00:42:08.880
So these um kind of the trust framework are that led by both the government and associations like DIAC in Canada are are quite pioneering work, I believe many other governments are following and having conversations with the Canadian government about it.
00:42:09.840 --> 00:42:10.800
That's very interesting.
00:42:10.960 --> 00:42:16.480
Now, I understand that you've been working on the verifiable credentials for COVID, haven't you?
00:42:16.800 --> 00:42:19.440
You've certainly been looking at how to advance the adoption of those.
00:42:19.599 --> 00:42:29.039
In fact, I wanted to ask you both about two possible use cases, which is sort of COVID credentials, if you like, or immunization certificates.
00:42:29.199 --> 00:42:33.280
I don't know how you're thinking about them, and then central bank digital currencies.
00:42:33.599 --> 00:42:42.559
I wanted to ask you if these types of digital identity that you are working on are very important underpinnings to either one or both of those.
00:42:42.719 --> 00:42:48.239
I wonder if you could just start by telling us a little bit about the work you might have been doing with COVID certificates.
00:42:48.559 --> 00:43:02.559
So I got into the COVID work because like the this the self-sovereign identity community are, you know, organize a community called COVID credentials initiative or like very early on, like in a COVID, like March 2020.
00:43:02.800 --> 00:43:11.199
The idea is like we we we have done it elsewhere, and we feel like these technology can provide value in the fight against COVID.
00:43:11.599 --> 00:43:18.960
And initially we we were thinking about how we can have more kind of tech more kind of standard, right?
00:43:19.039 --> 00:43:34.559
Like the both that the public sector and private sector can adopt to use like the credentials, the verified credentials for a variety of use cases, you know, including like test results, vaccine certificate, and even like the providers, right?
00:43:34.639 --> 00:43:41.519
Who like the doctors and nurses who have like the kind of the right credentials to do certain kind of things, to access certain kind of facilities.
00:43:41.679 --> 00:43:44.960
So they're all these kind of things we're we're exploring early on.
00:43:45.199 --> 00:43:53.119
And to a point we realize it's it's very, very difficult in the sense that I think healthcare is quite complicated space.
00:43:53.360 --> 00:43:59.679
And it also have a lot of like you know, existing infrastructure, what we call like legacy systems.
00:44:00.159 --> 00:44:00.320
Right.
00:44:00.639 --> 00:44:06.400
Bring new technology in a very, very kind of in an emergent emergency situation, right?
00:44:06.480 --> 00:44:20.559
It's is not easy in the sense you have to think about how this new technology can work with existing systems and how like these entities who are not kind of quite like adapt to these new technology, how they can get on board.
00:44:20.719 --> 00:44:22.960
And especially when it involves the government, right?
00:44:23.039 --> 00:44:33.360
The government can't just like a let us take something new and then use it because it just involves too much, you know, security, all this understanding and buy-in like in internally in the government.
00:44:33.519 --> 00:44:48.400
And also as technologists, like you know, especially initially, we're mainly technologists, how we can make sure like technologies are also kind of built in, you know, and together with stakeholders, not only the health sector, but also like you know, the legal professionals, right?
00:44:48.480 --> 00:44:57.119
The ethical, like ethics, or people are kind of familiar with ethics and all these other things, you know, they have you know kind of their say to guide like the use of technology.
00:44:57.440 --> 00:45:13.039
So this is quite kind of a complicated process to a point where we realize it the thing for COVID is not it's not it's not like how emergency credentials can be fully, where the SSI model can be fully kind of established.
00:45:13.679 --> 00:45:15.280
This is a good kind of long-term.
00:45:15.440 --> 00:45:20.559
As you mentioned, there's an immunization record that's you know can also use the same infrastructure.
00:45:20.719 --> 00:45:30.400
So the COVID is literally just a starting point for us to look at if we want to bring in what we believe a good technology into an existing system, where should be the starting point.
00:45:30.559 --> 00:45:44.159
So I think that's what we learn a lot, like through doing the COVID work, why where should be the starting point of bringing these new technology into existing systems and start kind of creating awareness and education and also market buy-in of these?
00:45:44.320 --> 00:45:50.239
So that's yeah, I I I will pause here and see, you know, if Kalia have anything she wants to add.
00:45:51.199 --> 00:45:58.239
I think that there is you know, I'll pick up on what you were talking about, central bank digital currencies.
00:45:58.400 --> 00:46:11.039
I think there's a lot of questions like our current the the banking system as it exists today requires know your customer, and that's a government requirement.
00:46:11.280 --> 00:46:16.639
You cannot open a bank even in the farthest reachest of the farthest country.
00:46:16.880 --> 00:46:19.599
And this all happened after 9-11.
00:46:19.840 --> 00:46:46.079
It wasn't before 9-11, there was there was significantly less regulation in this regard, and it comes about from a quasi-governmental entity called FATIF, which was set up to sort of put in these norms around know your customer, and basically say if you don't conform to the norms, you can't plug into the global banking system, and it's that's the way it is.
00:46:46.239 --> 00:47:01.760
So now there's these conversations about cryptocurrencies and cryptocurrencies managed by governments, and sort of asking this question okay, how does the KYC regulation interact with this new digital world?
00:47:01.840 --> 00:47:03.679
And honestly, I don't know.
00:47:03.840 --> 00:47:05.840
It's not my area of expertise.
00:47:05.920 --> 00:47:08.559
I'm not the person who pays attention to that.
00:47:08.639 --> 00:47:15.519
I would strongly recommend if you want to explore that realm, to invite somebody like David Birch on your podcast.
00:47:15.920 --> 00:47:24.639
But this is the thing, is there's this, there's a super strong fear reactivity to digital identity things.
00:47:24.880 --> 00:47:26.239
And I think rightly so.
00:47:26.320 --> 00:47:35.760
Like one of the reasons I work on this and I know so much about it, is I was like, oh, if this goes wrong, it could be really scary, and I want to help it go in the right direction.
00:47:36.559 --> 00:47:46.719
I think it's important to learn more about the things that worry you and get engaged in shaping the future of technology.
00:47:46.800 --> 00:47:54.159
That's another thing, is this this kind of fatalism, like, oh, these giant entities are in the control and coming to get us.
00:47:54.239 --> 00:48:03.360
And like they're just trying to do their job, and there's a set of rules that we have today that might make sense in the future and they might not.
00:48:03.519 --> 00:48:28.719
And we as humans who are smart, intelligent beings who get together and make decisions together can shape the future together, and that's one of the funnest things that I've experienced in in this work is helping a community of really smart, super caring, very values-oriented people try and shape the standards for digital identity.
00:48:29.199 --> 00:48:38.159
And we're getting together this week at the Internet Identity Workshop, and we'll see what the next iteration of what we work on is.
00:49:28.320 --> 00:49:39.119
Yes, there are other technicalities, but you're also drawing a distinction between the technicalities and the standards and our values and the ways in which certain people might choose to use control or not.
00:49:39.360 --> 00:49:45.599
So the COVID certificate is interesting to me because really there's nothing wrong with the COVID certificate.
00:49:45.679 --> 00:49:50.639
It's the fact that you know it's mandated, you are given permissions or not.
00:49:50.800 --> 00:49:53.440
You know, you can go to a restaurant if you have one or not.
00:49:53.599 --> 00:50:04.559
It's those sorts of societal and policy agendas that are placed sort of alongside the actual technological immunisation certificate.
00:50:04.800 --> 00:50:07.440
It's not the technology itself necessarily, is it?
00:50:07.760 --> 00:50:13.119
It's the way in which it may be applied or some of the premises that might be put around it.
00:50:13.280 --> 00:50:49.039
And I think what you've both managed to do is really draw that out and explain to people the beauty, really, and the simple I know I'm gonna say simple, you'll probably laugh at this because I know it's highly complex, but when you talk about the philosophy rather than just the technology of self-sovereign identity, it does feel a very aesthetically simple, beautiful solution, really, that can, as you say, ensure that we are still free as citizens, as users, to go about our business, but also to be uh verified and for us to verify others?
00:50:49.119 --> 00:50:49.760
Is that fair?
00:50:50.239 --> 00:50:57.440
Yeah, and so I wonder as we sort of just conclude this discussion, one question that does come up a lot is about anonymity.
00:50:57.760 --> 00:51:04.960
In a world of self-sovereign identity, will we have uh one and only identity?
00:51:05.199 --> 00:51:07.920
Will we have the possibility of anonymity?
00:51:08.159 --> 00:51:13.840
Will we in fact be able to employ pseudonymity in some places if we if we want to or not?
00:51:14.000 --> 00:51:19.760
I don't know if you could just talk us through those concepts and how they might fit with self-sovereign identities.
00:51:20.239 --> 00:51:21.519
That's a great question.
00:51:21.679 --> 00:51:32.880
And I'll bring it back to a question you asked at the beginning, which is what is this digital identity thing and what's important about it, I think, and different than our physical identity.
00:51:33.119 --> 00:51:57.039
So when we choose to participate in different activities in the physical world, when we go to church on Sunday and we go to our strange hobby club in the afternoon on Sunday, and then we go to work on Monday morning, and then we do some volunteer work in the evening on Monday, we separate all those contexts physically, and we probably use the same name.
00:51:57.280 --> 00:52:23.360
But when we do that online, when we use the same name across very disparate contexts that we may not want linked together, or worse, the same identifier, like the same email address or the same handle from that one account, Facebook, across all these places, we're merging contexts for ourselves that we might not want merged.
00:52:23.679 --> 00:52:25.840
And back to our values.
00:52:26.079 --> 00:52:40.800
If we believe people should be able to go to church on Sunday and not have all the folks in that context see their volunteer work on Monday or their strange hobby in the afternoon the next same day.
00:52:40.960 --> 00:52:53.679
Like you we have to give people the freedom to use different identifiers in different contexts online because that's how you separate context in the digital space, not by physically moving around.
00:52:53.920 --> 00:52:54.239
Right?
00:52:54.559 --> 00:53:07.440
So one identifier that you're forced to use all places is a recipe for disaster online and creates really high risk for vulnerable people.
00:53:07.679 --> 00:53:24.880
You know, there's folks talking about sort of a pseudonym-generating service where you're known to the service, where your government, you know, the name on your government ID is known to them, but they issue you a pseudonym that then you could go use the other places.
00:53:24.960 --> 00:53:29.599
And unless you did something wrong, nobody ever comes and knocks on the door and finds out your name.
00:53:29.760 --> 00:53:38.880
But if you do start to do something inappropriate that's illegal, then they could go back to the service that generated your pseudonym and like get it.
00:53:39.039 --> 00:53:48.880
So there's like interesting ideas about how to both support anonymity or pseudonymity and accountability in the digital world.
00:53:49.119 --> 00:53:53.760
And I think we need to look at more of the look at more seriously at that.
00:53:53.840 --> 00:54:10.159
I mean, you could see this also in like the dating realm where people, especially women, do not reveal their real identity in those realms, but they're willing to be accountable and they like the men that they're trying to date to also be accountable in these systems, right?
00:54:10.559 --> 00:54:12.400
So it's about the context, isn't it?
00:54:13.360 --> 00:54:15.679
Isn't that not a kind of technology question?
00:54:15.760 --> 00:54:22.000
It's more of like a if I understand correctly, technology, there's capability, right, to actually do that.
00:54:22.159 --> 00:54:30.559
It's a matter of like where we should do what, that's which comes back to like the kind of the governance, like the policies, what the rules should be, right?
00:54:30.639 --> 00:54:34.719
What is the right thing to do, how to view technology, like right?
00:54:34.880 --> 00:54:37.840
So that's that's that's how I see this.
00:54:39.280 --> 00:54:40.559
I think that's right.
00:54:40.880 --> 00:54:43.199
Okay, well, we're coming to the end of our time together.
00:54:43.280 --> 00:54:48.719
So I just have one final question for you both, actually, which is what's your action for identity?
00:54:48.880 --> 00:54:51.679
We're just going to take a quick break and we'll be back in one second.
00:54:52.159 --> 00:54:54.800
The Future of You is sponsored by FutureMade Consulting.
00:54:54.960 --> 00:55:02.719
Running for outlets like Forbes, Reuters, Cool Hunting and Wired means I'm always on the lookout for those who can inspire me on alternative futures and work with me to activate them.
00:55:03.039 --> 00:55:08.239
That's why I tap into the brains of FutureMade, a network of established professionals in research for strategic thinking.
00:55:08.639 --> 00:55:12.239
They help me spot trends, roadmap innovation, and fully prepare for what comes next.
00:55:12.880 --> 00:55:20.320
I've worked with a host of global brands, businesses and organizations, whether it's consulting, speaking, or curate on future on projects big and small.
00:55:20.480 --> 00:55:22.639
They even do training to teach you these skills too.
00:55:22.960 --> 00:55:31.199
Whether you're a CEO, CMO, or just in the business of starting up, future made can help you grow business, design product, and make decisions or with a future in mind.
00:55:31.440 --> 00:55:33.840
Find out more at future made.consulting.
00:55:34.000 --> 00:55:35.360
Made with a future in mind.
00:55:36.239 --> 00:55:41.599
Okay, Khalia and Lucy, I'd like to ask you both, they can be the same answer or different.
00:55:41.840 --> 00:55:43.920
What are your actions for identity?
00:55:44.079 --> 00:55:45.199
What would you like to see?
00:55:45.280 --> 00:55:47.679
Or what do you think must happen next?
00:55:48.239 --> 00:55:50.480
So I alluded to this earlier.
00:55:50.639 --> 00:56:04.000
I'd love to see a social movement of concerned citizens who are educating themselves and also engaging with the issue, but not like in a hysterical way, but in a proactive movement-building way.
00:56:04.159 --> 00:56:10.719
So those of us values-based technologists who are really trying to shape the future in a positive way have some backup.
00:56:11.039 --> 00:56:36.800
Yeah, I would really love to see business people, like this people like me, to actually understand what is like the like not inside out, but at least get dive a little bit deeper into how digital identity technology got to where it is today, and and which kind of help us understand, like if we're building new businesses around these technologies, what we need to do, like what is the right thing to do from a business standpoint of view.
00:56:37.119 --> 00:56:38.559
Absolutely brilliant answers.
00:56:38.719 --> 00:56:50.079
Well, I think we've done quite a bit today, actually, to maybe play a small role in this emerging social movement and also explain to people or explore with people, you know, what's the right thing to do.
00:56:50.320 --> 00:57:03.679
I can't thank you both enough, actually, for taking the time in such a considerate manner to explain really highly complex technical systems in very simple ways that the general public can pick up and understand.
00:57:03.760 --> 00:57:07.440
And actually, when they understand it, I'm sure they want to be more involved in it.
00:57:07.519 --> 00:57:08.400
That's how I felt.
00:57:08.559 --> 00:57:13.679
The more I was starting to understand it, the more I realised that I want to be more engaged and involved in it.
00:57:13.760 --> 00:57:16.719
So I hope this podcast episode will play a small part in that.
00:57:16.880 --> 00:57:17.760
Can't thank you enough.
00:57:17.840 --> 00:57:19.679
Thank you both, Khalia and Lucy.
00:57:19.920 --> 00:57:21.440
Thank you, Tracy, for having us.
00:57:21.599 --> 00:57:22.559
Thank you, Tracy.
00:57:28.960 --> 00:57:40.400
I'd really like to take a moment to thank everyone who has downloaded, subscribed, and left a five-star rating, which helped Apple Podcasts recognise the future of you as one of the best news shows in tech.
00:57:40.880 --> 00:57:52.000
And if you haven't left a rating, please do, and do visit the futurofieu.co.uk if you'd like to sign up to our newsletter covering all things identity in a digital world.