Here's my clicker, okay Thanks very much so I'm gonna start by paying all of you Europeans a compliment, which is I think that the EUDI framework or EIDIS is the most ambitious and Hopefully will prove to be the most successful digital trust framework ever built It's got layers of you know, it's it's it's very well put together very well thought out clearly You know, everything has been considered and it's proving very powerful right now And you know, that's unlocked, you know, we've got all EU 27 countries We've got a few that are not in the EU Norway and Iceland And it it seems to work very well.
It's that works since 2014 and and you know everything with the large-scale pilots Suggests that it's gonna work well for the wallets But I want to bring in a slightly different perspective because I work at the World Bank and so I've been Giving, you know technical assistance and supporting countries and financing projects in identity across the world so that includes Latin America, Africa, Asia and They have slightly different problems But but they're also very attracted by digital identity Attracted by wallets and all these things and so the perspective that I have and that some of these Countries have is that it's not actually a cross-border trust framework because for them they don't see this What they see is this All those, you know internal European borders disappear if you're someone in Papua New Guinea or in Argentina or in Zambia You just see a bunch of Europeans who all seem more or less the same to you and saying it's a cross-border trust framework makes about as much sense as saying that Arizona and California sharing driver's licenses across border trust framework and And this is pretty limited in its scope.
There's a digital single market, but but it has a hard edge and So in the global conversation You hear this term digital public infrastructure, so it's not the best term It's digital. So that's good. But the infrastructure guys are annoyed because it's not actually hard infrastructure It's like soft infrastructure, whatever that means and it's we say public But actually the whole point is that you can have private sector provision of TSP's and that sort of thing So that also confuses people so it's led to Some, you know, we've had to define it.
So the World Bank actually has a white paper on it And this is the definition that's in there. So it's foundational.
So it's for the whole of the economy or the whole of government It's these modular building blocks and it's for public benefit which had to be there because otherwise it gets confusing that you have public private provision And then you know, so I'm not gonna this is not a master class on on DPI But but the the it does capture a paradigm shift which is get away from these monolithic software architectures to something modular to being user-centric to have transparent governance and to have private sector participating so Because this is EIC and because we're in Europe when I look at this set of definitions, I think he itis I think most of you probably think something similar, right?
The whole point is that you're unlocking an ecosystem of public and private players. That's interoperable. You have transparent governance You've got privacy by design, etc.
So this is what I think But if we look at the DPI conversation globally No one is thinking about the itis These are the brands that we have in the DPI conversation There's others but but they're they're India stack and adhar and pics Which is this very very clever payment system in Brazil works great This bashini is this AI kind of translating, you know There's a bunch of local languages in India so you can relate to the government your own local language. The Estonians are there They're they're they're positioning themselves in this space.
But these are these are the brands and So, you know, where is Europe in all this and This is something that's frustrating to me frankly because I work on Europe and I'm I'm a fanboy of the of the eitis regulation I think it's great And and I think that a lot could be learned from that and exported to expand Digital trust and expand the the frontiers of where we can have interoperable identity and data But but I see these two very separate Conversations and you if you are someone who attends these DPI conferences You might be you might be forgiven for thinking that India and Brazil invented cross-border trust and and and PKI and all sorts of things so Now so then a question that I want to put on the table is the UDI framework to EU specific to travel, right?
Is it just something that? Europeans invented for their needs and it fits European use cases and European digital maturity and etc and and it's a great for the European digital single market, but that's the end and so There certainly are some things that make it not travel very well. I'm going to talk about three.
So the first one is the jargon So, yeah, I Probably don't need to say that much here This is a challenge And and it's so sometimes you invent jargon terms because you need them to say something Precise and specific and I think a lot of those are there but some of them are also kind of frustrating where you know Everyone in the world just says verifiable credential, but now we have to say QEAA, right and and everyone's confused Everyone's confused and and and yes, I know that the the technically an EAA is a credential and also as a PID So we need two terms because they're to govern.
Okay, fine But but at some point you lose the the crowd and and so I have I have Colleagues internally where I try to sell them so to speak on you know, you should really look at the EIDIS model That would be really interesting for this country you're working in and you know Latin America or or or Asia or wherever and and the the the reaction I always get is oh Yeah, yeah, I just yeah. No, it's a really good model.
It's it's too complex It's it's too and and then I say why is it too complex because because you know, if there's a problem, let's solve it Right, is it that you don't have the institutional capacity to supervise and accredit and and have conformity assessments for trust? and and we don't get that far because they're they just get caught on on how complicated this looks and And in the rare cases where we're able to have a you know, go under the the jargon We we are usually able to find things that oh, that's how they do it.
Oh, I'd never understood that. Okay.
Yeah No, that's super relevant. But that's not something that natively comes out of this sort of jargon set Um, so in addition to a communication problem, there's also an awareness problem Um, I'll who in this room and I think there's a couple of you like Gail You were at ID for Africa last week.
So who in this room has gone to a conference with a bunch of these people Yeah, so like a minority right like some but not many but there's an entire parallel conversation going on about India and Brazil and digital identity and digital public goods and open source and mosip and again, the Estonians are there but but the Europeans are not and the other European countries are not and And and and and this there's a there's a communication gap here, right and it's not helped by the jargon But then it's also different stakeholders with different problems, or at least they think they have different problems trying to solve them differently Okay.
So the third barrier I think to export is a is a mindset one And I think this is understandable because the the regulation is complicated and the timescales are short and everyone's very focused inwardly on Compliance, but we do have a compliance language that we speak and you know, why do we need to do this? Oh because it's in the regulation.
Well, okay, but but but what does it do for us? and and sometimes that's not a language that we're so good at speaking as Europeans and When it's outside of Europe and when it's not a regulation that you're actually Bound to then I can't just say oh you have to do this because the Europeans said so like well, we're not in Europe Why do we actually have to do it and then you have to speak about?
Oh, well what this helps you do, right?
This helps you have cross-border recognition or this helps you with your trade use cases or this helps you You know mobilize or I don't know create space for entrepreneurship or whatever it is And and and that's a that's a mindset that that that I find is difficult sometimes in Europe We have the same thing with GDPR I do a lot of data protection type work and we'll give it we'll be giving countries technical assistance on how to how you know a lot of countries have their first landmark data protection law and we're helping them put that into place and You know, we'll get experts to come in and advise them and and they'll say oh, yeah You have to have this or you have to have that it's like why what was because GDPR it's like Africa right.
This is not a GDPR jurisdiction We have to speak about what this is doing for us and everyone in this room knows that GDPR is a landmark But but it's not perfect. So so we can't just say oh everyone needs to follow this regulation I think the the the eidus is similar So, okay now so that was some bad news. So what does travel well the standards travel very well And the the you know, it's great that the UDI framework, you know adopted so many international standards and didn't you know Try to roll their own for everything.
And so we've got countries at different income levels that are Not every none of not all these are live so like Jordan for example, I put here but they're they're not yet adopting MDoc But we have a World Bank project that's supporting them to re-architect They're very very successful Senate app to make it a VC wallet, which will allow them to scale to private sector use cases, etc And and then you've got some of these other countries.
This is a sort of random sample This slide I stole because I had a slide for this one and it was worse than this But then Gail presented this yesterday, so I had her send it to me So the the different standards of traveling well But so those standards aren't always natively appropriate for everything So I wanted to talk use this as an example to talk about Evolving the standards and so in Benin and and much of Africa connectivity is a problem you don't always have internet access and then Smartphones are a problem.
You don't always everyone doesn't have smartphones or they don't have their own smartphone They share it with a family member or it's an old one. It doesn't have all the security hardware security, etc, so So one thing they like to do in Africa is to take a kind of a I call these naked credentials So it's a it's a verifiable credential data model, but it's encoded in a QR code and there's no wallet, right?
So this it basically it allows you to verify the authenticity of the document, but doesn't assure anything related authentication okay, and and and so the but the W3C model when it was came out it was For online use cases and had all these pointers and things so but the Mike Jones is at the conference But they they evolved it to do this really neat binary data format So now it's a much smaller file size you can actually compress it the whole thing onto a QR code as you can see there might be Scoped reduce it a little more because it's a huge QR code and when you when you print that out and you smudge it a little Bit, you know, I'm not sure that three years from now that's gonna scan very well But but still this is super transformational for the for Benin because they're going from absolutely nothing To having a document that you can't falsify now We still have an authentication problem to solve and that'll come But the the people that are they're using this in the village or whatever They're probably not active participants in the digital economy in the first instance.
So maybe that's not actually the problem. They're solving for Okay.
So another thing that travels well is when you take subsets of parts of the regulation so the the Commission has this third country list of trust lists that I imagine a number of you've heard of and You know when the mutual recognition Agreement part of eitis one didn't really pan out I don't think one's been signed since 2014 because it was I don't know I guess politically a bit complicated The but you can get the technical level of trust at least of the trust services by being assessed That your compliance framework is equivalent and then you can get your trust list pointed to by the Commission And so I mixed together countries that are live and countries that are in discussion right Egypt and India and Japan It's in discussion Moldova and Ukraine are the ones that are live and then I work in the Western Balkans region I know three countries that have that have applied and they're working on it as part of the accession process but this is cool this speaks to people because it's a it's an objective that they can reach in the short medium term and it's Not so overwhelming is like the full wallet Interoperability and it's a it's a step that can kind of get them toward the the digital single market I think this could have legs So I want to talk a little bit about selective adoption, what do I mean by that so this trustless thing Is is one form of it I think um so the the idea here is that if your problem is that eitis is Overwhelming and complicated and too much too soon or that you don't need all of these All the things that it gives you then just instead of saying oh, this is too complex.
It's not for me Let me make my own thing Why not take parts of it? So for example, if you don't need cross-border use cases then just get rid of all the stuff That's cross-border get rid of the nabs and the cabs and the supervisory bodies and the compliance and certificate you can get rid of quite a lot if you stay within your national borders because you have to trust the thing because it was Issued by your Ministry of Interior and the law says you have to trust it now You may not trust your Ministry of Interior, but then you have bigger problems, right?
So so legally you have to trust it It's only when you want to extend the trust across borders that you need all this like really really intense compliance infrastructure If you don't need a qualified electronic signature for like the woman in Benin in the village Don't complicate your life You can have an identity wallet that has a few credentials a kind of a minimum viable product get it off the ground get it In the hands of people can still be high assurance or maybe not What if level level of assurance high is kind of overkill for a use case?
You're going from people who don't have birth certificates. And now you want LOA high.
I mean, it's at some point Maybe that's not what you need. So then introduce a substantial tier You can always add LOA high LOA high back when you want to do Cross-border interoperability with the EU in a year or ten years or whenever it is But but don't forget about assurance levels, right?
One of the things about you know, the eitis one was great because you had three levels of assurance and those disappear So if you have low capacity, you know You don't have a whole bunch of issuers that all have this capability to issue digitally signed credentials then just limit your ecosystem It doesn't need to be infinitely scalable and infinitely modular in the first instance Solve some problems you actually have and then if people don't have smartphones, you know I had this the example the naked credential. You could also have hosted wallets and things like that.
So Take what you need, right? And so what one of the things I see countries and we're trying to advise countries to take what they can So I'll give a couple more concrete examples Let's see, I'll give an example of Lebanon so Lebanon's a country that's had many Difficulties the past few years and and so they wanted to get a signatures off the ground. They had a signature law But they were not very far along in implementing it and the public sector capacity was next to nil because they had Economic crisis and wars and all these things and so what we talked about what do you really need?
Oh, we just want to digitalize some services and we have a signatures in there and we need to have qualified electronic signatures But we don't have time to do any of the other stuff I said, why don't you just unilaterally recognize the EU trust lists and then you can use the EU signatures That's it. And they're like, it's that easy.
I was like, yeah, so they issued a decree and they just said in the decree We recognize like NC, you know approved QES providers And that's it and so because the law was already there that decree now implements it and now they're digitalizing some some public services using French TSP so hopefully the next version of the decree will go beyond France, but you know baby steps so the the but but they're actually they're having an issue because then they call up the French TSP's and they try to buy certificates like Oh, we don't really know how to do identity assurance in Lebanon.
So so there's there's a lack of imagination here I think about pushing the beyond that you 27 and this is I think this market is a crowded space a bunch of You are selling some sort of product. You're selling a wallet solution. You're selling trust services in a very crowded market There could be opportunities by looking outside of the EU and there could be opportunities for the for the public sector actors to think about you know expanding the these markets and And the type of trust that we can get.
Okay, so just a couple words about what the World Bank does There's a ID4D initiative identification for development and sometimes people are surprised to find that we're Over a couple billion and financing like four ID systems globally in 83 countries Not all of them are receiving financing some of its only technical assistance And that there's 120 million like direct human beneficiaries globally It's a big practice and and we do quite a lot and and in my opinion There's a suboptimal leveraging of the standards and all these good practices that are emerging in Europe Due to the things I was saying before about multiple conversations.
So here's a couple Papers that we've put out recently the one in the middle I only have a QR code for this one but but on the website the the others will be accessible soon and You know We're trying to give roadmaps for not just whole just adopting today the whole thing because not everyone's ready for that But how can you get on a pathway where we buy?
You know that we we adopt the bits that are relevant for us and then as we get experience and as our populations learn how to use the ID wallets then we add signature later and then we add high assurance later and and build toward getting to truly globally interoperable trust services and Digital ID so thank you very much for your attention
