The ID Code of Conduct: Building a Fairer Digital Identity Ecosystem [Introductory]

Hello, everyone. Thank you so much for coming to my session today. As you introduced me, I am Kay Chopard. I am the Executive Director now of Women in Identity. That's a new role for me. I've been a volunteer with them for many, many years. But I've just, in the last couple of weeks, taken on being the actual official Executive Director. But I'm very familiar with the research that they've been doing.

So, I'd like to give you just a little bit of background. The organization actually has currently two offices, one in the UK and one in the US.

In the US, where I am based in Washington, DC, it is a nonprofit organization. It is treated as a charity. And it is engaged in doing things that are for the public benefit, and so that's why it's viewed that way. But the organization, when it first started, was very informal. It was about 10 years ago when it came together. And honestly, the name Women in Identity is a little bit of a misnomer because it's really about inclusion. And the women piece is not the only population that needs to be included in identity.

In fact, there are many others that really struggle, and I'll talk about that in a minute. So, our focus is really on inclusion.

And also, as an organization, when we came together, we were concerned about trying to do something that was meaningful, as opposed to pushing a philosophy or raising awareness or doing things like that, which you may have passion or philosophical viewpoints about some of these things around inclusion. But what we really wanted to do is see if we could make some progress in the digital identity field where we could actually do more about being inclusive in product development.

So, what the organization decided to start with, really, was to do some real research to figure out, are things already happening so we don't reinvent the wheel? If somebody's already done a lot of work on this, maybe what we could do is leverage that to really make progress.

So, what we have landed on is this identity code of conduct, which is really about trying to find actionable steps that a company can take in order to develop a code of conduct about product development and product design. How can we do things to make sure that we are?

So, this isn't like HR policies or something, right? This isn't about how to run your company as a whole. This is about how do we develop inclusive products and what are the pieces that you need to do that. You'll see in this diagram these numbers, one through five.

And so, what we did is they, I say we, I wasn't actually doing the research myself, but they did it in phases. And throughout this, we've had a variety of partners.

So, the phase one there, it was actually a literature review where they went out to see who's already done the research so that we're not starting at ground zero if there's a lot of work been done. Unfortunately, we didn't find that there was a whole lot of research.

So, there wasn't a lot that we could base our work on, per se, but that literature review is published. It's on the Women in Identity website. It certainly has some useful citations if you're looking to see what other research is out there. The website is just womeninidentity.org.

So, it's easy to find it because all of that is included on the homepage. So, from there, then we went to the next phase, which was to look at research on the human impact of exclusion. How does it actually impact people personally? And to do this, we were trying to be a little bit more strategic.

So, we split the research between two countries looking for a more developed country versus a more underdeveloped country to try to see, are there a lot of differences? Is this something, is this a third world problem or does this have broader implications?

So, they focused with their research partners on the UK and Ghana. And actually, part of what they did was to interview many individuals who had issues with being able to get their identity documentation, being able to access services because they couldn't, for whatever reason, there's a variety of reasons, which we'll talk about in a moment here, because they couldn't access being able to have those digital identity documents. And what was the impact on them?

I guess the surprising thing to me, and since Jay was just here, who I know from the UK, in the UK, I was expecting it to be a small percentage of people who were excluded. In fact, it was over a million people. I was not expecting that. Because you think of them as a more developed nation and as much further along, even as Jay's talking about, right, all the work that's been done there. But as it turns out, we are still not always designing for inclusion.

So, there are these big chunks of the market that are not being able to access the digital identity. And actually, it was a similar number in Ghana, maybe slightly more, but actually not much difference, which I thought was very, very surprising.

So, anyway, so all of that is documented. There's a report about that, the human impact. There are also interviews. If you ever need video clips for some presentation you're doing, all of those are on there, and you're welcome to access all of that.

So, then from there, we went to the third phase, which was the economic impact. So, what does this do to the economy? And for some of you, if you were at, we did a women in identity event over the lunch hour, and we actually had a lot of those statistics in a slide. I don't have that here now. But one of the things that was interesting is that there are over a billion users globally who do not have access to digital identity, right?

So, it's not a small market share. It's potentially a fairly large market globally.

And also, the economic impact research was done in partnership with the London School of Economics. So, we had economists and others who were actually helping figure this out. And it really turns out that it impacts the sort of the gross national product by several percentage points.

So, again, it's not like an insignificant amount. It is quite a bit of money that we're sort of leaving on the table because we're not finding a way to reach some of these various groups that it's a little bit harder to be able to identity proof or authenticate and so on.

So, anyway, that was published, again, another report, but published about the economic impact. It talks about a lot of these things. It also gives some very specific examples.

I mean, I'm looking over here at Angelica, who is part of Women in Identity. She's based here in Germany. And she was showing me also some of the examples that came out of that research, which are just surprising. I guess we often think of these as outliers. And it turns out, there's a lot of situations that were just probably unintended, but really had a very big impact and a very big monetary impact on individuals, yes, but also on those countries and their economies. The next phase is to build the Code of Conduct itself. And that's really where we're at right now.

And I want to talk about that a little bit more. But out of the research that the London School of Economics did, what they also were able to do is pull together what are some of the principles in those products that are more inclusive. What were the principles and how they were designed and developed, how they're used? What are the principles so that potentially we could replicate that, right? Because the idea is, once we build this Code of Conduct, the phase five you see there is implementing it.

So what we want to be able to do is turn around and give actionable tools to organizations so that you can take those and build more inclusive products yourself and capture more of that market share. And also be able to use that in your own marketing strategies. I think what we are seeing is this is really a business strategy.

This is, like I said, this is really not a philosophy per se. It's really looking at how can we be more inclusive? So the principles that they put together, they also took from some existing research. And there you see some of the organizations that had already done some research.

Again, so we're not reinventing the wheel. And we're really leveraging work that's already been done. When you're a small non-governmental organization, it's important to leverage the resources that are out there because we aren't made of money. So we're not able to go and just sort of start from ground zero. But it was very helpful. And certainly a lot of work that's been done by the World Bank and the World Economic Forum was very useful to us.

And again, it's focused on the product development and the services being more inclusive. And when we are looking at inclusion, and I don't think I have a slide on this, but I'll just give you some examples. We're looking at, it would be things like race and ethnicity, the typical ones that you might see. It's also socioeconomic status. We saw a lot of issues for immigrants and refugees. We're also seeing issues for individuals with different gender identity, right?

So binary, transgender, those kinds of folks, those kinds of situations, as well as women, which might be a more traditional one. But all of these sort of coming together with a variety of groups that are really impacted. So the principles that were identified, and we've kind of, sorry, it's a little text dense, but I wanted to kind of just illustrate for you some of the things that we were able to pull out that are really principles that we want to try to work towards. So delivering universal coverage and accessibility, right? So that there are options for all types of users.

At the same time, safeguarding the rights of all users. And that might be through robust legislation. It might be through regulation. It might be through independent oversight or so on. But I'll give you an example. I spoke at another conference. It was a FinTech folks, right? And I was on a panel with a whole group of technical people from the banking industry who are working on technical solutions for their bank customers, right? And trying to be inclusive.

And one of the things we talked about is that what often happens is that, and you'll understand why I'm talking about this when it comes to safeguarding rights. Because what often happens is some of those populations, like for example, the unbanked, people who are homeless, people who are a lower socioeconomic status. So they don't have a credit history, right? They don't have some of those things.

What would often happen is that they would try to make solutions that were less restrictive and at the same time, what is already a vulnerable population, we're putting them at more risk for fraud, right? Because we've reduced those restrictions in an attempt to get them into the system. But we've also opened them up to the possibility of abuse of their digital identity. And so one of the things we talked about is how do you counter for that?

How do you make sure that you haven't opened up an avenue for organized crime to now get in there and start fraudulently using what is already a vulnerable population who may not have the access to all the tools and still protect their rights and still protect their privacy? So it's not always an easy path. And sometimes, like I said, we have unintended consequences. We're trying to make it better and actually end up making it worse by accident, if you will. So that was one of the things. The other thing, one of the principles was to look at making it an organizational priority.

That's one of the things that came out that was important, that you sort of align your priorities, your capabilities, and the consequences, recognizing that as something that is a goal for your company or for your product team, that you want to start out with that from the very beginning. And I use this at the lunch. So apologies to everyone who came and heard my stories already. But one example that I give is that this is an ancient one. But back in the day when YouTube was first created, right? And for those using YouTube, for some of the users, when they would look at it, it was upside down.

And so the product team is like, why is this working and upside down? What's going on here? Turns out it was that way for left-handed people. And on the product team, they were all right-handed people. They didn't have any left-handed people on the product team. And so when they designed it, they weren't thinking about that. So often there are unintended consequences, right? And of course, they were able to go back and fix that. As you can imagine, that meant spending more money to go back and fix it.

Unfortunately, if they had thought about that or tried to be inclusive in their design, they probably would have caught it sooner and saved themselves a lot of money. But that's not always possible. I just use that as an example because I sort of feel like it's fairly innocuous. No offense to all the left-handers in the room. But I think that's an easy example about things that can happen if we don't make it a priority, if we aren't being intentional about trying to think about some of the possibilities.

As I had said before, trying to protect the privacy while maintaining security and the agency through the design using open standards where possible and looking at outcome-based approaches. Another principle was to think about putting the user at the center of the identity ecosystem. And back in the day, I used to do a lot of teaching, and I used to train other teachers. And one of the things that I would talk to them about is when you go to do something, often you think about what you're going to do, right?

So if I'm the product team and I'm trying to develop something, I think about, well, what do we want to do? What do we want to create? Instead of trying to put yourself in the shoes of the users, and who are all the potential users? Who is that whole sort of bandwidth of folks that might be users? And try to put them at the center of your design instead of thinking about what do I need to do? What do I have to have in there for privacy? What does GDPR require me to do? What are some of the security measures I need? Now I have to worry about AI and all that.

So it's sort of a different way to focus as you're designing and being innovative and creative, but with that kind of a lens. And then another is that, you know, keeping in mind that you need to make these inclusive products still have to be affordable, right? Operationally and also financially sustainable.

So again, if one of our populations are socioeconomically disadvantaged, making a more expensive way to do it for them is probably not going to result in the inclusion they're trying to get. So those were some. There are some other principles, and those will be coming out in the next round. So the research approach, and I've kind of talked about some of this, but the next step now, and which we're doing imminently, we're starting a lot of things, and I'm going to put out a plea here. If anyone would like to get engaged with us in this, we'd really welcome your participation.

We need all the stakeholder input that we can get. And so we're kind of focused on product teams. So if anyone's participating in a team like that, we would really like to work with you, and I'll tell you how in a minute. We're also looking to talk with policymakers, with regulators, with framework developers, with relying parties.

And certainly on a daily basis, I'm trying to interact with a lot of those folks because we need them to understand what we're trying to do and how they view it and what kinds of, what I want to say, encouragement maybe they're putting in the marketplace by the way they either design things or the requirements that they're putting out there, and then further engagement on data collection, which we hope will result in this code of conduct. And so we've already drafted these potential principles. We're trying to design the research methodology.

We are running roundtable interviews now starting in June, which is now just a couple of weeks away. And so again, I want to talk to you about thinking about coming with us and participating. It's not paid. It's an hour's worth of your time to sit on a virtual focus group. But we need to hear from the tech providers, the product team folks. We need to hear from policymakers. Each of these are actually going to be different groups.

So by example, we found that sometimes policymakers or the trust framework developers who have responsibility for this are reluctant to have some candid conversations if the tech providers are there that they're regulating, as you can imagine. And also some of the tech solutions, we don't want them to feel like they have to give a sales job. Or if they have a struggle with something, we want to hear what that is. And if other people in the room, they might be reluctant to say, well, we tried that and it didn't work very well. So we're trying to really separate these groups out.

We also have a group of NGOs who are often not as technical. And we discovered we're very intimidated by being in conversations like with product teams, because they were like, I don't even understand the jargon. And I'm afraid to ask a question because I'm going to look stupid. So we're doing a whole series of these. And even if you're not interested, if you know someone who might be, or if you want to recommend to us, my email address is kkayatwomeninidentity.org. So send those recommendations in. We would really appreciate it. These are just some quotes.

I'm even quoted there because I also, the other half of my job is I work at Kintyra Initiative, which is a conformance assessment body. So this is just some of our, I think I've already talked about this.

Sorry, I kind of leaped ahead here. But looking at all of the early observations that we've made, here are some things that we're considering going forward. And as I said, these are the roundtables.

We also, we really could, we really want to continue to encourage more corporate sponsors. So if you think that your company might be interested in participating or also being even more engaged with us, helping fund some of this work and being at the table with us, we would really, really appreciate it. So thank you for your time. Thank you so much. Any short questions from the audience?

Otherwise, we will directly move on. Kay, if there are more questions for you, where can we find you? Where can people find you? Do you have a booth? We don't have a booth, but as I mentioned, probably email me or you can find me on LinkedIn, either way. And I would love to talk more, so I hope you'll reach out. Thank you. Thank you so much. Thank you.