Good to see you. Wonderful to see you, actually. I'm Elizabeth. I remember payphones. I did my homework using dial-up internet and floppy disks. My 10-year-old daughter hears about that stuff, and she thinks I'm from the land that time forgot. In this world today, she's living in a place where technology is advancing so much faster.
Every day, we see incredible things, like that guy who used chat GPT and mRNA to cure his dog's cancer. That is so cool. We are innovating in a time where organizations are seeing the value in identity and security. Verifiable credentials are taking off all over the world. Our products and services and identity are changing rapidly to meet today's needs. And we're developing this tech for the betterment of humankind. Right? Is there an elephant in the room?
Oh, there's an elephant in the room. A lot has changed since last year. A lot. And this talk was really, really hard for me to write. Because I do consider myself a patriotic American. And also because I'm kind of worried about what could happen to me. I'm a little worried that maybe the government finds out and I lose my TSA pre-check privileges, and I have to go stand in line at the airport. I'm a little worried that maybe someone might feel pressured because I've gone too far and maybe I lose a client. I thought long and hard about whether to do a talk that would sound political.
But I decided that it's too important. That what's going on in U.S. politics matters to us and to our industry. And the changes we're seeing, they're really not unprecedented. U.S. history includes periods of slavery, witch trials, genocide, apartheid, torture. And even though we've removed references to those things from many of our national parks now, they still happened. And the changes that we're seeing today are deeply, deeply precedented.
I, like many of us, thought that we had learned from the past, and that those things were not going to happen again, never again. Today I'm going to focus on the identity policies and what's changing in the U.S., and I'm going to show you why it matters to all of us. Because never again is happening right now. And while the regressive policies themselves might not be unprecedented, the ways in which technology is underpinning, enabling, facilitating, accelerating those changes, that is unprecedented.
History is repeating itself, but with stronger identity and surveillance technology than ever before. And we have to be brave enough to confront the idea that there are downstream consequences to our life's work. We build the technologies that sit at the beating heart of politics. Who belongs and who does not? How do you verify, provision, authenticate? How do you assert belonging? What are the rights and protections that people who do or don't belong have? Learning one, we need better ID infrastructure.
Last year I came to EIC and I spoke about the homeless population and how our ID systems was letting them down. 25%, roughly 25% of unhoused people are lacking ID at any given time. That's documentation that they need to gain access to housing, education, a home. That creates at least $7 billion in losses that are shouldered by shelters, non-profit donors, and taxpayers. It says nothing of the unrealized benefits of having those people contributing to the economy. Better foundational ID systems are critically important.
Three months after I did that talk, the Trump administration declared homelessness a crime. They issued an executive order declaring that homelessness was a crime. And by December, 150 camps in Washington, D.C. had been cleared. The people still exist there, they just don't have tents anymore. Service providers like doctors, like lawyers, recovery experts, they're having trouble finding them. Where could those people be? Especially the 25% who don't have access to foundational identity documents.
The executive order allowed for them to be involuntary institutionalized, like in this facility that they've proposed in Utah. And by July of last year, we had opened Alligator Alcatraz, that's its official name, and they had started receiving immigration deportees. Human rights abuses soon followed. I can't help but wonder, could some of those cleared from the camps in Washington, D.C., be somewhere like that? And I think of course they could, because there are plenty of examples of people with valid U.S. birth certificates, U.S.
citizens, ending up in those places. So, bringing up Alligator Alcatraz, that brings us to a corollary.
Yes, the United States needs better foundational identity infrastructure, but ID infrastructure can be dangerous, because it can be weaponized, and because the definition of what is legal can change. Let's talk about the Haitian immigrants in Springfield, Ohio. Perhaps you heard Donald Trump speaking in the presidential debate in 2024 about Haitian immigrants eating the cats and the dogs of Springfield, Ohio. That was a fabrication. They were not eating the cats and the dogs. He also said that they had come here illegally, not here to Germany, but there to the United States.
That was also a fabrication. The Haitians in Springfield had entered the United States under a program called Temporary Protective Status, TPS. It was started by George H.W. Bush in 1990. When they arrived, they filled out paperwork. They filled out an I-94 form. Their identities were recorded in DHS databases. They also filled out another form, USCIS I-765, which was required to give them permission to work, and it required the collection of biometric data. This was all recorded in ID systems.
Hey, that's us! The mayor of Springfield said that Trump's claims were false. They were working, they were paying taxes, they were contributing to the community, meeting unmet needs, growing the economy. Nevertheless, the administration revoked the legal status from the Haitian community, even though revoking those credentials would destroy their ability not only to earn a living and protect their families, but also to contribute economically to the places they were living. And they would be very easy to target, because all of their information was held in our identity systems.
Their story is not over. It's important to note that human rights organizations filed lawsuits immediately, and that's still being challenged in court. We are expecting the Supreme Court to rule any day on whether revoking legal status from the Haitian immigrants was allowable. In the meantime, the United States House of Representatives also passed a law extending temporary protective status for the Haitian immigrants. That was a purely symbolic measure, though, because it is unlikely to pass the Senate, and Trump will veto.
Nevertheless, these ongoing legislative battles, they have helped to elongate the process for the Haitian immigrants, but that wasn't the same for other communities who have been targeted. In February of last year, the president invoked a rare wartime power to declare that a South American gang was invading the United States. They moved so fast to deport 283 men to a notorious terrorist confinement center in El Salvador, known as CICOT. This included men like the hairstylist Andri Hernandez-Romero, who was targeted because of a tattoo with a crown on it.
And they were deported without due process. They were then subjected, allegedly, to mental, physical, and sexual assault. The administration kept the identities of those detainees a secret for a long time, but subsequent reporting has revealed that 75% of them had never committed a crime on not just American soil, but any soil. But with their credentials revoked, they were deported, imprisoned, and tortured. That was just the beginning. The administration has revoked the credentials of DACA recipients. These are folks who came to the United States as children and know no other home.
They've revoked student visas for people who spoke up and protested the war in Gaza, or just wrote an editorial. They have used information held in identity systems. States have used these data points to identify trans people and revoke their driver's licenses. Permanent residents are not safe. Mahmoud Khalil, his permanent residency has been revoked. Naturalized citizens are not safe. And the targeting of Somali immigrants, most of whom were naturalized U.S. citizens in Minnesota, is what led to much of the violence that we saw there this year.
On his first day in office, Trump attempted to revoke birthright citizenship, which is a constitutional amendment. It's part of the Constitution. If the Supreme Court allows this to happen, how far will it go? Credentials revoked digitally are leading to people showing up on the devices of ICE agents. People learn that they have gone from temporary protected to targeted when ICE shows up at their door and sometimes blows it off. First they came for the homeless. Then they came for the Haitians, the Somalis, the Venezuelans, the DACA, the trans, the U.S. citizens born to immigrants.
I didn't speak out because my credentials had not been revoked. Yet. So let's imagine a world where we have our government-issued identities on our phones. Our legal status is bound to our fingertips, our faces, and our devices. Mobile carriers know where we are at all times. More and more often, a whole range of companies are asking us to use those credentials to prove who we are because they want to reduce fraud. They want to protect kids. Imagine any of these companies or your wallet provider sharing that information with the government. It's for national security.
Or maybe your wallet is issued by your government and they can see where you are anyway. Now imagine that your credentials are suddenly revoked. Maybe you're an immigrant. Maybe you held the wrong sign at a protest. Maybe they don't like how you dress. How long before you're here?
Friends, are we building the trains and the railways of 1930s Europe? We don't blame the trains, right? Trains are good. We need trains. And we need identity infrastructure. We need them to manifest our rights, to protect our society from malfeasance, but we also need legal protections to keep us safe. Innovators and the technologies that they produce need guardrails. And current events in the United States demonstrate the impact of inadequate privacy protections. Since 9-11, surveillance has increased exponentially.
Without comprehensive privacy legislation, companies collect vast amounts of data. Willingly or unwillingly, these companies become partners in government surveillance. It's not unprecedented. AT&T and Verizon literally let the government plug in to the Internet backbone. Even if a company is unwilling to share data, they often need to comply with government subpoenas. They don't want to fight the U.S. government because the consequences for doing so are insane. Look at what happened to Anthropic.
They were declared a supply chain risk because they wanted to assert some control over whether the government could use their systems to conduct unsupervised lethal attacks or spy on Americans. Sometimes the technologies that we in this room are building can enable abuse to spiral out of control. Flock security cameras have been used by police forces to stalk the women that they're dating. They've been used to surveil protesters, track them down.
To track, target, and arrest women who have been accused of seeking an abortion out of state. Amazon's home surveillance company Ring created an uproar during the Super Bowl when they showed a commercial where all the Ring cameras on homes were suddenly switched on to help search for a dog.
Of course, people were not imagining it would be used on just dogs. Clearview AI, the facial recognition software company, is now being used by ICE. They say it's being used to disrupt, degrade, and dismantle those who would harm Americans. Which I notice is the same way that they speak about anybody aligned to the opposition. Perhaps that's why ICE agents know the names and addresses of the people who are standing and watching them.
The counter-terrorism strategy released last week talks about left-wing groups, trans-ideology, and the president signs off on his note, we will find you and we will kill you. Let that sink in. They're using our systems for this. Palantir synthesizes data from identity systems, including student visitor data, IRS data, health and human service data, clear social media.
Also, law enforcement has AI-powered dossiers that can detect and track individuals in real time. The data is being collected and synthesized for all citizens, regardless of whether there's a warrant or a threat is posed. We urgently need those legal protections, but belief in the law is changing in the United States. In the 20th century, we helped to pioneer international law. We declared that there were universal human rights, that everyone had the right to an ID and to be a person before the law, no matter where they were. We agreed in the rights of asylum seekers.
We agreed to help prevent statelessness. We agreed what constitutes a war crime and what is genocide. We signed onto treaties.
And we, the United States, exercised our sovereignty when we saw some we didn't like. We didn't sign those ones. But the administration today doesn't just say international law doesn't apply, they argue that it doesn't exist. This is how we justify bombing boats in the Caribbean, toppling the Maduro government, attacking civilian infrastructure, and, yeah, threatening genocide. In addition to undermining international law, the administration has refuted some US laws too, or undermined it.
From using our systems to render legal and non-criminal immigrants to third-party prisons without a trial, to refusing to investigate the deaths of protesters killed in American streets. Inside detention centers, they are scaling up an operation that is associated with record-breaking deaths. It's easy to get emotional here. It's easy to get carried away. Why am I talking about all of this stuff? How does it relate to us and our work? I have a few questions.
In these United States, would the governor of Texas decline to use a state-issued wallet or a server retrieval token to track a woman who tries to receive an abortion out of state? Would Stephen Miller observe a policy document on the use of government identity and he really wants to track down Joni, your local organizer who hands out the whistles to people like Rene Good? If the state's going to surveil, they're going to surveil, but we don't have to make it easy. We can try and make it harder. And we can't depend on policy alone.
I want to see rights-enhancing identity systems all across the world. These are not challenges that are going to be won in a single argument, in a single court case, and with a single technology. Legal protections need to be underpinned by legal protections. Technical protections need to be underpinned by legal protections, vice versa. Civil society needs a voice. They need a voice in tech. They need a voice in legislation. Individuals, citizens, non-citizens, innovators. And in our roles as citizens and neighbors, we need to be speaking up, taking our place at the table.
What we've learned in Minnesota is that bravery grows with friendship, with community. Winning our civil rights back requires fighting this battle on all sides, engaging in hard conversations. That includes everyone here. There's one thing our community needs to help with so that we can see a whole society, community, come together.
Today, our technologies are dividing us. Algorithms are determining what news media we consume, and we're seeing increasingly doctored images and messages coming from our own governments. When admitting his lies about the Haitian immigrants, J.D. Vance said, if I need to make things up so that you will pay attention, that's what I'm going to do. That is a quote. We have seen the White House itself doctor images and present them on social media. We see edited videos designed to make sure that protesters appear to be violent.
In a world where we can no longer believe our eyes, we urgently need the standards like C2PA and others for verifying provenance and authenticity. We need electronic signatures, and we need to be able to help our friends and families use these tools so that they know what is real and what is not. We need to be building bravely the tools and the rules. We know what needs to be built. We need foundational ID systems that offer persistent, privacy-preserving portable ID.
We need privacy technologies, selective disclosure, zero-knowledge proof, biometric cryptography, and we need those provenance and authenticity standards. On the rules side, we need to legislate our norms. We need comprehensive privacy legislation, say it again, Americans, with heavy restrictions on secondary use and surveillance. And we need digital civil rights. We need to have the tough conversations in real time. And in the last year, we have seen a really great example. I'm going to do it. Let's look at MDL and SETI in Utah. Some of you in this room are involved in one or the other.
Please don't hurt me. For years, people in this room have been working on ISO 18013-5, the mobile driver's license standard, and 18013-7, the one that defines how it's going to be used online. These standards have a powerful ability to increase equity, to increase access, and it's being accepted and adopted by countries all over the world. Another group of members from this community looked at it and said, this gives me pause. There were some features that gave them pause.
Kim Hamilton Duffy, for example, wrote a really, really thoughtful, considered article on what it could mean for surveillance in the United States if it was misapplied. Advocates in the state of Utah went so far as to repeal their MDL legislation, and they passed another, SB275, known as SETI, and it was built on a digital bill of rights at the start.
The ACLU, the American Civil Liberties Union, applauds that work. On the ISO side, my understanding is that the working group is pulling the functionality in question into another document, and the American Association of Motor Vehicles, AMVA, has said you cannot implement this in the United States as issuers. Whether you agree with what Utah did or not, I think this conversation was so important. I'm so proud of people on all sides of this argument for having the bravery to speak up, the bravery to listen, the bravery to mitigate risks.
We need to be out there, bravely standing our ground to build things in the right way, and courage is contagious. Let's look at some more examples of our community doing the right thing. The Didus community in Switzerland, after voters rejected the digital ID, they went out and they took a human-centered, whole-society, privacy-preserving approach, and now the Swiss people do have access to privacy-preserving credentials.
OpenID Foundation is always building privacy-preserving standards, has been driving the conversation forward ever since Heather published her amazing privacy paper a few years ago, and we are constantly responding to governments and SDOs about critical issues of importance in this industry. At IOW this year, I saw John Bradley give an amazing demonstration on Longfellow zero-knowledge proofs, and I think that this is the future. It has so much potential.
The authors of 863-4 called out some of these standards, and really, ultimately, this gives implementers in America the air cover to do things right in a privacy-preserving way. FIDO offers a great example, ensuring biometric templates used for passkeys never leave the device. UNHCR and other UN agencies, they recognize the risks of their biometrics programs and they weigh them against the importance of providing food, shelter, safety. They mitigate those risks with heightened security and purpose limitation.
And then, of course, Signal's example is a great one, Sealed Sender Program. They just don't collect the data. They can't comply with the government subpoenas because they don't have the data. You can build privacy-preserving standards You can build something with all the goodness and good intentions in the world, the Internet, Bitcoin, Facebook, Twitter, trains. A few years ago, Ian Glazer gave a talk about successor attacks and the importance of designing your products to be safe in the hands of a person who will succeed you who may have ill intent.
When you think this way, you'll find trade-offs. You'll find risks. We're never going to be perfect. This is a messy, messy world. And the only world where we solve everything is a world where human identity doesn't matter. And that could be the scariest world of all. There's going to be trade-offs. There's going to be risks. As product designers, as company leaders, standards developers, voters, we need to be brave enough to stand up, seek out, and name those risks. Listen to our critics. We need to be brave enough to argue on the merits and change minds, especially our own.
You are the smartest people in this industry. You can stop your company or the state or your working group from making grievous errors. You can educate your legislators. You can help mitigate the risks of harm. You can even sneak in a protection or two from people who don't know any better. They say that those who don't study history are doomed to repeat it. I'm here to say that even those of us who do study history are subject to its insistently cyclical nature. You could belong today, but that does not mean that you will belong tomorrow. One day you can wake up and find that you are a target.
Will there be laws to protect you? What's the technical landscape you want to be living in? Who will be by your side? Let's go out there and build the systems that will protect all of us. Thank you. Thank you. Thank you. Thank you. Thank you. That's nice. Thank you. In her book, Eve Mahler describes this community as a passionate community, and I think you are a testament to that. There's nothing more to be said, so thank you very much, Elizabeth Garber. Thank you.
