00:00:11Government's Role in Data Quality
00:07:32Government Action
00:20:47Addressing Identity Fraud and Government Benefits
00:26:36Digital Identity and Government Services
00:33:10Importance of Cybersecurity and Digital Identity
درباره این اپیزود
Ever wondered about government's role in online identification and how it could expand to help our digital economy function better and safer? Or how government data quality directly impacts risk assessment?
In this episode of Making Data Better, we tackle where US and Australian governments stand on protecting our digital IDs and personal credentials.
Join us as Jeremy Grant, Managing Director of Technology Business Strategy at Venable LLP, brings his insights on security technology strategy, policy, finance, and more to Making Data Better. Jeremy speaks to his decades-long experience with US federal and state government initiatives. And to the work of his organization, the Better Identity Coalition (check out its policy papers for federal and state-level policymakers!)
Government issues the credentials we rely on to prove who we are. Regulating how those credentials may be protected to enjoy expanded usage is both necessary and fraught with complications. Tech regulation has a history of being well behind technology's evolution.
That said, it is coherent policy and political direction that is needed. Disparate agencies may fully understand the potential of the assets they manage but without strategic focus at the highest level, the challenge of digital ID will remain. And our exposure to fraudsters, synthetic identities, and nation-state attacks will continue.
This is no small matter. FINCEN, the Treasury Department's Financial Crimes Enforcement Network, recently announced their analysis of bank-filed suspicious activity reports. They found that $212 billion of transactions were tied to compromised identity. The General Accounting Office, the investigative arm of the US Congress, estimated between $100 and $135 billion losses in public benefits fraud during the pandemic.
This is real money, ending up in the hands of organized criminals and adversarial nation-states.
So, take a listen to this episode with Jeremy Grant and Lockstep's Steve Wilson and George Peabody. There's work to be done.
انگلیسی
ایالات متحده آمریکا
یادداشت ها را نشان دهید 🔗
رونوشت 🔗
WEBVTT
00:00:11.071 --> 00:00:18.687
Welcome to Making Data Better, a podcast about data quality and the impact it has on how we protect, manage and use the digital data critical to our lives.
00:00:18.687 --> 00:00:23.126
I'm George Peabody, partner at Lockstep Consulting, and thanks for joining us.
00:00:23.126 --> 00:00:27.466
I'm so glad you can join us, and with me is Lockstep founder Steve Wilson.
00:00:27.466 --> 00:00:30.179
Hey, steve, hey George, how are you doing Very well?
00:00:30.179 --> 00:00:45.502
Sometime we're going to talk a lot about all the exciting things that are happening in Australia, but today we're going to take a little more of a focus on what's happening in the US to provide some context to something that we think is super important, and that's to be clear, data quality.
00:00:45.502 --> 00:01:00.473
And we look at data quality as a social and economic concern, while there are multiple mechanisms for individual enterprises to attempt to manage and protect their data, and we know that hackers find the cracks in those bespoke walls all too often.
00:01:00.473 --> 00:01:11.629
So we believe the long-term solution requires systemic change and ecosystem build, if you will, to how we conduct data sharing, security and government.
00:01:11.629 --> 00:01:15.280
And in this discussion, technology is not essential.
00:01:15.280 --> 00:01:16.182
We're far from it.
00:01:16.182 --> 00:01:25.493
We're interested in how the upcode to use Scott Shapiro's single word to describe the rules and procedures that govern tech behavior.
00:01:25.493 --> 00:01:30.897
We're really interested in how the upcode is developed and guides how we, in this case, manage the task of.
00:01:30.897 --> 00:01:42.697
We're really going to be talking a lot about identification online today, and I use that that last verb, govern intentionally, because we believe that government at all levels has a major role to play.
00:01:42.697 --> 00:01:43.878
Why?
00:01:43.878 --> 00:01:48.990
Well, let's focus on one use case for data quality identification online.
00:01:49.935 --> 00:01:54.388
Knowing who we transact with remains challenging, and getting that wrong is costly.
00:01:54.388 --> 00:01:55.352
Fraud hurts.
00:01:55.352 --> 00:01:59.763
The day we leave risk management up to the party with something to lose.
00:01:59.763 --> 00:02:06.406
Called the relying party is the party that owns the risk, and we are all relying parties.
00:02:06.406 --> 00:02:09.312
Each of us performs the risk management tasks every day.
00:02:09.312 --> 00:02:13.394
We may lock our apartment door, our car or use a password manager or not.
00:02:13.394 --> 00:02:15.662
Those are all individual decisions.
00:02:15.662 --> 00:02:23.986
Individuals and businesses have all sorts of tools to assess risk and decide whether or not to trust In the world we might want to see.
00:02:23.986 --> 00:02:26.953
We want to look someone right in the eye.
00:02:26.953 --> 00:02:29.667
Online, the tools we use are different.
00:02:29.667 --> 00:02:44.689
Cyber space is still new, risk management tools are evolving and the data isn't very good, and now that we have generative AI, we have the ability to create bullshitted industrial scale at zero cost.
00:02:44.689 --> 00:03:01.140
It turns out that managing the cost of fraud has many similarities to the cost of pollution, and I'm really going to be interested in our guests today reaction to this particular metaphor Individuals, and often those with the fewest assets to protect.
00:03:01.161 --> 00:03:04.949
They're a disproportionate burden of impact when defrauded.
00:03:04.949 --> 00:03:14.361
Today's post-breach nostrum of free data monitoring services how many of those have you gotten over the last 10 years, or 20?
00:03:14.361 --> 00:03:20.284
They're a thin layer of protection and we can't pretend that fraud doesn't have huge cost to enterprises too.
00:03:20.284 --> 00:03:41.510
In our last Making Data Better episode, we saw what it took for Heartland payment systems to recover from massive system compromise and, as we've seen over and over with pollution, the marketplace alone, without government influence, has insufficient incentives, imaginations or tools to put forward systemic or network-wide guidance.
00:03:41.510 --> 00:03:44.743
So that's our premise and viewpoint here at Lockstep.
00:03:45.264 --> 00:03:59.078
We think government has an important role to play in data quality, and it's a role that governments are just beginning to examine around data quality and in this role in online safety In the real world, government has a huge interest in safety.
00:03:59.078 --> 00:04:05.717
There's not an airplane in the air that doesn't conform to the FAA's strict certification regulations.
00:04:05.717 --> 00:04:11.007
60 years ago, automobile safety was up to the manufacturer, no more.
00:04:11.007 --> 00:04:17.446
So what could or should governments do about data quality and what would be the impact.
00:04:17.446 --> 00:04:22.644
So I'm very pleased to say that we're going to examine the role of government.
00:04:22.644 --> 00:04:31.391
We're delighted to welcome Jeremy Grant, managing director of technology business strategy at Washington DC law firm Venable LLP.
00:04:31.391 --> 00:04:51.963
Jeremy has long worked on digital identity in the public sector, having been senior executive advisor to the USA's National Strategy for Trusted Identity and Cyberspace Initiative, a key advisor to the FIDO Alliance, which has a huge bit of something to celebrate this year and a leader of the Better Identity Coalition.
00:04:51.963 --> 00:04:56.052
So with all that preamble, jeremy, welcome to Making Data Better.
00:04:56.660 --> 00:04:57.744
Thanks Great to be here.
00:04:57.744 --> 00:04:58.567
Where do we start?
00:04:59.350 --> 00:05:01.579
So why don't we start with what you're doing?
00:05:01.579 --> 00:05:02.649
What you're doing now?
00:05:02.649 --> 00:05:08.367
Tell us about your work and why a law firm is so eager to have an expert in online identity in the practice.
00:05:08.949 --> 00:05:12.495
Yeah, so the easiest way to describe my role at Venable.
00:05:12.680 --> 00:05:22.529
So Venable has what, by most measures, is the largest cybersecurity and privacy legal team in the US, and I'm going to say about eight, nine years ago.
00:05:22.632 --> 00:05:40.449
The chairman of that practice, who actually chairs the whole firm, now came to the conclusion that there's a lot of things that they're often asked to do as attorneys because they're in there as a trusted advisor, usually to the general councils of companies, but also sometimes dealing with product teams or on the security side, if somebody's dealing with incident response.
00:05:40.533 --> 00:06:15.238
He said there's a lot of things lawyers just don't necessarily know how to do, and so he had the idea of what if we could actually complement this best in class legal team with people who understand security technology strategy, policy, finance that would allow the firm to offer we call our 360 degree approach to service, where, if you're looking to do something, say, in the identity space, where you need help understanding technology, security strategy in terms of what might work, what might not, also liability and regulatory compliance, well, we've got attorneys who are great here.
00:06:15.238 --> 00:06:26.975
We've got a team that I lead that's really helpful there, and so think of us almost as a boutique consulting firm that just happens to be co-located inside a great law firm that specializes in the same things that we do.
00:06:26.975 --> 00:06:28.550
It's a little bit of a different model.
00:06:28.550 --> 00:06:35.012
I'm not sure any other firm has it, at least not at the scale that we have but it's one that works really well for us and for our clients.
00:06:35.764 --> 00:06:36.749
That makes so much sense.
00:06:36.749 --> 00:06:48.915
Jeremy, we've got a particular angle that George has already explored, that we're looking at so many of the world's problems through this lens of data and a lot of what you say always resonates with me around data.
00:06:48.915 --> 00:06:53.737
We had some great conversations just a couple of weeks ago in Carlsbad at the Fido Authenticate Conference.
00:06:53.737 --> 00:06:56.130
It was great to be out traveling again and good to see you.
00:06:56.130 --> 00:06:57.233
Definitely.
00:06:57.233 --> 00:07:05.649
How do you reflect on data quality and its import for cyberspace and risk and everything that you're doing in the law firm?
00:07:06.725 --> 00:07:27.692
I think it's a great angle you guys are looking at here, in that, beyond identity security or, frankly, anything that's fueling this data-driven economy, so much of the algorithms that we're feeding the systems that we're building are dependent on making sure that you're starting with the right facts, or at least enough of them, that you can start to analyze it properly.
00:07:29.286 --> 00:07:32.434
And I'll say as much as we'll talk about this a little more today.
00:07:32.434 --> 00:07:43.757
As much as I'm an advocate of having the government play a bigger role in digital identity, because they're the one nationally recognized authoritative source, even the government has a data quality problem when it comes to identity.
00:07:43.757 --> 00:08:05.807
I mean, I often point out our Social Security Administration here in the US mistakenly declares, I think, about 5,000 people dead every year, which, if you look at it in the context of there's 330 million Americans, all of whom have a social security number and deceased ones as well and whatnot, you're probably managing maybe twice that many identities in your system.
00:08:05.807 --> 00:08:07.915
5,000 is a pretty low error rate.
00:08:07.915 --> 00:08:20.675
That sounds pretty good when you do the percentages, unless you're one of the 5,000 people who has been declared dead suddenly life now looks like a Monty Python skip, but perhaps a little less funny.
00:08:21.245 --> 00:08:36.791
So I think it is an issue that underpins things in that the government has a role to play, but at the end of the day, nobody's going to be perfect, and the more we're going to perhaps rely on government systems for certain things, we also need to make sure that the quality is there.
00:08:37.445 --> 00:08:39.936
So we see a real willingness around the world.
00:08:39.936 --> 00:08:55.072
Well, not universally, but we see a willingness in the US administration with the Social Security online checking function, and in Australia we've got a document verification service where critical government documents can be checked in real time.
00:08:55.072 --> 00:08:59.534
So there's a willingness, we think, for government to get into the ecosystem.
00:08:59.534 --> 00:09:02.491
Would you like to see more done?
00:09:03.587 --> 00:09:20.974
I think a lot more needs to happen and unfortunately, I would characterize the willingness we've seen within the US government to be in isolated pockets as opposed to, I would say, as a whole of government approach, to sort of bind into the idea that we actually need to play a bigger role here.
00:09:20.974 --> 00:09:42.267
The Better Identity Polish, in which you mentioned before and is a group I lead, was founded with the premise that we have a hodgepodge of different nationally recognized authoritative credentials issued by a mix of federal, state and local authorities, but their usefulness generally stops in physical application because there aren't digital counterparts.
00:09:42.267 --> 00:09:44.232
There aren't ways to validate the information there.
00:09:44.232 --> 00:09:53.513
There's no way for me as an American to ask an agency route that develops for me when I'm trying to prove who I am online, and so we see some isolated things that are out there.
00:09:53.513 --> 00:09:58.958
For example, when you mentioned, our Social Security administration will validate some appliance, say, for a new credit card.
00:09:59.004 --> 00:10:02.147
Is there really a Jeremy Grant with this date of birth and SSN who's not dead?
00:10:02.147 --> 00:10:17.590
Yes, no answer there can be really helpful in preventing synthetic identity fraud, which the Federal Reserve has stated is the fastest growing type of financial crime in the US, but they'll only do that for banks and only for certain types of applications because they were narrowly directed by Congress.
00:10:17.590 --> 00:10:18.592
Well, you have to do this.
00:10:18.592 --> 00:10:28.889
Nothing legally precludes them from doing that, say, if I'm applying for government benefits where there's also a big synthetic fraud problem, but the SSA does not do that, and so we actually have this.
00:10:28.889 --> 00:10:51.455
Really, I don't even know if bifurcated gets into how messed up it is in many ways, where there's little places here and there, where there's pockets of excellence in identity services, but without a holistic approach to define what good looks like and how we get there and ensure that services are available more widely, we actually, I think, are really falling behind a lot of our competitors across the globe.
00:10:52.144 --> 00:10:54.614
You observe about the physical use of credentials.
00:10:54.614 --> 00:11:04.331
Typically I get a bit frustrated that it's not just a government problem but there's some tunnel vision with the ISO MDL work, sometimes the mobile driver's license.
00:11:04.331 --> 00:11:14.028
I've sat in rooms where people are saying wouldn't it be a good idea if this driver's license on the mobile phone was presented or usable online?
00:11:14.028 --> 00:11:24.037
And it's like their default assumption is this thing is only ever going to be used offline and it's a brand new idea that you would use a digital driver's license online.
00:11:24.037 --> 00:11:28.576
I just think it's a slow rate of thinking sometimes.
00:11:29.066 --> 00:11:31.735
I would argue with what's happening in the MDL world.
00:11:31.735 --> 00:11:51.961
We've got things absolutely upside down in that the ability to use an app on my phone to go through an airport security checkpoint or to get a beer at a bar that's a nice to have, Makes things maybe a little more efficient, or if I leave my wallet behind while I've got a backup on my phone, but it doesn't really solve any pressing problems.
00:11:52.261 --> 00:11:53.245
It is not transformative.
00:11:54.126 --> 00:12:06.831
And meanwhile in the US and I think globally as well but I can certainly quote some of the US numbers we have an absolute epidemic of identity related cyber crime that is costing the country hundreds of billions of dollars.
00:12:06.831 --> 00:12:09.732
I mean just to quantify those numbers.
00:12:09.732 --> 00:12:20.200
Fincen, the Treasury Department's Financial Crimes Enforcement Network, recently announced that they did an analysis of all of the so banks file something called suspicious activity reports with FinCEN.
00:12:20.200 --> 00:12:29.393
When they see an evidence of, hey, this is likely, suspicious, likely financial crime, we're going to continue the 2021 reports that were filed.
00:12:29.393 --> 00:12:36.187
$212 billion of transactions that were filed in those reports tied to compromised identity.
00:12:37.054 --> 00:12:54.644
Moving to public benefits tracking fraud, during the pandemic, when our government pumped a lot of money into new benefits systems to aid people who were suddenly out of work, the GAO, which is the investigative arm of the US Congress, estimated between $100 and $135 billion loss.
00:12:54.654 --> 00:13:05.083
So let's take the low point of that, $100 on top of the $212 billion, that's over $300 billion just in two sectors, and that doesn't even start to scratch the surface of what's going on in other places.
00:13:05.083 --> 00:13:16.125
Much of this crime is because it is really easy to defeat the systems that agencies and private sector organizations have in place today to try and verify who's who online.
00:13:16.125 --> 00:13:26.503
We're still, in many places, clinging to this outdated idea that because I know five things about you, that means I must be you and so I can open an account in your name and assume your identity.
00:13:26.503 --> 00:13:52.359
And it's, I would say, a little frustrating that it has taken so long for the government and I would say, industry writ large as well to sort of recognize this stuff doesn't work anymore, and when we have a national problem and it's costing Americans and American businesses and government agencies and others a lot of money and we need to actually have a strategic approach to solve it, that is definitely missing right now in the US.
00:13:52.359 --> 00:13:53.581
Today Will sit.
00:13:54.966 --> 00:13:58.923
Jeremy, we were all at Tvito authenticate and we are so happy to see that.
00:13:58.923 --> 00:14:02.456
Past keys, this replacement for passwords.
00:14:02.456 --> 00:14:07.918
We're shifting from plain text to device assisted presentation Super exciting, right.
00:14:07.918 --> 00:14:16.321
We'd love to see similar treatment to the credentials that we use, those, those other four other five things you were just talking about.
00:14:16.321 --> 00:14:24.905
Where there's some chain of custody, the provenance of that data can be assured through devices assisted presentation.
00:14:24.905 --> 00:14:28.844
Have you seen any discussion about that kind of thing?
00:14:29.636 --> 00:14:32.105
Well, I think mobile driver's licenses are going to get there.
00:14:32.105 --> 00:14:42.123
I mean, to Steve's point, they're focusing largely on the in person use cases, but they are also working on a complimentary set of standards to support, you know, what I would call online presentation of my credentials.
00:14:42.123 --> 00:14:45.041
So, look, we've been at this a long time.
00:14:45.041 --> 00:14:46.945
The technology is not actually that hard.
00:14:46.945 --> 00:14:56.029
It's not very difficult to, you know, be able to have digitally signed credentials stored and protected hardware on this device tied back to the state.
00:14:56.129 --> 00:15:08.496
You know DMV that issues the credentials say it's a mobile driver's license that I can then use, so that the experience when I am looking to prove who I am goes from answer these five questions tied to your credit report.
00:15:08.496 --> 00:15:13.177
Or, hey, take a picture of your ID and a selfie and enter a bunch of other information to.
00:15:13.177 --> 00:15:22.600
In about five seconds, you launch your app that says hey, this bank or this agency is looking to know these four things about you, or these seven things, depending on how many validated attributes they need.
00:15:22.600 --> 00:15:24.278
Are you okay sharing it with them?
00:15:24.278 --> 00:15:30.326
Sure, and at that point this device then transmits digitally signed data that the reliant party can validate.
00:15:30.326 --> 00:15:32.322
I mean, this isn't rocket science.
00:15:32.322 --> 00:15:35.475
This is pretty easy stuff, but it does require-.
00:15:35.917 --> 00:15:36.900
That's the down code.
00:15:36.900 --> 00:15:41.205
The up code is the government orientation towards the problem.
00:15:42.215 --> 00:15:44.086
And the government has to decide collectively that.
00:15:44.086 --> 00:15:50.105
You know they give a crap to actually look to digitize this stuff, which I think is really where in the US we have been.
00:15:50.105 --> 00:15:59.801
Look, there are a lot of pockets of great people in different agencies right now, as well as in the States, looking to drive this forward, but most of them, in my view, are often an island.
00:15:59.801 --> 00:16:20.061
They're, you know, trying to drive stuff forward with the authorities and the budgets they have, which is not very significant, and there isn't any prioritization of this at a national level to try and guide it and, you know, ensure that as we do this, how do we set a high bar for security and privacy and accessibility and usability?
00:16:20.061 --> 00:16:21.476
How do we define?
00:16:21.476 --> 00:16:26.982
You know, as I said before, what good looks like and how to get there, or what bad looks like, and you know what are the risks to avoid.
00:16:26.982 --> 00:16:29.018
So it's not all bleak.
00:16:29.018 --> 00:16:32.187
In that, I feel like we're making some progress.
00:16:32.355 --> 00:16:50.197
My concern is that at the current pace, it's going to take us 15 or 20 years to solve this problem and I don't think we have that long, particularly as we're seeing new, you know, attacks powered by generative AI that make some of the old ID spoofing attacks look, you know, very unsophisticated in comparison.
00:16:50.197 --> 00:16:56.856
One of the points I've made is we rely on things you know, like biometrics, for example, the selfie match tool.
00:16:56.856 --> 00:17:06.326
You know we're nearing a point, as AI gets more sophisticated and our adversaries start to use it, where we can't trust any face or voice or video.
00:17:06.326 --> 00:17:13.763
So, and there's a lot of things I look at as a practitioner in the identity space and I say, well God, can we really guard against it?
00:17:13.763 --> 00:17:19.061
And in some cases we can with, you know, maybe AI-powered liveness detection, but there's going to be a lot of really high quality spoof out there.
00:17:19.894 --> 00:17:29.059
One thing AI does not know how to defeat is public key cryptography, at least until it gets married to a post quantum computer in 15 years, and then we'll all be bowing down to the machines.
00:17:29.059 --> 00:17:50.102
Getting back to what you talked about with FIDO and the great things that are happening there in terms of solving authentication, finally getting beyond the password, that's, leveraging public key cryptography, being able to find proof of my identity to some form of public key cryptography, like that digitally signed credential I talked about that I want on my phone, as we're asked more and more to prove that we're human.
00:17:50.102 --> 00:17:56.260
It's gonna be really essential, I think, to have proof of identity bound to some sort of a thing that the AI is not able to defeat.
00:17:57.615 --> 00:18:08.003
Yeah, something physical, George, and I often say that this whole problem space boils down to data and metadata, but certainly that's the perspective of the relying party.
00:18:08.003 --> 00:18:10.022
That's all they've got to look at is data.
00:18:10.022 --> 00:18:15.403
But the physical aspect that you hit on there, I think, is so important and it's sort of key to FIDO.
00:18:15.403 --> 00:18:19.257
But AI can't defeat public key cryptography because it can't.
00:18:19.257 --> 00:18:26.138
You know, no large language model can walk out of the machine and grab hold of your key and enter a pin and take off with it.
00:18:26.138 --> 00:18:27.701
There's no scalable attack there.
00:18:27.701 --> 00:18:31.960
That because of the beauty of the hardware and the public key cryptography.
00:18:31.960 --> 00:18:33.378
You make such a good point.
00:18:33.378 --> 00:18:35.362
I just love hearing you say that, Jeremy.
00:18:35.835 --> 00:18:38.123
To be clear, pki offers a lot of headaches as well.
00:18:38.275 --> 00:19:03.939
It's not that I want to say that it's the easy solution, but again, this is where I mean certainly some of the discussions I have with you know, I would say national security officials who are thinking about this, and how do we start to get ahead of, you know, what could be a wave of scams and cyber crime that you know sort of puts the shame some of what we have seen to date and I don't mean to be sensationalist, I'm just it's not too hard to sort of see where this could be going or where some of it already is in terms of the trends.
00:19:04.714 --> 00:19:09.240
Well, you know, how do we actually start to decide that this is actually a priority?
00:19:09.240 --> 00:19:11.682
How do we decide this is something we really care about?
00:19:11.682 --> 00:19:23.684
To me, this is the sort of thing as you see these threats on the horizon on top of what's already a very significant identity related cyber crime problem that's largely benefiting hostile nation states and organized criminals.
00:19:23.684 --> 00:19:41.419
It's not like anybody nice is taking this, who we want to have our data or our money, but as you sort of see the types of attacks that are on the horizon, to me, this is the sort of thing where you would like to see your leaders acknowledging the threat and coming up with a strategy to proactively deal with it, and we've been advocating for a lot of that within the coalition.
00:19:41.419 --> 00:19:50.579
I would say there are a lot of people in the Biden administration and Congress who get it, but not necessarily enough to make something happen at this point.
00:19:51.414 --> 00:20:01.365
And would you say, Jeremy, that one of the challenges of democracy is that we have administrations that turn over on a periodic basis and then focus changes based on that?
00:20:02.134 --> 00:20:04.502
I mean, sometimes change is good, right.
00:20:04.502 --> 00:20:07.804
So you know I, you know.
00:20:07.804 --> 00:20:10.983
So, look, I've worked in Democratic politics a little over the years.
00:20:10.983 --> 00:20:17.701
I very famously sent out some fundraising emails during the 2020 campaign that said you can't spell Biden without ID.
00:20:19.154 --> 00:20:36.999
Because I was very bullish that, after the Trump administration had more or less ignored this issue for four years, that a Biden administration would look to pick up on the leadership shown by the Obama Biden administration, which, not to say that NSDIC was the be all, end all, but this was, you know.
00:20:36.999 --> 00:20:41.638
At least there was a strategy and a vision for how to move forward and it came out of the White House.
00:20:42.260 --> 00:20:46.564
Yes, and instead there has unfortunately been nothing.
00:20:46.564 --> 00:21:23.259
The efforts to date from the administration have largely focused on trying to address identity fraud and government benefits, which is a very small subset of the problem, and I think there's a challenge and you know we've made this point and there are those who get it but some who don't which is it is the same organized criminals and hostile nation states taking advantage of the same two, three and a before deficiencies in digital identity infrastructure and it really is infrastructure, if you think about it properly to steal not only from government but from banks and health and retail and fintech and cryptocurrency exchanges.
00:21:23.259 --> 00:21:24.763
It's all the same stuff.
00:21:24.763 --> 00:21:29.681
It's compromised passwords or compromised MFA, it's synthetic identity fraud.
00:21:29.681 --> 00:21:34.463
It's hey, I know the five things about you so I can be you and take over, set up accounts in your name.
00:21:35.335 --> 00:21:37.021
None of this is overly sophisticated.
00:21:37.021 --> 00:21:40.760
In fact, the reason we see so much of it is the attacks have become scalable.
00:21:40.760 --> 00:21:46.836
But if you just try to treat this as an issue around government benefits, you're gonna fail In that.
00:21:46.836 --> 00:21:50.804
Solving the government benefits issue doesn't mean you build new infrastructure for government benefits.
00:21:50.804 --> 00:22:00.363
It means you build infrastructure that can work in every one of those verticals and then government consumes it and it's also a much better experience at that point for Americans who look at to get those services.
00:22:00.775 --> 00:22:16.518
So that requires a government agency who has been issuing credentials for legibility purposes between the agency and its users, the citizens, to really rethink the utility of that account number that they created.
00:22:16.518 --> 00:22:19.762
What's it gonna take to get agencies?
00:22:19.762 --> 00:22:27.419
What do you think is the right approach to convince agency leadership that, hey, there's a bigger use for the credentials we already have?
00:22:28.035 --> 00:22:42.940
If you leave it to the agency heads who are in charge of issuing driver's licenses or state IDs or passports or social security numbers, which are not really credential, but at least an identifier, to figure out which George Peebo you are, you're not gonna get too far.
00:22:42.940 --> 00:22:48.102
This, honestly, isn't their job, or at least they don't realize it's their job.
00:22:48.102 --> 00:22:57.839
Yet and I mean as an example, the driver's license bureaus for years, when they had these discussions about identity, would say with a totally straight face we are not in the identity business.
00:22:57.839 --> 00:22:58.998
You see what I mean?
00:22:58.998 --> 00:23:05.019
Say, we issue you a card that says that you are authorized to operate a motor vehicle driver's license.
00:23:05.019 --> 00:23:16.486
The fact that other agencies and private sector entities like to use that as proof of identity is mildly interesting, but that's not what we're here for.
00:23:16.486 --> 00:23:20.455
We're here to say you can operate a motor vehicle Now.
00:23:20.536 --> 00:23:27.542
Congress then in 2005 passed with some controversy to the Real ID Act, which forced federal standards onto the states.
00:23:27.542 --> 00:23:29.830
That kind of made it their problem.
00:23:29.830 --> 00:23:33.648
Even then, it took a while for a lot of them to sort of recognize.
00:23:33.648 --> 00:23:37.730
I think what you're seeing now is some states are waking up and saying this is a dumb argument.
00:23:37.730 --> 00:23:46.853
Of course we're in the identity business, and why don't we recognize that and then take a step back and think about what does that mean in terms of what our role should be?
00:23:47.744 --> 00:24:02.454
So I do think that you're now seeing a lot of DMVs who are taking a more modern approach to things, but it is taken, I mean, I would say, over 20 years for this conversation to happen, and even now you will still have some states who are looking very much to just keep doing what they've been doing.
00:24:02.454 --> 00:24:16.429
This is why we've tried to focus our policy blueprints one for the federal level and one for the state level and the Better Identity Coalition on state legislatures, governor's offices at the federal level, congress and the president and his administration.
00:24:16.429 --> 00:24:28.909
I mean, you shouldn't necessarily expect change to come from within, but you can have those bodies that actually supervise agencies in the credential issuing business and that maybe have the ability to think a little more strategically about this.
00:24:28.909 --> 00:24:37.130
They can change things too, and we think that's really where the discussions need to go, as opposed to beating up a DMV director that they just don't get the vision of the future.
00:24:37.672 --> 00:24:37.992
Got it.
00:24:38.565 --> 00:24:45.731
Well, one of the powerful things we think about the better idea agenda the initiatives are incremental.
00:24:45.731 --> 00:24:50.890
That's not to downplay the enormous impact of those incremental changes.
00:24:50.890 --> 00:25:06.334
But to us, the important thing and we've learned this the hard way for many years that when you come up with a radical new digital vision for people and you change the meaning of business rules or you take the rug underneath people's feet about how they deal with risk, they can't cope with that.
00:25:06.334 --> 00:25:11.730
I think there's five initiatives in your Better ID Coalition agenda and they're all incremental.
00:25:11.730 --> 00:25:15.230
They're things like stopping so stupid with the social security number.
00:25:16.045 --> 00:25:17.450
Stop pretending that it's an authenticator.
00:25:17.450 --> 00:25:18.252
It's not a secret.
00:25:18.252 --> 00:25:20.666
It's great as an identifier, not very open.
00:25:22.164 --> 00:25:34.530
We think that preserving or conserving the meaning of data and the processes behind the data is probably important so that we don't scare the horses and people are still comfortable in their own agency missions.
00:25:34.530 --> 00:25:41.836
But we've got to make that data better when it winds up in people's hands and it's less vulnerable to replay and et cetera.
00:25:41.836 --> 00:25:45.088
I like one of the things you said at Identiverse, I think, jeremy.
00:25:45.088 --> 00:25:50.095
I don't know why you called it a uniquely American approach, but maybe that was marketing.
00:25:50.095 --> 00:25:56.612
But I love the way that you said why don't we take these ideas that we have now and make them presentable digitally?
00:25:56.612 --> 00:25:58.008
Have I got that right?
00:25:58.786 --> 00:26:13.990
Yeah, that's pretty much the thesis and I will say I mean here's why I think a uniquely American approach is needed is for years I mean certainly when I was running the NSTIC program for the Obama administration we would talk about what we were trying to do with the identity ecosystem and partnering with the private sector.
00:26:14.785 --> 00:26:19.788
You know, if I had a nickel every time somebody in the audience said, but what about the Estonians?
00:26:19.788 --> 00:26:20.971
Or but what about the Indians?
00:26:20.971 --> 00:26:25.275
I'd probably have about $8, which mean that wouldn't be rich.
00:26:25.275 --> 00:26:35.830
But it's got asked a lot and you know, like the point I made for example, look, india, for example I think it's just safe to say as an example with central match biometrics, would never fly politically in the US.
00:26:35.830 --> 00:26:43.894
Estonia is really interesting in that I mean, look, they've done some wonderful things for government services with their smart card program.
00:26:43.894 --> 00:26:56.753
But I also point out that Estonia is a country with a population that is less than that of Fairfax County, virginia, the suburb just across, you know, the river here in Northern Virginia, and it's actually a lot less diverse than Fairfax County.
00:26:57.365 --> 00:27:28.690
And also, fairfax County is not motivated by an existential threat immediately to its east because, you know a big driver for the big investment in digital government that the Estonians made when they became an independent country again was they're worried about when the Russians come in, and to them it's a matter, as we've seen with Ukraine, of you know if and not when, or at least that's how they're thinking, and they want to be able to run a government in exile which is a really great driver for issuing, you know, very robust smart cards to people, but a little different from the stuff we're working with in the US.
00:27:28.690 --> 00:27:32.334
So, look, the US has never had a national ID.
00:27:32.334 --> 00:27:38.950
The idea of one, I think, is triggers a lot of negativity on both the left and the right.
00:27:38.950 --> 00:27:46.448
People aren't comfortable with it, and so one of the things we thought about doing when we were creating the policy blueprint was to say what can we suggest?
00:27:46.448 --> 00:27:55.710
That's a little bit different, because too many times in the US, you get into maybe three minutes into the digital identity conversation and Estonia or India derail it.
00:27:56.392 --> 00:28:01.471
Yep, and how could we change the thinking to actually say here's another way we could do stuff?
00:28:01.471 --> 00:28:16.252
And so I think the best compliment I ever got on it was from Congressman Bill Foster, who spoke at an identity verse back in 2019, I believe, in Washington DC, right, and he said what I like about this blueprint.
00:28:16.252 --> 00:28:20.731
This was in his keynote, so I think it's fine if I quote him here what I like about this.
00:28:20.731 --> 00:28:29.509
I've been looking at this issue for a long time, and this is the only organization that's come up with an approach that's both technologically feasible, could solve the problem, and it's also politically feasible.
00:28:29.904 --> 00:28:37.788
It's not going to trigger people to take to the hills with their guns in protest, because we're not talking about creating any new identity systems whatsoever.
00:28:37.788 --> 00:28:57.606
We're just talking about coming up with digital counterparts and attribute validation services that are based off the systems we already have today, and I think what we have found politically in conversations with folks on all sides of the political spectrum is when you explain that, they kind of go oh, that doesn't sound so controversial, exactly.
00:28:58.369 --> 00:28:59.767
It's incremental, it's safe.
00:29:00.605 --> 00:29:09.109
So we're seeing the same thing in Australia after about 12 years and three different rounds of draft legislation.
00:29:09.305 --> 00:29:27.571
The latest installment has dropped about two months ago and it's called the Digital ID Bill and I read it twice before I realized that the phrase digital identity doesn't appear, and I think it's a significant pivot to go from digital identity to digital ID.
00:29:27.571 --> 00:29:55.273
I think that ID is a safer term but, more importantly, it's not a new thing, and our digital minister it happens to be the minister for finance his ownership of this bill and she's been very strong and articulate for some time that a new digital identity is not on the cards, let alone a national ID, because we share the same allergy down under as you do in the states for a new national ID.
00:29:55.273 --> 00:29:59.347
But it's not needed At Lockstep.
00:29:59.347 --> 00:30:03.594
We think what's needed is to make the data better and make it useless to criminals.
00:30:03.594 --> 00:30:15.615
But this new digital ID legislation sets up a governance framework within which you can demonstrate the fact that you have a set of IDs driver's license, birth certificates.
00:30:15.615 --> 00:30:21.090
It's the normal vocabulary or the normal grammar of identification, but made digital.
00:30:21.090 --> 00:30:23.790
I don't think there's anything scary in that.
00:30:24.704 --> 00:30:25.730
It shouldn't be to most people.
00:30:25.730 --> 00:30:28.574
I also think it's interesting.
00:30:28.574 --> 00:30:34.528
When we launched the N-Stick in 2011, we were very careful to say this is not a government-sponsored digital identity.
00:30:34.528 --> 00:30:51.772
It's all voluntary and all be driven by the private sector, because we were really trying to avoid triggering any of those emotions or different political groups and not to say that we didn't envision that the government might have some role in this.
00:30:51.772 --> 00:31:01.255
But there was an aspect of it where I think, in retrospect, we maybe were overlooking the elephant in the room which is, at the end of the day, the government's where the data is.
00:31:01.255 --> 00:31:03.271
The government's the only authoritative issuer.
00:31:03.271 --> 00:31:07.510
We've got a bunch of private sector systems that are trying to guess who's who.
00:31:07.510 --> 00:31:11.240
Some are decent at it, but let's not.
00:31:11.240 --> 00:31:17.777
Let's not be afraid to talk about why government's playing a more direct role is important.
00:31:18.785 --> 00:31:31.478
With that, I think we've also seen, in the 12 years since that strategy was first published, I think another generation has come into the digital age where, look, in 2011, we wouldn't have smartphones.
00:31:31.478 --> 00:31:34.755
I mean, a few people did, but it was still a pretty new thing.
00:31:34.755 --> 00:31:50.632
I had a flip phone when I went into government at the time but the idea of having these things that are very powerful and people are used to using as a remote control to their lives, and also just the fact that you're asked so many times each year to prove who you are to do something.
00:31:50.632 --> 00:31:51.674
People are tired of it.
00:31:51.674 --> 00:31:55.491
The idea of something as simple as I mean gosh.
00:31:55.491 --> 00:31:57.877
Again 2011, most people didn't have smartphones.
00:31:57.877 --> 00:31:59.911
Now we're carrying everything else on our phone.
00:31:59.911 --> 00:32:02.391
Why wouldn't you have your ID in it?
00:32:02.391 --> 00:32:06.214
People get this in a way that I don't think they would have a dozen years ago.
00:32:06.625 --> 00:32:07.328
Yeah, we'll sit.
00:32:07.328 --> 00:32:09.229
What haven't we asked you, Jeremy?
00:32:09.865 --> 00:32:11.109
Happy to talk about what's going on.
00:32:11.109 --> 00:32:20.615
We've got a, there's a legislation the Improving Digital Identity Act which we keep trying to drive forward or try to get the White House to do something based on it.
00:32:20.615 --> 00:32:28.913
We do point out you don't need a bill to actually tell the White House to launch an initiative to try and close this gap between physical and digital credentials.
00:32:28.913 --> 00:32:37.055
That's optimistic conversations with some folks in the House and Senate this last week, but I've also learned there's 10 steps to get a bill passed into law.
00:32:37.055 --> 00:32:39.873
You can get to nine and then somebody pops up and blocks you on number 10.
00:32:39.873 --> 00:32:44.895
And so it is a challenge that we still have, I think, to drive progress.
00:32:45.486 --> 00:32:51.451
Likewise, the White House had a really great section on digital identity and their national cyber strategy in March of this past year.
00:32:51.451 --> 00:32:55.375
When the implementation plan came out, we were all excited to see what they were going to do next.
00:32:55.375 --> 00:33:00.140
They skipped right over it, as if it was never in there, which I will say.
00:33:00.140 --> 00:33:09.375
There is disagreement in different parts of the White House in terms of whether they should do something, in how, and so I think there's some work that needs to be done to overcome some of those concerns as well.
00:33:10.306 --> 00:33:12.071
I'd like to say watch this space in Australia.
00:33:12.071 --> 00:33:26.698
Sometimes the five major Anglophone countries take it in turns to try something innovative in cybersecurity and I think that perhaps we're going to see a really modest way forward and maybe a model coming out of Australia.
00:33:26.698 --> 00:33:27.318
We'll see what happens.
00:33:27.318 --> 00:33:34.354
We're supposed to have a legislation developed and passed by June of next year, but there'll be quite a lot of governance to put in place in the meantime.
00:33:34.354 --> 00:33:41.089
It'll look like some of that mature governance that we've got in our open banking system here and we'll build on that.
00:33:41.526 --> 00:33:52.011
I'm rooting for you here and that we need more good examples of how to do this in a way that works and that candidly gets people worried that if we don't have something similar in the US, we're going to be falling behind.
00:33:52.011 --> 00:33:59.710
A point we keep making in our discussions with policymakers is that doing nothing is also an active policy choice.
00:33:59.710 --> 00:34:03.252
Indeed, you can look at do we pass this bill or not?
00:34:03.252 --> 00:34:04.789
That's often what the question is.
00:34:04.789 --> 00:34:07.152
A no vote means you're going to do nothing.
00:34:07.152 --> 00:34:23.992
You're going to preserve the status quo, which, in some cases, in some policies, is the right thing to do, but here, every year that we decide to do nothing means it's another year that we're falling further behind our peers like Australia that are leading on this, not to mention in the European Union and other countries across the globe.
00:34:23.992 --> 00:34:29.889
It means that the identity related attacks that we see in cyberspace get more sophisticated and we don't have a strategy.
00:34:29.889 --> 00:34:38.505
So doing nothing, even if you don't love the options, it's not a particularly good answer at this point, you know.
00:34:38.547 --> 00:34:54.094
Jeremy, I come from the payments industry and we noticed after chip cards were deployed in the UK and Europe around the rest of the world that fraud was migrating happily to the US because we were only a magstripe country at the time.
00:34:54.094 --> 00:35:10.777
I told the story today, getting the same effect right now, with fraudsters who are seeing us as more vulnerable and, of course, a massive target, this is a story today to a room full of congressional staff.
00:35:11.704 --> 00:35:30.273
I said in 2011, mastercard, at the conference I was at, revealed a stunning number, which is that the US accounted for 25% of all global transactions, but 50% of all payments card fraud, which meant we had an eight times higher fraud rate than the rest of the world, solely because we were stuck on magstripes while the rest of the world had moved to secure chip.
00:35:30.273 --> 00:35:36.842
And it was only after the target breach happened in 2013 that it was bad enough.
00:35:36.842 --> 00:35:38.088
Enough money was lost.
00:35:38.088 --> 00:35:41.588
The damage was bad enough that the banks and the retailers finally said we're going to move to chip.
00:35:41.588 --> 00:35:59.695
And I feel like we're at a very similar point right now when it comes to digital identity, in that, as other countries are moving ahead, we are going to be the last one standing hanging on to our old, archaic plastic cards and legacy systems trying to guess who's who, and we're going to be that eight times higher fraud rate again, if not more.
00:36:00.387 --> 00:36:10.490
The one thing that gives me some pause is that on my last trip to the US and I don't travel that often anymore, but I was delighted to see how many average retailers were accepting my Apple Pay.
00:36:10.490 --> 00:36:14.172
Even use Apple Pay on the San Francisco subway.
00:36:14.172 --> 00:36:26.092
Now, if you can click to pay, then you should be able to click or tap to present, and we think that maybe the US has got this ability to in fact leapfrog.
00:36:26.092 --> 00:36:40.293
Now that there's a increasingly a social acceptance of using this smart technology to send ones and zeros that relate to your payments, well, why not use the same technology to send ones and zeros that relate to your driver's license, your real ID, your birth certificate?
00:36:40.885 --> 00:36:48.873
I mean, it's no coincidence that in a lot of the companies that are driving digital identity solutions, it's the same team that's working on payments right now.
00:36:48.873 --> 00:36:53.034
The tech platforms, this is integrated.
00:36:53.034 --> 00:36:57.914
I mean they really see them as very complimentary to each other.
00:36:59.324 --> 00:37:13.637
I'll be a little bit grumpy in that in the payments industry, there's revenue associated with each transaction for multiple parties, and when we're talking about digital ID and security in general, it's a cost.
00:37:13.637 --> 00:37:24.954
So I'm hoping that there's a world where, just like, the FAA will move the aviation industry instantly if it decides to put a rule in place.
00:37:24.954 --> 00:37:30.215
Do you think, jeremy, we're going to need that kind of rulemaking to start to address this?
00:37:30.215 --> 00:37:37.068
And that's not such an incremental change, that's a fundamentally I mean it's hard to say Look part of it.
00:37:37.128 --> 00:37:44.916
I think, at least in terms of solving identity, is a lot of it gets back to government doing something itself, as opposed to trying to force industry through regulation.
00:37:44.916 --> 00:37:47.516
I think there's an interesting discussion around.
00:37:47.516 --> 00:38:04.293
I mean, more broadly, what's been going on in the cybersecurity space, where we've been in at least a 15 years argument over do we regulate critical infrastructure here or not, to mandate things like phishing resistance and multi-factor authentication versus just using passwords?
00:38:04.293 --> 00:38:14.331
And on that side I will say anytime you talk about regulating one, you've got one party that just doesn't like the idea right from the start.
00:38:14.331 --> 00:38:26.784
But also, how do I say this In aviation, the thing that's going to make a plane crash today is probably the same thing that was going to make it crash 10 years ago, and in 10 years we're now probably not a lot's going to change.
00:38:26.784 --> 00:38:30.617
You'll see some changes around the edges In security.
00:38:31.320 --> 00:38:46.157
Technology is changing constantly, threats changing constantly, and so I would say the anti-regulatory crowd does have a good point, which is that if you get too prescriptive, you may find yourself pointing to a bunch of compliance crap that's out of date.
00:38:46.157 --> 00:38:49.284
I mean, we see this all the time when I mean heck.
00:38:49.284 --> 00:38:57.858
The SEC just filed a lawsuit against SolarWinds this week, holding their CISO legally accountable, because they claim they had better password policies than they actually did.
00:38:57.858 --> 00:39:01.563
And my first reaction on that was password policies.
00:39:01.563 --> 00:39:05.143
What gives a crap about password policies in this decade?
00:39:05.143 --> 00:39:08.880
Like you can have a 30-character password and it'll still get fished.
00:39:08.880 --> 00:39:16.260
I mean, we're fighting the last war too many times, so I'll just offer that up as a cautionary note Every time we think forcing action.
00:39:16.260 --> 00:39:20.143
You really have to craft those things deliberately.
00:39:20.894 --> 00:39:22.521
Well, Jeremy, I think we need to leave it there.
00:39:22.521 --> 00:39:25.083
Terrific having you on making data better.
00:39:25.083 --> 00:39:26.097
Really appreciate it.
00:39:26.760 --> 00:39:27.463
Thank you for the invite.
00:39:27.463 --> 00:39:28.018
This was a pleasure.
00:39:28.574 --> 00:39:29.197
Well, that was cool.
00:39:29.197 --> 00:39:30.702
That was very good.
00:39:30.702 --> 00:39:37.260
If we're reflecting on what he had to say, I mean, I think he nailed it.
00:39:37.260 --> 00:39:38.920
You see the same pattern, don't you?
00:39:38.920 --> 00:39:39.757
Time and time again?
00:39:39.757 --> 00:39:42.882
Benefits fraud, payments fraud.
00:39:42.882 --> 00:39:44.340
He talked about synthetic identity.
00:39:44.340 --> 00:39:47.722
You and I are talking about data generally.
00:39:47.722 --> 00:39:51.724
Jeremy raised faces and videos for selfie matching.
00:39:51.724 --> 00:39:53.440
You don't know if any of that stuff's true.
00:39:53.440 --> 00:39:56.260
So it's all about provenance, isn't it?
00:39:56.260 --> 00:39:59.215
I mean, he said the same pattern is occurring all the time.
00:39:59.215 --> 00:40:01.101
Let's not just pick on social benefits fraud.
00:40:01.101 --> 00:40:06.159
If you could reuse those patterns, what do you need to know?
00:40:06.159 --> 00:40:08.880
How are you going to know that the data is true?
00:40:08.880 --> 00:40:13.018
And it seems to me that time and time again, we're seeing the same thing.
00:40:13.018 --> 00:40:17.262
How do you distribute the meaning of data so that you can tell what's in front of you is true or not?
00:40:17.715 --> 00:40:18.559
We have a lot of work to do.
00:40:19.335 --> 00:40:19.918
Yeah, we do.
00:40:19.918 --> 00:40:34.039
We've got a lot of stories to tell and if we can make those stories simple and not triggering I love the way that he was conscious of not triggering people with digital transformation I think that that's the trick.
00:40:34.875 --> 00:40:40.762
Well, I think, yeah, among other things, we ought to be encouraging folks to look at the Better Identity Coalition and their policy papers.
00:40:40.762 --> 00:40:43.021
We'll put that in the show notes.
00:40:43.021 --> 00:40:44.405
All right, we'll see.
00:40:44.405 --> 00:40:47.362
Thanks, very much Glad that we're doing this again.
00:40:47.362 --> 00:40:48.438
It's been a pleasure to talk to you.
00:40:49.494 --> 00:41:05.762
Good stuff, George Prepare for another Desmond Show generation.
00:00:11.071 --> 00:00:18.687
Welcome to Making Data Better, a podcast about data quality and the impact it has on how we protect, manage and use the digital data critical to our lives.
00:00:18.687 --> 00:00:23.126
I'm George Peabody, partner at Lockstep Consulting, and thanks for joining us.
00:00:23.126 --> 00:00:27.466
I'm so glad you can join us, and with me is Lockstep founder Steve Wilson.
00:00:27.466 --> 00:00:30.179
Hey, steve, hey George, how are you doing Very well?
00:00:30.179 --> 00:00:45.502
Sometime we're going to talk a lot about all the exciting things that are happening in Australia, but today we're going to take a little more of a focus on what's happening in the US to provide some context to something that we think is super important, and that's to be clear, data quality.
00:00:45.502 --> 00:01:00.473
And we look at data quality as a social and economic concern, while there are multiple mechanisms for individual enterprises to attempt to manage and protect their data, and we know that hackers find the cracks in those bespoke walls all too often.
00:01:00.473 --> 00:01:11.629
So we believe the long-term solution requires systemic change and ecosystem build, if you will, to how we conduct data sharing, security and government.
00:01:11.629 --> 00:01:15.280
And in this discussion, technology is not essential.
00:01:15.280 --> 00:01:16.182
We're far from it.
00:01:16.182 --> 00:01:25.493
We're interested in how the upcode to use Scott Shapiro's single word to describe the rules and procedures that govern tech behavior.
00:01:25.493 --> 00:01:30.897
We're really interested in how the upcode is developed and guides how we, in this case, manage the task of.
00:01:30.897 --> 00:01:42.697
We're really going to be talking a lot about identification online today, and I use that that last verb, govern intentionally, because we believe that government at all levels has a major role to play.
00:01:42.697 --> 00:01:43.878
Why?
00:01:43.878 --> 00:01:48.990
Well, let's focus on one use case for data quality identification online.
00:01:49.935 --> 00:01:54.388
Knowing who we transact with remains challenging, and getting that wrong is costly.
00:01:54.388 --> 00:01:55.352
Fraud hurts.
00:01:55.352 --> 00:01:59.763
The day we leave risk management up to the party with something to lose.
00:01:59.763 --> 00:02:06.406
Called the relying party is the party that owns the risk, and we are all relying parties.
00:02:06.406 --> 00:02:09.312
Each of us performs the risk management tasks every day.
00:02:09.312 --> 00:02:13.394
We may lock our apartment door, our car or use a password manager or not.
00:02:13.394 --> 00:02:15.662
Those are all individual decisions.
00:02:15.662 --> 00:02:23.986
Individuals and businesses have all sorts of tools to assess risk and decide whether or not to trust In the world we might want to see.
00:02:23.986 --> 00:02:26.953
We want to look someone right in the eye.
00:02:26.953 --> 00:02:29.667
Online, the tools we use are different.
00:02:29.667 --> 00:02:44.689
Cyber space is still new, risk management tools are evolving and the data isn't very good, and now that we have generative AI, we have the ability to create bullshitted industrial scale at zero cost.
00:02:44.689 --> 00:03:01.140
It turns out that managing the cost of fraud has many similarities to the cost of pollution, and I'm really going to be interested in our guests today reaction to this particular metaphor Individuals, and often those with the fewest assets to protect.
00:03:01.161 --> 00:03:04.949
They're a disproportionate burden of impact when defrauded.
00:03:04.949 --> 00:03:14.361
Today's post-breach nostrum of free data monitoring services how many of those have you gotten over the last 10 years, or 20?
00:03:14.361 --> 00:03:20.284
They're a thin layer of protection and we can't pretend that fraud doesn't have huge cost to enterprises too.
00:03:20.284 --> 00:03:41.510
In our last Making Data Better episode, we saw what it took for Heartland payment systems to recover from massive system compromise and, as we've seen over and over with pollution, the marketplace alone, without government influence, has insufficient incentives, imaginations or tools to put forward systemic or network-wide guidance.
00:03:41.510 --> 00:03:44.743
So that's our premise and viewpoint here at Lockstep.
00:03:45.264 --> 00:03:59.078
We think government has an important role to play in data quality, and it's a role that governments are just beginning to examine around data quality and in this role in online safety In the real world, government has a huge interest in safety.
00:03:59.078 --> 00:04:05.717
There's not an airplane in the air that doesn't conform to the FAA's strict certification regulations.
00:04:05.717 --> 00:04:11.007
60 years ago, automobile safety was up to the manufacturer, no more.
00:04:11.007 --> 00:04:17.446
So what could or should governments do about data quality and what would be the impact.
00:04:17.446 --> 00:04:22.644
So I'm very pleased to say that we're going to examine the role of government.
00:04:22.644 --> 00:04:31.391
We're delighted to welcome Jeremy Grant, managing director of technology business strategy at Washington DC law firm Venable LLP.
00:04:31.391 --> 00:04:51.963
Jeremy has long worked on digital identity in the public sector, having been senior executive advisor to the USA's National Strategy for Trusted Identity and Cyberspace Initiative, a key advisor to the FIDO Alliance, which has a huge bit of something to celebrate this year and a leader of the Better Identity Coalition.
00:04:51.963 --> 00:04:56.052
So with all that preamble, jeremy, welcome to Making Data Better.
00:04:56.660 --> 00:04:57.744
Thanks Great to be here.
00:04:57.744 --> 00:04:58.567
Where do we start?
00:04:59.350 --> 00:05:01.579
So why don't we start with what you're doing?
00:05:01.579 --> 00:05:02.649
What you're doing now?
00:05:02.649 --> 00:05:08.367
Tell us about your work and why a law firm is so eager to have an expert in online identity in the practice.
00:05:08.949 --> 00:05:12.495
Yeah, so the easiest way to describe my role at Venable.
00:05:12.680 --> 00:05:22.529
So Venable has what, by most measures, is the largest cybersecurity and privacy legal team in the US, and I'm going to say about eight, nine years ago.
00:05:22.632 --> 00:05:40.449
The chairman of that practice, who actually chairs the whole firm, now came to the conclusion that there's a lot of things that they're often asked to do as attorneys because they're in there as a trusted advisor, usually to the general councils of companies, but also sometimes dealing with product teams or on the security side, if somebody's dealing with incident response.
00:05:40.533 --> 00:06:15.238
He said there's a lot of things lawyers just don't necessarily know how to do, and so he had the idea of what if we could actually complement this best in class legal team with people who understand security technology strategy, policy, finance that would allow the firm to offer we call our 360 degree approach to service, where, if you're looking to do something, say, in the identity space, where you need help understanding technology, security strategy in terms of what might work, what might not, also liability and regulatory compliance, well, we've got attorneys who are great here.
00:06:15.238 --> 00:06:26.975
We've got a team that I lead that's really helpful there, and so think of us almost as a boutique consulting firm that just happens to be co-located inside a great law firm that specializes in the same things that we do.
00:06:26.975 --> 00:06:28.550
It's a little bit of a different model.
00:06:28.550 --> 00:06:35.012
I'm not sure any other firm has it, at least not at the scale that we have but it's one that works really well for us and for our clients.
00:06:35.764 --> 00:06:36.749
That makes so much sense.
00:06:36.749 --> 00:06:48.915
Jeremy, we've got a particular angle that George has already explored, that we're looking at so many of the world's problems through this lens of data and a lot of what you say always resonates with me around data.
00:06:48.915 --> 00:06:53.737
We had some great conversations just a couple of weeks ago in Carlsbad at the Fido Authenticate Conference.
00:06:53.737 --> 00:06:56.130
It was great to be out traveling again and good to see you.
00:06:56.130 --> 00:06:57.233
Definitely.
00:06:57.233 --> 00:07:05.649
How do you reflect on data quality and its import for cyberspace and risk and everything that you're doing in the law firm?
00:07:06.725 --> 00:07:27.692
I think it's a great angle you guys are looking at here, in that, beyond identity security or, frankly, anything that's fueling this data-driven economy, so much of the algorithms that we're feeding the systems that we're building are dependent on making sure that you're starting with the right facts, or at least enough of them, that you can start to analyze it properly.
00:07:29.286 --> 00:07:32.434
And I'll say as much as we'll talk about this a little more today.
00:07:32.434 --> 00:07:43.757
As much as I'm an advocate of having the government play a bigger role in digital identity, because they're the one nationally recognized authoritative source, even the government has a data quality problem when it comes to identity.
00:07:43.757 --> 00:08:05.807
I mean, I often point out our Social Security Administration here in the US mistakenly declares, I think, about 5,000 people dead every year, which, if you look at it in the context of there's 330 million Americans, all of whom have a social security number and deceased ones as well and whatnot, you're probably managing maybe twice that many identities in your system.
00:08:05.807 --> 00:08:07.915
5,000 is a pretty low error rate.
00:08:07.915 --> 00:08:20.675
That sounds pretty good when you do the percentages, unless you're one of the 5,000 people who has been declared dead suddenly life now looks like a Monty Python skip, but perhaps a little less funny.
00:08:21.245 --> 00:08:36.791
So I think it is an issue that underpins things in that the government has a role to play, but at the end of the day, nobody's going to be perfect, and the more we're going to perhaps rely on government systems for certain things, we also need to make sure that the quality is there.
00:08:37.445 --> 00:08:39.936
So we see a real willingness around the world.
00:08:39.936 --> 00:08:55.072
Well, not universally, but we see a willingness in the US administration with the Social Security online checking function, and in Australia we've got a document verification service where critical government documents can be checked in real time.
00:08:55.072 --> 00:08:59.534
So there's a willingness, we think, for government to get into the ecosystem.
00:08:59.534 --> 00:09:02.491
Would you like to see more done?
00:09:03.587 --> 00:09:20.974
I think a lot more needs to happen and unfortunately, I would characterize the willingness we've seen within the US government to be in isolated pockets as opposed to, I would say, as a whole of government approach, to sort of bind into the idea that we actually need to play a bigger role here.
00:09:20.974 --> 00:09:42.267
The Better Identity Polish, in which you mentioned before and is a group I lead, was founded with the premise that we have a hodgepodge of different nationally recognized authoritative credentials issued by a mix of federal, state and local authorities, but their usefulness generally stops in physical application because there aren't digital counterparts.
00:09:42.267 --> 00:09:44.232
There aren't ways to validate the information there.
00:09:44.232 --> 00:09:53.513
There's no way for me as an American to ask an agency route that develops for me when I'm trying to prove who I am online, and so we see some isolated things that are out there.
00:09:53.513 --> 00:09:58.958
For example, when you mentioned, our Social Security administration will validate some appliance, say, for a new credit card.
00:09:59.004 --> 00:10:02.147
Is there really a Jeremy Grant with this date of birth and SSN who's not dead?
00:10:02.147 --> 00:10:17.590
Yes, no answer there can be really helpful in preventing synthetic identity fraud, which the Federal Reserve has stated is the fastest growing type of financial crime in the US, but they'll only do that for banks and only for certain types of applications because they were narrowly directed by Congress.
00:10:17.590 --> 00:10:18.592
Well, you have to do this.
00:10:18.592 --> 00:10:28.889
Nothing legally precludes them from doing that, say, if I'm applying for government benefits where there's also a big synthetic fraud problem, but the SSA does not do that, and so we actually have this.
00:10:28.889 --> 00:10:51.455
Really, I don't even know if bifurcated gets into how messed up it is in many ways, where there's little places here and there, where there's pockets of excellence in identity services, but without a holistic approach to define what good looks like and how we get there and ensure that services are available more widely, we actually, I think, are really falling behind a lot of our competitors across the globe.
00:10:52.144 --> 00:10:54.614
You observe about the physical use of credentials.
00:10:54.614 --> 00:11:04.331
Typically I get a bit frustrated that it's not just a government problem but there's some tunnel vision with the ISO MDL work, sometimes the mobile driver's license.
00:11:04.331 --> 00:11:14.028
I've sat in rooms where people are saying wouldn't it be a good idea if this driver's license on the mobile phone was presented or usable online?
00:11:14.028 --> 00:11:24.037
And it's like their default assumption is this thing is only ever going to be used offline and it's a brand new idea that you would use a digital driver's license online.
00:11:24.037 --> 00:11:28.576
I just think it's a slow rate of thinking sometimes.
00:11:29.066 --> 00:11:31.735
I would argue with what's happening in the MDL world.
00:11:31.735 --> 00:11:51.961
We've got things absolutely upside down in that the ability to use an app on my phone to go through an airport security checkpoint or to get a beer at a bar that's a nice to have, Makes things maybe a little more efficient, or if I leave my wallet behind while I've got a backup on my phone, but it doesn't really solve any pressing problems.
00:11:52.261 --> 00:11:53.245
It is not transformative.
00:11:54.126 --> 00:12:06.831
And meanwhile in the US and I think globally as well but I can certainly quote some of the US numbers we have an absolute epidemic of identity related cyber crime that is costing the country hundreds of billions of dollars.
00:12:06.831 --> 00:12:09.732
I mean just to quantify those numbers.
00:12:09.732 --> 00:12:20.200
Fincen, the Treasury Department's Financial Crimes Enforcement Network, recently announced that they did an analysis of all of the so banks file something called suspicious activity reports with FinCEN.
00:12:20.200 --> 00:12:29.393
When they see an evidence of, hey, this is likely, suspicious, likely financial crime, we're going to continue the 2021 reports that were filed.
00:12:29.393 --> 00:12:36.187
$212 billion of transactions that were filed in those reports tied to compromised identity.
00:12:37.054 --> 00:12:54.644
Moving to public benefits tracking fraud, during the pandemic, when our government pumped a lot of money into new benefits systems to aid people who were suddenly out of work, the GAO, which is the investigative arm of the US Congress, estimated between $100 and $135 billion loss.
00:12:54.654 --> 00:13:05.083
So let's take the low point of that, $100 on top of the $212 billion, that's over $300 billion just in two sectors, and that doesn't even start to scratch the surface of what's going on in other places.
00:13:05.083 --> 00:13:16.125
Much of this crime is because it is really easy to defeat the systems that agencies and private sector organizations have in place today to try and verify who's who online.
00:13:16.125 --> 00:13:26.503
We're still, in many places, clinging to this outdated idea that because I know five things about you, that means I must be you and so I can open an account in your name and assume your identity.
00:13:26.503 --> 00:13:52.359
And it's, I would say, a little frustrating that it has taken so long for the government and I would say, industry writ large as well to sort of recognize this stuff doesn't work anymore, and when we have a national problem and it's costing Americans and American businesses and government agencies and others a lot of money and we need to actually have a strategic approach to solve it, that is definitely missing right now in the US.
00:13:52.359 --> 00:13:53.581
Today Will sit.
00:13:54.966 --> 00:13:58.923
Jeremy, we were all at Tvito authenticate and we are so happy to see that.
00:13:58.923 --> 00:14:02.456
Past keys, this replacement for passwords.
00:14:02.456 --> 00:14:07.918
We're shifting from plain text to device assisted presentation Super exciting, right.
00:14:07.918 --> 00:14:16.321
We'd love to see similar treatment to the credentials that we use, those, those other four other five things you were just talking about.
00:14:16.321 --> 00:14:24.905
Where there's some chain of custody, the provenance of that data can be assured through devices assisted presentation.
00:14:24.905 --> 00:14:28.844
Have you seen any discussion about that kind of thing?
00:14:29.636 --> 00:14:32.105
Well, I think mobile driver's licenses are going to get there.
00:14:32.105 --> 00:14:42.123
I mean, to Steve's point, they're focusing largely on the in person use cases, but they are also working on a complimentary set of standards to support, you know, what I would call online presentation of my credentials.
00:14:42.123 --> 00:14:45.041
So, look, we've been at this a long time.
00:14:45.041 --> 00:14:46.945
The technology is not actually that hard.
00:14:46.945 --> 00:14:56.029
It's not very difficult to, you know, be able to have digitally signed credentials stored and protected hardware on this device tied back to the state.
00:14:56.129 --> 00:15:08.496
You know DMV that issues the credentials say it's a mobile driver's license that I can then use, so that the experience when I am looking to prove who I am goes from answer these five questions tied to your credit report.
00:15:08.496 --> 00:15:13.177
Or, hey, take a picture of your ID and a selfie and enter a bunch of other information to.
00:15:13.177 --> 00:15:22.600
In about five seconds, you launch your app that says hey, this bank or this agency is looking to know these four things about you, or these seven things, depending on how many validated attributes they need.
00:15:22.600 --> 00:15:24.278
Are you okay sharing it with them?
00:15:24.278 --> 00:15:30.326
Sure, and at that point this device then transmits digitally signed data that the reliant party can validate.
00:15:30.326 --> 00:15:32.322
I mean, this isn't rocket science.
00:15:32.322 --> 00:15:35.475
This is pretty easy stuff, but it does require-.
00:15:35.917 --> 00:15:36.900
That's the down code.
00:15:36.900 --> 00:15:41.205
The up code is the government orientation towards the problem.
00:15:42.215 --> 00:15:44.086
And the government has to decide collectively that.
00:15:44.086 --> 00:15:50.105
You know they give a crap to actually look to digitize this stuff, which I think is really where in the US we have been.
00:15:50.105 --> 00:15:59.801
Look, there are a lot of pockets of great people in different agencies right now, as well as in the States, looking to drive this forward, but most of them, in my view, are often an island.
00:15:59.801 --> 00:16:20.061
They're, you know, trying to drive stuff forward with the authorities and the budgets they have, which is not very significant, and there isn't any prioritization of this at a national level to try and guide it and, you know, ensure that as we do this, how do we set a high bar for security and privacy and accessibility and usability?
00:16:20.061 --> 00:16:21.476
How do we define?
00:16:21.476 --> 00:16:26.982
You know, as I said before, what good looks like and how to get there, or what bad looks like, and you know what are the risks to avoid.
00:16:26.982 --> 00:16:29.018
So it's not all bleak.
00:16:29.018 --> 00:16:32.187
In that, I feel like we're making some progress.
00:16:32.355 --> 00:16:50.197
My concern is that at the current pace, it's going to take us 15 or 20 years to solve this problem and I don't think we have that long, particularly as we're seeing new, you know, attacks powered by generative AI that make some of the old ID spoofing attacks look, you know, very unsophisticated in comparison.
00:16:50.197 --> 00:16:56.856
One of the points I've made is we rely on things you know, like biometrics, for example, the selfie match tool.
00:16:56.856 --> 00:17:06.326
You know we're nearing a point, as AI gets more sophisticated and our adversaries start to use it, where we can't trust any face or voice or video.
00:17:06.326 --> 00:17:13.763
So, and there's a lot of things I look at as a practitioner in the identity space and I say, well God, can we really guard against it?
00:17:13.763 --> 00:17:19.061
And in some cases we can with, you know, maybe AI-powered liveness detection, but there's going to be a lot of really high quality spoof out there.
00:17:19.894 --> 00:17:29.059
One thing AI does not know how to defeat is public key cryptography, at least until it gets married to a post quantum computer in 15 years, and then we'll all be bowing down to the machines.
00:17:29.059 --> 00:17:50.102
Getting back to what you talked about with FIDO and the great things that are happening there in terms of solving authentication, finally getting beyond the password, that's, leveraging public key cryptography, being able to find proof of my identity to some form of public key cryptography, like that digitally signed credential I talked about that I want on my phone, as we're asked more and more to prove that we're human.
00:17:50.102 --> 00:17:56.260
It's gonna be really essential, I think, to have proof of identity bound to some sort of a thing that the AI is not able to defeat.
00:17:57.615 --> 00:18:08.003
Yeah, something physical, George, and I often say that this whole problem space boils down to data and metadata, but certainly that's the perspective of the relying party.
00:18:08.003 --> 00:18:10.022
That's all they've got to look at is data.
00:18:10.022 --> 00:18:15.403
But the physical aspect that you hit on there, I think, is so important and it's sort of key to FIDO.
00:18:15.403 --> 00:18:19.257
But AI can't defeat public key cryptography because it can't.
00:18:19.257 --> 00:18:26.138
You know, no large language model can walk out of the machine and grab hold of your key and enter a pin and take off with it.
00:18:26.138 --> 00:18:27.701
There's no scalable attack there.
00:18:27.701 --> 00:18:31.960
That because of the beauty of the hardware and the public key cryptography.
00:18:31.960 --> 00:18:33.378
You make such a good point.
00:18:33.378 --> 00:18:35.362
I just love hearing you say that, Jeremy.
00:18:35.835 --> 00:18:38.123
To be clear, pki offers a lot of headaches as well.
00:18:38.275 --> 00:19:03.939
It's not that I want to say that it's the easy solution, but again, this is where I mean certainly some of the discussions I have with you know, I would say national security officials who are thinking about this, and how do we start to get ahead of, you know, what could be a wave of scams and cyber crime that you know sort of puts the shame some of what we have seen to date and I don't mean to be sensationalist, I'm just it's not too hard to sort of see where this could be going or where some of it already is in terms of the trends.
00:19:04.714 --> 00:19:09.240
Well, you know, how do we actually start to decide that this is actually a priority?
00:19:09.240 --> 00:19:11.682
How do we decide this is something we really care about?
00:19:11.682 --> 00:19:23.684
To me, this is the sort of thing as you see these threats on the horizon on top of what's already a very significant identity related cyber crime problem that's largely benefiting hostile nation states and organized criminals.
00:19:23.684 --> 00:19:41.419
It's not like anybody nice is taking this, who we want to have our data or our money, but as you sort of see the types of attacks that are on the horizon, to me, this is the sort of thing where you would like to see your leaders acknowledging the threat and coming up with a strategy to proactively deal with it, and we've been advocating for a lot of that within the coalition.
00:19:41.419 --> 00:19:50.579
I would say there are a lot of people in the Biden administration and Congress who get it, but not necessarily enough to make something happen at this point.
00:19:51.414 --> 00:20:01.365
And would you say, Jeremy, that one of the challenges of democracy is that we have administrations that turn over on a periodic basis and then focus changes based on that?
00:20:02.134 --> 00:20:04.502
I mean, sometimes change is good, right.
00:20:04.502 --> 00:20:07.804
So you know I, you know.
00:20:07.804 --> 00:20:10.983
So, look, I've worked in Democratic politics a little over the years.
00:20:10.983 --> 00:20:17.701
I very famously sent out some fundraising emails during the 2020 campaign that said you can't spell Biden without ID.
00:20:19.154 --> 00:20:36.999
Because I was very bullish that, after the Trump administration had more or less ignored this issue for four years, that a Biden administration would look to pick up on the leadership shown by the Obama Biden administration, which, not to say that NSDIC was the be all, end all, but this was, you know.
00:20:36.999 --> 00:20:41.638
At least there was a strategy and a vision for how to move forward and it came out of the White House.
00:20:42.260 --> 00:20:46.564
Yes, and instead there has unfortunately been nothing.
00:20:46.564 --> 00:21:23.259
The efforts to date from the administration have largely focused on trying to address identity fraud and government benefits, which is a very small subset of the problem, and I think there's a challenge and you know we've made this point and there are those who get it but some who don't which is it is the same organized criminals and hostile nation states taking advantage of the same two, three and a before deficiencies in digital identity infrastructure and it really is infrastructure, if you think about it properly to steal not only from government but from banks and health and retail and fintech and cryptocurrency exchanges.
00:21:23.259 --> 00:21:24.763
It's all the same stuff.
00:21:24.763 --> 00:21:29.681
It's compromised passwords or compromised MFA, it's synthetic identity fraud.
00:21:29.681 --> 00:21:34.463
It's hey, I know the five things about you so I can be you and take over, set up accounts in your name.
00:21:35.335 --> 00:21:37.021
None of this is overly sophisticated.
00:21:37.021 --> 00:21:40.760
In fact, the reason we see so much of it is the attacks have become scalable.
00:21:40.760 --> 00:21:46.836
But if you just try to treat this as an issue around government benefits, you're gonna fail In that.
00:21:46.836 --> 00:21:50.804
Solving the government benefits issue doesn't mean you build new infrastructure for government benefits.
00:21:50.804 --> 00:22:00.363
It means you build infrastructure that can work in every one of those verticals and then government consumes it and it's also a much better experience at that point for Americans who look at to get those services.
00:22:00.775 --> 00:22:16.518
So that requires a government agency who has been issuing credentials for legibility purposes between the agency and its users, the citizens, to really rethink the utility of that account number that they created.
00:22:16.518 --> 00:22:19.762
What's it gonna take to get agencies?
00:22:19.762 --> 00:22:27.419
What do you think is the right approach to convince agency leadership that, hey, there's a bigger use for the credentials we already have?
00:22:28.035 --> 00:22:42.940
If you leave it to the agency heads who are in charge of issuing driver's licenses or state IDs or passports or social security numbers, which are not really credential, but at least an identifier, to figure out which George Peebo you are, you're not gonna get too far.
00:22:42.940 --> 00:22:48.102
This, honestly, isn't their job, or at least they don't realize it's their job.
00:22:48.102 --> 00:22:57.839
Yet and I mean as an example, the driver's license bureaus for years, when they had these discussions about identity, would say with a totally straight face we are not in the identity business.
00:22:57.839 --> 00:22:58.998
You see what I mean?
00:22:58.998 --> 00:23:05.019
Say, we issue you a card that says that you are authorized to operate a motor vehicle driver's license.
00:23:05.019 --> 00:23:16.486
The fact that other agencies and private sector entities like to use that as proof of identity is mildly interesting, but that's not what we're here for.
00:23:16.486 --> 00:23:20.455
We're here to say you can operate a motor vehicle Now.
00:23:20.536 --> 00:23:27.542
Congress then in 2005 passed with some controversy to the Real ID Act, which forced federal standards onto the states.
00:23:27.542 --> 00:23:29.830
That kind of made it their problem.
00:23:29.830 --> 00:23:33.648
Even then, it took a while for a lot of them to sort of recognize.
00:23:33.648 --> 00:23:37.730
I think what you're seeing now is some states are waking up and saying this is a dumb argument.
00:23:37.730 --> 00:23:46.853
Of course we're in the identity business, and why don't we recognize that and then take a step back and think about what does that mean in terms of what our role should be?
00:23:47.744 --> 00:24:02.454
So I do think that you're now seeing a lot of DMVs who are taking a more modern approach to things, but it is taken, I mean, I would say, over 20 years for this conversation to happen, and even now you will still have some states who are looking very much to just keep doing what they've been doing.
00:24:02.454 --> 00:24:16.429
This is why we've tried to focus our policy blueprints one for the federal level and one for the state level and the Better Identity Coalition on state legislatures, governor's offices at the federal level, congress and the president and his administration.
00:24:16.429 --> 00:24:28.909
I mean, you shouldn't necessarily expect change to come from within, but you can have those bodies that actually supervise agencies in the credential issuing business and that maybe have the ability to think a little more strategically about this.
00:24:28.909 --> 00:24:37.130
They can change things too, and we think that's really where the discussions need to go, as opposed to beating up a DMV director that they just don't get the vision of the future.
00:24:37.672 --> 00:24:37.992
Got it.
00:24:38.565 --> 00:24:45.731
Well, one of the powerful things we think about the better idea agenda the initiatives are incremental.
00:24:45.731 --> 00:24:50.890
That's not to downplay the enormous impact of those incremental changes.
00:24:50.890 --> 00:25:06.334
But to us, the important thing and we've learned this the hard way for many years that when you come up with a radical new digital vision for people and you change the meaning of business rules or you take the rug underneath people's feet about how they deal with risk, they can't cope with that.
00:25:06.334 --> 00:25:11.730
I think there's five initiatives in your Better ID Coalition agenda and they're all incremental.
00:25:11.730 --> 00:25:15.230
They're things like stopping so stupid with the social security number.
00:25:16.045 --> 00:25:17.450
Stop pretending that it's an authenticator.
00:25:17.450 --> 00:25:18.252
It's not a secret.
00:25:18.252 --> 00:25:20.666
It's great as an identifier, not very open.
00:25:22.164 --> 00:25:34.530
We think that preserving or conserving the meaning of data and the processes behind the data is probably important so that we don't scare the horses and people are still comfortable in their own agency missions.
00:25:34.530 --> 00:25:41.836
But we've got to make that data better when it winds up in people's hands and it's less vulnerable to replay and et cetera.
00:25:41.836 --> 00:25:45.088
I like one of the things you said at Identiverse, I think, jeremy.
00:25:45.088 --> 00:25:50.095
I don't know why you called it a uniquely American approach, but maybe that was marketing.
00:25:50.095 --> 00:25:56.612
But I love the way that you said why don't we take these ideas that we have now and make them presentable digitally?
00:25:56.612 --> 00:25:58.008
Have I got that right?
00:25:58.786 --> 00:26:13.990
Yeah, that's pretty much the thesis and I will say I mean here's why I think a uniquely American approach is needed is for years I mean certainly when I was running the NSTIC program for the Obama administration we would talk about what we were trying to do with the identity ecosystem and partnering with the private sector.
00:26:14.785 --> 00:26:19.788
You know, if I had a nickel every time somebody in the audience said, but what about the Estonians?
00:26:19.788 --> 00:26:20.971
Or but what about the Indians?
00:26:20.971 --> 00:26:25.275
I'd probably have about $8, which mean that wouldn't be rich.
00:26:25.275 --> 00:26:35.830
But it's got asked a lot and you know, like the point I made for example, look, india, for example I think it's just safe to say as an example with central match biometrics, would never fly politically in the US.
00:26:35.830 --> 00:26:43.894
Estonia is really interesting in that I mean, look, they've done some wonderful things for government services with their smart card program.
00:26:43.894 --> 00:26:56.753
But I also point out that Estonia is a country with a population that is less than that of Fairfax County, virginia, the suburb just across, you know, the river here in Northern Virginia, and it's actually a lot less diverse than Fairfax County.
00:26:57.365 --> 00:27:28.690
And also, fairfax County is not motivated by an existential threat immediately to its east because, you know a big driver for the big investment in digital government that the Estonians made when they became an independent country again was they're worried about when the Russians come in, and to them it's a matter, as we've seen with Ukraine, of you know if and not when, or at least that's how they're thinking, and they want to be able to run a government in exile which is a really great driver for issuing, you know, very robust smart cards to people, but a little different from the stuff we're working with in the US.
00:27:28.690 --> 00:27:32.334
So, look, the US has never had a national ID.
00:27:32.334 --> 00:27:38.950
The idea of one, I think, is triggers a lot of negativity on both the left and the right.
00:27:38.950 --> 00:27:46.448
People aren't comfortable with it, and so one of the things we thought about doing when we were creating the policy blueprint was to say what can we suggest?
00:27:46.448 --> 00:27:55.710
That's a little bit different, because too many times in the US, you get into maybe three minutes into the digital identity conversation and Estonia or India derail it.
00:27:56.392 --> 00:28:01.471
Yep, and how could we change the thinking to actually say here's another way we could do stuff?
00:28:01.471 --> 00:28:16.252
And so I think the best compliment I ever got on it was from Congressman Bill Foster, who spoke at an identity verse back in 2019, I believe, in Washington DC, right, and he said what I like about this blueprint.
00:28:16.252 --> 00:28:20.731
This was in his keynote, so I think it's fine if I quote him here what I like about this.
00:28:20.731 --> 00:28:29.509
I've been looking at this issue for a long time, and this is the only organization that's come up with an approach that's both technologically feasible, could solve the problem, and it's also politically feasible.
00:28:29.904 --> 00:28:37.788
It's not going to trigger people to take to the hills with their guns in protest, because we're not talking about creating any new identity systems whatsoever.
00:28:37.788 --> 00:28:57.606
We're just talking about coming up with digital counterparts and attribute validation services that are based off the systems we already have today, and I think what we have found politically in conversations with folks on all sides of the political spectrum is when you explain that, they kind of go oh, that doesn't sound so controversial, exactly.
00:28:58.369 --> 00:28:59.767
It's incremental, it's safe.
00:29:00.605 --> 00:29:09.109
So we're seeing the same thing in Australia after about 12 years and three different rounds of draft legislation.
00:29:09.305 --> 00:29:27.571
The latest installment has dropped about two months ago and it's called the Digital ID Bill and I read it twice before I realized that the phrase digital identity doesn't appear, and I think it's a significant pivot to go from digital identity to digital ID.
00:29:27.571 --> 00:29:55.273
I think that ID is a safer term but, more importantly, it's not a new thing, and our digital minister it happens to be the minister for finance his ownership of this bill and she's been very strong and articulate for some time that a new digital identity is not on the cards, let alone a national ID, because we share the same allergy down under as you do in the states for a new national ID.
00:29:55.273 --> 00:29:59.347
But it's not needed At Lockstep.
00:29:59.347 --> 00:30:03.594
We think what's needed is to make the data better and make it useless to criminals.
00:30:03.594 --> 00:30:15.615
But this new digital ID legislation sets up a governance framework within which you can demonstrate the fact that you have a set of IDs driver's license, birth certificates.
00:30:15.615 --> 00:30:21.090
It's the normal vocabulary or the normal grammar of identification, but made digital.
00:30:21.090 --> 00:30:23.790
I don't think there's anything scary in that.
00:30:24.704 --> 00:30:25.730
It shouldn't be to most people.
00:30:25.730 --> 00:30:28.574
I also think it's interesting.
00:30:28.574 --> 00:30:34.528
When we launched the N-Stick in 2011, we were very careful to say this is not a government-sponsored digital identity.
00:30:34.528 --> 00:30:51.772
It's all voluntary and all be driven by the private sector, because we were really trying to avoid triggering any of those emotions or different political groups and not to say that we didn't envision that the government might have some role in this.
00:30:51.772 --> 00:31:01.255
But there was an aspect of it where I think, in retrospect, we maybe were overlooking the elephant in the room which is, at the end of the day, the government's where the data is.
00:31:01.255 --> 00:31:03.271
The government's the only authoritative issuer.
00:31:03.271 --> 00:31:07.510
We've got a bunch of private sector systems that are trying to guess who's who.
00:31:07.510 --> 00:31:11.240
Some are decent at it, but let's not.
00:31:11.240 --> 00:31:17.777
Let's not be afraid to talk about why government's playing a more direct role is important.
00:31:18.785 --> 00:31:31.478
With that, I think we've also seen, in the 12 years since that strategy was first published, I think another generation has come into the digital age where, look, in 2011, we wouldn't have smartphones.
00:31:31.478 --> 00:31:34.755
I mean, a few people did, but it was still a pretty new thing.
00:31:34.755 --> 00:31:50.632
I had a flip phone when I went into government at the time but the idea of having these things that are very powerful and people are used to using as a remote control to their lives, and also just the fact that you're asked so many times each year to prove who you are to do something.
00:31:50.632 --> 00:31:51.674
People are tired of it.
00:31:51.674 --> 00:31:55.491
The idea of something as simple as I mean gosh.
00:31:55.491 --> 00:31:57.877
Again 2011, most people didn't have smartphones.
00:31:57.877 --> 00:31:59.911
Now we're carrying everything else on our phone.
00:31:59.911 --> 00:32:02.391
Why wouldn't you have your ID in it?
00:32:02.391 --> 00:32:06.214
People get this in a way that I don't think they would have a dozen years ago.
00:32:06.625 --> 00:32:07.328
Yeah, we'll sit.
00:32:07.328 --> 00:32:09.229
What haven't we asked you, Jeremy?
00:32:09.865 --> 00:32:11.109
Happy to talk about what's going on.
00:32:11.109 --> 00:32:20.615
We've got a, there's a legislation the Improving Digital Identity Act which we keep trying to drive forward or try to get the White House to do something based on it.
00:32:20.615 --> 00:32:28.913
We do point out you don't need a bill to actually tell the White House to launch an initiative to try and close this gap between physical and digital credentials.
00:32:28.913 --> 00:32:37.055
That's optimistic conversations with some folks in the House and Senate this last week, but I've also learned there's 10 steps to get a bill passed into law.
00:32:37.055 --> 00:32:39.873
You can get to nine and then somebody pops up and blocks you on number 10.
00:32:39.873 --> 00:32:44.895
And so it is a challenge that we still have, I think, to drive progress.
00:32:45.486 --> 00:32:51.451
Likewise, the White House had a really great section on digital identity and their national cyber strategy in March of this past year.
00:32:51.451 --> 00:32:55.375
When the implementation plan came out, we were all excited to see what they were going to do next.
00:32:55.375 --> 00:33:00.140
They skipped right over it, as if it was never in there, which I will say.
00:33:00.140 --> 00:33:09.375
There is disagreement in different parts of the White House in terms of whether they should do something, in how, and so I think there's some work that needs to be done to overcome some of those concerns as well.
00:33:10.306 --> 00:33:12.071
I'd like to say watch this space in Australia.
00:33:12.071 --> 00:33:26.698
Sometimes the five major Anglophone countries take it in turns to try something innovative in cybersecurity and I think that perhaps we're going to see a really modest way forward and maybe a model coming out of Australia.
00:33:26.698 --> 00:33:27.318
We'll see what happens.
00:33:27.318 --> 00:33:34.354
We're supposed to have a legislation developed and passed by June of next year, but there'll be quite a lot of governance to put in place in the meantime.
00:33:34.354 --> 00:33:41.089
It'll look like some of that mature governance that we've got in our open banking system here and we'll build on that.
00:33:41.526 --> 00:33:52.011
I'm rooting for you here and that we need more good examples of how to do this in a way that works and that candidly gets people worried that if we don't have something similar in the US, we're going to be falling behind.
00:33:52.011 --> 00:33:59.710
A point we keep making in our discussions with policymakers is that doing nothing is also an active policy choice.
00:33:59.710 --> 00:34:03.252
Indeed, you can look at do we pass this bill or not?
00:34:03.252 --> 00:34:04.789
That's often what the question is.
00:34:04.789 --> 00:34:07.152
A no vote means you're going to do nothing.
00:34:07.152 --> 00:34:23.992
You're going to preserve the status quo, which, in some cases, in some policies, is the right thing to do, but here, every year that we decide to do nothing means it's another year that we're falling further behind our peers like Australia that are leading on this, not to mention in the European Union and other countries across the globe.
00:34:23.992 --> 00:34:29.889
It means that the identity related attacks that we see in cyberspace get more sophisticated and we don't have a strategy.
00:34:29.889 --> 00:34:38.505
So doing nothing, even if you don't love the options, it's not a particularly good answer at this point, you know.
00:34:38.547 --> 00:34:54.094
Jeremy, I come from the payments industry and we noticed after chip cards were deployed in the UK and Europe around the rest of the world that fraud was migrating happily to the US because we were only a magstripe country at the time.
00:34:54.094 --> 00:35:10.777
I told the story today, getting the same effect right now, with fraudsters who are seeing us as more vulnerable and, of course, a massive target, this is a story today to a room full of congressional staff.
00:35:11.704 --> 00:35:30.273
I said in 2011, mastercard, at the conference I was at, revealed a stunning number, which is that the US accounted for 25% of all global transactions, but 50% of all payments card fraud, which meant we had an eight times higher fraud rate than the rest of the world, solely because we were stuck on magstripes while the rest of the world had moved to secure chip.
00:35:30.273 --> 00:35:36.842
And it was only after the target breach happened in 2013 that it was bad enough.
00:35:36.842 --> 00:35:38.088
Enough money was lost.
00:35:38.088 --> 00:35:41.588
The damage was bad enough that the banks and the retailers finally said we're going to move to chip.
00:35:41.588 --> 00:35:59.695
And I feel like we're at a very similar point right now when it comes to digital identity, in that, as other countries are moving ahead, we are going to be the last one standing hanging on to our old, archaic plastic cards and legacy systems trying to guess who's who, and we're going to be that eight times higher fraud rate again, if not more.
00:36:00.387 --> 00:36:10.490
The one thing that gives me some pause is that on my last trip to the US and I don't travel that often anymore, but I was delighted to see how many average retailers were accepting my Apple Pay.
00:36:10.490 --> 00:36:14.172
Even use Apple Pay on the San Francisco subway.
00:36:14.172 --> 00:36:26.092
Now, if you can click to pay, then you should be able to click or tap to present, and we think that maybe the US has got this ability to in fact leapfrog.
00:36:26.092 --> 00:36:40.293
Now that there's a increasingly a social acceptance of using this smart technology to send ones and zeros that relate to your payments, well, why not use the same technology to send ones and zeros that relate to your driver's license, your real ID, your birth certificate?
00:36:40.885 --> 00:36:48.873
I mean, it's no coincidence that in a lot of the companies that are driving digital identity solutions, it's the same team that's working on payments right now.
00:36:48.873 --> 00:36:53.034
The tech platforms, this is integrated.
00:36:53.034 --> 00:36:57.914
I mean they really see them as very complimentary to each other.
00:36:59.324 --> 00:37:13.637
I'll be a little bit grumpy in that in the payments industry, there's revenue associated with each transaction for multiple parties, and when we're talking about digital ID and security in general, it's a cost.
00:37:13.637 --> 00:37:24.954
So I'm hoping that there's a world where, just like, the FAA will move the aviation industry instantly if it decides to put a rule in place.
00:37:24.954 --> 00:37:30.215
Do you think, jeremy, we're going to need that kind of rulemaking to start to address this?
00:37:30.215 --> 00:37:37.068
And that's not such an incremental change, that's a fundamentally I mean it's hard to say Look part of it.
00:37:37.128 --> 00:37:44.916
I think, at least in terms of solving identity, is a lot of it gets back to government doing something itself, as opposed to trying to force industry through regulation.
00:37:44.916 --> 00:37:47.516
I think there's an interesting discussion around.
00:37:47.516 --> 00:38:04.293
I mean, more broadly, what's been going on in the cybersecurity space, where we've been in at least a 15 years argument over do we regulate critical infrastructure here or not, to mandate things like phishing resistance and multi-factor authentication versus just using passwords?
00:38:04.293 --> 00:38:14.331
And on that side I will say anytime you talk about regulating one, you've got one party that just doesn't like the idea right from the start.
00:38:14.331 --> 00:38:26.784
But also, how do I say this In aviation, the thing that's going to make a plane crash today is probably the same thing that was going to make it crash 10 years ago, and in 10 years we're now probably not a lot's going to change.
00:38:26.784 --> 00:38:30.617
You'll see some changes around the edges In security.
00:38:31.320 --> 00:38:46.157
Technology is changing constantly, threats changing constantly, and so I would say the anti-regulatory crowd does have a good point, which is that if you get too prescriptive, you may find yourself pointing to a bunch of compliance crap that's out of date.
00:38:46.157 --> 00:38:49.284
I mean, we see this all the time when I mean heck.
00:38:49.284 --> 00:38:57.858
The SEC just filed a lawsuit against SolarWinds this week, holding their CISO legally accountable, because they claim they had better password policies than they actually did.
00:38:57.858 --> 00:39:01.563
And my first reaction on that was password policies.
00:39:01.563 --> 00:39:05.143
What gives a crap about password policies in this decade?
00:39:05.143 --> 00:39:08.880
Like you can have a 30-character password and it'll still get fished.
00:39:08.880 --> 00:39:16.260
I mean, we're fighting the last war too many times, so I'll just offer that up as a cautionary note Every time we think forcing action.
00:39:16.260 --> 00:39:20.143
You really have to craft those things deliberately.
00:39:20.894 --> 00:39:22.521
Well, Jeremy, I think we need to leave it there.
00:39:22.521 --> 00:39:25.083
Terrific having you on making data better.
00:39:25.083 --> 00:39:26.097
Really appreciate it.
00:39:26.760 --> 00:39:27.463
Thank you for the invite.
00:39:27.463 --> 00:39:28.018
This was a pleasure.
00:39:28.574 --> 00:39:29.197
Well, that was cool.
00:39:29.197 --> 00:39:30.702
That was very good.
00:39:30.702 --> 00:39:37.260
If we're reflecting on what he had to say, I mean, I think he nailed it.
00:39:37.260 --> 00:39:38.920
You see the same pattern, don't you?
00:39:38.920 --> 00:39:39.757
Time and time again?
00:39:39.757 --> 00:39:42.882
Benefits fraud, payments fraud.
00:39:42.882 --> 00:39:44.340
He talked about synthetic identity.
00:39:44.340 --> 00:39:47.722
You and I are talking about data generally.
00:39:47.722 --> 00:39:51.724
Jeremy raised faces and videos for selfie matching.
00:39:51.724 --> 00:39:53.440
You don't know if any of that stuff's true.
00:39:53.440 --> 00:39:56.260
So it's all about provenance, isn't it?
00:39:56.260 --> 00:39:59.215
I mean, he said the same pattern is occurring all the time.
00:39:59.215 --> 00:40:01.101
Let's not just pick on social benefits fraud.
00:40:01.101 --> 00:40:06.159
If you could reuse those patterns, what do you need to know?
00:40:06.159 --> 00:40:08.880
How are you going to know that the data is true?
00:40:08.880 --> 00:40:13.018
And it seems to me that time and time again, we're seeing the same thing.
00:40:13.018 --> 00:40:17.262
How do you distribute the meaning of data so that you can tell what's in front of you is true or not?
00:40:17.715 --> 00:40:18.559
We have a lot of work to do.
00:40:19.335 --> 00:40:19.918
Yeah, we do.
00:40:19.918 --> 00:40:34.039
We've got a lot of stories to tell and if we can make those stories simple and not triggering I love the way that he was conscious of not triggering people with digital transformation I think that that's the trick.
00:40:34.875 --> 00:40:40.762
Well, I think, yeah, among other things, we ought to be encouraging folks to look at the Better Identity Coalition and their policy papers.
00:40:40.762 --> 00:40:43.021
We'll put that in the show notes.
00:40:43.021 --> 00:40:44.405
All right, we'll see.
00:40:44.405 --> 00:40:47.362
Thanks, very much Glad that we're doing this again.
00:40:47.362 --> 00:40:48.438
It's been a pleasure to talk to you.
00:40:49.494 --> 00:41:05.762
Good stuff, George Prepare for another Desmond Show generation.
جستجوی اپیزودهای گذشته
اپیزودهای قبلی Making Data Better را جستجو کن.
سلب مسئولیت: پادکست و آثار هنری تعبیه شده در این صفحه متعلق به Lockstep Consulting Pty Ltd است که متعلق به صاحب آن است و به Listen Notes، Inc وابسته یا تایید نشده است.
ویرایش
از کمک شما برای بروز نگهداشتن پایگاهدادههای پادکست سپاسگزاریم
