Digital Identity in Travel (and beyond): a public-private affair

So very exciting to be here. It is my first time at EIC and I'm having a great time and I'm surely hoping it's not the last. So thank you for being here and thanks to Pungo Cole for inviting me to talk about a topic, very close to my heart. We live in very challenging times, geopolitically, but also at the same time, in very exciting times with innovation, digital identity and, and everything. That's that's happening for travel a lot is happening as well.

But if we talk about digital identity and travel, we talk about crossing international borders and we cannot use our Facebook identity or our bank identity to cross a border. We will need a digital or a passport and a digital version of the passport. And this means that there's a whole ecosystem that needs to adjust airport, airline and government. But before we look at the future, let's look to the past first. This is not the past. This is every day in Aruba. Gorgeous. You must visit. But in 2015, we developed together with a number of Dutch and Aruba.

And by the way, Aruba is a country within the kingdom of the Netherlands. So everybody's Dutch, but Aruba and Dutch stakeholders, we developed what became the first passenger facilitation using a biometric token. This was a local federated identity management system, and it United the airport, the airline and the government around the passenger at the first step. What happened was the enrollment whereby the identity was established under the authority or done by the immigration services of Aruba.

This identity formed the basis for the biometric token, which was then used throughout the process biometrics for verification. Obviously the data in the token was then used by the airline and the airport in a privacy by design matter, meaning that only the data that was needed would be used and would be received by the airline only what is needed for check in and by the airport. Only the fact that you are a passenger with a valid travel document and a valid reservation. This created a unit, a uniform process, easy to use for passengers quick.

And it created also all kinds of efficiency, possibilities, efficiency, workflow options. And it was a big success fast forward to seven years, 2020 20. And it's on everybody's radar, seamless travel, contactless travel, and many, many other names, but a lot needs to happen before we are there. And we see right now in the past seven years from south America, the Gulf, the far east Europe, everywhere versions of seamless travel are popping up and projects are started, which is very exciting. It's not always all stakeholders, but very often it's what you've all experienced.

I'm sure eGates of course, which we've had for a long time, sometimes connected to the airport process, sometimes connected to the security airport process. And we've seen a need because of the COVID pandemic to use more digitization in travel, because we have a new credential in the mix, which is our health credential, which need to be checked. But before we can really get to a totally seamless contactless process whereby we really connect all the stakeholders and we can cross borders and continue traveling contactless, a few things need to happen.

And I would like to paint you a picture of what that would look like if we do have in the near future, a real seamless process using an E passport. So paint this picture, it'll be a bit impressionistic, but still, this is what I think will be, we will see happening. I hope again, we go to this beautiful beach. So we start from the comfort of our own home. And we book a preliminary flight. We decide the destination and we book a, we book a hotel.

Then the airline directs us to go to the government Porwal for authorization to travel, which means that we go to this Porwal we will share our digital travel credential, our digital passport. We will use our mobile device and an E passport to create this digital credential verify using biometrics.

We will also upload our health credential and we will share our flight reservation, the preliminary flight reservation we have, we will share the hotel details and the, on the other end, the government will verify all these credentials and run you through watch lists, and then decide if you are okay to travel to the destination, you will receive a token, a verifiable credential that you're okay to travel. I expect these governments to also ask you, do you want to opt into a fast arrival process, a fast seamless arrival process.

If so this and this you will share, and you'll be able to use biometrics upon arrival and you'll have to opt in and give consent. This credential that we then get from the government, we will share with the airline and the airline will make our booking final knowing that they have received through this credential, the okay, that the fact that you are okay to travel and the fact and your verified identity data. So that's very important because the government and the airline will both have the same data. So then it's time to fly.

And while you're packing your bag, you're reminded to check in for your flight. And when you check into your flight, you are asked, do you want to opt in for the seamless passenger facilitation at the departure process you want to, and you will say, I opt in for my border control. My airline and my airport process all will all, will be given separate consent and will receive the identity data that they're authorized to have and need to have to process you for a seamless passenger facilitation at the airport. I have an easy process, biometric clarification through every step.

And the only time I still pick up my E passport is when I pass through the board of control, because I will still need to prove I'm in possession of a, my physical passport, but NFC technology will match me with the data that is already received by the border control in Aruba, which of course is my destination. I will also, I have a smooth arrival and I will still hold by passport in my hand. But at a walking pace experience, the NFC technology will match the document to the previously verified identity data that was received.

And at the hotel, I will check in with my face and be no time I'm off to the beach. Now, a lot needs to happen, and that's no easy feat before we change the, the whole ecosystem to be able to use our E passport, our digital travel credential and have a walking pace experience everywhere. But luckily a lot is happening. The most important development is that two years ago, the specifications were published for what is the IKO digital travel credential type one, which is basically what I described. It is self derived.

So you use your E passport and your mobile device, and you can derive a virtual component of your passport. This is already out there soon. Hopefully we will have type two type two is going to be authority derived, which means that when you get your new passport, you will also get your, you will go to the municipality office or wherever in your country, you get your new passport, you'll bring your mobile device and you will also be issued one on your mobile device.

So you'll have a virtual and a physical component and then type three will be a pure physical, pure virtual passport on your mobile device. The industry is also busy for many years. ATA has been working on a program called one ID, many working groups, and I've been happy to participate in that have developed standards and recommended practices and are still busy developing them to achieve this interoperability and coordination between all these stakeholders in the ecosystem, using biometrics and making it travel with ease a walking pace. But of course, it's very sensitive personal data.

So we need the highest safety and security standards, privacy standards, and a self sovereign use of, of our passport, our E passport, our digital passport. So this passport is crucial and the digital credential, the DTC, and it will change the way passenger data flows and puts, and it will get it upside down right now. When we travel our, before we travel, the airline identifies us swiping our passport, or we scan it in the airline app and it uploads. And that is used as the basis for API, which is a different API.

It's the advanced passenger information data that data together with the P and R go data, which is the, the data, the travel reservation data that the airline also needs to share is sent by the airline to the government of destination. The reason for all this is found in human security council resolutions, and they have to do with countrying terrorism and transnational organized crime and fighting human trafficking. So it's a very serious business.

And the system has been in place and has grown to I API and include biometrics according to security council resolutions, but it is still the airline identifying you. Now.

What if, what I, what I painted that picture I painted the passenger was central and the passenger in a self-sovereign manner was sharing a set of Verit digital credentials with the government of the destination. So the government of destination in advance remotely verifies your identity with a very high level of security and then shares an okay to travel. And if you share that okay, to travel with the airline, the airline and the government have the same set of identity data. And that's the whole reason of API P and R, but now in a much more direct way.

And the high level of assurance for the identity is of course, UN uncomparable to a swipe of a passport or an airline agent checking, whether you are who you are. This will also be in line with the future of visas estas and Europe's ATS, of course, which will be part of the set of travel credentials as will our health credential, because they're not leaving the mix. We will be sharing our health credentials in the future. And God forbid we have another pandemic, but we have to be prepared for another pandemic. And we have to keep this as part of this mix.

So there's good reason why we need to do this security. I already mentioned extremely important, but also the passengers in control, uniform data, much better services efficiency of the airport process, aligning the process and a much better passenger experience all around, but we're dealing with the most sensitive of passenger data biometrics as well. So if this is not done with the highest security and protect data protection and data privacy regulations, we will not get the trust from the passengers, which is you and I, or the stakeholders across borders.

So this is work in progress, and hopefully we will get there, but yeah, what's next, sorry, guys. I have to have a sip of water.

We, we have the DTC, we had the specifications, we have standards that we can use, but we're lacking governments right now that are actually even after two years piloting this. Now I, I used to be a civil servant for much of my working life. I'm not anymore.

And I do, I do appreciate, and I respect that. And, and we feel from the vein from the Netherlands Institute for identity data gave a very good presentation, very honest that for governments, it's very difficult to jump on innovations because of, you know, bureaucracy culture, and often just legislation that doesn't allow you to innovate. I was always a very impatient civil servant, and I'm not a civil servant anymore. I like innovation working on innovation, but I'm still very impatient. And I think we need some bold leadership to make this happen and to start piloting.

I'm very proud to announce that Aruba will start piloting the DTC very soon, but I do hope we're not alone. And I'm really curious, what will the EU digital wallet mean for digital, for digital identity and travel? Will it include the DTC? Will it be type two or type three? How will we, how will we use it? What is the European external actions, the new borders, external action service, what is happening there? We will there be able to, are they ready to receive the DTC, the ETS, the new electronic travel authorization from Europe?

Is it able to receive and use the DTC and across the pond, the us customs and border protection, they have a fantastic system called the traveler verification system, but what if they are able to receive a DTC that would improve processes and the security of data, the security and the uniformity of data. Of course it needs security of data. So let's hope this is happening and I'm not only impatient, but I'm also very optimistic.

And I do believe that in the next few years, we'll be able to have presentations where we see where we can talk about what the, what this really means to use a digital travel credential and the standards around it. So stay tuned and thank you very much.