Embedded Files
Consistent trust in growth
The UK government is expanding its digital identity program, with plans to digitise most government credentials by 2027. This includes allowing people to use their phones to verify their age for alcohol purchases and introducing a digital driving licence. These credentials will be stored in a new government app.
However, the government's approach has raised concerns among private companies in the digital identity sector. They worry about uncertainty regarding how the government will engage with the private sector and the potential impact on their own digital identity services.
And All These Little Things
2024 saw continued work on digital identity projects around the world. Here we highlight the importance of inclusive and accessible systems, emphasising the need to develop systems that fulfill diverse user needs. The UK's recent decision to allow digital identities for age verification presents an exciting opportunity, though prioritising user privacy and building a robust ecosystem will be crucial for widespread adoption.
https://www.linkedin.com/pulse/all-little-things-bryn-robinson-morgan-sqzme
All Things Being Equal
The digital identity landscape is evolving rapidly. The updated NIST guidance emphasises privacy and equity, while advancements like mobile driver's licenses and Google's digital passport are gaining traction. However, concerns remain regarding the security and oversight of Big Tech solutions. A strong regulatory framework and adherence to rigorous standards are crucial for a trustworthy and inclusive digital identity ecosystem. Big Tech companies like Google must adhere to the same standards and certifications as other identity providers to ensure fairness and security. Alignment between NIST, TSA, state DMVs, and tech companies (like Google and Apple) is crucial for successful and secure implementation of digital identities.
Inharmonious Compromise
The draft Implementing Acts for the EU Digital Identity Wallets present several concerns, particularly regarding the mandatory inclusion of birth names in Personal Identification Data (PID). This requirement can compromise privacy for individuals who have changed their names for personal or safety reasons, and it may create barriers for those who struggle to provide accurate or complete birth name information. Additionally, verifying name changes can be complex, especially for individuals with multiple name changes or who live in different countries. To encourage wider adoption, the enrolment process should be simplified, and the system should promote pluralism and competition among identity providers.
Erasing the problem
The European Commission's draft regulations for European Digital Identity Wallets propose a feature allowing users to request data erasure directly from their wallets. However, this approach presents several challenges:
Complexity of lawful basis: Different Relying Parties may have varying legal obligations for data retention, making it difficult to determine whether erasure is applicable.
Decentralized architecture challenges: Initiating erasure from the Wallet can lead to reliability issues, especially if Relying Party endpoints are down.
Privacy concerns: Recording Wallet identifiers and contact details for erasure requests can potentially compromise user privacy.
Overall, while the intent behind this feature is commendable, it's likely to create more problems than it solves.
One industry, separated by a common language
The article "One Industry, Separated by a Common Language" by Bryn Robinson-Morgan discusses the challenges faced in the digital identity sector due to the lack of standardized terminology. This inconsistency creates barriers to collaboration and understanding both within the industry and for those outside it. Robinson-Morgan emphasises the need for a common language to improve clarity, efficiency, and trust across different stakeholders, ultimately aiming to create a more inclusive and interoperable digital identity ecosystem.
All the right notes
Bryn Robinson-Morgan discusses the UK's progress in age verification solutions, highlighting the abundance of providers and the lack of implementation by websites. The UK government is considering changes to allow digital identities for alcohol purchases, which could boost the market. The main challenge is the interoperability and acceptance of different solutions. Without a unified scheme, users might revert to physical credentials due to inconsistent acceptance. The article emphasizes the need for a coordinated scheme to ensure seamless digital credential use and suggests age verification could drive broader digital identity adoption.
The serenity of acceptance
Bryn Robinson-Morgan discusses the impact of EU regulations on digital identity and privacy, using a 2018 tweet about cookie consent as an example of the complexities involved. Despite existing regulations, user privacy often remains compromised. The revised eIDAS regulation aims to provide every EU citizen with a digital identity wallet and mandate its acceptance by public bodies and essential private services. However, there are significant uncertainties about its implementation, scope, and the balance between security and convenience. Robinson-Morgan emphasizes the need for private sector engagement and innovation to realize the potential benefits of a unified digital identity infrastructure.
There’s a wallet service for that…
Bryn Robinson-Morgan discusses the trend of companies wanting to develop their own digital wallets, likening it to the earlier rush to create mobile apps. He predicts that only a few mainstream wallets, tightly integrated with device hardware and operating systems from major tech companies, will prevail. He argues that digital wallets should focus on storing and presenting information, leaving innovation to services that build on this functionality. Rather than numerous specialized wallets, Robinson-Morgan envisions a future where a unified wallet integrates various services, streamlining user experience and enhancing functionality.
Disruption of digital trust
Bryn Robinson-Morgan discusses how disruptive technology, like artificial intelligence (AI), impacts businesses, drawing parallels with historical examples like Blockbuster and Kodak. He highlights the challenges companies face in adapting to technological changes and the nuanced realities of such transitions. Robinson-Morgan emphasizes the accelerating pace of AI development in 2023, its regulatory challenges, and the need for cybersecurity measures to address AI misuse. He urges businesses providing digital trust services to evaluate their future relevance and innovate to stay competitive, predicting significant changes in the digital trust landscape over the next decade.
Regulating intelligence
Misinformation, a long-standing issue, thrives online. AI's rapid evolution prompts the need for solutions, like verifiable digital signatures and trust protocols, to authenticate data. Lack of a digital trust infrastructure poses risks, seen in cases like Italy banning AI due to insufficient regulation. Waiting for AI to realize human errors isn't prudent; controls are needed. Establishing a robust digital trust system is crucial, given the costly consequences of fraud and misinformation during events like the COVID-19 pandemic.
Everybody’s changing, and I don’t feel the same
Reflecting on the dynamic changes of 2022, the need for adaptation and learning is clear. Progress in digital identity is evident, but challenges remain. Collaboration between BigTech and governments is crucial for successful digital wallets. Governance is vital to prevent exclusion and mitigate fraud in the adoption of Mobile Driving Licences. Governments must balance sovereignty with innovation to foster digital identity adoption. Interoperability should prioritise operability and user needs. Embracing change, challenging norms, and leveraging collective support are keys to progress in 2023.
An easy act to follow
2021, a year marked by pandemic recovery and real-world interactions, highlighted the importance of digital identity supporting multiple channels, not just online. Volunteering in the vaccine rollout revealed design flaws and the necessity of inclusive digital services. Health Passes showcased digital identity's potential and limitations. The shift toward decentralized Web 3.0 raises questions about Self-Sovereign Identity (SSI) and governance. Effective digital identity requires regulation and governance at the core to balance innovation with support and protection, making future systems better than their predecessors.
A year like no other
2020, dominated by the pandemic, transformed how we live and work. Travel ceased, and digital services became essential for bridging physical and online worlds, from telemedicine to virtual exercise classes. Personal experiences, like staying connected with my mother during her illness and eventual passing, highlighted the importance of seamless digital interactions across all channels. The pandemic underscored that work is about activity, not location, and flexible working should continue post-pandemic. We must embrace change, be bold with technology, and create resilient, adaptable digital services to build a better, more robust future.
Being known to be kind
In the wake of TV presenter Caroline Flack's suicide, the hashtag #BeKind trended in the UK, spotlighting the impact of social media trolls on mental health. This led to calls for social media platforms to take responsibility for dealing with trolls, with suggestions like raising age thresholds and verifying accounts against real-world identities. While having a verified identity might not stop unkind behavior, it can make people more accountable and empower users to block or report offenders effectively.
However, implementing such measures raises important considerations. Requiring identity proof like passports or driving licenses could exclude many from social media, increasing financial, digital, and social exclusion. The economics of identity verification should not burden users financially, and privacy concerns are paramount, given that social media platforms already monetize personal data.
Displaying real names and photos for all to see could endanger individuals and restrict freedom of expression. It's crucial to address fake profiles and trolling without causing additional harm. An ideal solution would balance privacy, security, and pseudonymity, fostering a kinder online environment without compromising users' rights.
The inevitability of digital identity
As digital interactions increase, the way we identify ourselves is set to transform dramatically. Incidents like Facebook's privacy breaches highlight the need for better control over our data. Digital identity can offer transparency, consent, and efficiency, putting individuals in control of their information. With evolving technology, including AI, we must address biases to avoid discrimination. The future will see physical identity documents becoming obsolete, replaced by secure and convenient digital identities. Embracing this change is essential to avoid becoming outdated and ensure a better, more connected society.
Should banks be identity providers?
Digital identity is crucial for both public and private sectors. Banks are well-positioned to be identity providers due to their trusted systems and expertise in security and identity verification. While banks may not be universally liked, they are trusted and have robust measures against fraud. Their experience in remote identity verification and compliance with Know Your Customer (KYC) regulations makes them ideal candidates. However, the challenge lies in standardising identity verification across different banks and products. While banks could play a key role in identity provision, it will require balancing commercial interests with regulatory compliance.
My convenience, your security
I experienced credit card fraud recently, and while my card company blocked the transactions, the inconvenience of getting a new card overshadowed concerns about security. The process to resolve the fraud issue felt outdated and cumbersome, highlighting my preference for convenience over security. Despite my card company's attempts to secure my new card, the delivery process wasn't secure. Interestingly, adding my new card to Apple Pay was seamless and convenient, making me overlook potential data privacy issues. Generally, convenience remains my priority, and unless my card company emphasizes and educates me on security importance, their security issues will continue to be their problem, not mine.
Privacy is not dead
Despite the widespread availability and accessibility of personal data, privacy is not dead—it's just misunderstood. The implementation of the EU's GDPR has heightened awareness of data usage. Social media has changed the nature of privacy by making personal information more accessible, yet this doesn't eliminate the importance of privacy. Context matters: sharing information within specific circles doesn't negate one's right to privacy. Privacy remains crucial, and understanding this new paradigm allows for better authentication, verification, and user control over data. Privacy is still alive, just evolving.
My trip to Washington - a ripping yarn
At the International Monetary Fund and World Bank's Spring Meeting in Washington D.C. to present on Digital Identity at the FinTech Exchange iLab sessions. The focus was on the challenges financial firms face with Customer Due Diligence (CDD) and Know Your Customer (KYC) requirements and how national digital identity programs can help. We also examined how to combat social, digital, and financial exclusion and the implications for policymakers and regulators.
Key takeaways:
Immediate Benefits: Deliver tangible benefits of digital identity to users today.
Abandon Status Quo: Move away from inefficient and insecure practices.
Embrace Change: Adopt digital identity decisively for better compliance, security, and customer experience.
Let's get physical
2018 marks the emergence of adults born after the millennium, who have grown up with technology as a routine part of life. Despite the rise of online shopping, physical stores still account for 85% of sales, highlighting the enduring value of in-person shopping experiences. Successful retailers are integrating online and in-store experiences to create a seamless customer journey, thriving in a "bricks and clicks" environment.
In the financial sector, open banking will increase competition from tech-focused services, making it crucial for traditional banks to enhance both their online and physical offerings. The goal is to create a cohesive customer experience that leverages the strengths of both channels, ensuring a sustainable and relevant presence in the digital age.
Trust me, I know a short cut
One of the greatest digital innovations is the SatNav, which evolved from custom devices to smartphone apps using real-time data for navigation. Initially, it eliminated arguments over directions, but now, real-time updates make it far more efficient. However, trust erodes when unexpected issues occur or arrival times increase, making the SatNav's guidance more reliable than a passenger's input.
In digital identity, trust is crucial and hard to rebuild once lost. Estonia's swift response to a security flaw in their identity cards highlighted the importance of trust in digital systems. Unlike Estonia's mandatory system, other countries must incentivize citizens to adopt digital identity schemes. Both government and private sectors need to balance security, user experience, and cost.
Key takeaways:
Trust Erosion: Trust in digital identity is hard to regain once lost.
Security vs. Cost: Cutting corners on security to reduce costs can backfire.
User Experience: Customers expect security but dislike excessive hurdles.
Balance: Achieving a balance in security, cost, and user experience is essential for successful digital identity systems.
The rise of synthetic identity
In the digital age, outdated thinking compromises security. Freely shared personal data makes us vulnerable to synthetic identity fraud, which now accounts for 80% of credit card fraud. Fraudsters exploit publicly available information and data breaches to create fake identities. These identities can acquire prepaid mobile SIMs and establish a credit footprint, eventually committing fraud.
Organisations are developing ways to combat synthetic identities, but standardized and interoperable identity verification is crucial. Different assurance levels are needed for various contexts, from social media to high-security environments. Standards should ensure robust security while allowing innovation. A collective effort is necessary to enhance digital identity security and prevent fraud.
Just in case - From early adoption to maturity
About 15 years ago, I wanted a wallet with plenty of card slots due to numerous loyalty and credit cards. Now, I have more store cards but they’re digital, and my preferred payment method is my smartwatch. However, I still carry my wallet for those "just in case" moments when digital payments fail or aren’t accepted. I also keep my driving license for identification, despite new digital alternatives like smartphone licenses and smart-wallet passports emerging.
While technology progresses, adoption lags, necessitating backups. My hope is that in 15 years, digital identities will eliminate the need for physical IDs and wallets. But for now, I keep my old DVDs and wallet, just in case.
I have control
Digital identity, whether centralized, federated, or self-sovereign, remains a complex landscape with various models offering different advantages and challenges. Self-sovereign digital identity, seen as the ideal, promises individuals full control over their digital representation, based on their real-world identity, with transparency, data access, and portability. However, achieving true self-sovereignty is hindered by the inherent uncertainty in linking digital and real-world identities completely. Real-world identities are multifaceted, involving government and third-party guarantees, complicating the notion of pure self-sovereignty.
Practical challenges include balancing transparency with the need to protect sensitive data and accommodating both mandatory and optional government identity models. Achieving true interoperability and managing explicit user consent for data sharing are additional hurdles. Despite the utopian vision of self-sovereign identity, focusing on user-centric design and pragmatic solutions that meet user needs while ensuring security and reliability may offer a more feasible path forward in the evolving landscape of digital identity.
Tipping the balance
Balancing security and usability is crucial for product success. Authentication often suffers from clunky implementations like SMS codes or inconvenient tokens. Contextual awareness can revolutionize this. For instance, a smartphone in a car could use behavioral biometrics to adjust security dynamically. If it recognizes a familiar user context (like driving), it can grant more access without additional prompts, enhancing both security and user experience. This approach, integrating multi-factor authentication with behavioral insights, offers a smarter way to achieve a secure yet user-friendly authentication process.
You don't know what you're doing
Recent data breaches at Yahoo, KFC UK, and Domino’s Pizza highlight ongoing cybersecurity challenges. Despite claims of improved security measures, incidents persist due to both technical vulnerabilities and human error. Common security pitfalls like weak password policies and insecure communication methods persist across organizations of all sizes, undermining efforts to protect customer data. Effective standards and enforcement are crucial to ensure robust cybersecurity practices, especially as digital transactions and data sharing become more prevalent under regulations like GDPR and PSD2.
I didn't say you could touch me
Biometrics are becoming mainstream for user authentication, with fingerprint sensors widely adopted and facial and voice recognition gaining traction in apps. Future smartphones may include iris scanning technology. However, using biometrics for identity verification requires a clear link between the biometric data and the individual. Facial recognition can compare against official identity documents, but voice and fingerprint biometrics lack verified commercial sources and pose hardware challenges.
On-device biometrics like fingerprint scanning on iPhones allow multiple users to authenticate, but authorization remains specific to the features permitted. Clear consent is crucial; enabling biometric authentication should require explicit user approval, akin to sharing a PIN for bank cards. As smartphones transform digital interactions, careful design and understanding of implications are essential to prevent misuse and uphold user trust.
You don't need to tell me
The General Data Protection Regulation (GDPR), effective May 2018, replaces the existing Directive 95/46/EC to harmonize data protection laws across the EU. It extends protection to EU citizens’ personal data globally, requiring transparency in data processing, explicit consent, and minimal data collection. Non-compliance can lead to fines up to €20m or 4% of global turnover. Companies must adopt a data minimization approach, justify data collection, and respect new rights for data subjects. Privacy-focused models like Mydex and Digidentity give individuals control over their data, while GDPR mandates understanding and compliance for all organisations handling personal data.
Coming together on being alone
Post-Brexit, the UK aims to assert sovereign control but must navigate its role in the global digital sphere. Cybersecurity, digital identity, and online regulation transcend national borders, posing challenges. Despite leaving the EU, the UK's influence in cyber policy is pivotal globally, necessitating strong leadership to maintain its voice and international standing. The Digital Single Market's eIDAS regulations are crucial for cross-border digital transactions, highlighting the need for interoperable identity systems like GOV.UK Verify. UK's future in cyber industries post-Brexit hinges on a cohesive digital strategy that fosters innovation, security, and global leadership.
One small step – the practice of greatness
The NASA Juno mission successfully entered Jupiter's orbit after years of planning and dedication. The celebration and pride from the team reflect the importance of setting clear goals, achieving them together, and celebrating success. Whether your team's goals are big or small, every achievement should be celebrated. Effective leadership involves clarifying goals, supporting team happiness, rewarding hard work, nurturing talent, and regularly tracking progress toward success. Celebrate achievements together to foster a culture of greatness, even if your goals are not as grand as exploring the outer reaches of our solar system.
I'm not the person I used to be
Digital identities are poised to transform online transactions by securely linking real-world identities to digital tokens. Countries like India with Aadhaar, the UK with GOV.UK Verify, and Norway, Sweden, and Canada with bank-issued credentials each have unique models for registering identities. Authentication methods range from passwords to biometrics, and the challenge lies in maintaining the link between the real world and digital tokens amid changes or fraud. Strengthening this link over time through authentication offers opportunities, but requires robust measures to prevent fraud and maintain trust. Addressing privacy concerns now is crucial to ensure digital identities remain reliable in the future.
Rip it up and start again
Business transformation is about making significant, strategic changes to improve your organization. It's risky but can be highly rewarding if done right. Many transformations fail due to lack of clear strategy, vision, leadership, and support, among other reasons. Start with a clear strategy and vision—know where you're going and why. Ensure strong leadership from a champion with board-level support. Address the impacts on people upfront to gain their support. Align your customer strategy with your transformation goals and listen to customer feedback. Finally, see it through to the end with realistic expectations and contingency plans. Success isn't guaranteed, but thorough preparation increases your chances significantly.
Distributed Identity has no clothes
A report by the Government Chief Scientific Advisor, Sir Mark Walport, endorsed the potential of distributed ledger technology (DLT) like blockchain to revolutionize government services, sparking widespread enthusiasm. However, many proponents lack a deep understanding of blockchain, identity, or the problems they claim DLT will solve.
Key issues include:
Identity vs. Transaction: Identity isn't transactional; it's about attributes like age, not data to be transferred.
Identity vs. Entitlement: Entitlement (e.g., legal drinking age) often gets confused with identity itself.
Security Risks: Centralizing identity data on a blockchain increases its attractiveness to attackers and creates security challenges.
Dynamic Nature of Identity: Identity information changes over time (e.g., moving house, changing names), making immutable records quickly outdated.
While DLT may play a role in identity management, its current hype is overblown. The real application will likely be different from the current bandwagon's vision.
Bring your own downfall - why we should embrace federated identity
The trend of "Bring Your Own" has evolved from wine at parties to personal devices at work, yet many organizations still resist BYOD (Bring Your Own Device) due to security and other concerns. This resistance is now extending to customer interactions, where the next wave is "Bring Your Own Identity" (BYOID). Customers want to use their preferred authentication methods and verified credentials across different services.
Organizations must adapt to this shift by adopting federated identity, which supports secure, convenient, and user-controlled identity management. Companies that fail to embrace this change risk falling behind, offering outdated and inconvenient identity experiences to their customers. To stay relevant, businesses need to look outward, focusing on customer-centric and risk-appropriate frameworks that enhance the user experience.
The upstarts at the startups
Startups have been disrupting big businesses for decades, with Steve Jobs' unconventional methods now seen as normal. Today's entrepreneurs face fewer barriers to market, leveraging cloud tech and open APIs to disrupt the status quo more easily. Startups can operate without the burdens of established brands, making them more agile and capable of rapid innovation.
For corporates to stay relevant, they must adapt by fostering startup culture in meaningful ways. This might include funding startups, creating innovation hubs, reducing internal bureaucracy, or restructuring to support innovation. Those who embrace these changes will be more likely to succeed in the future, while those who resist may struggle to stay relevant. The startup disruptors of today could become the leaders of tomorrow.
Defining the Business Analyst
The Business Analyst (BA) role is highly variable, spanning tasks from strategic planning to documenting minor processes. The role's ambiguity often leads to misallocation of talent, with top BAs stuck on mundane tasks and less skilled BAs tackling strategic issues. Unlike clearly defined roles like Project Managers or Architects, BAs often only differ by prefixes like Principal, Lead, Senior, or Junior, which doesn’t reflect their true capabilities.
Organizations should better define BA roles, recognizing the distinction between strategic, enterprise-focused BAs and task-oriented BAs. Clear role definitions and appropriate rewards will attract and retain top talent, ensuring effective utilization of their skills and benefiting the organization at all levels.
Unblocking Digital Identity
Centralized citizen identity schemes are outdated. A decentralized or federated model enhances user control, security, and usability. Blockchain, known from Bitcoin, is emerging as a potential solution for digital identity due to its privacy, security, and user control features. However, Bitcoin's relative infancy, security issues, and unregulated nature pose challenges.
The General Register Office in the UK exemplifies a successful distributed identity model, registering births, deaths, and marriages locally and issuing user-controlled certificates. While Blockchain has niche financial uses and potential in identity management, the best approach might integrate the strengths of centralized, federated, and distributed models. The key is balancing easy identity claiming for real users with preventing identity fraud. The future of citizen eID may lie in a hybrid model combining the best elements of all three approaches.
Report abuse