Insights from Digital Trust Hui Taumata 2024
Conference Overview
The Digital Trust Hui Taumata 2024, held at Te Papa in Wellington, brought together thought leaders and experts in digital identity. The event featured a full lineup of both national and international speakers, making the day rich with thoughtful discussions on various aspects of digital identity.
Throughout the day, expert panels convened, two roundtable discussions occurred, and a diverse lineup of individual speakers presented. Juliana Cafik provided an overview of the international landscape for digital trust frameworks and compared it with New Zealand’s approach. David Birch explored the current state of the multiverse and its intersections with the payments industry, predicting that AI will control most digital wallets in the future rather than people. Worldline shared updates on their developing assurance network, and Vica Papp offered insights into what New Zealanders consider personal data and their expectations for its protection.
Understanding Digital Identity: What Is Digital Identity?
The concept of digital identity often sparks significant discussion. For the purposes of this article, we can define digital identity as the online representation of yourself. It encompasses all the information about you, both held by you and by others. This information exists online and offline and includes usernames, passwords, social media profiles, email addresses, health information, age, hair colour, qualifications, and other personal data. Just as your real identity comprises facts like your name and photo, your digital identity includes all the elements that represent you in the digital world. Currently, you have limited control over how your data is shared, largely due to the distributed nature of its storage and in some respects the different legal arrangements that deal with data sharing and privacy.
You create and manage your digital identity by setting up accounts, choosing passwords, and deciding what information to share using digital tools provided by various organisations. These organisations handle the individual data points from a technical perspective, leaving you to use these points as best as you can. While you have some control over your online identity, other agencies also hold data about you and may share it with others. Recently RNZ has reported that IRD is giving hundreds of thousands of taxpayers’ details to social media platforms for marketing campaigns, despite legal and computer experts saying it is not safe.
Divergence Within the Ecosystem
Currently, only a few ubiquitous tools exist for sharing information about oneself, but most of this data lacks validation or authentication. This results in low trust due to the divergent and fractured nature of the numerous systems involved. This divergence was a key theme at the Digital Trust Hui Taumata 2024. Fragmented system design and a lack of standardisation lead to divergent technical solutions, which negatively impacts trust in the digital identity ecosystem. The real-life implications can be challenging to parse or predict. For example, consider the concept of a digital driver’s license, which the NZTA is currently developing.
The Digital Driver’s License
Historically, a driver’s license served as “proof of age” for purchasing age-restricted items like alcohol or cigarettes, as well as proving you had the right to drive. However, the NZTA does not hold the “assured facts” regarding your age (Births, Deaths & Marriages do). Traditionally, knowing your name and date of birth was deemed sufficient to verify your identity, and people generally accepted the driver’s license as adequate proof. Ideally, it should be possible to verify eligibility without disclosing more information than necessary. The question should not be “How old are you?” but rather “Are you old enough?” with a simple Yes/No answer.
The NZTA is working on a new digital driver’s license that you would keep in your digital wallet, assuring others that you are legally allowed to drive under specific conditions (such as vehicle type restrictions, corrective lens requirements, or curfews). Your digital wallet will soon be filled with various “cards” containing “assured facts” about you. This is where divergence significantly impacts the digital trust ecosystem. When each card is issued or verified by a different party, there’s room for the same “fact type” to be issued multiple times, but with different data included. Couple this with the lack of education of end-users and there is a risk of diluted trust at best or, at worst, complete system failure.
Opportunities in Digital Identity Ecosystems: Use Cases First
Throughout the Hui, numerous calls emerged to dedicate time and resources to developing use cases before establishing standards, rules, and regulations. This approach ensures that a trust framework can be built without compromising its effectiveness, as trust is hard-earned and easily lost.
Juliana Cafik, Identity Standards Architect at Microsoft, shared insights on Aotearoa’s framework. Compared to other jurisdictions, New Zealand operates in a high-trust environment. We can further establish trust in digital interactions by maintaining consistency and uniformity in our trust systems while building towards the ubiquity of digital identification tools and services, such as digital wallets and real-time identity verification.
Assured Facts
Beyond digital identity lies the concept of “assured facts.” While a digital wallet may prove your identity, it can also include various other verified facts. These need not be limited to matters like your name, date of birth, and address. For instance, a role-based token could verify that “the holder of this token is a certified local maintenance electrician.” As digital wallets and identity verification become more accessible, the range of verifiable facts will expand. Future innovations, such as ensuring package delivery to the correct person at a specific address, will build trust in the trust framework. Each successful interaction with a trust based app builds total system trust.
Challenges in Ecosystem Development: Safe Stewardship
Storing and retrieving identity information is not enough; understanding how that information is used and verified is crucial. Trust will erode if the underlying data is incorrect or if the data’s use in business activities is unethical or faulty. People will hesitate to use an identity system perceived as discriminatory. Previous incidents, such as the incorrect identification of an individual as a shoplifter, highlight the need for ethical data management. In that instance, not only were there harmful failings of a technological system, incorrect implementation of business systems regarding the correct use of the technological tools but also subsequent breaches of the privacy act which magnified the issue further. Organisations collecting and managing identifying data must adhere to stewardship responsibilities, ensuring data is kept safe, secure, and used appropriately.
Future Outlook and Considerations: Nothing Exists in Isolation
Building a trust ecosystem involves many components beyond mathematics and cryptography. It requires collaboration among individuals, organisations, and developers, maintaining trust with each incremental improvement. A significant part of sustaining trust is ensuring a consistent user experience across trust-based applications. Like a three-legged race each step of the way, and the industry must focus on fostering these relationships to stay upright. Specific use cases need thorough review and understanding within the broader context of digital identity, digital wallets, and assured facts. Stakeholders should prioritise building trust and addressing public concerns to ensure successful ecosystem development. Worldline has announced plans to integrate identity interactions into their terminal and mobile solutions, as well as to extend their OPEN platform to connect with identity providers. Meanwhile, the DISTF framework is now active and awaiting its first accredited digital identity providers. Public education on available options, their benefits, and how to protect personal data in the digital world is also essential. It’s now time to deepen and broaden stakeholder relationships and determine the scaleable use cases for digital identity solutions so that people can utilise them effectively and efficiently into the future
