Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:15):
Welcome to Making
Data Better, a podcast about
data quality and the impact ithas on how we protect, manage
and use the digital dataCritical to our lives.
I'm George Peabody, partner atLockstep Consulting, and thanks
for joining us with me asLockstep founder, steve Wilson.
Hi, steve, good day, george.
How are you?
I'm doing very, very well.
(00:37):
So a lot of fun today and animportant topic because I have
to say, as an American, I'mhaving a great time watching the
evolution of the digitalidentity work in Australia, our
country, compared to the US,where, look, we've got lots of
(00:57):
smart people, as we heard fromJeremy Grant in an earlier
episode, but it's fairlyuncoordinated the thinking about
how to handle the problem andtask of online identification.
In Australia, we have thefederal government.
You've got some of the statesworking more or less in harmony
around this problem of digitalidentity and data breaches,
(01:20):
because a lot of that hashappened, of course, over the
last couple of years.
So well done, steve.
I'm glad we're having thisconversation about what's
happening in Australia.
Speaker 2 (01:31):
Yeah, and Australia's
been part of an international
effort for I think 25 years withthe Five Eyes countries the US,
canada, new Zealand, australia,the UK.
We've had different legislativemodels for digital identity for
the last 20 years.
I think that what we have inAustralia now is the third draft
bill that we've had in 10 years.
(01:52):
So we've been working on thisfor a long time a lot of smart
people.
I think the significant thingthat's happened in Australia is
a shift in perspective fromdigital identity, which is
amorphous and contested andorganic and personal and just
like real world identity, andthere's a shift here.
(02:13):
I think it's a deliberate shiftto the term digital ID, which
might sound like we're splittinghairs or playing word games,
but should we unpack that rightnow?
Yes, let's do it.
Speaker 1 (02:27):
Again, I've observed
the same thing that in the
documents that have beenreleased from the federal
government and from a nationalAustralia bank, They've
abandoned that term digitalidentity in favour of digital ID
.
So yeah, unpack that for us.
Speaker 2 (02:45):
And that shift is not
an accident.
We know from talking with NAVthat it's a deliberate shift.
Digital identity appears to bethe digital version of identity.
Now I don't want to get into awhole lot of glossary
terminology and definitions andbe too semantic about this.
I just want to speak about howwe tend to use these terms.
So, identity, who am I?
(03:06):
What makes me me?
Digitising that, of course, isan impossible problem.
It means different things todifferent people.
Technologists fatally use theterm digital identity in
different ways.
There's a range of dictionarydefinitions and they don't line
up.
So that's a problem.
(03:27):
To start with, digital ID, onthe other hand, what is an ID?
If I ask you, george, for an ID, maybe I'm a barman and I'm
asking you to prove your age,then you'll know what to do.
If you're a student and we askyou for your ID, you'll know
what to do.
If you're visiting somebody,say you're visiting your own
company, the office in Australia, and the security person says,
(03:51):
hey, mr Peabody, show us your ID, you'll know that it's an
employee ID.
So we casually use the term ID.
We know what it means.
There's lots of them.
There's driver's licenses,passport certificates, medicare
cards.
They're all IDs.
Digital ID guess what?
It's just the digitised fact,the digitised attribute.
(04:13):
Now there's a number oftechnologies that make the
presentation of those IDs moreor less secure and we can come
to that.
The important thing about theAustralian legislation is that
it's just settled on the termdigital ID.
It's not about identity, andthat's super important because
for 20 years we've beeninvariably led down the path of
(04:36):
a new universal way of provingwho you are.
And that is so problematic.
I don't need to go there.
I don't think I need to treadthat ground again.
We know that the universaldigital identity certainly in
the US, australia, the UK it'snot even found upon its taboo.
I don't think we need.
(04:56):
The greatest news in all ofthis is that we don't need it.
Speaker 1 (04:59):
Exactly.
It would simply be yet anotherattribute when we already have
attributes in abundance thathave been developed and put out
in the world because they haveparticular use cases, particular
context.
Yes, we have IDs, like adriver's license that gets used
(05:20):
in other contexts, arguablyappropriately or not.
I have to show my ID to the barman to prove I'm over 21.
He actually sees where I liveand my name and all of that,
which is none of their business.
I can imagine that, with theright development, the right
user experience design, that itwould actually be possible to
(05:44):
walk into a bar and show mysmartphone and that would just
tell the bar man yeah, this guyis over 21.
Beyond that, he doesn't need toknow anything about me.
Speaker 2 (05:56):
Piece of cake Right
Piece of cake technologically so
easy.
Speaker 1 (06:01):
Yes, that's really up
around.
We're creating a digital ID, orwe need a digital ID, or we
need a collection of digital IDsthese individual facts for
individual use cases.
If you're opening a bankaccount, you need a collection,
or the bank needs a collectionof digital IDs attributes about
(06:23):
you in order to make a riskdecision to whether to bring you
on as a customer or not.
Speaker 2 (06:29):
And I think that what
the government in Australia has
let Sean to so remember.
We've had the world's biggestdata breaches as an appropriated
basis in the last two years inAustralia, and everybody's
driver's license number isassumed to now be stolen.
Some of the state governmentsresponded to these breaches by
giving you a free option torenew your driver's license.
But, oh my God, it was theproper response.
(06:53):
But let's play a long game.
Are we going to renew ourdriver's license every time
there's another data breach?
Of course not.
The problem is not the driver'slicense itself, the problem is
the replayability of the number,and we have this bad habit of
plain text presentation of allof those IDs.
(07:13):
Now I think the Australiangovernment has rethought this
with some clarity and someprecision and said you know what
the problem with identity crime?
Identity crime is not identitytheft, or identity theft doesn't
steal anybody's identity.
It's just a catchall for what'sactually data theft.
So we don't have an identitycrime problem, we have a data
(07:36):
problem.
And if we could make those IDsmore reliable so that they can't
be stolen and reused behind ourbacks, but instead of being
presented in plain text, theseIDs are presented
cryptographically or usingmobile technology, that would
solve the identity crime problemwithout any new universal
identity.
So it's a really cleanreframing of the problem that we
(08:01):
need to solve.
Speaker 1 (08:04):
Yeah, you know, I
like that, because adding any
other attributes or indeed justbuilding higher security walls,
or what we see in regulatorsdoing all the time is demanding
that those enterprises thatstore data about us put higher
walls and stronger walls aroundthem.
But the problem is that'sreally a very difficult task and
(08:27):
it's all we're doing isrepeating the processes that,
ultimately, we really haven'tworked for the last two decades.
Speaker 2 (08:36):
So it's a futile arms
race expecting to take this
data.
We should make the data lessradioactive and less usable to
criminals, and I think thatthat's the opportunity we've got
in front of us with digital IDin Australia.
Speaker 1 (08:50):
Well, the good news
is that we've, as a society,
we've done this before.
If you look at what the paymentcard industry did with its EMV
chip cards, what that put inplace was, running along with
every payment transaction, thereis now a piece of
(09:10):
cryptographically encoded datathat gets sent to the issuer of
the bank, the issuing bank ofthat card, and that assures that
the issuing bank to the issuingbank that it is indeed their
card, the card that they put inthe hands of their card holder,
as opposed to and this wasdesigned, of course, to replace
(09:31):
what we now think of as a plaintext data problem that came off
of the MagStripe at the back ofthe cards.
That MagStripe could be copiedover and over again, and what
the card industry did was put alittle bit of intelligence in
those microchips, a little moreintelligence in the terminals,
read them, and then, of course,intelligence in the back end,
(09:52):
the issuing bank to reallyprovide a mechanism for device
presented or device assistedpresentation of data, as opposed
to just presentation of plaintext.
So I think what you're sayingis and I know what you're saying
perfectly well that what you'resaying is we should be doing
the same thing for all theseother digital IDs, or all these
(10:16):
other IDs to make them securelydigital.
Speaker 2 (10:20):
Yep, we've done it
before.
I think if you go all the wayback to the paper credit cards
of the 1950s and then plasticcards, you know embossed cards
in the 60s and 70s, magneticstripe cards, chip cards and now
mobile phones, the accountnumber is the same.
It's the same data.
It's a 16-digit primary accountnumber.
(10:43):
It's the same data all the waythrough.
For 70 years.
It's been the same data.
But we've made the data betterby presenting it.
Now we present it with theassistance of a chip.
So two chips talk to each otherthe chip in your card or your
phone, the chip in the merchantterminal.
They know that this is genuinedata and, as you say, there's a
little bit of cryptography, alittle bit of a code that goes
(11:04):
with the core data to prove thatthe core data has come from a
real bank and it's beenpresented with the consent of
the card holder.
So exactly I mean just toreally round the point home if
you took your Medicare card oryour driver's license or your
employee ID and used that samecryptographic trick, so that it
(11:25):
wasn't plain text anymore but itwas device assisted, I
sincerely believe this is goingto sound over the top, but we
could do the same thing toidentity crime today as what we
did to card crime 10 to 15 yearsago.
You could cut it by I don't know, let's model it, george but you
could cut it by 70 or 80% in acouple of years and you would
(11:50):
then neutralize the black market.
Install the data.
Most data breaches now aredriven by criminals.
They're done by organized crime.
They have incredible resources,incredible guile to break into
Optus and to break into MedibankPrivate and to break into the
social administration of theUnited States.
You can't stop these criminals.
(12:12):
What you can do is you canremove the incentive by making
the data so much better thatit's useless to criminals, and I
think that that is the way thatwe seem to be thinking about
digital ID in Australia now.
Speaker 1 (12:26):
And compared to where
we were even 10 or 15 years ago
.
We actually have the back endtechnology, but we also have in
the hands of virtually everycitizen, the device that can
store a digital ID or acollection of digital IDs.
That device also manages andcreates a user experience and
(12:48):
guides the user experience forthe sharing of those digital IDs
.
So, in other words, we've gotthe tools to put this kind of
device-assisted presentation inplace across all the IDs that we
need to be able to share in ourday-to-day lives.
Not to say it's not a lot ofwork.
Speaker 2 (13:08):
It's not prepared
earlier.
Yeah Look, the latest figuresfrom the Reserve Bank of
Australia show that 35% of cardpayments are now done via mobile
wallets, so that idea of tap topay or click to pay is so
habituated.
Now I think, George, you talkabout the pattern.
There's a consumer pattern.
(13:30):
We know how to use thistechnology.
That proportion of thepopulation that's comfortable
with this stuff now is rising.
It could be 50%, 60%, 70% in acouple of years' time.
So why don't we just abstractthat?
If you can click to pay, thenyou should be able to click to
prove your ID any ID and you'dput it in a wallet.
(13:51):
People are familiar with thatpresentation.
Now, such a powerful latentsuperpower that we've all now
got in our pockets.
Speaker 1 (13:59):
And those credentials
could be released either in an
operating system level wallet, athird party wallet that
contains multiple credentials,or over 15 years ago, I did some
research about how many appsare customers willing to use to
affect their payments, and itturns out it was a fairly large
(14:23):
number.
The reason is we know which appwe want to use to get a
particular job done.
It's just like we know which.
Prior to that, we knew fullwell which card to pull out of
our wallet in order to eithermake a payment or, as you said
earlier, to present our employeeID to get access to the
(14:43):
building.
We know what we need to use.
We have pretty much a fairlyunencumbered device in order to
store and present credentials.
I know we're going to betalking about the digital wallet
evolution in an upcomingepisode, so why don't we leave
it there, steve?
This is exciting.
There's definitely theopportunity to make data better
(15:05):
here.
Speaker 2 (15:06):
Yeah, thanks, george.
It was your idea to have thisquick podcast.
We're breaking our normalformat and just having a chat
between the two of us, but we'veall been reading a lot of press
reports in the last few weeksand a lot of well-meaning
confusion about what is thedigital ID and what's the
digital identity and how doesthis matter.
So I hope that what we've donenow is to position this and show
(15:27):
now that shift is subtle butreally important.
It allows us to conserve theIDs that we've already got.
It makes that data better andit makes it easy to present.
I think that we could be usingthese IDs just as safely and as
quickly and as easily as we useour virtual credit cards.
Speaker 1 (15:47):
All right, stephen,
thanks a lot.
See you next time.
Speaker 2 (15:50):
Cheers, george, take
care Bye.