After UNFOLD #5: building the ecosystem around the wallet together

On 7 and 8 October, public authorities, banks, care providers, consultants and technology partners from across Europe came together at Pathé Nijmegen for UNFOLD #5. France Identité organised this fifth edition together with the Dutch Ministry of the Interior and Kingdom Relations, the City of Nijmegen, ICTU, Gebruiker Centraal and Ver.iD. The programme, the speakers and the recordings of all sessions are on the UNFOLD #5 website.

Tobias van Elferen, alderman of Nijmegen whose portfolio includes digitalisation, opened the afternoon of the first day with a welcome address. In it, Van Elferen encouraged participants to ask practical questions during the presentations and demos. Which data is truly necessary? Who issues it? Who can verify it? And what happens when a digital credential expires, a mandate is revoked, a phone is lost or a user needs help?

Use does not happen by itself

Van Elferen’s question about what happens when a user needs help came back in the session ‘Private-sector adoption: What Europe Can Learn from Yivi open source wallet’ by Prof. Bart Jacobs, professor of computer security, privacy & identity at Radboud University. He explained that many people do not immediately grasp what he called the ‘wallet logic’: that data first arrives on your phone and you then choose what to reveal from it. According to him, the penny usually drops only after people have used it a few times, and ‘for very few people, it’s immediately clear’. That is why Jacobs thinks ‘we need to organize also in some way that people get help, official help’.

Jacobs spoke from experience: he was at the origin of Yivi, a Dutch wallet that has been in use for about ten years and once started out as a research project. Even Yivi does not know exactly how many people use the app, because it deliberately does not track its users. On Google Play alone, the app has been downloaded at least 100,000 times, and iPhone downloads come on top of that.

Jacobs added that even applications that benefit everyone are slow to get going. His own university, Radboud University, is only now, after years, introducing password recovery via Yivi. Until now, anyone who had lost their password had to go to a desk with a passport. People ‘typically find out late on a Friday afternoon that their password doesn’t work anymore, and they have to send in, before Monday morning, an important paper to a conference’, Jacobs said. With Yivi, a person shares their own personal data from the Dutch population register (BRP). Since 2018, anyone with DigiD, the Dutch public login, can load that data into Yivi via the City of Nijmegen. The university compares it with its own records, and if it matches, a new one-time password follows. Both the university and the user benefit, and yet for years it did not get off the ground.

Jacobs pointed to another barrier: a wallet only becomes useful once enough organisations put data into it. ‘The wallet ecosystem only works if you have reliable sources of data, and you have many of them that people can use’, he said. Besides the personal data via Nijmegen, Yivi can, for example, read passports, so the app can also be used outside the Netherlands. For adoption, he sees issuing data to residents as the most important role of national governments, ‘because the government is holding lots of data that can be used’.

The framework behind the wallet

Jacobs’ plea for more issuers touches on two of Van Elferen’s questions that were not about the wallet, but about the organisations around it: who issues data, and who can verify it? That is where Matthijs de Vries of the Dutch Ministry of the Interior and Kingdom Relations put the emphasis on the second day. In the session ‘What organizations can already do today to prepare for integration?’ he deliberately spoke less about the NL Wallet, the government wallet that is still in development, and more about the system around it. He wanted to show ‘that we need more than just a wallet’, and so started from the question ‘what world is the wallet actually going to land in?’ His diagram put the wallet in the middle: ‘The user stands there with their wallet, wanting all sorts of things, but around it sits quite a large ecosystem to make this possible at all.’ Why a user can trust the wallet depends, according to De Vries, on the trust framework around it: the agreements on who may take part and under what conditions.

De Vries described two sides of the ecosystem around the EUDI wallet, the European Digital Identity Wallet. On one side are the issuers: organisations that issue identity data and other credentials into the wallet. They have to be notified and meet requirements before they can take part. On the other side are the relying parties: service providers that request data from the wallet. They have to register in advance, recording which data they request and why. De Vries called that registration a pillar ‘on which the user’s trust will actually rest’. Using a registration certificate and an access certificate, the wallet checks whether everything is valid and shows the user who is asking for which data. This creates a chain of trust: in future, the wallet can show, for example, that an access certificate from the City of Amsterdam is valid and was issued by a qualified trust service provider.

For the user, that adds up to a lot of information: who is asking for data, which data and why, and whether the requester is a public body. It would be a shame, De Vries said, ‘if most of the information is not seen, not understood or ignored’. Relying parties have an important role in this themselves, he said: ‘What are we really going to put in front of our users?’ The system itself is still being built. Registration is now being set up, with the Dutch Chamber of Commerce (KVK) among others, and a remark from the audience noted that there are still few relying parties, and certainly few private ones. De Vries hoped momentum would build once the system works well and people want to use the wallet.

Learning by doing it together

How to get such a system off the ground was the subject, on the morning of the first day, of Prof. Lokke Moerel, professor of Global ICT Law at Tilburg University. Her key message in the session ‘e-ID Wallets: when compliance requires innovation’ was: ‘It’s orchestration, … it’s cooperation, trying to get all the parts working together.’ Developing a technical solution and assuming everyone will follow does not work, Moerel said. With new technology, she argued, legislation cannot prescribe everything in advance either, so the rules have to emerge from doing it together.

According to Moerel, the approach for this does not need to be reinvented: there has been a lot of research into it, and the best proven way is a learning-oriented approach, with a learning loop in which organisations keep feeding back to regulators what works. First, the legislator sets broad goals, as in eIDAS 2.0, the revised European regulation on digital identity. Organisations develop and experiment, and feed back their experience. Then come technical standards, and then ‘you start organising the ecosystem in pilots, see what works’. Only at the end come the certification requirements. According to Moerel, that learning loop does not stop with the legislator: the supervisory authorities are part of the discussion and ‘need to be fed by all the test cases and sandboxes what works and does not work to feed into the right criteria’. ‘You need to have a learning, experimenting approach to make it work’, she said.

Moerel has argued since 2017 for digital identity as public infrastructure. Back then, she started the conversation everywhere with one question: ‘How on earth did we organise the whole internet without digital identity?’ Passports, driving licences and registers such as the trade register make trade and commerce possible, and that is a core task of government. Moerel counts digital identity as part of that same core task. Government does not have to issue all the data itself; other organisations can do that as well. But it should ‘organise and regulate and orchestrate’ the ecosystem.

In November 2019, the Dutch Cyber Security Council, of which Moerel is a member, advised in its report ‘Naar een veilig eID-stelsel’, on a secure eID system, organising not only government services but also those of businesses so that they connect, with a facilitating and coordinating role for government, because otherwise you end up with a chicken-and-egg problem. Without coordination, everyone waits for everyone else. Data and identity are part of that public infrastructure, Moerel said, ‘and we need to make sure it is open and interoperable’. She showed what that means with an example from telephony. With a subscription at KPN, you can also call someone with another provider, because telephony is regulated as public infrastructure. With WhatsApp, you can only reach people who also have WhatsApp. Digital identity should not be locked into such a ‘commercial walled garden’.

For such an open infrastructure, the Netherlands does not have to start from scratch, according to Moerel. There are already privacy-friendly solutions that can later be certified under eIDAS, and the privacy requirements Jacobs set with Yivi fed into the European rules. In Nijmegen, Moerel already saw that learning loop in practice. The municipality set up an ecosystem in which personal data reaches a wallet securely, and tested the applications. No law prohibited it, and the municipality took that room. Moerel recommended embracing what is already there: funding such test environments and involving the supervisory authorities, ‘for them to learn as well’. That needs no new law, but it does require ‘leadership and some imagination’. Van Elferen also stressed in his welcome address on the first day that this only works together: ‘No single city, ministry, university, or company can do this alone.’