Episode 12 - Continued innovation for digital ID and authentication

Transcript of the recording

Cyrielle Chiron:
Many believe that Canadians should have control of their personal data. Control who can access it and when. But also have the right to keep that information private. But what standard exists, if any? As more transactions are done electronically, the need for increased security is growing.

Cyrielle Chiron:
However, there is also a necessity for providers to adapt. The need for security and protecting digital identities has continued to grow, and our means of authentication for both consumer and businesses needs to evolve with it. Digital identification can make it easier to verify identity, and address security lapses, which my guests today will be discussing with us further.

Cyrielle Chiron:
I'm Cyrielle Chiron, your host for season two of The PayPod, which talks about all aspects of Canada's ambitious payments organization mission, and explores the topics that influence payments in Canada and around the world.

Cyrielle Chiron:
Strong customer authentication continues to be top of mind for payments organization around the world. Failing to confirm customer identity is a slippery slope that could see a host of unwanted consequences. It's also a big consideration for Canadian consumers. Based on a study conducted by Interac last year, 83 percent of Canadians describe their identity as one of their most valuable assets. But many are still unfamiliar with the concept of digital ID overall, and even less within payments.

Cyrielle Chiron:
Our discussion today will explore the perspectives of some of the leading digital ID champions, and that of the major player in the software space, shedding light on how professionals across the country can get closer to a frictionless and more secure payments industry.

Cyrielle Chiron:
Joining me today is Joni Brennan, President of the Digital ID and Authentication Council of Canada, or known as DIACC. Building upon 15 years of hands on experience in identity access management, innovations, and industry standards development. Joni helps the DIACC to fulfill its vision of organizing Canadian market forces to unlock digital identity and authentication economic opportunities for all Canadians.

Cyrielle Chiron:
Also joining us is Ian Glazer, Vice President of Identity Product Management and Salesforce, where his responsibilities include leading the product management team, product strategy, and identity standards work. He's also the founder and President of IDPro, where he works to deliver more services and value to the IDPro membership, raise funds for the organization, and help identify management professionals learn from one another.

Cyrielle Chiron:
Thank you both for joining me today on The PayPod.

Ian Glazer:
It's great to be here.

Joni Brennan:
Thanks for having us.

Cyrielle Chiron:
What an exciting topic we have today. Digital ID has been a buzzword for some time now. I've been reading it in the media a lot, and some companies have been providing it for a few years now. But I think I'm hearing everything and anything here. So, maybe we'll start with you, Joni, and you can help me answer this question. What is digital ID, and what are its benefits? Why is it important? Really, why is everyone talking about it?

Joni Brennan:
Yeah, well, digital ID can be a difficult topic to explain. And so we've done some research in the DIACC, and what we've found is that most people, average people, don't understand what we mean when we're talking about digital identity. So there is some education to be done. When I think about digital identity, I think about a collection of what I call attributes. A collection or descriptors. So things that describe who I am in a data driven way. And so for example, data that would say that I am a resident of
British Columbia. Or data that would say that I am a permanent resident of Canada. So if we think about these kind of data representations of things about us, when you put those pieces together you can create what is an identity. And so that's what we mean when we talk about digital identity.

Joni Brennan:
Of course there are many functions. Thinking about authentication, for example. How do you authenticate yourself to a service. That is part of identity. But identity itself is really all of those descriptors about who we are, how verifiable those descriptors are, and how we present them to others in order to perform a transaction.

Cyrielle Chiron:
Right, so really like who we are. The data collections in a digital way. Ian, do you agree with Joni's definitions or explanations? Or is there anything you think differently or you'd like to add in here?

Ian Glazer:
Well I might expand on the notion that it takes sort of two, if you will.

Cyrielle Chiron:
Okay.

Ian Glazer:
That there is the collection of the things that describe you in an online world.

Cyrielle Chiron:
Okay.

Ian Glazer:
And some of those are things that you describe yourself, right? You provide, that is, you know, information that you provide yourself. There are things that get, if you will, mixed in from other sources. And this could be a digital representation, for example, of your citizenship. Or it could be simply membership in an organization.

Ian Glazer:
But there is also the other side of the story, which is that organizations need to know how to consume that information. How to understand what that information is. And it actually takes both in equal measure. Because if you have a digital representation of an identity, and no one can consume it, then you actually don't have anything you can use sort of productively. There's no way to interact.

Cyrielle Chiron:
Yeah.

Ian Glazer:
And so we have to think about both the ways one can go through the ceremony of identifying herself online, and the other side, which is how does an organization, public or private, consume that information and understand what it means and respect the wishes of the individual as to the use of that information?

Cyrielle Chiron:
Right. That's pretty interesting. You're right, if you can't use it, and if both parties can't transact, it is kind of useless to have your ID stored somewhere.

Cyrielle Chiron:
I have another question actually. When talking about what it is, and it might be a very busy question. We talk about data, we talk about, you know, your citizenship, or it could be your driving license, or anything. But what about biometrics. Are my fingerprints, my eye, like, is it digital ID?

Joni Brennan:
So in asking the question if biometrics are digital ID, I would say that biometrics are one part of digital ID. They are one mechanism, if you will, that can be leveraged for digital ID. And so, there may be something about those biometrics that goes into that collection of data presenting and accepting who you are. So that can be part of that digital ID. In other cases, a biometric or a representation of a biometric can be used to authenticate. So thinking about kind of how you might use your finger to open
your phone.

Joni Brennan:
So biometrics can be used in different kinds of ways. They can be used to validate, does this picture match the picture that we have on file? They can be used for authentication. So stand alone, biometrics itself, it is something I am. It's one of those kind of features that is part of digital ID. It becomes really powerful when those biometrics are used within systems and solutions and services. And of course, right now, perhaps more than ever, conversations about how biometrics can and should be used, are critical in the sense that we don't necessarily have a standard for use with regard to appropriate use for biometrics, let's say, by law enforcement, or by third parties. So it's an important topic for us in Canada and I would say around the world, where and how should biometrics be collected and used in the context of a greater digital identity ecosystem.

Cyrielle Chiron:
Yeah, I think you're right. Like, thinking about the standards and how it should be used. That's actually extremely topical, right? And I'd like to talk about it a little bit further. But Ian, I'd like to ask you, because your job, you think about, you deal with businesses a lot. So is there any differences between consumer and businesses? Or is digital ID regardless of those two segments?

Ian Glazer:
I would make that separation necessarily.

Cyrielle Chiron:
Okay.

Ian Glazer:
Where there are differences in terms of the needs of serving a workforce, versus serving your citizens or your direct financial customers, for example. There are  differences, for sure. But I think in this context, it's more important to think about what businesses need and why they're interesting in digital identity to begin with.

Ian Glazer:
And what we are seeing is that identity is fundamental to all digital engagement and digital transformation. So all of the organizations now who are ... were dusting off their digital transformation plans, because of the COVID-19 pandemic, for example, are realizing that if I am going to interact with my students, my citizens, my customers online, I have got to have at least some identity capabilities. And if I want to do more, well then I've got to have more maturity there.

Ian Glazer:
And so not just in my day job, but in my other, other day job, where I am the founder and president of IDPro, which is the association for digital identity management, the professional association, we talk about this a lot. Which is, we see the drive to engage in an online forum now with one's customers, no matter what sector, what industry, what geography is stronger than ever. And that means fundamentally, all organizations need ways of interacting with digital identity.

Cyrielle Chiron:
Right, yeah. So it's kind of really important, right? I understand why everyone is talking about it. Thank you for that. I'd like to go to you, Joni, because it's important. It's clear we kind of identified that. But what are we missing out if we don't implement it in Canada at all? Like, is there anything that we're going to be left out or something like that?

Joni Brennan:
I think to answer that question is very straightforward. We are going to be missing out if we don't implement inner-operable, secure, and privacy respecting identity across the Canadian economy. There have been various studies that have been done with regard to what that economic potential is, by solving digital identity for people and for businesses, in the terms of the kinds of transactions that they make.

Joni Brennan:
And you know, it's safe to say, I would say, that anywhere between two to three percent of GDP growth, potential GDP growth, is where we are in terms of what we would not be able to realize without a strong, secure identity system. But that said, thinking about particularly now and what we see with the pandemic, is that the digital identity piece is, yes it has massive economic benefit potential, but the potential that it also has, that we perhaps had not predicted, was if you have these systems in place, the
massive move and shift, for example to work from home workforce, having a secure workforce and being able to continue those jobs while you can't go into an office. Or being able to get a new job or find a new workforce as a business owner during the situation that we're in.

Joni Brennan:
So we have much to lose in terms of kind of economic, as well as societal impact, by not solving these issues. And so it is imperative. Now on the opposite side of that, what we did see, there is a saying, "It takes ten years to make an overnight success." Well, one of the things that we did see in Canada was we did see a very rapid delivery of the CERB, of the benefit, the emergency relief benefit during COVID. And we saw that happen over the course of 48 hours. And part of why we saw that happen over the course of 48 hours with positive review, was that we do have strong collaboration between banks, between governments, between payment networks. So those pieces that we already had put in place with regard to identity, actually became very, very powerful when they were needed in the course of a 48 hour period as fundamental building blocks to deliver those benefits to people who needed them so badly.

Joni Brennan:
So we have a lot to lose, we have a lot to gain, and perhaps we have much more to lose by not pushing forward on this initiative.

Cyrielle Chiron:
Yes, I like how you give a concrete example on the economic potential, right? With the growth of GDP, but also, as you mentioned, just societal impact with what's happening right now. Like everybody's at home who goes somewhere, bring a piece of paper, right? To show who we are. So I think you're absolutely right. That's definitely going to bring opportunities for the country.

Cyrielle Chiron:
Ian, do you have clear examples that you can see actually in the business world, that how this can actually help businesses?

Ian Glazer:
Well I think going back to something I previously said, which is digital identity is a requirement for digital engagement. And that is just a ground truth, right? It's a fundamental. And so, although you may have, as a business, as an enterprise, you may have some form of web presence out there. If you want to truly serve the individual, you want to serve your customer, again, in any sector, in any geography, then you need real digital engagement. One of the mistakes that often enterprises have made in the past is that they have one online service and it's an island of identity information. They have a second service, and it's another island, separate from the first. And the problem is, that you can't actually serve that individual well, because you end up with a fragmented picture of your interactions with that individual.

Ian Glazer:
Now to get that holistic view requires you have a sort of substrate of identity capabilities in your enterprise. However, and this is keenly important, that when you have such a service, you also need to make sure that you can holistically and consistently respect the privacy wishes and the data use wishes of the individual. So that yes, you are building a more complete picture of your interactions with that individual online, whether it's through an app, through a browser, through a connected device, doesn't
matter. But that you are also then proactively engaging with the individual to learn what's the right way that person wants their data to be used, if at all?

Ian Glazer:
And this is not an optional thing. And it's not just, say, because of a post-GDPR world. This actually comes back to people make decisions based on trust. And brands. And all of us, individuals, organizations, governments, all have a brand. That selection, that trust assignment, comes through often repetitive interactions and the results of those interactions.

Ian Glazer:
And so if you get a great experience at what was your local grocer, who now has an online store and they deliver you really wonderful produce, and that happens time and time again, you're likely to go back and use that provider. And the same thing is true with the ancillary things around digital identity. So for example, you have an interaction with a provider online, and then all of the sudden, you get a ton of unsolicited emails from a bunch of their partners. That's a lousy experience. No one's going to go back to that. And so just having the ability to have a consistent picture of an individual in your digital engagement is good. But it's insufficient without the necessary privacy controls. And that's because you want to build a trusted relationship. Because from there, you can grow a high value relationship.

Ian Glazer:
And so you can't look at these things separately, as a business considers, all right, what is our digital transformation strategy? How are we going to engage with our customers online?

Cyrielle Chiron:
Yeah, I like the fact that you mentioned trust. That's really true, right? Trust is always at the heart of everything. And when you break that trust, it's very hard to build it back.

Cyrielle Chiron:
I'd like to stay with you, Ian, and I'd like to think about globally. And maybe to the best of your knowledge. But I'd like to understand if there is any country or countries that are leading the way with regards to digital ID. And if there are, what learnings can we get from them?

Ian Glazer:
So I think there's a variety of different kinds of examples of digital identity used in different sectors. Sometimes government sponsored. So one of the classic examples is the Estonian e-identity. Where Estonian citizens, and in fact digital citizens, can get a digital ID and use it for any number of things. Including signing a mortgage even.

Cyrielle Chiron:
Oh wow.

Ian Glazer:
Very powerful.

Cyrielle Chiron:
Yeah.

Ian Glazer:
Yeah, really cool. Works at a scale. And then you have examples in Nordic countries, for example, of bank IDs, that work within a consortia of countries and banks. And then you have examples like in Kenya, where you have really a payment driven network that is a form of digital identity that is everywhere. And works across all different form factors. It's really truly remarkable.

Ian Glazer:
And I think the interesting thing about all of them is, they grew up against the backdrop of a need.

Cyrielle Chiron:
Okay, yeah.

Ian Glazer:
Service to the customer, whether that customer is thought of as a citizen, if that customer is thought of as more of a financial transaction, customer more classically way. They've grown up because they've started to fill a need. And that's great. The other side of this, and this is something that I talked about just about two weeks ago. I was asked to give a keynote at the Identiverse event, and I was talking about the next ten years of identity. One of the things that I'm concerned about is the negative sides of this. Let me give you an example. Where it's likely that in the next decade we will see balkanization of the internet. And we will see actually separate internets for China, for Russia, and for the rest of the world. And that likely we will see non-inner-operable identity schemes being the boundaries of those internets.

Ian Glazer:
And this is an example of a digital identity scheme that's working against the global good. And is growing up for a very different purpose. And it's something that I'm concerned about, again, over a long period of time. But starting from the same root, which is, we are growing some digital identity scheme for a need. For a purpose. To fill service to the citizen need. Or serving the under-banked. Or serving a certain sector within the economy. That can grow up and be very powerful, as  we've seen in Europe, we see in Africa.

Ian Glazer: 
But it can also grow up in a negative way, and it can become a barrier to operability. A way to surveil a population. And so, just because there's an identity scheme that has grown up, it doesn't necessarily make it A, effective or useful, or B, something that is serving the global good.

Cyrielle Chiron:
Right. Well thank you for that. In all of those countries, is this managed by the governments? Or is it managed by private entities? Because there are big questions, right? And who has to manage this and how this is going to work.

Ian Glazer:
So, in those examples, some is public sector managed. Some is private sector managed.

Cyrielle Chiron:
Okay.

Ian Glazer:
Here in the States, we have taken a run in the past of doing a public private sector initiative. Didn't meet with as much success as we maybe had hoped.

Cyrielle Chiron:
Okay.

Ian Glazer:
Trying again with a public sector led thing.

Cyrielle Chiron:
Okay.

Ian Glazer:
But I think there is different reasons why different sectors actually go down these endeavors. They all, however, share a similar success criteria, which is, if the individual, who possesses one of these identities, can get real meaningful services using it. And if the answer is yes, then is it at only one service provider? So for example, with this digital identity, can I only get services with my local municipality, or can I get it province-wide, or can I get it at the national level, or can I get it even using it in a private
sector, in addition to public sector? That's one answer.

Cyrielle Chiron:
Yeah.

Ian Glazer:
The other is, well, it only really works in this narrow silo. One of those is going to have a lot more success, and naturally so. Where can you use it, and can you get real, meaningful benefit for you? Is the key make or break, if you will, no matter whether it's a public sector, or private sector led initiative.

Cyrielle Chiron:
That's actually a very good point. Actually building on that, Joni, I'd like to think about Canada. I think you had a survey in October last year that found that 70 percent of Canadians, right? Strongly wanted to see the governments and the private sectors to come together and collaborate, to create a joined framework, digital ID frameworks in Canada. In your opinion, who actually do you think should lead this, private or government? And if we are government, bringing up what Ian was talking about, are we talking about federal, provincial? Who do you think should be managing digital ID in Canada?

Joni Brennan:
Yeah, so, what we saw in our survey, as you noted, was that yes, 70 percent of Canadians who were asked coast to coast to coast did strongly want to see the public and the private sectors work together. So we feel that that is reinforcement to the direction that we've already been taking in Canada, which is a public private partnership.

Joni Brennan:
I think also for the pay pod audience, if I go back to the long, long, long ago, around 2012. During the global financial crash that took place 2008, 2009, the Minister of Finance put together an electronic payments task force to look at the payment system specifically. And over the course of the years of that task force, and in 2012, that task force put out a report that said that the payment system, to be robust and secure in the context of the crashes that were happening around the world, needed a digital
identity and authentication framework. And that report also said that that framework has to be developed in a self-governing body, where public and private sector can come and sit together at the same table to put this framework together.

Joni Brennan:
And so that was really the seed, if you will, for the creation of DIACC. Where the public sector and private sector could come to the same table. Now, one of the features with regard to Canada, is that we're just diverse enough to be interesting, although not so diverse that it's insurmountable. And so if you think about in the United States, you know, you have 50 governments, with state CIOs that are constantly turning over, plus the federal government, plus the economy. Well, in Canada, our numbers are much more manageable. So you know, we have 13 provinces and territories, and then the federal government being the fourteenth. Plus the economy.

Joni Brennan:
So the numbers work a bit better for us in terms of bringing this collaborative together with enough diversity but not too much. And so that feature alone is something that helps Canadians, I would say, kind of get behind this idea that the public and the private sectors need to work together.

Joni Brennan:
I think another feature in that public private view of how things work could also go back to some of the talk that Ian was, some of the points that Ian was sharing, with regard to the nuances between consumer identity versus enterprise identity. And so if you think about this holistic view for identity, we, you, I, I am the constant. I am the one constant here, right? And so I may have different kinds of priorities around different transactions that I have with governments, or transactions that I have with
banks, or transactions that I have with commerce sites, at the same time, or with my employer. But I am the constant.

Joni Brennan:
And so that all kind of moves around me. And so if we think about kind of where governments can and should lead, what we can think about is, where they do lead today. Which is underwriting trust in the economy, underwriting trust in society. And so if we think about going to restaurants. Well, there's some sort of inspection scheme that happens. That business was incorporated. So if we think about those little pieces of paper that are trust, that are issued by government. That maybe they say that I can drive or something like that.

Joni Brennan:
What government's role can and should be is to issue data that can and should be trusted and should be verifiable, that can be used in a way that I use it, wherein how I would like to, and then it doesn't constantly go back. That data isn't constantly going back and paying the government and saying, well Joni went to the liquor store today and bought some wine, and then she went and bought some tacos. We certainly don't need all of these transactions to be going back to the issuers. But there are kind of elements of the way that we work today. And what governments can do should be underwriting verifiable data for trust that can be accepted in the economy.

Joni Brennan:
Let's say for example, a digital driver's license, or a digital driving credential. That could be accepted as a piece of evidence to do your KYCAML with your bank.

Joni Brennan:
Now the other side of that equation is that I actually perform many more transactions with my bank and with our payment network than I do with the provincial or federal government. So there is an ecosystem of data verifiers and data providers. And so for reliability on the day to day actions and day to day data, it might be your bank or the payment network that kind of sees something suspicious or sees something happening that perhaps raises a flag, that maybe we have to do a little bit more security on a
transaction? So those are piece that the economy are much more positioned to offer into the center or this public private collaborative. So we strongly believe that the public private collaborative is the way forward, and that is I would say unique about the path that we're taking in Canada. And we have seen other regions around the world to a degree, around New Zealand and Australia, on a similar path let's say. But that is that cooperation and that collaboration is something for the economic societal good is something uniquely Canadian, I would say.

Cyrielle Chiron:
Having this working is great, but having to make sure, as both of you mentioned before, making sure that you don't break the trust. And we're making sure that everything is secure and my data is private. It's very important. Security and privacy are always the two key topics that's coming over and over.

Cyrielle Chiron:
And I'd like to explore that a little bit further. Both of you talked about it already, but more around the data. Because they're collecting, the system let's say, is collecting data. And if it's going out in the wild, it can do a lot of damage, right? So we don't want that. So how do you make it secure? And, first of all even ... how do you make it secure, that's one. But also, it seems that digital ID is more secure than doing the usual methods, right? So how can we make sure that this is definitely safe and secure? And where do we think the data should be stored and who owns it? That would be kind of key question I would have right now.

Cyrielle Chiron:
But mainly, who is responsible if something happens, and accountable if something happens? So can we start with you, Ian, to try to see if we can explore this area of security and privacy and data ownership and management?

Ian Glazer:
We can certainly take a try at it. There's a lot there to work on. So, first observation is that there isn't a state of secure versus insecure. It is a spectrum.

Cyrielle Chiron:
Okay.

Ian Glazer:
And so the practices that organizations, public or private sector, put in place, lead to better outcomes. Which means that it is harder for an adversary to get information to break the system to subvert the system. So there isn't some magical Nirvana state. There's only a series of stacking blocks of better practices that lead to good outcomes.

Ian Glazer:
And that's true not just from a keeping the data, wherever it may be housed, secret. But also using it within the constraints that the individual wishes, right? So just as there isn't a Nirvana state of security, there also isn't one for private, per se. It is the practices that the network and the organizations that are connected put into practice to respect the wishes of the individual.

Ian Glazer:
One should ... personal opinion. And Joni and I have gone around on this a couple times. The question of owning the data, and I'm quite literally sitting in my office making air quotes, is fraught with peril. Because it, first off, reduces digital representations of humans to property. That's a bad place to start a conversation. It obscures actually some of the responsibilities that we should be looking at. And in fact, your third question got to that, which is, who is responsible and accountable if something goes wrong? The clarification that is needed is, goes wrong how and where?

Ian Glazer:
Because there isn't a simple one interaction, right? There isn't one point, one magical moment, when digital identity is used. It's actually a continuum, because you have a relationship over time with the service provider. And so, things could go wrong at that initial introduction, where you are introducing yourself as your digital identity to the service. Something can go wrong in the fulfillment of you getting that service. Something can go wrong subsequently in the storage and management of the information about that interaction. So we've got to be a little bit more specific about where things can happen. One of the biggest concerns that I have is actually around the ceremony of introducing oneself to that service.

Ian Glazer:
Let me explain. Today online, most people are fairly comfortable with going to a screen that has two fields that they can enter an email address and a password. And that's a ceremony of introducing yourself to a service. That, by no means, is the crowning pinnacle achievement in usability. Let's be perfectly honest about that. We can do a lot better. We can make that introduction moment, that ceremony, more secure. I.e. harder for an adversary to subvert. We can make that ceremony easier for people of all ages and abilities to participate in. And what gets lost, often, in a conversation that just talks about security or just talks about privacy is that riding along and equally important is usability.

Ian Glazer:
And I think usability is actually one of these unique places where government has a larger role to play. Both around describing what makes a ... what is the minimum bar. As in, what do we expect usability to be as a minimum standard of interaction? But also holding service providers accountable to this new usability for a new kind of ceremony. Because we are going to suddenly change this. Sorry, not suddenly. We're going to change this, it will take time. And to the individual who goes to the service provider, it's going to feel very different, and it's going to feel very different very fast.

Ian Glazer:
And so how can we help guide people to new, more secure, privacy respecting ceremonies to introduce themselves to service providers? To me, that's one of the fascinating places, especially where government has a hand to play.

Cyrielle Chiron:
I love the way you describe the ceremony of introducing. I think it's exactly like that. I like the analogy. It makes it a bit clearer for me. Yes, sorry, I have so many questions. This topic is so interesting. And the topic around data is always coming up, right? Because we keep saying we're collecting the data, we're collecting the data, so making sure you know privacy and security is at the center. It's very important. But I like the way you answered it.

Cyrielle Chiron:
I'd like to move back with you, Joni. And I think I read in a recent DIACC study that 54 percent of Canadians are still unfamiliar. And you were mentioning it earlier. Unfamiliar with the concept of digital ID. I'd like to understand about education. Because as you said, both, earlier, we can collect the data, but if you cannot use it, and if only half of the population is aware of it, it's not going to work, right?

Cyrielle Chiron:
So how do we educate the ecosystem on the importance of digital ID? And how but also who has to educate the ecosystem?

Joni Brennan:
Yeah, I think this is an important question about educating people about digital identity and about data, and about all of these features that we've been talking about. I would say that even looking at the study that you've been referencing, one of the things that we wanted to be sure to do as DIACC was to actually go out and ask people what they think or know about digital identity. Because you know, we are a digital identity initiative. So we didn't want to make assumptions. We wanted to have a baseline to understand what Canadians are thinking. So that's valuable information.

Joni Brennan:
And so we were surprised by some responses and not surprised by others. And even there were differences in perception between British Columbia and Quebec. Or Newfoundland. And so there were even some regional perceptual differences with regard to digital identity and data and what it is. So that's fascinating unto itself.

Joni Brennan:
Now in DIACC, in our last five year strategy, we had agreed that we would focus on educating decision makers. So CIO's, journalists, members of Parliament, those people who are charged with making decisions about systems, where digital identity would come into play at scale. So that's the place we wanted to focus our education on. And in the work that we've been doing, we've been collecting a number of liaisons who happen to be from universities. And something that came out in our university liaisons was that there was an interest in creating a shared curriculum with regard to digital identity and what it is.

Joni Brennan:
And so what we were finding is that businesses are not able to find the workforce with regard to digital identity, who have a set of requisite skills to a particular standard to understand from an identity professional's perspective.

Joni Brennan:
So maybe you can see where this is going, but this is a point where we reached out also to the ID professionals, the IDPros organization to say, well okay, we really don't know how to create a curriculum, but our liaisons are asking us to help, help, help. Help organize an effort around that. And ID professionals are a great place to kind of validate is this curriculum meeting the demands that we're seeing out in the economy or by employers with regard to the kinds of skills that they need. So we have started around this education at the academia level with regard to a professional, what an identity professional should know, and how that maps back into jobs.

Joni Brennan:
But yet, there's an even bigger piece, which is, what people know and what people understand. And so if we're asking them to perform these ceremonies and move through these ceremonies, there does need to be kind of a baseline of knowledge about these kinds of systems, what the risks may be, what the benefits may be, to provide them with kind of a digital first, digital native educational scheme.

Joni Brennan:
And so one of the things that I've been undertaking recently with the DIACC is simply asking, which organizations are performing that kind of average person education? And what does that education look like? Because it may be very different for one population. Let's say someone like myself, an immigrant to Canada living in British Columbia, that kind of education may be very different for somebody who is First Nations, and has a different kind of culture and different kinds of perceptions or experiences in the world. And so we have to think about how do we education en masse, which I think is a massive initiative that I think has to pull in public and private sector together. And then we have to think about how does that education tailored for different cultures, different populations, who may have kind of different perceptions or realities with regard to data.

Joni Brennan:
Back to that word of trust. Who do they trust or who don't they trust? And so I think that education scheme has to be tailored for trust of the recipient of such education, so that we have a much better educated audience. So I think this is a massive piece of work that we all have an opportunity to at least play some part in, to make sure that Canada and Canadians have the right tools to be able to make decisions. Will they make perfect decisions always? No. But that they'll be able to make better decisions. More informed decisions.

Cyrielle Chiron:
Yeah, and I hear you talking also, makes me think about the generations. Right? About the older generations that may be completely lost. We see that in payments when we move from analog payments to digital payments. How do we bring them along the journey? So I can see how this can be a massive piece of work, definitely.

Cyrielle Chiron:
Talking about payments, I'd like to actually specifically speak about payments and link this concept of digital ID to payments overall. So today, as I said, we are in a world where payments is just really evolving really fast, and almost everything now is done electronically.

Cyrielle Chiron:
So I'd like to stay with you, Joni, and can you tell us a little bit, like how do you see the role of digital ID in payments?

Joni Brennan:
Yeah. I think it's an important question. And as part of we've been going through this conversation, one of the things that I've been thinking about is that identity and payments are not synonymous, but they certainly do have quite a bit in common, and they certainly do have a reliance on each other. So that foundation of in order to make a payment, you have to be able to identify the business that you've be making that payment to, reliably.

Joni Brennan:
And in order to issue an invoice, or whether that's making a payment to me as a citizen or beneficiary, or whether that's asking me for an invoice to make a payment, there is an identity transaction that is foundational and intrinsic to payments. So they are very, very related. And they do depend on each other and kind of getting one right helps the other.

Joni Brennan:
With regard to kind of what we're seeing as well around the financial systems, I think you had a previous question where we were talking about what if something goes wrong, and what about accountability? While identity and payments are not synonymous, they do have much in common. And so I actually do feel at least some sense of relief that there are patterns and structures from a legal perspective that are in place with regard to payments. So I think that we can look to the financial system, the payment system, as places where we actually do see a very specific use case that it has been moved forward on.

Joni Brennan:
And some of that, for example, you know, we could see a tie there together, with regard to the FATF, the Financial Action Task Force. From an international body, who is looking at finances, know your customer, anti money laundering, payments. One of the changes that they made recently was to move language from providing original proof of identification to providing authentic proof of identification. And so just that word of original to authentic, actually opened up a much wider array of the kinds of things that we can do.

Joni Brennan:
And so identity and payments are very related to each other, they're not one to one synonymous, but we definitely move together and learn together in that overlap of the then, and how we're evolving these ecosystems. And so strong digital identity helps make payments more reliable, and a strong payment system helps identity to become more useful, more utility around it to perform more transactions. So.

Cyrielle Chiron:
I really like the fact that you said digital identity and payments are not the same but work together, complimentary together. Because as you may know, and I would like the audience of The Paypod to know, Canada is in the process of modernizing its payment system. So, actually now is the time to talk about digital ID.

Cyrielle Chiron:
And I'd like to ask you, Ian, trying for us Canadians to understand, what do we need to take into consideration to implement digital ID in the process? And what learnings payments organization, do you think, can learn from other sectors. I know you talked about it a little bit earlier. But is there something you could give some tips for those payments organizations today?

Ian Glazer:
I think there's a few things to consider. One is that, especially in payment, but this is true in other regulated industries. Going it alone, going it by yourself, is not a good strategy, right? We should be looking to whole sectors for participating in a digital economy, and hoping for a digital transformation. As opposed to individual players.

Ian Glazer:
Obviously, individual organizations will take the lead in some ways. But it really does have to be a sectoral led effort. And the reason why is that we need common standards around acceptable behavior, around normalizing ceremonies, around having standard agreements. Things like trust frameworks about what is acceptable in this realm, using digital identity.

Ian Glazer:
And so I would look not only to finance sector and payments, but also healthcare, is two examples where there is fertile ground for sectoral action, to help set real standards. I think government is another place. And looking at successes that government led programs have had, or not, right? Also looking at where things have not gone as well, is important.

Ian Glazer:
Then lastly, the thing that I would stress organizations think about is, that you're going to be the custodian of a great deal of information. Not just digital identity. But information about how that identity is related to some sets of transactions. And that you may be deeply, strongly tempted to use that information in a variety of ways. But you have got to bring back in your head central the individual who this all started with. And that you've got to make sure that not only you as a system, as someone
who is designing a system, but the system themselves, consider the individual and their wishes.

Cyrielle Chiron:
Guys, this is great. I have so many more questions. You are so knowledgeable. I can keep asking you questions for hours. But I think I'd like to ask you, you know, one last question. And it's a quick one just to conclude. Because I think that was a really great discussion. I actually learned a lot from you. But to both of you quickly, how quickly do you think we can expect digital ID frameworks to be implemented in Canada? Like when is going to be the time where everything is going to be there, and I would be able just to have everything recorded and be able to go to service Canada without having to bring my original invoices or something to prove who I am?

Joni Brennan:
So in terms of how quickly do we expect digital identity as a framework to be implemented in payments across Canada, I would say that we are 100 percent on that journey. The work that we're doing in the DIACC to deliver the pan Canadian trust framework, which is focused on that intersection of public and private utility, with the citizen consumer at the center of that design, the minimum viable product version one of the pan Canadian trust framework is ready to be available this summer, and we're going to start alpha testing it. That's moving along and in alignment with the payments Canada modernization and payments Canada are strong partners in the work that we're doing for the pan Canadian trust framework as well.

Joni Brennan:
I think that we have also seen just how quickly organizations and institutions can move with the right motivation and with the right political will. And so I think the pandemic and COVID are definitely going to drive some of this work to move faster and particularly as we move into the fall. So we're looking at what can we accomplish and move faster for the fall and winter or 2020, 2021.

Joni Brennan:
So we are seeing already pieces of this get put into place. I do think there is some time. The identity ecosystem and along identity and payments and service delivery, this is a space that continues to evolve over time. So I don't think we're ever kind of necessarily done with the work that we're doing. Maybe if we reach kurzweil singularity then we will be done. But we're not done yet. So we'll have evolution to make. But I do believe that we are on the bubble here of the next wave of how we will work and interact with technology for payments, for government transactions, for health transactions. And I think we're going to see much more progress over the next 12 months that is visible and concrete, and is participatory of governments and the private sector, and ideally, most importantly, that people are the
beneficiaries of this work.

Cyrielle Chiron:
What about you, Ian?

Ian Glazer:
I think from my perspective, what I would say is that I am very much encouraged of the other side of this, which is the common access to technologies that would facilitate the kinds of ceremonies that we want to move towards. And I think we're going to see that those kinds of technologies will be more ubiquitous in the next two to three years, which means that bleeding edge organizations can start now. That we'll see that continuing wave of ubiquitous technology over those next three years. And that we can start to see sort of mainstream, common, next generation if you will, ceremony, the middle of the decade.

Ian Glazer:
So I'm really excited for 2025, because I think we're going to see that commonality, or that ubiquitous capability, that will really facilitate those ceremonies and the digital ID world that we all want to see.

Cyrielle Chiron:
I'm excited too, actually. And as I say, I have so many more questions. I think I have to stop at some point. I really thank you for your expertise. This was really brilliant, guys. I really appreciate our conversation today.

Joni Brennan:
Thank you so much for having us. It's a great conversation.

Ian Glazer:
Thanks. It was a blast.

Cyrielle Chiron:
As we know very well, security and payments go hand in hand. It's up to all payments organizations to
continue educating themselves on making this integration as strong as possible. While also educating
Canadians on how advancements in digital ID can make the daily transactions easier and safer.

Cyrielle Chiron:
Digital ID is a concept that will only get more important as the payments industry advances, and organizations like the DIACC and IDPro are playing a crucial role here. Advancing Canada's digital identification methods within payments will not only protect those making the transaction, it will keep Canada competitive and sharp within the global payments industry.

Cyrielle Chiron:
I'd like to once again thank both Joni Brennan and Ian Glazer for speaking with us today. As always, The PayPod, is available for download on your favourite podcast app, or payments.ca. Join the conversation online using hashtag modern payments, and stay tuned as we continue to explore the changing world of payments.

Cyrielle Chiron:
That's all for today. See you next time.