Adam Cooper: Digital Identity as a Building Block for Ethical Digital Economies

And, and as I say, good afternoon, afternoon, everyone. I will definitely be talking about how ethics is an important part of identity systems and how it affects our lives and what we can do to actually improve people's lives as a use of digital identity. Building digital economies is a big part of that. So if I start now, so everybody always talks about identity being the great enabler it's been mentioned in many national and international projects as being the great thing that will allow us to have many different interoperable systems across the digital world and build digital economies.

But as you'll see, as I go through my presentation, hopefully identity is only skimming the surface and there are far more important things identity can unlock. So it is a great enabler, but it isn't the great panacea. It's not gonna solve all the problems on its own. Cause the really important thing about transactions. And this is what digital world is really about. It's about transactions in many ways and the value we have in those transactions. And where do we derive value from?

Well, if you think about it, then the things we value generally in the world are things that are personal to us that are sensitive in nature. That cost money. We either have to pay for them, or they will cost us money if we don't do them and things that jeopardize all of those things. So things that interact with us on a personal level or a financial level and affect our lives. And it's exactly the same in the digital world. And this is why we need to have a, a pretty much an ethical approach to how we deal with data and, and individuals as there progressing through that digital world.

But identity itself can help in some ways. So it can help us to protect that value. And you'll all be familiar with the old, nobody knows you're a dog on the internet cartoon.

Well, it's still true. But knowing that you're a dog is only part of the equation. If we want to protect the value and put in place systems that actually provide not just safety for us online, but also richer, more compelling transactions, then the relying parties, the services need to understand not just who you are, but what you are, because we need to be able to provide some means, some trusted means to allowing you to access things. And this cuts into lots of different areas.

I mean, one, one example is financial inclusion, where if we want to enable more people to be able to access banking digitally, what we don't want to do is necessarily release all of their data to be able to do that in the way that we would've done in, in the old paper based world. But we might want to provide some digital proofs that actually don't reveal that much about them from a, an attribute data point of view, but might provide some trust that organizations can use. The current crisis has brought a lot of this into focus.

I work on many international projects with the world bank in particular. And what we are noticing is that many countries, particularly in developing world are now pushing forward as fast as they can on their identity programs, particularly around digital identity. Why? Because the current crisis means that they can't do the things that they would normally do. For example, if you take a country from like the Philippines, for example, given to pick one pick on one, they're very used to natural disasters, volcanoes, earthquakes. I I've been in a few of each there.

And what they normally do is send people out in a truck with money and give it to beneficial rates. You can't do that in a crisis like this. That's just not possible. So digital, all of a sudden is massively important. And identity of course is very important in that. Because if you're giving aids to people, you need to know you're giving it to the right people and you're not giving to them, to them, same person, multiple times, for example, or the wrong person, governments have a big role to play in all of this.

This is not just about industry governments have fantastic role to play because they're good sources of trust. Don't forget that in general, 80% of the cost of any government is spent on services. It's a huge expenditure every year, just on delivering services to citizens.

So they, they interact with those citizens on a huge scale. And that means they, they, because they do these real world things and they, they make laws and they provide trusted documents like passports and driving licenses and to name but two. But they also hold civil registers of birth deaths, marriages. They provide licenses for things. They gather information all the time.

They, they gather taxes. They make payments, huge amount of rich data about individuals needs to be used very carefully though, and needs to be attributed to the right individuals. Cause what we have to remember is that trust is actually a transaction. It has to be earned and it it's earned through the actions that organizations have. So in some ways it could be, we often think about technical trust. For example, that's only a very tiny part of the equation. Most of this is about best practice. It's about did the individual get the result they wanted? Did I get that aid?

Did I open that bank account? Have I got my driving license? Was it a good experience? Do I trust it to happen again?

Reliably, all of these things are factors in trust. It's not simply about the technical element. A lot of it's about people and process and governments forge this trust all the time. They provide welfare systems, healthcare things. We rely on social services. They help us when we're in trouble, they keep us, they keep us alive when we're sick.

And then we're particularly seeing that in the COVID crisis, but they provide all kinds of services that people forget about that the basic operations of, of a country are very important and they forge trust through that because they provide those services. They also write laws. They put things in place around privacy protection and data quality. They help us to secure those things that they they've gathered. They're not all necessarily very good at that. Governments make mistakes as any other organization does.

So they need help again, if we think about the current crisis and this has changed, the focus of many things, it's actually changed the way our values are held. In many ways, people now are worrying less about their civil liberties in some ways, because they want to end results and governments. In some cases, my own included in the UK are pushing forward with some uses of data and uses of technology. That frankly are frightening tracking individuals. For example, from an infection point of view is just one. My country's going for a very centralized approach.

It's very, very worrying from a privacy point of view, but none of this is new. It's just new to the developed world. It's new to, to our, our way of life in the developing world. This is a problem continuing. So as I say, adapting to these crisis, shouldn't detract from our rights at all. There are lots of, I, I hear lots of people in policy positions saying, well, it's okay to introduce this for the, the next few months and then we'll take it away later.

But do we really trust that they'll be taken away once the data's there, once it's accessed, once it's been gathered, how do you put the genie back in the bottle? So we need to focus on rights even though there's an impending need. So what is that need?

Well, part of the problem is that those governments that have this data that build these, these systems and the basis for these digital economies, they don't have the capacity, but they do need to act. And by capacity, I mean, they don't necessarily have the technical expertise internally to understand the implications of what might happen, but policy should always lead. One of the temptations is that technology will immediately say we have the answer to this hundreds of, of organizations.

If not thousands of organizations have, have come up with ideas of how they might solve the COVID crisis, not all of them will work. Not all of them will be ethically, correct. Many of them will, will walk over our rights. Some of them will be fantastic. It's finding a way to do that, but doing that based on policy, that's very important. And so there's a need for service providers, technology experts, legal experts, all to work together to create the environment for this to work.

And I'm starting to see this happen, which is very important because one of the things we need to do is focus on individuals. They need their control and their visibility and their rights to be protected. And doing that particularly in a high pressure environment by the COVID crisis is very difficult. Because as I said at the beginning, I think this is really all about people and not technology. And we need to focus on that.

Very easy to roll out a huge it system, a huge identity system, and think that's fantastic job done, but there are often consequences that we need, we haven't necessarily thought about. So it's very important to map that out very early. And a lot of the shift that's going on at the moment is, as I mentioned at the start, it's not just about identity anymore. It's largely about data. So there's a big shift now where trusted data is the very important thing, because there's a lot more analysis being done, lot more data driven systems.

The power is being realized now in, in the data that we have, or we have touched and rather than actually who we are. So you used to focus more on giving you access to systems. So I can sign into something with a strong credential, Even a lot of the EU laws still the, the in many ways are rather forward thinking, but a lot of laws around access to bank accounts, for example, still focuses on strong authentication rather than strong identification. So knowing more about you and what you can do is very important.

And that's why we're seeing lots of groups working very hard on things like E K Y C to enable access to systems and give people the ability to prove that they are eligible for things without necessarily imparting all of their valuable data.

Because as I said, there is a very much a focus on transactions rather than access control transactions are the things that drive these powerful services, the, the compelling things that we want to continue to interact with the things that we need more than never when we're in, as I am at the moment in lockdown where I can't go anywhere to do things, and this might be a, a sea change. So what, what needs to be done from my opinion?

Well, anybody who's certainly taught before will know that I see trust frameworks being very high up on the list here of setting out the rules and they are based on law, but also based on the rules of engagement between the different parties. And there will be many of these. There are very few at the moment and we've seen one or two appearing, but there are not enough. And that doesn't give us enough protection as individuals, as we interact with these things. We need to remember that there's a com needs to be a combination of people processing technology here.

If we just focus on one, we fail, we can create great technology. Absolutely. Does it satisfy the needs of the people interacting with it all the time or the processes that we need to fulfill? Not necessarily it's a triangle and we have to make sure that we satisfy all sides, but we don't really need to invent any new technology. There's some fantastic things out there. There's some great standards. There are some great things that we can do with DIDs. There's some great things we can do with decentralized identity, with trust, technical trust.

So the mechanics of, of identity and sharing trust are actually there already. What we need to do is be able to interoperate better between them. And we need to start shifting away from providers of identity, which is a couple of years ago that would've been the norm to actually users and consumers. We're all players in the identity system equally important are the users to the relying parties, to the, to the credential providers and the trust providers. And that needs to be recognized more, but there are some gaps that we need to fill particularly around standards, around trusted attributes.

In my opinion, N came out with an internal report a few years ago and N 8 1 1 2, which I'm sure many of you're aware of, which has some fantastic pointers towards what could be a standard for verified attribute data. Now there is vectors of trust, which is many of you will be familiar with as well, which is from the I ETF and just richer. One of the authors of that excellent pieces of work as yet, we haven't seen those realized enough in my opinion, and that sort of needs to be work done on that. And maybe to create new international standards.

And we need to encourage vendors to embrace this interoperability and the portability of, of data and trust too many systems lock individuals or organizations in still, and a large part of this fight is to make sure that that is broken so that not to destroy markets, actually to encourage them, to encourage the ability for vendors to work in multiple places, as well as for users and buyers to change as they need to and to progress because we need to focus on some real good benefits here. From my point of view, one of the greatest thing we can do is increase inclusion.

Digital identity should not be polarized to those who have smartphones. And those who do not. For example, we can reduce a huge amount of social impact by doing things digitally. I wrote a report 10 years ago for our national health service, which showed how we could save billions of pounds by using more digital to deliver healthcare services. That's still a gap today. There's increased financial inclusion.

There is still too many unbanked people in the world, and that makes it incredibly difficult in COVID for example, to deliver in the Philippines age to individuals, because there are so many unbanked people in the Philippines, so you can't get money to them when they're locked down. So breaking that mold is very important, but overall deliver better service to every services to everyone. Because by doing that, you actually improve people's lives. Thank you very much. I hope that's been interesting. There's still a lot of work to do. I hope you'll help me complete it. Thank you.