I recently participated in a Treasury Identity Forum organized by the US Treasury Department in Washington, DC. The Forum focused “on the critical role of legal identity for financial inclusion, economic development, and anti-money laundering/counter financing of terrorism (AML/CFT) safeguards, and the development of new technology identification/authentication solutions to help achieve these goals.” It brought together stakeholders from governments, financial service companies, FinTech startups and technologists to better understand how emerging technologies and legal frameworks can help us develop the required digital identity systems.
I was a member of a panel on how government, business and research communities can collaborate in developing workable identity solutions. Let me summarize the points I made in my introductory remarks.
From time immemorial, our identity systems have been based on face-to-face interactions and on physical documents and processes. But, the transition to a digital economy requires radically different identity systems. As the economy and society move toward a world where interactions are primarily governed by digital data and transactions, our existing methods of managing identity and data security are proving inadequate. Large-scale fraud, identity theft and data breaches are becoming common, and a large fraction of the world’s population lacks the credentials needed to be part of the digital economy.
Earlier this year, the World Economic Forum (WEF) published an excellent report, A Blueprint for Digital Identity. The report lays out a framework for the creation of digital identity systems, and discusses the benefits that such systems would bring to their various stakeholders. In addition, it includes a primer on identity which I found to be the most satisfying explanation of what identity is all about.
Whether physical or digital in nature, identity is a collection of information or attributes associated with a specific entity. Identities can be assigned to three main kinds of entities: individuals, institutions, and assets. For individuals, there are three main categories of attributes:
- Inherent attributes are intrinsic to each specific individual, such as date of birth, weight, height, color of eyes, fingerprints, retinal scans and other biometrics.
- Assigned attributes are attached to individuals, and reflect their relationships with different institutions. These include social security ID, passport number, driver’s license number, e-mail address, telephone numbers, and login IDs and passwords.
- Accumulated attributes have been gathered over time, and can change and evolve throughout a person’s lifespan. These include education, job and residential histories, health records, friends and colleagues, pets, sports preferences, and organizational affiliations.
Attributes are used to determine the particular transactions in which the individual can rightfully participate. The attributes needed to certify your identity or permissions will vary with different kinds of transactions. For example, to buy alcohol, all you need is proof that the individual is over the legal drinking age. Approving a moderate financial transaction might require a relatively small number of attributes, but a large financial transactions like the purchase of a house will require many more attributes. Getting a passport or TSA Global Entry involves a different set of attributes from financial transactions, and so on.
These data attributes are generally siloed within different private and public sector institutions, each using its data for its own purposes. But to reach a higher level of privacy and security, we need to establish trusted data ecosystems, which requires the interoperability and sharing of data across a variety of institutions. The more data sources a trusted ecosystem has access to, the higher the probability of detecting fraud and identity theft while reducing false positives. In addition, an ecosystem with a wide variety of data sources can help foster economic inclusiveness by certifying the identities and credit worthiness of poor people with no banking affiliation.
It’s not only highly unsafe, but also totally infeasible to gather all the needed attributes in a central data warehouse. Few institutions will let their critical data out of their premises. But, there are innovative ways to move forward, in particular the identity and data sharing framework being developed at MIT Connection Science, a recently established research initiative led by MIT Media Lab professor Sandy Pentland.
A few weeks ago, MIT Connection Science published Trust::Data: A New Framework for Identity and Data Sharing, a collection of articles edited by Professor Pentland, Thomas Hardjono and David Shrier. I’m a Fellow in MIT Connection Science, and was a co-author of the book’s first chapter, which summarized the key elements of such a framework. These include:
Robust Digital Identity. “Identity, whether personal or organizational, is the key that unlocks all other data and data sharing functions. Digital Identity includes not only having unique and unforgeable credentials that work everywhere, but also the ability to access all the data linked to your identity and the ability to control the persona that you present in different situations… the work you, the health system you, the government you and many other permutations. Each of these pseudonym identities will have different data access associated with them, and be owned and controlled only by the core biological you.”
Universal Access. Universal access, like open data, is the kind of principle few would disagree with. However, to be effective, universal access requires a legal structure. “The U.S. Government can promote universal access by policies that provide for secure, citizen-controlled Personal Data Stores for all citizens in a manner analogous to current physical Post Office Boxes, and promote their use by making government benefits and interactions such as tax transfers and information inquiries conveniently available by mobile devices and web interfaces secured by the citizens’ digital identity.”
Distributed Internet Trust Authorities. “We have repeatedly seen that centralized system administration is the weakest link in cybersecurity, enabling both insiders and opponents to destroy our system security with a single exploit. The most practical solution to this problem is to have authority distributed among many trusted actors, so that compromise of one or even a few authorities does not destroy the system security consensus… Examples such as the blockchain that underlies most digital cryptocurrencies show that distributed ledgers can provide world-wide security even in very hostile environments.”
Distributed safe computation. “Our critical systems will suffer increasing rates of damage and compromise unless we move decisively toward pervasive use of data minimization, more encryption and distributed computation. Current firewall, event sharing, and attack detection approaches are simply not feasible as long-run solutions for cybersecurity, and we need to adopt an inherently more robust approach. The optimal technology for such an inherently safe data ecosystem is currently being built and tested [in] MIT’s Enigma project.”
Earlier this year, Pentland explained the key elements of Enigma as part of his testimony to a Presidential Commission on Enhancing National Cybersecurity.
“Enigma, is a decentralized computation platform enabling different parties to jointly store and run computations on data while keeping the data completely private. Enigma enables a sustainable data ecology by supporting the requirements that data be always encrypted, with computation happening on encrypted data only, by allowing owners of the data to control access to their data precisely, absolutely, and auditably, and by reliably enabling payment to data owners for use of their data…”
“Since users in Enigma are owners of their data, we use the blockchain as a decentralized secure database that is not owned by any party. This also allows an owner to designate which services can access its data and under what conditions, and so parties can query the blockchain and ensure that it holds the appropriate permissions. In addition to being a secure and distributed public database, the blockchain is also used to facilitate payments from services to computing parties and owners, while enforcing correct permissions and verifying that queries execute correctly.”
Enigma will take considerable time to develop and deploy. But a much simpler and easy-to-deploy version called OPAL (OPen ALgorithms) will soon be ready for pilot testing in a few European countries. “The concept of OPAL is that instead of copying or sharing data, algorithms are sent to existing databases, executed behind existing firewalls, and only the encrypted results are shared. This minimizes opportunities to attack databases or divert data for unapproved use, but places restrictions on the ability of an ecosystem to collaborate on data when it is in an encrypted state. Note that OPAL may be combined with anonymization identifying elements in order to reduce risk, and in the long run will evolve toward [Enigma’s] fully-encrypted, computation friendly model.”
I closed my remarks at the Treasury Identity Forum by discussing the roles of government and the private sector in advancing such initiatives. Governments have long provided us with a biological proof of identity, - i.e., our birth certificates. I expect that governments will continue to play the central role in establishing the digital equivalent of birth certificates, - core digital identities, - which will in turn be used to create the persona digital identities for each of our slices of life, e.g., work, financial, social, family, organizational affiliations, and government interactions.
Persona digital identities will be provided by various private sector identity ecosystems, each bringing together different kinds of partners, valuable data, and sophisticated technologies. These different ecosystems will compete with each other in the marketplace for our business, based on how much we trust that they will protect our personal data, privacy, security and identity.
The WEF Blueprint for Digital Identity argued that financial institutions are well positioned to drive the creation of such digital identity ecosystems because they already serve as intermediaries in many transactions, are generally trusted by consumers as safe repositories of information and assets, and their operations, - including the extensive use of customer data, - are already rigorously regulated.
Finally, as was the case with the Internet, government needs to play a leadership role in the creation of such highly complex identity ecosystems by supporting the required R&D, experimental testbeds, and legal frameworks.