Game On, But What game is it?

Everyone, welcome to the full first of all day of the conference. Hope nobody's nursing any ocean going hangovers after all that free beer last night from some places. So those of you may have missed it. There was an award ceremony last night and Youresh got a lifetime achievement award, YRG. So I think That for those that don't know the amount of work that Yrg has to do to handle people like me saying, oh, can we just change this? I've got this person, can they come in and he never complains and just gets on with it, it's fantastic.

Also, winning an award were my good friends from the Kingdom of Bhutan who won the the best decentralized identity deployment award. So they've actually delivered for a whole national infrastructure, decentralized identity for a whole country. So if anyone's wondering how to deploy decentralized identity for a whole country, go and speak to Supr and Co from Bhutan. So to kick off today, I DDAs last year was standing room only downstairs. Bit of a bigger room today. And we're gonna just introduce what's gonna be a full track in this room all day long.

But first, before we do that, Jen Digital, who are we? Well, we're the world's biggest cybersecurity firm. It's fallen from the merger of Avast and Norton and I came in from the acquisition of E, we got secure key in there as well. So we have a team called Digital Trust Services who are working on this stuff. So that's who Jen is. It won't have escape. You'll notice that this is an Olympic year. The Olympics is in Paris this year. Huge event.

Many, many countries and many participants from all over the world. A massive logistical challenge. Years in the planning. And E-I-D-A-S has a lot in common with the Olympics. We've got at least 27 countries. We've got millions of participants in Europe, hundreds of millions of participants. All the people in Europe, we've got tens of thousands of businesses will have to be involved as well. So it's a huge logistics challenge. It's got its own organizing committee that have been working on this for years already and everyone needs to play their part. So when we say what game is it?

Let's call it the Wallet Olympics, shall we? So what is this Wallet Olympics?

Well, the starting gun has been fired already. Every citizen is going to get, if they want it, a digital wallet that they'll be able to use to prove who they are, online sign contracts and do other really cool stuff. It's gonna include very strong privacy protections. And these wallets will be certified as being safe to use and adhering to the legislation. So the legislation is in effect now it's, it was only a few days ago, it was signed off. If you want to read it, I do recommend reading it. 'cause it is, you know, you might think, do I wanna read 73 pages and 25,000 words?

It is actually really good. And you'll see a lot of privacy protections in there. And what it does is it puts the citizen at the center of their digital lives. So everything you've been hearing about yesterday, decentralized identity and wallets and credentials is all in there. So the starting gun's been fired, but like the Olympics, it's a long event. The preparation has taken years already and governments have got now 24 months to deliver wallets into people's hands. It's not very long. Anyone who's been involved in digital wallet projects know that that's a big challenge.

But not only that, businesses, there are certain business categories that are regulated that will have to accept people who turn up with one of these E IDA wallets. So businesses have got 36 months to get ready, okay? And that acceptance is mandated by law. So that's the stick if you like. There's a carrot as well and we'll come onto that. So what games are being played at? This massive wallet Olympics that we've got. Let's look at one of them, which is the large scale pilot event.

There are four of these LSPs large scale pilots with the attractive names, EWC, potential DC for EU and no bid, Jen is I part of is is part of one of them, the EWC one. And I'll share some early results from some of the surveys that have been happening there. And as you can see, there's a whole set of different use cases that are being trialed with real people and these pilots to last another 18 months or so. Real people, real use cases, real data. In EWC we're, we're planning on trialing with 10,000 real citizens with real wallets. And these are public private consortia.

They have to be led by governments, at least three governments and they have a lot of private sector organizations like us in them as well. There are more to come, there's a new call for some new large scale pilots. So it's probably too late to get into any of these ones, but if you want to get into one of the new ones, there are consortia forming at the moment.

And the, it's important to remember with this that the, the people of Europe, the citizens are the most important participants in this wallet Olympics, right? They're the ones, they're gonna have to be using these wallets and making sure that they work properly and enjoying the benefits of them. So I'm just gonna share with you some of the first results from some of the EWC large scale pilot consortia research with actual real people from these three countries when this was being set up.

And my colleague Steph is looking after this user research program, I had some preconceptions about what people from these different countries would say, and I guess you might have as well. So this, can I have a thing? What would the Swedes think? What would the Greeks think? And what would the Netherlands think? Because the results were pretty much the opposite of what I thought they would be. The Swedes, you know, they're looking at, well this is not all Swedes, right? This is just a, the initial sample set. What about people that can't or won't use it?

What, what happens to people who aren't having wallets are they're gonna get disenfranchised in some way? The Greeks, who I thought would be very anti, no, they're, they're seeing the ability to be part of a modern Europe as being a key promoter for their country and a, a key positive. And the Dutch who I thought would be going, yeah, this is really cool, they're thinking, oh hang on a minute, is this, is this some government overreach? So very surprising results for me. And this is a trend that we're gonna have to be really conscious of as, as the ID progresses.

Here's a really good bit of a quote from one of the, the people surveyed, EDIW, this is like acronym rich stuff, but European Digital Identity Wallet, okay? Be the best thing ever. A digital card better than a plastic card. The final part of digitization after bank cards, gift cards and membership cards. So whoever that this is got the message. I think it was a lady called Ursula Underline, I think was surveyed for that one, but it's not all smooth sailing in Sweden.

They've got bank ID and I know the Swedish Bank ID folks are here, maybe not in the room, but they're, they're here, they're around last night, but they've got something that works, works perfectly. So for those, those countries that already have working digital ID programs that are very well used, what are they gonna do? How is it gonna evolve? Are they gonna have to switch? What's gonna change? Interoperability is absolutely key as well. People expect these, these wallets, once they understand what they are, they expect them to just work wherever you are in Europe, right?

And the people in this room probably know what a massive challenge that is gonna be to make that happen, but that's what the expectation is. It should just work just like you can go with your visa cards and buy something and it just works. So that's a huge challenge. Then we've got this kind of thing as well. This is again, really interesting feedback, great initiative for the right reasons and a lot of trust in the EU as the upholder of citizen rights and privacy. And I think that's a really interesting finding. However other people see pitfalls, right?

Is it gonna be surveying everything I do? Is it gonna be profiling all of my activities? Are they gonna track my mayonnaise buying habits and report it back into my health insurer? So we need protections to prevent these worries coming to reality, but also we need a lot of education about how this stuff is, is gonna be avoided and prevented. So like any Olympics, much as the host nation wants to win all the goals and be top of the medal table, they often get very frustrated by other participants coming in from other countries and winning stuff.

And this is no different in the Silicon Valley at the internet identity workshop a few weeks ago, unbelievably Apple and Google got on the stage together and they demonstrated interoperability of their new digital credential, API from the Apple wallet. So an Apple wallet holding a mobile driving license, being able to scan a QR code and do selective disclosure of some elements of that driving license to this website, spaceship rentals. And then Google standing up with a Google wallet and being able to show the same thing with the same QR code with selective disclosure all working.

Okay, wow. But it's not just that. If you look closely, you'll see with Apple Pay, those who use Apple Pay, you know, double click to pay, right? Well they've got double click to share. There are many of these very simple little functions that make the user experience delightful for people. So how long before they combine these two things and they combine payments and identity into one and you've got identity enrich payments and amazingly it won't have slipped by our, our understanding that they have a massive acceptance network with Apple Pay and Google Pay already. So that's one to watch.

If we are looking at surprise countries and surprise entrance into our wallet Olympics. Also at Olympics you often get a really obscure event that turns out to be compelling viewing. It might be Greco Roman wrestling for example. And here in our Walla Olympics our obscure event is the driving license directive, revision 2 0 2 3, et cetera, et cetera. What is that? Why on earth am I showing you this?

Well, this is a revision to the European driving license directive that will enable member states to issue digital driving licenses into apps, into wallets. Which wallets are they gonna be able to issue them into? There are currently three versions. This is not final by the way. The the the directive. This is going through draft at the moment. There are three versions at the moment. And let's say the language is a little bit gray, but if you think of a driving license can handle probably 80% of your identity needs.

If those go into Apple and Google wallets, then why would you use your I DDAs wallet for anything other than doing your tax returns? So there needs to be a bit of tightening of language here. For example, you can only issue these mobile driving licenses into certified European digital identity wallets. Okay? So just keep an eye out for that one because that is absolutely pivotal in my view for the success of I DDAs and the Wallet Olympics is a global event as well. People will expect to be able to take their European digital identity wallet and use it elsewhere. So how's that gonna work?

How's somebody from Bhutan gonna arrive in Europe and be able to use their national digital identity in Europe? How's someone from Europe gonna be able to go and use their identity in their European wallet in the US or the UK or Canada? So we need really some kind of global acceptance network like you have for Visa, for for cards, for MasterCard, et cetera. That just works. And if you look around this room, and I've been at EIC now for eight years, I think, and we look at the talent and capabilities we have as a group, it's a wonder that we haven't done this yet.

So we need to up our game, okay? We need to make sure this works. And it works interoperably and it works globally. So faced with a huge event like the Olympics, it's often useful to have a viewing guide. So in the last few minutes, I've got five main attractions for you to watch at the Wall Olympics as they happen. Number one is legislation. So this 73 odd page piece of legislation has been passed, but that's just the start you'll hear a little bit later.

So from 11 o'clock onwards we're in this room and we've got European parliamentarians, we've got government representatives who will be telling you about the detail of, of, of what's happening next. But each member state has to do what's called an implementing act to make this law in their country. And therein lies the potential for for diversification between different countries.

And that's something that we need to watch very closely because if things, the, the implementing acts are different in different countries and countries do things differently, you use that interoperability and people just expect it to work. So it has to work across Europe in the same way. The second thing to watch is the tech. So it's already complex. We've got the CTO for e IDAs speaking later, Paolo DeRosa, so you can quiz him. But the tech is already complex. The spec for the wallet, the architecture reference framework has two protocols in it.

I know from my experience how horrendously difficult it is to develop a digital wallet with one protocol in doing it with two is gonna be really difficult. So it's a huge challenge for, for wallet developers, but also these wallets all need to be certified. So if I'm there as maybe Jen develops an IDA wallet and I've got it going pay to get it certified at 27 different member states, that's gonna be a huge challenge.

So it's, it is a big challenge for wallet developers, but also it's a big challenge for all of the surrounding ecosystems as well. And then let's look at user experience. If you add up the amount of time spent on the legislation and the technology and compare it to the amount of time spent on the user experience, you'll find things a little bit the wrong, the wrong way round. Think of how much time Apple spent making their icons. Like little candy sweets that you could eat, right?

If the UX for these wallets is not as good or better than the inbuilt apple and Google wallets, people are going to use it reluctantly. So I would say you need to reverse the emphasis on time and effort and do a huge amount on ux. It's got to be really, really good. The fourth one is the economic model. The number of organizations, businesses sitting around waiting to see what happens is just too damn big. And I speak from personal experience because we are looking to see what happens as well.

And if we are, and a lot of others are, and the feedback I've had I've had from many other businesses is who, who actually know about e IDAs ignoring the ones that dunno what it is yet are wondering where's the money, right? Is it gonna cost me a huge amount? What's the economic model for this thing we're gonna hear later today from the first bit of work being done. So the European commissioner has got an economic model working group. So Joran from Deloitte is on later on is gonna tell us about that.

And Jamie Smith is gonna be speaking about the the hidden benefits of EI DDAs that nobody's really seen yet. So we need that economic model sorted out. And the last one is the big sell, the survey work we've done already, no one knew anything about IDAS. And if you bear in mind the different views of different people in different countries, the communication's gonna need to be very, very clear and tailored per use case, per country, per sector and so on.

So there's gonna have to be a massive communication exercise and you will have the newspapers going, oh no, we're all gonna be surveyed and they're gonna track my mayonnaise buying habits. There's gotta be answers to that. There's gotta be briefings going out. There's got to be citizens and businesses involved very closely. So a huge amount to do that. But I think possibly the, the biggest game in town is this one.

Jen, you saw from the first slide, we, we monitor and we block billions of attacks and threats every year. We are seeing the first AI powered fake ID factories. And they're really good. They're really good. They'll create a fake person, a video of that person, a driving license with that person's picture on it all, you know, with a photograph that looks like it's been taken against, different background, et cetera, et cetera, that can fool a lot of the ID verification services out there. And they're the worst. They're gonna be, they're only gonna get better.

There'll be fake ID factories, AI powered, creating thousands of fake IDs a minute. And when that happens, digital trust in the online digital economy is gonna fall apart. So what people need is a way to prove they're genuine and prove they're real and their actual people and not ais and perhaps e IDAs is the way that that happens. And that would make the European economy hugely competitive from a a digital business perspective.

'cause if other countries, other blocks are not able to operate digitally because nobody can trust who anyone is or what any business is or who any customers are, they the, the country, the the group of countries that can do this properly are gonna be massively well positioned. So digital trust becomes of geopolitical importance. So just to roll up and finish off here, I'd ask as I hope you see here isn't one game, there are many, many games going on in this huge tournament. It's of global importance.

A lot of places are watching what happens in Europe and a bit like GDPR, there's a lot of opportunity and a lot of change that is gonna happen as well. So we've got a full ID dash track from 11 o'clock today in here. You'll hear from the experts who actually know what's going on, who are actually delivering and implementing things. And that's from 11 in here. So I hope you really enjoy that and enjoy the rest of the conference. Thank you very much. Thank you very much Andrew.

And clearly there is huge interest in this audience here, both in Berlin and online on in this topic because we've got quite a few questions, we'll just take the top two. Excellent. What prevents Google from getting its wallet it's licensed in Europe and becoming the overwhelming provider anyway? Well that's an excellent question and the answer is they'll have to get their, their wallets certified and there are certain things they'll need to deliver to make, to, to provide a certified wallet. And that will include things like open source code and interoperability and portability and so on.

So maybe they pass the certification criteria, which is probably okay. It's probably okay if they do what the regulation says and they have the right privacy protections in place and the right protections against profiling and correlation, maybe that's okay. So the answer is what prevents 'em, they've gotta get, they've gotta get certified. Do we know exactly what certification means yet? It's starting the latest architecture reference framework has some detail about that, but they could, Okay.

And the other question is, if regional authorities restrict issuance to their own certified wallets, you won't reach global interoperability. Why not use open standards and let individuals choose which wallet best meets their needs? Well that is a good question. So people will be able to choose wallets.

So in, in the Netherlands at the moment, I think there's three wallets that are being put together. Countries will be able to issue, a government will be able to issue their own wallets or they can subcontract to have multiple wallets issued or they can just certify third party wallets. So there's gonna be quite a lot of optionality there and it's up to the government to decide how they want to do it. But the standards for credential issuance are open.

Okay, so a driving license issued by one government into a wallet should work anywhere, should work anywhere. But that's a challenge for everyone in this room to, to make that happen.

Okay, great. Thanks Andrew Tobin. Thanks All.