Metagov Seminar Research Notes On Digital Identity 04242024
Speaker 1: Hi, everybody. Welcome to another MediGov seminar. Today is 04/24/2024. I go by Seth Hoston. I am one of the community managers at MediGov and I will also be today's host for the seminar. The seminar is a weekly event that takes place within our digital governance laboratory for guests and collectors who are doing work in online governance, who can so they can come and present their...
Top Keywords
- identity 0.027
- digital identity 0.025
- digital 0.016
- systems 0.007
- design congress 0.005
- identity systems 0.005
- benjamin 0.004
- design 0.004
- research 0.004
- first 0.003
- philip 0.003
- even 0.003
Transcript
Hi, everybody. Welcome to another MediGov seminar. Today is 04/24/2024. I go by Seth Hoston. I am one of the community managers at MediGov and I will also be today's host for the seminar. The seminar is a weekly event that takes place within our digital governance laboratory for guests and collectors who are doing work in online governance, who can so they can come and present their research, engage in conversation with their community of, online governance researchers and practitioners. Today's seminar was proposed by me after seeing a recurrent sharing of articles from New Design Congress, which is an independent research group confronting the gap between what is said to be happening and what is actually happening in digitized societies. And we have a number of guests from that organization with us today. And before I go into that, just a little bit about the seminar. Seminars are a community organized and operated activity at MediGov. The people in our community are invited to propose individuals or collectives who are also working in online governance to present at future seminars and also take opportunities to lead these seminars by doing what I'm doing right now, facilitating and moderating the seminars that they propose. There's information on how to join the community and how to propose a seminar. And I'm gonna post that in the chat after I finish introducing our guests. But to the people who are watching this recording asynchronously, you can visit our website at medigov.org. And it's very clear where to find information about the community, which I'm actually very happy about in the last two months. That's a new development. So, okay. So in terms of today's event, there were two particular reasons that I was interested in having New Design Congress come and talk with us. The first is the fact that we had this seminar last week on the topic of digital personhood and coordination puppeteering and proof of identity protocols. We had a paper presented by Puja Alver, Mikhail Nuvkolin, and Paula Bremen or Berman, I should say. And also, secondly, there's a very, to me anyways, interesting way in which the history of governance, in particular the kind of cybernetic understanding of system control is rooted in this particular strain of research that New Design Congress is currently doing on digital identity. And so today from New Design Congress, we have these names that I don't think I've ever said out loud. So apologies if I mispronounce them. KDM, Benjamin Royer, and Roel Raskam Abing, who are gonna present on some of their recent research. They're sort of drip releasing these research notes as part of a longer publication process for a report on digital identity. I also had the chance to hear that they're doing interviews as of today with people in this field. So it's a very live and active area of research, and I'm really excited that we're gonna be able to be joined by them today to talk about it. I thought about doing a kind of list of all of the, like, numerous and very interesting, unique and original research contributions that they've made to the field, particularly in my view to digital culture. But I would really much prefer to just, you know, pass over to our guest as soon as possible so that they can present what they came to present today. However, before doing that, I have to just quickly say we'll have about twenty minutes of presentation from our guests and then a moderated discussion. So if you have questions for our guests, please post them in the chat as they're speaking, and I will keep track of when people are posting comments and kind of start a stack list of the order. And if you want to speak later on, you can raise your hand or type stack in the chat. And if there are any questions, please feel free to message me directly or also type in the chat. Okay. Great. With that, I'm gonna pass it over to our guest from New Design Founders.
Thank you so much. And thanks to everybody for coming here today. This is really exciting. This will be the first time that we speak openly about the work aside from very a much more casual perspectives or in incidents of so my name is Cade, of course, from New Design Congress. I wanted to just quickly start with a round of introductions, but I'm actually going to get my other two guests, Benjamin and Raul, to go first, and just quickly introduce themselves. So, Benjamin, please.
Yeah. Hello, everyone. I'm Benjamin. I'm a research director at, New Design Congress. My background is in UX UI design. And, yes, I was I left the industry after collaborating a bit too much with a a lot of the mainstream, let's say, consulting firms that we're starting to use design in conjunction with a lot of, say, projects that I was maybe not aligning with. That's where I discovered, the concept of webinar design, and that led me to, you know, Cade and the new design congress, starting collaborating with him, over the past three years.
And, Roel? Yeah. Thank you. Hi. My name is Roel Rosmabing. And in my daily life, I'm a doctoral candidate of interaction design at the University of Malmo in Sweden, where my research is focused on the consequences of online federation for systems design. And in that, I have a particular interest in the Fediverse. And I've joined NDC for this particular project on digital identity to contribute insights from my work on the Fediverse, notably on how, yeah, digital identity systems work within that ecosystem, but also how identity emerges and changes in in federated media. Back to you, Kate.
Thank you. So, it's actually a really good starting point. Rul and I meet in 2018 at Radical Networks. We've been we gave two presentations, and both of them, I think, were interesting enough to to, like, go on a whole wild tangent. But the one that really starts us off also starts New Design Congress off, which is what Benjamin suggest mentioned weaponized design. So before well, I guess before I even get there, so my background essentially is I trained as a designer. My first job was at Deloitte as an analyst. In that role, I saw a bunch of, I was there for the beginning of the iPhone and the the the first wave of of the gold rush of applications, but specifically from the perspective of large organizations. Right? So I was there for the early stages of things like being able to recharge your mobile phone through an app or the the first wave of digital health apps and things like that in smartphones. And what I saw there was a particularly difficult and very blase opinion or or understanding of the sort of safety that or lack of safety that was inherent in these systems. And so after leaving that, after really being disillusioned by that, I started to do some research into how we could make things more secure. This is before Signal. This is before HTTPS, that sort of thing. So I went and worked on Signal before it launched. I was there for the beginning of of Signal as it pushed into the App Store for the first time. And even though I'd been involved in digital security ever since, the problems were still there. All the things that I had seen, the big events of hacks and data dumps, things like that had continued. And so I started wondering what the deal is with that. Why, despite the rise of encryption, that things were still not getting better? So I wrote an essay in 2017, 2018 for tactical tech in Berlin called On Weaponized Design, which described a a phenomenon in which a system or an interface harms users while performing exactly as intended. So these are not systems that necessarily have flaws in them in the sense of, like, in their code, but in fact just behave as they're supposed to. And to the users, they look completely normal, and yet they have devastating consequences. And I won't dive into that. There's a lot of material on our site and a couple of talks that you can find, including the talk that Rul and I met at at Radical Networks. But, really, I raise this point because that's both the beginning of New Design Congress and the beginning of this research project. So New Design Congress is an independent research organization that I started in 2020, but has now grown to four people full in a sort of full time capacity. And as Ascent mentioned, it's we confront the gap between what is said to be happening, what is actually happening in digitized society. I was there for a lot of the early sort of decentralized platform optimism that was in Berlin in 2017. I was there for a lot of crypto optimism, which hasn't panned out in the last sort of decade. And, really, what we do at New Design Congress is we're trying to prevent that sort of thing from happening again and actually have degrees in which things change for the better. So you've sent mentioned that there's been some discussion in turn around sort of the disillusionment or the the issues with crypto and things like that. I've read that piece. I think I know which one you're talking about, and I I have a lot of agreement with that. What we kind of do as part of that is to try to get ahead of the curve by being sociological red teaming. So we do we we dive into concepts with like minded organizations. We practice responsible disclosure, like, organizations that do threat modeling or or offensive security. And then we, that gives us the ability and the expectation to have open access publications. And then, really, what it's down to is that this is not the future that we will accept and that another world is possible. And it's through antagonism, but honest and accountable antagonism that we think we're gonna get there. And so, really, where this comes down to, we're gonna jump around a little bit, is what I wanted to do is share some of this ongoing research with with this group around digital identity. We believe that digital identity is fundamentally flawed. The current models that we have are are compromised in a very particular way in their terms of how they're conceptualized through three different areas, which each of us will will talk about a little bit, and represent the three first research notes that we've put out. But what the reason why this is important is because we believe, the theory is that sort of powers this work, is that digital identity, is flawed in such a way that no matter what we do, no matter what systems we develop, what kinds of resilience we try to infuse in these systems, how we choose to roll out digital systems for governance or for secure transactions and communications, no matter what kind of types of encryption that we use, multifactor authentication, biometrics, etcetera, that without challenging the first principles of digital identity, we run the risk of never actually moving to a more secure system. Because so long as social engineering attacks are possible, which are inherent in certain ways in current forms and implementations of digital identity, then we will just make these systems more expensive, more chaotic, and with very little, to show for in terms of actually solving for, social engineering attacks. And social engineering attacks, as we all know, from civil attacks all the way through to straight up fraud, from cat phishing or spearfishing, is is has a monumental cost on the social fabric and economic fabric of societies. So we're gonna quickly run through a couple of, of these three research notes and key points. In January, I published the first of these. These are problem statements. This piece is called identifying and defining the digital self. And in this piece, we shared a kind of working definition for digital identity, which is based around six key components that we think make up the modern digital identity. Those six are, one, serialization in which a part of an individual is read and converted into a digital form by a software or hardware sensory apparatus and defined at the discretion of a systems designer within a cybernetic digital system. Two, custodianship in which that serialized self from which the identity is derived is stored and maintained in some form, be it via software automation or blockchain or by manual means by the user or third party, such as local storage, secure enclave, etcetera. Three, presentation, where the serialized data is reassembled and made legible to machines or humans through an interface of some kind. Now this is everything from key exchange in cryptography systems through to avatars in virtual reality metaverse spaces or profiles in social media networks and everything in between. Four, authentication, where digital identity becomes a central mechanism in which an individual invokes some form of cryptography and or relational trust to gain access to digital or real world resources, services, or opportunity or is granted movement in a place. So the idea here being that it's not just authentication to access digital materials, but also authentication digitally to access the real world. Five, authorization, where the authentication and presentation layers of a digital identity act as a vessel for an individual that allows other gatekeepers or vendors, service providers, etcetera, to give and maintain access to a system or resource. And finally, number six, assetization, where the digital identity is employed as the support for wider financial speculation goals or other commercial ventures. The two that I can think of right off the bat, one is fusing digital identity based token systems like last week to UBI, and the second is the the kind of DAO voting sort of systems. This idea of tokenizing decentralized autonomous organizations. And so the first piece before I hand over to Benjamin for the second one really details a little bit of the history from a technical implementation and cybernetics conceptual perspective, how the fusing of these six properties has given way to a particular way in which these systems are vulnerable to to to exploitation and thusly rendering entire systems incapable of resisting attack. Benjamin?
Yeah. So the the essay that we published and I was authoring self determination starts with a kind of online pedant arguments, which is a very rhetorical argument about, you know, what are you talking about when you're talking about identity. There are many definitions of identity and fundamentally none of these really fit the bill as it pertains to the context of the deployments of digital identity. And so, this kind of pedantic arguments around, the wording, of, of of narratives of digital identity, kind of try to actually dig into a proper historical analysis of identity as a as a governmental scheme, as a politic you know, as a tool of political economy over the past fifty years and over the past hundred years. So, looking a little bit into, how talks around identity emerged, post war, very briefly, and it seemed that it came from this kind of tentative to resolve social tensions without discussing forums of race or class. Basel, if you look back further in history and past hundred, two hundred years, like, how identity and identity schemes and passports and similar schemes were used and manipulated by power structures to their advantage, be they commercial or of the state, for example. And the big outcome of this essay was that identity, whatever however you want to define it, it has a very strong performative component to it. And the issue with this performative component is that you give a lot of weight to any claim that you attach with identity and with digital identity. If this claim is verified by the affirmative power of digital identity, then you open you open people and you open systems to very powerful attacks, even if you're trying to limit the the the the limit the the the surface of an identity. Even if you talk about partial identities, we'll come back to it a bit later. So that is what I was trying to address in this self determination, self determination of identity where identity ends and identity starts.
So where where this combines these two is moving on to the third research note that's forthcoming, should have been released today, but still in the edit room, is we now have the I a working definition of digital identity that tries to represent as many different implementations as possible, And we have a kind of understanding of of the governance implications. And then moving to rules, this is about fusing different models and spheres of digital identity and contextualizing their topologies as part of this assessment rule.
Yes. Thank you. So this forthcoming research notes, basically, is a literature review of, let's say, the the state of the art of widely deployed digital identity management systems, which in plain language are basically the login and account parts of online systems that you encounter, where we, in a in a systematic manner, kind of look at the different types of models that exist. So there's, like, siloed login and identity systems or centralized login identity systems, federated and user centric. And then we do a comparison of both the core formal characteristics. So we so we describe how they work formally, but then we also look at existing documented flaws, basically, that emerge from their wide deployment and use. So to give one example, for instance, in the siloed identity model in which each and every application that you encounter online, for example, where you create a new account, usually with the email and password credential combination, which is arguably one of the most common kind of digital identity systems there is. One of the clear issues that have emerged with this model over time is that in practice, people don't want a thousand and one different identities. And so one of the things that you see emerging in the use the widespread use of of these systems. Because they're siloed, these identities are not portable from one to the other. So then people invent basically their own portability by using the same email address and password in all of them with with, of course, disastrous consequences whenever a breach in one of these things occurs. And so our interest with this particular part of the research is to both explore, yeah, what is already widely deployed and also really looking I mean, I call it state of the art, but in many in many cases, it's a lot of the the very mundane and and boring stuff of digital identity in practice that also then tends to get overlooked in favor of, you know, of of of the new, of the innovative, of the, you know, the the unproven. And so this particular research note and really, tries to dig into, you know, what what do we already have around us, in in widespread ways and what kind of, core characteristics have been described about each of these in the kind of benefits and their downsides.
Thank you.
Yeah. I'll I'll I'll leave it at that rest of the pieces what's coming.
So so that's coming and it will be posted in the Medigov Slack and widely disseminated within NDC when it lands. So we've we're gonna have a little bit of time left. I just wanna quickly run through some early leads, and we're gonna bounce back and forth between Benjamin and myself for this because this is we just threw these these particular ones together, especially based off some of the interviews that we've done in the last couple of days. So the first one here as early leads for the group here to reflect on, digital identity is ambiguous and attempts to define it are contested. What we've found so far both in our review of of of sort of overview of the landscape of digital identity, but then also in the series of interviews that we've been doing, which are about an hour and a half long qualitative interviews with experts from all sorts of fields whose work touches on digital identity, is that there's no one core understanding of what digital identity is in terms of defining it. And not only that, but the there's a huge gap between how different industries and even silos of people. So people for example, policy has a different idea than arts. Arts has a different idea than technology. And even within the technical spaces, your so called web two versus web three people have totally different ideas of what digital identity is supposed to be. That has privacy implications, especially when you start to add biometrics or other one way identity systems where, you know, you supply a credential and then you can't replace that easily because you can't replace the biometric easily because we don't have any un universal understandings of of the standards of digital identity, and, thus, we're unable to assess them for risk properly. We also see things like wellness and mental health apps, as biometrics as well. So this here isn't just about, like, eye scans or or face scans or fingerprints or whatever, but also, the kind of more less visible esoteric things like health records and mental health apps, as data brokers and things like that. What's really interesting is that it's in line with the shifting conceptual definitions within cybernetic systems, but at the same time, as a core component of any digital system, it's also the weakest. And so it's interesting that it hasn't really been completely interrogated at a degree that I believe that we believe that it needs to be. Benjamin.
Yeah. I'm off mute. So so on one, where we have a race to secure networks is making identity immutable. And I think, in this case, we have sort of twin concerns that arose over the past decades. Concerns from, I would say, commercial and financial sector and obviously, you know, the states trying to make sure that these financial sectors and commercial sectors are properly lubricated And the the the necessary trust that needs to be imposed to facilitate these transactions by those there are there were genuine humanist and progressive intellectual and academic circles that were trying to understand identity through the medium of, now what we call digital identities, but, you know, inter early Internet, web two point o Internet, etcetera, and trying to re rearrange and and and create these these, let's say, idealist framework of digital identity. Now the issue is, even
with
the best the the best, intents, we have decisions and and and many conceptual, confusions that ripple through the social fabric. And something that was very local, like, how do we secure transaction at a mass scale becomes suddenly deployed in in very brittle contexts. So I'm talking a bit too much about the next slide but Kate, do you want to continue on?
Yeah I'll just I'll finish this bit and then add one thing and then if you want to read the next one you can do that too. So what that means in practice is we've spoken to people who work in digital security and in the intelligence community and in law enforcement. But we've seen how unexpected consequences of the kind of immutability of digital identity has created new danger points. For example, just a simple one, when you have a face ID phone, like, a biometric to unlock a smartphone, the fact that over time, you can accidentally train that smartphone that authentication to also accept the the face of your partner means that the identity the biometric one way identity is not only immutable because you can't change it, but also has been fused with someone else's biometrics. And that's a one way process that becomes very hard to remove.
Yeah. And to to continue on, first one, but as a transition for this one, it's conceptual confusions and of shifting goalposts that paradoxically are accompanied by very rigid encoding within technical structures. So for the third one, that's where it becomes really interesting because, obviously, digital identity needs to be identity. There needs to be this level of trust among financial actors, commercial actors to establish trust between two parties so that those transaction happen or those exchange of goods and services happen. And as always, just socially, it's good to know who you're talking to or who you're interacting with. But those kind of, concretized digital interactions or or conceptualization of the self encoded in digital infrastructures are deployed at scale in very difficult context like welfare under austerity or elections during conflicts. I was talking about intellectual circles that have this humanist approach that is very good on some level, but, again, the conceptual shiftiness can be quite problematic. And an argument we hear a lot in conferences is that really digital identity, that's finally the way you get to be and present who you think you are, which annoyingly or conveniently depending on who is speaking ignores the the materiality and the physical constraints of digital infrastructures and the power structures within embedded within digital and technical infrastructures. Kaye, you want to connect? Yeah. Yeah.
So we're just running out of time. That's all. We could talk about each of these for
ages. Yeah.
Yeah. Number four is, at the same time, digital identity is not identity. Right? So the idea is that, we've equally spoken to and seen examples of how personas or other compartmentalization, has been produced and deployed to resist all forms of both digital identity in terms of surveillance, but also in terms of being able to have a presentational or a performative layer of digital identity that isn't then converted into a source of truth that can be used in a legal or economic definition. But what's really interesting about that is that it's it's there's a the the you can speak to people, and we have been doing this, who believe in both at the same time. And the problem is is that because of all of what we've talked about, the lack of challenge of digital identity and the lack of standardization, etcetera, etcetera, it means that identity can be both digital identity can both be an identity and not an identity at the same time. And the only thing that really matters here is the context and the business objectives of the people who are using the identity paradigm in some way. And then finally, I'll just finish up on this, and we'll move to questions. It's the straightforward sort of thing that we've talked about so far. We've been embedded in lots of different spaces, and no identity current or proposed defeat social engineering. There are some threads that we wanna follow, and we're not comfortable talking about them just yet because it's quite radical in some ways. But the performative power of identity, even a partial one with a limited set of attributes, counterintuitively opens the door to new and powerful, civil attacks. But beyond just the kind of 51%, attack, there's also other things. At the beginning of the essay, the the research note that Benjamin put out is a discussion essentially on this idea that as we speak today, we exist in a world in which no recorded voice or face can be trusted. And it's really as we reach this accelerated endpoint of the hallucination between machines representing ourselves and our ability to puppeteer those and hijack those that these problems of social engineering truly come of age. And so what comes next? Here's a quick list of things that are coming up. You can, like, pause this on the video later because I we're sort of running out of time here, and we definitely really wanna hear what some feedback here. There's some links here as well, which we'll drop in the chat during the discussion. And thank you so much. I think I want to finish just by quoting Philip K. Dick, who I think has an amazing quote in Vales that we're using as the introduction to the research report. We hypothesize information into objects. Arrangement of objects is in is change in the content of information. The message has changed. This is a language which we have lost the ability to read. We ourselves are part of this language. Changes in us are changes in the content of the information. We ourselves are information rich. Information enters us, is processed, and then projected outwards once more, now in an altered form. We are not aware that we are doing this. That is, in fact, all that we are doing. And to us, I think that is a extremely poignant description and an example of communicating this problem statement and why it's so urgent, that we come up with something better in terms of digital identity. Thank you so much, everybody. And now I'd like to turn it over collectively for discussion.
Great. Thank you very much, Kate, Benjamin, and Roel. Already some early clapping in the chat. There's a fair bit of discussion kind of happening between Steve, Rick, and Philip. And since there's a kind of bit of back and forth, that maybe what would be nice is to take comments from all three of them and then sort of see how the three of you synthesize that. And then that'll also give people a chance to contribute some thoughts while they're responding. So I'd like to go in that order. Some short comments or questions from Steve that ring the bell.
I'm sorry. I can't remember that far back. I literally don't know what my comments were, but I am I mean, I think the first one is just I am highly concerned about this. This is my primary concern too that artificial humans will be manipulating us social engineering of all types. And I actually just finished writing a white paper on how to preserve pseudonymity despite being able to filter out bots so we can create human only places. And so I just think your work is tremendously important and would like to contribute to it in any way that I can. And I'm also working with Clyde dot AI on a way to integrate defenses into a personal digital assistant. As okay. Why don't you go, Rick?
Yeah. It's just a question I put in there.
I just scrolled back, and I said, what are the best AI digital meta gov resources to preempt, prevent, minimize, and redress the six items described today, how is the EU working on these challenges? And I'd like to add one that I asked last week, and that is, you know, within the academic audience, it's a question of how do you translate these concerns to the general public? Not that you'll have time to answer, but my question is the same as last week. If you were to take this call and and turn it into a PR release such that people become more aware of the dangers that people are unaware of. So big questions, not enough time to answer it, but it's on the table.
I will say that at this point in time, we would be quite pessimistic about that, the the ability to fully answer these because at the core, it really is that the the first principles of digital we have to kind of go back to the first principles of digital identity. And until we, I guess, in a sense, free ourselves from some of the some of the generational truths or or things that we hold as true as part of designing digital identity systems with and especially from my personal perspective, the the fusing of the presentational layer with the authentication layer, if we're able to separate those somehow where authentication is separate from presentation, then we that would, to me, represents a first step, although that's untested at this point in time, but it's a part of the work that we're doing. That's one way one lead that we're looking at following as part of this work and also have done historically as well.
I want to let me address Steve's question, I think, or remark. I think yeah. I mean, we are very concerned about both, you know, impersonating humans. I think to sort of circle back on last week's presentation with Puja Oliver, right, where increasingly you're gonna see pools of humans behaving like bots to trick those systems. So what then? You know? I mean, we don't have an answer, but it's kind of a scary thought that fundamentally those those those kind of, fortunately, digital identity systems and, you know, proof of humanness is not gonna not gonna be efficient even in the near future.
Okay. I wanna turn to Philip. Juan, I see your hand. Why don't we take Philip and then Juan and then responses? Thanks,
Sam. I think that this is the mother of all arithmetic clashes. That's the way I I like to put it up until about ten years ago, maybe fifteen years ago. It really didn't matter a lot that computer science thought like computer scientists and and the social scientists and humanities thought about the world the way they think about the world. They didn't really mix. You went online and then you went offline. I mean, in recent years, no one has gone offline. Everyone on this call is sadly enough to know that the digital permeates everything. Even when you're not looking at a screen, the stuff around you is instrumented. The stuff you're carrying is instrumented. We no longer on or offline, we are effectively cyborg cyborgs in as much as our sensory system, part of our cognition, and our actuation are digitally augmented. So this is where suddenly the computer science and the social sciences need to learn from each other. If I were first to to characterize the difference, perhaps just being slightly oversimplifying, you might say that computer science is predominantly Newtonian and bureaucratic. It's drawn to tree like structures and, you know, things are assembled from elementary entities, and it's fundamentally predicated on rendering entities that legible system, which, of course, those who read seem like a state will recognize as being state bureaucracy works. Why? Well, because computer science is first customers. Well, governments and large corporates who had to keep inventories of customers and employees and parts and suppliers, and that's the past dependencies that we've we've inherited, then the system might strive to correlate identify as representing Alice in the system until as Steve would like, I think forgive me, Steve, if I'm putting words in your mouth you would disagree with. I know you'll you'll speak up if I have, but until her singular thinginess, if you like, is represented singularly in the system. And in fact, actually, if you give Alice some small, immediate value, she will do that. She will happily self triangulate herself, self self correlate herself in the ignorance of the poor systemic consequences. Social science, by distinct contrast, is immersed in in complexity and community. It's looking at hierarchical and and and rhizomatic structures that no elementary set of entities that, you know, everything else is grounded in. And addressability is more contextual, more dynamic, more relational. Our our own understanding of ourselves is based on constantly revised contextual narratives. So for me, the vast majority of people identifying problems to do with digital identity are playing around with lipstick on a pig. That's not gonna make the pig something less pig like. It's still gonna be a pig. The work that we've seen presented today is rare in pointing at some of the deeper, more conceptual paradigmatic challenges that we have to grapple with. We have no choice. We cannot make what we've inherited fit the tasks at hand in terms of human flourishing and the the flourishing of the web of life that we're we're all part of. So that's
been my my research as you you
might be able to tell for the last seven or eight years. And if I may, I'd like to share a a link to an essay that summarized my research that I published a a couple of years ago. I'll stick that in the chat. Thanks for the presentation, guys. Really appreciate your work.
Cheers. Thank you. I don't know if it takes me time.
Yeah. Let's do it. Let's let's take let's take once and then see if we can combine the response. Yeah. Yeah. Juan, you are up. Yep.
Sorry. Sorry. Cool. So, yeah, I great great work so far. I've been I've read one of the earlier reports, earlier installments in this, and I I I I think it
You're back on mute. One.
I'll timed. So, yeah, the the I I think a lot of people who work on digital identity professionally or as a research topic have this sort of solidarity among themselves. They they all tend to say, like, no no one but us realizes how big of a problem this is and how fundamentally all of the all identity systems are houses of cards. And and people have a lot of different there there's sort of, like, a clash of of solutionism. And and I really think that in terms of short term and long term goals, like, what what we could change to make this giant problem a giant problem for civilization going forward forever. I I do think that the issue is often one of scale. I I really think the biggest problem with digital identity systems is that they tend to imagine they'll ever be done. Like, they'll ever be a 100%. One of the biggest problems I find with digital identity, you know, because I I am one of those specialists. I do work on web two and web three digital identity systems. I do think that there is this sort of you know, there there's the individual goals of toolmakers making tools and and getting real humans into systems. And then there's the goals of companies and business incentives. And including the latter tends to under like, give short shrift to the the +1 800 number, the fallback, the legal corner cases, the big picture. And and those are all things that are much bigger when you're dealing with techno social systems than they are when you're dealing with any other technical system. So in a a lot of ways, I always just like, the the advice that you can pretty much always give a technologist of identity is, like, have you talked to enough lawyers? Have you talked to do you have a sociologist on the team? Are are you thinking about, you know, people with disabilities or or complicated liability things? And that usually yeah. It's it's it's almost always helpful. So to me to me, it's, like, not even intellectually, it's a it's an interdisciplinarity problem. It's really hard to get the people working on any identity problem to give enough thought and time to things outside of their sort of disciplinary grounding. And then on the but on the if you really zoom out enough, so many of the problems are basically just capitalism problems. They're sort of like so most digital identity problems are externalities. They're things for which the people making money are not liable. So the biggest problem for me, usually, with any identity system is, like, figuring out where you can cert, like, a liable body that has the right incentives to, I don't know, counterweight the incentive to create a bot army or whatever. I'm I'm very much concerned about the like, you like, Puja was saying last week about the if if if real humans' time is cheap enough somewhere on Earth and the stakes are high enough and you build a totalizing system totalizing enough that it's worth someone's a while to build up an army of, you know, click farms in a in a low minimum wage country, you sort of just weren't thinking big picture enough about the externalities. Right? It's it's it's kind of like an economics problem. It's all externalities. But Wow. Anywho, Matt. I rambled to
No. No. It's great. We are at the hour. I wanna do two things at this point. One, I want to give everyone a chance to leave if they have to. I also wanna give, our speakers a round of applause. And then if our speakers are willing to stay for a little bit, I'm happy to hold the space for a little longer and carry on the discussion. So first, let's just thank our speakers for coming. So the kind of three, I invite you to come off mute or camera or don a new digital identity, if you like, maybe like an avatar if you have one. And thank our speakers for coming today. So three, two, one. Applause. Applause. Applause. Applause.
Thanks, everybody.
Yeah. Thank you.
I love that thumbs up response. Okay. So, also, our our Benjamin role, Kate, are you able to stay for a little longer?
Or Yep. Near you.
Okay. Super. So, yeah, I can hold the space for another fifteen or twenty minutes. So if you all wanna respond to that. And sorry. If I can also just assert my moderate my moderation privilege. Seth has asked has asked a very kind of practical question about what's motivating this particular strategic intervention or focus. And I think that could be possibly easily addressed and also bring some more light to the other questions that were raised.
So the straight up answer to that is that we can see like, the acceleration of abuse through digital systems, whether it's, sort of interpersonal abuse and violence all the way through to state based targeting of violence all the way through to financial crimes and fraud, means that we have to engage in this because we believe that digital identity is the battleground for information warfare, in in in this in this decade, especially, both in terms of how to weaponize it and then how people respond to it and build systems out. And where our concern is really that, because the lessons haven't been learned or the fact that the underlying vulnerability has not been solved for or even really properly grappled with in serious ways, that we'll just continue to make systems that become more embedded, more entrenched, more complicated, but ultimately suffer from the same problems. That's the main issue.
Thank you. Thank you, Cade, for for, yeah, kinda laying out the mission. Maybe that's just obvious and doesn't have to be said, but I do like to hear that kind of thing.
No. I appreciate it.
It doesn't it doesn't it doesn't ask, like, is it complete is it just off the table when they consider technologies that don't require
a a solution to identity?
Like, there there's a lot of governance forms out there. There's a lot of technologies for bringing human beings together. The that I I I hear you fill up that, like, it really is a nexus for a lot of what's being proposed, but isn't that just a problem with what's being proposed?
Well,
that's a that's an interesting challenge. No one's asked me that one before. I haven't yet. I think that if we think that this set of technologies that we call Internetworking are to live up to the promise we think they represent, if we're going to apply them in a prosocial way to facilitate human flourishing and rising up collectively to the big suit, wicked problems we face this century, then we have been gifted this amazing technology just the time we might need it, but we're still in the creche in terms of knowing how to wield it in a way that's by mimetic in a way that plays to human nature as opposed to insists that humans fit with computer science vision of how we work, which by the way is we are just that this is, almost verbatim, an opinion held by the self sovereign identity community. They claim as an advantage that their set of protocols has has the advantage that we can be addressed just like all the other things. They actually believe that's they actually believe they're saying something of the value there as a source as opposed to something that's alarmingly ripe with dystopian potential. I don't want to be another thing on the Internet of things because I am not a thing. As Buckminster Fuller said, I am a verb. And It's it's
Sorry. I wanna turn to Roel. Also, I was I was speaking yesterday about, I mean, object oriented ontology. You can sort of take it or leave it. But there's kind of an argument there that everything is a thing, even things that we don't consider things. So yeah. Sorry. I just wanna give our speakers a chance to to join.
Yeah. Thank you, Senth. I mean, just just to just to bring back to the the discussion to the the question, Seth was asking, like, why is it important to to to address these issues? And especially, when we follow, the line of argument of Philip that, in a way, these are also kind of unresolvable things, not because computers naturally and computing systems naturally tend towards simplification and universality, whereas, you know, identity is this rich and contradictory and social human activity. But if we realize that these things can never be brought together, I mean, this can also change our our our agenda for for governance as well. When we think of of things such as identity fraud, you know, in banks, you know, when when somebody gets your credit card and you get a you gotta get a phone call. Hey, Dick, you just spent €5,000 and this and that shop. One of the things that digital identity systems do and that this concept of identity fraud does is basically put put the issue on the user. Whereas if we realize that, you know, like, sock puppet attacks and these kind of things, an identity theft will always be a property of these issues, then shouldn't we really be advocating way more for making sure the bank, like, the the liability for making sure that the the right person is spending that money is actually with the bank rather than with the person? So I think that that that's one of the, for me, one of the interesting potential outcomes of tackling this this thorny problem is not to, you know, to to do a proper analysis of all these systems and then propose yet another system, But rather, if there's always this kind of incommensurable aspects between what identity is and how it becomes encoded into systems and regulations, maybe that can also change the kinds of demands we make on on the level of of governance and regulation when it comes to particular consequences of of identity fraud and these kinds of things.
Yeah. And Izzo, it comes back to, to the, conceptual confusion and how identification has been merged with what we would have called recognition and registration. So if you actually look at, you know, historical analysis of identity systems, passports, and, you know, they talk about obviously, you know, identity as a concept is used, but fundamentally, we're talking about recognition in the society and we're talking about registration. Augustine, things are different. We use different words for it. Again, don't don't want to be a rhetoric, you know, pedant, but we need different words to different to to describe different things. And when you have a system that gears towards identifying so as to provide recognition and access to vital services, then there's there obviously are things that are going to go wrong. I just wanted to come back before we have Rick ask a question. Philip, I really like your pieces actually. I read a couple of them and absolutely agree with with, quite a lot of your points. I would actually disagree about the strict separation between, computer science and, social sciences, but, you know, again, again, we don't have a seminar on cybernetics, so I'm I'm gonna shut up. They're all complicit.
Everyone's complicit. You don't get out of it just because you didn't know how to code. Rick, sorry. Yeah. Please.
Yeah. I'd just like to flip Philip's enthusiasm when he was going on and turn it into question back to the speakers. And I just wanna differ with Buckminster Fuller when he said something along the lines, if you wanna get rid of the old paradigm, build a better one. I think it's more complex than that. It's reductionistic. And how do we, you know, how can we deconstruct? How can we create a new paradigm in the spirit that Philip was alluding to that simultaneously deconstructs the old one? Deconstructing the dark side isn't gonna give us the light. So how can we construct something that draws becomes a an attractor to move in the right direction?
So from that's a good question. The theory of change here is that the first step is to comprehensively debunk the current form of digital identity, right, which is, like, something that lots of people aren't really doing. And And I wanna just sort of give you a like, throw, like, a simple example of of this to the group of of how just entrenched the idea of digital identity is conceptually, which is that in everybody that's spoken like, everybody here today, and this also, by the way, includes me. Like, I'm even though I'm gonna, like, sort of condemn us all a little bit, I'm also condemning myself here. There's a con there's this idea that digital identity is both somewhat of, like, a something playful, something nonserious, something that, you know, has a degree of of curiosity to it as an identity system as a as a design system. And then simultaneously, we all recognize it as being, like, a really dangerous tool. Right? But culturally, we still see these things through the eyes of, say, of of of engineering or of of sort of shaping or modeling or otherwise designing for for for for to enhance our ability to to to do something in the to achieve goals in the world. But here's just a simple way in which we could make changes, which will be in the final report as a recommendation. We need to have systems of we need to add amend laws for financial crimes and and and, interpersonal, like, physical violence crimes, like assault and things like that, that make the use of a digital identity. So, like, breaking into your partner's account before you go and harass them or, like, committing financial fraud and being caught by sock puppeting or by grabbing someone's like, catfishing them or whatever. The, the use of a digital identity in, like, a a crime like that should probably be, well, I believe, definitely, an aggravating factor, like, similar to a hate crime or other sorts of things. The idea here is that, like, we nobody in this room treats digital identity with the kind of level of importance that it needs. It's really closer to something like a a fragile reaction, like a like like standing in a nuclear power station than it is something that's, you know, a playful peer to peer open source curiosity. Right? But the problem is is that we we don't see it with the level of gravity of of what it's capable of, especially when it runs away from us. Right? And so that's the first steps towards making steering this towards a different direction is by changing how we see digital identity completely and having it sort of understanding that because it is an aggravating and amplifier and accelerant, that that should be represented at least legally in terms of criminal law at the very beginning or civil law. You should be able to, for example, get punitive damages for under these current systems that we have, flawed or not. You should be able to get civil damages, punitive civil damages for examples where, I don't know, like espionage corporate espionage has also used digital identity as the weapon to to accomplish that that sort of that sort of activity as an example. Just to be super clear, I haven't tested the idea of, like, whether or not that's actually a good idea or not. I'm using it as an example of the gulf between what digital identity is capable of and how we should be seeing it versus how we collectively see it. There's other things too, for example, like, just while nobody else has their hands up. Like, a digital identity should never ever be used to make a decision about a person in the same way as an algorithm should never ever be the final decision made on a person for any reason. The fact that one of them is and one isn't, like, the the European Union talks about not being able to apply to change your digital identity in some way, but will sort of have intruded in the European constitution or whatever the hell that I can't remember where I saw it. But, basically, the idea that, like, you have the right to appeal an algorithm, rule help me out here, if you remember. Like, you you can there's a so the GDPR where you can, like, demand access to to yeah. I'm sort of riffing off the cuff here, but, yeah, the idea that you can have an algorithmic response to to something that you've applied for, and then you have the ability to demand that it gets reviewed or somehow, like, you have a recourse for that, but you don't for digital identity, that's super important. Yeah. So that's, like, the the kind of gravity of of digital identity is not super cool. We're not really doing a good job of understanding it collectively.
So okay. I wanna pose a question, and then I wanna go to Cam, and then maybe that would be a good good place to bring the conversation to a close. Kind of slightly going out on a limb with this one, and you'll maybe kind of regret this question in the future. But, you know, I guess I when yeah. I think this also kind of kind of easily veers into the not quite appreciating the gravity of digital identity. But you could, not saying that I would necessarily want to live in a society like this, but you could potentially imagine society or a nation where the populace had kind of agreed as like a a constitutional right, you were able to I also don't know. Maybe I should, like, trigger warning, like, for, like, morbidity. But, like, you have the right to euthanasia. And that, in my mind, very, very radically changes the nature of, like, what it means to exist, what it means to plan for your future, how social relations are built up, the kinds of incentives that you might design or interact with or be, like, implicated in. And I guess I'm just wondering if you could imagine or kind of paint a kind of world where the kind of paradigm of identity as a kind of like rights based, not rule, but like something at that kind of that kind of base level, like could be decided in a way that radically changes how people relate to each other. I guess I'm also sort of responding to this kind of this, an algorithm should never make a decision, on behalf of another person. And I wonder, you know, again, this is like a very complicated area, but I wonder if like, in certain instances, if people kind of willingly, consentfully, you can argue whether or not you can actually consent to that, like put themselves into situations where their their digital identity is kind of being autonomously deployed, then you might imagine a different set of rights. Again, I'm not saying this to say that, like, we should necessarily aspire towards these things, but I'm just curious since since you're trying to kind of provoke the imagination a little bit, if you could sort of offer some kinds of radical alternatives or, like, what kind of different structure for society would be if it was constituted around digital identity differently?
I wonder so it's a larger conversation, and I know, like, a lot of people don't have much time here. I think the the the I'm a little bit hesitant to to sort of dive deep into this because there's two sides of it. One is the kind of cultural understanding of the importance of digital identity or what it where it fits in terms of whether it accurately represents people. And then there's the the the other side of it, which is the physicality of it, and the the material outcomes, especially when it's weaponized. The the design of it is weaponized. And so it's hard to separate those two. So, yeah, I mean, some of the work I mean, this is an unsatisfying answer, but, like, some of the work comes down to that we'll be putting in the work in the in the report. We are exploring, like, examples of, like, performative identities and pseudonyms, etcetera, that have led to economic resilience in the last sort of decade inside subcultures that use that rely heavily on identity, but one which is not rationalist in nature, where it's not necessarily I think or I authenticate or I present, therefore I am, but rather one that has, like, a kind of circular a circular feedback loop, and then also from that has, like, a economic incentive, but also, like, has structures of anonymity, safety, and and and the ability to govern spaces in a slightly sort of anarchistic way. But it's it's hard to it's hard to fully like, there's much there's so many moving parts that have to go along with something like that, like, who owns infrastructure, who gets to who to control what the identity represents. All of those consensus under under a computer science sort of and design philosophies are kind of really risky.
Yeah. Perfect. I, yeah, kind of wasn't expecting, like, that. Yeah. It's a lot. Let's turn to Cam.
Cam. Yeah.
Hi. First, I would like to say well, first of all, this is Chaka from NDC. I wanna just say congratulations for the presentation. It was very nice. The other thing I wanted to build off of one of the previous things that we were currently previously discussing. I'm currently a researcher and designer at a company that once presented a slide that's going around pretty, like, online, very fairly obvious fairly around that that says a computer can never be held accountable. Therefore, a computer must never make a management decision. Additional identity can be held to account in the fields of a digital platform, but we're also sitting in a increasing point where this digital identity is beginning to kind of, like, reflect on well, really, real life primacy. Like, it's one of the things that I wanted to sorry for all the filters. I wanted to bring up the I guess I guess the question of in terms of the end user and the current moment in terms of, like, operating on the Internet or inter operating on, like, any sort of, like, a large scale
social
network in the age of these platforms. What would you say, like, if any, if there are any sort of, like, almost cracks of daylight between these, like, digital identities as as we've, like, seen, like, mentioned during this presentation versus, like, what's happening, I guess, like, in sort of, like, I guess, a physical reality plan or or what's happening material materially because I feel like they're both obviously very obviously being cross crossover mentally.
Well, I don't know I don't know if I'm gonna be replying to a question, but I'll provide a proper answer because you were talking about ray of sunlight. You know, even though we have critique of the EU and the IDAS, I think the IDAS is actually quite good on on some level because, you know, they they don't have a choice to legislate that at the end of the day. You know? It is true fundamentally that, you know, the political economy the current political economy, the the current, you know, geopolitics is at play requires to regulate the way by which Silicon Valley companies, but then any other technological tech tech companies, are reansing and and and sensing people and and organizing them and and processing their attributes, their data, their information. So so there there there's there's no choice. And and the the IDAS, for example, the EU legislation is is not perfect and probably not the future that we would want at New Design Congress specifically, but it it does considerably considerably help cleaning up a lot of issues that that would otherwise arise without any legislation. But like any system, like any technological system, then you have you have problems of conceptualization and and and, you know, know, one of the main problem which you're talking about the the materially, the consequences is, you know, you you create this legislation, but you don't have sovereignty over the hardware. Right? So or even I mean, Kate wrote an essay on the what was it? The game game engines.
Yeah. Video game engines. It's like a political political arena. Yeah.
But there are some way of, like, in the game engine, for example, and those kind of technological solutions where you have actors that produce, I mean, spaces for people to experiment and then potentially maybe, you know, force that into legislation and force that into the public consciousness. So, I mean, you know, it's like every other political problem. It's never resolved, and there are other always at the margin, you know, experiments that, unfortunately, eventually get absorbed and, you know, at this point, you can discuss the radicality of them and how they actually help change the world for for the better. You know? We could be talking about that for, like, you know, three hours, four hours. Yeah. Again, I don't know if I that reprise your question at all, but Hey. It's
I don't wanna sound like a broken record, but I'm, like, pretty pessimistic on pretty much all forms of digital identity at the moment. I don't really have much insight in how like, what the immediate fixes are. I know for a fact that, like, and the ultimately, what this comes down to is removing as I I sort of said this at the beginning, I'm trying not to repeat myself too much. It's like, we gotta separate the presentational layer from the authentication layer. And, you know, there's there's ways in which we can do that in radical ways. Like, pet name systems do that really well, and reconfiguring culturally the idea of, like, ident digital identity is being restricted to devices rather than being representative of people. But, like, yeah, I it's it's I'm if I if the if my answer to to these kinds of questions are frustrating, it's because, like, I I'm very careful when we talk about these to sort of position we're we're in a really sort of the the the yeah. I mean, doomer Kade doomer brain comes out. We're in a pretty bad space. Like, its identity is pretty awful, actually, and and I'm kind of really hesitant to we don't even know all the ways in which it's not great. And so it's kind of hard to to really dive into sort of a even though we're optimistic, it's hard to kind of turn that into, like, a material optimism in a sense at the moment because we're still in, like, the first stages here. I real I feel like that was a really unsatisfactory answer as well. I'm sorry.
No. No. I I it helped it in some ways. I feel like we're both from the same wavelength. I felt like I was almost asking less for almost like a question and more almost, like, asking for, like, almost survival tactics in some way. It feels especially bleak. I mean, like, for lack of a better word, like, right now, people are being, like, drone strike and killed based on, like, metadata, which is Mhmm. Based off Yeah. Data that we're already following right now. Like so look forward into even, like, just, like, second order effects or, like, kinda, like, for prognosticating what's to come at least from a not even so much of it even just a govern go governance level. Just, like, from an individual level, like, it's a it's a very, like, big, tall mountain to climb. Obviously, like, you need new tools and new words to just, like, name what we're looking at. So even this even this alone was, like, really helpful. So
If that I know Sentra is just about to bring it to a conclusion, but can I just finish with the it's just this lovely Wendell Berry quote? Wendell Berry is, like, he's one of my heroes. And and I think this phrase he wrote around about nineteen ninety nine, two thousand, and I think it plays beautifully to the way we're just bringing this call to a conclusion. Here's the quote. It's easy for me to imagine that the next great division of the world will be between people who wish to live as creatures and people who wish to live as machines. So if anyone's gonna be a bit excited about the way digital identity is playing in today, it's because they are trekkies, and they have always wanted it to be assimilated to the bulk. For the rest of us, it's time to get our thinking caps on, I think.
The the counter to that, and this is, like, also the reason why Charlie Brooker's Black Mirror sucks, is the the humans always win. Because at the end of the day, the machine can't unplug itself, but we can unplug we can unplug the machine. The machine will always, no matter what, depend on people. No matter how much people who believe in machines promise that one day they will be autonomous, they will never have that degree of autonomy because they we will always be able to unplug them in some way, shape, or form.
Just to add, I would I would maintain I was gonna say, I think that's optimistic, actually, and I would flip what you were saying, Philip, by saying our machines are doing that to us, and we have to decide. So, you know, it's the machine that's turning people into things. So I think it's a circular process,
you know.
Good point. At at at the moment, we've maintained the power to revolve, but perhaps that power won't pass forever.
But who's gonna unplug the machine?
I'm going to unplug this machine that's happening right now. But I also just I mean, I like the fact that we had a a reading from, like, a quote at the end. That was very nice. Thank you for that, Philip. And thank you to our guests. Thank you for the new people who are joining today. Thanks for the very interesting conversation. And I shared some links in the chat for joining our community to talk on Slack and carry on the conversation here. So hopefully, I will see some of you for there. Ciao. Goodbye, Noah.
Thanks, everybody. Thanks for the invite. It's been great.
Yeah. Bye.