Taking control of your digital identity

Where are you? It’s an easy ques­tion with one cor­rect answer: you are where you are, whether that’s at your desk, in bed or on a train, for exam­ple. But where are you online? 

You can prob­a­bly count the dig­i­tal accounts you use most fre­quent­ly on your fin­gers: a ride-hail­ing ser­vice, a social media plat­form, a bank­ing app. How­ev­er, you need only to look at your inbox to realise how many ser­vices you’ve signed up for, the count­less com­pa­nies that you’ve giv­en your address, date of birth, mother’s maid­en name. The truth is that on the inter­net, you’re all over the place. 

We have dif­fer­ent dig­i­tal iden­ti­ties for the dif­fer­ent ser­vices we use and we’re only ever one “what was the name of your first gold­fish?” away from real­is­ing just how messy this can be. This sys­tem is known as cen­tralised iden­ti­ty, where dif­fer­ent organ­i­sa­tions are respon­si­ble for keep­ing an abun­dance of people’s data safe. 

Over the last few years, a fed­er­at­ed iden­ti­ty sys­tem has tak­en off, in which com­pa­nies such as Face­book and Google allow you to log on to dif­fer­ent plat­forms through their ser­vice. It is con­ve­nience at a cost as these tech giants can fol­low you across the web, col­lect­ing data from your health­care apps, shop­ping accounts or any plat­form you’ve used the “log in with Face­book” but­ton for. Not only is this trou­bling in terms of your pri­va­cy, it’s a gold­mine for hack­ers.

Enter Self-Sov­er­eign Iden­ti­ty (SSI), an entic­ing solu­tion that promis­es to keep your data under your con­trol. As Irra Ariel­la Khi, co-founder and chief exec­u­tive of cyber­se­cu­ri­ty start­up Zam­na, puts it, with SSI you are “the king or queen of your iden­ti­ty”. But this rev­o­lu­tion­ary new solu­tion is not with­out its draw­backs.

What exactly is SSI?

SSI is an alter­na­tive dig­i­tal iden­ti­ty mod­el by which each user con­trols their ver­i­fi­able cre­den­tials – tam­per-proof elec­tron­ic ver­sions of phys­i­cal cre­den­tials like a pass­port, per­mit or proof of address – and can selec­tive­ly hand over bits of data to those who need them. 

While SSI’s pro­po­nents agree on its prin­ci­ples – it should be decen­tralised, users empow­ered, and every­thing must remain portable, pri­vate and, most impor­tant­ly, secure – there is some debate over exact­ly how this can be achieved. 

Most believe blockchain could be the answer: each data attribute can be reg­is­tered to a block on the decen­tralised chain, which busi­ness­es can access to obtain an individual’s data with­out the need to store it them­selves. 

Many dif­fer­ent enti­ties are cur­rent­ly tri­alling SSI sys­tems, from the Cata­lan gov­ern­ment in Spain to an NHS hos­pi­tal in Black­pool. Banks are also dip­ping their toes in the water, with Bar­clays pre­vi­ous­ly explor­ing the ben­e­fits of SSI with spe­cial­ist Evernym. “SSI has con­sid­er­able poten­tial when it comes to improv­ing cus­tomer expe­ri­ence: users may be able to reg­is­ter with a sin­gle click, instead of hav­ing to fill out lengthy forms,” accord­ing to Barclaycard’s web­site. 

How can SSI benefit businesses?

SSI might be cost­ly to imple­ment, but could save busi­ness­es mon­ey in the long run. At present, com­pa­nies can be fined hefty amounts if cus­tomer data is lost or hacked and main­tain­ing secu­ri­ty sys­tems that pre­vent this is expen­sive. SSI both shifts the onus from cor­po­ra­tions and makes them less appeal­ing to hack­ers. 

Michael Shea, man­ag­ing direc­tor of tech­nol­o­gy con­sul­tan­cy The Din­gle Group, says SSI can also improve data qual­i­ty, which will save on admin­is­tra­tive costs. “If the cus­tomer is able to present part of their cre­den­tial, say their home address, because it’s now in this cryp­to­graph­ic bun­dle that’s been issued and ver­i­fied, then nobody’s enter­ing any infor­ma­tion on the key­board,” Shea explains. “It’s done auto­mat­i­cal­ly, and so you elim­i­nate the human-entry error or pro­duc­tion mis­take. There’s huge val­ue there.” 

He also notes that SSI won’t just change how exist­ing busi­ness­es oper­ate, it can cre­ate entire­ly new oppor­tu­ni­ties, ref­er­enc­ing Ener­gy Web, a com­pa­ny that uses SSI to allow any­one to par­tic­i­pate in the ener­gy mar­ket.

“Tra­di­tion­al­ly, if you had solar pan­els on your house and you pro­duced more pow­er than you could use, it flowed back into the grid and your meter might run back­wards. The grid oper­a­tor can­not use it to bal­ance the pow­er on the grid because there are too many unknowns,” says Shea. SSI allows Ener­gy Web to ver­i­fy indi­vid­u­als and the equip­ment they use. “They’ve cre­at­ed this sort of iden­ti­ty bun­dle that’s all cryp­to­graph­i­cal­ly signed, so you can become an active mem­ber of the pow­er grid,” he says. 

What problems does SSI pose?

Of course, prob­lems arise when the­o­ry is turned into prac­tice. Zamna’s Khi notes there’s an issue with SSI as it doesn’t recog­nise what cen­tralised insti­tu­tions pro­vide us in return for our data. 

“If you state the user is the most impor­tant per­son in this ecosys­tem, then we’re ignor­ing the fact that the hard work of assess­ment and risk man­age­ment, busi­ness pro­cess­ing and deci­sion-mak­ing, and ser­vice pro­vid­ing actu­al­ly doesn’t hap­pen on the user side,” she says. “There are prices of admis­sion to the ser­vices we as indi­vid­u­als want to have.” 

Zamna’s co-founder Alex Gore­lik adds that “tech­nol­o­gy by itself doesn’t real­ly solve any­thing”, and a rush to apply SSI can be direc­tion­less, with the­o­rists not under­stand­ing how it can solve the prob­lems faced by indi­vid­ual busi­ness­es. 

Susan Mor­row, head of research and devel­op­ment at iden­ti­ty data spe­cial­ists Avo­co Secure, has writ­ten about her doubts sur­round­ing SSI. While in the­o­ry she sup­ports giv­ing users con­trol of their data, she says SSI mod­els in prac­tice do not take human behav­iour suf­fi­cient­ly into account.

“They’re techies build­ing for techies,” she says. “When it comes down to it, if you want this to be the panacea, then it has to cov­er every­body and every­thing.” In real­i­ty, many peo­ple don’t have the smart­phone or reli­able inter­net access that a “wal­let” sys­tem would rely on. 

Ques­tions also remain about the trust lay­er of SSI. Ver­i­fied cre­den­tials are con­firmed as cryp­to­graph­i­cal­ly sound and untam­pered with, but Shea points out they do not prove whether a doc­u­ment was issued by a legit­i­mate organ­i­sa­tion. Khi has exposed such flaws, show­ing how easy it is to pur­chase a domain name using the title of a coro­n­avirus-test­ing com­pa­ny. This means peo­ple could abuse the sys­tem where a bor­der force requires trav­ellers to have neg­a­tive tests before they enter a coun­try. 

SSI identity custodians explained

If our dig­i­tal iden­ti­ty remains total­ly decen­tralised, then there’s no one we can call if every­thing goes wrong. Iden­ti­ty cus­to­di­ans are indi­vid­u­als or enti­ties we can rely on to help us recov­er our data. Some argue banks are a nat­ur­al fit for the role, as we already trust them with our mon­ey and iden­ti­ties. Oth­ers, how­ev­er, may pre­fer gov­ern­ments to take on the job. 

Much remains to be resolved with SSI, but the coro­n­avirus pan­dem­ic has accel­er­at­ed inter­est. Shea says the land­scape has shift­ed and more of his clients are focused on dig­i­tal iden­ti­ty and SSI, with invest­ment increas­ing. “It’s get­ting a lot of atten­tion,” he says. Per­haps con­trol­ling your own dig­i­tal iden­ti­ty is just around the cor­ner.