Research

What do you do in the industry? What does caribou digital do? 

Savita: I’ve worked with Caribou Digital for 4 years now. As part of the research team, I lead research projects of experiences of digital life - we’ve worked on overall online use by lower income demographics in emerging economies (what we used to call “ICT4D”!), digital financial services but also increasingly “identification in a digital age” - this might be a good time to say we prefer to use the phrase “identification in a digital age” rather than “digital identity” - see our colleague Jonathan’s great piece on the terminology and why).

Hélène in Kakuma refugee camp in Kenya

 Just the other day, we realised we’ve now conducted fieldwork in over ten countries on “ID” (to use the shorthand): a few of those are Kenya, Uganda, Bangladesh, Côte d'Ivoire, India, Lebanon and Thailand, working with clients such as Omidyar, Aus Aid, World Bank, UNICEF and the Gates Foundation. In addition to conducting the research, we share our findings and advise on relevant strategy and policy both in the public and private sector. Caribou Digital has a much wider scope of work (all around supporting ethical digital economies in emerging markets), which you can see on cariboudigital.net but that’s just us on the research side!

Hélène: I’ve been working with Caribou Digital for 2 years, conducting research and leading ground work, mainly on identification questions in countries across Africa and Asia. I don't really have a typical week, but a cycle of work through projects. It starts with from pre-field research - working with Savita on the framing of the research and setting everything up for ground work including finding local partners to the fieldwork itself and then post-field wrap up. 

How do you determine where you run the research?

S: We start at a high level determining the intent and scope first for clients (what is it we are trying to find out?), and after we work on the details collaboratively. We think about the demographics to work with - we know qualitative research (which Helene and I largely do) is not meant to be representative, but we do need to think about who we talk to - a typical cross-section may be “expert” interviewees, middlemen/women who are intermediaries (e.g. mobile money agents) and the “end users” either in focus groups or more in-depth interviews. We don’t really like the term end users (we are just humans!) but I guess that’s the shorthand. Then Helen mobilises the teams. She’s fantastic at finding the people on the ground and building up trusting relationships with people. We always try to do a pilot study so we can test and refine questions and demographics. Ethics are paramount to us so we make sure we go through a code of conduct with partners, and consent with respondents.

H: Savita has such a wealth of experience in the topic. She knows what the important issues are which haven't been thoroughly researched yet and sees where processes are inefficient.

What do companies look for when they come to you?

H: They are not always companies - they can also be foundations, governments, NGOs etc. Often they come from a perspective of wanting to know more about end users’ experiences, as often they haven't been looking at the issues at stake at the same granular level that we get with our qualitative research. With Unicef it's been a unique piece of work looking at youth and adolescence and the overlap between identification and identity. I was interviewing a child who was 10 years old in a refugee camp in Lebanon, who was acutely aware of what ID is and the need for documents. I've found the more privileged the child the less aware they are of identification documents and their use. This child told me: 'it's the document that my dad takes to work with him every day', as this is a key enabler of their rights to move around in the country. That's generally not an issue for children in more privileged communities.

S: It's certainly a challenging and delicate subject to address when doing field research. To find out how access to identification affects people on the ground requires good rapport and a large dose of empathy, which Helene is brilliant at. They key is asking questions without being intrusive - imagine if some random person came and started asking you questions on your identification documents - how would you feel?

What areas are you working on next then?

S:  Well, we’re just wrapping up our in-depth ID research in Bangladesh and Sri Lanka on women, work and ID, funded by Aus Aid. It was part of the Commonwealth Identity Initiative with GSMA and the World Bank. Next we’re starting research with Gates on how digital financial service principles they established (Level One) may have a different impact on women, including interoperability in mobile money - I do think this will also bring up gender and ID issues, like around KYC (whose ID is used to register a SIM?). We’ll be working in Kenya and Cote d’Ivoire.

From your research you’ve identified 5 fundamental barriers of access for women. You must see great variation in use of identification between countries depending on the availability information, access, ownership, societal expectations and intersectionality?

Savita in Abengourou, rural Côte d'Ivoire

S: Yes, these barriers vary between countries, depending on everything from infrastructure to social norms.That’s why we keep saying you can’t just go in and dump a new “digital ID” system - you have to do some user research. For example, we have enough evidence now that people get nervous around biometrics, especially women in some cultures when they are touched - can we address that issue? Or that even if women have their own ID, it may be the men in their families who keep them - how do we address this

H: We saw in Bangladesh that often women didn't have the time to go and access services, as they were looking after their families, or they didn't have the means to travel. Depending on the type of work they’re doing, this may or not be an issue, but it does become a barrier at some points.

What will you be speaking about at ID2020? 

S:  ID2020 reached out to me to do a keynote, which was nice as they come from a more private sector angle (e.g. the alliance includes Accenture, Microsoft, Rockefeller and many others). So it’s a good audience to take our “end user” research to. Our work brings forward end user research and adds the perspective of the human voice. We’re telling the story of Humans of ID, layering it in with the context of increasingly digital societies in emerging markets. It’s a story that all of us can relate to, as identity and identification go back to the beginnings of humanity.

What brought you into this field?

H: I still find it fascinating that we all live and breathe identity all the time. I now notice it everywhere - whether it’s a clothing collection launch on Instagram called ‘ID’ or in films like Capernaum. We all have a unique identity story that defines us and you can see that in culture globally. 

S: All of us who have moved around the world can relate to the identification issue (I was born in India, moved to the UK, now in the USA, and at various points had all that change codified in documents and credentials). 

There are so many stories about identification in the bureaucratic sense and how it crosses over with identity - the film Lion for example, or the Tom Hanks The Terminal,  or the book Educated (Tara Westover) where she grows up in an American family without a birth certificate and is home schooled, so she has no ID at all but how she navigates that. Two powerful pieces of journalism struck me just this year. One was about an Iraqi boy who is reunited with mother after years, thanks to different types of identification. Another was Azeteng’s story of human trafficking through West Africa. When his Guinean friend Sekou is murdered by the human smugglers, Azeteng keeps his ID. The journalist asks him why he keeps Sekou’s ID. He says: “that is someone’s son, someone’s brother, who knows, maybe even someone’s father,” he said. “I asked myself, how will his family know that he is dead? So I am trying my best for the family to be aware.” 

We are becoming such a globalised society and many are stateless for one reason or another - if you're a migrant worker who’s newly arrived in a new city, but don’t have the right ID you can be completely isolated from applying to jobs (look at the IDNYC by the way  - really interesting case). We often take our access to services and help for granted, but the additional challenge is a lot of people don't have the time or ability to sort these issues out for themselves. 

It must be striking seeing how ID isn’t just a means to accessing essential rights, but also impacts on heritage?

S: Absolutely, on Sri Lankan tea estates workers used to be given numbers not names when they were born. Honestly, a lot of the identification issues are legacies of colonialism and the carving up of countries - the complex case of Cote d’Ivoire for example where the Burkinabe communities have settled in Cote d’Ivoire but are not considered Ivorian. Or what is happening in Assam. Or even the appalling Windrush case - we need to face up to the fact that identification is also a question of power with terrible consequences. And we cannot make the same mistakes again and again by classifying people in a particular way.

H: You start to see the impact of these problems through generations, for example where parents are displaced or lose their identification documents. The barriers faced from your own access to ID often then has an impact on your children’s experience. Consistently we see identification is an essential enabler for social and economic inclusion, though sometimes it isn’t thought about as such and taken for granted.

When you present to private sector organisations, what do you find surprises people the most?

A woman registering for a bank account in Assam, India for Caribou Digital’s Identities Research

S: Often the private sector have a totally different angle as their primary concern with identification for a single task or service. It’s a one time necessity and it’s not their job to think about the ethical issues that may arise from how people use it.

H: We question the role of the private sector in our research - are they responsible for people’s accessing and using ID? Take the case of Sri Lankan online companies we spoke to - they may facilitate online work, like people creating a webpage or managing social media for a client. We’ve seen that these companies may not check the ID of the individual that signs up to do the task, unless it requires dealing with sensitive information. Is it that company’s job to educate the people who work on the platform about the importance of ID? Similarly, is it the role of factories to make sure that their employees have ID or is it better that they employ them as the employees need the money? Some companies mentioned they would try to create more awareness around financial inclusion - encouraging them to get access to formal bank or mobile money accounts.

S: So we come back to the question, why do we need ID? There are a number of conversations going on about standards and interoperability, but someone pointed out to me the other day that passports are an universal system, but birth certificates are not. You can't check a birth certificate beyond making sure the hospital is real, as really you could create a fake one at home, and then a passport is often built off that. The other issue we saw is with voter ID, which is generally issued when parties are campaigning for an election - so in rural India, a political party may happily make you 18 so you vote for them. There's very little standardisation across the board, particularly concerning initial ID. 

H: We're very conscious in the recommendations that we make to organisations that we think identification enables inclusion and growth, however, once the need for ID becomes mandatory, you may end up excluding people. 

S: Yes, it raises the question, If you've got no ID then what happens? 

You covered that experience in a number of your articles, what did you find?

H: It really varies. In the research we just finished in Sri Lanka, there were a couple of people who didn't have ID. One used their sister’s ID until they could pay for the lawyer to get their ID sorted. The other person was a gentleman who was just getting by with cash and operating off the grid. In Bangladesh there were far more people “off the ID grid” and using other people's ID when they needed to access services.

In Sri Lanka, Gayani (left) holds the old laminated paper ID and Rangala holds a new smart ID

S: You see a number of systems and means of access are interdependent.  Cote d'Ivoire went through mandatory mobile SIM registration with a biometric ID (for national security) but it did impact on those who didn’t have a biometric ID. Most importantly, it meant they didn’t have access to mobile money. 

H: Really the government were trying to push people to get the new biometric ID, and using that specific threat of cutting your mobile line is very strong. In our research, we’ve often found that one of the main drivers to getting an ID in the first place was to be able to own a SIM, so you see how strong that threat is. In addition, mobile money is dependent on your SIM so if you don't have access to a phone line then you can't use mobile money services (e.g. you can’t receive or send money, you can’t take small loans or make savings, through the platform).

S: As a result, those who wouldn’t register for a biometric ID, would have to go through someone else to get their money, which becomes really risky. Researching these issues has made me realise that ID is the foundation for everything.

Yes, and you hear of women having problems travelling with children if they haven’t changed their name.

H: There’s a big - not explored enough -  issue with marriage, changing names, movement after marriage wherever you are in the world. In Kenya you choose whether you keep your father’s name or take your husbands, this decision can have significant impact later on. 

S: Coming full circle on the women and ID issue you’re talking to us about - I do wonder if women face ID issues more than men, which is worsened by the lack of clarity on who do you go to for help (what we talk about in our blog). Just my example again, when my husband and I were trying to get married in the UK, as he was not a British national we faced a lot of challenges - we ran around asking so many different organisations, lost time from work, spent money on travel, but we were just ultimately reliant on individuals helping (or not!). Those who do are the true heroes keeping it together. In contrast, women are not supported in other countries always, which is why I keep going on about intermediaries - and that’s where the role of NGOs and females in advisory committees is so essential. There’s still a lot of both research and policy work for us to do when we talk of women and identification in a digital age.

Find them at @SavitaBaliur and @HeleneSmertnik

Read more of their work at cariboudigital.net 

How did you end up in the world of identity?

I spent the last 7 years at IBM, working in a variety of roles all over the world. 4 years ago, whilst I was in Istanbul I found block chain, which is the space I’ve remained in since. Identity is essential to block chain, particularly when you think about permissions and the block chain network. Leaving IBM in June, I was really interested in understanding the provenance of digital content so I set up the Deep Trust Alliance. How do you know that images, videos or texts are what they say they are? Or what their provenance is? That drew me down a couple of different rabbit holes – one of those is identity, the other is around deepfakes and misinformation. Both strands are essential to understand what’s real on the internet. I’ve been so fortunate to have some incredible mentors and advisors from the identity space, specifically Don Thibeau from OIX and Timothy Ruff from Evernym.

Taking a step back, how do you define a deepfake?

It’s an image or video, generated by AI technology known as generative adversarial networks or GANs for short. The technology was pioneered by a researcher called Ian Goodfellow at the University of Montreal, who’s now at Apple. It’s a specific method of combing existing images with AI technology to create a wholly new image. Yet when people talk about deep fakes, especially in the US, they talk about the Nancy Pelosi video which came out this summer, but that video didn’t use AI. It used technology that’s been around by 20 years that basically anyone could use. Deep fakes have captured people’s imagination and that’s a important place to start, but you have to think about the broader ecosystem of digital forgeries.

The work you do at the Deep Trust Alliance reaches across all elements of society and industry – how did you start on that journey into this space?

At IBM I ran product management of the IBM Blockchain Platform, contributing to Hyperledger Fabric and building the managed service on top of it. I was supporting building networks in anything from digital tickets, food, trade, shipping containers, financial products. Looking at the ledger layer of blockchain, I wanted to move towards digital assets and digital content, so I started building a product roadmap for what it would take to do that. Through this I learned three things:

1. No single entity controls content. You take a picture with your iPhone and you edit it with Instagram, Adobe, or iMovie. Then you might post it to Facebook or Twitter. Then it’ll proceed to ricochet around the internet. To control that, you would need to pull together the hardware, software and the human.
2. To reach internet scale, you have to do it in an open way. Obviously the identity community know that, as open source and standards have been a foundational in enabling identity to work. Some companies are working on closed capture, proprietary solutions, but either it’ll take a long time or be difficult to reach internet scale
3. It’s ultimately an arms race. The incentives are more in the camp of nefarious actors.  Deepfakes are ultimately just a tool which can be used to defraud any company that transacts over the internet, so there are really important implications for financial services, insurance, telecom and even healthcare.  We’re already starting to see sophisticated attacks using fake audio, like a recent case in Germany, where a German CEO’s voice was faked and $243,000 was transferred.

Where do you think awareness of deepfakes is now?

A lot of people are worried about the problem of deepfakes, but they don’t have a lot of solutions as people see this totally new phenomenon. Although the technology is new, it sits in a long line of digital forgeries, from the days of the first cameras and motion pictures. My aim is to connect the dots between those companies trying to work on this problem for their own platforms and the academics who are researching it, to put the issue (and solutions) firmly on corporate agendas so they can deal with deepfakes. Robust standards for accelerating the use of ethical deepfakes is key because for scenarios where they make a lot of sense. For example; entertainment, fashion, or if people have lost the ability to speak and want to recreate their voice.

Are there particular industries that you’re speaking to first?

We’re spending a lot of time talking to social media platforms and news providers, because they’ve been directly impacted already. There’s a lot of political attention and regulatory pressure on them to make sure they’re sharing the right information, so they’re further ahead than most in how they understand the risk and innovate. For example, Facebook and Google have run a number of deep fake detection challenges. Importantly, as they develop technology they’re building best practise in technology and policy, which needs to be disseminated across the ecosystem. The Deep Trust Alliance can help bring these best practises and coordinate learnings across a number of stakeholders to drive standards forwards.

Do you find these it helps that stories about deepfakes are quite sensational?

With technology problems you need to capture people’s imagination and deep fakes have done that because it’s a sexy story, but you have to be careful about not making people too crazy. We’re going to live in a world connected by 5G networks, and we’ll all have devices that are sending tonnes of data to each other. The IOT and the security situation with those devices isn’t great. These are all questions that we as consumers, society and corporations need to think about. Part of the problem is there’s no single silver bullet.

How do you detect a deepfake?

Media literacy is a great place to start. Look at the website you’re on, look at the image itself. Often AI technology doesn’t recognise some of the semantic difference that a person would pick up immediately. For example I could wear 2 different earrings as a fashion statement, more likely it’s a symmetrical difference that it’s missed. There’s a website called Which Face is Real?, that shows 2 pictures side by side. People get about 60% of those images right, so it’s a little better than guessing. There are some technical tools like browser plug ins that use forensics, but the detection technology is still fairly nascent and you need to really understand how the image is made to accurately detect it.

Why do you think women in identity is important?

Where to begin! When you take a moral philosophy view, identity is all about how you recognise, define and share who you are. The IT space approaches it from such a dry and technical perspectives, but a diverse range of perspectives is essential because it goes back to the foundations of what it means to be a human. Annabel Backman, a senior engineer at Amazon Identity – made a really compelling point at Internet Identity World that identity means and drives very different things to different people.  Women’s perspectives and experience are required so you build secure, user friendly and fundamentally human solutions.

Do you see that deepfakes affect certain groups in society?

100%. Deeptrace mapped deepfakes over the past few months, where they found nearly 15,000 deepfakes open on the internet. Of those, 96% was deep fake porn. 100% of that was women. At a conference recently, Mary Anne Franks from the University of Miami made one of the most compelling points. If society cared about the damage that was done to women, they would have immediately identified the risk that comes from deepfake porn. As a society we’d be much better prepared to deal with these threats in the media or news, because we would have thought through the way in which people would use it. Instead, we’ve kind of ignored it, didn’t think it was a real problem for society and here we are years later playing catch up.

There’s a famous example of a journalist in India, Rana Ayyub, who’s been outspoken about the Modi administration and Hindu nationalist movement. Some of her adversaries created a fake porn of her and spread it all over the internet. In India this is problematic to a degree in the UK and US we don’t quite understand, as it resulted in numerous death threats. The police didn’t help. They watched it in front of her, made all sorts of jokes and said she probably deserved to be killed. This got to the point where the UN had to intervene to get India to take down the fake video. Your average women doesn’t have the UN ready to speak to your prime minister. In a number of ways, deepfakes and technology in a broader sense affect the most vulnerable populations first – it’s a little bit like the canary in the coal mine.

How do you think technology can avoid these problems?

There’s a lot in which technology can learn from healthcare, whether that’s technologists taking the equivalent of a Hippocratic oath or nutrition labels for consumers of what’s in the technology. Looking outside of deepfakes to AI and Machine Learning models, how do you know that bias isn’t baked in? There’s been an atmosphere of techno-optimism, that technology gives us the tools to deal with any problem that comes our way.

I am fundamentally optimistic, however we need to think of the possible negative ways in which technology could be used too. The creator of an app called DeepNude, which adapted photos of women (not men) to make them naked, posted it on reddit and it went viral. He got a lot of attention from the press and ended up taking it down with the explanation that he hadn’t considered the ways in which it cold be misused. You need to break things and get shit done, but you need to make sure you’re not breaking democracy or the open internet.

What do you make compulsory and what do you ban as a CEO?

Personal development plans are compulsory for each individual in my company. What do they want learn, what skills and capabilities do they want to develop, what are they curious about? Then lining this up with milestones and targets. It’s helped me develop as a person and professional, and helped me prioritise my life, my day, or even the next hour. If I were to ban something, (this is aspirational rather than real), it would be meetings on Wednesdays. I love one full day to put my head down, get things done and focus. At big companies you can get into a rhythm of back to back meetings, so carving out the time and space to do your reading is essential.

What piece of art/book/or anything else would recommend?

My favourite artist is Kandinsky, I just love the colours and the energy. My favourite book of the moment is Americana by Chimamanda Ngozi Adichie, it’s an amazing and beautiful read. I also recommend the Knowledge podcast, although it’s not really art but I love it.

Find out more on the Deep Trust Alliance

Get in touch with Kathryn on Twitter or LinkedIn