The Global Interoperability of Digital Identity

So how many of you are coming from identi diverse this past week? Couple? How many of you have another conference to go to next week? What are we doing to ourselves? I think it's a great question. So many of you know me as the executive director for ID Pro or you might actually know me from my work in the standard space, or you might know me from some of my work in research and education and I'm, I'm not actually here wearing any of those hats right now.

This is, this is actually personal observations from meetings I've been attending over the last couple years just at, with all the different hats on my head at one time. And it's really neat that I got, I'm coming right after Nick because I, I have a thing that will, will make that, well, that will make that make sense. It's about something that's just been annoying me in our industry. 'cause we're talking about these large scale global forces and the importance of global interoperability of digital identity. And it's definitely, absolutely important.

But I'm gonna talk a bit about the, the background of what I'm seeing in the space, some of the challenges, some examples of what's going on, the diverse demands being made. And then of course, I can't actually finish a slide deck without giving some call to action.

So first, my biggest pet peeve, it's not just about the frameworks. The frameworks are incredibly important without a doubt. But if you take nothing else away from my talk, I want you to remember that it's not just the frameworks, it's also about the people, the people that are using these, these identities, the reasons why they're using them, and why some of this is actually ever so much more challenging than it might seem. And we already know that it is in fact pretty challenging. So some background, if you're gonna talk about people, then it's a, it's just a fact of life that people move.

People move for a variety of reasons. They move for the desire for education, for employment, or even for safety. And making sure that this global interoperability of any, you know, digital credentials they have with them is pretty useful. But right now it's, it's not always meeting the need, having a digital credential that they can bring with them when depending on where they're coming from, they may not actually have the paperwork.

We're, we're fracturing an ecosystem in a way that we need to take into consideration. So let's talk a little bit just for a moment about education. So the OECD reports that there's just a whole, there's a huge growing knowledge base of an education economy almost in the European Union. There's a program called Erasmus, which is all about student mobility.

Getting, getting the students from one country to the next to the next, while their educational history moves along with them. It's a great model and we're seeing ever so much more, you know, it's happening here. It's not happening as much elsewhere. And so more credentials are being created that are, are splintered from anything else.

So, looking at some of the numbers in the US when we're talking about, well, how big, I mean how many people are actually moving just in the education space? International students in the US it's primarily China and India are accounting for so many. We're talking about, you know, over half a million students moving around, coming into the country, leaving the country, bringing their thoughts, ideas, goals with them, but not necessarily bringing their digital identities because they're not necessarily accepted here. They may not be based on the type of things that the US would wanna see.

Okay, so that was education. Now we're gonna talk about, how many of you are familiar with the phrase digital nomad? Good number of you. How many of you have ever heard the phrase, if there's an internet connection, I can work anywhere?

Yeah, we all do that. We're all digital nomads to a certain extent, but some people take it to a little bit more of an extreme where they say, if I can work from anywhere, then I'm working from Tahiti this week because I can.

And the, the economics behind the digital nomads is quite impressive, the amount of money they bring into both local economies and the amount of money that they send back home. But now it gets complicated again a little bit because we're like, okay, well what kind of credentials do they need to have to do this? In some countries they actually have very specific visas for digital nomads. In other countries they treat it as a tourist visa 'cause the person's going to move along probably before the, you know, 2, 3, 4 months are out.

But it's, it's, it's an interesting thing to watch as they, as they bring the money in, as they send the money out, as they have these credentials that sometimes work in some countries and sometimes work in others, not as well. Okay, so we talked about education, we talked about employment and how we talk about safety. Now here in Europe, you've got an enormous refugee crisis where people are coming here over borders, possibly with nothing. They don't have any credentials at all, left.

They don't have any paper, much less any digital credentials that, you know, are ultimately based on, on that paper. So what happens, what happens to these people and how is this taken into account? The refugee crisis is, is pretty global and we've talked about all sorts of fun ways, fun, interesting, intellectually interesting ways to solve for it.

Like, well if we all, if we, if everybody had a decentralized identity on a blockchain, this would just be, this would just be solved, right? But it's not, the people in question don't have the tools to get there from here. And that's something we just keep seem to forget. So if you looked at this from like a perspective of Maslow's hierarchy of needs, you know, people want to do a lot of things, right? They want safe and legal movement, they want high levels of efficiency and automation. 'cause the last thing anyone wants to necessarily do is stand in line.

And if you think of this, you know, in terms of this hierarchy of needs, do you, if you think about it, identity is just one level up from physiological needs and sometimes it's actually down at physiological needs. Especially if you're talking about refugees and safety.

Our, our level of core of being core infrastructure at that, dealing with humanity at that level is really important to keep in mind as we're developing our frameworks and our big pictures, our big picture, you know, we have this whole forest, the trees are important. So what are the challenges that I'm seeing? We have people they both want and need to be able to move, but the documentation that they need, they may not have it.

And when they do have it, it may not be accepted in the countries they're traveling to, which makes our whole trust framework model a little bit more challenging to implement. So there are some really great guidelines out there as you're talking about, well what, what does the law require?

What, what regulations are out there about how you verify people? What about the identity assurance?

You know, you've got everything from the ICAO for our passports. You've got United Nations offering guidance, you've got banking guidance for new year customers.

You know, there's a lot of information out there. Almost too much information out there in terms of trying to figure out what you're going to do, when you're going to do it, what is actually required in what circumstance. It's a lot to navigate. It's a lot to navigate for anyone who's trying to actually put together a national ID program that will be accepted globally.

And I think, and I think that's one of the other things that we forget, you know, when we're talking about the global interoperability of digital identity, you know, it, you starts perhaps with, well what's happening at the national level. And if at the national level you're dealing with a significant number of your people that don't have what the ICAO refers to as breeder documents, Your birth certificate, your base base documentation, then how are they supposed to get their national identity infrastructure to be globally accepted? I don't know the answer to that. So Step one, right?

We're we're talking, if you're going to do this global thing, you want to have an internationally recognized identity. And I think we're gonna need to rethink a little bit as to what we accept and why we accept information about that. Andy Hindel and Steve Wilson did a really neat talk last week about a proofing creep where we're starting to get really excited about all the use cases where we can with just a little bit more data and a little bit more assurance why we can, we can do all sorts of great things.

'cause suddenly we can validate everybody and everything and is that what we really want? And is that necessary in all use cases? And even when you're talking global, at global scale, can we step back and say we don't always need a birth certificate.

You know, we don't, there are other things that we might be able to say can take its place In the us There's some pretty interesting examples about this. In order to be employment eligible in the United States, you need something called an I nine. And to get that I nine the documents that can establish that you need to, you, there are some documents that do it all. If you have a passport, if you have a permanent resident document, if you have, you know, specific authorization forms, then yes, you, you can actually work in the United States.

But if you don't have those things, then you need two more things, a driver's license, which as an aside, I find fascinating how much we use that as a government document to say everything and about people when what it's supposed to be is, yes, this person is legal to drive, but we use it for everything else anyway. But I digress, you know, there's documents that establish that identity. There's documents that establish employment authorization.

I was chatting with someone from the IRS last week and I mentioned the talk that I was doing today and the level of concern that I had about what happens when you've got the undocumented and their source of truth is that their village elder said that they were born on this day in this village about this time. And she said, oh yeah, we see that use case. We don't accept that. We would never accept that. They're going to have to find something else. And this really surprised me.

We even see that in witness protection use use cases where they don't have all the documentations that they need to have. But sorry, we just, we just don't accept it. That's within one country that's, you know, known to be this whole western world. We've got this global identity thing, you know, we're, we can make this work, right?

We're, we're advanced and yet we're still stumbling across these same problems ourselves. So, And that's where, again, it's coming back down to people, how many people in this world don't have the, that source documentation, the breeder documentation that's going to actually result in something that the trust frameworks that we are talking about and promoting can do something with. That's a lot of people. I actually probably know some of these people and you probably know some of these people. So I want you to be thinking about this.

You know, again, as you're talking about where you start your trust frameworks that perhaps you might wanna start 'em a little bit earlier in that process for those people. Start with the assume there's nothing and see what happens. So that comes then down to embracing that wider scope.

And yet, you know, as digital identity practitioners, we really like that big scope. We like that big complicated problem that we can, we can sink our teeth into and we love talking about it. We want to see all the, we know that there could be so much more efficiency in the system if everybody just did what we told them to do. And if everybody had the phone and if every family member kept their phones to themselves, surely that the world would be a better place. And I'm not saying that that's wrong, I'm just saying it's unrealistic.

So as much as you want to simplify things, perhaps this isn't a good idea. In all the circumstances that we have, we're missing, we're missing the long tail. And I want to know how equitable you think a society can be if you can't serve that long tail L Okay, so what does that mean?

Step one, stop assuming documentation. We need a clearer roadmap. I actually was reading through some of the ICAO guide. There was an ICO guide for assessing the security and handling of the issuance of travel documents, which is one of the places I started reading about breeder documents. And what I was reading for is, okay, what happens when someone doesn't have a breeder document? And it said, and you know, to paraphrase, yeah, you need to be careful This is not helping. But that's, you know, that's as good of a guidelines as we actually have these days.

So what would actually be helpful indicating when a human could actually take the place of a document, maybe an elected official, maybe the village elder, but actually putting something in writing saying internationally speaking we recognize that these use cases are a thing and here are ways to deal with it. Practical ways that actually take into account what's happening on the ground today. Some implementation guidance.

You know, I was at an event last November where we were talking quite a bit about the, the broad scale of, of global interoperability of digital identity. And one person stepped up and said, you know, this is all great stuff that's at least 10 years down the road from me, at least 10 years. Can you tell me how to get there from here from where I am today? And we all said, oh, that's a very interesting question. So let's talk about that trust framework some more, not quite the right answer.

Another thing I think we can do is, and this is part of as we're supporting those national infrastructures that are, that are coming up, that are starting to think about how they're going to, to do this and act on the global stage, is I think we need to actually shift how we're measuring success of these systems. One of the more common measures is, well, how many identities do you have?

Okay, that's good. But what I wanna know is how those identities are actually practically being used. I think that's a much more interesting level of measure that we should be focusing on. I think we should be focusing on just like the different levels of impact and what's actually needed in the use cases that we've been talking about. This comes a little bit back to the, the proofing creep.

You know, what do you actually need? Because maybe sometimes the this dependency on, on paper, on these breeder documents is not appropriate. And this is something, especially now that authorization is such a really big deal, you know, and we focus on this whole interoperability. Interoperability does not mean that someone gains access to the thing. It means that, that those are two separate concepts, completely separate concepts. So when we're saying that these IDs are interoperable, you know, they do have to be readable, people have to be able to make decisions off of them.

But the decision doesn't always have to be. Yes.

So as, as part of the research in doing this, one of the things I stumbled across was the passport index. Have any of you ever played with this site?

Oh, it's super fun. It's super fun because here success is so much more than just documentation.

This is, this is about how, how are passports being used, where are they accepted? You know, the different characteristics of the, the, the equity involved in get in, getting that passport and how hard it is to get the passport and where that passport is generally accepted without needing additional visas. And you can, you can play around with this a lot.

It's, it is a fun website, but this is the, the kind of, I'm not saying that this is going to work for everything, but as a way to spur some innovative thinking in the space about what is it that you wanna measure. There's, there's other ways to do it. And I think this would be a fun one to just get you to start thinking about it. Last but not least, you know, my, my final call to action again, if I can just summarize, you know, before you actually dive into saying, okay, how are we gonna build this framework? Start a little earlier and say, how do we start from nothing?

You know, create that roadmap that countries or organizations can start with a much clearer path for the people that don't have documentation. Knowing that you're trying to get to the point where what you do end up with is globally interoperable. We 100% want that, but you start your thinking from a different place because I think that's, that's a better way forward for what ultimately it is we wanna do. And with that, that is, that was my soapbox. Thank you for letting me stand on it for the last 15, 20 minutes. Appreciate it. Thank you.

Heather, what would people like to ask our friend? I think I, I'll inject one thing that the village elder thing is not just a third world notion. I was told that before nine 11 in the Commonwealth of Virginia, you could get a driver's license by having a small number of people who already had them in Virginia, a test that you were a Virginia resident and of age. Thank you.