The global response to covid-19 has sparked intense debate about the balance between protection and privacy. Should privacy be sacrificed in order to slow transmission of the virus? If so, how much intrusion is acceptable and how should we best design digital systems that combat the virus? Immunity passports in particular raise significant privacy concerns.
Imagine being over 50 and trying to renew, sign up for or extend your life or medical insurance. The call centre operator asks you to provide your immunity passport to demonstrate you’ve successfully survived coronavirus. “Oh wait, you don’t have immunity. I’m sorry we can’t insure you.” Or perhaps worse still, your prospective employer is able to perform a background check on you confirming you might be vulnerable and suddenly a job offer is withdrawn. These are Orwellian examples but it’s only if we act now that we can prevent the design of systems that make them possible.
Not just in respect of an immunity passport but actually for identity more broadly we urgently need a trusted guardian. One that can store our identity information to the highest possible cyber security standards and one that we can administer ourselves as individuals. Here I draw a parallel to the role played by Visa and Mastercard in the payments ecosystem.
Yes, the card networks occupy a very powerful position and regulation is required to ensure fees remain reasonable, but they also achieve something very special. They protect the privacy and integrity of the individual’s card data right through the transaction chain so it isn’t exposed to merchants or third parties. The same is possible for our identity information.
This requires a change of mindset from businesses. The predominant narrative has long stated that data is the new oil and you must hold as much intimate data about your customers as possible in order to personalise and sell more to them. But the tide is turning, and surveillance capitalism is now being challenged and exposed as exploitative. GDPR and CCPA have increased risk so significantly that, for all but a few of those most wedded to surveillance capitalism, it is no longer rational to store vast amounts of identity data. It would certainly be a tragedy if our immunity status propagated the web in the same way our name, address and date of births have.
Emerging technologies can now combine to deliver the trusted guardian we so desperately need. Firstly, we do not need to ask every organisation we interact with to store our immunity status or personally identifiable information, rather we can provide that data once to the cloud-enabled trusted guardian. Organisations can then obtain the confirmations they require from the guardian as they authenticate us without actually having the data “Dear guardian, can you confirm this person is over 21 please?”.
Secondly, we can hold the guardian to account using cryptography. Threshold cryptography, whereby a decryption key is split between several parties, means that no single actor, including the guardian, can decrypt the data. The user is always a key fragment holder and no significant action can be performed without their consent (granted simply by the user via a web interface or app).
Thirdly, we do not need to permit the guardian to track us in order to sell data or metadata relating to our behaviour. We all know how valuable cookies have been. Today’s identity platforms behave in a similar way by helping companies target us based on where we’re logging in, how frequently and other patterns that betray our intent. Tokenisation of data can stop this in one simple swoop by anonymising user behaviour data and then encrypting it and then also subjecting it to user-administered threshold cryptography.
You may still feel a centralised identity guardian would be in a position of great power. But wouldn’t it be easier to regulate such an entity? Rather than trying to coax every business up to the required security and privacy standards. Should the guardian somehow manage to grow too powerful it could transition to a global public utility with regulated fees and strict oversight.
I am deeply concerned that the initial proposals for immunity passports are at best racing to be functional and forgetting the need for privacy. At worst, some players involved realise that being in control of peoples’ immunity status is an extremely powerful position and are seeking to exploit it – governments are seemingly unaware, or perhaps so desperate they’re looking the other way for now. That’s why we need a cloud-based trusted guardian, one that has significant checks and balances hardwired into its design from the outset and one that puts our privacy first.
