Alan Mitchell, Chairman of The Mydex Community Interest Company has blogged this view of the Economics of Identity as an alternative to that provided by Heiko Rossnagel and Michael Kubach from Fraunhofer IAO. I am happy that these different ideas can be debated. I am not even sure if just one solution is possible, and if that is the case, can different concepts co-exist? - Jon Shamah
Are we asking the right questions about identity?
As the old saying goes, if you ask a silly question expect a silly answer. For
example, if you ask the question “how to reach the pot of gold at the end of the
rainbow?” you could waste a lot of time and effort in your quest for that gold.
A few weeks back, Michael Kubach and Heiko Rossnagel from Fraunhofer IAO
laid down a gauntlet to the identity community with an article asking whether
economically viable ID ecosystems can be built. The problem is simple: most of
the main actors in identity so far see it as a way to capture a pot of gold for
themselves at the end of the identity rainbow. But not enough people are
prepared to hand this gold over.
Result? A stalemate where, the authors suggest, the only solution may be for the
necessary infrastructures to be permanently subsidised by the state.
An alternative question
There is, however, a different way of thinking about digital identity. It asks
different questions which quickly lead us to some very different answers.
When push comes to shove, identities are assured when enough verified
attributes about an individual can be presented. An identity, then, is not a
separate ‘thing’ in itself - a product to be packaged and sold. It is actually
generated as a by-product of the ability to share verified attributes.
Depending on the situation and context, including who is attempting to verify
the identity for what purpose, the verified attributes in question may vary. In
some cases, more such attributes may be needed with higher levels of security
surrounding them. In others, maybe less are needed. Which means that this
ability to share verified attributes needs to be flexible: customisable, capable of
dealing with a wide range of different requirements.
An alternative answer
As it so happens, the means of delivering such flexible, customisable data
sharing has already been built in answer not to this question of identity but
another question entirely: how to eliminate the huge amounts of friction, effort,
risk and cost that service providers and customers currently incur when trying to
find, present and use the data they need to access and provide the services in
question?
One way of doing this is to provide individuals with their own personal data
stores (PDSs), and to enable service providers to deposit cryptographically
secure verified attributes in these PDSs, so that individuals can reuse them as
and when needed.
It turns out that provision of this safe, neutral, enabling data logistics
infrastructure works just as well for the sharing of verified attributes for the
purposes of identity assurance as for service access and delivery. Which means
that the problem of identity assurance can be solved, not by vast complicated
attempts to create a new ‘identity industry’ but by solving a different problem
instead: how to enable data sharing for the purposes of efficient, effective
service delivery.
The value capture logjam
In their article, Michael Kubach and Heiko Rossnagel rightly point out that the
identity industry’s current commercial logjam boils down to the issue of value
capture. This is how they sum it up: “It is largely unclear how opportunities for
value capture can be realised through various fees without creating adoption
barriers that are too high in view of limited willingness to pay by the other
actors”.
But this value capture logjam only arises if those involved insist on treating
identity as a product to be sold in a market for a profit. In the context of data
sharing for the purposes of improved service provision this isn’t necessary. A
completely different set of economic considerations kick in instead.
Data is shared between individuals and service providers as extensions of their
existing relationships, the legal basis being the data portability provisions of
GDPR (Article 20 in particular). No prices are set for this data, no money changes
hands, and no margins (profits) are made on the sale of any items.
Yet huge amounts of time, effort and money are saved because improved data
sharing eliminates the multiple layers of friction, duplicated and unnecessary
effort, risk and cost that are generated by today’s data systems - data systems
that are organised around separate, isolated organisation-centric data silos that
are designed to hold data close to the organisation’s chest and NOT to share it.
In other words, when identities are assured as a by-product of the sharing of
verified attributes (made possible by the use of neutral, enabling data logistics /
personal data store infrastructure), the ‘value capture’ dilemma is replaced by
the new win-wins of improved data sharing.
A way forward?
We at Mydex CIC first began to realise all this over a decade ago, when we were
chosen by the UK Government to be one of just five companies to pioneer its
‘Verify’ identity assurance programme. It was our experiences in this programme
- including the huge cost savings we saw once we made it possible to easily and
safely share the building blocks of identity (verified attributes) - that led us to
these conclusions.
This is what led us to build our existing personal data platform which is now up,
running and operational 24/7/365, specifically to provide the safe neutral
enabling data logistics infrastructure that this approach needs.
That doesn’t mean all obstacles and challenges are simply waved away. To
ensure its ongoing integrity, a huge amount of thought and effort needs to go
into the design and operation of this infrastructure and its operation. Many
technical interoperability issues need to be overcome.
Collective action problems don’t simply disappear either. While it is in every
service provider’s interests to be able to tap into a system where the data they
need can be provided by individuals instantly and safely, it is in none of these
service providers’ interests to start the systemic ball rolling by populating an
individual’s personal data store with their data. In the short term, all that does is
help other organisations improve their operations while they pay the costs.
So, as Kubach and Rossnagel conclude, some Government intervention may be
necessary. But this intervention doesn’t have to take the form of a permanent
subsidy. All it needs is some initial pump-priming to establish the critical mass
for a system that would quickly do more than pay for itself.
In short, an economically viable ID ecosystem is indeed possible. But it only
becomes possible when we start asking a different set of questions to find a
different set of answers.
Alan Mitchell
Chairman, Mydex Community Interest Company