Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2702 Thanks!
[Music]
and this talk is about please identify
yourself thas
[Applause]
[Music]
lerari thank you so today what we're
going to talk about our digital ID
systems why they exist in the world what
are some of the lessons that we can
learn from the ways that they've been
deployed in certain countries and more
importantly what's happening next and
what are the ways of
resistance digital ID systems tend to be
quite prolific this map is just a very
small indication of some of the systems
that we will be talking about today it's
by no means indicative of all of the
digital ID systems that exist in the
world but it's particularly the color
red red and the color orange that are
important for us color red is India
where we will talk about India's adhar
project which there have been talks on
in previous iterations of the Congress
so we'll be focusing at a relatively
higher level and then in Europe there's
the EI disregulation which specifically
looks at how digital identity will
operate in Europe and is set to
radically shake up the way that more
citizens will interact with their
governments in a digital
age the adhar project the adhar project
in
India is something
that um sorry something wrong with the
clicker so the Adar project in India is
fundamentally driven and motivated by
one of the stgs specifically 16.9 of the
un's sustainable development goals talks
about the importance of providing
Universal legal identity this is the
point where it's important for us to
separate identity which is something
that is inherent in an individual versus
identification which is usually a
manifestation where a government or
another authorized entity tells an
individual that this is how you can
assert the identity that you already
have this part of the SG has led to a
rapid proliferation of governments
funders and international institutions
investing in digital ID projects because
digital ID is supposed to LeapFrog many
of the concerns that traditional ID
systems both on issuance as well as
fraud have faced in the past and the
country that has tried to do this in its
most ambitious scale is India with the
adhar project the adhar project in India
currently has between 85 to 90% of the
Indian population enrolled that is over
1.2 to 1.3 billion individuals who
already have an adhar project the adhar
project has many security and privacy
concerns it has many exclusion concerns
and while we'll be going over them in
some detail in case you'd like to get
into them please do listen to The Talk
that Kiran gave at the last Congress
that actually does a deep dive into a
lot of these concerns around the adhar
at a fundamental basic level the adhar
project is a concept that says you don't
need a physical ID card in order to
identify yourself there is no chip there
are no ways in which the card contains
information instead your Biometrics are
used to issue you a number and in order
to issue you that number and ensure that
there is no one else like you in that
system system there are three main
components that are ingested in order to
carry out duplication your iris scans
your fingerprints and your Biometrics as
well as your photograph that is taken
when you sign up for this system all of
these three things are combined to issue
you a unique 12-digit identifier that
stays with you for the rest of your life
if it's compromised or if it's even made
publicly available it cannot be changed
there is no con provision under the laws
that govern the Adar in India for that
identifier to be reissued to an
individual and most of the risks that
stem from biometric
identification in most ID systems are
magnified in the Adar project because it
is you your body that serves as the
primary identifier whenever you want to
authenticate yourself using the
Adar that also leads to some pretty
interesting scenarios for how the Adar
project was actually rolled out in India
this graph is really interesting because
what will showcase to you is that the
law that actually created the adhar
project was passed and introduced in
late 2016 and passed in late 2016 early
2017 and the really shocking part is
that over 980 million individuals were
enrolled in the adhar project before
there was a democratic process to create
a law that would govern how the project
should work in practice instead there
was an executive Authority that was
established in India in order to push
the project through and ensure that
enrollment could start taking place well
before there was any concrete legal
backing to the project this led to a lot
of push back from Civil Society within
India which apart from its security and
privacy concerns argued that it's really
important for a project of the scale and
the magnitude of the Adar to go through
uh inner democracy the deliberative
process that via laws and regulations
rather than merely executive action and
that's the first trend pattern that we
will talk about of how societies and
democracies engage with digital
ID after that as enrollments continued
we've also seen a second varing Trend
the fact that the adhar which was
initially proposed as an identifier to
perform one purpose has slowly crept
into various aspects of Indian life
we've seen it being asked for school
enrollments children under the age of 2
to 3 being asked to sign up for the
adhar where on the right hand side you
will actually see a tweet from the
official Adar account actually asking
for individuals to register their
children sometimes even before they have
a birth certificate on the Adar project
ignoring the fact that Biometrics often
change and evolve as as individuals grow
over time especially fingerprints and
this finger and this scope creep has
also led to this mandatory voluntary
nature of the adhar project where
officially according to government
policy the adhar is not required for
school enrollments and this is something
that the government has clarified
however in practice it's much more
common to see that you will simply be
refuse Services both in the government
as well as in the private sector until
you provide these
details and another aspect of the adhar
project is that it is merely the
foundation of how India as a society is
approaching digitalization there is a
concept known as India stack and it's
created by a voluntary group called iert
in India and they envisage the adhar
being the foundation of a lot of the
interactions that one would carry out in
society the presence in Slayer which
talks about how the biometric identity
that you have will allow you to assert
your identity digitally the paperless
layer where once you have asserted your
identity official documents can be
issued to you in a completely digital
format once the identity in the
documentation piece is established you
could enter into Financial transactions
and relationships which has is called
the less leer and is behind some of the
most successful projects in India on the
financial inclusion front such as the
United payments interface or UPI and
ultimately the consent layer where all
three of these and just even one and two
can be combined in order to allow
individuals to exert their consent for
All Digital
interactions the one thing that I will
suggest we also keep in mind is that
this idea is not unique to India the UN
is currently considering dig public
infrastructure or DPI as a big Focus as
a part of its work and a way to
actualize sdgs and many of the trends
and Concepts that I've just spoken about
here are things that Thomas will also
talk about both in the context of the EU
but also with regard to how these
projects aerating elsewhere in the world
with that I'll now hand over to Thomas
to talk about the eidas thank you UTB so
as you might have heard we've recently
concluded huge reform in the European
Union to establish a harmonous digital
identity scheme the starting positions
in the EU are actually quite different
we have very different systems in member
states and the penetration the uptake
are also sometimes above 90% sometimes
below 10% and now the EU wants to
harmonize all of these various digital
identity system we what to call the
European digital identity wallet and
you've guessed it it's an app on your
smartphone that you as a holder can have
and it can store your national identity
or your residency card or also other
attributes that can come from the public
or private sector these can be your
driver license your age it could be
University degrees but also customer
royalty cards it could be uh Financial
scoring information or also your Co
certificate whether you have been
vaccinated or recovered from any type of
disease and all of this Trove of
personal data can then be used whenever
you authenticate identify verify
attributes or sign documents Visa
so-called relying parties and again the
system is open in in terms of what a
relying party is this could be a bank or
a telecom company that legally is
obliged to identify you before they can
have you as a customer it could also be
the police or border control it could be
uh whenever you are going to a theater
whenever you are doing any type of
e-commerce um this is really a universal
system to identify authenticate and
verify attributes about a natural legal
person Visa government or private sector
online or in physical proximity in an
offline scenario and the commission has
high plans for this they are aiming for
80% penetration in the European Union by
the end of this decade so this should
become something that you come across um
every day in a few years when the system
is rolled out and the law actually makes
sure that you will come across it in
case you use any of the big Tech
platforms so um the Facebook Google
Twitter they are all required because
very large online platforms to offer
this government wallet as a means to log
into their service and I don't think it
was intended but uh recently also porn
platforms like PornHub were classified
as very large online platforms so you
can also use the government wallet to
log into
PornHub um it really it is one tool to
rule them all it is one size with all
solutions and one level of security of
technical assurances to buy cigarettes
or do your taxes
to um open up a bank account or to uh
log to Facebook and this Universal key
of course contains many risks but before
we look closer into Europe giving a b
buff thanks Thomas as we talk about
risks we'll both be talking about some
of the risks and how they manifested in
India during the deployment of the Adar
project as well as some of the risks
that exists within the eidus framework
in India some of the biggest risks have
been around exclusion this idea that the
Adar would be compulsory if you were to
procure government services such as
access to your rations admission into
schools access to banking services are
were all issues that led to a fair bit
of pushback by civil society as well as
many other interest groups in India a
lot of these protests were quite
successful in that it forced the
government and the entity and
implementing the Adar to make it clear
when the adhar was mandatory and when
the adhar was not mandatory however it
didn't completely fix the problem
because of what I'd mentioned earlier if
an provider refuses to provide you a
service unless you're providing the
adhar it's usually much more convenient
just to give them that piece of paper
than to tell them I have a copy of a
government order that says that the Adar
is not mandatory in order to provide the
service this mandatory voluntary nature
of the adhar is one of the bigger
reasons that exclusion continues to be a
concern despite ways in which has
actually been addressed in law there was
also a very important risk of how the
Civil Society organizations that were
pushing back against the Adar were
characterizing as those holding back
India's progress into a digital age and
were sometimes targeted as individuals
who were anti-national and not in the
interests of India making it much harder
for their arguments to gain like
Credence in mainstream organizations and
press then came the privacy insecurity
risks this is a graphic from uh the
times of India newspaper in India from
earlier this year that has documented
that there have been at least 210
instances of leaks from concerning Adar
numbers now the Indian government's
stated position is that the uad database
that is the centralized database that
stores the AAR information has not been
breathed so far but the truth of the
matter is that that database does not
need to be breached in order to access
very sensitive information that is
present in the adhar and that's for a
variety of reasons the first is that
there are documented instances of the
information that is present in the Adar
database also being present in other
databases that are OCC either run by
government agencies or by state
governments some states such as
telengana have been shown to have
operated State resident data hubs which
were populated with information from the
Adar database when individuals in that
state were signing up so in order to
access this sensitive information you
don't necessarily need to compromise the
one centralized data place where this
information is present but there are far
lower hanging fruit that allow malicious
actors to essentially achieve a similar
outcome and one of the more obvious ways
in which it happens is the screenshot on
the right which is a screenshot that was
was released as part of news reports
where a government agency in a state in
India was using the Adar in order to
carry out attendance and biometric
verification of attendance which was
then access by by malicious actors and
data from that was pulled in and then
made generally available for individuals
to purchase either on the public web or
on the dark web as
well and finally there is the scope
creep this idea that the Adar as a
single identifier should be one that
allows individuals to link their
services to each other so that
governments can be sure that they are
who they claim that they are on the left
hand side you will see an official post
by the election commission's State
office in a state in India asking people
to link their Adar to their voter ID
cards something that so far according to
law is not mandatory in India but as you
can see from these like posts is very
much being encouraged by the government
and the image on the right is actually a
promotional post that was put up by a
company called ongrid that was promoting
its services of being able to perform
background verification merely using an
individual's Adar numbers where while
this image itself is from 2017 before
the legal case that we I mentioned
earlier actually came up right at the
bottom you'll notice it says enter OTP
and that's in fact one of the most
common ways in which Adar information is
actually utilized in India merely an SMS
that comes to a registered phone number
which as we all know has various
security and privacy risks and is not
recommended as a second factor of
authentication in most secure systems in
the world but yet it is used within the
Adar and is in fact one of the most
common things that is used used in uh
the adhar and finally there is this idea
that the adhar is a battle that has been
complete this is nand Nilan one of the
co-founders of a very large Indian
company called infosis as well as one of
the chief Architects behind the idea of
the adhar project from at least 2007 to
2008 and this is a quote that he
actually has given in the recent past
saying that the adhar battle is now a
part is complete because the adhar is
such an ingrained part of Indian culture
that it's a done deal and it can now
serve as the foundation for other
efforts which makes push back that Civil
Society or digital rights groups might
do seem like a lost cause because once
it has been rolled out at the scale at
which it has and everyone is already
using it how much can you really work
towards making sure that it's is not uh
that that it can be improved and if
things are working fine anyway and this
also is something that has spread
elsewhere around the world the lessons
that were learned from the Adar project
were key in many of the the decisions
that were made around the world to bring
forth the problems of the idea of
exclusion which is how digital ID
projects despite sometimes being
intended to simplify processes for
individuals end up excluding them either
due to the lack of public infrastructure
including the internet and electricity
as well as flaws in the technical
designs of these systems themselves and
this is also something that we've seen
increasingly start happening in Europe
as well this is actually a petition uh
that garnered over 600,000 signatories
on uh change.org that was run in Spain
by pensioners demanding that there be a
way for them to be able to access their
financial entitlements in a physical
manner because Mobile Banking and was
the only way that a lot of banks were
providing those services and they did
not have the digital literacy in order
to be able to access them showcasing
that digital exclusion by no means is
something that is only limited to the
global majority with that I now hand
over to Thomas to talk about how of
these risks have played out in the etis
too thank you well so let's talk about
overidentification which is I think a
very important helpful frame to actually
capture the risks that these systems
entail for everyday situations right now
we very often can rely on anonymity uh
in the absence of these digital identity
systems and ous facial recognition you
can walk across the street go to a shop
buy something nobody knows who you are
and it's exactly the type of anonymity
that is at stake with these systems we
have seen various attempts across the
world but also in Germany France or
Austria to establish real name laws on
the Internet or some type of
registration before you allowed to post
very often these proposals could only be
prevented with the cost of
identification which is actually quite
High we are talking about a few Euros
that you have to multiply for millions
of users these government run systems
could set the price to null and of
course if you have these systems
ubiquities in all areas of life suddenly
the big question of observability comes
into place if you are able to correlate
the actions of an individual um in the
health sector in the financial sector in
their labor market in their private life
in their interactions with the
government you know a damn lot about
that person and uh sadly we cannot
solely rely on the gdpr with protections
on that in many of these physical
situations consent is simply not enough
um there are obvious flaws in the gdpr
that's why the law is currently being
reformed like pay or consent or
prohibition of tying all of these weak
points will come into play with these
systems and that's why we have to talk
about safeguards and we are now at the
end of the European reform so we also
can take a look back on the most
important safeguards that are in there
and let's start with the good um the one
basic idea that uh when we got on our
shoulders the weight of this reform was
the idea to have a non-discrimination
provision to really protect everyone in
any individual situation when they opt
not to use this new system so we
established this idea as something like
a wild shot and then thankfully it was
actually taken on board by all four
committees in the European Parliament
with a huge majority and it made it
through in the final law so you are
protected with any type of government
service the labor market or the private
sector so that you cannot be asked to
pay a higher price ref us the service or
hindered in any way just because you're
not using this system you can always
rely on Alternatives it can never be
mandatory the second important thing was
the unique persistent identifier these
lifelong serial numbers for humans uh we
just heard uh in India how atar is a
very central part of the culture of
society Scandinavian countries actually
have similar behaviors and cultures
around their serial numbers um but we
could actually prevent these unique
persistent identifiers to become
mandatory in the EU and we are
completely deleted all of the references
to something like this in the legal text
and there are other safeguards we can
rely on First and formost a right of
cimity whenever you're not legally
obliged to identify yourself like with a
bank or a telecom company with uh in a
country with a SIM card registration
then you can always give them a
pseudonym um when you prove something
about yourself um it most likely will be
done in the form of a zero knowledge
proof that means you can prove a fact
about yourself without revealing to
underlying data classical example proof
that you were above 18 without giving
away your birth date and then very
importantly and getting that through was
really a hack in the negotiations
unlinkability
this principle establishes that um
whenever you are interacting with a
relying party and again you're not
identifying with your legal real name CL
then they are technically prevented from
correlating that so there are no uh
public keys that could be hash nothing
that can actually be used to track and
profile you this is a clear requirement
in the law for any type of technical
implementation in the system but it's
not all about Tes we are dealing with
companies so it's also about regulating
the use cases and the business models
and there is a strong use case
regulation any riing party any company
that wants to use that system system
needs to go to the National Authority
have the use case registered with
exactly the amount of data they want to
ask from users and they are technically
limited to that registration and the
whole list of registrations is up for
public scrutiny online available these
are good things let's talk about the bad
things we failed to establish um a
safeguard against Biometrics being a
precondition of the system so you can be
asked to use uh face ID Touch ID in
order to use this digital identity
wallet um we've already seen in a few
countries where this requirement exists
that is a huge show stoer for people
they don't want to use their Biometrics
with any form of government ID system
and so that sadly is not a requirement
so it will be left for member states um
the most severe admission in the
Articles of the law is the
unobservability I talked about this P
Optical view you could have if the
issuing authority to government knows
everything you do with the wallet every
transaction that you even attempt and we
really wanted to prevent this level of
observability but it's only in the
recital so it is a can kick down the
road so we'll see in the technical specs
whether we can actually get this
solemnly enshrined in the text um but we
have a Fighting Chance because in the
recitals we have enough things to fight
for which ugly things and muddy things
are also worth mentioning um I think
that heckers will have a lot of fun with
the system because particularly in the
first few years there's no common
certification scheme uh in terms of how
to make the system secure and honestly
this certification scheme I'm not truly
convinced about that like having a stamp
this is secure is not always really
secure we all know that um but
nevertheless there will be widely
varying security levels in the beginning
and so that's certainly something to
have fun with we have a little bit of an
open source obligation so at least the
application components of the app need
to be open source but um not a back end
and there are also security exceptions
and of course it's only open source it's
not free software although it's public
money thanks
Thomas very briefly I'd also like to
talk about some pretty interesting
statistics and this image is actually
from
2019 uh but at that point in time well
over a billion people were registered in
the AAR database of both what are some
of the measures that have been
implemented in the Adar ecosystem in
order to address the security and
privacy concerns but also what are some
of the trends of how individuals utilize
their adars probably one of the most
interesting statistics is the fact that
the vast majority of the use cases
despite this actually being a digital ID
continues to be in the physical world
which is that the two most common
manifestations a card which is
essentially a laminated version of the
Adar not a chip no like no nothing that
sets it apart or makes it unique and
photocopies continue to be the two most
dominant ways in which individuals
actually utilize the Adar in an Indian
Society despite it being a digital ID
and the measures that were implemented
in order to address some of the security
concerns were a virtual AAR number very
similar to the right to sud anonymity
that Thomas spoke about where you can
generate Adar numbers and share them
with providers rather than your core
Adar number itself so that even if there
is a compromise you could remove or
delete that virtual AAR number which you
can issue in a limited amount which is
something that very few people actually
go into your the Adar dashboard and
create for themselves then in order to
address the card in the photocopy uh
idea there was the mased Adar where
certain key numbers are masked in a
manner where even if the physical copy
of that document is compromised or a
virtual copy of that document is
compromised then all the sensitive
information is not necessarily present
on it while still allowing using the QR
code and other measures for basic
authentication and use cases to actually
take place as well and this is also the
point where I'll highlight that some of
the more interesting lessons that were
learned in India played a very big role
in the conversations that have happened
around digital ID elsewhere in the world
it's one of the reasons why when we made
Arguments for why pseudo anonymity is
important under the eidus regulation
like Thomas did we were able to point to
examples from what happens if pseudo
anonymity does not exist as an example
and that was true for a lot of the other
solutions that are present in the eidus
regulation as well
finally there's also litigation and when
it comes to litigation many other
projects that were inspired by the
India's adhar model such as Kenya's
digital ID project were actually struck
down by quotes the Kenyan project the
original one from about four years ago
actually collected DNA information apart
from a lot of this other sensitive
biometric information and it was struck
down by the court in early 2020 on the
basis of the fact that it was true
privacy invasive and ultimately that
entire digital ID project was shuttered
and a new variant was recently launched
about a year and a half ago that is
better from a privacy perspective and
also led to Kenya actually having a data
Protection Law both of this were
parallels in India where the supreme
court judgment helped tweak the Adar to
make it slightly better than what it was
but also actually led to conversations
about whether Indians enjoy a
fundamental right to privacy a
conversation that for the first time in
the Supreme Court and as a society in a
big way we really had only in between
2015 to 2018 which showcases how digital
ID projects can precipitate
conversations in societies because of
the amount of information that they
collect with that I now hand over to
Thomas to talk about dpis and world
domination um so we have not actually
completely concluded the European
process formerly speaking there's one
last vote happening on February 6th in
the plenary of the European Parliament
but we really don't expect there to be
any showstop of cuz we had a huge
majority already in the industry
committee and so this 2 and a half year
uh reform is about to conclude and we
are heading towards the techical
implementation which should be finalized
by August of this of next year and you
can expect the wallet then to pop up in
a few countries and by 2026 the
obligation kicks in that every member
state has to offer at least one of these
European digital identity wallets to the
citizens and
residents and the technical
implementation as we are at a Hecker
conference it's actually being developed
by um the EAS expert working group so
this is a group that consists of
government officials uh a lot of
Industry influence very opaque you
really cannot get anything out of there
except with leaks and we got a few leaks
and we are right now in the process of
analyzing them and uh this is certainly
something where the modem area so in
case you want to help with that um we'd
be happy to collaborate and it's
important to note that EAS is just one
piece of the jigsa puzzle this system is
already the basis and been mentioned and
referenced in other legislations we have
the European health data space which um
I don't know whether we have a talk this
year about it but it's certainly a very
important issue that also requires our
attention because it will create an
exception to the gdpr it is the rule the
law governing how we are actually um um
dealing with our health data when we go
to the doctor to the hospital to the
pharmacy and also secondary uses to this
data for research purposes uh of course
there will be driver licenses there's a
directive for that that includes the
wallet we have age verification as a
huge part of the chat control Builder
caesa regulation and of course the
digital Euro um this is another load
that we are working on you can find
position papers on our website on that
and this new currency that Europe is
creating will also live in the same
wallet and it's not just Europe and it's
not just India this really is a global
wave that's why we started with an
incomplete world map we see these
systems popping up everywhere um there
is interest from the World Bank from the
UN from many actors in Rolling them out
and a lot of money behind it and so
there's now a process by the um un Tech
Envoy called DPI minor safeguards org
which aims to establish worldwide
safeguards for these digal public
infrastructure systems and they actually
try to do the right thing they also try
to be quite open how much we can
honestly um believe that is still up uh
the verdict is still out uh but we
certainly have a timetable that's quite
ambitious for this year uh ultimately
these rules will be voted upon and
decided between governments and uh
believe me these un processes are uh
even worse than any parliamentary
process you have seen But nevertheless
there are ways to influence that and
there's some transparency that we can
expect that's another thing where we can
engage and I would also like to
summarize maybe a little bit what the
axes of resistance are that we've
highlighted here and this should this
talk should not leave you in despair I'm
always trying to um give you hope
because that's the only way we can do
politics um we have seen in Kenya that A
system that was meant to really collect
DNA information from everybody and be
rolled out Nationwide was stopped in its
track with a successful strategic
litigation similarly in India several of
the court cases have done um
tremendously good successes so strategic
litigation can work protest can work we
need to see to make visible for everyone
that be care about these systems sadly
with the European reform I would have
wished for much more public scrutiny but
it's a European thing it's fire away um
hacking Works tremendously well so any
form of U responsible disclosure uh
showing that these systems are nether
secure nor trustworthy is uh very
helpful this happened in in Germany
recently and so I hope that Um this can
be replicated also now with the European
system and lastly advocacy um we've done
a lot in terms of parading amendments
policy papers meetings with politicians
media work just getting the word out
making people understand why this whole
thing matters is vital for getting it
right and on that note we want to end um
and uh just tell me that like just down
the road there's an assembly of
epicenter works I'm going to be there uh
the next three days from uh 7il 99: we
also have two self organized sessions on
the EU on net neutrality and campaigning
stuff and um please come and talk with
us all of our work on this whole issue
of electronic identity was funded by
individual small donations we never
received any grant money for that so um
please consider becoming a supporting
member uh these are the people that make
this work possible thank you
so we have 10 minutes of uh time left to
have some questions oh the first ones
are already coming in is are there any
questions from the
internets yep then let's start
there uh the internet would like to know
uh is it possible to Black List and out
our number and effectively cut someone
off from the economy
entirely so there hasn't been a
documented instance of that happening so
far um and that's largely because the
uad as an entity only takes the
responsibility of issuing Adar numbers
and the law doesn't have a provision for
it to be stopped or blocked but it's
something that hypothetically certainly
could be done but we haven't had any
documented instances of it happening so
far out of a deliberate action it has
happened in the past where people's by
like the duplication has not been
successful and people have claimed that
there is already someone like them in
the database um but that's much more I
think a consequence of the technical
flaws of the system rather than a
deliberate action on part of the
government um please have brief
questions because I know it's a topic
like politics but please take it very
brief number two please I have two
questions one um I've seen in India we
don't have a full coverage by this outar
system so this was a question how those
people who are not in the system uh what
kind of people are they they are
resisting or just not you know somehow
excluded and the other question goes to
you Tom um are we going to have in
Europe This virtual uh EID number I like
that from India that's part so two
questions so on uh the reasons there is
a small fraction of individuals who have
resisted in India but much more so it's
individuals who don't have the ability
to sign up one of the main
characteristics of the Adar is while
it's considered a single identifier the
only way for you to get it is to have
other identifiers so whether it's your
address whether it's your identity
whether it's your age all of there are
lists of other government documents that
need to be submitted which either many
people don't have or live in localities
where sign up boots are so far away that
they haven't managed to get it or
sometimes their identity has been stolen
and has been used by other individuals
in order to create other numbers in
their name which therefore they cannot
exercise so it's very much a case of uh
design and exclusion flaws being much
bigger than the people who are resisting
who are present but it's a small
fraction thanks to answer your question
about Europe so ultimately no we don't
uh we started off with the worst case
scenario with one number to Ru the all
for private public sector we discussed a
lot of variance also p cimity and
ultimately we could delete all
references to any unique identifier um
there there of course still is matching
in case of crossborder situations when
you have a Swedish citizenship but
you're living in Germany then there is a
mechanism to match that individual but
is only crossborder scenarios um mind
you that you could of course still have
attributes that serve as identifiers
customer royalty cards and for example
Estonian social security number will
still live in a new system as an
identifier that comes from the
government and will be used like any
other attribute but the European system
does not contain any of these unique
persistent identifiers M and number one
please yes um I have a little question
about op sourness of the systems they're
now developing the wallet uh for the
European identity wallet um what I see
there is they're using the iso Moc
standard which is a Clos paid standard
um is there any way to continue fighting
this to Open Standards or is this a done
deal so we actually tried in an early
version of the law to have an obligation
to only use Open Standards the council
wouldn't have it and they really used
the dirty arguments in terms of like
sunk cost and and and uh private
interest so um there is of course huge
interest from the big vendors in Europe
to have this go their way towards
propert Solutions um and that's exactly
this architecture reference framework
discussion that's happening right now um
that will be concluded in August where
we need to comment on all of these
standards right now they haven't really
made too many decisions and they they
have to do a lot of work to actually
include the safeguards the
parliamentarians now have adopted so
there is definitely hope to change and
improve that text but it needs to happen
the next months okay I'll start typing
thank
you number two please hi uh thank you
for the uh talk I wanted to talk about
maybe having an daty theft in diar
because um from my knowledge the um
biometrical data is rather easy hacked
is there any other way to identify in a
two-way identifier else than the phone
like RSA or something no so the that
those were the suggestions that Civil
Society gave when the project was
initially being rolled out and the only
mitigation that has been done and even
that hasn't been enabled by default is
that the Adar dashboard now gives you
the ability to lock your Biometrics so
if you go in there and lock your
Biometrics uh once you've locked them
you can only unlock them in 10minute
intervals within that dashboard so if
say someone were to make a copy of my
fingerprint and attempt to use it
somewhere else unless they also had my
phone number and could receive an SMS
that lets me access that dashboard
online which is not difficult but still
a like just a slight step of friction
then those Biomet would not end up
working so it's very much your
fingerprints your iris and pretty soon
your face will be the only ways that you
can authenticate yourself via the Adar
apart from your phone number Via
unencrypted
SMS okay thank you a question from the
internet
please uh so the internet would like to
know uh do we know what's prompted the
creation of these systems uh like atar
and what's the main use case that the
governments are focusing on when
advertising it
the primary reason that the adhar was
created was because there was a
widespread belief in India that
traditional ID systems such as ration
cards which gave you access to your
public uh you know uh uh resources and
rations were ones that were so subject
to fraud um that and there were so many
people down the chain in the chain of
how things got to people that a digital
ID system would let the government
transfer subsidies directly into
people's bank accounts so there was this
image painted that this identifier will
remove all corruption and allow for
money to be able to flow into systems in
a manner that is much more reliable uh
there were some studies that were done
that showed that this was the case but
many of those studies since then have
actually been very widely discredited um
for having various flaws in both their
economics as well as their technical
methodology uh which is the origin now
it is just a very easy way to know
everything that you would like to know
about a citizen and or a resident and
most governments love doing that just to
maybe also ask a question for answer
this question for other reasons so we we
very often see the spin from World Bank
and other un organizations that this is
about efficiency and ultimately there is
a kind of mistrust Against All Humans uh
that is kind of a driving Factor um in
Europe it was strongly economical
arguments Estonia is always using the
billions of money saved in the GDP with
these systems and in the EU uh impact
assessment the Inception impact
assessment so like very early on they
already had one thing clear this system
will be used for the private sector so
they want this to also serve private
corporate interests and all the other
things like the European health data
space the digital Euro these are things
they left out like the government uses
of these systems were not advertised
when this in reform was started so we
have time left for three fast questions
so number one then the internet then
number
two okay very quickly you answered my
first questions which is B basically
what's the reason uh for these systems
and basically you said economic
efficiency uh your counter argument is
that these systems can be used for
surveillance and my question is then
what do you both both of you propose as
a system that would work for economic
efficiency that will be not be used for
surveillance I mean this really touches
on the on the big big question can these
systems ever be safe can they ever not
be exclusionary towards the most
marginalized parts of society uh can
they ever be so bulletproof
decentralized that they cannot be abused
by a bad actor or government and the
verdict is out we don't know yet and
that was honestly the weight on our
shoulders when we did this reform um cuz
it was clear that these these systems in
the minds of many policy makers are
inevitable and so it's it's actually we
we got a lot lot of attention from
politicians from all across the
political Spectrum with our ideas to
reform this um and I can tell you that
not even the people that negotiated this
thing for the parliament slept well um
so yeah the ver is still up number two
please very brief uh yeah hello I was
surprised not to see the Ukrainian EAD
case so I wondered whether he had an
opinion on it because it was although
Loosely regulated and fastly legislated
technologically sometimes better than
like some other Alternatives and without
Gathering of extra
data um so I would love to have a
discussion with you and and also learn
more about Ukrainian case I know a
little bit also the relationship to
Estonia and for this talk we simply did
not have the time like
we covering any issue with a global
scope is super difficult so we try to do
everything Justice we touched upon but
you're right that that would have
totally deserved more attention thank
you thank you and the last question from
the
internet are you personally optimistic
for a privacy and security preserving
standard or will it be a race to the
bottom to find a compromise between all
stakeholders I think
so there is a lot of very positive
standardization movement in terms of
privacy preserving Technologies in this
space but a lot of the good ideas are
really still in research
stage I think that in the like 3 to 5
years we'll have very good standards
that are ready for production and that
are robust right now actually the edas
expert working group is solving an
impossible task because these standards
are too early the the discussion in
Academia is still ongoing I have trust
in the outcome of these standardizations
cuz we have also seen this in the co
pandemic how creative people can get in
terms of really enshrining privacy and
Technology um but uh the the the strong
Push by lawmakers to have these systems
now or yesterday is kind of at ODS with
um the reality of the technical
specifications thank you very much for
the talk have a warm welcome a warm
Applause Forda tari and thas
linger thank you very
[Applause]
much
[Music]
la