IATA Travel Pass - Self Sovereignty in Action

Yeah. So thanks having me back. And as you said, yeah, a bit of a veteran of EIC.

In fact, I just credit to KuppingerCole here because they saw the, the promise of SSI really early on. I couldn't find the slide deck for 2016 that Timothy rough gave that attracted a huge amount of attention, but just, this is some of the stuff going back a few years. And what's interesting is every year it's got bigger, you know, SSI is happening more. There's more people speaking about it, you know, back in the early days when I was talking about it or my colleague drum, or even Phil Windley there, people thought we were absolutely crazy.

And it's, it's really good to see all the content coming up today with all of the innovation and exciting things that are happening around the world. But as every day is every, every year has gone on at U IC. It's like a, a monitor of, of the progress of SSI as an industry movement. So I'll just take this back to this slide. I think Phillip picked this out from the new Yorker, this cartoon on the internet. No one knows you're a dog. This must have been used about 5 million times in SSI presentations over the last few years, but it remains true.

We got no way of easily verifying information about each other online and the reward. If this is fixed is huge.

I, I see so many use cases around the world for so many different types of use of verifiable credentials and the establishments of online trust. I generally think that as we solve this, we verifiable credentials and did it becomes the, the next wave of business innovation because products or processes that you couldn't automate previously, cause they were too expensive or too complex to do.

They'll become trivial when you can immediately immediately establish trust whether that's bank KYC, whether it's pharmaceutical supply chain, whether it's air transport, as we'll see in a minute, once you can establish trust in a few moments for very, very little money, those business processes can get transformed. So we're talking about a, a massive new wave of business transformation. I won't go into this too long.

I, I think everyone in the audience has probably probably seen this by now, these sort of pros and, and capabilities you get with verifiable credentials. Just really to say that we're talking about a, a new way of, of moving and proving data around and that data can be anything for any purpose. Often people ask me, you know what, what's the use case for this thing you are telling me about this, this SSI thing they say, what's the use case. And it's a bit like saying what's the use case for the internet?

You know, is it, is it cap videos or is it online auctions where it's all of these things because you've got a platform and you can build many use cases on it. So think of SSI and verifiable credentials in that way, not as something solving a particular use case, in fact, it can be used, but pretty much any digital trust use case we've seen about 85 variations of this slide today during all the other presentations. So I won't, I won't D on it other than to say, what does Evan do?

Well, we have a suite of products that enable organizations to SSI enable a business processes. So our, our main organizational platform is called Verity. It's a credential exchange platform that lets organizations issue and verify credentials about anything. And we also have a mobile SDK that lets anybody build a, a full, capable edge wallet for holding credentials and verifying things about yourself. And in this presentation, I'm gonna show you how this stuff is, is used in anger. So let's kick off straight into air travel as a use case, we'll know the problem.

Very few people flying, judging by the empty seats in the auditorium. There there's a lot less people at some EIC than usual and governments, airlines, people need to get flying again and IO the international air transport association have created this travel pass capability to address that specific problem. It's really being positioned as a platform for contactless travel. And as you'll see, there's a lot more to it than you may have heard already.

I'm sure some of you might have been on some of our webinars that have talked about this, so I'm not gonna dwell too much on how it works, but I want to tell you a bit more about what's under the skin of what is, I think the, the biggest rollout of SSI in, in production use ever seen so far. So let's just do a quick compare and contrast with most of the health pass initiatives that are out there already.

And you'll be familiar with these ones like the EU digital COVID certificate stuff, DCC smart pass, common pass, and so on where they put data health data and your personal data into a QR code, they embed it into a QR code and that could be scanned and somebody can check that information. There are a number of issues with this kind of approach in that you are always sharing everything. There's very specific correlation points, serial numbers, and that kind of thing. Within that data, you are mostly doing this face to face. It's a bit difficult to share data ahead of time.

And of course you can photocopy them as well. You know, there's nothing that's strongly binding you to the bit of paper or the screenshotted thing that you've, you've taken from a friend to, to show that you are COVID negative. So let's call these basic passes. Shall we? For the sake of it, I iota and good health pass labor pose, a digital wallet, which holds verifiable credentials with numerous benefits there such as you only need to share the data needed for a particular transaction.

You know, nobody needs to know my date of birth in order to show I'm COVID negative. Right? So with the, with the passes on the left hand side of the screen, there, you're sharing everything all the time and you can only use that QR code for one thing, with the travel pass and good health pass approaches, you've got a digital wallet that contains verifiable credentials that can be far more flexible and usable for many more things and a lot more private and secure. So for the few of you that may not have seen one of our webinars on IAA travel pass, how does it work?

Well when you get the travel pass app from IA and that app, by the way, is built with our connect me mobile SDK inside it. The first thing you do is you verify your passport. And that includes doing a selfie liveness check, and also an NFC read of the passport in countries where you're allowed to do it. I think Germany, France, you can't. So it does a photo over the passport. That information is digitized by IA. You issue that passport data after having matched it with your face.

I'm sure you've all familiar with this the way this is done, but that data that verified passport information is issued by IA as a credential. The wallet person says where they're gonna travel to the travel pass, tells them what sort of test they need, or what are their conditions for entry. So in the case where they need to go and get a PCR test, the, the travel pass will say, here's the labs that can do it near you. When the passenger gets to the lab, the lab in SS items sends a proof request to the passenger saying, please, please prove some data from your passport.

Not all of it, just enough that we can match the test results to you as a person. So that's the first proof happening. And then the lab matches the person to the test and then issues the test result as a credential, I oughta then create an okay to travel credential from that, knowing that you are okay to enter the country you're going to, and that means you can depart and you can then send proofs to airlines, border forces and so on. So within the IR ecosystem evidence, the technology partner, so the labs and IATA are using our Verity products in the airlines as well.

So global rollout on this is happening at pace. At the moment, there've been a lot of trials happening in different parts of the world with IAT and lots and lots of different airlines. There's approaching 2000 test labs already have been onboarded. And what that means is those test labs are verified and approved as issuers of credentials. And they all have DIDs on the sovereign ledger and more are being added every day and more and more airlines come in onboard as well. So Emirates. So there's been lots of trials and tests across the world.

And Emirates is the first to actually roll out at scale globally. They've got hundreds of route around the world and there's a whole queue of other airlines waiting to go as quickly as possible. So the airlines are kicking off as well. Not only that, but also governments are getting involved because they want to be able to quickly verify people on arrival as well. So don't forget. You've got people with verified passports here, as well as health credentials, and then app downloads as well for a while. The app's been restricted using a passcode.

So try lists how to have a passcode to, to enter it. And that I think it has not been taken away. That passcode thing, it, it will be in the next few days. So that was a quick run through. What does it mean in S items?

Well, the I to travel pass mobile app is a smart edge wallet. Okay? So it's not a cloud wallet where the, the data is held somewhere else, your credentials and your DS and everything are in the wallet. It creates private DS on the fly.

When you, you scan Q code or get a deep link, it's creating peer DS in, in real time and it can receive and store these very credentials, credentials, and IA have built business logic around it as well. It does all of the things you'd expect around selective disclosure compound proofs mean you can take a bit of your passport and a bit of your test result, combine them together without sharing everything. And of course it does your knowledge proofs and selected disclosure as well.

So that's, that's the app and IRA looking at making an SDK available for airlines to put into their own airline apps. And you can see why that would be attractive. IRA's also an issuer. So they're issuing these passport credentials. They've got a public did on the sovereign ledger and every person that they issue a passport to gets appeared its as well. So they're strongly binding the person to the passport data, which is giving you that really strong identity verification to start with. They are also, and they're doing this now. It says that they will also, but they're doing this now.

They are converting EU another country specific, basic or dumb credentials into smart verifiable credentials. So right now with your travel pass out, you can scan an EU DCC QR code. And I will take that. They'll verify the name and date of birth and some other details with your verified passport. And then they'll issue that, that DCC credential as a smart verifiable credential into the wallet. So that's much better than just a normal EU bit of paper or on a QR code that you show because now you can do selected disclosure and now it's strongly bound to your identity as well.

So that also works in the UK and IRA have been out doing deals with governments around the world to enable them to get access to the public keys for verification of those credentials. So there was a story a while back where a plane arrived and every passenger had a, a COVID negative test on a bit of paper, but it was all the same piece of paper that had been photocopied.

So this, this stops that happening. Every airline is also verify they can also be issuers as well, so they can create their credentials to issue for that purpose. They all have did on software as well. And they're able to verify the travel status and passport details and COVID status of passengers in a few seconds. And also every one of those hundreds and hundreds of labs, every single one of those is a verifier and an issuer. Every lab has a did on sovereign as well.

So it's all using DICOM and peer DIDs and zero knowledge proof, selective disclosure, as you would expect, but it's bigger than health tests, right? The reason I to have gone down this route is because the whole travel ecosystem needs digital credentials to operate more smoothly. And this is the big picture for travel pass is that it can be used for any credential for any purpose. And this could be anything from, you know, car rentals, hotel reservations, et cetera. And those credentials can be combined in lots of different ways for lots of different use cases.

So the, the health pass situation is a kind of entry into the world of SSI for travel. And you know, that's the reason I also went down this route in the first place. We were initially talking about this, this whole end-to-end digital travel capability where you are digitizing previously UN digitizable business processes. So that's looking fantastically exciting as well. And one of the benefits of this is all of these entities previously, would've had to connect to each other and have APIs to each other. Now they don't have to do that, right?

The verifiers can verify without having to contact anyone other than reading the public keys of the issues offer S somewhere. But there's more than that as well.

It's, there's some very understated functionality of SSI include things like logging in right using Dior to log in without needing usernames on passwords, getting rid of usernames and passwords completely for travel websites, for hotel reservations and so on. Having credentials that you can use to onboard and pay. So what I call identity enriched payments is gonna be huge. And also you've got secure peer to peer messaging as well. And lastly, we're just gonna come onto governance quickly. A key part of what I have done is they've designed this ecosystem.

They, the ecosystem convener, if we call that a role, they set what the rules are and what the liability is. They set up the business and commercial model. It's been precious, little talk about business models during today's sessions, very, very important. They've done the credential design. They've managed the credential issuing methods.

They on, they have contracts for the labs when they onboard for labs to participate in issue. They had a global registry of lab issuers.

So, you know, if the lab is good, it's really interesting castings or at X 5 0 9, I ought to do it slightly differently, but the principle is the same. How do you know the lab is good? They got airline acceptance rules and so on. So they built the whole governance framework that sits alongside the technology. So why SSI? Why is SSI SSI ideal for this?

Well, SSI is brilliant in a situation where you've got lots and lots of participants who all need to work together, but to try and get them all to contract and technically connect with each other just doesn't scale. And SSI is ideal in that situation. Why is it ideal? Because with SSI, the user is the API. The user carries the data for you. They move it around. You don't need to have big central gateways, huge data stores. The is your API.

And that's the big kind of learning from all of the work done around SSI is the very simple scale that users taking the data around for you and is making those connections for you. And that's a fantastic shift in the way that data connectivity has worked in the past. So lots of expansion possibilities, lots of people in the travel world. Getting very excited about this. Not least because you can present proofs using verifiable credentials before you fly. And then when you arrive at the airport, the boarding gate immigration at the other end, they know you're coming.

They've previously verified all of your information, your visa, your ticket, your hotel, and your face arrives. They're waiting for your face to arrive. It arrives. They've checked you and you're straight through. So it's potentially absolutely huge. So that's it. That's the formal bit of the presentation for you. Hopefully that's given you a bit of an insight into this whole world of what I art is up to and is tremendously exciting being right in the middle of it. Thinking back to 2016, where we started with SSI.

Now we've got this global rollout, huge scale and I art are expecting millions and millions of passengers to be using it. And those will be millions of people with edge wallets using SSI, without knowing anything about what a did is or, or what a credential is, it'll just work. So thanks very much.