How digital IDs are set to shake up the way we access services [Q&A]
Around the world governments are increasingly keen on introducing digital identity systems for their citizens. These are seen as a secure way for people to access government and other services as these move online.
We spoke with Philipp Pointner, chief of digital identity at Jumio, to find out more about digital ID and its implications for security and privacy.
BN: Can you describe the digital identity initiative?
PP: A digital identity system enables citizens to upload their driver's licenses to their mobile phones and use them at the growing number of physical locations that accept them. Many countries, US states and companies have already implemented digital identities and many more are likely to follow suit in the near future. Gartner predicts that at least one-third of national governments and half of US states will provide citizens the option to use digital identity wallets by 2024.
BN: Many governments around the world are launching digital IDs. Can you name some examples of a digital ID system that has worked and one that hasn't?
PP: One of the biggest digital identity success stories we've seen so far is Sweden's BankID. BankID was launched as a private initiative and was soon administered by the government once it became apparently successful. BankID has proven to be successful because it prioritizes the security and safety of users by leveraging quick and secure identity verification technology.
At the same time, there have been quite a few digital ID systems that have struggled to fully develop into secure, trustworthy systems. For instance, New South Wales in Australia adopted a digital driver’s license (DDL) system in 2019 that was designed to let users show their digital identity at certain venues, such as bars, hotels and stores. The government tapped into some pretty advanced security and privacy measures to protect users’ identities, such as a hologram that shifts when someone tilts their phone or a temporary QR code. However, researchers soon discovered simple hacking techniques could enable malicious actors to pose as other people by combining their own photo with stolen driver’s license details. So, the system was ultimately deemed untrustworthy and unsafe for citizens to use.
BN: What are some ways that fraudsters might take advantage of a digital ID system?
PP: Similar to any other digital advancement, a digital identity system introduces a gateway for fraudsters to start seeking new attack vectors, which only expands the attack surface. Due to the frequency of these attempts and the high level of sophistication cybercriminals possess, cyberattacks and fraud have become quite common. With identity fraud losses reaching $52 billion and affecting 42 million US consumers in 2021, these numbers are sure to increase with the rollout of digital identity systems across the country. The likelihood of a consumer becoming an identity theft victim will increase as they continue using their digital identity and sharing their data with different businesses.
BN: Can you weigh in on the privacy implications involved with digital IDs?
PP: Data privacy has been a leading area of discussion in the technology sector for years now. While technology has brought convenience for many consumers, the digital world also raises many concerns regarding their privacy. Digital identities will be no different, as governments and businesses would be able to track where a consumer has used their digital identity online and monitor their digital footprint. Third-party organizations that want to verify a user's digital identity may also want to contact the issuer to confirm whether or not their ID is valid. For example, a concert venue can contact the DMV to check if a guest’s ID is genuine after it’s presented upon entry. Unbeknownst to the consumer, governments can leverage this information to monitor when and where the ID was used.
BN: How can organizations and businesses work together to create a trustworthy system?
PP: A digital identity system will flourish only if governments and businesses can render it foundationally safe and secure. This starts with decentralized storage, where data resides with the consumer on their own device, such as their cell phone. With centralized data storage systems causing constant data leaks and breaches, companies that store consumer data in large databases are placing consumers at huge risk. Decentralized storage gives consumers control over their data.
Users must also have full control over what data is shared, who can access it and who it is shared with. Organizations that request a consumer’s digital identity must be transparent about what data they plan on using and must only collect the information they need. For instance, if a business needs to confirm a user's age, they should only be allowed to collect their date of birth and no other pieces of data.
Finally, all companies must implement cybersecurity tools that can guarantee every presented digital identity is authentic and ensure every user is who they say they are. A digital identity verification platform leverages a physical document of identification that is issued by a credible authority, including a driver's license or a passport, and compares it to a real-time selfie using AI and biometrics. This method proves that the user is currently present and not a fraudster posing as another individual with stolen information.
BN: How far are we from achieving a global standard for digital IDs?
PP: While many governments have implemented digital identities, it will be a while before others even adopt their own system. The holy grail for making this work will be interoperability on the issuing side, meaning that there cannot be multiple, unique digital identity applications for each organization. Instead, there will be a single digital identity that can work at every location across the globe. Thus, it might be a few years before we see a standard global digital identity system that is foundationally safe, secure and trusted by people around the world.
Image credit: ra2studio / Shutterstock