Great. Thank you. So I'm gonna talk today about verifying identity as social intersection. And so this is a new identity paradigm that, we think has a lot of promise and can circumvent some issues with, current identity paradigms, which I'll go over in the course of this talk. And this is joint work with Matt Jackson and Glenn Wau. So the, you know, there's this traditional definition of identity that I like, which says that the structure of society is what provides a framework within which an individual's non interchangeable and singular characteristics may develop and find expression. And so when you look at this, I think what's striking about this statement is that it's, really the society that provides the framework for our individuality to develop. That is, we're not individuals in a vacuum. We're individuals because we live in a society that enables our individuality. And so the key idea here is to use that framing of individuality to provide identity solutions. So what is identity? First of all, it provides authentication and authorization

interactions that you engage in. And so it's very important in, in our daily lives. We need it in order to do to vote. We need identity to pay taxes and to receive government benefits. It gives us our rights. We identity is in central employment. Your employer will want to verify your identity in order to put you on the payroll and to to understand your qualifications and trying to hire you. And, it's also our access to capital, so identity is essential for lending and borrowing money, which enables us to invest in ourselves and grow. So the, you know, I think I don't have to spend a lot of time convincing people that identity is important to our, our uses or to our daily lives, but how can we implement identity? You know, in a traditional society, there wasn't really a question about this because everybody knew who everybody was. But in today's society, we're a very large global society. We're very mobile, and we want to be able to implement identity without relying on, like, without having a breaking point, like a sort of, vulnerability in the system. So we don't want to rely on a single narrow institution like the government, which is potentially corruptible and insecure. So traditionally, you know, there were just everybody knew everybody in the village typed identity solutions. But as society grew, centralized solutions became more common. So we have government IDs, biometrics, passwords, social network accounts that allow us to access other websites with SSO and stuff like that. All of this relies on one central authority to identify to provide the identity solution. And so that means that there's a single point of failure as well. And so then we saw in, I think starting in the eighties, the emergence of decentralized identity solutions. There's this web of trust idea, which is that we all have keys and we can sign each other's keys if we trust that person, which creates a social network of trust. And simultaneously, there's this, sort of solution to identity that I've mentioned, which is that, you know, I can count on my friends to vouch for me. And so what we'd really like to do is to combine these solutions, and that's kind of the idea here. Instead of using cryptographic keys to create a web of trust, which has a technological barrier that's hard to overcome for people, we want to just leverage technology to magnify the existing social identity solutions that are part of our human nature. So the system that we want to develop, we have some goals for it. It should be decentralized. That's going to defend against corruptibility. It should be secure, and so, like, you wanna make sure that I can't create a bunch of fake identities and take over the system. It should encapsulate different levels of trust and confidence because, you know, I know my family much more closely than I know, the person who I buy my coffee from at the coffee shop down the street, but I know I I know them each to some degree, and I need to be able to encapsulate that I know them to different degrees in a good identity solution. It should be used be able to be used for multiple purposes, so we don't wanna build a single purpose identity solution, like, that only lets you use this identity to vote. We want it to be able to use across many purposes in your life. And it should reflect the social determinants of identity, which I'll go over shortly, in order to enable this like this traditional social sense of identity to to infiltrate the system. And it should be dynamic. So as we grow and change, our identities grow and change with us. So the key characteristics of identity are that it's intersectional. So these are the things we're gonna leverage in order to build our identity solution. So identity is inherently intersectional. This means that a person, we can identify a person as the intersection of all of his or her attributes and experiences. It's unique, so there's nobody else that has the exact same characteristics as I do. It's redundant, which means that there's many different conversations, so many different intersections of my attributes that uniquely identify me. And it's social, meaning that the characteristics and attributes that identify me are shared and known to many, many different people. So how can we use this to develop an identity solution? I'm gonna illustrate these these concepts of intersectionality and uniqueness with a particular example. So my co author, Matt, and I share an attribute, which is that we were both at Microsoft Research in New England in the 2018. We also are both co authors with Glenn, who's the co author on this paper. And I have a PhD in computer science, and Matt has a PhD in economics. And with just these very few features, we have uniquely identified both me and Matt. So there's no other people in that that share all three of these features. And so the other point about the identity is that it's redundant. So, you know, Matt was at MSR, as we discussed, and he co authored with Glenn, and he has a PhD in economics, but he also is self employed by Stan er, employed by Stanford, and he was born in Illinois, and there's many other attributes that Matt has, and different subsets of them can uniquely determine who Matt is. So maybe, you know, if just knowing that he was born in Illinois at MSR in fall twenty eighteen and has a PhD in economics uniquely identifies this, individual as Matt. And the final thing that's important about identity is that, it's social, and this is what I really want to leverage in this solution. So these attributes that we acquire that, that compose our identity are shared with others. They're fundamentally, and this is why I started with that statement at the beginning of the talk, these attributes exist in the context of a society, so that Matt was at MSR in 2018 is known to everybody else who was at MSR then, that Matt has a PhD in economics is known to everybody who was in his class at that time and and his advisors, and and so on. You can imagine that each of these attributes is fundamentally constructed in conjunction with other individuals that can verify it, and so we want to use the fact that people know these attributes about each other to check that a given person has some features, and you know, different people know different features of of each other, so and different, you know, very like different people asking to verify stuff care about different features. So a mortgage company might care that Matt is an individual that is employed by Stanford and has paid back all past mortgages, or a voting authority might care that Matt is a resident of California, born in Illinois, and at least 18 years old, and, of course, you know, the voting authority wants to know that Matt didn't vote twice, so has to they also have to verify that Matt hasn't already voted, and maybe that he lives at a particular address, which gives him the right to vote in that particular state. Okay. So, how can we build a decentralized system that uses these sorts of intersections to identify people? And the idea is to allow friends of people to verify the attributes that a particular person possesses. So this is an idea from the web of trust that we're relying on others to verify things, and the way that we're gonna do it instead of using cryptographic keys is to look at the intersectionality. So who can identify some things about a person, and try to search out in the social network some paths of trust about who can identify certain things about a person in order to verify their identity. And, of course, if we're gonna be doing this just by sending out queries in a social network saying, like, do you know where Matt was born? We're gonna have to do it in a way that respects the incentives of the people in the network, so it should be that I have an incentive to actually tell you what I know about Matt's birthplace. And so let me get into a little bit of how that system could be built up. I imagine that we have an individual which has a journal, and this would in in an implementation, I think, be a digital journal, say, stored in your cell phone. The journal could contain a lot of details about you, like your mother's maiden name, your city of birth, your current employer, and these details are each all observed by others and recorded in their journals as well. So, you know, my place of birth is also known by my family. My mother's maiden name is known by my mother, and where I live is known by my current life partner, and so this constructs a knowledge network for every individual and every bit of data about them that's stored in their journal. We know a set of other people that have access to this information stored in their own journal because it's a shared attribute between them. So, you know, I was born in Thousand Oaks, California. My mom had a daughter in Thousand Oaks, California. These are both in our journals, and so now, we have a social network that identifies, as I already said, what each individual knows about each other individual, and we're also going to store, and I mentioned this was important to have levels of trust, so we're going to store the confidence that each individual has in this belief about what they know about the other individual. And now in order to verify, somebody's identity, we're going to use the knowledge network and this, what I'm calling, trust network to, build out paths from a claimant to a verifier. And so the verifier wants to verify something about a claimant, like who they are, and the verifier can, you know, the claimant claims that they have some features, and the verifier then sends out queries in this trust network to identify to see if the network can provide proof to the verifier that the claimant has the features that they're claiming they have. And so, in order to do that in a way that respects incentives, we're going to assign weights to each edge, which identify how much node I trusts node j, and this can be attribute dependent. So maybe I trust, you know, my mom to know things about my birthplace, but not about my social life. And so we have this this, trust network, and then we need to find paths to verify a ver for a ver claimant, for a verifier to verify a claim of a claimant, the verifier is going to try and find paths that have a large amount of trust on them. So, each edge in this network has a weight that's associated with the trust and the, verifier is looking for a bunch of paths to the, the claims that have either a heart you know, and now this is up to implementation, but you could imagine asking for a large, flow capacity between the verifier and the claimant on these paths. You could ask for them to be edge disjoint, a very variety of things like this. And I'm not really sure, like, I think it we need more research to understand what the right, requirement is on the, paths that verify the claims of the claimant, but it's going to be based on these these weights of trust. And that also then, so so that's that's how we can provide proofs of particular attributes, and it also is going to enable incentives because if I you tell me something that's false, I'll decrease the trust on those paths, and this will hurt your ability to be a claimant yourself. So I'm going to skip this slide. I think this is basically saying what I said, that, you know, I don't quite know how to aggregate the the trusts on the various networks that are built out here. But and this is, again, I'm trying this is a bit of a longer talk than I was asked to provide, but anyway, this is the what I was saying about the, trust. So if if you say something that's false, we'll burn, the trust on the paths between us, and that can, incentivize you to be truthful about these things. And also, by the way, the other way that this is robust is, if you try to create a fake identity to verify everything about you that you want to be true, it'll be hard to have a rich network between the verifier and those fake identities of the claimant. So we can also use this system to prove uniqueness. The idea is that you don't need all that many attributes to be proved about you, to prove that you're a unique individual, and so that can be useful. And you can do this to you can use uniqueness to do authorization for access to a service and authentication, and also things like voting. But I'm what I'd rather talk about now instead of these particular applications is something that I think is particularly exciting, given the moment that we're in in history right now, which is that the all of these systems, all of these solutions that I've been discussing with you rely on that, what I called a journal. Like, I need to have some digital store of all of what I know about myself and everybody else, and that's necessary in order for, like I'm imagining all of this is gonna be implemented with technology, and we're gonna be sending out queries in this network with a protocol that's automated, and so we need all these, these knowledges and the knowledge network to be stored digitally somewhere. And so, what I imagine doing is something like, having the location on our phones on, and so when two phones are in the same place, they can connect by Bluetooth and share the information that they've been co located. And so this gives basically a time stamp that's shared, among, you know, people the the social network now is if we've been in the same place at the same time, and I can prove that I am who I say I am by, you know, the voting authority say asks me where were you at 12:52PM yesterday, and where were you at, you know, 8AM on March 30? And, my phone knows that and can provide answers to that. And then the verifier, the voting authority in this case, can send out pings into a network and say, can you verify that this phone was in this place at that time? And then you can, you know, verify that, yes, this person is who they say they are, and then you can also check the database of answers, to previous questions and make sure that this person is unique. So I think that this is something that we have the technical ability to deploy, like, now, and that's pretty exciting, and and we should, think about leveraging that to do that. I'm gonna skip the other applications I had here, but I just wanna end with pointing out that there's a lot of work to do to make something like this actually viable in practice. We need to look at, develop the technology for how these protocols are hosted and run in a decentralized way. We need to use encryption so that the system doesn't learn the answers, like you might be bothered that I don't want to let the whole world know where I am at every moment in time, but, you know, that's not necessary. We just need to be able to verify, that the answers are what they were claimed to be, but we don't necessarily need to learn what the answers were. We can do that with, like, zero knowledge proofs. We need to worry about how to initialize the system, and this is the thing that I'm excited about because I think these COVID tracing apps are already initialized a lot of this for us that we might need. And we need to figure out how to convince others, like if, if it's in a not in a face to face interaction that, that the person who's asking to have something verified is actually the, that individual itself and not trying to abuse the network to learn something about someone else. So I think that's the basic idea of what I wanted to transmit here, and and I'd be happy to take questions or brainstorm about ways to to make the system work. Thanks.

Zargam Yep. Is it okay if we queue your question?

Am I supposed to see the feed?

Yeah. So, I agree that there's a lot of systems that already exist that could do this. And being at Microsoft, you know, LinkedIn is one that came to my mind. And, LinkedIn is already in a sense providing a a very small slice of this because if you have a LinkedIn account, you can always, have certain skill sets verified for you. So, like, I can vouch that you're, skilled, you know, computer scientist or or whatever I want. Right? But what's missing in LinkedIn is and I I think this is just an oversight because it would be so easy for them to implement is a sense of how much I, as a potential employer of you, say, should trust the fact that somebody I've never heard of has verified that you're good in computer science because it doesn't tell me, like, you know, it's missing that web of trust that, like, how many paths do I have, independent paths of my friends and my friends of friends and my friends of friends of friends that can verify that that, this claimant is is trustable in in knowing this attribute of you. So yes, I I, in short, think that there's a lot of networks out there that could do this kind of thing, and they have a very limited approach to trying to encapsulate it, but nonetheless, I would hesitate to have this be solely the purview of a private firm. Like, I'd really like this to be done on a blockchain or something that is a pub more of a public governance type system so that there's not a single point of failure or a system, so that there's not a single point of failure or a single corruptible party that can wipe out the entire identity. And also, you know, there's issues with exclusivity for identity, like maybe, a disparaged minority group won't have access to a private firm or a government identity solution.

Yeah. So, like, not me so much, but Glenn has been, working very closely with Kim Cameron on identity solutions. We think that they're largely complementary, so, I guess we're coming from a more social science perspective, and a lot of the identity solutions I'm aware of are coming from a more technical perspective, and I think that, you know, we need to combine these concepts in order to to build something that's both human usable, technically feasible, and, you know, respects incentives in an appropriate way.

I'll I'll just speak up for Navin. He actually just had to run at 06:30 because of a prior commitment.

just pick one question or move on to another one?

Yeah. So there's a I I think there's something to be worked out here as well, but I would hope that we could use cryptographic techniques to not actually share the data itself, but just the fact that we know the data. So I should be able to submit a hashed, you know, proof of like, I claimed that I was in XYZZF75230 8, location yesterday at 8AM. And so you don't know what that maps to in the real world, but you can, as the verifier, ask somebody else, like, can you also you you know where Nicole was, so can you hash her location using this hash function also? And then if they collide, we know that it's the same individual. Like, we we can verify that, you know, that, yes, that that was the right answer, but, like, without learning the answer itself.

Yeah. So I think one key point is that the redundancy of identity that naturally exists can protect a lot of, a lot of the issues here. So I guess so I'm I'm let me say two things. One is I think there is a valid world in which we have multiple identities that are distinct. And so I might wanna have the Nicole trans identity and the Nicole, like, you know, business identity or something. Or, you know, like, I think the drag community has a lot of issues with this. Right? You you have your drag personality, and that's intentionally a different person. Like, you you walk into a different person when you put on your drag and and go to a show, and you want that to be different from your business, Wall Street job identity. There's nothing about this system that requires me to have only one identity. I can I can have, like, you know, if I'm trying to verify my trans identity, I can do that with, like, you know, set of attributes that apply to that trans identity, and I can have a different set of attributes that apply to the, Wall Street job identity that I have? Now the other question was, like,

like, hiding stuff. So maybe I don't want maybe I have just one identity that includes my trans stuff, but I don't wanna release that information when I'm registering to vote. And there, I think the redundancy is gonna help a lot because I could use that as a verification of who I am. Like, you know, I'm the trans woman that sings at the, you know, gay door in on Thursday nights, but I don't have to use that because there's many other, redundant sets that have a unique intersection that identify me as who I am.

Yeah. So there the uniqueness, I I would imagine that the voting system would ask a set of queries about, like, say, there would be 10 times in the past that they ask everybody about. And if two people were in, like, two different identities were in the exact same places at these 10 times, So the trans version of yourself and the Wall Street version of yourself both had lunch at, you know, this particular time, then that would fail the uniqueness check. So the idea is that with a small number of attributes, if two different, verifiers gave the same answers to these small number of attributes, then it's quite likely that they're the same verifier. And so for things like voting, I think, you know, that that would solve that problem for the trans identity and the Wall Street identity can't both vote.

Yeah. Just in that latter point, I I forget right now the, the woman who presented this, I'm I'm embarrassed by that, but she she pinpointed she advertised to a a single individual on, Google by restricting the ad to go to, like, certain demographics, features. And with a very limited number of demographic features, she was able to advertise this ad that she had to a single individual, which was quite shocking, and so I think that's an example of this latter point, the negative side that you're mentioning. But as for empirical work, you know, we haven't done any on our own. We would really like to see some of that done. I, you know, this is we haven't talked about this project in six months, with Glenn, so maybe, he's moved on and and actually, moved into more of the empirical side of things. But, yeah, I don't, I don't have much to add to that discussion. I would love to see I, like, one, the, I guess the only thing I can add is that we've done some back of the envelope type calculations about, how many like, if you make certain assumptions on distributions of attributes of people, how many attributes do you need to uniquely identify people? And as you can expect, you can use simple combinatorics to argue that you don't need very many attributes to get unique unique, verification.

Yeah. Makes sense.

Yeah. Sure. I I just I'm just looking at my question and realizing it's not not actually a question for which I sincerely apologize. I hate people who do this. But I I guess it was just something you had mentioned, Nicole, is that how do I say it? So when you have, like, separate identities, and I thought that was a really kind of spectacular and really interesting point that people may wanna maintain separate identities, like, of a trans identity and a professional identity. And currently, that's currently maintained by the it's kinda like it's almost like natural. Right? Like, currently, what we have is a way of having separate entities. I have one name on GitHub, one on Reddit, one on LinkedIn, and you kinda have, like I mean, people can implement, I guess you can choose usernames that are all copies of one another, and that becomes a little bit more obvious that you are the same person. But, like, naturally speaking, it's like these are all separate. So the the notion of identity that's implemented there from a, like, a social perspective is that, like, the identity is kind of vested closely to the place or platform which, you know, that identity is Right.

I guess like, I I'm not sure I agree with you that I can have multiple identities in our current world.

That's all I meant to say.

Like, because you're saying I can have one identity on Facebook and a different identity on Twitter, which is true. Like, I could create a completely different username and adopt completely different behaviors on these two systems, but they're not, like, you know, the I can't have two identities on Facebook, or at least Facebook discourages that to some degree. And hence, like, in any specific activity that I'm engaged in, I still can have only one identity in today's world. Whereas what you might want is to be able to have on Facebook your trans account and your professional account and have two different circles of friends that you can engage with and maybe they overlap a little bit or this or that. Right? Like, that's not enabled in today's world.

I guess I I guess I'm just not convinced, like, whether that's the actual use case that people want. You know? But I guess this is something that would can only really be tested empirically.

Yeah. I mean

Well, no. It's I I guess what I'm trying to articulate is just the just the underlying sort of like supposition of, you know, the system is that identity is social. Right? That is like it's constructed through your knowledge of other people and their knowledge of you. And that may not be true. Like, it might be that identity is performed or active somehow. You construct an identity by engaging with a service. And if that's if that's true, right, then you would expect identity to be, like, very closely related to, like, your subscription to a service or to something else. And then that's like in in some sense, that's almost like a different notion of decentralized identity. Right? One that is not directly social. Anyway, sorry. I this is this is like how do I say it?

This is very interesting. I I'm wondering if, like, these are like, the fact that I have a Twitter account with this and that username is is an edge thing. Right? Like, there's an edge between me and Twitter that knows that, like, I can claim that I have I'm the person with this username, and Twitter can verify that that there is a Twitter account with that username. And then so there's that edge, and then there's the Facebook edge, and and the Twitter edge also, like, the the me Twitter relationship also has a lot of information about, like, the twenty third character of the eighteenth tweet I sent on was blah di di blah. Right? But I could still merge the Twitter. Like, it's still me that has both the Twitter and the Facebook account, and I could merge them to make a claim that I'm unique.

So that's, that's possibly, like, something you can incorporate in the system if you only allow verification to so let's say we could implant in every human being a, a chip that then is physically tied to my body. So that's very corporal. And this chip will record things like I've been in, you know, I'm currently in the West Village in New York City, and then and the the doorman knows that. Right? Like, and so this this can be very physical too. It doesn't have to be that I'm using the twenty third character of my eighteenth tweet to identify myself. So it kind of it, like, it is more permissive than tying my identity to my corporal self, but it doesn't have to be.

Yeah. It's interesting this, notion that accountability has to be tied to a physical existence of myself. I guess I'm maybe this is more, again, responding to John, but I find this as super interesting idea because I get that, but also social isolation could be a corporal kind or, like, I sorry. A a punishment technique. And so maybe, you know, banning me from Twitter is a punishment. Pick a random example, is a punishment that can be meted out without the physical, without the physical being a necessary thing. So I could be completely, like, live in a like, I don't even have to be a human being that has a moral, like, code embedded in myself. I could be a bot that has an identity based on all these different things that I engage in. And if the society is going to isolate me by cutting off certain access, then that would also serve to regulate my behavior.

could I jump in?

I I guess I I wonder if John is getting at part of what the word identity, you know, means to us that might not be all that important to the systems Nicole is most concerned about? Be so I guess I'm thinking of identity. I was think I'm thinking a lot about things like authentication. I guess maybe Nicole reminding us of sort of the applications you have in mind. Like, things like just authenticating that I am who I say I am is just a very small piece of, you know, what, you know, identity can mean to us. And so I guess I'm kind of interested in going the other way from John and saying, identity is sort of very situational, and, you know, it could be that, you know, you just need to identify yourself as someone who lives in this building, and that collective of people at this point in time is that identity. And then, you know, it's very fluid and very situational.

You're very agreeable.

This was super fun. Mhmm. Philosophizing about these things. I really enjoyed this. I'd I'd be delighted to hear more about this meeting in general.

Thanks, Nicole.

Thank you.