Our interest in identity systems was an inevitable outgrowth of our earlier work on blockchain-based¹ land registries.² Property registries, which at the simplest level are ledgers of who has which rights to which asset, require a very secure and reliable means of identifying both people and properties. In the course of investigating solutions to that problem, we began to appreciate the broader challenges of digital identity and its role in international development. And the more we learned about digital identity, the more convinced we became of the need for self-sovereign identity, or SSI. This model, and the underlying principles of identity which it incorporates, will be described in detail in this paper.

We believe that the great potential of SSI is that it can make identity in the digital world function more like identity in the physical world, in which every person has a unique and persistent identity which is represented to others by means of both their physical attributes and a collection of credentials attested to by various external sources of authority. These credentials are stored and controlled by the identity holder—typically in a wallet—and presented to different people for different reasons at the identity holder’s discretion. Crucially, the identity holder controls what information to present based on the environment, trust level, and type of interaction. Moreover, their fundamental identity persists even though the credentials by which it is represented may change over time.

The digital incarnation of this model has many benefits, including both greatly improved privacy and security, and the ability to create more trustworthy online spaces. Social media and news sites, for example, might limit participation to users with verified identities, excluding bots and impersonators.

The need for identification in the physical world varies based on location and social context. We expect to walk in relative anonymity down a busy city street, but will show a driver’s license to enter a bar, and both a driver’s license and a birth certificate to apply for a passport. There are different levels of ID and supporting documents required for each activity. But in each case, access to personal information is controlled by the user who may choose whether or not to share it.

Self-sovereign identity gives users complete control of their own identities and related personal data, which sits encrypted in distributed storage instead of being stored by a third party in a central database. In older, “federated identity” models, a single account—a Google account, for example—might be used to log in to a number of third-party sites, like news sites or social media platforms. But in this model a third party brokers all of these ID transactions, meaning that in exchange for the convenience of having to remember fewer passwords, the user must sacrifice a degree of privacy.

A real world equivalent would be having to ask the state to share a copy of your driver’s license with the bar every time you wanted to prove that you were over the age of 21. SSI, in contrast, gives the user a portable, digital credential (like a driver’s license or some other document that proves your age), the authenticity of which can be securely validated via cryptography without the recipient having to check with the authority that issued it. This means that while the credential can be used to access many different sites and services, there is no third-party broker to track the services to which the user is authenticating. Furthermore, cryptographic techniques called “zero-knowledge proofs” (ZKPs) can be used to prove possession of a credential without revealing the credential itself. This makes it possible, for example, for users to prove that they are over the age of 21 without having to share their actual birth dates, which are both sensitive information and irrelevant to a binary, yes-or-no ID transaction.

Although the concepts behind SSI have existed for over a decade, actually implementing them was, until recently, technically infeasible. The arrival of blockchain and the continuous advancement of biometrics have brought SSI from concept to reality. Blockchain allows for distributed data storage and peer-to-peer transactions, both of which are helpful for a system that requires the users to control data instead of having it under the control of a centralized authority. Similarly, biometrics is critical for enabling SSI, as it allows intrinsic characteristics of the individual to be extended into the digital world.³ Biometric capabilities are becoming increasingly common in smartphones, including fingerprint readers, facial recognition, and iris scanners.

The ability to securely tie a digital identity to a unique, living person through biometry is powerful. When paired with “a transparent, immutable, reliable and auditable way to address the seamless and secure exchange of cryptographic keys,”⁴ it becomes extremely compelling. With the recent emergence of blockchain the SSI community finally found a secure infrastructure for managing keys and attestations in a way that is both public and decentralized. Skeptics have sometimes described blockchain as a hammer looking for nails. Blockchain for SSI is just the opposite; not a case of a hammer looking for nails, but of a nail finding its hammer.

Though we live in a world that is increasingly digital, the benefits of the tech revolution have not been evenly shared. In the words of science fiction author William Gibson, “the future is already here — it’s just not very evenly distributed.”⁵ Policymakers and international development professionals must take this as a challenge. Ensuring that the positive impact of emerging technology is extended to the less fortunate is a daunting task, and it is not always obvious where to begin. But sometimes it is. Digital identity is one such case.

Identity is widely recognized as both a crucial tool and a pressing need in international development. When the Sustainable Development Goals were announced in September 2015, Goal 16.9 explicitly targeted “providing legal identity for all” by 2030.⁶ The development community has recognized that connecting people efficiently and securely to essential services requires a robust identity solution. As systems and services increasingly become digitized, so must identity. Already, the Identification For Development (ID4D) initiative at the World Bank is funding a set of initiatives in more than 20 developing countries to improve digital identity systems.⁷

But what is the optimal approach to digital identity? Digital identity platforms offer efficiency, transparency, convenience, and inclusion. Of course, if designed poorly, they can also create or exacerbate privacy and data security challenges. The dangers of centralized and insecure storage of personal data have been well illustrated by recent events—notably the Facebook-Cambridge Analytica scandal,⁸ the Equifax data breach,⁹ the ongoing challenges facing the Aadhaar system in India,¹⁰ and the most recent Facebook hack.¹¹

Alan Gelb and Anna Diofasi Metz of the Center for Global Development published Identification Revolution: Can Digital ID Be Harnessed for Development?¹² in January 2018. They review the case for digital identity, highlight the increasing importance in developing economies and examine current case studies such as Aadhar. They “conclude that digital ID has the power to do both tremendous good and to inflict serious harm depending on how it is used.”¹³ We agree completely and do not intend to repeat nor review their exceptional work here. Instead, we look to the next evolutionary stage of digital identity, which we believe is self-sovereign identity. We expect that SSI will be widely adopted in the coming years as it addresses the shortcomings of centralized identity systems.

The report has two sections. The first section is relatively non-technical and accessible: we describe SSI and its advantages; we discuss registries, broadly highlighting their role in society; and, we look at four areas in which we believe SSI can have a positive impact on land administration.

The second section assumes that the first section has succeeded in arousing the uninitiated reader’s curiosity about SSI. The curious reader must also be patient; our attempts at brevity resulted in an unacceptable density of jargon and so were abandoned. The second section has three parts: We review ten broad principles of SSI that have been in use for some time; we describe three emerging solutions from Everest, Evernym, and uPort, companies that have invested in SSI and should be taken seriously; and, we look at each firm through the lens of the set of ten principles previously described. This analysis does not imply our endorsement of these three. There are many companies competing in this rapidly growing space. Instead, by exploring three solutions which are both influential and markedly different along various axes, we hope to make clear to the reader the breadth of what is possible and the options they can explore.

Disclaimer: The week of final edits on this paper was punctuated, almost daily, by the release of a major publication about digital identity and/or SSI. This paper is neither definitive nor exhaustive. Instead, we intend it to be a useful tool for policy makers to learn about an emerging technology we see as inevitable. The only thing of which we can be certain is that by the time we send it to print, parts of it will have become outdated. This is a frustration familiar to anyone who analyzes emerging technology. Our hope is that even though our citations and examples may age quickly, some of the work here will be useful and stand the test of time.

This section is relatively non-technical and intended to be accessible. First, we describe and make the case for SSI. Second, we discuss registries broadly, highlighting their role in society. Third, we look at four use cases regarding land registries where we believe SSI can have a positive impact.

The way that identity and personal data are handled is fundamentally broken. We see at least four issues with how identity and personal data are managed today. Societally, we lack a coherent approach to regulating the handling of personal data. Users share and generate far too much data—both personally identifiable information (PII)¹⁴ and metadata, or “data exhaust”—without a way to manage it. Private companies, by storing an increasing amount of PII, are taking on an increasing level of risk. Solution architects are recreating the wheel, instead of flying over the treacherous terrain we have just described.

Society: Data does not have to be property to be protected. Elizabeth Renieris and Dazza Greenwood recently argued that treating data as property may be an insufficient legal framework for protecting our digital identities. Instead of trying to secure our privacy by applying property law to personal data, they suggest that some sensitive information may qualify for protection under human rights law. As such, they point out:

constitutional and international human rights laws protect our personhood, they also protect things that are property-like or exhibit property-like characteristics. The Fourth Amendment of the U.S. Constitution provides “the right of the people to be secure in their persons” but also their “houses, papers, and effects."¹⁵

The implications of this are significant and we encourage the reader to consider their work. Simply put, if their position is correct, regulators will have a powerful legal tool that does not require overhauling our property laws.

Users: We are creating too much data, both from oversharing and from “data exhaust,” but have no way to manage it. A common example of oversharing is entering a bar, which requires patrons to prove that they are above the legal drinking age.¹⁶ This is usually accomplished by presenting a state-issued driver’s license to the bouncer, which displays the customer’s date of birth. Yet an individual needlessly shares an exact birthdate for binary information: Is the person over or under the age of 21? Worse, sharing a driver’s license exposes other PII that is irrelevant to the identity transaction taking place, such as the bearer’s full name, home address, and status as an organ donor. Similar examples are sharing full credit histories, household income, and assets with a department store for a modest line of credit. One has to ask if sharing this information is necessary, and if so, what rules govern their future use of that data? Can they keep it? Can they resell it? Are they profiling their customers with it? More importantly, once this data is shared, how is it possible to know where it has gone or how it has been used?

As troubling as these questions are, issues around “data exhaust” are potentially more concerning. "Data exhaust" has been described as the “evil twin brother” of big data. It is the trail of cookies, session logs, and other metadata created during online activity.¹⁷ While this data is useful to firms for improving the user experience, it can also be used to develop profiles and individual-specific insights that compromise any reasonable definition of privacy. Unlike oversharing, users are often unaware of the amount of data they are leaving behind and the ways in which it can be used.¹⁸

Companies: Directly managing identity databases is risky. As companies and NGOs collect large amounts of information on their employees or the populations they serve, these organizations assume the responsibility of protecting that data. That burden is significant legally, financially, ethically, and socially:

• Legally: The EU General Data Protection Regulation (GDPR) went into force on May 25, 2018. This far-reaching regulation imposes significant penalties on entities if they manage personal data in ways that are legally deemed as irresponsible.
• Financially: Software maintenance, routine updates, server hosting, and the archiving of data are a nontrivial cost for companies and NGOs.
• Ethically: The Harvard Humanitarian Initiative released a report entitled Signal Code in January 2017 that describes the increasing volume of digital information humanitarian organizations are now handling and the responsibilities that data management entails.
• Socially: Everyone—employees, refugees, or social media users—is increasingly aware that their data is valuable and should/will be reluctant to share valuable data if there is no assurance that it will be well guarded.

Solution architects: We have too much functional identity and too little foundational identity. Many identity solutions are functional in design. A functional identity is used solely for a narrowly defined purpose. For example, a medical insurance card is used to access health care and a voter ID card serves the purpose of conducting a vote.¹⁹

A foundational identity, on the other hand, is multi-purpose, allowing access to multiple services or applications. Various national ID card systems or university ID cards, for example, could be classified as foundational.²⁰ SSI provides a way through the complexity of a centralized foundational ID, gives the individual a way to manage multiple credentials from multiple sources, and provides a user-centric platform that can in effect become the ultimate foundational identity—one solution that can be applied in most, if not all, use cases.

For all of these reasons, we see identity as broken, which is why we are excited about digital identity in the form of SSI.

Christopher Allen described four stages of digital identity in 2016.²¹ In Phase One, a single and centralized authority controls the system. For example, the Internet Corporation for Assigned Names and Numbers (ICANN) is the lone administrator—and source of truth—for domain name servers online.²² Within Phase Two, a federated solution, such as Microsoft Passport, allows users to utilize the same identity on multiple sites. A powerful institution, however, is usually at the center of the federation. Through Phase Three, there is a modicum of respect for consent concerning disclosure of PII across interoperable and user-friendly platforms, but final ownership and control of user-centric identities remain with the registering entity, such as Facebook, the Google G Suite, or OpenID. Phase Four is self-sovereign identity, requiring that users be in full control of their digital identities and are the sole managers of their PII—there is no central authority.²³

Table 1: Christopher Allen’s “Evolution of Identity” and Updated Examples

SSI provides users with full control over the administration and use of their identities.²⁴ One criterion that serves as a “litmus test” for SSI is whether a user’s identity can be revoked or deleted by the platform provider or any other third party. If this outcome is possible, the identity scheme is at best user-centric.²⁵

A user can create a self-sovereign identity on a given platform through a process known as enrollment. To be precise, the user is creating a public identifier that they control via a public/private key pair. The identity can be enriched over time as valid claims are added to it by credible third parties. Data input may include basic demographic and contact information, likely a full name, phone number, and email. Biometric information, such as a set of fingerprints or a face scan, may also be added depending on the platform in question. After the creation of this baseline identity, a user can compile a number of credentials, distributed by various issuing authorities. These initial credentials, such as a driver’s license, a passport, or a diploma, will be incorporated into the individuals SSI wallet.²⁶

A credential is a set of one or more claims provided by an issuer—a known and trusted real-world entity.²⁷Anticipated issuers include banks, universities, hospitals, and governments, among numerous others. Within an SSI ecosystem, these established entities can provide credentials that are easily verifiable and tamper-resistant through digital signatures.²⁸

As an individual user accumulates more verifiable credentials, their self-sovereign identity becomes more robust. In the future, a substantial SSI might include a digital driver’s license provided by the State of Maryland, a digital passport issued by the U.S. Federal government, and a digital diploma signed by Georgetown University. Furthermore, activities like paying taxes or credit card bills on time can also be recorded in an SSI wallet. Users will be able to disclose these verifiable credentials, or parts of them, as well as transaction histories, at their discretion. Furthermore, since the data sits in users’ wallets, their approval will be required if their information needs to be accessed.

Equipped with a self-sovereign identity, a user can return to their local bar and present the verifiable credential that “I am over the age of 21” (derived from the digital driver’s license) in a secure manner. Through algorithms known as zero-knowledge proofs (ZKPs), the user can validate that they are of the legal drinking age without sharing underlying or secondary data. The bouncer simply learns that the individual is older than 21, without viewing their date of birth or any other PII contained within the digital license. At that point the bar would have a record that the person associated with this wallet (which can be verified biometrically) is over 21, but would not have any other information.

Table 2: Selected Definitions of Self-Sovereign Identity Terminology

Source: "Verified Credentials Data Model 1.0,” World Wide Web Consortium (W3C).

We have traditionally kept identity data in centralized databases, which were the only technical option. Now that distributed ledger technology is becoming available and affordable, however, SSI projects are developing rapidly. As noted by Phil Windley, chair of the Sovrin Foundation, self-sovereign identity is now possible thanks to the development of distributed ledger technology (DLT). There is no central authority within the SSI model and no central database storing PII. DLT is ideal for SSI platforms because it enables secure enrollment, data storage, validation of credentials, and the recording of transactions without the need for a principal administrator.²⁹ Now that implementation of self-sovereign identity is feasible, there is a choice to be made. Bob Reid, of Everest, describes that choice as “either [data control] goes to individuals or it goes to major institutions that will mine our data.”³⁰

A self-sovereign identity solution can be adapted for a wide range of use cases, including subsidies, banking, microfinance, healthcare, and land administration. The interoperability and flexibility of SSI can also help to prevent the creation of identity “silos” designed for a specific purpose, such as for subsidies in a refugee camp. A single-purpose digital identity solution often places an unnecessary burden on marginalized populations; it is another password to remember, another card to safeguard, a new bureaucratic system to worry about.³¹

Widespread adoption of an advanced technical solution in the Global South may be challenging, but it is not impossible. Both mobile phone penetration and internet access are increasing in many developing countries (See Box 6 below).³² Thoughtfully-designed digital solutions—those which do not impose administrative and financial burdens or require a high level of technological know-how in the end user— can now attain widespread adoption in emerging economies. Examples include M-Pesa, which allows for the transfer of funds via text message, in Kenya and Tanzania, and WhatsApp, a messaging service with over 200 million users in India.³³

We believe that self-sovereign identity will be widely adopted due to: 1. social realities, as everyday life is increasingly digital and existing systems leave their users vulnerable; 2. the development of enabling technologies, such as DLT and smartphones; and 3. growing capacity for adoption of new technologies in the developing world. Various firms are already working with governments and other stakeholders to develop and implement SSI solutions. To borrow a quote from the Evernym homepage: “Self-sovereign identity: now that it’s possible, it’s inevitable.”³⁴

Self-sovereign identity could have a significant catalytic effect on registries. Before explaining further, it is useful to review the nature of registries and their importance in society.

Registries are key components of any functional society. Without shared, verifiable information about people and assets, collaboration, trade, and finance would all be all but impossible. A registry is a list of people, organizations, or things accompanied by information about them which is relevant to the purpose for which the registry was established. This information is endorsed and made credible by its inclusion in a trusted public ledger. Registries of people serve many purposes, from securing citizens’ access to services to helping researchers understand rare diseases. Asset registries allow for documentation of who has which rights to what assets. These records create value and serve as “market-enabling institutions,” for the various actors in different sectors of social and economic life who use registries on a daily basis.³⁷

Examples and typology of registries follow, although this list is far from comprehensive:

Entity registries capture essential information about people or organizations.³⁸

• Natural persons are individual human beings, as opposed to a legal person, which may be a private (business entity or non-governmental organization) or public (i.e., government) organization.
  • Vital records describe the group of birth, death, marriage, and divorce registries. In some jurisdictions, civil unions or domestic partnerships will also be included. A birth registry –complete with names, parents, time, date, and location– may be used for the purposes of citizenship or identity. The UNDP notes that in almost all societies a birth certificate automatically grants a number of rights, such as the right to health care, schooling, a passport, property ownership, voting, formal employment, and access to banking services.³⁹
  • Patient registries allow patients and researchers to collaborate, further disease understanding, and enable rapid decision making.⁴⁰ Similarly, a clinical quality registry is established with the purpose of monitoring quality of care for patients, providing feedback, benchmarking performance, describing patterns of treatment, and as a research tool. According to a 2017 study published by the University of South Australia, these registries play an increasingly important role in improving health outcomes and reducing health care costs. ⁴¹
• Legal persons are organizations or companies.
  • Company registries are usually managed either by a government or a chamber of commerce. Any company that wishes to be constituted legally must register with the managing entity, and may be placed within an industry-specific registry. Company registries improve the functioning of the private sector and facilitate tax collection, to name only a few key functions. ⁴²
  • Organizational registries list any other kind of organization from NGOs to churches. TechSoup’s NGOSource is one of the largest such registries that we are aware of. The registry and its impact are described in the following box.

Asset registries at their core, identify unique assets and then describe who has which rights to those specific assets.

• Real assets are physical things with intrinsic value.
  • Immovable registries describe parcels of land, from urban plots to sections of forests, as well as discrete buildings, apartments, etc. Broadly, the rights that an organization or person may have to these assets include, but are not limited to, ownership, occupancy, logging, mining, flyover, etc. A property registry helps to ensure strong land tenure security and enables mobility, security, financial inclusion, gender equality, and many other elements of socioeconomic development.⁴⁴ Land registries also help facilitate efficient tax collection and help identify property owner(s) during a transaction such as the purchasing or renting of land.
  • Movable registries describe objects which are not fixed in place, such as vehicles, boats, livestock, and mechanical equipment. Rights vary from ownership, to possession, to liens. A car may be owned by a dealership, possessed by the lessor, but have a lien held by a financing agency or bank. The FAO highlights how a registry can be used to levy taxes or to confirm ownership before a sale in the case of shipping,⁴⁵ but this is also true of automobiles and other vehicles.
  • Movable asset collateral registries record various assets that borrowers offer lenders to secure a loan.⁴⁶ While it may seem duplicative to list it here, the category is important enough to be distinctly labeled. These registries allow lenders to “perfect” a security interest,⁴⁷ provide recourse in case of loan default, and ensure an asset cannot be fraudulently used as a security for multiple loans. Collateral registries facilitate lending to businesses, with land and buildings widely accepted as collateral for loans.⁴⁸ Many banks in the developing world are beginning to accept movable assets as collateral, increasing financial inclusion for small- and medium-sized enterprises that lack immovable resources.⁴⁹ For example, a 2013 International Finance Corporation study found that access to bank finance increased by almost 8 percent on average across seven countries after collateral registries and related lending practices were established.⁵⁰
• Non-physical assets, are valuable but intangible things.
  • Financial assets are stocks, bonds, fiat or cryptographic currency, or debts owed by someone. Sometimes, financial assets can be included in the collateral registries described above.⁵¹
  • Digital assets range from rights to everything from music files, to satellite imagery, to parts of virtual worlds. They would also include utility tokens that are ostensibly non-financial in nature.

In all these cases, registries connect assets and/or related information with people or a group of people. Registry managers essentially perform four key tasks:

1. Verifying individual identity: Confirming the identity of the person or the group in question.
2. Identifying objects: Identifying the unique object in question, such as a boat or land parcel, where applicable.
3. Gathering data: Validating associated information, where applicable.
4. Managing the registry: Managing the process of adding, amending, and/or referencing information in the registry.

The occupation of these managers generally depends on the specific registry. A collateral registry will be staffed with financial experts, such as bankers and underwriters; a property registry will be staffed with property experts, such as surveyors and assessors; and a clinical quality registry will be staffed by medical experts, such doctors and researchers. Although establishing the identities of the people who interact with these registries is fundamental to their successful operation, this process usually relies on legacy systems and regulations. This often entails cumbersome and costly in-person identification, for example a lawyer or notary witnessing the seller’s signature on a property transfer document.

Our current identity systems are increasingly challenging, complex, and congested. People are more mobile and more connected than ever before. In the developed world, technology allows individuals to complete myriad tasks remotely—from renewing a license to buying a house; from selling shares to moving money between bank accounts. With such activities now possible online, there are also increased opportunities for fraud, as many basic checks on identity, namely completing a transaction in person, are eliminated. According to Javelin, a California-based advisory firm, “it is no coincidence then that adoption of digital channels and devices have grown in tandem with fraud.”⁵⁹ The number of identity fraud victims in the U.S. reached 16.7 million in 2017, a record high since Javelin began tracking identity fraud in 2003. These crimes continued to shift online and away from physical stores.⁶⁰

Within emerging markets, large groups of people are beginning to take part in digital financing. Societies that have used physical money for generations are now utilizing mobile phone applications, such as M-Pesa, to transact in refugee camps, town markets, capital cities, and remote villages.⁶¹ A 2016 report by McKinsey Global Institute asserts that the continued spread of digital financing in the developing world could be “transformative.” Provision of basic financial services via mobile devices can reduce costs for providers, while increasing convenience and opening access to capital for individuals; businesses can ease inefficiencies and generate significant productivity gains.⁶² As a result:

• The GDP of all emerging economies could increase by 6 percent, or $3.7 trillion, by 2025.
• This additional GDP could create up to 95 million jobs across all economic sectors.
• 1.6 billion “unbanked” people could gain access to formal financial services; more than half of this total would be women.
• An additional $2.l trillion of loans could be made to individuals and small businesses.

The report also warns that this trend is not without risks, including the creation of new transaction costs, as well as potential for fraud and abuse of technological newcomers. Secure digital identity is critical for combating fraud, which is the predominant risk that comes with increasing digitization of financial services. This risk extends to registries, which, as we discussed above, must be secure and reliable in order to support a wide range of critical economic activities. SSI could become a common solution to these growing problems. There will be both push and pull in the market:

• Push from registries: We expect registries to recognize both the increasing importance of digital identity and the complexity involved in managing identity for any given registry. We expect them to move from using existing government issued foundational identities (where, and if, available) to self-sovereign identity platforms for their registries.
• Pull from users: As the general population increasingly understands the value of personal information, people will demand the best available tools to protect their data. Also, as the foundational nature of SSI becomes clear, it will be preferable to use one SSI instead of creating a new functional identity (a service specific profile often managed with a username and password).

As self-sovereign identity platforms go into production and gain wider adoption, registries will have the opportunity to evolve. As the British Columbia example illustrates, transitioning to decentralized identity is possible for an established registry.⁶³

Kaliya Young, the “Identity Woman,” emphasizes the myriad interactions between individuals and institutional contexts where personally identifiable information ends up in databases; many, but not all of these, involve various types of registries. In The Domains of Identity, she describes 16 such identity interactions in detail (See Figure 1 below).⁶⁴ Aside from registration at birth, a person completes a number of secondary registrations and transactions over the course of a lifetime. Events include professional licensing, tax payments, and the purchase of land.⁶⁵ Many of these identity-based transactions suffer from inefficiency or “bottlenecks” variously caused by the requirement for a notary’s signature, the mailing of documents, or the need for an escrow agent.

Current registry infrastructure is usually centralized, with a government or private authority hosting and controlling the data. Numerous stakeholders are involved in administering these systems and jurisdictions adhere to different rules and regulations—especially as it relates to identity issues. As a result, individuals can experience difficulty in accessing relevant data, or can become entangled in protracted bureaucratic processes.

Self-sovereign identity solutions—through cryptographically-signed attestations, pairwise connections, and digital identities—put the information about the user under the control of the user. Individuals or groups can be explicitly linked to their assets via SSI. Registry functionality and scope will evolve as a result, and the challenges of verifying identity and sharing information will evolve to issuing verified credentials and managing the other components of a registry that are not benefiting from SSI.

To be clear, the role of government in registry management will not disappear. SSI should relieve government registrars of the tasks of validating identities and providing ad hoc reports, which would instead be offered by the owner of the relevant SSI. But governments still need to control a registry and manage the other critical data in the registry, as well as issue verifiable credentials.

Through this forward-looking model, it is possible to imagine the utility of asset registries depending on SSI for their identity function, especially in developing countries. Resource-constrained governments with limited technological and infrastructural resources can avoid the repetitive work of building identity into system after system. A state may also continue to arbitrate disputes, but if the integrity of information within identities—and by extension asset registries—improves over time, the need for arbitration or policing should diminish.

Eventually, SSI-based asset registries could also help to generate more accurate, trusted information regarding potential loan borrowers in the developing world. Juan Antonio Ketterer and Gabriela Andrade, both financial market specialists at the Inter-American Development Bank, assert that “more transparent and more efficient registries of assets as collateral could diminish constraints rooted in information asymmetries and thus facilitate access to finance.”⁶⁶ As shown by recent initiatives in Latin America and the Caribbean, the expanded use of movable assets as collateral can have a significant impact on economic growth for small- and medium-sized companies, female business owners, and young entrepreneurs.⁶⁷

Figure 1: Domains of Identity by Kaliya Young

Self-sovereign identity will be disruptive for property rights. The technology could explicitly connect people to land parcels within property registries and also provide a platform for documenting land claims and associated data in the absence of a secure formal registry. Discussion below will examine the impact of SSI on four other land-related topics:

• Efficiency in real estate markets: Mitigating fraud risk within real estate markets requires a high degree of due diligence around the identities of the transacting parties, contributing to workflow inefficiencies and high transaction costs. A self-sovereign identity solution could securely connect landowners to their properties and enable trusted and transparent online workflow, including legally-binding digital signatures.
• Property rights in post-conflict situations: The legal return of property to refugees and internally displaced persons (IDPs) contributes to peaceful rebuilding in post-conflict situations. But the process of restitution is complex, as many of the displaced lack important land-related documents or fear persecution for asserting their claims. A self-sovereign identity solution could enable these vulnerable individuals to securely store property ownership documents or to receive verifiable credentials from an NGO in order to better record a claim in the absence of a functioning registry. Of course, if a country had an SSI-integrated registry in the first place, refugees would never be separated from their claim to property.
• Natural disaster resilience: Accurate property rights are crucial for disaster preparedness and can expedite reconstruction. Current disaster resilience programs do utilize emerging technology, but a self-sovereign identity solution could provide individuals with a more secure and accessible tool to demonstrate their property rights and apply for aid and reconstruction grants. Distributed document storage would ensure the survival of essential records and biometrics would allow people to prove their identities and authenticate to services even if their physical identity documents were lost or destroyed.
• Women’s land rights: Women make up almost half of the world’s agricultural workforce, but are often excluded from land ownership by entrenched, discriminatory customs and practices. Recently, many countries have passed legislation to improve gender equality in property ownership. A robust self-sovereign identity platform could bolster this progress by connecting women more securely to their properties. Paper land records can be withheld or fraudulently transferred by male relatives. Similarly, physical identity documents needed to interact with the registry can be stolen or destroyed. The personal control and persistent identity afforded by SSI would help to address both of these issues. SSI could also improve transparency in judicial decisions related to land disputes, and allow gender-blind interactions with the land registry and related financial and administrative services via zero-knowledge proofs. In turn, a greater degree of women’s land ownership could support socioeconomic development throughout the Global South.

Even advanced land administration systems often lack sufficiently robust identity solutions. For example, in Ontario, real estate lawyers are required to verify the identity of their clients in property transfers. This means that clients must either be physically present with their lawyer for the signing of the documents or, if they are traveling, must hire a second lawyer in their location to attest to their identity. There is no settled law in Canada on the standards for remote, digital identification and authorization. Even a live video call with the client is considered insufficient. In addition, only verified real estate professionals (primarily lawyers) are allowed to file documents for registration in Ontario’s electronic land records system. In order to create an account they must submit an application and appear in person with two forms of ID.⁶⁸ The rationale for restricting access to verified professionals is largely the need to shift liability for verifying the identities of buyers and sellers away from the registry.⁶⁹

In technologically sophisticated and well-governed jurisdictions like Ontario this system functions very well. But the increased cost of registration and restricted access to the land registry is a greater burden in the developing world. SSI and biometrics can help to reduce fraud by bringing existing, verified, foundational identities to the registry.

The consequences of lower liability in real estate can be especially critical for countries in the developing world. Secure connections between people and property through SSI will better allow individuals to use property as collateral, and subsequently access banking services such as loans and mortgages.⁷⁰ Financial inclusion encourages improvements in land and housing, raising property values and enhancing livelihoods. For those who do not own property, transparent and secure registries provide better access to markets.⁷¹ Formalization of land and stronger property rights should also increase investor confidence, leading to an inflow of capital.⁷²

The legal return of property to refugees and internally displaced persons (IDPs) is critical for rebuilding in post-conflict situations. But the process of restitution is complex, as many of the displaced lack important land-related documents and/or fear persecution for asserting their claims. A self-sovereign identity solution could enable these vulnerable individuals to securely store property ownership documents or to receive verifiable credentials from an NGO in order to better record a claim in the absence of a functioning registry.

The 2005 United Nations’ Pinheiro Principles state that “all refugees and displaced persons have the right to have restored to them any housing, land or property of which they were arbitrarily or unlawfully deprived…”⁷³ Such recovery and/or restitution of property can be complicated. Whole families can change as a conflict carry on for years or decades. People often flee hundreds of miles and cannot return home easily. Many lose their identification cards, passports, deeds, and other important documents as they take refuge in other countries.

This phenomenon is far from new. Jewish groups are still attempting to obtain the return of Holocaust-era assets throughout Europe⁷⁴; Palestinians continue to claim houses and land lost during the chaotic formation of Israel.⁷⁵ And ruinous intra-state conflicts have proliferated since 1945; these civil wars last an average of seven to 12 years.⁷⁶ According to the 2017 Global Trends report by UNHCR, an unprecedented “68.5 million people were displaced as of the end of 2017. Among them were 16.2 million people who became displaced during 2017 itself, either for the first time or repeatedly.”⁷⁷ The relative ease of modern travel has resulted in millions fleeing far from home to Europe and beyond.

Case studies demonstrate the dire need to secure land rights in war-ravaged states. John Dempsey, formerly a senior advisor for Afghanistan to the U.S. Agency for International Development, notes that the South Asian country has produced roughly 8 million refugees and IDPs since the 1979 Soviet invasion. Families often return home to find their property long occupied by others. Poorly-organized, conflicting, and informal property claims unsurprisingly lead to land disputes, which easily devolve into violence, perpetuating instability.⁷⁸

The Syrian Civil War has currently displaced 12 million people, or approximately half of the pre-conflict population.⁷⁹ Although fighting has largely subsided, many refugees are afraid of returning to a state still controlled by the brutally repressive Assad regime. The Assad regime does appear to be interested in the homecoming of millions officially viewed as the opposition. Instead, Assad aims to reshape the demographics of his war-torn country.⁸⁰

Even for those Syrian refugees who do desire to return home, it will be increasingly difficult to lay claim to property. Recent surveys indicate that only 17 percent of Syrian refugees possess documentation of their property rights, while only 9 percent of IDPs have managed to maintain their records.⁸¹

Worse, the vindictive Assad regime in April 2018 passed Law No. 10, which enables the government to expropriate informal settlements for the ostensibly benign purpose of reconstruction or development. Most inhabitants of informal communities supported the opposition and fled the country. Both Syrians and international observers perceive Law No. 10 as little more than formalized land grabbing as punishment for rebellion.⁸²

The Assad regime is clearly aware of the immense power of land ownership, but instead of utilizing property as a tool for reconstruction and peace, the state is exploiting land as another weapon against its opponents. And Assad may very well realize a demographic revision of Syria.⁸³ Human Rights Watch notes that a significant segment of the Syrian refugee population is “unlikely to return without a house or property to return to.”⁸⁴

Precautionary actions could have been taken to mitigate this crisis. Various organizations are presently examining new technologies to support marginalized populations, including refugees and IDPs.⁸⁵ Implementation of self-sovereign identity is a compelling option to empower vulnerable groups during their displacement and repatriation. Digitized land records encrypted in distributed storage would not be destroyed or become inaccessible during displacement. These would ideally be copies of the legal land records held in the state-sanctioned registry. But other information to support land restitution claims can be recorded by an NGO through personal interviews and earth observation data. Such information can then be connected to a self-sovereign identity through a credential, giving refugees and IDPs time stamped documentation of their claim to that property. These credentials could later be used in the post-conflict dispute resolution and land restoration process.

Hurricanes, typhoons, and floods have all intensified in recent decades.⁸⁶ As vulnerable communities confront these natural disasters, land administration is increasingly recognized as a critical part of the emergency planning and recovery process. A lack of clear property rights particularly leads to conflict, delay, and higher costs during reconstruction.⁸⁷

Sameh Wahba et al. argue compellingly that land records and related geospatial data are vital in “all phases of disaster risk management, such as disaster reduction, risk reduction, preparedness and mitigation, and emergency response.”⁸⁸ In the aftermath of a natural disaster, thorough and secure registries ensure protection of property rights and livelihoods for returning evacuees. Post-disaster access to PII and land data facilitates loss valuation, reconstruction planning, and access to financial services including reconstruction grants.⁸⁹

Many disaster resilience programs do not take full advantage of emerging technologies, but there are notable exceptions. In the eastern Indian state of Odisha, for example, an initiative run by the state government in partnership with the Tata Trusts and Omidyar Network combines drone mapping, land title formalization surveys, and financial assistance to encourage the construction of permanent “monsoon-resistant” housing.⁹⁰ (Disclosure: Omidyar Network is a funder of the Future of Property Rights Program at New America, and provided financial support for this report.)

Investment in a more storm-resistant housing stock is essential for human security and economic development in places like Puerto Rico, where FEMA recovery grants –based on the replacement value of the existing structure, have been too small to allow for sturdier reconstruction that will survive the next major storm. According to reporting by The New York Times, the median repair grant was $1,800, and while “a new roof of cheap corrugated zinc typically starts at about $5,000 and might blow off again in the next hurricane; a concrete roof that could survive future storms costs about $15,000.”⁹¹

Paper land and identity documents are vulnerable to loss or destruction, and even simple ways of increasing the durability of documents, like lamination, may prohibit service at banks or government institutions.⁹² Paper records still serve an important role, especially in communities where connectivity is limited. But the issuance of paper documents should be accompanied by the concurrent creation of digital credential, linked to a SSI, in order to create a more resilient system.⁹³ The process of digitizing land records is relatively simple and has many practical benefits. We have written about the success of large-scale digitization projects in Punjab, Pakistan.⁹⁴ SSI could provide individuals with more agency and opportunities during post-disaster situations, especially given a synthesis of digital identity platforms and land registries. Due to decentralization, a self-sovereign identity solution will be more resistant to destruction, more accessible to vulnerable populations, and will allow for improved data management.⁹⁵

Almost half of the world’s farmers are women, but they are often excluded from land ownership due to entrenched discriminatory customs and practices. Although many countries have passed legislation to improve gender equality in property ownership, a robust self-sovereign identity platform could bolster this progress by connecting women more securely to their property. SSI could also improve transparency in judicial decisions related to land disputes. In turn, a greater degree of women’s land ownership could support socioeconomic development throughout the developing world.

On average, women comprise 43percent of the agricultural workforce in developing countries.⁹⁶ Small farms are labor intensive, and women are often expected to perform additional duties, including supplying food to men in the fields, fetching water, collecting firewood, caring for children, and preparing meals.⁹⁷ Women are also heavily involved in the livestock sector, and many others labor under contract farming arrangements.⁹⁸

Female farmers often lack proper access to resources and services such as land, animals, human capital, financial services, and new technology.⁹⁹ There is an enormous gender disparity in global land ownership. A recent analysis of eight African countries revealed that women comprise less than one quarter of landowners. The proportion of female landholders in Latin America is about 20 percent; in the Middle East and North Africa it is as low as 5 percent.¹⁰⁰ Poor women usually work in harsh conditions, earn meager wages, and are subject to sexual harrasment.¹⁰¹

In many contexts, a woman’s right to use land depends on her relationship to a man: a husband, father, brother, or other male relative. If said man dies or becomes estranged, the woman may be coerced off of land or out of a home with little or no recourse. Paper land records may be withheld from a woman or fraudulently transferred to a man during a subsequent dispute. These physical documents, needed to interact with a registry, might also be stolen or destroyed.

Even in places where women have equal land rights before the law, practices and customs often favor male rights over female. Officials often fail to protect women’s rights, and male relatives can withhold court notices to sabotage proceedings related to land-grabbing and other disputes.¹⁰²

Various developing countries, such as Nepal, have enacted progressive legislation to fight discrimination against women’s land ownership.¹⁰³ The African Union formally pledged in 2016 to ensure that women constitute 30 percent of landowners by 2025.¹⁰⁴ Punjab, Pakistan recently connected “next of kin” data within the national identity system to its provincial digital registry in order to guarantee women properly receive legally-mandated land inheritance. Related legislation concerning female property rights was previously ignored; now technology has improved lives by helping to ensure that good laws are executed.¹⁰⁵

Technology is not a panacea, and laws, behaviors, and attitudes will need to change. Yet a self-sovereign solution could mitigate many of the aforementioned abuses and help to sustain progress in gender equality. Personal control of a persistent identity afforded via a self-sovereign identity platform would allow for more secure management of land-related documents. It would be difficult for a male relative to fraudulently transfer, steal, or destroy a title connected to a women’s SSI, and stored on a biometrically-secure smartphone or in the cloud. Through use of zero-knowledge proofs, women might not even need to disclose their gender when interacting with a land registry or related financial and administrative services.¹⁰⁶

It is unrealistic to assume that digital identity can prevent real world threats and physical intimidation in land disputes. But an SSI ecosystem connecting women to the judicial system and/or relevant NGOs could help to streamline reports of injustice, as well as document sharing for legal proceedings. Increased transparency and the potential for human rights organizations to monitor data via observer nodes¹⁰⁷ might prompt previously apathetic officials to protect female title security. Repeated abuse could be connected to specific identities and clearly displayed on a blockchain for easy access by law enforcement.¹⁰⁸

The importance of women’s land rights cannot be overstated. Title security is strongly correlated with higher economic gains for women in countries like Tanzania, Rwanda, and India.¹⁰⁹ Female land ownership further promotes entrepreneurial investment, agricultural productivity, and food security. Multiple studies have even demonstrated that the resulting economic stability reduces women’s vulnerability to domestic violence, poverty, and the impact of HIV/AIDs.¹¹⁰

This section has three parts. First, we review 10 broad and well-established principles of SSI. Second, we describe three noteworthy SSI solutions from Everest, Evernym, and uPort. Third, we look at each of these three firms through the lens of the well-established set of principles previously described. We do not do this to make the case for any one of the three; by exploring solutions which are markedly different along various axes, we hope to clarify for the reader the breadth of possible options to be explored.

There is no universally recognized definition of SSI, although we agree with Christopher Allen that in the absence of a common description, the best course of action is to evaluate each solution by its overall adherence to the principles of self-sovereign identity, which “actually provide a better, more comprehensive, definition of what self-sovereign identity is.”¹¹¹ A sizable and growing body of literature surrounding the “principles of identity” seems to be harmonizing on to a consistent set.

Key members of the international development community have developed separate, yet overlapping principles for identification. Prominent sets are introduced in:

• The National Digital Identity Programmes: What’s Next? report by Access Now
• The Known Traveller report by the World Economic Forum
• The Principles on Identification for Sustainable Development report by the World Bank
• The ID2020 Alliance Concept Note

Several thought leaders¹¹² within the digital identity space have developed their own principles or laws:

• Kim Cameron of Microsoft introduced seven laws of identity in 2005.
• Christopher Allen presented ten principles of self-sovereign identity in 2016.

These various sets are relatively consistent. The table below shows that principles prevalent throughout this recent literature broadly include universal coverage and accessibility, protection, data minimization, and users’ rights to control and transport their identities.

Table 3: Various “Principles of Identity”

We have synthesized and recast these principles. The major differences being the addition of the principle of “Inclusion” and the removal of “Existence.” The former is critical for adoption in developing countries and the latter is implicit in other principles, including “Consent.” We believe that these principles incorporate all key principles in the space.

1) Inclusion: Identity should be available to all

Every individual should be provided with an identity from birth to death. Enrollment processes cannot discriminate against an individual due to ethnicity, gender, socioeconomic status, illiteracy, language, a lack of resources, or lack of technological literacy. An identity platform should ensure minimum cost to the end user in order to maximize inclusion.

2) Control: Users must control their own identities

Individuals must have ultimate authority over their identities and all related personal data. Storage should be decentralized to the greatest extent possible. It is the user’s prerogative to update, share, and hide any information. Solution administrators and/or stewards must be incapable of revoking a user’s identity.

3) Access: Users must have access to their own data

Users should be able to easily and directly access their identities and all related data. Access must not depend entirely on the technological or infrastructural capacity of the user, especially on the possession of a smartphone. Gatekeepers cannot restrict access.

4) Transparency: Systems and governance must be transparent

The manner in which an identity system functions, is managed, and is updated must be publicly available and reasonably comprehensible. Solution design should be based on open protocol standards and open source software, in part to prevent vendor lock-in. The governance model of the solution should limit the power of administrators to access, revoke, or otherwise interfere with the user’s identity and personal data.

5) Persistence: Identities must be long-lived

Identity systems must be long-lasting; user identities should last from birth to death. Solution developers should implement sufficient foundational infrastructure, and design sustainable commercial and operational models. As a caveat, the persistence of digital identities should not contradict the “right to be forgotten.”¹¹³

6) Portability: Identity information and services must be transportable

A digital identity cannot be restricted to a single platform. Users must be able to transport their identities – as well as credentials and attestations—from one platform to another. The transfer of data should be uncomplicated from the user perspective. All firms, governments, and third parties should strive for simple and consistent user experiences.

7) Interoperability: Identities should be as widely usable as possible

There are numerous contexts in which an identity is required. Through open standards and scalability, digital identity firms should allow myriad stakeholders to leverage the benefits of a solution. Different organizations, databases, or registries must be able to quickly and efficiently communicate with each other globally through an identity system.

8) Consent: Users must agree to the use of their identity or data

Users must give explicit permission for another entity to access and/or utilize their data. The process of expressing consent should be interactive, deliberate, and well-understood by the user. Shared information must only be used for a specific function. Users must restate consent for personal data to be used in a different manner and/or to be used another time.

9) Minimization: Disclosure of identity information must be minimized

Any identity solution should mitigate against extensive disclosure of personally identifiable information. A platform must minimize the type and quantity of information collected by entities that verify individuals. A user should share only the least possible amount of data necessary to accomplish the task at hand. Minimization can help to ensure user privacy.

10) Protection: Users’ right to privacy must be protected

Any solution must be embedded with “privacy-by-design.”¹¹⁴ Safeguards should exist against tampering, data traffic should be encrypted end-to-end, and restrictions should be placed on the monitoring of information. Affected parties must also be notified of a data breach. Users’ right to privacy must always come first.

The first instinct of many governments, NGOs, and international organizations may be to create single-purpose identity solutions through the use of biometrics and commonly available identity products.¹¹⁵ This is increasingly impractical and a disservice to the end user. Our analysis concentrates on firms dedicated to developing self-sovereign identity solutions.

The firms included within our report offer slightly different ecosystems. Each will include a self-sovereign identity platform and a private company (or group of companies) that will sell value-added services for their respective platform. Two of the ecosystems—from Everest and Evernym—will include an independent foundation as steward of the SSI platform with a fiduciary responsibility to uphold established principles. We believe that this structure is a strong model for governance.

Figure 2: A Suitable Model for a Self-Sovereign Identity Ecosystem

Multi-purpose, independent self-sovereign identity solutions are generally preferable to a collection of single-purpose tools for at least four reasons:

• Leverage: Any network-based ecosystem requires a critical mass of users to function and becomes more useful at scale. SSI is no exception. As an SSI solution interacts with an increasing number of services and credential providers, identities becomes stronger, more robust, and increasingly valuable. Each entity that provides a service or offers a credential increases the quality of an identity. Consider how you feel about a social media profile that has hundreds of contacts, some of whom you know, as well as years of posts and interactions: it is probably a real person. Now consider one with dozens of contacts, none in common with you, and a series of single issue posts: It might be a bot. The same is true with identity.
• Complexity of Related Technology: The technology needed to create and administer secure digital identities is complex and constantly evolving. Specialists and/or third party firms are better suited to create, deploy, and maintain digital identity solutions. These private entities are also more adept at keeping pace with rapidly evolving technologies. For instance, a firm interviewed for this report is actively tracking the rate at which the speed and cost of DNA sequencing are decreasing. Its leadership is waiting for the day when the technology can be used for biometrics.
• Risk Mitigation: Because identity is the core business of SSI platforms, their developers have a greater incentive to prioritize privacy and security than a government with competing priorities.
• Market Forces: Competition and the needs of various user groups will motivate and support both development and technological innovation.

Using the principles of SSI as a basis for analysis, we have developed a number of questions concerning the design specifications of various self-sovereign identity platforms and/or products. The three companies we have included in our analysis are Everest, Evernym, and uPort. Each firm is briefly described below.

Table 4: Attributes of the Self-Sovereign Identity Firms

The Basics: Originally known as EverID, Everest is a California-based digital identity firm founded by Bob Reid and Brad Witteman in 2016.¹¹⁶ Everest describes itself as “dedicated to liberating humanity from subservience to centralized, non-user friendly identity management and capital allocation organizations.”¹¹⁷ Through distributed, encrypted data storage, Reid and Witteman aim to socioeconomically empower billions of people.¹¹⁸

Network: The firm is creating the Identity Network (IN): “a non-profit, stewarded identity and value transfer network for the common good of the planet.”¹¹⁹ Everest asserts that IN will provide the technological infrastructure and protocols for every human to own and control their identity data, including biometrics. The blockchain-based network is designed to be self-funded, transparent, and to exist in perpetuity.¹²⁰ It is anticipated to go live in late 2018.¹²¹

Governance: The governance model will include the Identity Network Foundation (INF) charged with safeguarding the independence, transparency, and longevity of the network. Board members must be from an established NGO or international organization dedicated to socioeconomic development.¹²² The targeted launch date for the INF is December 2018.¹²³

Decentralized Application: The Everest decentralized application is designed to operate within the IN ecosystem. The dApp will contain EverID, described in the Everest Whitepaper as a “digital biometric identity system to store and confirm user identity data.”¹²⁴ Everest technology creates a user identity and records user information into a proprietary, encrypted storage file: the EverID Datagram.¹²⁵ This dataset is stored on an individual’s smartphone, if available and also on a network of InterPlanetary File System (IPFS)¹²⁶ nodes.

Everest plans to create and support a new economy to verify identity and record, update, store, and transfer value.¹²⁷ In order to do so, Everest will include two additional components within its platform. The first is EverWallet, a multi-currency digital wallet with built-in document storage, which is included in the Everest decentralized application.¹²⁸ The second is EverChain, a transaction system built on a private, permissioned instance of the Ethereum blockchain.¹²⁹

Per the Everest Whitepaper, a robust digital identity will allow individuals to validate themselves to large organizations, such as banks or hospitals, and obtain services. In turn, these entities can use the Everest platform to cost-effectively verify user identity, track service delivery and consumption, and ensure that funds are delivered securely. The Identity Network ecosystem is intended to mitigate issues such as leakage, fraud, and inefficiency.¹³⁰

Token & ICO: Everest will use a utility token, the ID, and a USD-pegged token,¹³¹ the CRDT.¹³² IDs will allow entities to interact with the system,¹³³ while CRDTS are the digital currency used to move value.¹³⁴ Institutions that want access to the Everest economy or want to operate observer/transaction nodes will gain access by purchasing and holding a predetermined number of ID tokens corresponding to their role in the network. Everest plans to conduct an initial coin offering in Fall 2018, and will issue a maximum of 800 million IDs for three rounds of financing.¹³⁵

Every enrollment, verification, update, or transaction will require spending CRDTs. Everest intends to initially peg the CRDT to the US dollar, and each token will be equal to USD $0.01. “The goal of pegging to a known and accepted fiat currency is to achieve stability, liquidity, and transparency.”¹³⁶ There is no planned ICO for the CRDT, as it will only be used to verify identities and exchange value within the Everest ecosystem.¹³⁷

Use Cases: The Everest “testnet”¹³⁸ launched in July 2018, and Everest 1.0 is scheduled to go live in October 2018.¹³⁹ The firm is currently engaged in a health service project in Cambodia and a gas subsidy pilot project in Indonesia.¹⁴⁰ Other possible use cases listed on the Everest website include land administration; micro-insurance; micro-financing; cash transfers; remittances; medical records; and humanitarian aid.¹⁴¹

The Basics: Evernym was founded in 2013 by Jason Law and Timothy Ruff, and is headquartered in Salt Lake City, Utah.¹⁴⁷ Evernym is a well known player in the digital identity space, and endeavors to “significantly ease the deployment of self-sovereign identity infrastructure in many different industries.”¹⁴⁸ The company is perhaps best known for creating Sovrin in 2016.¹⁴⁹

Network: Sovrin is designed solely for identity, and the platform is described as “the first global public utility exclusively for self-sovereign identity and verifiable [credentials].”¹⁵⁰ The software is based entirely on open standards, with the core network code being open sourced under the Hyperledger Indy project.¹⁵¹ The Sovrin white paper asserts that platform architecture accounts for the four major requirements of self-sovereign identity: governance, scalability, accessibility, and privacy.¹⁵² The Sovrin Network is planned for launch in late 2018.¹⁵³

Governance: Company leadership recognized the need to engage with digital identity, security, and privacy experts to assist with design and governance. To that end, they established the Sovrin Foundation in late 2016 as an international non-profit comprised of a Board of Trustees and a Technical Governance Board. In early 2017, the Sovrin Foundation transferred its open source code to the Linux Foundation¹⁵⁴ to create the Hyperledger Indy project. The foundation is now finalizing version two of the Sovrin Trust Framework, a document defining the business, legal, and technical terms for participation in the Sovrin Network.¹⁵⁵

Decentralized Application: Evernym was difficult to distinguish from Sovrin only a year ago, but has separated itself from the governance of the platform.¹⁵⁶ The company is now a vendor of Sovrin-enabled software and services. Its Connect.Me wallet, a smartphone application, will enable individuals to create secure, peer-to-peer communication channels with other people and organizations.¹⁵⁷ The application also allows a user to manage digital keys and verifiable credentials, giving a person “true control over their digital identity for the first time.”¹⁵⁸

Token & ICO: Evernym does not plan to conduct an ICO, but will participate in the Sovrin ecosystem as a vendor of Sovrin based solutions.¹⁵⁹ Through implementation of advanced “privacy-by-design” features, including pairwise pseudonymous identifiers, peer-to-peer exchanges, and selective data disclosure through zero-knowledge proofs, Evernym believes that it can help to transform major economic sectors. The four highlighted within the Sovrin white paper are: 1. identity and access management; 2. cybersecurity; 3. regulatory technology; and 4. data integration.¹⁶⁰

The Sovrin Foundation plans to create a digital token—the Sovrin token—for privacy-preserving value exchange. By providing an economic incentive for network participants, the Sovrin Foundation intends to enable a global marketplace for digital credentials of various types and values. Ancillary markets for digital credential insurance and permissioned personal data may also emerge.¹⁶¹ An initial coin offering is scheduled for 2018.¹⁶²

Use Cases: Launch of the Evernym Connect.Me application is planned for 2019.¹⁶³ The firm has already conducted a number of pilots across varying geographies and sectors. Prominent examples include a digital identity solution for credit unions, financial services in Canada, a partially completed birth registration project in Illinois, and a nationwide initiative to provide U.K. doctors with a digital passport and reputation system.¹⁶⁴

The Basics: uPort grew out of ConsenSys, a Brooklyn-based blockchain firm. Rouven Heck, Michael Sena, Christian Lundkvist, and Pelle Braendgaard are considered the founders.¹⁷¹ The stated purpose of uPort is to “return ownership of identity to the individual by creating a trustworthy, flexible, and inclusive identity solution that empowers people.”¹⁷²

Network: Unlike the Everest and Evernym solutions, uPort is built on the public Ethereum blockchain. Founded in 2015, Ethereum was conceived as an improvement on Bitcoin, the first public blockchain, adding support for smart contracts and decentralized applications.¹⁷³ While there is constant discussion¹⁷⁴ about the future of blockchain technologies, the Ethereum ecosystem—which is supported and nurtured by ConsenSys—is relatively broad and robust.¹⁷⁵

Governance: uPort leadership has not expressed any intention to create a foundation for stewardship of its digital identity solution. But if uPort intends to become a major player within the space, we expect that such an entity will be created. Both Everest and Evernym will have independent foundations to safeguard the interests of users and hold all participants within their respective ecosystems to the highest possible standards. In order for uPort to remain a viable and competitive option, an independent foundation with stewardship over uPort may be necessary.

Decentralized Application: The company website describes uPort as an “interoperable identity network for a secure, private, and decentralized web.”¹⁷⁶ By creating base infrastructure for digital identity on Ethereum, uPort claims to “lay the foundation for a radically free, equitable, [peer-to-peer], user-centric internet society.”¹⁷⁷ According to uPort, its dApp is simple to use and meets demanding usability, flexibility, and interoperability requirements.¹⁷⁸

The firm released an updated version of the uPort ID dApp in late September 2018, and it is available to download for iOS and Android. This new version is built on the Ethereum mainnet.¹⁷⁹ The smartphone application allows users to register their own identity on Ethereum, send and request credentials, sign transactions, and securely manage keys and personal data.¹⁸⁰ Per uPort, “users are always in control of their data and they are free to share it with whoever they choose.”¹⁸¹

Token & ICO: The uPort solution does not have its own token and there are no plans for an ICO. Instead, uPort is based on Ethereum and uses Ether and other ERC20-compliant tokens.¹⁸² As such, the application will charge Gas to complete smart contract transactions within the Ethereum ecosystem.¹⁸³ Rouven Heck, co-founder of uPort, emphasized that uPort shifts costs away from the end user, as Gas fees are paid by the identity issuer.¹⁸⁴

Use Cases: uPort has been applied to a number of initial use cases. These include the Gnosis prediction market, the FOAM geospatial data protocol, asset management, and online poker. In addition, uPort has completed a pilot with the city of Zug, Switzerland.¹⁸⁵ Through its base-layer identity application, uPort can issue “citizenship” to city residents. After input of basic information online, the scanning of a QR code associates the PII with a uPort address. Citizens must then visit Zug city hall, where the government validates the uPort ID and signs the data with a private key. The resulting credential is stored on the user’s smartphone and can be used to log in to city services. A citizen of Zug can use their uPort identity to vote, access a bike-sharing service, and log in to the citizen’s tax portal. As of late May 2018, approximately 300 Zug residents were registered with uPort.¹⁸⁶

ConsenSys highlighted a number of benefits of the Zug pilot in a 2017 blog post: 1. reliance on the public Ethereum blockchain lowered infrastructure requirements; 2. decentralized data storage decreased the risk of cyber attack or data theft; and 3. the early version of the application, situated on a testnet, was cost effective and scalable.¹⁸⁷

Everest, founded in 2016 and only recently emerged from “stealth mode,” is a relatively new actor.¹⁸⁸ The California-based company is developing proprietary software, which raises eyebrows in the open source community. Nonetheless, Everest has created a potent multifunctional platform which does not require smartphones, and has conducted a number of impressive pilots with a diverse group of partners (See Box 4 above). Evernym has a longer public record in the digital identity space, having developed Sovrin and the Hyperledger Indy project.¹⁸⁹

We believe that the differences between Everest and Evernym are similar to the broad differences between Apple and Google. Akin to Apple with iOS, Everest plans to operate in an integrated system where they offer services. In contrast, the indicated commitment of Evernym to open source technology is more analogous to Google and its Android Open Source Project.¹⁹⁰

As a part of the ConsenSys mesh, uPort is part of an increasingly important Ethereum ecosystem. ConsenSys was founded by Joseph Lubin, co-creator of Ethereum, and it very engaged with the community.¹⁹¹ Schemes include ConsenSys Labs, which “supports entrepreneurs and developers around the world as they build on the Ethereum platform,” and ConsenSys Academy, an educational institution “developing the global blockchain ecosystem by bridging the Ethereum knowledge gap.”¹⁹² ConsenSys also has a number of high-profile partnerships. For example, the company is an advisor to the Government of Dubai on blockchain, and has even engaged in a proof-of-concept with the Emirate to build a blockchain-based land registry.

The features of a digital identity solution are obviously technical, and are often explained in jargon. To many stakeholders, therefore, the specific aspects of a platform can be overlooked if it is functional overall. For example, Aadhaar appears sufficient at a distance, but it has frequently suffered data leakages¹⁹³ from its centralized servers.¹⁹⁴ Yet correct solution design, including data storage, accessibility, and privacy, is critical if individuals are to safely and securely utilize a digital identity every day in the real world.

Our goal is to familiarize policymakers and other stakeholders within the international development space with effective solutions to their identity problems. Utilizing our adopted set of “Principles of Identity” as a framework, we now examine the design specifications of the aforementioned firms’ self-sovereign identity solutions. We aim to provide high-level overviews of the three platforms, comparing and contrasting their functionality.

Our methodology included desk research and interviews with company leadership and employees. To help ensure uniformity and impartiality, an identical and standardized set of questions was asked during interviews. General design question themes include platform architecture, governance, data storage, tokenization, key management, and biometrics. ¹⁹⁵

The three firms aim to maximize inclusion within their solutions through free access to basic services.

All claim to not discriminate against potential users due to ethnicity, gender, socioeconomic status, or language. However, their respective degrees of outreach to different audiences vary.

Everest strives to include the “Bottom of the Pyramid,”¹⁹⁶—the “unbanked” and the “unverified"—within its solution.¹⁹⁷ To accommodate for illiteracy and a lack of technological know-how, its platform will employ pictograms, biometric scans (in place of written passwords), and voice commands. Everest will also allow coaches—or “agents”—to guide users through any process.

Evernym, through Sovrin, wants to enable universal accessibility. The Sovrin white paper explicitly states that, “a global public utility for self-sovereign identity must meet the identity needs of everyone,” and that “the goal must be identity for all.”¹⁹⁸ The firm, through a concept of “guardians”, will enable a person to manage an identity on behalf of a vulnerable individual or anyone else unable to manage their digital wallet.¹⁹⁹

uPort, as part of ConsenSys, is more so configured to support people within the Ethereum community, and within the crypto-community generally. Nonetheless, the firm provided the example of red and green buttons as a cross-cultural and intuitive design feature that it is considering for use within its platform.

Everest and Evernym are noteworthy for two reasons. First, use of their dApps will not necessarily require smartphone ownership. Although studies do suggest that hardware penetration is increasing in the Global South, access in least developed countries is still a challenge (See Box 6 below).²⁰⁰ As our study is focused on the developing world, we believe that it is essential to account for individuals lacking sufficient resources. Everest, in particular, intends to ease enrollment, and therefore inclusion, through the use of paid “agents” owning smartphones.

Second, the ability for an “agent” or a “guardian” to ease interaction with an identity solution can help to ensure widespread inclusion and use. Even the most intuitive and user-friendly system may still be challenging for uneducated or illiterate individuals with limited technological exposure. Important tasks, such as accessing food subsidies, voting, or scheduling a medical appointment, may seem intimidating or even impossible no matter how “simple” a process has been designed to be.²⁰¹

Individuals, not technology companies or governments, must have ultimate control over their identities and related PII. Only users should be able to access, update, share, hide, or delete their personal data. No self-sovereign identity firm, or any other third party, should ever be able to revoke an identity. All three firms agree, but will enable an individual user to possess and control their self-sovereign identity through different methods.

The Everest solution will allow only a user to “unlock” their EverID Datagram. This will be accomplished via biometry—a faceprint and/or a fingerprint scan—and a PIN/password. Lacking smartphone ownership, a user will be able to control their data through an “agent device.”

Decentralized storage of private keys and personal data within the Everest solution will further ensure user control. Through the Identity Network Foundation (INF) supernode infrastructure,²⁰⁴ data will be stored in IPFS, spread across multiple data centers and various geographies.

Everest will further provide for the ability to recover control of an identity. Through provision of biometrics and successful completion of a “challenge process,” a user can regain command of their EverID Datagram on any Everest-enabled hardware device. We believe that this feature is especially pertinent to the developing world, as social upheaval, natural disasters, and large-scale population movements can easily result in the loss of a personal device.

Evernym will store all personal data on the user’s smartphone. If desired, PII and a “recovery key” can also be encrypted and stored on the cloud. Control in the Evernym solution will also be enabled through biometry; but the Connect.Me dApp will use the default biometrics on a given smartphone.

The Evernym solution will provide a simple export/import option to recover a private key and therefore control of an SSI.²⁰⁵ While the firm did not provide details, exportation of a private key usually involves the creation of a file containing private key data and its transfer to a new or different wallet. An individual can generally import a private key into a digital wallet via a text file or QR code scanning.²⁰⁶

Tech savvy individuals may find this process relatively simple and straightforward. But a refugee is unlikely to carry along a text file containing Evernym private key data as they flee violence; a poor migrant worker may lack the resources and knowledge to manage their key in such a way. The aforementioned ability to backup both PII and a key in the cloud, as well as the potential to designate a “guardian,” may mitigate this concern in the developing world.

uPort stores private keys and PII on user smartphones, and does not necessitate the use of biometrics to enable control of a self-sovereign identity. An individual can use the standard biometric functions of a smartphone as an additional security layer, but the solution only necessitates provision of a PIN and a basic password for control. In general, uPort is concerned with the potential for biometrics to allow for identity correlation.²⁰⁷

uPort relies on a seed phrase to recover control of an identity.²⁰⁸ In regard to its target audience, it should be relatively easy for a member of the crypto-community to record a seed phrase for later use. Vulnerable individuals—such as IDPs, refugees, and persecuted minorities—in developing countries might encounter considerably greater obstacles in storing their own seed phrases for quick access.

Overall, user control of an identity will allow individuals to selectively update, share, hide and delete personal information. Decentralized and encrypted storage can also limit third-party access to data and should bolster privacy.²⁰⁹ For marginalized populations in the developing world especially, control over identity is crucial. Selective disclosure of PII can help to protect ethnic and religious minorities, women and children, migrants, and individuals diagnosed with infectious disease such as HIV from discrimination, abuse, and violence.

Self-sovereign identity firms should endeavor to create easy enrollment in, and access to, their platforms. Indeed, all three will allow for self-enrollment within their solutions. At a minimum, an individual must input basic demographic and/or biometric data to satisfy enrollment requirements.

Enrollment and subsequent access will require interaction with hardware—typically a smartphone or tablet, or possibly a laptop—and internet connectivity (See Box 6 above). Reliance on these devices might compromise access in the developing world, but this could be mitigated via agents and/or public access centers. Additionally, hardware is constantly improving and becoming more affordable. Humanity continues to urbanize, and technological resources tend to be more readily available in cities.²¹⁰

Everest will employ coaches—or “agents”—to help users without smartphones enroll and access its solution. Following user provision of biometrics to an “agent device,” pre-designated “agents” should be able to guide individuals through any process in the Everest platform. These “agents” will be compensated based on the subsequent economic activity of previously enrolled users.

This arrangement may become less necessary with increasing rates of smartphone ownership and accompanying technological literacy. But a network of Everest “agents,” employed to enroll and authenticate users without personal devices, would be especially helpful during and after chaotic population upheavals caused by conflict or natural disasters. Perhaps multiple Everest “agents” would be present in a refugee camp within such a scenario, allowing for continued access to self-sovereign identities.

Evernym, via Sovrin, will include a concept of “guardianship.” The feature will enable a trusted party to manage the identity of a vulnerable person. We believe that Evernym is prescient to allow for this possibility within its solution design. There will always be defenseless individuals in the world, such as sex-trafficked children, the elderly, refugees, or people who are ill. The Evernym decentralized application will allow pre-designated and responsible “guardians” to manage self-sovereign identities in the best interests of these groups.

uPort does not currently plan to utilize “agents” or “guardians” within its solution. But the firm does attempt to expand access by reducing reliance on a specific hardware device. uPort asserts that an individual smartphone, or any other device, is not part of a user’s decentralized identifier (DID)²¹¹ within its solution. This allows individuals to switch devices without the loss of an SSI, and protects against the loss or replacement of a device.

Transparent governance and open solution design should help individuals make informed decisions about their identities and PII. As demonstrated in Figure 2, we believe that a suitable model for an SSI ecosystem includes a platform, a private firms providing value-added services for that platform, and an independent foundation stewarding the platform.

Everest plans to establish the Identity Network Foundation (INF) in December 2018. The INF will be a nonprofit organization and will govern the Everest ecosystem.²¹² As previously mentioned, INF board members must originate from an established NGO or international organization committed to socioeconomic development. Everest states that the INF “is designed to ensure transparency, neutrality, security and longevity of the Identity Network.”²¹³

The Everest platform is based on two private and permissioned instances of the Ethereum blockchain.²¹⁴ Everest believes that there is no need for the general public to access its technology through any mechanism other than the dApp or the software development kit/application programming interface (SDK/API).²¹⁵ Everest utilizes Ethereum code specifically because “it is a proven, trusted open-source system which is built by a highly-engaged distributed organization and which has a vibrant developer community.”²¹⁶

Evernym, and the Sovrin ecosystem, will be governed by the Sovrin Foundation, an international nonprofit organization. The Sovrin Foundation Board of Trustees consists of 13 individuals from around the world and is bounded by the Sovrin Trust Framework, a set of business, legal, and technical policies originally published in June 2017.²¹⁷

Through the Sovrin Network, Evernym uses an open source, hybrid architecture that provides access in a permissioned ledger. The overlying identity system does not require permissioning; only the need to be cheap and fast.²¹⁸ Any individual and/or organization will be allowed to enroll and create DIDs. But all nodes, and most importantly, validator nodes,²¹⁹ will be managed by stewards. Organizations are invited by the Sovrin Foundation to become a steward, and must agree to act in accordance with the rules set out in the Sovrin Trust Framework.²²⁰

Responsible governance provided by the INF or the Sovrin Foundation, along with secure blockchain implementation, might help to prevent the misuse of digital identity and PII in the developing world. For example, in contrast to the poorly-defined legal framework surrounding official use of Aadhaar-related data,²²¹ a limited, enforceable, transparent set of rules—such as the Sovrin Trust Framework—could mitigate against unwarranted data collection and location monitoring. Malicious actors might be prevented from tracking and targeting marginalized groups, ethnic, religious, or otherwise.²²²

The uPort platform, which was conceived as base infrastructure for projects requiring digital identity– does not have a governance model. Leadership has not declared an intention to create a foundation analogous to the INF or the Sovrin Foundation, yet we believe that such an entity is necessary if uPort aims to become a major player within the digital identity space. This independent organization could help to protect users’ interests and to ensure that all actors within the ecosystem behave accordingly.

uPort is based on the open source and public Ethereum blockchain, largely because it is relatively easy to create a wide range of decentralized applications using the technology. This choice noticeably introduces additional costs, as the public Ethereum blockchain requires expensive computational activity and Gas fees in order to add new transactions to the ledger.

Table 5: Blockchain Implementations of the Self-Sovereign Identity Firms

A self-sovereign identity solution must last for decades, at least. An individual should possess an identity from birth until death. Each firm also recognizes the need for long-term persistence, although they have developed very different strategies for achieving this goal. These schemes are rooted in both foundational infrastructure and commercial/operational models.

At the core of the Everest solution are two private Ethereum-based blockchains: the EverChain, a blockchain-based transaction system, and the EverID blockchain, which includes a pointer to the storage location of the EverID Datagram on IPFS and a hash²²³ of the EverID Datagram for integrity checks.²²⁴ Everest supernodes, which host the two blockchains, will be operated by members of the Identity Network Foundation.

The two Everest blockchains will exist in parallel to the public Ethereum blockchain. The private and permissioned network will utilize independent software and hardware and Everest leadership maintains that their solution would be unaffected if the Ethereum mainnet were to suddenly disappear.²²⁵

Everest claims that its solution will reduce fraud and leakage, possibly saving significant sums for organizations globally, and that it will “make identity verification at scale more cost-effective than ever before.”²²⁶ Although these benefits, if realized, might lead to widespread adoption, the Everest business model also involves driving other economic activity within its ecosystem. The firm will charge entities for access to its multi-functional marketplace, and will levy small fees for specific user actions.²²⁷

Evernym will be based on the Sovrin Network, a purpose-built blockchain for self-sovereign identity. As of late July 2018, forty-one Sovrin stewards have commited to host network nodes in at least 12 countries.²²⁸ Evernym infrastructure for the Connect.Me dApp will be primarily hosted on the AWS.

We are cautiously optimistic regarding the persistence of Sovrin, despite the fact that the blockchain is single-purpose. By electing to make the software open source as Hyperledger Indy, Evernym has positioned the network for widespread adoption and has likely increased its odds of persisting.²²⁹ In addition, the Sovrin steward framework, with companies such as IBM, Cisco, and ATB signed on to operate nodes, suggests that the ecosystem has staying power.²³⁰

The Sovrin Foundation claims that the Sovrin Network can help to mitigate the enormous costs—hundreds of billions per year globally²³¹—related to cybercrime and data breaches.²³² The white paper specifically asserts that the Sovrin Network could reduce costs and increase efficiency in the major industries of: identity and access management; cybersecurity; regulatory technology; and data integration.²³³

For its part, Evernym maintains that its Connect.Me dApp will lower the costs and risks of identity verification. The firm will therefore sell its identity verification “toolkit”—which includes the Hyperledger Indy SDK, a user interface, and its mobile application—to institutions on a subscription basis.²³⁴ Evernym also plans to support the Sovrin Network through future products and services.

uPort, as part of ConsenSys, is dependent on the live, public Ethereum blockchain and views itself as an enabler of the ecosystem. But the uPort team does not host any servers. dApp developers must maintain the physical infrastructure of the platform instead.

The working assumption within its community is that Ethereum will persist.²³⁵ The platform is “generalized so that anyone can program it for their specific needs.”²³⁶ This versatility may very well incentivize widespread adoption of the technology. At present, Ethereum has a market cap exceeding $20 billion, over 1,900 decentralized applications, and scores of developers building upon it.²³⁷

uPort asserts that its foundational identity infrastructure will always be free to the user. Only entities need to pay Gas costs in order to validate credentials. Eventually, uPort would like to be utilized in an identity validation market, and anticipates requiring organizations to pay fees. The firm hopes to gain a better understanding of a holistic and viable business model as the underlying Ethereum platform evolves.²³⁸

Table 6: The Persistence of Self-Sovereign Identity Solutions

Even given viable incentives for adoption, or sustainable business models, there is no guarantee that any solution will be utilized and/or exist in perpetuity.²³⁹ We remain confident but guarded about each. While unlikely, it is not impossible that a network could fail. The ability for users to transport their identity to another system is clearly crucial.

It should be possible for the user to transport their identity and any related data from one platform to another, different platform. The wider community is aware of this necessity and is currently within the process of establishing open standards at forums such as the Decentralized Identity Foundation (DIF)²⁴⁰ and the World Wide Web Consortium (W3C).²⁴¹ Due to this extensive collaboration, we expect that the transportation of a self-sovereign identity will be possible in the future.

The digital identity firms claim to account for portability within their solutions:

• Everest is planning for the user to be able to transport their self-sovereign identity to another platform through use of DIF standards.
• Evernym noted that the Sovrin Trust Framework states that, “the design, governance, and operation of the Sovrin Network shall provide Members with portability of their Public Data and Private Data to the greatest extent feasible consistent with the other principles herein.”
• uPort leadership maintained that the transfer of an identity and any pertinent data to another service would be intuitive.

The use of open source code, open standards, and a standard process for private key recovery²⁴² may reduce dependence on any single solution. But the actual process of transporting a self-sovereign identity from “solution A” to “solution B” remains unclear from available resources. One reason that firms will need to address interoperability is to be able to manage against vendor lock-in –people are not going to invest in an SSI solution if they are not able to get out at a later date.

The digital identity space is becoming increasingly competitive, and it is far from clear if any particular platform will experience widespread and predominant adoption in the future. As the community expands, solutions must be able to communicate with each other at scale. Governments and large organizations will greatly value the ability to choose a distinct SSI solution and still be able to communicate quickly and efficiently with entities that decided to adopt a different platform.

Although Kaliya Young recently observed that there is still a significant amount of work to be done regarding interoperability, important stakeholders are coordinating with one another to build a broad, interoperable ecosystem.²⁴³ This is still clearly an evolving arena, but the digital identity firms within this report have signaled use of common technical standards:

• Everest stated that its solution will be able to interoperate with existing systems over its API or Conduit System, and with other SSI solutions based on DIF standards.
• Evernym, as well as the larger Sovrin ecosystem, will adhere to emerging DIF and W3C standards, as well as a communication protocol derived from the open source Hyperledger Indy project.
• uPort shared that it is an active member of the W3C, and that its architecture complies with accepted Ethereum, smart contract, and verifiable credential standards.

Significant attention has been directed towards the interoperability of decentralized identifiers, or DIDs. According to Michiel Mulders, a blockchain developer at TheLedger,²⁴⁴ a DID is “nothing more than a scheme with several attributes that uniquely identifies a person, object, or organization.”²⁴⁵ DIDs are fully owned and controlled by the “DID subject,” independent from any centralized registry, identity provider, or certificate authority. Additionally, every DID is cryptographically secured by a private key managed by the owner. ²⁴⁶

Markus Sabadello, CEO of the digital identity and personal data company Danube Tech, notes that “DIDs are an important innovation because they give us the ability to establish digital identifiers that are persistent, secure, and globally resolvable.”²⁴⁷ And because the technology is based on an open standard, any self-sovereign identity vendor can create a “DID method,” defining how DIDs are written and read on their particular blockchain.²⁴⁸

Everest currently perceives the use of DIDs as unnecessary within its solution. Leadership does view the principle of interoperability as important within the SSI space, but does not believe that the DID protocol has reached an adequate level of sophistication for adoption at present. Everest does not want to risk the security of PII through interoperability at this moment.²⁴⁹

In contrast, the Evernym solution will utilize multiple, pseudonymous DIDs in order to prevent identity correlation (See “9. Minimization – Disclosure of identity information must be minimized” in this section). A unique DID will be created for every new connection between individuals, and also for every new relationship between an individual and organization, within the Sovrin Network.

uPort also incorporates the decentralized identifier into its solution. The firm critically does not use multiple DIDs, however. uPort considers the extensive writing of data on to the Ethereum ledger to be too expensive to do so.

The Decentralized Identity Foundation is currently developing a “Universal Resolver” to enable communication between DIDs situated within different solutions. This software²⁵⁰ will retrieve information, such as the “DID method,” public key, and service endpoint, of a particular decentralized identifier, allowing for the more widespread formation of relationships, transactions, data sharing, and messaging. Both Evernym and uPort decentralized identifiers are included in the initial phase of this project.²⁵¹

The recent creation of massive and centralized databases by firms, such as Facebook and Equifax, and by governments, such as India with Aadhaar, has resulted in controversial and often unauthorized use of personal data.²⁵⁸ Digital identity firms should prevent misuse of personally identifiable information by requiring organizations to ask for explicit and repeated permission to access, utilize, and share user data.

Everest will require user biometry to access a EverID Datagram and any related data. PII will not be able to be accessed and shared otherwise. The firm even plans to incorporate “proof-of-aliveness” tests within its biometric system in order to prevent replay attacks.²⁵⁹

The Evernym Connect.Me dApp will necessitate user biometrics in nearly all circumstances to access a particular identity and its associated information. Individuals will also be obligated to provide biometric data to create peer-to-peer communication channels with other people and organizations; to accept credentials from an issuer; and to share credentials.

uPort stated that PII within its solution can never be accessed without explicit permission from the user. Any and all data requests are displayed in a clear and concise format for approval or rejection.

In most cases, nearly all adult users should be able to express consent when using a self-sovereign identity solution. But we believe that self-sovereign identity should be provided from birth to death. Infants and younger children will not be able to understand requests and give consent for a third party to access their personal data.

As the Everest solution is designed to provide a self-sovereign identity across a human lifespan, the firm plans to enroll minors and associate them with their parents who have custody of them.

Evernym, through the Sovrin Trust Framework, ensures that adults will be able to operate in a “guardianship” capacity for identity owners who cannot manage their own SSI, including minors.²⁶⁰

uPort does not explicitly claim to provide self-sovereign identity for a complete lifetime. This feature is likely unnecessary, as the decentralized application is largely designed for use by the Ethereum community. Leadership nevertheless claimed their intention to include a function for the management of others’ digital identities in a future version of its dApp.

The need for privacy and the ability to consent to, or deny, the sharing of PII is increasingly recognized as a right throughout the industrialized world, as demonstrated by the 2018 EU General Data Protection Regulation and the 2018 California Consumer Privacy Act.²⁶¹ This ability to safeguard sensitive personal information is also vital for vulnerable groups.

For example, a recent UNHCR initiative collected the biometric data of Rohingya refugees in order to more effectively distribute humanitarian aid; but the agency also shared this information with the Bangladesh Government. This intimate information has been used to control refugee movements in Bangladesh as a result. Worse, “the fear for the Rohingya is that this biometrically-enabled control system could be used to send them back to Myanmar.”²⁶² Hundreds of thousands of lives are threatened, as Rohingya PII may be given to Myanmar officials during the repatriation process. A government accused by the United Nations of a “textbook example of ethnic cleansing”²⁶³ could soon possess their targets’ most sensitive data.²⁶⁴ Self-sovereign identity, adequately incorporating the principle of consent, could mitigate similar dangers in the future.

Identity correlation and subsequent fraud have recently proliferated throughout the developing world.²⁶⁵ A self-sovereign identity solution should lessen the real-world identification of users. A 2013 Scientific Reports article notes that “re-identification” of an individual only requires a few seemingly unrelated fragments of information;²⁶⁶ minimization of data exposure is therefore crucial.

Everest asserts that there will be no method to correlate biometric data with an underlying EverID Datagram within its solution. In addition, the Everest system will not be exposed to open data traffic because it will be private and permissioned. The firm will protect user information through a “layers of the onion” approach, requiring any individual to complete unique challenges in order to progressively access more sensitive data.²⁶⁷

By way of comparison, Evernym connections within the Sovrin Network will be associated with a “pairwise-pseudonymous identifier,” or a unique DID for every relationship. As explained in the Sovrin white paper:

Imagine that when you open a new account with an online merchant, instead of giving them a credit card number or phone number, you gave them a DID created just for them. They could still use this DID to contact you about your order, or to charge you a monthly subscription, but not for anything else. If the merchant suffered a breach and your DID were compromised in any way, you would just cancel it and give them a new one—without affecting any other relationship…Not only can the criminal not use it anywhere else, but the moment either you or the merchant detects a problem, you simply can change the DID. The giant data breaches we are experiencing today, like Equifax and Yahoo, would become a relic of the past.²⁶⁸

uPort is aware that public blockchains such as Ethereum are available for all to read and analyze. Malicious actors might then be able to track public data and public actions back to a common identity.²⁶⁹ The firm conceals all transactions within its solution using Secure Hash Algorithms 2/3,²⁷⁰ as they believe that hashing can help to prevent identity correlation.

Of note, uPort suggests that, “one simple improvement is for identity systems and wallets to promote the use of application-specific accounts.” This design feature “makes it much more difficult to track a single user across the applications they use just by analyzing the blockchain.”²⁷¹

Perhaps the most substantial difference related to the principle of minimization is the use of zero-knowledge proofs (ZKPs):

• Both Everest and Evernym will attempt to further reduce the risk of identity correlation utilizing ZKPs.
• uPort does not, believing that the technology is immature, computationally intensive, slow, and expensive.

Like other design principles, data minimization is particularly helpful to marginalized groups. Ethnic and/or religious minorities could adopt a self-sovereign identity solution without fear that their personal data could be used to identify and persecute them. Refugees could access humanitarian aid without fear of being added to a centralized list. Citizens subject to a volatile political systems could vote for an opposition party without fear of repercussions. SSI may allow individuals to assert their rights while also protecting their privacy.

Recent data management scandals, along with many companies’ self-proclaimed prerogative to collect PII, have amplified demands for better protection of users’ right to privacy.²⁷² In order to better serve their users, digital identity firms must incorporate “privacy-by-design” into solutions:

• Everest plainly states “that privacy is a human right” within its whitepaper.
• Evernym will incorporate “privacy-by-design” into its solution, as the Sovrin Trust Framework declares that, “the design, governance, and operation of the Sovrin Network shall follow the principles of Privacy by Design to provide Members with privacy for their Sovrin Identities and Private Data.”
• uPort specifically acknowledges the need for privacy in the description of its platform.

Cryptographic key management is vital for user protection in any self-sovereign identity solution. A user’s public key is accessible for anyone to use; it encrypts data. A private key decrypts data into readable information.²⁷³ Basically, whoever or whatever “owns” the key pair has access to the related data.²⁷⁴ If a private key is not stored within a secure and well-managed location, it can be stolen, allowing hackers and/or criminals to decrypt data, read messages, and possibly control an identity.²⁷⁵

Everest will store a user’s private key within their EverID Datagram. The system will manage this key, and a user will be required to present their biometric data and enter a PIN in order to gain access to their private key. Everest will write encrypted public keys on to EverChain, its private transaction system.

The Evernym Connect.Me dApp will directly issue private and public keys, which will then be stored on the user’s personal device. The solution will write DIDs—and not public keys—on to the Sovrin ledger. Public keys will instead be written to the associated DID documents²⁷⁶ of identity owners.

The uPort decentralized application issues cryptographic keys, and the private key is stored on the user’s personal device. The solution writes public keys directly on to the public Ethereum blockchain to serve as a decentralized identifier.

Table 8: Key Management

The protection of users’ right to privacy is already necessary in the developing world. In Africa and Asia, less than 40 percent of countries have passed legislation to secure data protection and privacy.²⁷⁷ Most prominently, India currently does not have any comprehensive national law protecting personal security through privacy.²⁷⁸ As a result, some argue, there are relatively weak and ill-defined protections dictating the use of Aadhaar data.²⁷⁹