Your Identity Is Not Self-Sovereign

Hey, we good? All right, good. And talk everybody. Thank you for sticking around to the end of EIC 2023. My name is Justin Richard. All week we have been hearing about self-sovereign identity and how important it is. And I am here today to tell you that your identity is not self-sovereign, which is why they probably put me in this last slot. We're gonna look at this with with a mind towards the underlying model of identity and specifically all the promises that you have been told about what self-sovereign identity gives you. So let's talk about self.

Self seems to be a pretty core and important part of the identity process. It is really, you can't have identity without self, can you? It's this whole notion of who somebody is, but in order to define self, we have to define not self. And it turns out that finding this boundary between self and not self is way more difficult than you. I think now in the physical space of things, our immune system does a pretty decent job most of the time of figuring out what is self and what is not self. That is its whole purpose, isn't it?

Its whole purpose is to decide that something entering the system of the body itself is not there. It's not supposed to be there and to get rid of it and keep it from harming you, but the immune system screws up. There are all kinds of autoimmune disorders out there that where the body actually attacks itself, itself, doesn't recognize itself as self, and therefore starts to tear itself apart. And sometimes we need to be able to override things. We need to be able to say like, oh, this new organ that is, that we have put in you transplanted in you. It is part of yourself.

So don't attack that, all right? And unless you think that this is kind of like a, a strange, esoteric thing, think about the curry verse that you had for lunch yesterday when you were about to eat it. That was not self. Now that you're sitting here today, guess what? Through a long complex chemical process that we call digestion, that curry verse is now part of you. You are curry verse. We are all curry versed in a way because in a sense, everything that we do, our nation, our notion of what ourself is changes.

And let's get outta the physical space for a minute because you might be thinking like, well, that's all interesting, but what about sort of the mental self, the spiritual self, the moral self? What does that actually mean? Because isn't that what we care about when we talk about digital systems? Now I can say all sorts of attributes that I think apply to me. You might think of yourself as scholarly or as health conscious, or you might even try to describe yourself as a rockstar. These are all things that we say, like this is the person that is looking at me when I look into the mirror.

This is our set of descriptors for ourself, our mental self. So the thing is though, just like a mirror, I don't exist in a computer, I don't exist in the mirror. Myself does not exist there. It's some reflection of that, but myself is not there. So it's really strange to me that a lot of these systems are saying, you know what? We're just gonna hand the self a wallet and then the wallet is gonna go to a computer and that's going to solve our identity problems.

Myself, I do not exist in a wallet anymore than I exist in a computer or in a mirror. So self sovereign identity doesn't really do that great a job of dealing with self in a fundamental level if we're talking about self as a portion of identity. So let's talk about sovereignty. Sovereignty is a really interesting topic because ultimately it boils down to authority. Who's allowed to make the rules, who's allowed to enforce and say the rules? And it's all about where all of this stuff comes from. And I think Barbie said it best in toy story.

Three, that authority should be derived from the consent of the governed. But authority honestly in the real world gets derived from all sorts of different places. It could be threat of violence, a threat of incarceration. It could just be convenience. Authority comes from the context, right? Ultimately authority, when we're talking about information boils down to trust. Do I trust the information and the source that it's coming from? Is that useful to me right now? So why on earth would my system trust an app that's running on your phone as a source of information, right?

If you are truly self-sovereign, something that you are telling me is I'm gonna take that as truth. Now, my partner was lying down on the couch the other day and and showed me this bit on her phone that she has decided to says, I've decided to stop being short. I'm tall now. Now I could take that at its word aura, but the objective measurement of her height might disagree with that claim that's coming from her cell phone. Which of these am I to believe? Which of these ultimately matters? It depends on our context.

Now, I'd like to talk a little bit about Norton, the first emperor of the United States. I am from the United States. Did you know that we had an emperor?

Yeah, we did. Back in the 18 hundreds, this guy out that was living out in San Francisco declared himself emperor on his own authority. And by his logic, because he was emperor, he was allowed to declare himself emperor, right? And so it's this notion of he created his own authority. He was very self-sovereign. Did he have any actual civil authority in the world?

No, not really. But he had some really interesting and powerful social deference. So much so that his obituary in the San Francisco newspapers declared that the king is dead. The emperor lies in tomb. So depending on the context, he was emperor. But if he was trying to arrest somebody, he wasn't emperor.

You know, he could make proclamations, but who is actually going to listen to them? The whole notion of sovereignty depends on who you ask and when you ask. And I was actually corrected on this slide earlier today that that that should actually be East Sweden up there. And but so anyway, history lessons aside, this is something that is happening currently in the United States. You can go out and buy a license plate that says, ironically, you don't need a license plate. This is a real thing.

This is a photo that a colleague of mine took in Washington state of all places where this license plate says, I don't need to have a license plate because this person has declared themselves their own self sovereign authority for the license plate for their car, which is really strange. And guess what? The cops don't agree with this because the, like, they are not, they are not paid. They are not brought in to enforce this sovereignty. They're brought in to enforce the sovereignty of the state in which this person lives.

So this is a great way to declare yourself sovereignty and that you are willing to get tickets. We also saw at the, especially at the height of the pandemic, people coming in with cards like this saying like, hi, I am my, my own medical authority and I, I don't have to follow your mask mandate. And the interesting thing, one of the most interesting things about both of these is these are supposed to be bastions of like self-declared sovereignty and expertise. Both this and the license plate have references to US laws and code in order to back them up.

If the whole point is that they're self-sovereign, why would you even need to mention any of that? Why would you need that in order for somebody to listen to? Now this is a gross misapplication of the ADA and H and all sorts of stuff and a and and a complete misunderstanding of what those laws actually mean. But why would you need them in the first place if this is truly self-sovereign? So back into our computer systems, I can put something on my wallet that says I am certain thing and send that to the computer. But why would the computer trust the thing that's in my wallet and what it says?

Well, the self-sovereign community will tell you easy. There's an external authority. There is a sovereign that is not you that says that this is the thing that you're allowed to trust. So ultimately, self-sovereign identity doesn't really change the sovereignty conversation at all. You still need that in order to trust. And we saw a lot of that in the last talk as well. You need to have some authority that says yes, this is something that you can trust in order for these things to be processed. So let's do the easy part. Let's talk about identity. It's an identity conference.

We all know how this works, right? Identity is a, is a very simple thing. Obviously there's all sorts of attributes that I can say about myself, all sorts of things that I can declare as much as I want. This is what I call myself back to that first topic. This is what I call the intrinsic identity. This is the identity that I feel belongs to me, right? And so we have all sorts of really good ways to do that and so that the systems that we build can reflect back who we are. But the reality is the systems that we're building reflect back who we want to see in the mirror.

Not necessarily what's there, but what we would like to see, the things that we would like to project down into the world and have looking back at us. So now the question is how do we project those onto a computer screen? Like into a computer system? We need to have an outward expression of that intrinsic identity for any of these attributes to fly. I can think and feel about things all day long, but if I can't communicate that to a computer, it doesn't matter. We're pretty decent at building systems that allow us to do this.

In fact, we've built so many persona-based systems that allow us to pick a different identity and express it in different contexts that you know there. The history of computing is littered with these right now in our self-sovereign systems. I absolutely have to give the entire movement. Credit is very, very good at allowing me to load off an identity into my wallet that I can look at and say that's what I put in there, right? It allows me that reflection of what I think I should look like into this system. It's very, very good at that. But is that how identity actually works?

You go off, you talk to somebody, you meet somebody and you are projecting an identity out to them. You're projecting a set of attributes. And you might think that, well, they now have a copy of my identity in their mental model of me. But the truth is that identity is not under your control. So right here, I'm up at the front of the stage. You guys are all looking at me right now. You have all formed an identity of me.

You have, apart from the things that I have self asserted about my name and any affiliations, you have figured out that I talk quickly and I'm pretty loud. And also that I wear glasses though a bunch of you just looked up to make sure that I was actually wearing glasses. Good on you for verifying that assertion.

Now, you may know me from some of the work that I do in the standards environment. You may know me from some of the board games that I've published, but if you saw me in a different context, you would probably make a different set of assumptions about me and who I am and what I do. You would form a different identity and you would assign that identity to me. And this is something that we do just absolutely like smoothly inside of our brains that that we don't even have to think about. This is just part of how society works.

So when you go off and you talk to somebody else, you're projecting a certain set of identity about them, but they are going to form an identity about you in their minds. That identity is something you do not have control over. You have influence over the input, but you do not have control over the identity that somebody else forms about you. They can have all sorts of opinions about you, whether you like it or not. And this is what I call the extrinsic identity. Now this might be seem like a really strange phrase. Identity is all about self. And extrinsic is all about by definition not self.

But I would argue that this is exactly the identity that matters in these systems. So I can go and take a set of attributes that I'm expressing to the system and I can tell you, this is who I am and this is who I want you to see me as. But you're gonna make your own decisions. You're gonna make that own image regardless of what I say. And this is exactly the model that our digital systems have. And in fact, we've gotten to a space right now where these digital systems are so good at drawing conclusions about us. They know things about us that we don't know about ourselves, right?

And some of times we get to learn these things and it's, it's a surprise. And other times it's just, it affects us as we go through the world. Ultimately though, this extrinsic identity, this is the identity that matters. The identity that I carry in myself can maybe project out a bit, but ultimately this is the identity that we need to care about. This is the identity that matters.

And so it's worrying to me that all of the focus in the SSI and wallet and everything like that is down here, is down at the outward expression bit where the true identity, regardless of what I'm sending over in my wallet, happens over here. All right? This is the only real identity and that is the identity that is accepted by the recipient. That is the only true identity that can happen in a system. Incidentally, this whole thing is exactly why anonymity matters and that is a whole other talk.

But we do a lot of work to put anonymity, build it over here on this side around the user, try to protect the user. But ultimately the true anonymity happens over here. It happens in this extrinsic identity. And if you dig into the gdpr, this is what the GDPR is all about. It's all about storing data. It's all about protecting data, not about hiding the user on the way in. It's about what you remember and the decisions that you make about the user. That's a really, really important thing that a lot of our industry kind of misses.

So self-sovereign identity does deal with identity, but I don't think it really does a good job of dealing with the identity that matters. And this disconnect can can really be clear when you look at some of the official diagrams of the three party model of the self-sovereign identity system because the self lives over here, the sovereign lives over there and the identity is over here. And now all the blockchain in the world can't help you stitch these back together into a cohesive system, right? So is there a better way to look at it?

I believe there is communication theory is a fascinating science because communication fundamentally is all about one self projecting information out into the world so that another self can actually understand it. This is an amazing and just it mind-blowing thing that two self can actually make pictures of each other by using communication. Communication has long been studied and I would say this is, this is my central thesis here, that funda fundamentally my identity is a message. It is a message that I send and it is a message that you receive.

My identity fundamentally is a message that exists in the system in multiple places and multiple times in multiple forms. It is a message. And so if we look at some communication theory, like Shannon's groundbreaking work in 1948, this is pretty simple. This is the message sender receiver model with some noise for to talk about information loss and stuff like that.

To be able to even talk about information transfer like this is, is really powerful because we can start to say like, oh, maybe you know, maybe there was some noise and my identity didn't get across, but Shannon later published the what's called the interactive model because communication is an ongoing thing. The first thing that I tell to you, I'm gonna get some reaction, I'm gonna get some response and that's going to affect what I say next. I might decide to disclose more. I might decide to obscure more depending on what it is that I want to get out of this interaction.

Unless you think that this is all pretty straightforward. This is a more modern model from folder at all where we have messages, languages, media, imagination, and all sorts of amazing crazy things. I contend that identity lives in this space much more than it lives in any of the protocols that we're building.

Now, where do computers actually come into any of this? One of the most important things to realize is that our transmission through any part of this system is imperfect. It is imperfect and the resolution is not super great. So take for example, what seems to be a very simple thing and that is a gender flag. A lot of people building a system, you think, oh, is male female? That's it. That's all you have to do. This actually hits very personally to me because my middle child is non-binary and therefore there is no expression of them in most computer systems.

They can have all the intrinsic identity in the world that they want, but if they cannot express that in a way that is heard by these systems, the identity that they are assigned in the world does not match them. We need to do better. For another example, my youngest kid, as far as I'm concerned, this is his middle name, Renee, as far as the state of Massachusetts is concerned, this is his middle name Reen, and I think there's a Rene in the audience, but this is his middle name according to official state records.

Now, as a Frenchman, I find this offensive, right? This is dropping an important part of the language, but as somebody who has deployed multinational character set databases, I get it, haskey's a lot easier to deal with. But we need to get better at that. We need to be able to allow expression of these systems. And I want to close with one final question. I've got four examples up here on the screen. Which of these is a sheep?

Yes, a I heard yes as an answer. So none of these are sheep. These are pictures of sheep. This is the identity of a sheep that was conveyed to you in the message format of a picture that allowed you to create the image of the identity of a sheep in different contexts. Each of these is appropriate in different places, and that is the key to expressing identity in all of our systems because our identity is a message fundamentally, our identity is a message. I can send it out into the world using these outward expressions.

And yes, we do need to continue working on that, but we mostly need to work on the message as received because ideally that message as received at least reflects as much of what I'm sending as I can. Thank you guys very much. Thank you Justin. Thank you for presentation. We have just over one minute left questions.

Ah, microphone. Yes. Just for your reaction. So Shannon was a mathematician and in communications theories, which is tightly ma bound and mathematically defined. Absolutely. I raise you a Goffman, a sociologist who talks about our, our, our outward presence being a performance.

And in, if I sort of extend the metaphor, the identity that we, that we use on the other end is the review of that performance. So the, what you call the extrinsic identity is actually the review of your performance however imperfectly done. So it depends on both Possibly. I say that there is one major thing missing from that and that's that I don't have to be at the play to make an, to make a review, right? I don't have to pay too attention to a single thing that you send, especially in today's systems to make a review of your performance.

So I think that calling it a performance puts again, too much weight on the what you send out and not enough weight on what is received. If you take one thing away from this talk, it is the message that is received. It is the identity that is received. That is the only thing that ultimately matters. Everything else is a step to getting us there. But thank you. Do we have any more questions?

Yeah, I think we've got another minute. Okay. We'll do this one more question and then we will End the session.

Yeah, it was a short talk, only 92 slides, so we've got time. Yeah, Don't challenge me hutch. I will. Anyway. I often hear people speaking about multiple identities, but finally, when you do something illegal, whether it is in the physical world or the online world, when they want to find you, you only have one identity. There's only one person they can arrest.

So for me, a PE a person only has one identity. You can have different representations of identities and people can have a certain picture of your identity. You can have different roles, you can have different attributes and stuff like that. But finally, there's only one identity. You are only one person. And unless your case of maybe, but that's maybe the only exception for me. So you can, you have, you could say that you have only one intrinsic identity from which everything grows.

But like we were just saying, that doesn't necessarily have to have any bearing on the identities that exist in the SI systems that we're building. And I would raise you that this goes into ness mo Moad theory about, you know, identity and existence and things like that, that is absolutely core to self and you know, and the intrinsic identity. But ultimately I can have all of the intrinsic identity that I want and, and I can obscure that as much as I want if the extrinsic identity is somehow mapable back to me as a person.

In your, in your legal example, like what matters there is not that I was only one person in a legal sense, it's that they were able to find me that they had a good enough extrinsic identity that tied to the system that allowed them to disambiguate me from hopefully everybody else that that might be in the systems.