Humanitech

I’m releasing part 3 during a big week; it’s the week that communities across the United States respond. And I want to explain why I’m not in community with the amazing folks at the OpenID Foundation and the Internet Identity Workshop.

• Part 1 is about how identity is at the heart of U.S. politics – and the atrocities being carried out on the streets and hidden away in detention centers and third countries. It was released in the wake of a series of Supreme Court Rulings that changed the meaning of what it means to be “legal” in the United States.
• Part 2 is about the role that surveillance technologies are playing enabling this agenda – and how policy-based guardrails alone are insufficient. It was released on the day that Marco Rubio, US Secretary of State, proposed dismantling the International Criminal Court.

In Berlin, I argued that winning our civil rights back requires fighting this battle on all sides. I argued for bravery and engaging in difficult conversations. The reason that this post is so late is that I’ve tried to practice what I preach. I’m going to weave in experiences from the last few months while I summarize the last part of the talk (which you can find here).

Power in Community

Identity remains at the heart of American politics. As Identity practitioners in the United States head to the polls, I want us to reflect on that. Remember the ways in which technologies continue to be used to track and target people. Remember that people, like me, are being surveilled by DHS and that de-naturalization efforts are ramping up.

Also, please remember that non-violent civil resistance works.

Nonviolent resistance. Things like:

• Neighbors standing with neighbors
• Neighbors speaking to neighbors
• Local advocacy
• Peaceful protest

It means colleagues and friends speaking to one another and gently challenging one another and finding levers within our spheres of influence. How can you – or your company, your product, the standards body you’re affiliated with, your town, your state legislature your brother – how can you add protections for people or resist injustice?

Bravery in Community

Talking to people about this stuff is not always easy. Maybe it’s never easy. It really is much easier to avoid the rising tension when your views are at odds with someone else’s, the realization something we’re doing is at odds with our values, the recognition of how small we are in the face of societal change. It’s easier to put your head down and work hard, safe in your own good intentions. It takes bravery to speak up and take action (“speak” is a verb, by the way) even when we know how small we are. It takes hope that others will listen, that others are out there, and that together you are many.

So, that’s why I’ve been advocating in my legislature and spending weekends door-knocking in Michigan, Maine, New Hampshire, and North Carolina every unallocated minute since EIC. It’s why this blog is so late and it’s why I’m not at IIW: I’m spending the election long weekend in North Carolina, knocking doors for Roy Cooper and Don Davis (NC CD-1).

Building Bravely in the Identity Community

Even if you cannot participate in the ways that I do, there is important work to do inside the identity community, which brings us back to EIC and IIW.

We need to build bravely the tools AND the rules for digital identity that are fit for the world we actually live in. It’s a world where abusers do take power and corruption does exist. The technologies we build will be placed into the hands of bad actors, willingly by society (albeit often unwittingly).

Building the Tools

We know what tools we need to build:

• Foundational identity systems that provide persistence, privacy, and portability. Beyond proving who we are right now, people need tools that prove, irrefutably, who they once were before a government stripped them of their rights.
• Privacy-preserving technologies – we need end-to-end encrypted channels for communicating & zero knowledge proof technology. We cannot let our legislators strip away our protected channels under the guise of “national security” or ill-conceived attempts at child protection – we need to help them solve those very real challenges with privacy-preserving options.
• Provenance and Authenticity standards (like C2PA) to help us navigate a world where we can’t believe our eyes and elected leaders doctor images and admit to creating stories. We urgently need the standards for verifying provenance and authenticity so that we know what is true and the source of that truth.

Building the Rules

On the rules side we need to:

• Legislate our norms so that our justice system can act when our values are under attack. Policies and entire regulatory agencies can be dismantled. We need to legislate what patters.
• Comprehensive privacy legislation with heavy restrictions on secondary use and surveillance so that everyone in the United States is equally protected under the law – and so that the dignity of each person is placed in higher priority than corporate profit. And so
• Uphold civil rights in identity standards. Let’s align what we build with the kind of societies we want to live in. Let’s identify and mitigate risks to our core rights – even if it means trading away certain use cases.

Laws and technology go hand-in-hand. Through technology, you can build essential safeguards into the system. Signal can’t give the US Government the data because it doesn’t have the data. Be like Signal.

But when you can’t be like Signal, you need laws much more than administrative interventions and norms. Legal processes cannot stop a slide into authoritarianism, but they can slow it down. As long as the Rule of Law exists in some capacity, lawsuits can be fought and won – but only on the basis of law. If you don’t want the government to be able to surveil you for not being Christian enough or for supporting someone else’s right to privacy, then demand that our legislators legislate.

Brave Identity Movements

We need to move fast to stop the expansion of the civil rights attack surface. So, we need to have the tough conversations in real time – and in the last year we’ve seen a really great example of brave conversations.

Let’s look at mDL and the SEDI initiative in Utah. For years, people have been working on ISO 18013-5, the mobile driver’s license standard, and 18013-7 that defines how it is to be used online. It has a powerful ability to address issues of equity and access – and the format is being adopted by countries all over the world. It’s a major step forward.

But other members of our identity community and civil liberties advocates in the United States picked up on features that gave them pause. Kim Hamilton Duffy wrote a careful, considered analysis of how – if the standard were misapplied – it could deepen surveillance issues in the US.

To their credit, folks in the ISO WG and the American Association of Motor Vehicles have both taken key steps that address some of the feedback.

Advocates in the state of Utah went so far as to repeal their mDL program and passed another, SB 275 “State Endorsed Digital Identity” (SEDI) initiative. It is grounded in a Digital Bill of Rights that the American Civil Liberties Union applauds. Whether you agree with Utah or not, this was an important conversation and I’m proud of people on all sides for having the bravery to speak up, the bravery to listen, and the bravery to mitigate risks of harm.

We *need* to be out there, bravely standing our ground to build in the right way. Courage is contagious. We’ve already talked about C2PA, SEDI, AAMVA, and the mDL community. Here are some examples of our community doing the right thing:

• The DIDAS community in Switzerland, born out of voters’ rejection of digital ID, has been taking a human-centered, whole-society approach to designing rights-enhancing ID systems and supporting legislation. Now, the Swiss people do have access to privacy-preserving digital credentials.
• The W3C Privacy Working Group offers a great example of a Standards Development Organization directly engaging with Civil Society, bringing folks like the Electronic Frontier Foundation and others into the process.
• The OpenID Foundation has built privacy-preserving standards, and has been driving the conversation forward – like with Heather’s Privacy whitepaper and speaking up to respond to governments, regulators, and SDO’s about critical issues
• At IIW this spring, John Bradley and others gave a powerful demonstration with Longfellow Zero Knowledge Proofs
• The authors of NIST 800-63-4 specifically called out equity and privacy standards in the document, creating air cover for US implementers to support pseudonymity, least disclosure, and other privacy best practices
• The FIDO alliance provided a great example of ensuring biometric templates used for passkeys never leave the devices – and there are amazing vendors out there advancing privacy-preserving biometric cryptography so that we get the societal benefits of biometrics without the human costs of a breach
• UNHCR, the International Office for Migration, and other UN agencies recognize the risks of their biometrics programs, weighing them against the value of food, shelter, and safety – they mitigate those risks with heightened security and purpose limitation.
• And of course Signal’s “sealed sender” is a great example of a company simply not giving itself access to data that could harm end users.

You can build something with all the good intentions in the world. The internet. Facebook. Bitcoin. Twitter. Claude. Trains.

But we cannot fail to imagine the consequences if our products are controlled by powerful people with ill intent.

When we think this way, we will find trade offs and risks. We’re never going to be perfect. This is a messy, messy world – the only world where all of this is solved is a world where human identity doesn’t matter. That could be the scariest world of all.

As product designers. Company leaders. Standards developers. Voters. We all need to be brave enough to:

• Seek out & name risks
• Listen to our critics
• Argue on the merits.
• Be brave enough to change minds – including your own.

You are the smartest people working in this industry. You can stop your company or the state you are advising or your working group from making grievous errors. You can educate your legistlators. You can help them mitigate the risks of harm. Heck, you could even slip a protection or two past those who would do us harm.

They say that those who don’t study history are doomed to repeat it. Well, as it turns out, even those of us who study history are subject to its insistently cyclical nature. You may belong today; that’s not guaranteed tomorrow. One day, you may wake up and find yourself a target. Will there be laws to protect you? What is the technical landscape you want to be living in?

Who will be by your side?

Will the systems you’ve built help defend you?

Post Script

Get out there and vote!

If I were at IIW, here’s the session I’d call “Blue wave, now what? What identity policies and tech must we pursue to regain and protect civil liberties as, little by little, power changes hands” If you call it, please send me the notes.