Around the world, government services are changing. Countries such as Australia, Austria, Estonia, Singapore and the United Kingdom are already offering life event–triggered or proactive government services. These services could be automatic enrolment in retirement benefits or receiving your child’s birth certificate without having to submit forms. These new types of government services offer fundamentally new and better interactions between government and its citizens.
However, these new services often require new forms of identity. Take the birth certificate, for example. The issuing agency needs to know that the digital identity in the hospital records corresponds to a physical identity living at a specific address, has rights to citizenship and so on. People no longer live in just the physical world; we live, work and play in the physical and digital worlds—and identity also needs to work seamlessly across both.
But for years, governments have been using a patchwork of systems to identify people: physical ID cards like drivers’ licenses and passports to identify physical individuals and generic logins and passwords to identify digital users online. But there were few solutions that could identify both physical and digital identities to the level of accuracy needed for government services. While the pandemic accelerated the adoption of many tools and approaches to identity like digital travel credentials, adoption was uneven. The result is a fractured ecosystem without the cohesive national strategy, policy, legislation, or leadership needed to unify it.
A common vision for identity is needed: a vision that protects user privacy and at the same time makes transactions easier regardless of your preferred channel, whether that be in the physical world, the digital, or even some combination like virtual reality. A common vision can help coordinate the innovation of the large number of players in the identity ecosystem, helping everyone move independently toward a common goal. We have termed that vision “agile identity.”
Many approaches and technologies can help realise this vision, but government needs to build trust in that vision to begin unifying the identity landscape. The services that citisens want tomorrow could depend on having the identity solutions we need today.
If the new world of proactive or life event–based government services requires identifying individuals in both physical and digital worlds, it also adds additional layers of complexity. Rarely do our lives stand still. We move houses, get a new email address, get married, and so on. Our concept of identity must be similarly agile. If I file a tax return online, my digital identity must be able to verify that I am the physical person entitled to that return, as well as more changeable information like my status as a parent, patient, or business owner.
This trend exists for a reason: The digital services emerging today require agile identity. Over a decade ago, commercial companies discovered that by combining experiences across both physical and digital customer experiences, they could improve sales.1 This concept of omnichannel marketing was a first step on the journey of linking the physical and digital worlds and has driven much of the progress to date. Well beyond just analysing the contents of online carts, companies can now gather data from browsing habits, location and more, to provide customised experiences and tools like apps and digital wallets to allow those digital experiences to work in the physical world. We can search for a flight online, buy it on a mobile app, get a boarding pass delivered to our mobile phone, and use that pass in the real world to board the flight. In fact, with the emergence of nonfungible tokens and other assets in virtual or augmented reality, physical identity can be important to transferring ownership of purely digital assets. Just as seamless service delivery in the commercial world rests on the foundations of omnichannel, the next revolution in government service delivery requires a new concept of identity and the tools to make it a reality.
Historically, identity solutions were static. Both physical credentials like social security cards and digital ones like usernames and passwords, once issued, stayed the same until renewed/replaced. Digital credentials are becoming more dynamic, with zero-trust schemes for access to computer systems using additional context like IP addresses, geolocations, device IDs and so on, to continually update a user’s risk. But now, the twin pressures of new technology and shifting social expectations are changing the context of identity. We live and work in physical and digital environments. Therefore, we need a form of identity that is portable between the physical and digital worlds, between different transaction types, and across different properties.
But the relevant attributes of identity can also shift rapidly as we move between those environments, requiring identity to be more dynamic than just printed plastic cards or usernames and passwords. If users are to understand what information is being used where and when, modern identity will need transparency in how data is collected, how the technology works and how an individual’s data is treated in order to protect privacy.
Further, shifting social expectations also have implications for identity. The ability of users to control digital data—whether by accepting/rejecting cookies, using ad blockers, or controlling how apps access data—has increasingly created an expectation that users should be able control use of their data in other contexts as well. Modern identity, in turn, needs to be governed by individual choice.
Technology and social trends have altered the context of the world. The nature of identity must shift to match this new context. The modern world needs a system of identity that is agile—identity built on portability; transparency; and individual choice.
Governments and companies use a variety of identity solutions today with a wide array of capabilities. We can visualise the fractured, but evolving, identity landscape by categorising existing identity solutions based on whether they are physical or digital and dynamic or static (figure 1).
The problem is that digital identity requires several different roles, each with different incentives pushing and pulling on the players. While omnichannel marketing may involve just a company, a customer and a service provider, identity at a minimum requires an issuer (who creates the credential), a holder (the individual who uses that credential), a verifier (who views the credential to verify the holder), a relying party (who relies on the verified identity to provide a good or service) and a governing authority (who sets rules for the system).2 Further complicating matters is the fact that organisations may play multiple roles depending on the transaction in question. For example, the federal government issues physicians with an identifying number to allow them to prescribe controlled substances, but it may also act as verifier in verifying that identity during investigations. Add on top of that the variety of roles that technology and service providers are likely to play, and there is a wide variety of players, all with different goals and incentives. As a result, different solutions can go in radically different directions depending on who created them or for what purpose. With many players, each pursuing their own solutions according to their own incentives, the identity landscape lacks the cohesiveness needed to support new services and promote the interests of individuals.
To realise a revolution in citizen experience, government has a unique ability to bring clarity to this fragmented identity landscape.
With so many different players pushed by so many different incentives, it is unlikely that one dominant, interoperable solution is going to emerge on its own—nor is this necessarily desirable. Instead, we need a common vision for agile identity toward which different players can work independently. That way, whether you are an issuer of credentials like a state Department of Motor Vehicles (DMV) or a verifier of credentials like a web service provider, you can understand the future goals and requirements of the identity ecosystem.
Agile identity is a user-controlled identity that enables individuals to selectively manage the exchange of their personal attributes and data to securely interact with commercial and government services, in both the digital and physical domains. This vision has three hallmarks: portability, transparency and individual choice.
Portability. For identity to work at scale, it needs to work across a variety of platforms and be accepted for a variety of services. This means that citizens can access their identity on a phone, computer, or in person, and use that identity to verify their age at a liquor store, board a flight, or pay their taxes online.
Transparency. With so many players, transparency is needed to help ensure trust at every step. Transparency about the tools, technology and methods used in establishing identity would give issuers and verifiers solid assurance that transactions can be trusted. When paired with transparency about what data is collected and available to whom, this can also help individuals have confidence that their personal information is not being lost or misused.
Individual choice. With transparency comes the opportunity to control your own data. Individual choice is the ability of individuals to control which credentials to use, who issued them, which data they release and to whom they release that data. With physical IDs, the individual has no choice but to reveal all the information on the card to whomever they show it. With an agile identity solution, individuals can choose which credential to use and even what data to reveal, allowing them to show only the data needed for a particular transaction. When dealing with such sensitive data as identity information, the principle of individual choice could help build trust among individual users, and also reduce the compliance burden for many agencies as they would have to protect less personally identifiable information (PII).
The three hallmarks of agile identity should be present in any future identity solution, and there are many ways to achieve those hallmarks. Each approach has its own strengths, weaknesses and supporting technologies:
Ultimately, the approach chosen will come down to how different communities wish to navigate the trade-offs of the different models. In fact, the likely path forward for many communities will be a mix of all three approaches, depending on the risk, use cases and transaction types they support. This further emphasises the dynamic nature of agile identity. An agile identity does not only support the different transaction types that a user may encounter, but also operates across different communities and implementation models. This is particularly critical as the identity ecosystem continues to evolve.
The fictional vignette below, for example, lays out one future where individuals use their mDL issued by a central state authority acting as their “core” identity that binds additional verifiable credentials or attributes from other issuers operating in a decentralised model. A truly agile ecosystem will harmonise standards and different technology implementations of different identity models to provide individuals with the greatest degree of choice and portability possible. Centralised, decentralised and federated ecosystems can coexist to support the different interactions and personas we reflect in our lives.
Jamie, a 21-year-old college senior, is due for a licence renewal. On the day that she visits the local DMV, the clerk asks her if she wants to download a secure wallet application to her smart phone that can act as her digital driver’s licence. Seeing the potential convenience of having her driver’s licence stored on her phone, she chooses to enrol. After downloading the application, Jamie has her identity verified by the DMV clerk, who then provisions the identity in her application. Jamie now has all the personal information usually stored on her licenses at her fingertips encrypted and digitally signed by the DMV on her device.
A few months later, Jamie graduates from college with a degree in engineering. During her last few days at school, the registrar offers students an electronically verifiable credential of their diploma. Because Jamie’s secure wallet application leverages multiple open standards, she is able to sign into her school’s online account, scan a QR code with her wallet application, and populate a cryptographically verifiable version of her transcript. She then links this to her LinkedIn account when applying for jobs online, allowing employers to independently verify her skills without ever having to directly contact the school.
After getting a new job with an engineering firm, Jamie needs to file her state income taxes online. Navigating to the state tax administrator’s web page, she sees that she can sign in and file her taxes directly using her state-approved secure wallet. She selects “sign-in with your mDL,” scans a QR code presented by the page, and consents to the release of her information. The personal information she requires to establish an account is automatically populated directly from the issuing source at the DMV. Later, she receives a push notification from the tax administrator with an update on the status of her refund. Jamie uses her phone’s biometric authentication capabilities to log in seamlessly without a password.
The recent growth in popularity of digital wallets on smartphones and the adoption of “mDL” in states such as Arizona, Colorado, Delaware, Oklahoma and Louisiana, as well as the continued advancement of verifiable credential standards make a story such as this increasingly likely in the near future.8 But regardless of the approach a jurisdiction chooses, the ultimate success of any identity solution will depend on how well it is trusted.
The stakes of identity are incredibly high. For citizens, identity contains their most sensitive and personal information. For governments, identifying citizens and delivering services are core functions of the state. With the consequences of failure being so high, every stakeholder needs to trust that the entire system will work as designed and protect their interests. But as we have seen, those interests vary with each stakeholder and the role they play. Therefore, government needs to help build trust in an agile identity ecosystem—regardless of the technology used—if it is to be adopted at scale. Our research on public trust suggests that this can be achieved in three parts: by building trust in the competence of the solution, building trust in the humanity of the players, and trust in the integrity of the system.
Government needs to build trust in an agile identity ecosystem to provide the services that citizens need. Without that trust in identity, trust in government itself may suffer as a result. Citizens already live and work across physical and digital worlds, so government services are provided there as well. Without identity solutions that can keep up, those services are more at risk of fraud than ever before. Often, that fraud is due to an inability to identify real, physical human beings from purely digital data. Our research on trust suggests that these type of missteps may be especially damaging to citizens’ trust in many government organisations.9
First, government should build trust in the competence of the solution. Issuers, verifiers and relying parties in particular need to trust that the technology will work as advertised, because without it, their businesses and missions will suffer. Whether a nation uses a distributed, federated, or centralised approach, the technology stack that makes agile identity work needs to be trusted by those creating and checking credentials. They need to know that the system will work as advertised and deliver the promised benefits. On the one hand, this means demonstrating reliability, so that verifiers know that transactions will go through quickly and easily under any circumstances. On the other hand, it means demonstrating security so that verifiers know that the credentials they issue cannot be hacked or forged. Balancing these needs for trust requires an entire ecosystem of collaboration across federal, state and local governments, as well as commercial companies.
But a trusted technical system only works if there are users willing to participate. For citizens to willingly entrust their personal data to an identity solution, they need to trust more than just the technology—they need to trust the humanity of the implementors. Most citizens will not have deep technical knowledge about how an agile identity solution works. Even if they hear terms like blockchain or PKI, most will not have a sense of how those technologies truly operate and where risks may lie. Therefore, citizens’ trust of complex technology solutions will be driven by their trust of the individuals and organisations operating it.10 If they trust the motives of the government agencies and companies involved, they are more likely to trust, and therefore use, the solution. If not, adoption could lag, and the solution may fail. And this trust in humanity must be two-way: Federal, state and local leaders can harness digital technologies to solicit the input of constituents to help ensure that any identity systems meet their needs. The freer and more open this communication is, the more it helps companies and agencies see users as individuals and not merely as means to profit.
Finally, in an ecosystem as crowded as identity, it is not sufficient that only government be trustworthy. Every issuer, verifier, technology, or service provider must adhere to the same standards of trustworthy behaviour. To achieve this, government should build trust in the integrity of the system, implementing rules, establishing measurement, and creating accountability structures to enable a network of trust.11 In ecosystems working on sensitive topics, it only takes the failure of one player to cast mistrust over the whole system. Therefore, government should gather data about citizens’ trust, put in place enforceable standards of conduct, and communicate through real people the mission and transparency of the identity solution. This can look like common privacy labelling on tools that use identity that describes what data is collected and how it is used but can and should vary with the needs of the public. Government also needs to function as a backstop to the identity ecosystem. Just as the federal government builds trust in the integrity of the banking system by backstopping it with deposit insurance, governments should take similar steps to backstop the identity system should leaks or compromises occur—by providing redress and protection for individual users, enforcing accountability to expected standards, and providing incentives to organisations that uphold the principles of the ecosystem.
Building trust may sound like an abstract concept, but trust can be seen at work every day in use cases like payment processing—a very similar ecosystem—where different public and private players work together on highly sensitive use cases. First, vendors and payment processors must trust the reliability and security of the system. Banks want to know that transactions are unlikely to be fraudulent and to gather data that can help them identify if that is the case. Vendors on the other hand need transactions to be processed quickly every time. Delays can not only cut into sales but can also encourage workarounds that are more prone to fraud. And, as is likely for agile identity, modern payments processing is a mix of centralised, decentralised, and federated approaches. Take mobile payment apps for example. These are federated platforms that link to the centralised bank accounts that house most individuals’ money but can also allow the transfer of fully decentralised cryptocurrencies. Also, like identity, most citizens have very little knowledge about how payment processing works behind the scenes. Rather, our trust in the system rests on our trust in our banks and the government regulators and insurers whom we trust to secure our savings and backstop them in case of loss. Much as this ecosystem exists in payments processing today, it needs to be recreated in identity if stakeholders are to trust the technology.
Agile identity is needed today. Every day without a scaled agile identity ecosystem increases the risk of fraud, compromise of personal data and inefficient government services. We have seen ersatz and half-realised identity solutions in the past, and they often lead to more problems. For example, the use of social security numbers as a de facto national identity number has created significant opportunities for fraud since those numbers and their simple paper cards were never designed to fill that role.
The path to agile identity is not a straight line, however. Like payment processing, no single player can create a successful ecosystem. Collaboration and coordination will likely determine success.
Due to its importance to the identity ecosystem, government at all levels has an important role to play in ensuring that agile identity gets moving. Since the successful adoption of agile identity rests on building trust in the solution, the players and integrity of the system—it can be a useful way of organising the immediate next steps for each player to help make agile identity a reality (figure 4).
Agile identity offers the technology-agnostic way ahead on digital identity that government services need and citizens want. But if we are to realise the transformational government services of tomorrow, we should begin building the infrastructure of agile identity today. Our future selves might literally depend on it.
As a recognised leader in cybersecurity consulting, Deloitte Cyber includes thousands of dedicated cyber professionals, across numerous industry sectors, who help clients better align cyber risk strategy and investments with strategic business priorities, improve threat awareness and visibility, and strengthen their ability to thrive in the face of cyber incidents. In the realm of Cyber Everywhere, the ubiquity of cyber drives the scope of our services. Deloitte Cyber advises, implements and manages solutions in strategy, defence and response; data security; application security; infrastructure security; and identity management.