The Case for Self-Sovereign Identity

The way that identity and personal data are handled is fundamentally broken. We see at least four issues with how identity and personal data are managed today. Societally, we lack a coherent approach to regulating the handling of personal data. Users share and generate far too much data—both personally identifiable information (PII)¹ and metadata, or “data exhaust”—without a way to manage it. Private companies, by storing an increasing amount of PII, are taking on an increasing level of risk. Solution architects are recreating the wheel, instead of flying over the treacherous terrain we have just described.

Society: Data does not have to be property to be protected. Elizabeth Renieris and Dazza Greenwood recently argued that treating data as property may be an insufficient legal framework for protecting our digital identities. Instead of trying to secure our privacy by applying property law to personal data, they suggest that some sensitive information may qualify for protection under human rights law. As such, they point out:

constitutional and international human rights laws protect our personhood, they also protect things that are property-like or exhibit property-like characteristics. The Fourth Amendment of the U.S. Constitution provides “the right of the people to be secure in their persons” but also their “houses, papers, and effects."²

The implications of this are significant and we encourage the reader to consider their work. Simply put, if their position is correct, regulators will have a powerful legal tool that does not require overhauling our property laws.

Users: We are creating too much data, both from oversharing and from “data exhaust,” but have no way to manage it. A common example of oversharing is entering a bar, which requires patrons to prove that they are above the legal drinking age.³ This is usually accomplished by presenting a state-issued driver’s license to the bouncer, which displays the customer’s date of birth. Yet an individual needlessly shares an exact birthdate for binary information: Is the person over or under the age of 21? Worse, sharing a driver’s license exposes other PII that is irrelevant to the identity transaction taking place, such as the bearer’s full name, home address, and status as an organ donor. Similar examples are sharing full credit histories, household income, and assets with a department store for a modest line of credit. One has to ask if sharing this information is necessary, and if so, what rules govern their future use of that data? Can they keep it? Can they resell it? Are they profiling their customers with it? More importantly, once this data is shared, how is it possible to know where it has gone or how it has been used?

As troubling as these questions are, issues around “data exhaust” are potentially more concerning. "Data exhaust" has been described as the “evil twin brother” of big data. It is the trail of cookies, session logs, and other metadata created during online activity.⁴ While this data is useful to firms for improving the user experience, it can also be used to develop profiles and individual-specific insights that compromise any reasonable definition of privacy. Unlike oversharing, users are often unaware of the amount of data they are leaving behind and the ways in which it can be used.⁵

Companies: Directly managing identity databases is risky. As companies and NGOs collect large amounts of information on their employees or the populations they serve, these organizations assume the responsibility of protecting that data. That burden is significant legally, financially, ethically, and socially:

• Legally: The EU General Data Protection Regulation (GDPR) went into force on May 25, 2018. This far-reaching regulation imposes significant penalties on entities if they manage personal data in ways that are legally deemed as irresponsible.
• Financially: Software maintenance, routine updates, server hosting, and the archiving of data are a nontrivial cost for companies and NGOs.
• Ethically: The Harvard Humanitarian Initiative released a report entitled Signal Code in January 2017 that describes the increasing volume of digital information humanitarian organizations are now handling and the responsibilities that data management entails.
• Socially: Everyone—employees, refugees, or social media users—is increasingly aware that their data is valuable and should/will be reluctant to share valuable data if there is no assurance that it will be well guarded.

Solution architects: We have too much functional identity and too little foundational identity. Many identity solutions are functional in design. A functional identity is used solely for a narrowly defined purpose. For example, a medical insurance card is used to access health care and a voter ID card serves the purpose of conducting a vote.⁶

A foundational identity, on the other hand, is multi-purpose, allowing access to multiple services or applications. Various national ID card systems or university ID cards, for example, could be classified as foundational.⁷ SSI provides a way through the complexity of a centralized foundational ID, gives the individual a way to manage multiple credentials from multiple sources, and provides a user-centric platform that can in effect become the ultimate foundational identity—one solution that can be applied in most, if not all, use cases.

For all of these reasons, we see identity as broken, which is why we are excited about digital identity in the form of SSI.

Christopher Allen described four stages of digital identity in 2016.⁸ In Phase One, a single and centralized authority controls the system. For example, the Internet Corporation for Assigned Names and Numbers (ICANN) is the lone administrator—and source of truth—for domain name servers online.⁹ Within Phase Two, a federated solution, such as Microsoft Passport, allows users to utilize the same identity on multiple sites. A powerful institution, however, is usually at the center of the federation. Through Phase Three, there is a modicum of respect for consent concerning disclosure of PII across interoperable and user-friendly platforms, but final ownership and control of user-centric identities remain with the registering entity, such as Facebook, the Google G Suite, or OpenID. Phase Four is self-sovereign identity, requiring that users be in full control of their digital identities and are the sole managers of their PII—there is no central authority.¹⁰

Table 1: Christopher Allen’s “Evolution of Identity” and Updated Examples

SSI provides users with full control over the administration and use of their identities.¹¹ One criterion that serves as a “litmus test” for SSI is whether a user’s identity can be revoked or deleted by the platform provider or any other third party. If this outcome is possible, the identity scheme is at best user-centric.¹²

A user can create a self-sovereign identity on a given platform through a process known as enrollment. To be precise, the user is creating a public identifier that they control via a public/private key pair. The identity can be enriched over time as valid claims are added to it by credible third parties. Data input may include basic demographic and contact information, likely a full name, phone number, and email. Biometric information, such as a set of fingerprints or a face scan, may also be added depending on the platform in question. After the creation of this baseline identity, a user can compile a number of credentials, distributed by various issuing authorities. These initial credentials, such as a driver’s license, a passport, or a diploma, will be incorporated into the individuals SSI wallet.¹³

A credential is a set of one or more claims provided by an issuer—a known and trusted real-world entity.¹⁴Anticipated issuers include banks, universities, hospitals, and governments, among numerous others. Within an SSI ecosystem, these established entities can provide credentials that are easily verifiable and tamper-resistant through digital signatures.¹⁵

As an individual user accumulates more verifiable credentials, their self-sovereign identity becomes more robust. In the future, a substantial SSI might include a digital driver’s license provided by the State of Maryland, a digital passport issued by the U.S. Federal government, and a digital diploma signed by Georgetown University. Furthermore, activities like paying taxes or credit card bills on time can also be recorded in an SSI wallet. Users will be able to disclose these verifiable credentials, or parts of them, as well as transaction histories, at their discretion. Furthermore, since the data sits in users’ wallets, their approval will be required if their information needs to be accessed.

Equipped with a self-sovereign identity, a user can return to their local bar and present the verifiable credential that “I am over the age of 21” (derived from the digital driver’s license) in a secure manner. Through algorithms known as zero-knowledge proofs (ZKPs), the user can validate that they are of the legal drinking age without sharing underlying or secondary data. The bouncer simply learns that the individual is older than 21, without viewing their date of birth or any other PII contained within the digital license. At that point the bar would have a record that the person associated with this wallet (which can be verified biometrically) is over 21, but would not have any other information.

Table 2: Selected Definitions of Self-Sovereign Identity Terminology

Source: "Verified Credentials Data Model 1.0,” World Wide Web Consortium (W3C).

We have traditionally kept identity data in centralized databases, which were the only technical option. Now that distributed ledger technology is becoming available and affordable, however, SSI projects are developing rapidly. As noted by Phil Windley, chair of the Sovrin Foundation, self-sovereign identity is now possible thanks to the development of distributed ledger technology (DLT). There is no central authority within the SSI model and no central database storing PII. DLT is ideal for SSI platforms because it enables secure enrollment, data storage, validation of credentials, and the recording of transactions without the need for a principal administrator.¹⁶ Now that implementation of self-sovereign identity is feasible, there is a choice to be made. Bob Reid, of Everest, describes that choice as “either [data control] goes to individuals or it goes to major institutions that will mine our data.”¹⁷

A self-sovereign identity solution can be adapted for a wide range of use cases, including subsidies, banking, microfinance, healthcare, and land administration. The interoperability and flexibility of SSI can also help to prevent the creation of identity “silos” designed for a specific purpose, such as for subsidies in a refugee camp. A single-purpose digital identity solution often places an unnecessary burden on marginalized populations; it is another password to remember, another card to safeguard, a new bureaucratic system to worry about.¹⁸

Widespread adoption of an advanced technical solution in the Global South may be challenging, but it is not impossible. Both mobile phone penetration and internet access are increasing in many developing countries (See Box 6 below).¹⁹ Thoughtfully-designed digital solutions—those which do not impose administrative and financial burdens or require a high level of technological know-how in the end user— can now attain widespread adoption in emerging economies. Examples include M-Pesa, which allows for the transfer of funds via text message, in Kenya and Tanzania, and WhatsApp, a messaging service with over 200 million users in India.²⁰

We believe that self-sovereign identity will be widely adopted due to: 1. social realities, as everyday life is increasingly digital and existing systems leave their users vulnerable; 2. the development of enabling technologies, such as DLT and smartphones; and 3. growing capacity for adoption of new technologies in the developing world. Various firms are already working with governments and other stakeholders to develop and implement SSI solutions. To borrow a quote from the Evernym homepage: “Self-sovereign identity: now that it’s possible, it’s inevitable.”²¹