Digital Identity

I just had two different but related things happen with my 18-year-old daughter regarding her identity…

This week, I took her to the DriveTest Centre to get her G1 (driving license). Since she’s 18, I left it up to her to ensure she had all the necessary documentation. She brought her Ontario Health Card and Canadian Passport. When it was her turn, she went to the counter and presented her documents. The representative looked over the papers and let us know the passport was expired, and thus she could not accept it. She asked if she had another piece of identification, like a birth certificate. Of course, she did not have this with her. As we left the DriveTest Centre, I mentioned that we wouldn’t have had this problem if she had a digital wallet that could store her identity documents. She would have had all her credentials on her phone to prove who she was. She told me, in short, that it wasn’t a better alternative because she just watched a movie on digital identity, and we are all going to turn into tracked and controlled robots of Big Brother if we let that happen.  

My daughter opened a new bank account online, but she still has to present herself in person to finalize things. With a digital wallet holding credentials and verification via biometrics, she could have completed that step online and had access to the new account immediately. Why does the bank offer the option to open an account online?

You’re already at risk.

Maybe it’s because of the nature of my job in decentralized identity consulting, but lately, I’ve been seeing a lot of conspiracy theories on social media about Self-Sovereign Identity (SSI). People criticize the way it’s being implemented and warn about the negative consequences it will have. It’s almost as if people don’t realize that organizations are already monitoring and influencing us and that Google and social media algorithms have been instrumental in this.

Right now, Facebook owns your identity and essentially decides what you see in your feed; and Google tracks your every move. These companies claim our data as their asset and make money off it.

“Many acts of ‘digital misdirection’ are happening before our very eyes every day, and we are starting to become more aware of them. Every action we perform online has become a piece of data which is used to coerce and constrain our digital experiences. We see it in the ads that show up across all our devices following an Internet search, in the ever-narrower set of content we’re shown on our social media sites, and in the increasingly compelling, and sometimes spooky, product recommendations we receive. This digital misdirection goes on to the point that we begin to wonder whether we can still exercise any free will online at all.” – The Rise of Surveillance Capitalism

What if you could monetize your identity? What if you could share extra preference data with Facebook and allow them to share that data with a third party for a fee? You could charge $0.50 for every additional set of preference data you share. Self-Sovereign identity can give you control over your data and generate passive income. Why wouldn’t you pick this option?

How can we trust them to be honest stewards of our data?

A lawsuit has been filed against Google that stems from investigations dating back to 2018 by Princeton University and the Associated Press. The lawsuit alleges that “Google falsely led consumers to believe that changing their account and device settings would allow customers to protect their privacy and control what personal data the company could access. The truth is that contrary to Google’s representations it continues to systematically surveil customers and profit from customer data.”

What else are these media giants doing that we haven’t figured out yet? How Bad is the Global Data Privacy Crisis? And you want them holding your information? I’m confused.

Platforms like Facebook and Google aren’t fond of losing access to people’s data; having less control over the user data makes it far less valuable for monetization. I’m not sure why people aren’t more concerned with this aspect.  I can’t help but come up with my own conspiracy theory: the Facebook algorithm suppresses positive news and advancement in SSI while pushing misinformation.  With digital identity, you (the holder) will be able to control your identity and decide which credentials to share with whom.  That’s a significant loss for big tech.

SSI Architects care about privacy and security

I saw a Facebook post shared with a photo of a copy of The World Economic Forum – Advancing Digital Agency report with the quote, “Digital ID, it isn’t just a rumour, people. WEF wants to control everyone’s life. SHARE“. The WEF report is more about protecting users, the challenges of broken trust, and data intermediaries instead of controlling everyone’s life.  There are many benefits to Digital Identity, particularly with vulnerable and marginalized groups (refugees). 

We care about privacy and security; we have the same concerns. Organizations like Evernym/Avast want to embed eIDAS in their products, but only if it addresses these four problems and maximizes opportunities. 

Something crucial for laymen to remember is that governments cannot build and implement these frameworks without help from the private sector. That includes SSI consultants like us here at Continuum Loop. We’re regular members of society; we have friends, family and children that we care about and want to protect: now and in the future. We are involved because we care and are aware of the negative implications and aspects; we can help mitigate these factors, build these frameworks, and make them beneficial for all.

Hold, own, and control your credentials/identity.

Digital ID is nothing new; it’s been around for a while in one form or another. However, the COVID pandemic has caused a “digital acceleration” event where our reliance on technology has catapulted forward. The pandemic has accelerated the adoption in many ways, like the increased use of QR codes and contactless payment to mitigate the risk of exposure to the virus. In particular, it has helped to raise awareness of the need for such a system and its benefits.

You will take back control of your identity and hold it. Not Facebook, not Google, and you will decide what credentials to share on a need-to-know basis. We don’t have to be scared of the shift; we have to ensure the architecture is built ethically for all.

The Privilege of Hesitation.

We are privileged to be able to be so critical of these emerging technologies. We take for granted that the college or university we graduated from will always be there or that our government institutions will always be in place and functioning to provide us with the services we need. I can’t help but wonder how a current refugee, who had no time to take paper documents, would feel to have the ability to easily prove their identity while starting over in a new county. All we have to do is look to Ukraine and see why centralized Identity systems can cause a problem.

Many Ukrainians have been displaced and need to apply for new documents to be able to travel and access services in other countries. The centralized identity system can make it difficult for people to get their records. As different groups seek refuge, they face unique challenges. Many Ukrainians of Roma origin, for example, suffer discrimination in Ukraine and may not have any documentation indicating their identity or citizenship. Being undocumented as you flee conflict and navigate foreign countries can lead to many dangers like human trafficking. Desperation can lead to refugees bribing government officials to get their documents. 

In contrast, Estonia has a practical but highly-centralized digital identity system that makes it easier for people to access the various services they need. While it is centralized and questionable from a privacy and surveillance perspective, this system allows for secure and transparent transactions that make citizens’ and e-residents’ lives more convenient and secure. The Estonian government has been using this technology since 2001, and it has helped them become one of the most digitally advanced countries in the world. 

While this implementation of digital identity is not ideal for many reasons, it’s a step in the right direction, and we can build from it. The flaws within the system (e.g. privacy, centralization) can be handled.

Rebuilding Trust

These technologies cannot move forward without the general public’s adoption. Organizations must rebuild trust for this to happen. Those building the framework architecture are fully aware of this challenge; the general public has lost confidence in the way organizations hold and use their online information.

There are many possible ways to rebuild trust. One way is to give people more control over their information. With Self-Sovereign Identity, they can choose what information they share and with whom, and they can also see how their data is being used and change their settings accordingly. 

Another way to rebuild trust is to ensure that the technology is secure. People need to know that their information is safe when shared online. Organizations need to ensure that they use the latest security technologies, Blockchain Technology, to protect people’s information.

Finally, people need to know that the organizations they trust with their information are reputable and honest. Organizations need to be transparent about using people’s information and their steps to protect it, and Verifiable Credentials will facilitate this.

In a world where corporations and governments are constantly harvesting our data, it is more important than ever to take back control of our identities. Self-sovereign identity is a new way of thinking about identity that puts the individual in charge of their information. We should embrace it and use it to create a more just and equitable society.

Tell us how you got involved in the world of identity technology?

I started out working for PwC, so I’m an accountant by trade. As part of my journey through public accounting, I was sent out to California where I got involved in the tech industry, auditing IPOs during the dot.com boom years. I had actually started out working in the manufacturing sector in Cleveland, Ohio, but when the firm asked for people to go out west to help with the technology sector, I put my hand up! Why not? It’s a good mantra, I believe, especially for women: “Raise your hand and have a go! The more opportunities you can have to put yourself out there and learn new things, the more it helps to advance your own career.”

So, I headed for California and found I loved the world of tech – it was super cool, fast-paced, and a lot of fun. After a short stint back in Cleveland, I eventually transferred over to Atlanta, Georgia so I could stay within the tech sector. From there, I moved to work for a publicly listed company as their Corporate Controller. As I progressed in my career with them, I was offered the opportunity to move out to Australia. I had a really good mentor in my boss, who encouraged me to go for the role of Regional CFO in APAC. My husband and I decided to pack everything up, take our dogs, and move half-way across the world, where we stayed for 3.5 years!

On our return to the US, I went to work for another publicly traded software company as their Controller – and with the support of another great boss, I moved up to be CFO after a couple of years.

What has been most helpful to you in your career development?

The role of a supportive boss and mentor has always been critical for me. In my experience, the best ones are super-smart and are genuinely committed to seeing their people succeed. Interestingly, at this company, the CEO offered me the role of CFO just months after I had had my second child. What was huge about this is that he told me they wanted me to do the job even though they recognized that my family circumstances meant I really couldn’t travel much and would have other calls on my time. I think, as females, we often feel guilty that we have to divide our time between family and work commitments, so having someone recognize me as a “person” and not just an employee was really great.

My advice to others would be to look for the people in your business who act as advocates, who try to lift you up all the time, and who see you in the round. 

And to CEOs and business leaders, my advice would be: “Look for the people with fire in their bellies! The people who want to grow regardless of their personal circumstances. And then… trust your team. You know they have the skills, so you just need to trust that they will find ways to manage their personal and professional lives.”

For me, that is really what leads to true inclusion.

Was the younger Janine an ambitious go-getter? Or did something happen along the way to spark your drive?

I have never been very good at just sitting still! I’ve always had a vision of doing great things. Now that I have a family, I am so appreciative of my husband – we really do share all the responsibility, and I couldn’t do it without him. When I had my first child, I did consider taking a back seat, but it was my Dad who said, “Are you kidding???” And, after a few months’ maternity leave, even my husband was saying, “You need to go back to work!!” For good or bad, I think my background and family instilled in me a need to be working – taking ownership and accountability, and pride, in what I do. And that’s a reason why I really enjoy working at BeyondTrust. I genuinely do believe they try to embody those same cultural values. 

Do you think your working class background has helped you in some way to identify more with customers or users – and with other colleagues?

For sure. I think if I had not come from a more middle-class background, I might not have recognized the full diversity that exists in our society. And that is so important for anyone working in the identity sector. We have to stay really focused on the customer. Differentiation comes from thinking about the different ways a customer may want to buy or use your products. There is so much complexity in what we are trying to do in this sector that we really need to remind ourselves what it feels like to be the person at the end of the chain – the person trying to actually complete a service or a transaction.

How have you taken all these learnings into your role as COO at BeyondTrust?

What drives me today is that I know I can help people drive change. Whether that is seeing someone on my team move on to the next stage in their career or helping to transform something within the business. I am a big fan of change – it has been a huge part of my life, and I am not afraid of having to adapt. What I love is the fast pace of the world of identity, and I honestly believe that what I do can help our customers make changes that benefit everyone.

Everything that my teams do really is about stopping and asking, “How do I make this better for our customers?” Our company lives by a “customer-first” pledge, but on a day-to-day basis, we strive to answer the question, “How do I make this work?” rather than “Why can’t this work?” It keeps us all really motivated. In my career as an accountant, the focus was very much on moving in a very structured way through a process, ticking boxes as we went. Now, I’m much more likely to ask “is this box necessary? What would happen if it wasn’t included?”

What is the most important lesson you have you learned along the way?

I had a humbling experience earlier in my career that really helped change my trajectory. I was a Financial Controller, and I was given the opportunity to stay with that company and move into a new role in a new location. I really thought I was the best leader my team had had and was leaving them in a great place to grow from. But, in fact, my successor fed back to me that the team wasn’t great at all. They couldn’t take responsibility and were always looking to be “managed”. What that really taught me is that I had tried to mange them by always being there – always being helpful and picking up the pieces for them. I didn’t allow them to fail. It was one the hardest lessons I have ever had – basically, my leadership skills were not good enough, and I really felt I had let my team down. But from a personal growth perspective, it was definitely one of my greatest lessons. I now seek to “trust but verify” – I will always care deeply about my colleagues and want to support them, but that doesn’t mean stepping in to do the job for them when things get tough.

In short: when you leave a role, you need to be sure that each individual feels good about needing to step up and do the right thing.

In your opinion, what should we be looking to change in the identity sector?

There is a lot we should challenge. If I had a crystal ball, it would be a lot easier, but there are so many different components, so many vendors that it can be really confusing. What we hear from customers is that there are a lot of players in our space, and unified platforms or the better integration of products from different vendors is essential to success. This sector is so focused on giving people access to fundamental, sometimes life-changing services that we need to be thinking much more about collaboration rather than worrying about how we compete with other vendors.

At BeyondTrust, we do think a lot about how we stay one step ahead of the fraudsters and criminals who reduce trust in our sector. We need to focus on predictive technologies so that we can stay ahead of the game and make each end user’s experience much more relevant. The technologists are already saying there is so much more that we can do.

As a senior woman who has progressed through the technology sector, what are we doing well and what do we need to do better?

There are definitely fewer women, but there are more and more coming through. I don’t want to hire people who look like me - different backgrounds and opinions give me so much more. But you have to want it. We need to offer an inclusive environment that covers so many different backgrounds to ensure we get that diversity of voice.

It’s why I love Women in Identity – you are putting a spotlight on the women in our sector, highlighting that there are lots of opportunities in identity, and that you don’t just have to be a technology geek. There are women, yes, in Marketing and HR, but also in Product, Finance, and Operations!

You’re a sponsor of Women in Identity; how do you encourage your own teams to embrace diversity?

• Recruitment – we focus on bringing in a broad range of candidates in the early stages and will continue to develop this.

• Look for diversity of thought – encourage everyone to speak and listen to those voices that are often quiet.

• My teams are already quite diverse in terms of gender and ethnicity. My own direct reports are 50:50 male and female. I hope that other females are encouraged by seeing me in a leadership role.

• Often, it is the educational background that can stifle diversity. I went to a smaller private university versus a larger, more recognized, tier-one educational institution in the United States. I believe your college experience and degree are a part of the equation for success, but it’s what you do later on and how you handle life’s experiences that really counts. We try to look for drive, hunger, passion, and a match to our corporate culture—not just college grades.

What advice would you give the younger you – and others who feel under-represented in our sector?

• Find a mentor. And, if you feel you can, offer yourself to others as a mentor

• Put yourself out there. Spend time building relationships – see networking and those “water cooler” moments as part of developing you. Don’t just focus on doing the tasks you get paid for.

• Know your boundaries. Be open and accepting if you have other responsibilities outside of work. Don’t try to hide them.

What are you reading?

With work and family commitments, I only have time for audio books when I’m at the gym, but I’m currently reading Impact Players by Liz Wiseman - which focuses on the themes of adaptability and how to be impactful in a changing world.

Follow Janine on LinkedIn and @BeyondTrust on Twitter

Read more about BeyondTrust’s sponsorship of Women in Identity at https://www.womeninidentity.org/sponsors

At the recent Singapore Fintech Festival (8-12 November), our own Tamara Al-Salim hosted and moderated a roundtable panel session on Enabling Borderless Digital Identity. The session explored the role of public/private partnerships in enabling an interoperable identity network. The session had great attendance and lively debates, the speakers were asked to share their views on Trust and how to innovate in a space of growing demand for interoperability and cross border recognition of people, credentials with self sovereignty when consenting for access to their information. 

Common threads and differences were highlighted in the approach to delivering government identity projects, the approach of government mandate delivery seemed to attract higher adoption due to the requirements placed on accessing services by users, the pandemic has also played a catalyst role in this where the government ID systems were used for contact tracing or as a tool for two factor authentication. Other governments chose to partner with private entities to run the program and its delivery for the country, this created a start in single sectors, in this case finance before shifting wider as the benefits are realised; it allows a clear segregation in the delivery from being government lead, but also allows the trust levels to be higher for the end users as the service is government endorsed. 

The speakers shared insights on the significant role Digital Identity plays in the growth of digital economy; it drives inclusion by supporting increased access to public and private services for people, businesses and public institutions;  it creates trust in a non-physical environment to enable everyone to interact and transact in a way that's authenticated and safe; it drives open markets and creates level playing fields for innovation in the interest of growth and choice for users; and finally, it lowers the cost by finding ways of delivering digital services at scale.

With the right foundational digital infrastructure, digital identity, authentication and consent, interoperable payments and data exchange, we're able to create digital ID systems that can work across countries with trust, and limit independent verifications in the process.

The Human Impact of Identity Exclusion in Financial Services

We commissioned Caribou Digital to conduct research into the Human Impact of Identity Exclusion. As part of that work, several people who have experienced  ID exclusion were interviewed in the UK and Ghana. Va-Bene is a transwoman—or as she calls herself, a transvatar—based in Kumasi, Ghana. She faces challenges every time she goes to a physical bank branch. Her IDs (and particularly the photos on them) don’t reflect who she is now. “If I have to withdraw money with my ATM card, that is fine. But any other thing I will do directly in the bank. Believe me, either we are going to fight in the bank or I’m just going to be delayed for several hours without any money.” Being denied access to her own money not only has a direct financial impact on Va-Bene. It also has an emotional impact: “it is very frustrating when I am excluded. Very, very frustrating. Very depressing.”

[See Va-Bene’s video here]

Va-Bene is the first of several participants we spoke to about the impact of being excluded from financial services due to poor or complex ID systems. We asked Caribou Digital to conduct research in the UK and Ghana to explore emerging themes from these two, very different, contexts. They spoke to a range of participants who are or who have felt excluded from financial systems for different reasons. These powerful stories will be shared with the teams responsible for designing financial services and products, who aim to learn how they can design more inclusive products. 

This research is the first step towards building a comprehensive set of guiding principles and framework for inclusive ID-product development. Using a human-centred design (HCD) approach, we intend to build a Code of Conduct to explore how users in the UK and Ghana (as representative of a developed and developing economy) deal with ID challenges, including identifying work-arounds users have developed, and recommendations for product designers and developers to build into ID systems to minimise disruption for users without compromising security and trustworthiness. 

Our Identity Code of Conduct will establish a set of guiding principles around inclusion, building on the broader Digital ID Principles. It will offer a practical set of tools to address inclusion at every stage of identification. 

Nowhere is this more necessary than in financial services, where ID is needed to protect users (e.g., from financial crime), as well as provide access to specific products. Service providers need to know who users are, but how does that process happen, why, and when does it become problematic?

“Know Your Customer” and existing challenges of exclusion

In her book In Pursuit of Proof, Tarangini Sriraraman documents how “identification” began as a need to recognise individuals for governance, but has become a process heavily shaped by social norms. Why is gender an important characteristic for identification? Who decides how that is categorised (male/female)? What happens when gender goes beyond binary, as in Va-Bene’s case?

“Know Your Customer” (KYC) is a legal requirement to comply with anti-money laundering regulations (AML) in most countries. Verification requirements to access financial services often include database checks, identity document verification, and, increasingly, biometric checks. For proof of address, utility bills or bank statements can often serve as acceptable documentation. By verifying a customer’s identity and intentions when they open an account, and then understanding transaction patterns, financial institutions can more accurately pinpoint potential account takeover or other suspicious activities.

However, many people get stuck when trying to prove who they are (like Va-Bene) or where they live. Obtaining an ID can be a time-consuming and expensive process, made more challenging for those who are female, from an ethnic or racial minority background, live in a rural area or with a disability, or are refugees or migrants. Youth, too, are emerging as a demographic facing barriers to ID. Often these issues include not having a proof of address (being without a fixed address, having recently arrived in the country, or for other reasons) or not being able to easily prove who one is (not having foundational ID documentation). These challenges can become even harder to address without knowledge of where to go or what to do next.

Interview with Payal, a recently arrived migrant in northwest London, UK, who faced challenges opening a bank account without proof of address.

Our Identity Code of Conduct: A guide for financial service providers

At Women in Identity we believe identity solutions should be inclusive, built for all, by all. But we also believe this does not happen by chance. 

The aim of our initial research and videos is to work towards this Code of Conduct: a practical guide for product designers to gain deeper empathy for the challenges experienced at the user end of the ID lifecycle and the knowledge to take these challenges into account when designing products. 

Other sectors already take this approach to product development. The pharmaceutical industry, for instance, has an ongoing Code of Practice based on principles of care, fairness, honesty, and respect that impact agreed standards of product development (e.g., clear and transparent information on packaging). 

We believe we can learn from other industries and create an Identity Code of Conduct which ensures inclusion is built into identity product design, thus making these products better for the organisations that rely on them and for the people that use them. 
 

We look forward to you joining us on this journey and welcome feedback and suggestions. Please reach out to us on @WomenInID on Twitter or @WomenInIdentity on LinkedIn!

Read more about this project at ID Code of Conduct and follow us at @womeninID @WomenInIdentity @CaribouDigital #DiversityByDesign #ForAllByAll #IDCodeofConduct #IdentityExclusion