5 things PMs should know about digital identity

More online services are making use of digital identification in products

In 1817, a cobbler in a small village outside Bristol came across a young woman wearing a turban and speaking an unrecognisable language. He took her to the local authority tasked with looking after the poor, and after being examined by doctors and scholars it was deciphered that she was Princess Caraboo, an exotic royal kidnapped by pirates from her home island Javasu in the Indian Ocean. Treated like aristocracy, she beguiled local dignitaries and was provided with clothes and comforts– that is, until the landlady of a boarding house recognised her picture in a newspaper and outed her as a local servant girl named Mary Baker. That identification cost her a life of luxury and thrust her back onto a trajectory that would lead her to become a leech seller and die in obscurity. 

Modern life is built on the ability to prove your identity. Ensuring that when you get behind the wheel of a car you are who you say you are– someone who has passed a skills test– keeps the roads safer for everyone. And when you qualify for social benefits, such as a pension, making sure  that you are who you say you are means you can access what you are entitled to– or that a Princess Caraboo-type figure isn’t claiming to be you in your place. As these services move online, so do the systems that provide proof of legal identity. This creates new opportunities for digital layers to be built on top of existing legal ID systems so that online transactions can happen, and means that there’s more chance that as PMs we’ll want to know something about digital identity as it relates to an increasing number of products.

1. ID systems collect personal attributes to prove identity

ID systems verify your identity using attributes, whether biographical (e.g. name, age) or biometric (e.g. facial image, fingerprints), that are unique to you in a given context. When the appropriate identity attributes are collected and validated, they establish a person’s identity and provide proof of that identity in the form of a credential. This credential is then used by the individual via authentication to prove the identity to “relying” parties, or diverse third parties including government agencies, financial institutions, and employers that require assurance of who that person is. 

Your attributes help answer one or more of these questions:

• Who are you?

• Are you who you say you are?

• Are you authorised or eligible for something?

The first question establishes your identity by collecting the information required. This is followed by the authentication process where checks are carried out to determine that you’re the true owner of the identity claimed, which is done by checking against something you have (like a card), something you know (like your mother’s maiden name), or something you are (like your fingerprints). 

2. There are several key features of an ID system

The purpose of an ID system is to allow access to basic rights, services, and opportunities. While ID can be either foundational, covering the general population for a wide range of transactions, or functional, serving a specific purpose like a driver’s licence, they always have three key features. These are: 

• whether the ID establishes uniqueness

• , who in a population is covered, 

• and the technology used. 

Uniqueness means that an individual cannot claim multiple identities within a system, and that each identity is associated with one person only. While most systems are designed for uniqueness, this isn’t always the case– for example, in the now decommissioned Gov.UK Verify system, an individual could enrol multiple times because while it was used to prove an identity, it left uniqueness the responsibility of relying parties.

Foundational ID systems typically cover more of the population than functional ID systems, and this is because they’re intended to be universal. 

When it comes to the technology used, systems are either traditional paper-based formats or, as is becoming more widely adopted as systems move online, digitised. 

3. Moving ID systems online creates a lot of new complexity

As ID systems are digitised, they no longer need to be managed entirely by governments. Partnerships between the government and the private sector can increase the use cases addressed by digital identity, and unlock up to 13% of GDP by 2030. But there are a lot of risks, too, primarily to do with security and privacy. 

Back in 2006, the UK passed the Identity Cards Act that created not just national identification cards but also a centralised database that stored the personal information of the population. This particular solution came under scrutiny, calling into question issues of privacy and providing no evidence that its aim to combat terrorism would be achieved. The Act was repealed in 2011 and the database destroyed.

Nearly two decades on, there are even more accounts and online data than ever– the IDC predicts that by 2025 the global datasphere will grow to 175 zettabytes (a zettabyte is equivalent to a trillion gigabytes). This amount of connectivity and information sharing presents the risk of data breaches, technological failure, and concerns around making sure individuals maintain control over their personal data. Making sure these continue to be addressed as technology and policy advances is vital; digital ID systems must be designed with these challenges in mind.

4. Good digital ID can unlock value that is both financial and social

Opening a bank account by meeting the know-your-customer (KYC) requirements keeps a huge amount of fraudulent activity at bay; although a challenge across the board, fraud in anonymous crypto finance (referred to as DeFi) increased by over 33% for losses totalling £226m the UK in 2022. In the same period, fraud was up by only 8% in general, demonstrating the impact of secure systems that use identification. 

Good ID enables an equitable society by ensuring access to jobs, government benefits and services, and financial systems, but it also has a hand in helping to reduce child marriages, stop human trafficking, and end preventable newborn deaths. It also puts us on a path to greater equity: In Estonia, over 30 percent of individuals vote online, of whom 20 percent say they would not vote at a physical polling place. And during the pandemic, individuals in Singapore were able to access benefits like the Recovery Grant using Singpass, which has been adopted by 97% of the eligible population, making the government’s COVID19 response fast and effective. Added up, this is all to say that identity verification makes our economy stronger, keeps us healthier, and our society a whole lot more pleasant to live in. 

5. There are arguments for requiring ID in more places across the internet

It’s clear that the use of digital identity can make things like voting easier, and that advances can reduce the friction in existing KYC processes. But there are other places it could be used, too– nearly 700,000 people in the UK signed a petition to have verified IDs made a prerequisite of using social media where anonymity reigns, powering trolling and online abuse.

Scott Galloway has called for social media providers to require identity verification to battle the bot and spam issues, and even sees the value propositions for doing so:

Once an identity is affixed to an account, a platform could decide whether to permit pseudonyms. LinkedIn likely sees little value in anonymous accounts, and Facebook’s basic premise is in opposition to pseudonyms. Both brands would benefit from maintaining an environment where real people post under their real names (perhaps with exceptions for worthy cases). Twitter, on the other hand, might see the virtue in continued anonymity, and even allowing multiple accounts (a subscription perk, perhaps?), but it could wipe away its bot problem with KYC.

The ‘bot problem’, as Galloway notes, has been tied to nefarious political activity originating from regimes such as Russia and China. 

There’s so much value in digital identity, but as product managers it is up to us to understand the basics of how it works, the benefits, and the risks.