From First Mover to Blueprint: Lessons from Bhutan’s Decentralized ID

Transcript

Hello everybody. Is it working? Yeah. Thank you for joining us today. Um, so at the Geneva Research Lab for Digital Impact, we look at what it takes for digital transformation to deliver meaningful, inclusive and sustainable impact. So we look beyond the technology itself at um the governance, the institutional, the economic and the human um components that that enable technology to succeed in delivering that impact. Now a few years ago, uh Bhutan set out on a journey to develop and deploy the first uh national digital identity system that's anchored to a public blockchain. Um today more than 95% of the eligible population and

around 30 services and agencies are using that technology. So naturally at the Geneva Research Lab for Digital Impact, we've spent the past few months trying to understand that journey and writing a case study about it which you can find uh using the QR code behind me. Uh it was published just last week. But today we are with Kinzang and Chendu from the Bhutan NDI technical team and we'll walk through that journey together. So without further ado, first question. Um could you tell us a little bit about what prompted Bhutan to embark on this journey?

>> Uh hello. Okay. Uh thanks Emma and uh Defcon team for having us here. I am Gang Doji and I lead the technical team behind Bhutan Ndi. We built a digital identity platform uh for our country uh that is based on principles of self-s sovereign identity which is actually inspired by the vision of his majestic king of our country. The platform that we built is used by organizations to issue and verify credentials as well as we uh build wallet app that is used by the people of our country which is actually used in a mobile device.

So since the in inception of Bhutan NDI, so we have the the architecture uh that has been developed for Bhutan NDI is a decentralized one and based on the principles of SSI the data actually sits with the user so that the user has control over their own data. So uh I have uh we are here with uh I am here with Synindu. So we are happy to talk about more uh in the next uh I mean the follow-up questions.

>> Thank you. And I think it's a really interesting paradox, right, that uh his majesty the king who represents a very centralized form of leadership was such an advocate for uh such a decentralized form of identity. And I think um it shows that with strong leadership, you can really advocate and push for um more private control of of citizen data. Now, as I mentioned, this is the first um initiative of its kind anchored to a public blockchain. So when Bhutan set out on this journey um you could look at other count's national digital identity systems such as Singapore, such as Estonia and you could also look at um the private sector that had implemented decentralized technology. So you could

share could you share a bit about what the learnings were from those different contexts and then what you had to adapt or rethink for national public infrastructure. I think uh when we started the technology was new so we had to learn whatever we could and Singapore and Estonia were the obvious reference. We learned that the identity matters only if the services are built around it. So the user should be able to do something by using the identity service. And the thing that we differently is the like where the data actually lives.

Unlike other systems for us the data lives with the user. So we have a wallet app which has the credentials of the users. So the the verification happens directly between users and the service provider. And I think for us we have been the our country was the first country to deploy the SSI SSI based identity at a nation scale and we had lot of lots of challenges and we are still learning actually and we try to do our best to make the national infrastructure more stable so that the users can use it seamlessly to get to access the

services. >> Thank you. Um and during these past few years, I know that the technical architecture has also evolved, right? Including a transition from Polygon to Ethereum. So, could you speak a bit about um the reasoning behind that decision and could you tell us now what role Ethereum plays within this broader NDI ecosystem? >> Okay. Hello. Okay. Um first of all, uh thanks Emma. Uh that's a wonderful question. So before that one like let me introduce myself. So I'm Sunundi Gson and I'm also one of the technical lead at Bhutan India and I've been working uh at Bhutan India for more than four four

years and u like uh like like you rightly mentioned like we had a lot of transition and migration uh since we we were the first uh adoption of SSI and like because the uh technology has been like keep on changing so we were first company or the digital identity to use the Hyperledger Indie actually. So, so like um that Hyperledger Indie uh the company who was supporting us went shut down and then uh we had to migrate to another um supported technology. So, we went to the Polygon.

So uh during that time like we also migrated to have migrated to uh W3C verifiable credential because like it it is a subsupported more uh interoperability uh with the other countries and and after that we we move to the Ethereum blockchain. So the the reason uh to move to this blockchain is because like Ethereum has more the diverse uh u uh support and also like we also our India also wanted to have a strong foundation on those technology and uh and the the the question that you have asked about the the reason behind the enchoring to this Ethereum is like um we store the

public registry of our organiz organizations like the public date of the organization who uh who wants to onboard as the issuer inside the entire wallet and also we also store the credential definition we call it which is basically the schema template of the um verifier credential but we never store the public information inside the inside the blockchain. So, so that blockchain is used during the verification process especially like holder wants to share the credentials uh to the service provider. So those uh signature of our u the digital so we call it as a de actually which is basically the decentralized identifier.

So those kind of metadata and the D document to verify those signature are only kept inside the public blockchain which is Ethereum. So so it is a strong foundation of the of the blockchain. So we use that Ethereum as a as a blockchain and u and um and also like to transition to this blockchain. So so we had uh we had still has to support the polygon network also because like some credentials are still in inside uh in still inside inside the uh wallet of the polygon network for those users. So so like we have to to give some uh time for the user to migrate. So, so it was um like a very hard hard deadline but like we we have like now like I I can say

that it has been migrated more than 90% of the of the user have already moved to the Etherum blockchain but still polygon blockchain is still supported for the for the user who still wants to use the polygon blockchain. I think uh just to add on what Cindu Synindu said about uh the transition from polygon to Ethereum blockchain the journey was not easy actually since the architecture that we use is a decentralized one so it's not just a flip of switch so it needs to be based on the consent of the user since the data lives on the user's end so we make the migration optional uh in the sense that user can choose to migrate the

credential or they can still use the polygon credential. So in that sense user until uh unless the user do the migration although we have set certain deadline to not push the uh user but the migration remains optional for now. So the new credentials gets anchored on the Ethereum blockchain whereas the older credentials that still resides with the user remains valid. And the main role of blockchain for us is that I think uh I want to uh emphasize on this one because one misconception that I have observed is that uh people assume that everything goes to blockchain which is actually not the case. For us, we use blockchain to store only the public information like

identifier and credential definition of the issuer. The main the personal data uh lives only on the users's end. So that's how the architecture has been designed to uh make the system priv privacy preserving as well as ensuring that the security is preserved. >> Thank you. Very interesting. And I want to jump back to something um that you just said in a question. But before that um I think one of the things that we learned from the case study is that technical um sorry decentralized tech is not the same as decentralized responsibility. And I think one thing that's really important that Bhutan did was um at the same time as it developed

this this technology and the technical systems, it also developed the legal and the governance frameworks but also the enabling infrastructure that allowed uh this self-s sovereign u identity system to succeed. Um and so I just wanted to ask um what for you are some of the key enablers that really enabled this identity system to be successfully implemented? Uh I think that's a very important question because when we started the technology was only at the P or a pilot stage and the main challenge for us was to take that concept to a production at a national scale. So that has been the major challenge for us and to achieve that one actually there are certain

critical component for Bhutan NDI we had NDI act 2023 because we had a great support from the very top so that's important for a program like this and in addition to that one I think uh the agency uh I mean the decision makers are important for this one because the there needs to be someone who can decide like what kind of issuer is supported in the ecosystem and what kind of credential can be issued. So those are some major enablers that for us to make the make it a national infrastructure.

>> Thank you. And I think that's really interesting because in a lot of um technological innovation there's often this struggle to jump from the pilot phase to a more uh sustainable um and widespread adoption right what we call the valley of death. And I think if it were not for these parallel processes happening at the same time, potentially Bhutan would have faced a similar challenge. >> Um now earlier you mentioned that citizens had uh the choice to basically migrate their credentials to Ethereum within a specific time frame. And I think that takes us to another really important element which is adoption. Um and here if we use it economic terms right there there's what we call the

network effect where the technology itself becomes much more valuable the more users adopt it but for adoption to happen it usually entails a certain level of understanding a certain level of trust um and users also need to see the tangible benefits. So could you walk us through a bit uh what was needed for this trust to be developed and for uh users to be encouraged to adopt the solution? >> Okay. Uh for that one like uh like building the technology is the one thing because like uh uh like we are the one uh to build the first centralized identity system and uh like citizens don't understand what what product is

also like to build the build the trust and um it was the first component is the user experience and al also the the trust about the privacy and the sec security. So, so like uh like what we uh did was like we try to make a seamless access on the on the user the device. So the onboarding process, the verification also also the the credentials that needs to be issued inside the holders wallet those kind kind of advocacy has has been uh done through the this social network our uh through the uh we call it as a but it is a community center volunteer who uh travel through the remote places

of the of the country to uh teach them how to use the uh uh teach them how to use our the digital identity system about the privacy the consent base how how it can be securely stored inside the wallet those kind of uh adoption has been done and like people uh had the difficulty in uh like uh understanding and also also the adaption and and the and the trust is some far far side that that people really think about because like our country like before like NJ come comes in like uh they shares their identity to any proprietor without their noation also. So like like it was uh

hard for the for us and they and also our government uh partners who were trying really trying to like give the importance of the privacy and all and the the reason the attion become uh more seamless is because like uh our uh government and also the private sector has played important role in in in us and uh that they are local de developers. uh who have been been like uh integrating with with with our system inside that financial system then private sector and also the our government uh citizen service portal.

So, so like like user were like uh uh able to like simply just scan the QR code and and then uh share the credential and uh they were they were able to get the access uh seamlessly and and and because of that one the uh the access and and the trust has gradually been adverted and now like I'm happy to say say that like more than uh like 50% of citizen have already been using the bud for the basic services from the financial just by uh financial system like opening the bank account then uh then accessing the uh government

services and all >> uh I think I'll add on to what Jindu mentioned uh first the main what we have observed is the main driver for the adoption I think convenience played a critical role there so uh Since I would say that it's a first step for our citizens in uh to avail services in a digital version before vhan before the Bhutan NDI the people have to visit the offices physically with their ID documents for let's say if they want to open a bank account they had to go to the uh bank office to open the account.

Now uh using Bhutan NDI they can simply open a bank account from their home which uh which is which can be instantly done online. So the convenience has uh has been the major uh driver for the users to use Bhutan NDI because it saves cost as well as time for them. And I think uh I would say that we were lucky because during the early phase there was a coit and our citizens like especially in Bhutan they got used to with scanning the QR code and using that one we actually made the we have built the interaction on on that actually on that interaction actually uh using this uh QR

code as well as dibling to access the services. So it was easier for the users to use Putan NDA because they were already experienced in using QR codes. >> Super. Thank you so much. Um now thinking more about the context and what uh other governments or entities can learn from this experience because I think we can all agree that Bhutan is quite a unique context right it's a small country. Um, I think uh all but one administrative blocks is connected to high-speed fiber. And I think uh for those of you that were at Christopher Fabian's talk the first day, we know that more than two billion people aren't connected to the internet today. We know that a lot of countries are much larger in terms of population, in terms of

geography. Um, and obviously every country has their own institutional context. So taking that into consideration, what are some lessons learned that you could share with other governments that are thinking of embarking on a similar journey? >> Uh I would say to be careful on coping the exact setup but I think lots of the thinking can be still carried over. For instance, like if the country lacks connectivity or smartphones or like a basic uh foundation setup where they have a registry of uh registry that has the information of the citizen then I would say that wallet is not the first problem. So they have to build the

foundation where they have the connect connectivity. Uh the users have the smartphones. Although there are certain uh solutions like where we for Bhutan as Bhutan India as well because Bhutan is a like mountainous country. So there are certain rural area where the connectivity is still limited. So we have uh developed solution like cloud wallet or uh like we have also used a biocrypto QR code with the physical ID card which can be used by citizens to avail the services. In addition to that one uh we also have community centers at uh in the rural areas where the users can go and maybe seek help from them to

get the services. >> Thank you. And I think that's a question that's very dear to my heart because I'm from the development sector. So all about inclusion. How do you ensure that those who aren't literate um digitally literate or how or how do you ensure that those that don't have mobile phones or access to internet can still partake in this? Um final question on my end. When might decentralized national identity not be the right investment or the right choice? >> Okay. So I will answer that one. Uh for that one like I would say say that like uh government should uh look at the infrastructure first like um especially

like uh if if the government have have a proper uh the database of the person information or not because like that will play a critical role in uh building the foundation ID for the uh this centralized um ecosystem because like uh for us like our country was lucky because like we have a proper uh registry of of the of the population like we it is maintained by the department of civil civil registration.

So so like for us like by birth only like um the every child is being registered at the department of civil registration. So like like it was uh easy for us to like on on board and and get the foundation for the uh boutin citizen but for for outside country like if they if they don't have those kind of uh checks and those kind of um personal information is uh is not maintained properly. I think uh we strongly suggest that it it is better to to first like establish those uh uh foundation for the for the user to unote on vote like uh

like maybe like some some other other countries especially like th and other like they during the covid like there there may be a a record for the for the vaccine vaccination during that time like people's registration have been done and and like those kind can can also we have for foundation but then like um like what what I one wanted to say is is that one is like foundation is very important for the bhutan ngi to um play play the role as as um as like foundation service but um we have other services like functional uh weber credential. So, so that is one thing and other other thing thing is is like uh it

needs to have um attion from from the people also like um and also also like uh some countries those who have limited internet and uh smartphone infrastructure uh that they can still be able to use the other other services apart from the uh NDA wallet those kind of things that they can use like like my colleague Kang mentioned like they can use the online services like a cloud wallet and all uh those kind of uh technology can be built aside from the entire H wallet. So, so if if the if the country can is willing to uh invest on the decentralized approach on the on the on preserving

their privacy like us. So, so it is um better to balance out on the people's adoption the the legal legal framework that the the government can support because like for for us like uh we have have the have the legal legal framework which has been accepted as as a as a legal in uh maybe like 23 or four I think. So uh those kind of legal framework that needs to be also be checked and also also it can be the political uh decision that takes a that makes a major role in in whether to adopt the uh new approach for decentralized approach or not. So that that is uh >> I think uh in terms of uh like countries

looking into adopting decentralized uh identity system like if the country already has uh like has a centralized identity based system or any model of identity base I think it's critical for the country to like weigh the cost of migration. So I feel like that is also a critical thing that needs to be considered if the country is looking into adopting decentralized technologies. >> Perfect. Uh we're in the last minute. So if you want to say a few closing words. uh uh I think the key takeaway I would want the audience to have today for from this session is that what we have experienced is that uh

blockchain is not the hardest part but what we have seen is that the hardest part is the uh law people and the patience that makes up the national infrastructure successful. So with this I think we are uh still uh exploring the technology. It has been evolving. Lots of new standards has been coming in. So we are open for any discussions. If you have any feedback, any suggestion or advice, uh comment.