Keynote presentation slides from Ubisecure's IAMwithUBI Nordic IAM event May 2018. Digital Identity in the style of an age-old wedding rhyme, how digital identity in 2018 can be explained through something old (Facebook), something new (GDPR, AI, Blockchain Identity), something borrowed (Consent Receipts), something blue (Ubisecure!).

1. KANTARA INITIATIVE
N O R D I C I A M C O N F E R E N C E 2 0 1 8

2. Digital Identity 2018 –
A Wedding Rhyme?
#IAMwithUBI, Helsinki, May 24th 2018
Colin Wallis
Executive Director, Kantara Initiative
Ethics & Conformance Trust Marked

3. Attribution: PA https://ichef.bbci.co.uk/news/976/cpsprodpb/EBFE/production/_101641406_hi046913336.jpg

4. ‘Something old, something new,
something borrowed, something blue’

5. © Copyright 2018 Kantara Initiative, Inc.
Kantara Initiative – A Snapshot
 US non-profit, founded 2009. Estonia non-profit,
founded 2017 (licensee)
 Strong ethics & societal purpose. Low barriers to
participation. Passionate about giving control of
identity and personal data back back to individual
owners
 Mission: the global consortium improving trustworthy
use of identity and personal data through innovation,
standardization and good practice
 Business model: Membership, Trust Framework
Operator, Specification development, Publishing
platform
 Comprises global thought-leaders; Organizations &
Individuals & Government agencies
© Copyright 2017 Kantara Initiative, Inc
Our Liaisons (examples)
Our Leadership

6. …and our 40+ individual contributor members
Kantara’s Global
Membership
& x10 Non-Member Participants
© Copyright 2017 Kantara Initiative, Inc

7. © Copyright 2018 Kantara Initiative, Inc.
Our Core Work
 Nurture emerging technical communities
through our discussion & working groups
and our incubators - Digital Identity
Professionals, Identity and Privacy R&D.
 Develop and standardize community
practices with specifications companies can
understand, trust and implement.
 Operate conformity assessment programs
to enable companies to meet their
adherence goals to standardized practices
needed to support their business.

8. © Copyright 2018 Kantara Initiative, Inc.
Award-Winning, Trend-Setting, Compliance-
Assisting Innovations
 UMA, the world's first open specification for
delegated authorization, extending OAuth
2.0.
 Consent Receipt specification – a user’s
receipt for personal data containing the
conditions upon which the consent is given –
giving control of personal data back to
individuals.
 The world’s first Trust Framework to offer
3rd party assessment, approval & grant of
trust mark for NIST SP 800-63-3.

9. © Copyright 2018 Kantara Initiative, Inc.
‘Thought Leader’ Organisations & Individuals
Join Kantara
 Strong Ethics
 Low barrier to participate and contribute
 Collaborate with peers transparently and equitably
 Develop and publish artefacts on the platform
 Seek conformance, approval and grant of trust mark for
solutions
 Contribute comments to ISO and other global policy and
standards bodies side-stepping national policy and
standards bodies

10. ‘something old’…

11. Who was surprised?

12. © Copyright 2018 Kantara Initiative, Inc.
Programmatic Advertising is Data driven advertising – an unrestricted trade in PI via Cookie Matching
Who was surprised?

13. © Copyright 2018 Kantara Initiative, Inc.
Old models using old concepts
Attribution: Behance, April 6, 2011

14. © Copyright 2018 Kantara Initiative, Inc.
Business practices that pollute
the Internet...

15. © Copyright 2018 Kantara Initiative, Inc.
‘If industry can’t self regulate, Government will do it for them’
ConsentPerformance
of Contract
Legitimate
Interest
Who was surprised?

16. © Copyright 2018 Kantara Initiative, Inc.
..even though there are old (but generally good)
mechanisms for industry to self regulate

17. Conformity
Assessment
System
Standards
Assessment
Scheme
Rules
Qualified
Assessors
Mark of
Conformity
Conformity
Attestation &
Certification
Conformity
Assessment
Systems are
Available ISO/IEC 17000
© Copyright 2017 Kantara Initiative, Inc

18. © Copyright 2018 Kantara Initiative, Inc.
Principles Upon Which to Develop
Open Standards are Available
 Cooperation
 Adherence to Principles
 Collective Empowerment
 Availability
 Voluntary Adoption

19. © Copyright 2018 Kantara Initiative, Inc.
What Makes Data Privacy Regulations
Different This Time Around?
 Virality
 Digital transformation
 Aspirations
data
control
data
transparency
data protection
Attribution: Eve Maler @xmlgrrl

20. © Copyright 2018 Kantara Initiative, Inc.
‘something new’

21. © Copyright 2018 Kantara Initiative, Inc.
CustomerTech is New…Kind Of..

22. © Copyright 2018 Kantara Initiative, Inc.
To Which GDPR Articles are Most Relevant?
 Article 5: Principles relating to personal data processing
 Article 7: Conditions for consent
 Article 8: Conditions applicable to child’s consent in relation to information
society services
 Articles 12-23: Rights of the data subject
 Article 25: Data protection by design and by default
 Right of access, to restrict processing, to withdraw consent at any time
 User-controlled delegation of access
 Centralizable management of consents
 Transparency of and control over consented access
 Consented sharing directly from sources for greater data accuracy
 Parent/guardian-to-child constrained delegation

23.  A subgroup of the UMA Work Group, with globally acclaimed expert legal help,
has produced a draft framework defining:
 The business tools we (and others) can build from this framework can be single-
and cross-jurisdictional, and single- and cross-sector
 Our contention:
How the UMA protocol enables a license-based model for controlling access
rights to personal digital assets
UMA can provide the autonomy, reciprocity, and objectivity to grow market
trust in widely sharing access to personal digital assets with devices, apps, and
Internet databases.
‘The BLT Sandwich’
Putting together a business, legal, and technical framework for UMA usage & deployment
Attribution Eve Maler @xmlgrrl tinyurl.com/umalegal © Copyright 2017 Kantara Initiative, Inc

24. Something Else New…
Introducing the Localised Self Propagating Identifier

25. © Copyright 2018 Kantara Initiative, Inc.https://www.youtube.com/watch?reload=9&v=2njPFYdF29o&feature=youtu.be

26. “The growth of artificial intelligence
(AI) creates a risk that machine-to-
machine decisions could be made
with no transparency to humans.
To avoid this, and to ensure AI is
developed ethically, individuals
need to be able to influence and
determine the values, rules and
inputs that guide the development
of personalized algorithms directly
related to their identity.”

27. …yet old problems
persist inside new
ideas…

28. Blockchain Identity –
it has to be something new, right?

30. © Copyright 2018 Kantara Initiative, Inc.

31. © Copyright 2018 Kantara Initiative, Inc.

32. © Copyright 2018 Kantara Initiative, Inc.

33. © Copyright 2018 Kantara Initiative, Inc.
You will not have just one DID – you will have thousands
Each one will give you a lifetime encrypted private channel with
another person, organisation, or thing
You will use it not just to prove your identity, but to exchange
verifiable digital credentials
Best of all: there is no central registration authority – every DID is
registered directly on a blockchain or distributed network
SSIMeetup.org

35. © Copyright 2018 Kantara Initiative, Inc.
Looking Closely at the Terms…
Self Sovereign Identity – User centric identity or self issued identity
Verifiable claims – Attributes exchange, attribute management
Decentralised IDentifier – A pseudonymous key pair
Zero Knowledge Proof – Data minimisation
Distributed Ledger/Blockchain – Registr(ies) of DNS URI
(attribution: .Nat Zone https://nat.sakimura.org/)
Claims Provider – Identity Provider
(attribution: .Nat Zone https://nat.sakimura.org/)

36. © Copyright 2018 Kantara Initiative, Inc.
Is Blockchain identity ‘new’?
or something ‘borrowed and extended’?
or something ‘re-mixed and re-mastered’?
(thanks to greater computing power, faster internet and some
new technology that can solve an established problem)

37. ‘something borrowed’

38. © Copyright 2018 Kantara Initiative, Inc.
User Controlled GDPR Consent Cookie
(The IAB’s daisy-chained cookie ‘re-purposed for ‘good’)
 http://advertisingconsent.eu/ the IAB’s transparency & consent
framework.
 The Framework standardises the capture of user consent (CW: first parties)
for data processing and “signals” this information across the advertising
supply chain (CW: third parties) to process user data on one of the legal bases
laid down by the Regulation”. It uses the user’s browser cookie..
 What if….in the context of GDPR consent, this cookie approach could
be ‘re-purposed’ to become part of the consent process ‘for good’,
including agreement on the user terms along with the vendor terms

39. Kantara’s Consent Receipt Specification
Built into the user journey and machine readable
Signed JWT
© Copyright 2017 Kantara Initiative, Inc

40. Summary Conclusions
and Closing Thoughts

41. © Copyright 2018 Kantara Initiative, Inc.
#1: The digital identity landscape
can change within a few months

42. © Copyright 2018 Kantara Initiative, Inc.
#2: Finland is one of the lead nations
 FICORA – lead agency
 TrustNet Project
Trust Network for Distributed Personal Data
Management. MyData +Sovrin
 Finland Trust Network
 Federated Identity
 European Trust Mark
.. a microcosm of a global phenomenon – privacy, security, user control,
& the challenge of sharing with privacy

43. © Copyright 2018 Kantara Initiative, Inc.

44. Back to the wedding rhyme…

45. ‘something blue’..

46. This image was originally posted to Flickr by katrinket at https://www.flickr.com/photos/53759368@N00/362776208. It was reviewed on 29 May
2010 by FlickreviewR and was confirmed to be licensed under the terms of the cc-by-sa-2.0.
?

47. ?

48. Icons made by https://www.flaticon.com/authors/maxim-basinski. Flaticon">www.flaticon.com</a> is licensed by http://creativecommons.org/licenses/by/3.0/ CC 3.0 BY

49. Nurture. Develop. Operate.
– That’s What We Do
colin@kantarainitiative.org
Twitter:
@KantaraColin
@KantaraNews
Join us at https://kantarainitiative.org/membership/
Ethics & Conformance Trust Marked

50. END OF PRESENTATION

51. PANEL: REGULATION

52. T HE PA N E L ISTS
Janne Jutila
Internos Partners
I A M w i t h U B I 2 0 1 8
Colin Wallis
Kantara Intiative
Markku Mehtälä
Inside Secure
Sue Dawes
OIX UK Europe

53. COFFEE BREAK