Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/151 Thanks!
So
as all of you can see,
this is the first talk about Europe, the
United States of America and identity
ecosystems.
Yeah. This is Christopher Engelman.
Yes, he's a speaker today.
Please have warm applause for him.
And so you might start.
Yes.
Well, thank you.
Thank you to the organizers of the
car's computer conference for having me.
It's a great honor to be here.
And thank you for coming
at this early time after probably
a long night.
I guess most of you went to bed late
just like I did.
I still, I hope I can manage
to catch your attention
with some.
Ideas, descriptions
about digital identity
policies currently
taking place of being shaping
up in Europe and
the United States of America.
Let me briefly introduce myself.
You know my name Christopher Engelman.
I work at the Locarno University, just
south of Hamburg and Luna Book
and have for quite some while been
studying the history
and theory of cultural techniques
of authentication media.
So some of you and I will
get back to that in a moment.
Might have seen my talk two years ago
where I gave a presentation
basically on the history of
authentication, media and on naming.
And in some ways, what I'm doing
today is a continuation of that.
That said, my
talk basically is divided
in two parts.
First one, as I just said, is a recap of
what I said two years ago because I think
it's important to understand the
contemporary
dynamics and and
things taking place
and the contemporary things taking place
actually behind those
two acronyms.
Com 220, 2012 238.
And Stick, which
I will then go into
in the second part of the talk.
So.
Let's start with the recap.
What's in a name?
That was the title of of the top two
years ago.
Basically, I showed that
the rise of the modern nation state is
linked to the stabilization of naming
of people
in the sense of making people making
a population after addressable.
And the format that has emerged
is basically the name surname
system. This was already talked about a
little bit in a presentation
on on the first evening
new neutral ground in a burning
world.
So the states in certain parts of
the world quite far back,
but in the so-called developed world
or in Europe, the U.S.
and some other parts where
we have seen the emergence of a modern
nation state sometime after the
17th century, the
stabilization of the naming system was
actually a relatively slow
process, which took
a couple of hundred years to to come
to bear.
So I show that naming an identity
regime emerge and economic, military,
colonial social welfare
in migratory contexts,
and that names are not a matter of
choice.
Instead, there are mandatory modern
nation states. People are not free not to
have names, and
I guess nobody knows anybody who has
no name, at least in the
real world.
Everybody has some sort of
basic registered name.
So it's the same time
those names are basically
referencing a body of an individual,
and there's
all time for all of the history
of identity systems.
This pesky problem
of linking a certain identifier,
usually like name and surname,
birthdays and so forth to a certain body.
Um, some researchers have
called this the gap between the body
and the document, and
closing this gap is an
issue that you try to
deal with with basically biometrics
and pre-digital biometrics are
things like handwritten signatures,
which leave a trace of the body
descriptions like eye color, hair color,
hate
or, for example.
Also, pictures can be understood as
biometrics.
So basically, when I say to govern is to
address what is being
what, what state or tries to
be able to address is
an individual in
an individual's body.
Also, identity
is duplication, and that means control
duplication with registers,
meaning that if you get
an identity in
some sort of nation state, you usually
are issued some sort of paper
starts with the birth certificate,
which is pretty much mandatory
in most parts of the world.
So you cannot enter a territory
from sort of say within without being
registered.
But the way the system
works is basically while you have
this credential, this document
identifying you, there's
also a so-called copy
in the register, which
proves that you have this
document and essentially makes
it valid.
So only this this form of duplicate
duplication
of a register and an issued document
is
making the
generating that identifier
ability of the individual.
Um, the second
part here is important.
What basically happened
sometime in the 19th and 20th century
is this nation states monopolized
these registers.
You're not being registered as a citizen
by some sort of private
enterprise or business or
even civil society organization.
It is the nation state that maintains
these registers, right.
In Germany, it's the standard center
major burden where you have
where those registers are kept.
And in the U.S., in England, there are
similar institutions in place.
The difference between Europe and
Anglo-Saxon countries is just how
important these registers
are in everyday life and they become.
In a context of other states
ever more important as we going to see
soon, so
um, the the last
point was that identity systems are media
systems changing as media change.
And this is what we're seeing now.
Basically, existent identity
systems are built on
paper based bureaucracies.
The issue you papers and they process
your data on papers.
Of course, they are the hybrids by now,
as we all know.
But essentially,
the history of these systems is linked to
the to the history
of the availability of and
uh, yeah, of the widespread availability
of paper.
Now we have a new media
regime for 20
or 30 years in which people conduct
business, which is digital media and the
internet.
And everything I'm going to talk
about from now on is basically
describing how state or
tries to handle this
media transition to a digital
system and tries to create digital
identities.
So, by the way,
roughly 19, the 1980s
of the last century
in the developed nations,
we had a system while we had a situation
in the second
where First World countries were
uniformly dubious registration
have international travel
regulated by passport system
and basically most,
if not all, people neatly named
and addressable.
The paperwork was all tidy and well
organized and.
And all people, with few exceptions, had
an address in the form of name, surname,
birth place, postal address and so forth.
And then, of course, and that's what I
just said, the internet happened
and looking back at.
And we don't want to do now is
basically.
Go back to the 1990s to 80s and 90s
and show what happened when
this media, when the onset of the
aforementioned medias media change
took place.
So the internet happened.
And if
you look back at the time when the
internet became a widespread phenomenon,
one could see
that from from
today's perspective, one could see
that in the 20 year history in between,
we have three
waves of administrative attempts
to create digital identities for citizens
or to put, in other words, to
give people digital names
which are equivalent to the name surname
system and thus to make them
addressable and to create a
capacity to govern digitally.
So
I think we um,
I think there are just three waves.
The first wave is basically the mid-90s
when the internet became a widespread
phenomenon where in the US
you see the Clipper Ship Initiative,
the digital signature stunned standard
and the signature exists in
Germany, India and Germany.
And I would explain those initiatives
now.
So.
In the mid-nineties, the internet became
a socially and economically and also
political phenomenon and
a sizable and growing amount
of people conducted important
parts of their life online to business
and entirely new economic sectors
began to emerge in both Europe
and the U.S.
governments began to draft regulations
to enable digital names for
the population, for the individuals.
I will focus here on Germany and the
American example because
both of the limited time and
also I'm not an expert on the
developments in other European countries.
In 1993, one of the first acts
of the still fresh Clinton administration
was that the inventor of the internet,
Al Gore, introduced the
proposal for the national information
infrastructure, which in hindsight
can be understood as the first serious
attempt was one of the first serious
attempts of creating
official online identities
by statehood,
part of the national information
infrastructure.
This is the information superhighway you
all heard about.
The policy proposal was suppose called
national information infrastructure,
but in the press it was usually
referred to as the information
superhighway.
Part of this
program was an ambitious crypto policy
proposal, which essentially
envisioned a government approved
cryptography for all digital devices
connected to IP networks,
and this namely via the digital signature
standard and to escrowed encryption
standard SSL.
I don't know if this is readable.
This is basically
the proposals in this case for the
digital signature standard.
As you can, you can download these
from the National Institute for
Standards list.
It's just the first page, of course, and
this is the escrowed and Crypton
standard, which
gave rise to much controversy.
The escrowed encryption standard is
probably better known as the Clipper chip
initiative, anybody knows about
the Clipper chip.
OK, a few people.
So I will explain a little bit because I
think it's important to know this history
in order to put what is happening today
in context. Also, I think it
might give some
some ideas also about the revelations
that Snowden gave us
how the policy
was influenced by the failure of this
initiative.
So the Clipper chip
initiative was named after this
device, which was
if the standard would have come to bear
to be implemented in all
telephones
in the U.S..
And the chip basically
had two functions.
It would allow encrypted voice
telecommunication and at the same
time, what they call lawful interception
of set encrypted
communication
via the escrowed keys.
So basically, there was an official
and and
uh, well and officially
acknowledged backdoor built
into the crypto in this
chip so that
if a warrant was issued, uh,
law enforcement agencies would
be able to
eavesdrop on the communications done
by this device or done over these
devices.
Um, the case would be
escrowed would be held by
government institutions.
Um.
It is, uh, much less
widely known that there was a second ship
called Capstone, which
basically implemented the same crypto
protocols but
instead of telephones was supposed to
be implemented in personal computers.
Capstone Besides
the capacity to encrypt and decrypt
online communication,
would also have implemented the set
digital signature standard.
Oops, wrong way.
So this is an implementation of
this is this is one of the
devices that actually contained the
capstone chip. It was a PCR,
a that
was actually sold on the market and
where you were able
to use
this crypto chip
on there it
was. It actually found it
was actually implement, I think, in some
military contexts
anyhow. So Capstone
was supposed to implement digital
signatures, and
the official press release in this
context reads here.
The National Institute of Sanitization
has been developing digital signatures
technology that would provide a way to
verify the author and send off an
electronics message.
So this is the important part here.
Um, mostly in public
folklore, when people talk about the
clipper chip, they talk about
eavesdropping.
And basically
bugging telephones.
But the the
proposal that the Clinton
administration basically made
and try to implement had
watch ahead a much wider scope
besides those lawful
interception eavesdropping capacities.
This program also envisioned
digital identities
for the US citizens based
on a officially recognized
and officially implemented
cryptographic system, with
ciphers provided by the government
in this case, by the end, actually by the
NIST, the National Institute
for Standardization
and the NSA.
So the NSA was publicly
part of this program.
And and uh,
you will find in all the documents
mentioned that the NSA approved of this
algorithms to be used
here.
So basically, and that's why I said it
might illustrate some of the developments
that we are seeing today.
The NSA acted in
the open and set
in not only NSA, basically the U.S.
government acted in the open, said we
need encrypted communication
for our citizens to enable
them to conduct business
and so forth.
Cybercrime and you know all this.
But at the same time, we
need to be able to intercept
and control those
cryptographic communications
and thus
we are offering.
And it was a proposal was not
a law that actually got enacted.
We are offering a
public key cryptography infrastructure
for basically
the U.S. situation that
would allow both, on the one hand,
secure communication, on the other hand,
lawful interception.
Right. So of course,
few people in
civil society actually liked this idea,
and the opposition against
this policy proposal was one of the
formative campaigns for
the Electronic Frontier Foundation.
Also, the business community
opposed this project strongly
because if they feared
for their export chances, if
every computing device made
in the U.S.
would contain a government backdoor.
Right. So eventually,
the whole thing fell apart
and never came to bear.
So we're now in roughly
1996, and this is the US
situation.
There is a well-funded
and and,
uh, high
level attempt to create digital
identities, which basically,
um falls apart
because of the
way this was set
up at the same time,
um, in Germany.
This is how McCaul. I didn't find a
better picture with this nice and
from from the election campaign,
uh, secure into the future.
It's what it reads there.
At the same time, the Homewood School
Administration actually
tried
to implement their own digital identity
regime and actively
discussed this during the most
part most, most of the first
part of the 90s and
very late in during
his term.
How do you say you?
Um um
uh.
The administration
enacted the information on some
communications deans to Gazette's
UDCA, which contained two
so-called signature Gazette's
and two signature Gazette's, which is
basically valid to the state, has been
changed a couple of times provided
the legal prerequisites to create a
digital equivalent for handwritten
signatures and provided regulation
for the implementation of an officially
recognized public key infrastructure
in Germany.
Unlike the US system, there were no
provisions for key escrow,
but the government would create and
maintain the root institution.
And, of course,
hold the root case from which all
officially recognized digital signatures
in Germany would have to be derived.
The signature, because became law
on January 1st, 1997,
and the German government
boosted it as the first digital signature
law worldwide and somewhat
naively, the German government
expected a white stripped of
widespread adaptation of digital
signatures and envisioned a system
where people would voluntarily use those
signatures
as to official address for
transactions like legal contracts
for e-government and also
for health care and
other welfare state provisions.
And they've actually pretty lofty
e-government, uh, visions
which never came to bear and
also the uptake in the market.
Um.
Basically did not happen at all.
The German government, however, continued
to promote and develop
its digital signature vision
and programs as
the solution to the internet identity
problem.
And in the following years.
So from 1997 on,
um, quite some, uh,
quite a bunch of pilot programs
were initiated, which
are relied on smart card systems,
which basically implemented provisions
as outlined by the signature visits
to signature law in English.
So in other words, by 1996,
the German government had decided that
rolling out a public key infrastructure
and providing digital signatures to
submit to German citizens
is an essential aspect
of digital politics.
And despite many setbacks
and at least four different
administrations in power since then,
um, this vision is
still division of the German government.
So the second wave
of digital identity policies of
state sponsored digital identity policies
is basically the last decade.
And in this context,
I will
solely speak about the German example
because interestingly,
in the US, not much happened.
And I believe that after the Clipper chip
debacle and also after 9-11,
um, other things were
more important.
And nobody really dared to
touch this issue again.
Um, and also
there were fears of interfering with the
explosive growth of the IT sector.
Um, nobody really wants to touch
that market because evidently
at least the market was functioning.
Even from a government perspective,
the inability to identify
people in a legally
valid way remains.
So, uh, except
some ill fated attempts by the Bush
Bush administration to piggyback
a digital signature initiative on the
Real ID Act in 2005, there
was no large scale
policy approach
to
towards providing digital
identities.
The situation in Europe is different
in the last decade.
By the mid 2000s
2000, most European countries were
pursuing some sort of smartcard based
identity system because most European
countries have identity cards
like the German identity
card.
And most countries
tried to transition those cards to
to chip cards to smart cards
and use those smart cards and some
some way or another to implement
digital identity solutions.
In Germany, this was
one of the main, uh,
policy areas of the
UM
ruling Red-Green coalition of Chancellor
Schroeder, which enacted a number
of bills with ambitious programs to
provide German citizens with smart cards
holding digital signatures.
Most of these laws were based on the
specifications given by the
aforementioned signature Gazette's,
but included some alterations made
necessary by the European Union's
Digital Signature Directive from 2000
2001.
Basically, the European Union
said the German signature
Gazette's from 97
makes unrealistic
assumptions on the necessary
security levels for digital signatures,
for example, the trust centers.
So the secondary trust centers
that like that companies like Georgia
Telecom also would run, uh
uh, needed to be
of such high security level that they
were economically infeasible.
This was one one of the things that the
European Union
criticized and which had to be changed
into German network assets.
This would administration initiated three
projects in Germany, the elected electron
and others, which has Vice,
which is the electronic ID card.
Today, it's called a new
passenger list was because some
sort of PR agency
did some research and found out that
electronic im,
uh, has some connotations that
people that make people suspicious.
So noia personalized license nisi,
which just means new personal
I.D. card.
So one of the project
was the electronic and almost was
second project was electronically was
sometimes called electronic health care
card, and the third project was the
so-called job card.
It has analysis which you see here with
the former Minister of Interior Otto
Shealy.
It's the idea that every German is
expected to have um
and um,
which actually most Germans also own.
There's actually no obligation to have
fun. You just have to have either a
passport or an ID card.
Um, but most people in
Germany have have this
I.D. card because it's
it's used fairly often.
So the
legal prerequisites of the of the
electronic ID card when acted
in November 2012 and
2011 in the so-called anti-terror
law, which
basically which, whether
basically used the chance
of the impact of 9-11
to say We need electronic
ID ID
media because
it makes it easier to find terrorists.
It's the usual story.
The system, of course, and
the law have been been shaping
up for a much longer before.
It was just a good chance
to to enact it.
The actual roll out of this
electronic identity card
only took place since October 2010,
and by now around 20 million
are rolled out to the German citizens.
And in another 10 years, all
18 million German citizens
should have one of these in their
pockets.
This I.D. card contains a chip which
again holds the private key
of a
digital signature infrastructure and
authentication infrastructure,
which also can
be but not necessarily
linked back to the route maintained at
the Buddhist Nets. I Can Tool, which is
an official institution
that does the oversight on
of the public key infrastructure in
Germany.
So people
actually have those things, they just
don't use them, right?
This
there is absolutely no digital
uptake in the electronic
identity and digital signature
capacity of this capability
of this electronic ID
card.
Still, I think it's an important part
that the roll out takes place and that
the government
still maintains its stance that this is
important.
Also in 2003 and in
2003, two years after the
anti-terror blog, it's another piece of
legislation of the Red-Green
Coalition of the past,
and that was to gazette, so one is
using the existing King Faisal.
So this is the law for the modernization
of the, um,
what is this health insurance, right?
This was part of the famous agenda 2010,
the 2010 efforts of reforms of
the welfare state.
And in a way, it's an even more
ambitious project.
And it just showed Electronics
Shop hasn't lost face
because this law
basically. So you see, it's what is
it article?
Is it actually on there?
Oh, no, it's it's not listed.
I think it's an Article five and on
disputing pixel
tags. It's
because this law mandated
that every German would get
such a card.
The electronics contact's card electronic
health care card
Since Germany has universal health care
since actually 1892,
Wellcome America in modernity
this means that every German
will get such a card.
Without going into too much detail,
this card is basically the front end
of an ambitious e-health infrastructure,
including electronic health records
for every individual.
And
if actually coming to fruition
would probably be
the biggest.
Electronic identity system worldwide,
the card is being rolled out since
2011.
By now, there's 25 million
of those out there and they
expect to total roll out within the next
two years.
So the important part here is
that the digital signature
on this card is compatible
to the digital signature on the new
personal office was on the electronic
ID card.
It's basically the same system
and you can use them, vice versa,
at least in certain
in certain parts of the system.
So.
Second,
again, here is the issue
that even though this system
was mandated by law to be in
place and up and running
by 2006, the actual rollout
only started two years ago
and the e-health infrastructure
envisioned in this program is actually
not implemented yet,
partly because there was fierce
opposition by the medical community
by doctors which
feared the Gleeson, a patient,
a transparent patient, which I think
is actually not true
because the privacy
infrastructure that is
part of the electronic records onto its
cadre is
a fairly sophisticated and interesting
approach of of dealing with the
privacy issues in the medical
context.
But what it would definitely
enable is to make the medical system
much more transparent than it is today.
And that was one of the reasons why it
was implemented because the government
basically drops 250
billions each year into the health care
system and has no good ways of
tracing where that money goes.
And basically, medical
community in Germany has managed
to slow
down at least the implementation
of this project and is actively trying
to prevent UM.
Well, be cautious here is
actively trying to prevent to becoming
more transparent than it is today.
OK. Ten more minutes, we need to rush
the third part of.
Those aforementioned
three policy projects by the Schluter
administration was the so-called job
cut.
And let me go back to this interesting
for the German listeners because the
agenda 2010, the social welfare
reforms enacted by Schluter
have been much disputed
and they go back to the parts of them.
Go back to this
report by the Commission for
Modern Services in the Labor Market,
the so-called Hartz Commission,
which basically
led to the Hartsville, uh,
framework and so forth.
And if you look at this long list of
of things that that that are mentioned
there, you will see they
actually can't really see it here.
You probably can't either.
Oops.
That it says signal to a car to on
here.
Right? So you have all kinds of things
fertile air passenger service are going
to a vital building, uniquely your job
center, whatever the usual welfare, state
uninsurance, employment issues, right?
And among this, in 2002,
they have signaled Toccata.
Right.
So again, in Germany, will
you see that basically
the welfare state is being used as a
medium, as a vehicle to implement digital
identity?
Right.
And
next to universal health care, we have
universal unemployment
insurance also since 1892.
And as part of this unemployment
insurance, employers
have to report the working hours
and the income of the employees
to the insurance entities.
And this is done on paper
to this day, and Division of
the Food Administration was to
do this digitally and to system
to do this had the name Eleanor
Electronica and get in.
Actually, this would have not included a
cart because the Gesundheit
cart and electronic shop hasn't.
All sides would have had the signature
necessary to use the system,
so.
There are some pictures of job cuts if
you start to look around.
It was called job cuts before it was
called Eleanor.
But basically this was a cardless systems
which would use the existing public
infrastructure provided by the two other
courts to function.
Eleanor actually
didn't come to bear because of the
privacy issues.
In this case, there would have been a
central repository for all the data that
was to be collected
for the unemployment insurance, and the
privacy risk were deemed to be too high,
and it was considerable political
opposition to the system
and eventually it was scrapped
in 2011.
There are no new ideas how
to do this. So expect
in the next two or three years some
new proposals how to reform
the unemployment insurance and
how to give it a digital infrastructure.
So wait a minute.
OK. So basically my point here
is that between 2000
one and 2010, roughly
we have a second wave of
attempts to create digital identities,
at least in Europe and especially in
Germany.
That is to use the welfare state
as a vehicle to implement public key
infrastructure and
have
a situation where you actually have use
cases where the populations, where the
citizens need to use that system
because people deal
with welfare, with the welfare state
and its provisions quite
frequently in their life.
Right.
Again, at the same time in the US,
there's nothing really publicly
visible.
The private sector does interesting
things, though there is a
there isn't, as some people
will know, as lively debate going on in
the US between 2000
2010.
Competing systems for online
identity federation,
lifting debate about cryptographic
protocols
and some companies folks
in this case, actually Microsoft,
at least for some time, taking a very
progressive stance with Kim Cameron
publishing the seven loss of identity and
so forth.
But on the government side, not much
is happening this time frame.
Also, at the same time, what happens in
the US, of course, is and not
only in the US basically worldwide is
the rise of social media, Facebook,
Twitter, Google Plus
and so forth and off smartphones.
So the I.T. landscape changes
tremendously and especially with
what boost Bruce Sterling
called the stacks.
So Amazon, Facebook,
Twitter, Apple
and Google.
You have a massive concentration
of online activity
with very, very few actors which
are based out of the US,
which basically
are India in the position
to identify people or
to provide identity services.
And this will come to bear in the third
wave, which I will not now talk about.
And I believe we are now entering
the third wave in the in
the last two years, basically since 2011.
So it's almost 2014
now, which is actually 20 years
after the Clipper chip initiative.
And as I said, we are looking back at
almost 20 years of basically
failed attempts by a
nation state to provide digital
identities, clipper chip failed
signature visits and all
those lofty visions of
results, card electronics and space and
so forth. I just mentioned also failed so
far.
There is there is no real uptake
because this use case, the systems
are complicated and so forth.
But still, I would assert
that the nation states have
not given up pursuing
their vision of creating basically
public key cryptography based
digital identities for their citizens.
So let me ask a little bit
of stuff you.
So spare you the Declaration of
Independence of Cyberspace, which as you
probably all know, there's an interesting
little note in their own identities,
which I think have completely been
invalidated by the current developments.
In 2011,
the Obama administration published
the National Strategy for Trusted
Identities in Cyberspace, enhancing
online choice, efficiency, security
and privacy.
What is? And the acronyms
and stick.
So if
you look for this, you will see and still
quite often, um,
basically. And stick is there is an
invitation to civil society, to
businesses and also to government
entities to engage in debate
on the necessities
and formats of implementations
of digital identity protocols and
formats.
In a way, I think it's a regime of the
responsible ization
of the Society for the Problem
of Digital Identity and delegates
the thorny issue away from the states
into the society.
At the same time, the
U.S. government, of course,
takes part in this debates and
is an important stakeholder.
Give me a second.
So.
Oops! This is actually not readable.
Sorry about that. So you see Barack
Obama's signature down there.
And the first paragraph here
reads, As a nation, we are addressing
many of the technical and policy
shortcomings that have led to insecurity
in cyberspace. Among these shortcomings
is the online authentication of people in
devices.
The president's Cyber Space
Policy review established trusted
identities as a cornerstone of improved
cyber security.
So the end stick
process is supposed
to solve this problem, right?
Furthermore, the unstick this is
still quotes from the same
document states that central
to the strategies of protest, a
conviction that the role of the
government and receiving the identity
ecosystem is critical and must
be carefully calibrated.
On the one hand, the government should
never over the final overregulate
existing and growing market for identity
and authentication.
If government were to choose a single
approach to develop the identity
ecosystem, it could inhibit innovation
and limit private sector opportunities.
So it is.
I read those quotes to you because this
is this contains
important policy directives
which differ from what the European Union
attempts to do, as you will see
in a second.
So it says.
The role of government is critical, and
at the same time, the government should
keep some sort of hands off
approach.
Furthermore, on the other hand, the
current market for interoperable and
privacy enhancing solutions remains
fragmented and encrypted in it,
and its pace of evolution does not match
the nation's nations meet.
So far, the problem statement?
So how should in the US
contexts and identity ecosystem
come to bear? As I showed the European
approach, the German approach is
basically to
create a system where the state
issues use some sort of
cryptographic credential,
which which enables us to offer,
which enables you to authenticate
yourself online.
The US, at least when
when one would believe this paper
will take a different approach.
Ultimately, the identity ecosystem can
only be designed and built by the private
sector.
So think about this for a minute.
What does this mean?
Right?
This means and I understand
I read the end stick basically
as an invitation in this context
that the U.S.
government encourages
the private sector.
For example, the aforementioned
stacks, Amazon, Apple, Google
and so forth to actively
engage in developing and
building an identity ecosystem.
The government, Fletcher said it
will support it
and ensure that the identity system
respects privacy and supports
civil liberties of the individuals.
And it also
asserts that they will implement those
this identity ecosystem within
their own institutions,
within their own services.
Currently, the debate on how
this ecosystem is supposed to be built
is mostly taking place and Identity
Ecosystem Steering Group,
which is a public private partnership.
And if you look at the membership list,
it's it's really impressive.
Yes, it's it's it's a
very, very long list.
And basically everybody, you would expect
us on there and also everybody you
wouldn't expect, like the American Civil
Liberties Union and the Electronic
Frontier Foundation and so forth.
So I'm running out of time.
I have to clean up.
Just skip through this.
So
another important point I want to
raise awareness to in the context of the
stick is there is
there is something interesting
going on in this document when it comes
to the question of where
is the identity actually generated and
who controls that?
Remember what I said in the first part
that nation states basically monopolized
the registers historically
and the European?
And the German example shows that
this monopolization is also taking place
in the context of digital identity
provisioning.
In the Antarctic, it's very hard
to find out what the actual role
of government issued identity
credentials like birth certificates,
Social Security numbers and all those
things would be.
And they talk about identity media
is available in many formats and so
forth. And then there is this
little footnote on Page five,
which basically says for sworn
statements transactions, you may want to
know their true identity.
No, no. What is the true identity?
If you look into this document, you won't
find any definition of true identity.
You will find all kinds of crypto lingo,
which is really interesting.
And it's worthwhile reading because you
get a very, you know, plain
explanation of, you know, what
credentials are and non-personal
entities and so forth.
But here there is true identity.
So what?
What might that be?
On Page Eight, it says the threat of a
strategy and is important.
Fido belief does not exploit.
Not sorry.
Does not explicitly address identity and
trust issues in the offline world.
However, offline online identity
solutions can and should complement each
other identity proofing,
verifying the identity of an individual
and the quality of identity.
Source documents have a profound impact
on establishing trusted identities.
What are identity?
Give me a second identity source
documents.
Again, just like two identities,
this is not defined within the unstick
documents, I haven't found any definition
there. Some online debates about this,
which is interesting, but
I believe what this
actually means is that the government
says, and it's totally
logical to say that I don't want really
scandalize it.
What I want to scandalize is that this is
not debated in the open, as it should
be, that the government
basically remains
the entity which will issue the
source documents for true identities.
Right. Which would keep the registers
and those source documents might be birth
certificates or something similar.
Right.
All the stick in a way does is
to invite the interested public
in a debate, how to render
digital credentials on the base
of the source documents, and how
to how to generate
an identity ecosystem
that makes both authentication and
privacy possible.
Right.
So in a way, if you think,
uh, think about it in
the context of crypto lingo, the state
remains the root entity that provides
the initial authentication
on on which basis to all other
follow ups of authentication
should take place.
OK, we're almost out of time.
Just let me jump to Europe.
European Union third wave.
Um um.
The indicator that the third wave is
happening in the European Union is the
proposal for a regulation of the European
Parliament.
Forget it
of electronic identification
and trust services for electronic
transactions in the internal market.
Um, so the European Commission basically
2012
floated this document and started
to engage in a discussion of how to unify
the existing many electronic
identification systems of the member
states.
As I showed you, Germany has a really
ambitious and fairly sophisticated
ID card system, electronic health
care card and so forth.
Other European member states
have similar systems like France,
Austria
and most of the Scandinavian countries.
The current situation is that
this, um
uh, that these systems are completely
incompetent or mostly incompatible,
and especially not, um
are not facilitating
Inter European digital transaction
based on the identity, uh,
provisions these systems give.
So what?
Com Thirty eight to thirty eight tries
to achieve is a
harmonization of the
yes is a harmonization of the
existing identity systems
of the applicable laws and to
force member states to make
two systems compatible compatible.
It does not mandate that member states
actually implement their digital
identity system.
So the European Commission
does not say to some country that doesn't
have a system like that, you need this
right? It just says if you have
a system or if you start to build up
Electronic Identity System,
it needs to be compatible with
the other European systems.
Um, and of course, there's an important
industry policy
aspect to this because
this is a market of 400 million people
and is quite some
businesses in the European
Union, which compete to
provide the services and into necessary
hardware.
OK, I have to stop here, I guess, and I
will take questions
now. I can talk a little bit more about
2:38, if you like,
but so far there is
not much really interesting in there,
except that the security
level that, for example, the German
system would provide, uh,
would not be,
uh, would not be maintained
if this commission would not be
maintainable.
If this commission proposal would come to
bear, they would actually lower
the security level
there. Thank you.
Oh, thank you.
Christopher Engelman, OK.
We have now, I guess, about five minutes
for Q&A,
so there are some people already standing
on the microphones.
And are there some questions from the
internet?
There are no questions from the internet.
So stream what are you doing?
OK.
I think we will start with microphone two
because you stand there the most time.
Yeah, thank you.
Thanks for the interesting talk.
I just had a comment about instead.
So I do understand the reason why they
created it that way.
It was when the person was appointed
to work on this stick.
He he had no experience in
India's identity management space,
and the whole work was delegated to Nest.
Yes. And the nice guys.
However, at that time they had a project
on going on smart grid
and that was supposed to be considered
to be a very successful effort.
And so they had this notion of private
public partnership, which was then later
copied into the European Commission
in various other efforts.
And they looked at talk
to those guys and then found out that
they actually in they had guys who
worked on, developed,
wrote the specification for the public
key infrastructure theme park in
particular, and here to understand some
of the terms that you highlighted.
This are true identity layers
of assurances, identity proving.
There's actually a document that theme
park had written in the
special publication 863.
And that explains what some of those
terms mean.
And it also explains
what the role of the government is in
that space.
And what it's supposed to be doing is to
create policy documents
that explain what you have to do
at the specific levels of assurance,
different security levels
to fulfill the needs of the government
for specific applications.
And so while that's all great,
it's a great idea and also sounds
possible given that you have two identity
providers already in the U.S.
established, which doesn't exist in
Europe to the same extent.
So far, it had failed to, even
for the U.S.
government as a consumer to actually
make use of their own technology.
They had been coming up because there are
already policies available for
themselves as customers.
And to my knowledge, none of those had
been so
far in use
in what was the last part.
So none of those are sort of these
trust frameworks and the technologies
they had come up for themselves.
Not talking about for the citizens
like for themselves less as US
government within their own
infrastructure, within their own
procurement processes,
even the deployment prior to that, the
public key infrastructure they had
created, which was one of the largest in
the world they hadn't
ever took a very long time and had been
very complicated.
Mm-Hmm.
Thank you.
I'd like to talk to you after after the
Q&A and thinks so.
Okay, thank you.
It would be great if you have some,
some shorter questions, please.
So because we have not that much time,
so I guess three minutes left.
So but if you can
ask your questions here, I guess you
will have a discussion later.
Over there? I guess so.
Microphone one, please.
Thank you. I think one thing that
is very important to to
see the difference is that
when someone makes
activity in the web, it's not the
identity that makes this.
It's the person who holds the card
to this identity.
So it's not a direct a direct
link to a person, which is which cannot
be changed.
And I think we should we should
keep in mind that it's not OK, that
it's not a good idea to
chip an individual from
birth to death with the number.
I think that there was activities in the
past in our history from
a very bad regime that we saw
that it is bad, but results of
doing this. So perhaps
how do you think about making
these kind of identity more
temporary thing?
So like when I need a taxi, I
call a taxi and I get a taxi for a
temporary time and I give it back them.
So when I need that
identity I.D.
for internet transaction, I can go
and get some more temporary time, and
then it expires.
But what do you think about such ideas
that such an idea does not
last for the whole life?
It's just for a temporary time?
Yes.
Well, in no way I wanted
to sound affirmative of everything that
is happening. That is was rather meant as
a description, on the other hand.
Governments have this idea of life
courses and of
the necessity of a lifelong
viability. Of an address of an
individual, which
even more is even more important if you
have a welfare state which actually
supports the life, biological
well-being and so forth of an individual.
So creating temporary
identity identities is
in a government context, not feasible.
And how to solve
this problem of,
on the one hand,
the desire to have temporary identities
and not have a fixed identity and
governments needing that, that's
difficult.
OK, so I guess one
last very short question,
and then please have a discussion later,
so we're out of time, actually
trust me on this one.
Oh, OK.
Yeah, you want to hear this one?
So first, Amos statics,
Can somebody verify me?
Yes. OK, good.
Thank you.
I say this because I believe I'm the
first pseudonymous member of the
Instigator ESG Group,
which has created a number of interesting
discussions within that group,
by the way, regarding the first part of
the talk with regards
to the American perspective.
One of the key differences between Europe
and America is that the United States
does not have a national I.D.
and this has led to some of
the confusion within that truth.
And it's also worth noting that the whole
true idea your true name thing has
been a major topic of discussion,
which leads to the question I want to ask
right now or within a
year she announced it.
We were doing a lot of discussion on it
terminology and taxonomy,
and I was wondering if you had any
pointers or if there was a list of things
that we could possibly learn from to
collaborate with.
So thank you very much for the talk.
Thank you.
From the top of my head. But maybe talk
later in. I think about it.
Listen.
Yeah. Well, just the short question.
OK. Come on.
There's just too much identity could be
a for privacy, but
you're creating, I think, a class of
hunter mentioned who don't have an
identity and don't get to get an identity
card, they are almost out at.
Some citizen analysis will not give
Social Security numbers to Bulgarians or
Romanians who don't have decent housing,
so they won't be allowed to pay taxes.
Yes, strangely.
Have you comment on that?
Well, of course, the
like every identity infrastructure,
if it's paper based or digitally,
is a system that differentiates
between people who are part of
the system and people who are outside.
And in the context of paper based
identities, there's this notional sop up
here of people without paper identities.
They
foolishly admit refugees.
Thank you
who have a hard time living their
lives and managing because
they are without papers and.
What some or saw signature?
Well, if you want to call it would mean a
digital context.
It's interesting and
also very scary question we need to think
about.
OK, thank you. So give them a last warm
applause.