Dr. Mawaki Chango Kara University DigiLexis Consulting FROM STATE ADMINISTRATION TO BLOCKCHAIN? A Policy Perspective on the Fundamentals of Identity Dr. Mawaki Chango Kara University DigiLexis Consulting

Contents Socio-historical research on identity: research purpose and findings The making of digital identity Blockchain and self-sovereign identity The case of Sovrin Identity Network

SOCIO-HISTORICAL RESEARCH AND FINDINGS Lessons from THE MODERN STATE

Authoritative Identity Identity subjects have adopted it and use it Other parties which were not part of issuing it, rely on it. Becomes a standard referred to by more and more parties. Becomes an anchor around which an extensive record (of relevance) about the same individual is accumulated. Follow by off-slide elaboration.

The making of digital identity Tracing the process

1. Centralized Identity Administrative control by a single authority or hierarchy 1988: IANA began to determine the validity of IP addresses 1998: ICANN began to manage and make policies for domain names 1995: Certificate Authorities started helping Internet commerce sites

Limitations Users are locked in to a single authority who can deny their identity Balkanization or silos: juggling between an incontrollable number of identities on different websites Digital identities are owned by CAs, domain registrars, and individual sites They rent them to users and can revoke them at any time

2. Federated Identity Administrative control by multiple, federated authorities 1999: Microsoft .NET Passport Federated: allowed users to utilize the same ID on multiple sites But put Microsoft at the center of it all 2001: Liberty Alliance organized by Sun Microsystems Reduce balkanization but the power of centralized authority just got divided among several entities

3. User-centric Identity Administrative control in the hands of the individual or across multiple authorities without requiring federation Ambition to give every user the capability to build a persistent online identity, and control it. Making up for the lack of identity layer in the core Internet architecture

User-centric… 2001: Identity Commons Consolidation of work digital identity and decentralization Launch of Internet Identity Workshop in 2005 User-centric identity vs. Server-centric model of centralized authorities Better user experience Users to have more control over their ID Trust to be decentralized

Instances of User-centric ID OpenID (2005) OpenID 2.0 (2006) OpenID Connect (2014) OAuth (2010) FIDO (2013) Main characteristics User consent Interoperability

Research Findings on Digital ID Ref. Notes on Research Implications

4. Self-sovereign Identity Bringing in user autonomy User not only to be at the center but to become the ruler of their digital identity It’s being increasingly recognized that individuals “have an established right to an ‘identity’.” Leading to the emergence of ‘personal cloud’ initiatives (e.g., Open Mustard Seed begun in 2012 by Patrick Deegan)

Self-sovereign… Mathematical policy (e.g., Marlinspike) Cryptography is used to protect user’s autonomy and control Legal policy (e.g., Sovrin Identity Network) Defining principles and contractual rules that network members agree to follow In 2015, self-sovereign identity made an entrance in international policy (refugee crisis in Europe)

Main Characteristics User must be central to the administration of identity Interoperability across multiple locations and sites User consent Portability is required for true user’s control Allow ordinary users to make claims

A Few Basic Principles Prevent human rights abuses by the powerful Defend against financial and other losses Support the rights of the individual to be oneself and to freely associate And there are more…

Blockchain & self-sovereign identity will distributed ledger technology save digital identity?

Blockchain Distributed ledger technology (DLT) Peer to peer exchange of value Ledgers: form of database that is provided cooperatively by a pool of participants Distributed Public Encrypted Every 10 mn. all transactions verified, cleared and stored in a block linking to the preceding block Examples of Bitcoin and Ethereum Permissionless ledgers

Case: Sovrin Identity Network Sovrin is a software ecosystem for private, secure and powerful identity “Public permissioned,” open source, distributed ledger technology Nodes of the Sovrin Identity Network Analogy with ATM SIN (or SIDNet) is publicly accessible, but the data is visible only with the consent of its owner

Sovrin Stakeholders Sovrin Foundation: Oversight Board of Trustees: Governance of the Foundation Initiated by trusted institutions and individuals to bootstrap the process Universities, financial organizations, hospitals, issuers of driving licences, passports, birth certificates, etc. Technical Governance Board Legal, technical and operational policies for Sovrin nodes Nodes exercising stewardship of the ecosystem Identity Owner

Foundations Contractual model of governance Full suite of 3 founding documents The Provisional Trust Framework (PTF) The Identity Owner Agreement The Founding Steward Agreement The two Agreements are appendices to the PTF Others: Agency and Developer Agreements

Main PTF Sections Purpose and Principles Definitions Policies Business Legal Technical Amendments

Purpose The purpose of the Sovrin Network is to provide a global public utility for decentralized identity that adheres to a number of principles

Principles Independence and Self-Sovereignty Guardianship Diffuse Trust Web of Trust System Diversity Interoperability Security Privacy Portability Accountability Transparency Accessibility, Inclusion, and Non-Discrimination Collective Best Interest

Business Policies Identity Owners Stewards Guardians Trust Anchors Obligations Stewards Qualifications Invitations Disqualification and Remediation Guardians Obligations Trust Anchors Qualifications Invitations Disqualification and Remediation

Legal Policies Identity Owners Stewards Agencies Developers Sovrin Trust Mark Dispute Resolution

Technical Policies Steward Node Requirements Steward Security Monitoring & Reporting Sovrin Ledger Write Permissions Sovrin Ledger Transaction Limitations Agencies Developers

Concluding Remarks Why would stakeholders rely on Self-sovereign identity to identify their counterparts, or rather to conduct identity-based transactions with users?

THANK YOU! Dr. Mawaki Chango Kara University, Togo DigiLexis Consulting @ki_chango