Discover more from On Digital Trust Ecosystems
Nidhi Razdan recently wrote about her experience where she faced a fairly well crafted deception.
While the social media has been both sympathizing with her (for falling victim) and excoriating her (for failing to see the tell-tale signs) it is important to note that each one of us at some point have being deceived. Whether the loss is minimal or life changing depends on the circumstances, but it should be understood that the social fabric runs on trust networks. And “trust but verify” is not always done in a structured manner.
Digital Credentials
All conversations around verifiable credentials (VCs) tend to focus on how the digitally available, cryptographically signed, secure and portable credentials provide a significant advantage over existing models. That is true. Combined with a strong digital identity framework, the VC + SSI model is a game changer. However, the true impact of this originates from 2 additional concepts which need to be discussed - the verifiable registry of legal entities and a trust assurance framework.
An oft-used example used to describe the “Trust Triangle” and governance framework is how credit cards work. The company (or, legal entity) who brand the cards issue them through banks and similar agencies (another set of legal entities) who in turn qualify and recipient and issue it against their name. When the holder of such a card presents it at a merchant a set of verification routines are invoked and upon approval the transaction goes through. The end customer is aware of the verification routine and approval/rejection decisions but the underlying concepts which keep this flow humming are the governance frameworks (business, legal and technical decisions which facilitate the functioning of this business domain) and the trust assurance frameworks (based on audit, control and compliance) which allows the entities who are actors to trust the machine-centric transaction flows.
Digital credentials in the domain of education can efficiently transition over to a higher degree of trust through adoption of similar processes. The key concepts are a verified registry of issuers (often these are either the governance authority or have a delegate role in a governance structure) and the application of systems audit, control and compliance mechanisms in the exchange of such digital credentials. Systems and Organization Control (SOC) audits are fairly standard and reasonably well understood with an extensive ecosystem of auditors who can certify systems.
The SSI Ambassador has a good post about this topic - see here.
How might this help in avoiding deception?
We should begin with a caveat - systems designs also play catch-up with innovative methods of deception. So, while new methods provide an enhanced level of security there are always additional gaps to be addressed and improvements due.
Legal Entity Identifiers (LEIs) as managed by organizations such as GLEIF help underpin the authenticity of the origin of a transaction. Thus, along with a cryptographic security method being able to establish the claim of the originator of an assertion (or a document) helps raise the confidence of the recipient who is asked to participate in the transaction.
Another topic to focus on is the selective disclosure of information. This is an approach that verifiable presentations are capable of enabling. Thus, instead of an all or nothing approach to sharing personally identifiable information (PII) or personal health information (PHI) or even financial reports, a system that is built around the notice/consent design pattern can also include selective disclosure to contain the sprawl of information that is presented in response to a query. Traditional models of making digital copies of paper credentials lead to a significant amount of data scatter. Often we do not have the necessary insights to determine if such extra data is enabling forms of context based linking and mapping that we are unaware of.
Is this actually possible?
Well, yes. There are open standards around which topics of credentials, digital wallets to receive and share credentials, distributed ledgers enabling private/public permissioned writes, ecosystems where credentials are shared and accepted do exist. The machine readable methods of request and verification are expected to significantly reduce the inefficiences and data leaks which are now the norm. The key is good governance frameworks which incorporate the checks required by the trust frameworks which raise the level of confidence and trust in transactions within this network.
In fact, in the wake of the COVID-19 pandemic there is a renewed focus on standardization and prototyping so that network-of-networks are created which can begin to exchange digital credentials with tamper-evident characteristics. Now, if your next question is “would all these have helped to avoid this scenario” the answer would be that we do not know yet. What we do know that these systems and designs significantly reduce the surface area available for deception and focus strongly on legal identity centric provenance driven data exchanges. Thus they reduce the risks of similar manner of deception.