We’ve heard the phrase “the world is going digital” time and time again. And it’s true! We can access our bank account on our phone. We can meet with a doctor through a video call. And due to COVID-19, many of us find ourselves in a living room instead of a conference room for work meetings.
The digitization of services is inevitable and has tremendous benefits including accessibility and convenience. However, benefits are not felt by all. For example, nearly 3.3 billion people cannot reliably access the internet, severely limiting their ability to take advantage of these services. When it comes to digital services related to COVID-19, accessibility is paramount. Otherwise, the already marginalized and vulnerable sections of society will be put at a greater risk, and the COVID-19 pandemic could be exacerbated.
Many initiatives, enterprises, and startups are turning to tools such as self-sovereign identity (SSI) and verifiable credentials to help mitigate the spread of COVID-19. Streetcred interviewed digital inclusion and SSI expert Nicky Hickman to understand what can be done to ensure COVID-19-related digital solutions and services are inclusive by design.
Tell me a little bit about your journey in the identity space and why SSI is different than its predecessors.
Nicky Hickman: I started working in identity in 2004, managing the consumer facing Identity & Access Management (IAM) capability for Vodafone UK and leading the team to design a new one. Since then, I have worked on many identity and personal data projects for customers such as O2, Sky, Barclays, Verizon, and GSMA. In 2001, I founded Inglis Jane, an IT professional services company which I sold to investors in 2019. I also have been a member of the Sovrin Governance Framework Working Group since 2016 where I have focused on Identity for All, inclusion, and guardianship.
SSI is different from traditional identity architectures because:
- SSI is about the edges (relationships between entities) in the network rather than the nodes (the entities).
- SSI has considered from the outset that things could be entities—most ‘old school’ identity systems have retrofitted IAM designed for people to work for things.
- SSI is not a full IAM stack. It is only a very thin utility layer. So every time you think about SSI in the context of an application, you have to remember that it’s not SSI OR old-school identity. It’s SSI AND extant identity systems, federations, and services. We are enabling not competing.
You’ve been highly involved in the guardianship and digital inclusion work done at the Sovrin Foundation. What is your simplest description of each?
Guardianship is a trustworthy way of enabling those who cannot be fully self-sovereign to have an identity and therefore carry out digital transactions. Examples include a parent acting as a guardian for their child or an aid worker acting as a guardian for a refugee.
Digital inclusion is simply enabling everyone to participate in digital transactions. People are excluded at different times and in different situations and for different reasons. Maybe they have cognitive or physical impairments which make using a computer or smartphone difficult. Maybe they are financially excluded and cannot afford to connect. Maybe they can’t read very well.
Why is digital inclusion important?
All the evidence shows that a telecoms connection and with it an internet connection directly improve economic and social well-being. Digital transformation brings many benefits (e.g., delivering government services, cutting enterprise costs in customer service, or making any book accessible to anyone anywhere at any time). By considering inclusion factors, you design for a wider real market, making more usable, robust, and ultimately more profitable products and services.
As a person I say that unless we bring everyone with us, we will create more divisions, inequality, and poverty in society. I am guessing that everyone likes their smartphone and internet access and would still like to use them even if they are older, forgetting things, and losing their hearing.
As a product and innovation manager I say unless you design inclusively, you will miss huge sections of your potential market, potentially falling foul of many regulatory requirements to provide accessible products and services. Inclusion also means diversity, and this is a distinct and well documented security strategy.
Is SSI better equipped to take on inclusion and guardianship problems than prior generations of digital identity solutions?
No, I have achieved both with other technologies. However, SSI does make it easier for people to access a functioning digital identity because it is not centralized.
Let me give you an example, traditional identity systems are necessarily designed to exclude some people. For example, KYC processes exclude those with thin credit files—the financially excluded. This is because it is a process designed by the financial services industry to judge whether or not someone is good for a loan. However, the KYC process—indirectly via a credit card—is also used as a proxy for other forms of attribute verification (e.g., age verification for access to adult services). If the excellent KYC functions were able to use SSI and verifiable credentials to verify single claims such as age, then they would be able to include more people and develop new verification service offerings that still use many of the robust processes, protections, and liability models that they deliver with KYC. Of course, banks and other financial service providers could also offer similar services without the need to always use Credit Reference Agencies if the use case was not related to credit but to more generic ID&V.
One potential solution being pursued is the idea of a digital ‘immunity passport’, which people would store on their mobile devices and present when they need to prove that they either have the antibody or have been vaccinated. Ignoring the scientific challenges with such a solution for a moment, what are the inclusion challenges you see in such a solution?
I used to sell vaccines and some of my early work on identity concerned its application in e-health and then m-health, so I have very strong opinions on the idea of an ‘immunity passport’. When it comes to inclusion, the idea of an ‘immunity passport’ risks creating greater exclusion and a new basis for discrimination. Remember what happened with AIDS when this virus was new and poorly understood?
However, the main inclusion challenge is that of digital access. As this is a global pandemic, we won’t ‘solve’ the problem for anyone until we solve it for everyone. Therefore, there must be a range of application layer solutions that allow those without personal internet access to also present credentials or have such a ‘passport’. This means there needs to be a physical token (e.g., paper, plastic, NFC tag), a solution for feature phones (e.g., using SMS), a solution that enables multiple users for a single device, and a solution for connected internet devices to be accessible using voice.
The exciting thing is that this offers a fantastic opportunity to make the first steps in achieving identity for all because COVID-19 credentials might be the first ever functioning digital identity many people get, including the 1.1 billion people without a legal identity. This will not necessarily be a full legal identity, but it will be a starting point.
What is your take on Google and Apple’s contact tracing technology proposal in terms of its inclusion requirements? Do you see any risks?
The key risks from an inclusion and diversity perspective are that the very people who most need to be alerted because they have a higher risk from the virus (the elderly, ethnic minorities, people living in poverty who are more likely to have pre-existing health conditions), are the very people least likely to have a smartphone with this functionality. Of course, there are some solutions to this, but all of them will require digital connection of some sort including options for guardianship.
How will our treatment of digital inclusion affect how quickly the world can recover from and return to some level of normalcy?
As above, if we don’t solve it for everyone then we don’t solve it for anyone. Our main goal is to be able to work, travel, and have physical contact with our loved ones. Most of us care about at least one person who is considered ‘vulnerable or at risk’ from COVID-19. Many of these people are digitally excluded, so in order to reach our goal as a society, we will need to create solutions that include those loved ones as well as ourselves.
What is the best way to get started with digital inclusion?
I really recommend using inclusive design within your strategy, training, HR, planning, design, and marketing functions. The Inclusive Design Toolkit is freely available and gives a good starting point and some ideas on the approach. Within the Sovrin Governance Framework, we also have Inclusive by Design as a core principle, and there is a set of sub-principles which hopefully give clear guidance on the approach.
[end of interview]
One of our core values at Trinsic is accessibility. We encourage those that are developing verifiable credentials use cases in response to COVID-19 to do so with acute attention towards digital inclusion. We’re in this together, and we can’t leave anyone behind.
We have made some of our paid plans free for those who are building a verifiable credentials use case related to the COVID-19 pandemic. Contact us to learn more or sign up for a Trinsic Studio account to start building.
