The COVID-19 pandemic has brought the issue of digital identity to the fore. As nations went into lockdown and people were asked to stay at home, governments around the globe quickly realised the importance of being able to digitally authenticate citizens in order to deliver them the necessary services.
Digital identity programmes were clearly on the agenda anyway, but the onset of the novel Coronavirus has clearly made these initiatives a priority over the coming years.
With this in mind, the influential Alan Turing Institute has this week established an International Advisory Board for Trustworthy Digital Infrastructure for Identity Systems, along with a new report. Whilst the name of the Board doesn’t exactly roll off the tongue, the Institute is highlighting some critical issues surrounding digital identity that should be given attention.
The Board also marks a four year research and development project that is being kicked off by the Alan Turing Institute, which aims to bring together thought leaders, practitioners and field experts in digital identity to “enable progressive innovation for countries around the world”.
Mark Briers, Programme Director for defence and security, The Alan Turing Institute, said:
This Advisory Board is a unique forum set up to enrich understanding of our growing reliance on digital identity systems and the robust considerations needed to avoid harm, address inequalities and protect the citizens these systems are being set up to serve.
Today numerous approaches to digital identity are supported by complex ecosystems of data stores, networks and interfaces with services. Data science techniques are creating strong opportunities to underpin the trust assumptions required of governments, service providers, and the many businesses and organisations that rely on these systems.”
The inaugural members of the new board include: Dr Joseph Atick, chairman and co-founder of ID4Africa; Dr Michael Van Der Veen, director of innovation & development at the Netherlands’ National Office for Identity Data; and Vyjayanti Desai, practice manager at the Identification for Development initiative.
What’s on the agenda?
The Turing Institute notes that 161 of the 175 countries known to have a national identity programme have a digital element. The Institute’s project aims to develop a deeper understanding of the evolving threats to digital identity systems and processes, and particularly the risks these present within lower income countries.
It hopes that the work will result in the creation of new tools, including a Trustworthy Digital Identity System Framework, to help guide countries’ assessment of the trustworthiness of their systems.
The Turing’s report notes that digital ID developments in government, as well in the technology and financial services industries, mean that increasing levels of personal details and biometric data - fingerprints, photos, palm, facial and iris scans - is collected and used widely. This data is often collected freely in exchange for convenient access to a product or service.
The advancements in digital identity are particularly pertinent for some lower income countries and populations that don’t yet have a ‘legal identity’, as digital systems present the opportunity to leap forward with improved access to both social programmes and digital commerce.
The Alan Turing Institute believes that trust is a systemic imperative to the creation of digital ID. The Institute’s report states:
Unlike the physical documents that precede them, the information associated with the use of digital identity can be interpreted to provide a wealth of information tracking an individual’s movements, use of public services, consumer habits and more. National foundational identity systems can be linked to functional services, facilitating new opportunities for managing services financial transactions, crises, or public governance.
The trust assumptions required in and of governments, service providers, and the services that rely on verifiable authentication of an individual can be poorly understood. They speak to reliance on all parties to be lawful and competent, as well as transparent, particularly with their access, management, and use of identity data.
And the public trust in these systems isn’t always there, which has been evident during the COVID-19 pandemic. For example, you only have to look at the backlash and campaigns against linking airport facial recognition and temperature reading devices with national identity systems as a method for controlling the spread of the virus, as evidence that people don’t always believe the intentions behind these systems.
The Alan Turing Institute’s Digital Infrastructure for Identity Systems project outlines six criteria for assessing the impact on the trustworthiness of the design and implementation of an identity system. These are:
The aim of these essentially boils down to ensuring that digital ID schemes assure the transparency of purpose, that the individual’s data remains confidential, that the data is only accessed by those with the right to do so, that it is available when needed and that it retains its integrity. In addition to this, the system and supported services must be resilient enough to cope with and recover from unforeseen events.
The Turing Institute also notes that many of the implementations of digital ID systems today were created before current levels of appreciation for privacy-by-design and more sophisticated regulatory frameworks, such as GDPR.
The Institute’s report concludes:
The Alan Turing Institute’s Research Engineering Group is working alongside the research teams, analysing platforms, simulating data flows and testing resilience within sandboxed environments. This presents significant opportunity to disaggregate current models and trial new designs for evolving requirements, including the technical agility needed to accommodate future advances and developing expectations. This applied area of the research is working to produce functional prototypes to be developed and tested in preparation for implementation and further analysis within real-world implementation.
Digital ID schemes aren’t anything new, but it’s evident that the COVID-19 pandemic has raised their profile on the agenda. The risk over the coming months and years is that as these programmes are accelerated in order to accommodate the delivery of services, that they don’t fully take into account privacy and resilience concerns. The Alan Turing Institute’s work is notable in that it is bringing these issues to the fore and seeking to establish an effective ‘roadmap’ for countries and companies looking to create safe and secure digital ID for citizens. The benefits could be huge, but the work needs to be done with the citizen’s privacy at the core.