What does the future of digital identity look like?

Like smart­phones, wifi or cloud com­put­ing, dig­i­tal iden­ti­ty is head­ing on the same growth tra­jec­to­ry towards mass adop­tion. Coro­n­avirus has been a shot in the arm for the indus­try with vac­cine pass­ports for trav­el, deal­ing with vot­er fraud or online access to new ser­vices help­ing to fuel adop­tion. 

Five years from now, many more of us will be using dig­i­tal chan­nels to ver­i­fy our iden­ti­ty on a dai­ly basis. 

“We fore­see over 6.2 bil­lion dig­i­tal iden­ti­ty apps in ser­vice by 2025. This will cap­i­talise upon how impor­tant the con­cept of iden­ti­ty is to our every­day lives,” says Nick May­nard, lead ana­lyst at Juniper Research. Expect rapid growth in emerg­ing mar­kets, par­tic­u­lar­ly in Africa, where mobile-first ser­vices help cit­i­zens access banks, loans, insur­ance and gov­ern­ment ser­vices.   

The tech toolk­it need­ed to catal­yse the future of this sec­tor is already avail­able. Esto­nia, which is a poster child for the mass adop­tion of dig­i­tal ID, has been using decades-old sys­tems. “Any changes will need social more than tech­ni­cal devel­op­ments. No tech works with­out the right social con­text,” says Dr Garfield Ben­jamin, researcher at Solent Uni­ver­si­ty. 

Suc­cess tomor­row will depend on soci­etal trust in the sec­tor today. This will be the cru­cial cur­ren­cy over the next decade, weighed against fears of a sur­veil­lance soci­ety. 

“Peo­ple trust­ing in an organ­i­sa­tion hold­ing their dig­i­tal iden­ti­ty data is going to be fun­da­men­tal to any suc­cess­ful roll­out in the future. That’s one rea­son why social media plat­forms have strug­gled with sim­i­lar con­cepts,” says Adam Desmond, UK and Ire­land coun­try lead for Mitek Sys­tems. 

“To dri­ve adop­tion, gov­ern­ment and big tech need to cre­ate more every­day use-cas­es for dig­i­tal iden­ti­ties. One thing is for sure, if we don’t act soon, we may miss the boat.” 

Answer may lie with government

Access­ing gov­ern­ment ser­vices is like­ly to be a sil­ver bul­let. Aus­tralia announced last year that dig­i­tal iden­ti­ty will be a major focus of its AUS$800-million tech­nol­o­gy bud­get pack­age. The aim is to help sim­pli­fy and reduce the cost of inter­act­ing with pub­lic ser­vices. The UK government’s Dig­i­tal Iden­ti­ty Con­sul­ta­tion closed with a com­mit­ment to fur­ther the use of dig­i­tal iden­ti­ties. 

“We’re def­i­nite­ly see­ing a grow­ing appetite in gov­ern­ment as we enter the new decade,” says Kevin Tril­li, chief prod­uct offi­cer at Onfi­do. “Set­ting stan­dards will also help over­come the risk of mar­ket frag­men­ta­tion as dig­i­tal IDs become more per­va­sive in soci­ety. With cen­tralised stan­dards, the gov­ern­ment can estab­lish a require­ment for inter­op­er­abil­i­ty, while still allow­ing for com­pa­nies to offer com­pet­i­tive dif­fer­en­ti­a­tion on the qual­i­ty of ser­vice pro­vid­ed.”

This is where the prob­lem lies as many indus­try play­ers fear a pro­lif­er­a­tion in dig­i­tal iden­ti­ties, sim­i­lar to count­less pass­words and user­names, will weigh heav­i­ly on the sec­tor. If you aren’t liv­ing in Sin­ga­pore, Den­mark, South Korea, Esto­nia or the Nordic coun­tries where a sin­gle, often gov­ern­ment-backed, dig­i­tal ID reigns supreme, expect a pro­lif­er­a­tion of authen­ti­ca­tion sys­tems.   

“British soci­ety has adopt­ed an almost ‘neo-medieval’ approach to dig­i­tal iden­ti­ties. Indi­vid­u­als are using mul­ti­ple over­lap­ping iden­ti­ties across dif­fer­ent juris­dic­tions, tech­nolo­gies and com­merce,” explains Aman­da Finch, chief exec­u­tive of the Char­tered Insti­tute of Infor­ma­tion Secu­ri­ty. 

“Our social media accounts present who we are to the online world, our bank accounts allow us to access our finances, and our nation­al insur­ance num­bers ensure we’re paid and taxed cor­rect­ly. All these iden­ti­ties remain sep­a­rate from each oth­er and are not inter­change­able.”

It doesn’t help that in the UK there’s been a strong his­tor­i­cal resis­tance to uni­ver­sal iden­ti­ty cards, even though it’s ranked in the top ten by the Unit­ed Nations e‑government list­ings. 

“The biggest bar­ri­er to mak­ing things hap­pen is it takes years for gov­ern­ment depart­ments to even define what their require­ments are. This, on top of lengthy, inef­fi­cient and bureau­crat­ic pro­cure­ment pro­ce­dures, means the tech­nol­o­gy is often out­dat­ed or obso­lete by the time it’s in pro­duc­tion,” says Don­al Greene, chief expe­ri­ence offi­cer at Inno­vatrics. The spec­tre of uni­ver­sal cred­it looms large.

In Esto­nia, albeit a much small­er coun­try with a strong dig­i­tal­i­sa­tion strat­e­gy, they’ve had a phys­i­cal ID card, a SIM card and an app, all tied to a sin­gu­lar dig­i­tal iden­ti­ty that’s pow­ered by blockchain for a num­ber of years now, the ben­e­fits of which are wide­ly expe­ri­enced across soci­ety.

“My ID card doesn’t just serve as my dri­ving licence and nation­al health card, but also as a loy­al­ty card for book­stores and gym mem­ber­ship,” says Flo­ri­an Mar­cus, dig­i­tal trans­for­ma­tion advis­er at the e‑Estonia Brief­ing Cen­tre. “It’s effec­tive­ly every­where. I can also view my tax dec­la­ra­tion or log in to my bank.” 

Time for self-sovereign identities

For those nations stum­bling over per­son­al free­doms and fears of cen­tralised dig­i­tal IDs, the future could lie with self-sov­er­eign iden­ti­ty, where­by peo­ple own their per­son­al data ful­ly with­out exter­nal inter­ven­tion. 

“This is where indi­vid­u­als can cre­ate their own portable dig­i­tal ID,” says Mark Tay­lor, dig­i­tal­i­sa­tion and data part­ner at Osborne Clarke. “This also chimes well with wider devel­op­ments in data reg­u­la­tion. The aim would be to raise the lev­el of trust from indi­vid­u­als about how their data will be used and encour­age greater data shar­ing.” 

This form of dig­i­tal ID has pri­va­cy by design and cit­i­zen empow­er­ment at its core. With this tech­nol­o­gy there are no cen­tral repos­i­to­ries of infor­ma­tion that can be com­pro­mised. 

“With­in five years, enter­pris­es and gov­ern­ments may no longer have domin­ion over dig­i­tal iden­ti­ties; the pow­er will instead have shift­ed to sit with indi­vid­u­als them­selves. Peo­ple will be able to set, man­age, share and with­draw spe­cif­ic parts of their iden­ti­ty with organ­i­sa­tions, based on their needs,” accord­ing to Mike Adler, chief prod­uct offi­cer for secu­ri­ty at RSA. 

End of online anonymity

Anoth­er dri­ver of change will be the shift away from anony­mous or bogus pro­files online to one where every­one must prove who they say they are, just as they have to in real life. The recent storm­ing of the US Capi­tol by sup­port­ers of Pres­i­dent Don­ald Trump, incit­ed by social media chat­ter, has high­light­ed these con­cerns. It’s easy to incite all kinds of trou­ble when no one knows who you are on the inter­net. This will change.

“Cur­rent­ly, there is very lit­tle account­abil­i­ty online. There is a lot of focus on free­dom of speech, for­get­ting the respon­si­bil­i­ty of speech. We’ll see stronger reg­u­la­tions in this space, mak­ing peo­ple account­able for shar­ing ille­gal or fake infor­ma­tion,” says John Erik Set­saas, vice pres­i­dent of iden­ti­ty and inno­va­tion at Sig­ni­cat.  

“The need to prove who you are online in a trust­wor­thy way will only increase. Anti-mon­ey laun­der­ing direc­tives will also become stronger, with high­er con­se­quences for organ­i­sa­tions and indi­vid­u­als for non-com­pli­ance.” 

So, what of the future for dig­i­tal iden­ti­ty beyond the next few years? There are already tech­nolo­gies that offer a new dawn for this sec­tor. Beyond blockchain, quan­tum com­put­ing could com­plete­ly change how almost every type of cre­den­tial is stored and ver­i­fied. This tech­nol­o­gy in the wrong hands could also allow hack­ers to crack most cen­tralised data­bas­es. The arms race to secure iden­ti­ties may there­fore have to step up a notch. 

“Research is already under­way on post-quan­tum cryp­tog­ra­phy, but the speed of this research and its imple­men­ta­tion will depend on the suc­cess of quan­tum research and devel­op­ment,” says Kelvin Mur­ray, senior threat researcher at Car­bonite + Web­root. 

In a decade’s time, the dig­i­tal iden­ti­ty land­scape could look com­plete­ly dif­fer­ent.

---

Learning from Estonia

Esto­nia is liv­ing proof that hav­ing a sin­gu­lar elec­tron­ic ID for gov­ern­ment and some pri­vate ser­vices can work effec­tive­ly with buy-in from the gen­er­al pub­lic. The ques­tion is whether this is a blue­print for the future of dig­i­tal iden­ti­ty in oth­er coun­tries. The Baltic state, with a love of all things dig­i­tal, is small – Estonia’s pop­u­la­tion is less than 1.5 mil­lion peo­ple – and inter­net pen­e­tra­tion is high. But is it an out­lier?

“We need to dis­pel this myth of Eston­ian excep­tion­al­ism, it doesn’t help us and it doesn’t help those try­ing to learn from us either,” says Flo­ri­an Mar­cus, dig­i­tal trans­for­ma­tion advis­er at the e‑Estonia Brief­ing Cen­tre. 

“The most sig­nif­i­cant prob­lem is lack of polit­i­cal will to change. Some in gov­ern­ment sim­ply don’t get dig­i­tal­i­sa­tion, oth­ers think it’s a mere gim­mick. Anoth­er group absolute­ly sees the ben­e­fits, but only want to sup­port projects they can fin­ish with­in their cur­rent term in office, so they can cap­i­talise on it.”

Most coun­tries still have to solve the basic ques­tion: should the gov­ern­ment be the one and only guar­an­tor of a ver­i­fied dig­i­tal iden­ti­ty. This may give some cit­i­zens in the UK and Unit­ed States the jit­ters; in oth­er nations, the pri­vate sec­tor is play­ing a deci­sive role, such as the bank­ing sec­tor in the Nordic coun­tries. 

“It mustn’t be for­got­ten that it’s tak­en Esto­nia decades to achieve this with its dig­i­tal ID. Pro­grammes can­not be rushed or they will end in dis­as­ter,” explains Matt Aldridge, prin­ci­pal solu­tions archi­tect at Car­bonite + Web­root. 

“This is not a glo­ry option for any one leader, cab­i­net or par­ty. It relies on co-oper­a­tion from a suc­ces­sion of gov­ern­ments to deliv­er on the promise of a uni­fied nation­al dig­i­tal iden­ti­ty that is ful­ly inte­grat­ed into all cit­i­zens’ dai­ly lives.”  

Estonia’s suc­cess­ful dig­i­tal ID is now enabling oth­er solu­tions. The gov­ern­ment in Tallinn has part­nered with the World Health Orga­ni­za­tion to cre­ate a blockchain-based, coro­n­avirus vac­ci­na­tion cer­tifi­cate. 

“The secure, pri­vate solu­tion has suc­cess­ful­ly gained the trust of Esto­ni­ans, who are used to its tech­nol­o­gy and under­stand how it can sup­port pub­lic safe­ty dur­ing the cur­rent pan­dem­ic,” says Aman­da Finch, chief exec­u­tive of the Char­tered Insti­tute of Infor­ma­tion Secu­ri­ty. 

The Eston­ian gov­ern­ment is also look­ing to use arti­fi­cial intel­li­gence (AI) to deliv­er the kind of tasks that usu­al­ly require a phone call or an in-per­son vis­it to an offi­cial agency. Called #Krat­tAI, the AI-pow­ered bot or vir­tu­al assis­tant could soon deliv­er pub­lic ser­vices safe­ly and secure­ly. 

“We could also dri­ve this fur­ther into the pri­vate sec­tor, but that’s where we will face more ques­tions relat­ed to ethics and pri­va­cy, and right­ly so,” says Mar­cus at the e‑Estonia Brief­ing Cen­tre.

“Imag­ine you could log in to Face­book or Twit­ter with your real dig­i­tal iden­ti­ty. No more spam bots, no more opin­ion hack­ing such as we’ve seen with Cam­bridge Ana­lyt­i­ca. This could dras­ti­cal­ly increase the account­abil­i­ty of indi­vid­u­als when it comes to harass­ment and cyber­bul­ly­ing. 

“But also no more secre­cy for whistle­blow­ers and a greater poten­tial for gov­ern­ment super­vi­sion.” There’s a fine bal­ance to be had.

---