Is Digital Identity Solved?

Co-authored with Maria Francesca Montes

*“What’s in a name? That which we call a rose by any other name would smell as sweet;”***[1**] . I am who I am, and my identity is me. This simple truth is unfortunately far from reality for many individuals across the globe that have not been provided with a formal identity to verify and authenticate who they are.

A common non-digital verification process is customer onboarding (aka Know-Your-Customer). This is the process when you provide, for example, a financial institution, with documents evidencing your name, home address, and other particulars. The cumbersome experience of signing your name on multiple sheets of paper has largely been the driving force behind dissatisfactory customer service, high processing cost and low compliance factors. The current process has unintended consequence of data replication. You are identical with yourself. You are your identification whether presented in a physical or electronic form. Presenting your physical identification to the security guard for them to write your personal information in their logbook replicates you in a written form. Presenting your physical passport to immigration for inspection replicates you in electronic form within the central databases of that country. In a way, you are practically everywhere at once.

Digital access to an identity is a natural progression emerging from technological advancements. Harmonized physical and electronic identity footprints in order to protect the privacy of an individual while concurrently proving and authenticating their identity is practical. The preference for digital verification of identity is motivated by convenience.The collection, processing, and use of identity digitally is more cost effective and more efficient than physical manifestations of identity. In most developing countries, digital identity management systems are equipped to deliver basic social services and welfare programs from government to the public. Leaving aside issues of fraud and cybersecurity, the identification of individuals for administering these benefits has been proven to work.

Digital access to an identity should be grounded on a legal framework that ensures privacy-by-design while providing seamless accessibility through interconnectivity and interoperability. Any resulting system should be able to provide harmonized access for online identity authentication to be used whenever needed, such as opening a bank account, enrolling in a school, applying for a job, and so on. Such access enhances and protects privacy because it eliminates the paper trail in the verification process and minimises manual processes. The verification process may be done in real time directly between the individual and the institution responsible for issuing the identity.

In exploring digital identity, we recognise that we face two separate problems. The first - having an officially recognised identity; and the second - having an officially recognised digital version of the officially recognised identity. This distinction is crucial. The former is the provision of formalised identity to a person. The latter is the process of having such formalised identity provided over a digital mechanism.

With this in mind, let’s consider a government agency that has the legal framework to provide and verify an identity document which contains machine readable information. Travel documents are provided, to a machine or immigration officer for the verification of the traveller’s identity. This may not feel “digital” given that a physical document is involved in the process. However, it is important to realise that these travel documents have data encoded on the identity page in optical character recognition format. Purely as a matter of background, the ICAO Document 9303[2]is the protocol for machine readable travel documents. Despite the travel document being a physical item, data encoded in the identity page enables digital verification, in that computers with a camera and suitable software can directly read the information encoded in machine readable passports.

Would it be too far-fetched then to imagine the same agency having the legal framework to provide access to the same machine coded information (e.g. via APIs[3])? The answer is no. On this basis, digital identity is solved. We may have been looking too hard for a solution not realising one has already been waiting to be acknowledged. That is, government agencies currently providing identity documents need to digitally expand on their existing non-digital role as utilities provisioning and verifying an individual’s identity. We are not comprehensively using the readily available technologies to handle a secure and frictionless identity management.

The issue here is not one of digital identity. Rather, the issues are the inefficiencies surrounding the process of verification, digital access, trust, and identity itself. Without putting the cart before the horse, the true question becomes how to effectively provide official identity documents to those who have none.

[1] William Shakespeare, Romeo and Juliet.

[2] https://www.icao.int/publications/pages/publication.aspx?docnum=9303 (accessed 10 August 2020)

[3] https://en.wikipedia.org/wiki/Application_programming_interface(accessed 10 August 2020)