Inclusive identity: are we doing enough? With Tricerion, Women in Identity and FinClusive – Podcast episode 67

Podcast: Play in new window | Download

Subscribe: Apple Podcasts | Spotify | Pandora | Email | TuneIn | Deezer | RSS | More

Let’s talk about digital identity with Schehrezade Davidson, CEO of Tricerion, Sarah Walton, Code of Conduct Programme Manager at Women in Identity, and Amit Sharma, Founder and CEO at FinClusive.

Episode 67 explores inclusive identity. Making identity solutions inclusive for everyone wanting (or needing) to use them is a topic that’s coming more and more to the forefront of the identity industry. From logging into apps, to accessing essential services; to how barriers to organisation identity is impacting individuals – in this episode, we speak to three guests from the identity industry on what they’re doing to help solve these issues.

[Transcript below]

Schehrezade Davidson is the CEO of Tricerion Limited, a company that owns novel patented mutual authentication software using image passwords. Find Schehrezade on LinkedIn. Find out more about Tricerion at tricerion.com. Schehrezade has appeared on the podcast twice before, talking about: neurographic passwords (episode 26) and immunity passports (episode 41).

“If the onus is on the individual to authenticate themselves, those in the industry need to make it truly inclusive with alternative ways, depending on a customer’s needs.”

Dr Sarah Walton is a digital consultant, author, coach and public speaker. She founded Counterpoint in 2003 to support organisations become digital, innovate and grow. Most recently she led the UK Open Finance programme and is Women in Identity’s ID Code of Conduct Programme Manager, as well as being commissioned by the Open Identity Exchange to author ID Inclusion reports. Find Sarah on Twitter @sarahlwalton and on LinkedIn. Find out more about Women in Identity at www.womeninidentity.org.

“This is very much something that is very commercially important but it’s also extremely important to people’s lives and livelihoods on an individual basis.”

Amit Sharma has engaged in a myriad of roles that intersect financial markets, risk management, regulatory compliance, and international development. He is the Founder and CEO of FinClusive, a hybrid FinTech and RegTech company dedicated to financial inclusion. Connect with Amit on Twitter @ASharma_VT and on LinkedIn. Find out more about FinClusive at finclusive.com. Amit has featured on the podcast before, discussing the role of identity in financial inclusion (episode 51).

“From a macroeconomic perspective, it’s important to note that identity challenges are often seen as just at the individual level, but these at the institutional or entity level are equally important.”

We’ll be continuing this conversation on Twitter using #LTADI – join us @ubisecure!

­Go to our YouTube to watch the video transcript for this episode.

 

Podcast transcript

Welcome to the Let’s Talk About Digital Identity podcast. I’m Francesca Hobson and I’ll be guest hosting this episode of the podcast all around inclusive identity.

Francesca: When I say I work in Identity, my friends and family usually don’t know what I’m talking about. To explain, I’ll often give the example of signing up to an app and logging in – which really doesn’t begin to cover the myriad of use cases that identity enables (some of which we’ve explored on this podcast), but it’s such a common experience that it’s often the easiest for them to relate to. They’re touching our industry several times a day, many of them without really thinking of Identity as the key to so many processes.

Of course, that’s not the case for everyone. Some people, often the more vulnerable in society, are only too aware of how important identity is to accessing and using services. Security is clearly high priority for service providers when it comes to identity, as is regulatory compliance. But when these aspects aren’t correctly balanced with user experience – or when users with varying abilities, technical proficiency, or access to resources are not fully catered for – there is a very real risk that the intended users will be excluded from, or have trouble, using the service, bringing all kinds of implications from ethical to economic.

Making identity solutions inclusive for everyone wanting (or needing) to use them is a topic that’s coming more and more to the forefront of our industry. From that almost-universal use case of logging into apps; to what happens when people are prevented from accessing essential services; to how barriers to organisation identity is impacting individuals – in this episode, we speak to three guests from the identity industry on what they’re doing to help solve these issues.

One of the clearest areas of digital identity where we see the impact of not doing enough to include vulnerable people is authentication – the point where a user must verify their identity in order to gain access to a service. Many services still require authentication via a password – though many others are now opening up options for authentication via biometrics, identity providers, real-time document proofing, and so on.

To explore this topic further, our regular podcast host –Oscar Santolalla – spoke to Schehrezade Davidson – the CEO of Tricerion, which provides strong authentication with picture-based passwords.

Oscar: How do current authentication methods, especially but not exclusively username/password, are impacting inclusion?

Schehrezade: Inclusion is a very wide term as we know, Oscar, and one of the key issues post-pandemic is an increase of use of digital across the board. That’s obvious to a lot of people. But what isn’t so obvious is this whole concept of digital divide and how that impacts inclusion. So if you are not sophisticated in using online services, and maybe because you’re too young or you’re too old, that is excluding people from accessing services.

In addition, it is true that there’s a whole cohort of people that find the simple alphanumeric passwords very challenging, maybe they have learning difficulties or maybe they don’t but they have something like dyslexia. That’s not a learning difficulty. That’s just difficulty maybe typing in numbers and letters. But if that’s the way the corporate entity forces you to authenticate then there’s an issue. Similarly, I think sometimes biometrics and fingerprints are things that people don’t necessarily want to use as well in terms of, where is my data stored, who gets access to it.

So I think corporate entities need to think wider than just what looks simple might be complex for some people, and that’s why I think it’s important to bring in experts on user interface and actually usage by consumers or people using services online to get an idea of the wider impacts of this race to digital.

There needs to be a wider review by corporates and governments on how people of all abilities manage to access digital services. And it is true that one size doesn’t fit all and corporates need to be quite flexible in the alternative ways that they offer authentication.

And I think we talked about this – where if the onus is on the individual to authenticate themselves, those in the industry need to make it truly inclusive with alternative ways, depending on a customer’s needs.

Oscar: Exactly. And what are these alternatives? What are the available alternatives for those providers who have decided to be more inclusive? And you can tell us what is Tricerion’s role in this.

Schehrezade: Yeah. So our solution at Tricerion is an image-based password where it’s very simple, and we like to say you can use it whether you are from age 2 to age 100 because it’s based on images. And your brain is wired to remember a series of images or pictures much better than a long string of letters and numbers. So you have the keypad you recognise that’s delivered to you at each authentication occurrence. The images jumble around on the keypad but your password stays the same. So simple, easy, visual.

And of course, we will acknowledge that not everybody can use a visual password but I think this is where it comes back to the first point is giving individuals choices on how they authenticate and allowing them to choose something that works for them. And that’s a different way of thinking for corporates actually because they do want to force all of their customers to use the same methodology because it’s cheaper for them and easier.

But I think it is really beholden on all of us who work in the industry to push hard for alternative authentication methods because then digital truly becomes an inclusive secure environment where people aren’t nervous about going online. And that has got to be a good thing all around, right?

Oscar: Yeah, absolutely.

Francesca: Thank you to Schehrezade for filling us in on the impact of exclusion in the online service authentication process.

So what about national-level IDs, such as physical documents, which are now often used for both virtual and in-person identity verification? What happens when people are prevented from accessing essential services, such as Banking, because of a lack of perceived sufficient identity documentation?

One organisation carrying out important research in this area is Women in Identity – a not-for-profit organisation making practical steps towards an identity industry that is “built for all, by all”. To fill us in on its latest research on this topic, Oscar spoke to Sarah Walton, who’s managing Women in Identity’s innovative Code of Conduct programme.

Oscar: Hi, Sarah. Could you tell us what is the impact of identity exclusion?

Sarah: Yes, certainly. There’s a number of really quite detrimental impacts both to end-users to organisations who are involved in the identity ecosystem, so that would include reliant parties and also it would include identity providers.

But in terms of the impact to end-users, it can mean sometimes that they can’t find work, they can’t find somewhere to live because they can’t prove their identity and so they can’t support their request in their application for a bank account for example, which would then enable them to find somewhere to rent. So end-users end up sometimes having to compromise their integrity and to lie in order to find ways around quite a rigid system, and the system doesn’t have to be that rigid.

So we interviewed a number of end-users in our Human Impact of ID Exclusion Report. And we found that there were similarities both in more developed economies and emerging markets. We took Ghana and the UK as representative of one of each of those types of economy. And we found that there were definitely similarities to the quite horrendous experiences that end-users have and how it limits their engagement in society. But also, very importantly, this is something that makes people outsiders within society that they don’t belong, and so there’s an emotional aspect and impact to that for real people in their lives too.

And very quickly I’ll just add that that’s the human impact, the emotional impact, the impact on individual people’s lives and livelihood, and children suffer because if parents can’t make money then children sometimes can’t get fed. So it’s really very serious.

But from a global perspective, from a national perspective, from economic and commercial perspective, the McKinsey report has recently suggested that between 3 and 13% of gross domestic product, so the income to a country could be increased by 3-13%, probably 3% for more developed economies and 13% more towards that end of the spectrum for emerging economies. So in terms of income into a country, which is beneficial for everyone involved in every type of organisation and individuals, if we included a more inclusive in our identity service creation then we would all be richer essentially.

So this is very much something that is very commercially important but it’s also extremely important to people’s lives and livelihoods on an individual basis.

Oscar: Yeah, absolutely. I see that everybody benefits with more inclusion.

Sarah: Absolutely, yes.

Oscar: So I think one of the products of the project that you just mentioned is the Women in Identity’s Code of Conduct. So could you tell us more about this and how it aims to support identity inclusion?

Sarah: Absolutely. There are a number of phases to this piece of work. It’s an international code of conduct for the identity industry and I would stress that it’s international and we have very much a fragmented approach at the moment in different regions but also, within those regions, irrelevant of whether it’s a government–owned or a government-assured or private identity system.

So the ID Code of Conduct work is aiming to create a set of guiding principles that will ensure that all users of identity systems have a consistent and high quality end-user experience because what we found in our first phase, which is the human impact of ID exclusion that I just mentioned, is that users – irrelevant of what type of economy they come from – have a lack of knowledge of how the process works. So if we could at least make this consistent then people will have a certain set of expectations and then they can learn one approach and then know that approach will apply wherever, whatever products or services they are accessing. And also, that there are alternative ways for those people to access those services. And the work that we’ve done so far, it has emerged that there are 5 key principles that will be foundational to the creation of an ID Code of Conduct.

So the first one, it’s pretty obvious to any product design, designer, and design team, but very important that the user is at the centre of the ID ecosystem, and there are many ID ecosystems. So, we always need to come back to this user-centric approach.

Secondly, that social norms are changing. So we need to acknowledge that one size doesn’t fit all and we need to move towards proportionality so vouching, tiered KYC, e-KYC and drawing on other forms of government data – so other datasets may help reduce the burden of identity for the user. And it’s essential to build diversity into ID for the reasons that I mentioned earlier because it has a commercial and a human impact benefit.

And also, the identification may be individual but that we live in networks of people that already know us, so we need to account better for delegated authorities and intermediaries so we can leverage those networks effectively. So what we will be aiming to do is take these key principles and then develop probably about 5-10 principles that will be useful for ID creation teams, ID development teams.

We also have another piece of work called the Implementation Framework and that will be a way of helping, the kind of how-to guide to look at how these Code of Conduct principles can be applied in practice in a practical setting via an ID team. And we will create a fictional ID product or service to show at each phase of the design and development process, in an agile process of development, how these principles would be applied coherently and in a practical way within the ID development team.

And our sponsors who I’ll just mention and with a big thank you, GBG Group, Mastercard, RBC, and Omidyar Network are sponsors for the human impact work, some of whom will be coming with us on the journey and new sponsors are joining all the time. We will also be using some of our sponsors’ products and services to demonstrate how they provide in practice this ID Code of Conduct set of principles in order to create an easy to use, accessible ID service as an end product for the user.

And I would just also like to say Oscar if I can that we are looking for new sponsors as well. More sponsors are coming on board all the time, but please do contact us because we are in the process of raising the funds for those last two elements that I mentioned, the ID Code of Conduct principles and the implementation framework and we’d very much like some new sponsors to come and join us – not just in terms of funding but also with their knowledge from their ID teams because the more widely we go with this, the more diversity we have in our development process for the ID Code of Conduct, the more relevant it’s going to be and useful it’s going to be for organisations and standards bodies and government entities around the world. All of whom are extremely interested and see this as a very useful potentially alternative solution if we can get adoption to the creation of legislation, because legislation is expensive and some organisations have been very keen to look at this piece of work in more of a standards-type frame, as a potential alternative in some countries to legislation potentially.

So it’s being taken very seriously by lots of different types of organisations but we are looking for more sponsorship – please do get in contact.

Oscar: Absolutely. Thank you very much, Dr. Sarah Walton for sharing your insights.

Sarah: You’re very welcome. It’s great to be with you. Thank you.

Francesca: Great insights there from Sarah on the impact of identity exclusion, and how service providers can mitigate against these critical issues.

The issue of individuals being excluded from identity systems is key to the future of many industries, such as financial services. But what about organisations? Organisation identity is a lesser-focused on aspect of identity inclusion, yet how organisations identify other organisations (for example, in transactions between financial institutions and maintaining trade relations) is also a critical factor in whether access, or a specific process, is authorised – thereby impacting the individuals that rely on a successful B2B identity verification.

To investigate this area, I spoke to Amit Sharma, Founder and CEO of FinClusive – a hybrid FinTech and RegTech company dedicated to financial inclusion.

Thanks Amit for joining us, for the second time, on the Let’s Talk About Digital Identity podcast. So let’s dive right in. How can inadequate organisation identity systems exclude organisations—and individuals— unintentionally?

Amit: So in the financial services domain, there are obligations by financial services providers to do the requisite Know Your Customer or Know Your Business due diligence. And so when an organisation has run through that due diligence, by rule, one has to not only test the validity and verify the authenticity of the organisation but they also have to cover what’s called beneficial ownership coverage. So individuals that may have an equity or ownership stake or other, what we call ‘control persons’ that control, say fiduciary or economic activities of that organisation.

And if there are not adequate identity systems to verify and validate either the organisation or their beneficial owners, they get rejected by financial services organisations. And this can happen in a number of ways. Corporate enterprises, they may be large and very easy from a legitimacy perspective but because of how large they can be and their ownership structures, the complexity of their org structures can vary globally, it’s hard to actually do the beneficial ownership and controlled person verification because those org structures are pretty complex.

But also small businesses, small businesses are very challenged because often there’s very little information on the backgrounds of those small businesses that are often start-ups, etc. They are not available in mainstream databases and corporate registries. And so, ensuring that the organisation’s identity can be verified and validated can be very difficult if they’re a small start-up with a registration in a local town but don’t have a state, province, municipality, or federal registration.

And then non-profits are a great example too, critical for global humanitarian and development needs. But many are seen by financial services operators as operating without adequate documentation. And these all come back to organisational identity systems failing many of these organisations‘ ability to access basic financial services.

So, it’s quite a complex challenge. It’s very solvable but these are some of the issues that we see.

Francesca: This is really a lesser talked about aspect of identity and how it impacts inclusion. And as an industry, we do need to be more proactive on solving the kinds of things that you’ve spoken about. So, how can we do that? How is FinClusive supporting organisation identity in order to enable better financial inclusion?

Amit: Well, we have the tools now to be able to assign digital credentials or verifiable credentials for individuals and entities – and entities of all types, from small businesses and micro businesses to non-profits to global corporate, and any other kind of legal entity out there. And so what we do at FinClusive in partnership with organisations like the Global Legal Entity Identifier Foundation is to be able to run the associated compliance checks, the background due diligence of the validity of the organisation itself and the beneficial owners associated with it.

And with those full compliance checks, we are able to issue a credential that other business entities, other financial services organisations can be sure that the organisation is not only a legitimate registered organisation with a legitimate set of activities but also the individuals associated with that organisation have been equally checked. And by providing that, you create a veil of legitimacy associated with that organisation’s set of activities. So its business counterparts, its financial services providers can all understand and verify and validate in an efficient and cheap way the validity of that organisation. And that’s hugely important.

Now, from a macroeconomic perspective, it’s important to note that identity challenges are often seen as just at the individual level, but these at the institutional or entity level are equally important. And they are important I’ll say by many standards, but one really stands out, that the global job creation space is small businesses. So we have to be able to ensure the validity of small businesses worldwide so that they can access capital to start and grow their businesses so they can interact with other organisations financially and economically. So this is a huge challenge. And when 90 plus percent of job creation and business growth is small businesses, this makes this very important.

Francesca: Thanks to Amit for that summary of the many issues and implications around organisation identity and financial inclusion.

So there we have it – three perspectives on the state of identity inclusion as it is today, and how they’re personally taking strides towards making identity solutions more inclusive. Thank you so much to Schehrezade Davidson, Sarah Walton and Amit Sharma, for sharing your expertise with us. To find out more about this episode’s guests, and links to their work – take a look at the show notes.

This topic isn’t going away any time soon. These challenges and solutions that are facing the identity industry aren’t simple. The more we raise awareness of these issues, the more initiatives and innovation we work towards, and share as a community, the faster we can build more inclusive identity systems – that work for everyone. We hope to provide one of those awareness platforms on the Let’s Talk About Digital Identity podcast – so make sure you subscribe. Until next time.

[End of transcript]