0:04 – Hello. Okay, great. My name is Daniel Hardman. I am a CEO of a company that is
0:12 in the telecom space. I've been working in identity for many years. And I got an
0:17 almost impossible assignment from Christopher and crew, which is to try to
0:23 summarize the state of the identity landscape in 10 minutes. And that's almost
0:31 impossible because there's so much that's happening and that has been happening. So,
0:38 you know, being a progressive thinker here, I said, I'll ask AI to help me find
0:43 a list of things that are going on in the space. Now, I knew that this was going to
0:48 generate massive amounts of stuff. So, I said, just find 40 headlines that have
0:56 been in the news recently in English about things that are going on in identity that
1:00 have been widely reported. So this is what it came up with and this is of course an
1:08 AI summary but the point of this is not the specific headlines. The main point of
1:14 it is how many of them there are and how hard it was even for the AI to pick from
1:19 all the different things that are going on in the space. And as I was watching this
1:25 list come in from AI what was going through my head that is that Billy Joel
1:29 song, We Didn't Start the Fire. You know what I'm talking about? There's just so
1:34 much that's happening and it's virtually impossible or overwhelming to keep track
1:38 of it all. So to summarize in 10 minutes is very hard, but what I'm going to do is
1:44 I'm going to try to explain how it looks to me as a practitioner in the space at a
1:51 high level. I'm going to make some generalizations. These generalizations are
1:55 partly subjective, perspective, but I think they're a useful mental model for
2:00 people to understand if you're not thinking about identity all the time and
2:04 you want to kind of wrap your brain around it. So, my generalizations basically say
2:11 that there have been three waves of innovation in identity and I would start
2:17 the really interesting and this is digital identity by the way. I would start these
2:21 waves going back to something like maybe the Diffie-Hellman. Diffie-Hellman was a
2:26 cryptographic technique that was invented in 1976. You could possibly go back to
2:31 email which was a little bit earlier than Diffie-Hellman. But anyway, and then I
2:36 would say that there's these three bands of or waves of innovation and they have
2:41 characteristics that are common or commonalities in the way they think about
2:47 things. These aren't exactly
2:53 perfectly aligned technologies in each of these bands, but they have these common
2:57 characteristics. So I'm not sure what happened there. Maybe my laptop is still
3:04 alive. I'm going to keep talking. Maybe we can get it to come back up. Okay. So the
3:14 first band here, central or federated governance, it was an assumption that when
3:21 you built identity systems initially there was going to be some central body that did
3:26 it for you. And it was an assumption that you were going to use this brand new cool
3:31 thing called Diffie-Hellman and this brand new cool thing called asymmetric
3:34 cryptography and all that kind of good stuff. And that you were going to use keys
3:38 and certificates. That was kind of the new kid on the block that was cool at the
3:44 beginning. And a lot of innovation has happened since then that kind of keeps
3:48 those key assumptions. solutions. And by the way, when I represent these three
3:55 bands here, I'm not saying that there's bad and okay and better so much as I'm
4:02 saying it's kind of like a classic car that had a carburetor and then a car that
4:07 has a fuel injector and a computer and then an electric car or something. These
4:10 are waves of technology. There are reasons though why we learn from our experience.
4:19 And so there is thinking in these later bands that looks back at what was done in
4:25 the earlier bands and says there might be a better way to do this and there's
4:30 advantages to tweaking our mental model. So the second band of identity innovation
4:37 I would kind of track back HIPA is kind of an outlier in the fact that it came about
4:43 pretty early and by the way HIPA has Utah roots. I didn't know that until yesterday
4:47 I was talking to somebody. But anyway, really kind of when blockchain started
4:54 impinging on people's consciousness, there were a number of things that people said,
4:59 oh, wait a minute. That means there's a different way that we could do this. Oh,
5:02 there's a different way we could do that. And there were some dominoes that fell and
5:06 it brought about this yellow band of thinking. And the thing that's different
5:10 mainly between the red and the yellow is that we're using generation two techniques
5:15 where we're not identifying people by keys. Now we're identifying people by
5:20 identifiers. And we're using probably upgraded cryptography like elliptic curve
5:27 and so forth. And there's a lot of blockchain, although it's not all
5:31 blockchain oriented in the yellow band. But there's a lot of the notion of
5:36 wallets, digital wallets was a big deal. And then there are a lot of dissonance
5:42 around privacy issues as this yellow band kind of came about. out. The third wave of
5:48 thinking here, this green band is typified in my mind by a much more sophisticated
5:55 and nuanced view about the governance that has to be in place. And that doesn't mean
6:04 that people that are making yellow banded stuff or red banded stuff are ignorant
6:10 about governance by any means. But it's kind of like playing a symphony. There's a
6:15 lot of different instruments and I think in the green band the full range of
6:20 instruments is now much more apparent. And big emphasis on auditability of what's
6:28 going on in a system and a big emphasis on recoverability. If something goes wrong
6:37 and you assume in the green band that things will go wrong. So the question
6:43 becomes what do you do when things go wrong? wrong, not how do you prevent
6:47 things from going wrong, which is an unrealistic question in some ways. And
6:52 there's different cryptographic primitives. There's identifiers, yes, but
6:56 they're upgraded to autonomic identifiers which have certain desirable properties,
7:02 so forth. And an emphasis on look post -quantum is going to be a reality soon.
7:09 Are we ready for it? It would be really foolish to build an identity system that's
7:14 not ready for post-quantum at this point when NIST has already announced post
7:20 -quantum standards.
7:24 Okay, so enough on that slide. I can't spend that much time because there's just
7:30 like I said 10 minutes is nearly impossible here. What I see in the market
7:36 is that there's major tensions. There's things that are pulling solutions to the
7:44 yellow and the red band. hands and you can see what I've said roughly kind of argues
7:52 for yellow and red solutions today. And then there's things that pull people
7:57 towards the green direction when they're designing solutions.
8:04 Enough said on that. I could go into this for hours, but let me just talk about the
8:10 two biggest forces that I see in the market today. I just returned from living
8:16 in Europe for several years. So I've lived personally through the EUDI initiative a
8:24 little bit and what's going on there. And the EUDI initiative has enormous, enormous
8:32 momentum. It's a juggernaut in Europe. But it doesn't, it's not without its
8:38 challenges. many different countries have built systems and they kind of don't all
8:44 get along, but they're trying really hard. And the state of play in the United States
8:54 is a little bit different. You have state level initiatives, which is why this
9:01 conference makes so much sense. States are making the decisions, not a central
9:06 government. There are things that are being built with generation one solutions
9:12 or generation two solutions in the United States. Absolutely. SEDI is an example of
9:18 a generation three solution and there's reasons why I think that's really
9:22 exciting. The strategic trends that I'm aware of, I'm not going to say them all,
9:31 but you can read them there. I'll just say that the thing I would bet on, bet my
9:36 bottom dollar on, is that last bullet. Security pressures are going to grow and
9:41 legal pressures are going to grow. I guarantee that's going to be true. If
9:46 nothing else that I can forecast, that one's for sure. Remember what that might
9:52 imply about what kinds of solutions are wise. I'd like to end with a thought here
9:59 and that is we sometimes hear solutions described in terms of formats. So, you're
10:05 going to hear today about ISO mobile driver's licenses and you're going to hear
10:09 about W3C verifiable credentials and so forth. I think that's the wrong way to
10:14 think about decisions. Up here you have two pictures of the same person and one of
10:22 them is the lossless view that you get off of a digital camera when you take an image
10:26 and the other one is a JPEG. Now, are JPEGs bad? No. We use them all the time
10:32 and they're very useful. But if you're a professional graphic artist, you would
10:36 never want to deal in JPEGs as inputs to your graphic projects. So they have
10:42 different uses. And I'd like to suggest that permanent evidence needs to be
10:49 lossless evidence. And there are a number of dimensions to losslessness. There's
10:55 time-related dimensions like how long does this evidence persist. There's governance
11:01 -related dimensions to evidence. There's post-quantum cryptography related
11:06 dimensions to evidence and losslessness. There's all kinds of stuff. So I'd like to
11:12 just suggest that as you run into conversations about this, don't make it a
11:17 debate about formats. Make it a debate about how to solve problems and you'll
11:24 find that the format questions fall out. Thank you.