As COVID-19 intensifies reliance on digital technology it puts a spotlight on innovation in the fast-evolving world of digital identity (ID). Businesses, organisations and public services have faced a new imperative to facilitate online access to remote working, payment systems and resources as if overnight. They have also needed to reliably verify the people who have the right to that access.
Further, as economies slow down, the pandemic has deepened reliance on social support and humanitarian aid, underlining the role of verifiable identity to meet growing need. Countries with well- developed ID systems are reported as better poised to respond. Digital identity systems, which document unique attributes of an individual within computer-based solutions, can be used in place of traditional paper documents such as passports or identity cards. They underpin a capacity to uniquely identity people and develop effective payment and distribution ecosystems and an efficient ability to reach those in need.
For instance, representatives from several African nations illustrated the urgency for their region in a series of discussions last month hosted by humanitarian organisation ID4Africa. Enrolment campaigns to boost participation in health, finance and social systems include the need to reach remote communities and people that may not have any form of identity documentation.
They highlighted the priority of working to manage the pandemic to facilitate both social services and frictionless economic trade. The emerging situation has also fast-tracked consideration for innovations in the collection of personal biometric data, including iris and facial scans that can facilitate both remote and hygienic contactless enrolment as they work to extend their social safety nets.
Innovation in contact tracing apps
Another area of development influenced by COVID-19, contact tracing apps, is pushing boundaries in the emerging area of privacy enhancing technologies—or PETS. These include areas of cryptography only just working their way into real-world application as appreciation for engineering privacy requirements into systems begins to mature.
Contact tracing is inherently privacy-invasive to individuals as it is fundamentally a mechanism for sharing details of the interactions they have with others. In response, many researchers have turned their attention to developing secure and privacy-preserving solutions. Large inter-institutional projects such as DP-3T (Decentralized Privacy-Preserving Proximity Tracing), PEPP-PT (Pan-European Privacy-Preserving Proximity Tracing) and the Apple-Google partnership have developed protocols, systems and mobile apps that have already informed contact tracing deployments internationally.
Turing researchers James Bell, David Butler, Chris Hicks and Jon Crowcroft considered contact tracing early in the pandemic and proposed two novel approaches for achieving aims that explore opportunities to limit government access to user data. The work, while not peer reviewed, was published to inform discussion around the potential for designed architectures that separate the roles and the data received by the stakeholders (the government, the healthcare provider and the user) in a contact tracing system. By doing this the information that can be learnt about an individual by any party in the system is limited.
While not specifically designed for digital ID, the body of research around contact tracing has unlocked knowledge around how the risks to privacy associated with the collection, processing and misuse of personal data could be managed in any systems, including ID.
"While not specifically designed for digital ID, the body of research around contact tracing has unlocked knowledge around how the risks to privacy associated with the collection, processing and misuse of personal data could be managed in any systems, including ID."
Trade-offs
Research into contract apps has also prompted debate around the trade-offs that inform development criteria and further lines of research. Lockdowns in the face of the pandemic are challenging our prioritisation of privacy for the protection of society. This was reflected in the experience shared in the ID4Africa series and in a representative sample of the United Kingdom’s (UK) population participating in the Speak for Yourself! Survey (research led by Turing Fellow Carsten Maple, also of University of Warwick in collaboration with Rebecca McDonald , University of Birmingham).
The UK group were given choices that probed their readiness to prioritise controlling the pandemic over their privacy. A significant majority, 66.4% said they would probably or definitely download an app. This rose to 74.3% when given discrete choices for limiting the release of the data produced by an app to particular organisations. Participants showed a clear preference for sharing data, including an anonymised list of people the app showed they had contact with, to health organisations, rather than the government agencies running the contact tracing programmes. Survey respondents were also reluctant to see their data become available to technical companies that underpin an app, including Google and Apple, citing concerns that both governments and companies would be likely to access their data for other reasons.
These considerations speak to the trust people have in a system, the level of control they may want over their data, and their willingness to use it— and ultimately the impact delivered.
Carsten Maple and Jon Crowcroft are research leads on the Trusted Digital Identity Infrastructure Programme
