In the context of national digital identity systems, there is a push towards openness with regard to how the systems operate, prompted at least in part over concerns about user privacy and human rights considerations surrounding government (including authoritarian) controlled digital identities. An excellent summary of this topic can be found in the Mozilla whitepaper "Bringing Openness To Identity", which talks about the push for digital identity by the international sustainable development community, but warns about the ethical concerns of digital identity in practice: "In many countries, people are being required to use a singular government issued digital -- and often biometric -- ID in order to get food rations, get treated in a hospital, or get a cellphone connection all logged in a centralized government database." The document concludes by suggesting that in future, digital identity systems should be developed in an open, transparent and participatory manner, so that citizens are more likely to reap the benefit of efficient access to government services and less likely to have their Personally Identifiable Information (PII) compromised in ways that could lead to harm.

But what counts as "openness" in the digital identity context? Mozilla offer this analysis of the Indian national ID system Aadhaar: "[There is a] gap between ID systems which have an open API and meaningfully open systems. While Aadhaar has an open API and allowed for the development of myriad private and public sector applications, this itself did not ensure much needed accountability in the Aadhaar. In fact, the creation of private ecosystems on top of state-issued credentials must be critically examined, particularly for applications that use personal data in predatory ways (for example, loan creditworthiness). These uses may easily transform an ID system meant to empower into one that is exploitative of citizens."

In addition to the considerations around user privacy and human rights, openness is often advocated as a mitigation for vendor lock-in, where a government becomes dependent on (and potentially limited by) a single systems vendor due to the lack of interoperability between closed proprietary software in use and other platforms. How can a digital identity system be designed with openness in mind? Should, for example, identity software be open source, so that all decision-making processes can (at least theoretically) be understood by any citizen who chooses to view the source code? Should there perhaps be a set of open standards that identity systems conform to? Here I describe two alternate approaches to these problems.

MOSIP has been set up by the International Institute of Information Technology, Bangalore (IIIT-B) as a "global public good" project which is described on their website as "[helping] Governments and other user organizations implement a digital, identity system in a cost effective way". The project intends to be open source in nature and to offer a "modular" software architecture, meaning that organisations choosing to use it are neither limited to existing functionality nor forced to use all the available features for their purposes. MOSIP is being developed to avoid the vendor lock-in problem and has use cases both as an all-encompassing "foundational" digital ID system or for issuing purpose-specific IDs for things like healthcare, insurance, welfare etc. IIIT-B hope that by making MOSIP open source, the platform can be easily adapted to new use cases and specific requirements, regulations and policies.

OSIA is a product of the Secure Identity Alliance, a non-profit consortium. It provides a set of standards for components that provide necessary services in "the ID ecosystem", and fully specifies the interfaces between those components. The system operator (government) can choose any supplier for the individual components (or implement their own), which avoids the vendor lock-in problem.

The Alan Turing Institute within its multi-year Trustworthy Digital Infrastructure for Identity Systems project is investigating and evaluating the existing efforts to actively contribute to the evolution of the field, including the extent to which the pros and cons of open source and open standards are being realised by platforms such as MOSIP and OSIA.

Elliot Maxwell suggests that: “The spectrum of openness is very broad. If a person creates a work but does not share it with anyone, the work is closed. On the other end of the spectrum are works made available to, and modifiable, by all. Most works fall between the two extremes. Thus characterizing a work as open or closed is rarely a binary decision; it is generally a question of “how open." This is something important to bear in mind even as we consider the openness of software in the context of open- source code and open standards.

Open source software is described by opensource.com as "[software whose] authors make its source code available to others who would like to view that code, copy it, learn from it, alter it, or share it", as opposed to "closed source" or "proprietary" software. The idea has been to encourage innovation through collaboration. The source code for open software projects are typically hosted on collaborative development websites such as github.com.

Open standards are guidelines for developers to help keep their software both interoperable, meaning they work with software developed using the same standard, and open, meaning that open-source development is not excluded from the particular software domain or technology. More generally, standards (as defined by ISO, the International Organization for Standardization) are voluntarily adopted, continuously evolving best practice formulas or documents compiled by (or in consultation with) a variety of subject matter experts.

Of course all standards need to be carefully designed and the hope is that openness will help with that process. As to whether a given software standard can be considered open, there are a variety of definitions, including that of the FSFE (Free Software Foundation Europe) which considers things like public assessment in development of the standard and the availability of the standard in multiple complete implementations or as a complete implementation equally available to all parties who may adopt the standard.

An important distinction to highlight is the relative informality of openly developed standards compared with international standards set by bodies such as ISO, which has a membership of 165 national standards bodies. As an example of how the development process is also different, ISO has a technical committee who draft each standard, before opening up for comments and voting within their membership, but does not consult the broader public.

The table below summarises some of the pros and cons associated with open source software development (when contrasted with proprietary software) and those of open standard adoption. There is a persistent myth that open source is insecure by default, but here we present security as a pro of open source software.

 

Approach	Pros	Cons
Open Source	Control: By viewing the source code, you can understand how the software works and whether it works as expected Security and Stability: More programmers means faster and more likely to spot/fix bugs and long term maintenance Contribution: Anyone can improve or fork the code for their own uses	Support: Open source software may lack the troubleshooting and FAQ support of proprietary software Maintenance: Contributors could neglect long term maintenance and projects could be abandoned These cons are less likely to apply for larger projects or those with an active contributor community
Open Standards	Interoperability: Widespread adoption of a standard means that software developed by different people can work together Durability: Standards can be carefully thought out to remain useful for a long time Building blocks: Standards define predictable boundaries for building within software ecosystems	Speed: Standards take a long time to develop and change Compromise: There could be many competing parties wishing to influence standards

 

The myth of insecurity

One important point to drive home is that rather than being a compromise on security in favour of collaboration, open sourcing software actually has benefits from a security perspective as well as functionality. Unlike in the case of propriety software that is developed by a single company, potential vulnerabilities in the code of software developed in an open source capacity can be spotted by a wider community of developers. Contributions including bug fixes that address these vulnerabilities can therefore be included in the code well in advance of the software being deployed in any production setting.

When the community works to test it by trying to attack it, improve it, it both helps security, and can lead to better governance, alerting regulators for example with information to help them decide what is in the public interest.

One can’t say that because it’s is open, it‘s secure, however if the open source community becomes large and diverse the scrutiny becomes significant. Projects such as MOSIP are attracting that scrutiny for identity (including that of the Turing project) and working to advance the systems.  Further, security researchers regularly find breaches in commercial products, that could have been found faster and easier if they were open source.

Whether digital identity systems will help or hinder progress towards fair and just societies in the 21st Century remains an ‘open’ question. The Turing is advancing an opportunity to encourage discussions with organisations around the world.

This work is also establishing a framework for evaluating "Trustworthiness” of the systems. Evaluation of the broad characteristics that underpin trustworthiness, including facets behind security, privacy, the robustness of the design, ethics and more can also be strengthened by open scrutiny.

The hope is that digital identity systems will empower citizens and reduce the humanitarian risks for the nations that adopt them. The push toward openness has created an opportunity to attract a level of scrutiny needed to support such an aim.