Making SSI Happen in Switzerland

Transcript

thank you very much for the opportunity to speak about this this is um you know very exciting we have so many people here obviously uh you know identity has a lot of interest and i wish there were more people because you know for me identity is the foundation of everything that we do around digital processes without proper identity without solving privacy issues scalability decentralizing it moving it from the paper world to the digital world i don't think we can advance a lot for blockchain applications or our everyday uh processes that can also be built on blockchain right so with that in mind we actually um slightly more than a year ago we set up you know adidas association and we're not a technology

company we're not creating technology we are a lot of passionate people lawyers educators companies startups that try to figure out well how can we leverage ideas from self-serving identity to solve some of the biggest problems facing our society and helps switzerland become one of the countries that is at the forefront of adopting it right for uh everyday processes so um i will actually build a little bit uh deeper on on the concept that were i mentioned by my predecessors uh it will not be technical presentations i'll be skipping some technical points and we can talk about them later otherwise i'll need you know two hours to to really cover this so so uh i'll start by uh the the the

actual task that that we are facing today as we speak so um how many of you actually switch swiss people and voting okay great so so many we actually know right so in switzerland it's quite amazing for me as a as a auslander uh so uh how direct democracy works in switzerland actually you you know every couple months there's you know the weekend there's big questions that uh swiss people you know consider and say i would adopt some law or not right and it's really happening and um you have to consider that uh swiss federation has been working for a number of years to create eid law right and just this march it completely shattered um

and and this is the you know screenshot of the campaign where people were basically like what are you proposing this is some sort of log on uh you talk about passports we don't want private companies to own our passports and you know it doesn't make sense to us which i think had some merits in it i think you know uh the whole education about this was wrong but now we have to figure out the next step right so what what are we doing because you know digital identity is actually needed so um ministry of justice and uh federal police so called fat paul they recently published a discussion paper um it's it's a very very nice paper i recommend you to read it they have an english version of it uh we're basically saying okay what what is the next step

okay you guys don't want uh uh login like we got the message so what do you want right and they they talk about different options uh and uh different uh levels of ambitions right so they say like okay so there's like three things we're considering right and we would like public to tell us which one is the one we need to focus on right and basically first one is just okay just a basic uh identity just secure identification option just basically okay just verify my name uh uh birth date and so on right the second one is okay can i maybe extend it with some additional government attributes like in its vigilant it's very common to go and and and get some printout for certain registries or criminal records or or the debts you

might have and things of that nature and the third one is like okay can we consider ecosystem of digital proofs right so i collect different attributes from everybody you know not from just the government but actually from all kinds of companies universities doctors and so on and use it right so so they're asking that question and then they're asking like okay so what kind of technology we should be using and we already talked about the fact that you know identity uh has been evolving and specifically you know identity has been um you know kind of existing in in in real world in an online world into different places and and of course when we try to bring this world together we have to consider where are we coming from and essentially you know what internet happened uh uh people knew each other right they knew each other's ip

addresses and they created hosts files right some of you might edit those from time to time right so they didn't want to type in those you know ip addresses uh with numbers but then it quickly became a scaling problem right so the dns system was created but the concern was not to verify who owns uh this thing is what to scale you know alphanumeric human readable uh monikers for ip addresses essentially right as internet became more and more successful you know email came about uh online applications came about and of course corporations they come together and created saml which we heard about as a sso federated identity but this identity right what type of applications i can work with you know my association with the company is

owned by the company that is providing you that or idp in commonwealth that is providing you that service then of course e-commerce came along social internet came along you know google meta whatever you know they providing open id connect uh uh type of services which is useful but they know everything about you they own the all your associations every application that you authenticate through that provider basically leaves a trace right and and gets attributes uh from them you have some sort of control but it's not very fine grade you cannot move the data and so on so forth and finally as an evolution of that in 2016 there came this concept of self-certain identity where the basic idea which i'll talk about in a second is to is to make sure i can collect my different

attributes and can present them the way i want uh and using zero knowledge proof for example if i don't want people to know my exact age uh or or or tenor in the company uh or exact uh amount of my bank account i can do that too uh uh depending on you know what my business says right and you know ssi it's very important to to understand you know why sometimes exercise confusing actually origins of ssi is a very philosophical idea right it's the idea that when i'm born into a world right by that very fact i actually have rights to my identity right because i'm a human being right i have you know certain characteristics as i grow up i have a name you know i have a

place i live and so on so forth and i it my identity therefore does not depend on the government to give me an identity i have the right to my identity right that's the philosophical sort of idea behind self-certain identity but how do you translate it into technical terms so christopher allen uh being one of the cryptographers uh who actually helped us to use tls and you know was one of the authors and today we protect a lot of communications with tls he sort of translated this philosophical idea into this sort of principles that are very human-centric but the idea is you know i can use attributes the way i want i i can make them portable between providers i can i know exactly what's going on i can minimize the amount of information i

provide right time goes by you know some of you might know sovereign foundation they've been and still i think the biggest self-sovereign identity technology you know network out there they sort of say well it's not just about humans right it's also about things it's about you know legal entities and so they sort of evolved as a set of principles they came up with these 12 which are very similar but sort of really go a little bit more into even more in certain cases data privacy but also uh governing identities enabling different types of applications okay so so how how is it happening how does it work well very very simple uh actually like for example here in switzerland i go to a new doctor if i've

never been there i have to take my uh you know insurance card uh sometimes presented or sometimes fill out the form it's quite annoying uh and you know i don't know how to verify it they just trust that you gave them the right information so basically ideas is uh and those are formal terms it's you sure uh would be uh like an insurance company you come to them uh you you get a credential uh in certain form you become the holder and you use something called the id i uh you know this is a high level presentation i'll not talk about this details but you know for those of you that know i just create the did which is my global identifier uh that i can create um just specifically for this connection or i can have a permanent one depending on what i need and then and

then when i go to doctor i i pack package up the information by my insurance into something called presentation and i electronically provide it to them they can and then they can you know verify digital signatures using decentralized you know pki system essentially that's kind of how the system works technically but um you know obviously the beauty of this is you know my identity essentially is lots of lots of different applications that allow me to do all kinds of different things and now friends from findi uh finji is a finnish network uh that's trying to do this they they say like okay i mean you actually as a user right you have all these different applications you can you can work with right so your student card your loyalty programs proof of vaccination education

whatever right and then you when you go about your business and need to combine these things like for example you want to apply for a job right they want a bunch of different things about you right so you need to combine these different parts of your identity and provide to them and and verify in the self-serving model can decide which providers they trust right which providers they trust that's that's very important and the user can decide from each store and they will get something called proof request they'll say okay this is the information i need to provide i'll choose this this and these sources package it up and send it out right so so that's kind of the beauty it's an ecosystem it's an ecosystem that's the important thing right but how do we make sure that people can actually use it right you know zero knowledge proofs

protocols it's all great and and basically right so if we look at this it's it's this is this called trust triangle right so you have an issuer right then you use a technical protocol to provide the data to the opener holder right and then the co i as a as an owner of the data i decide who i provided to and the verify i can decide if if they trusted it or not but you know that's that's the important thing this trust relationship right so why do i accept that data why do i believe that data and and the way that works is comes governance trust diamond and when we talk about technologies forget you know all these applications moving from you know people world that we believe today with into the digital world technology

does not replace human trust it does not replace human factor i mean they have to work together so therefore you have to build a system whereby you know basically this has to be governing authority maybe one day we'll learn how we can make it decent completely decentralized and automated but the important thing is they publish something called governance train work right with this governance framework they talk exactly but how do these identities come about how people verify data how they manage the data how they manage the keys so you can trust it from a technical standpoint things like that right and basically then so if if you become part of this ecosystem the verified trust uh the governing authority that they trust into the trust framework right uh and if governor

authorities is certified insurer i implicitly trust the issue right if i'm part of the same ecosystem so this is how that actually the whole thing works right so it's not just the technology and actually trust over ip a fantastic organization recommend you kind of work with them if you're interested in this space they sort of really spend a lot of time to think about this it's actually work that's been pioneered by sovereign foundation but then generalized for all kinds of other applications and basically these two parts right this governance part with layers and then there is a technical part with layers and then they kind of work together starting to build from the utility network this is where you anchor your public keys and enable technical trust right and then we just had a fantastic

example yes decentralized systems are you know honeypots and they people break them right and with dpki it's much much much easier that's what all this did utility network's all about but you need to know who is creating this the ids how do you know like you know internet today if i go and open meta how do i know it's actually meta how do it's not mickey mouse meta i actually don't right i i hope that they did the work that you know not somebody's not pretending to be them and i can maybe look at the certificate and i can maybe trust that certain you know a certain certificate authority did the job to verify they actually showed it to meta but i don't really know right this is where that happens and so on so forth right so you kind of build that

and in the end uh you know these these voters are very you know uh down to earth people most of them they just want to have things done they can then trust the system and use it right so that's why you need something like that so who are the people building this uh you know uh there's uh you know obviously interoperability is very very important because we cannot build the ecosystem it's the things that not interoperable right and some of the key organizations out there is the central identity foundation w3c trust of vip and some of the open source projects in the hyper ledger uh indie space in europe there's lots and lots of effort actually europe is pushing it really really well with eu wallet but also with the european

blockchain infrastructure on top of which to build a sales store identity framework right um and and you know here i just want to say that it's also very very important that we demand that these things are done in open source right because we know that security doesn't work by obscurity right only secure protocols of the protocols down in the open the people can look at contribute to and trust right so those are those are very very important efforts and finally uh the interesting thing about ssi networks is you you don't have to have one giant network right it's not it's a competition it's not it's not like you know google is competing with uh meta

right or or whatever um it's it's actually coexistence of technology and the reason why is because of assurance remember we talked about governance and how you know i want to publish my identity and attributes obviously for government applications there will be one set of rules in requirements and then of course if you talk about uh you know uh some sort of you know uh uh uh a robot community right in the future that'll be different set of things and different set of rules and and it will be different set of networks right different governance framework but if they can interoperate you know i can go from one country to another for another ecosystem to another and and make sure this ecosystem thrives right with that in mind let me just quickly

talk about adidas and what we do uh you know i i mentioned that you know to me identity is very very important an identity in the largest sense of the world you know being able to move from paper-based processes to trusted data exchange privacy preserving data exchange into the into the completely digital processes and you know uh uh we want to make it happen in switzerland so data stats for us stands for digital identity data sovereignty association and the id is in there for those of you who know the standard it's kind of important thing for us and what we're trying to do we're basically trying to bring all kinds of people together to educate about ssi you know a lot of people especially non-second people don't understand why eid is a thing you know why privacy is a thing why is

important uh what what what is it about as a site that makes it special so we have to educate it and we will be publishing some education materials uh here that people can really understand right we don't want to reinvent the will right um we want to bring best practice and make sure the availability is there we want to grow the experts and bring them together right we want to promote use cases because to build ecosystem you know you need to know which proofs and attributes are there and which one you can use so you can build those applications and finally obviously there's lots of legal questions out there other things so we're working with lawyers and others to understand how can we change legislation or or or or work with legislation to make the things work

between the technology and and you know legal system um we have responded to the public consultation with our paper it's available on our blog our post it's also available uh through the fed poll it's uh it's a it's in german unfortunately uh so it's 26 papers uh 26 pages of lots of information why we think it is uh the important thing is we do believe that out of this free level of ambitions that i talked about in the beginning it doesn't make sense to focus on anything rather than level three right because otherwise it's like why are we doing this we do believe that government plays an important role right they will bootstrap the ecosystem by providing trusted data that they own and they can provide and

then we'll build around it we do believe ssi is the best approach for the future it's not pki it's not you know another e-card or something like that and there's lots of reasons for it and and but we understand i mean ssi is not perfect right there are questions there's there's been some flops for example in germany uh when people try to move too fast but we have time right we're building for next hundred two hundred years maybe right and so so we have to use this time and work together to build and solve these problems which we can right so this is our our position and and and finally i just want to say that you know we have to again consider its network of networks right so it's not either or you know we don't have to build one giant network we can just

leverage you know for example evolving parallel some industry networks uh some federal networks that cantons for example can run and then interoperate with our neighbors in european countries that are listed here so uh yeah so let's do it thank you