The New Economy Series: Digital Identity as a New Policy Frontier (LPL1-V07)

Transcript: The New Economy Series: Digital Identity as a New Policy Frontier

[The animated white Canada School of Public Service logo appears on a purple background. Its pages turn, opening it like a book. A maple leaf appears in the middle of the book that also resembles a flag with curvy lines beneath. Text is beside it.]

Webcast | Webdiffusion

[It fades out, replaced by a Zoom video window. The moderator, Francis Bilodeau, smiles. He is a white man with short black hair and a trim beard, and he wears a black long-sleeved shirt. He sits in front of a grey wall. A few cards and small pieces of art hang behind him. A purple text box in the bottom left corner identifies him as "Francis Bilodeau, Science and Economic Development Canada."]

Francis Bilodeau: [Translated from French] Hello. I would like to begin by introducing myself. My name is Francis Bilodeau. I'm the senior policy ADM at the Department of ISED. I was also previously the acting GC CIO and then the Assistant Deputy Minister at TBS for digital policy. So in one way or another, I've been connected to the important topic we're talking about today, which is digital ID, for a number of years. [Translated from French] Welcome to the 7th event in the New Economy series, a partnership between the Canada School of Public Service and the Center for International Governance Innovation. I will make a few important administrative points before we begin. Simultaneous translation is offered in the language of your choice through the portal. Instructions to this effect as well as the presentations were sent to you with the link to this webcast.

Digital ID has been a topic of discussion within the Government of Canada, but also within countries around the world for a number of years. Shaping Canada's digital identity landscape is a task shared by many levels of government, as well as external stakeholders like DIACC, private sector organizations. There are many groups around the table who will be key partners for getting it right in Canada. We've assembled what I think is a fantastic panel today, and this should be a really good discussion. Our panellists bring expertise from the private sector and other levels of government, and we can expect them to expand on the federal conversations around digital identity in ways that are both complementary and thought-provoking. Of note, this panel isn't designed to give you the official view of what digital ID is or should be for the Government of Canada, but rather to expose public servants to some leading thinkers from other levels of government, business, industry and representative associations.

First, let's talk a little bit about what we mean by identity and what we mean by digital identity. At a very basic level, we all understand the concept of identity. We're born and our parents give us names so that when they call out to us, we know that they're talking to us. At the same time, we're given one of our first government-issues identity in the form of a birth certificate. Later on, we start accumulating other types of IDs: things like our passports that allow us to travel or a driver's licence that allows us to, for example, get into a bar. Some of you may have even experimented or seen people experiment with early sort of forms of identity fraud by using a fake ID to get into a bar.

[Francis chuckles.]

So in some ways, we've been around identity for all of our lives, and they've been an important part of our life that we don't always think about. But more and more, as we move into a digital age, we are moving from paper-based identity to electronic forms. You're accessing your banks online by using a password. You may have bought a coffee recently by using a form of biometric assurance and using your iPhone to pay for your coffee. Some of the transactions you're doing might not be very sensitive. For example, if you are reserving a camping site and not having to pay for it through to the Parks Canada website. Others require a more important level of assurance and the consequences of identity fraud can have serious repercussions.

And so as more and more of the interactions between governments are moving online, the capacity to identify and validate an individual's identity electronically is becoming increasingly important. This is an issue for governments around the world. Some nations already have well-established national digital ID ecosystems. The GoC, the Government of Canada, has been making efforts in this space, and I would venture to say developing what we can consider to be a Canadian approach that's anchored in our own federal reality. I'm sure you'll hear more about this from some of our panellists.

Many countries have approached digital identity as a foundational platform to moving the interactions between government and individuals to the digital reality that reflects the expectations of citizens in the 21st century. Today, we have the benefit of being able to engage in conversation with some leading experts in the field of digital identity, and I look forward to the conversation. Introducing our panellists, I would first introduce Joni Brennan.

[Four video windows appear alongside Francis. In one is Joni, a white woman with shoulder-length dark brown hair. She wears a white sweater and a necklace with a triangular black pendant. Behind Joni, a few photos hang in a line down a white wall. Two large brown hearts hang from the ceiling in the corner, and a large leafy plant sits beneath them.]

Joni is the president of Digital ID and Authentication Council of Canada, or DIACC. She has more than 15 years of experience in digital identity, innovations and standards development. Today, she's driving the development of an identity trust framework, contributing to international committees and standards organizations and building strategic partnerships across the public and private sector. Next, Colleen Boldon.

[Colleen smiles. She is a white woman with shoulder-length brown hair. She wears black glasses and a black blouse. Behind her, a painting of muted flowers hangs on a white wall.]

Colleen is the Director of Digital Lab and Digital ID Programs with Service New Brunswick. Colleen has a long career in information technology and experience in private sector, academia and government. Currently, Colleen is responsible for digital identity programs with Service New Brunswick and is leading efforts on the Smart Province initiative to leverage technologies to accelerate the integration, development and growth of digital solutions in the public sector. And next, I'd like to introduce Debbie Gamble.

[Debbie has olive-tone skin with short black hair, and she wears a black shirt. Debbie sits in front of shelves with plants, photos, and other small items on it. She waves.]

Debbie's the Chief Officer of Innovation Labs and New Ventures at Interac. Debbie's work focuses on mobile commerce, digital identity and cryptocurrency solutions. She's recognized as a leading authority in the digital economy and has been widely recognized for working within tech sector. And last but not least, I'd like to introduce Andre Boysen.

[Andre is a white man with short brown hair and a short grey beard. He wears black glasses and a black button-down shirt. A TV screen is mounted on the wall behind him. Next to it are shelves of books, photos, and other small items. Andre has a microphone set up in front of him.]

Andre is the Chief Identity Officer at SecureKey and a senior fellow at CIGI. He's recognized as a global leader in digital identity, privacy, digital transformation and blockchain. Andre is an active contributor to the digital identity community and serves on the boards of identity standards organizations such as DIACC and Kantara Initiative. The panel today—just a note that the panel will be using Wooclap to pose a few questions to the audience and to receive your questions towards the end of the event. The instructions to access Wooclap were sent to you to your email and also appear on-screen. The access code is JAN12. J-A-N 12, all capitals. And why don't we warm up with a first question on Wooclap?

[A web browser fills the screen. Beside a QR code, text reads, "How to participate? Web: Connect to www.wooclap.com/JAN12. SMS: Send @JAN12 to (855)910-9662." The page is replaced with a poll titled "How familiar are you with digital identity?" The options are Very, Somewhat, A Little, and None.]

In the first question, we'll ask to all our participants to get to know you a little bit is how familiar are you with digital identity? [Translated from French] Are you familiar with digital identity? So your options are very, somewhat, a little, or none at all. And we'll be looking to learn a little bit more about you.

[The poll results shift as people submit responses. The majority is consistently "Somewhat," staying around 50%.]

And so we see the results are moving a little bit, but we see we have a small portion of the audience that says they know quite a lot. The vast majority are saying they know [Translated from French] somewhat or a little. And a small portion doesn't know about digital identity at all. So, context for our panel members today: we have an audience that varies quite a bit in terms of its understanding from the quite a lot to the not at all with the majority of our participants today having some notion of digital identity, but looking to enhance their knowledge. So with that, we'll move straight to the presentations. And our first presenter will be Joni.

[A presentation title slide fills the screen. It reads, "Digital Identity as a New Policy Frontier. Andre Boysen, Chief Identity Officer, SecureKey and CIGI Senior Fellow. Colleen Boldon, Director of Digital Lab and Digital ID Programs, Service New Brunswick. Debbie Gamble, Chief Officer for Innovation Labs and New Ventures, Interac. Joni Brennan, President, Digital ID & Authentication Council of Canada." Joni' video window takes up a small section of the screen to the left of the title slide]

Joni Brennan: Thank you so much, Francis. It's a real pleasure to be here. Thanks for the introduction and thanks to all of you for participating in this important discussion today. I'm really thrilled to be here. As the slides are getting pulled up, I also am thrilled that we have in this panel today not only the experience that was discussed; we also represent from Canada, one coast to the other. So good morning to all of you from early morning here in Vancouver. And we've got Colleen Boldon out in New Brunswick on the other end of the country so it's a real thrill to have that coverage. I think you folks are going to put up my first slide so you can do that as soon as you are ready.

[The slide has an image of a woman smiling at her cellphone. Text overtop reads, "$48-97 Billion, 3-6% +GDP. Economic Impact of Identity in Canada."]

Great, thank you. I wanted to start by covering what identity is with broad brush strokes and really focus on one of the top priorities here about the "why" of identity. And that is really on the economic impacts that solving digital identity can bring to Canada. There have been numerous studies that have been done around the world and generally we find that there is around three to six percent of GDP that can be gained and realized into the Canadian economy by solving for the ability to verify people and organizations and relationships in between. How is that made up? It's made up through fraud reduction, through increased efficiencies and through opportunities to create new and compelling services that all Canadians need to be able to use, whether they're in the busy, bustling cities or in the rural landscapes of Canada. So the economic opportunity here is massive. That's especially important when we need to get Canadians back to work and reopen the economy and keep the economy moving in times such as these with the global pandemic that we're working through. Next slide, please.

[The slide reads, "Canadians need to know what data exists about them. Citizens, governments, and businesses need tools to manage sharing."]

In order to make this vision a reality, Canadians need to know what data exists about them, and citizens, governments and businesses, they need tools to help people to manage proper sharing and verification of that information. Next slide.

[Overtop a photo of a woman in a home office looking at her phone, text reads, "What do Canadians think about digital identity?"]

Now, it was great to hear the level of understanding that folks have with identity today and the concepts. We went out last year—actually this is 2019 data—we asked Canadians what they thought about digital identity. So let's go through what Canadians thought about digital identity.

[The next slide reads, "What does digital identity look like today?" Next to this is a graphic of a man holding his phone up to his face for facial recognition.]

Well, Canadians had some concerns about digital identity, and particularly—we're missing one slide here but I'm going to talk to it anyway—what Canadians were looking for is they do have concerns about using social media. Only 30 percent trusted social media sites to protect data about them. Now, what Canadians did have trust in was 83 percent said that they trusted governments to protect data about them, followed very closely by 81 percent who said that they trusted financial institutions to protect and manage data about them. So we have some strong foundations here for building solutions and services on top of institutions such as government and financial institutions and financial services. So let's talk about what does identity look like today? Next slide, please.

[The slide is titled, "What are some of the key challenges?"]

What identity looks like today, really, is—we like to say that on the Internet, nobody knows that you're a dog, which I think is a really good example of how the Internet and identity behaves today. It's hard to prove that you are a dog. It's hard to prove that you're not a dog. We need ways to be able to verify people. Let's go through some key challenges here and put the next pieces of the slide. Thank you.

[A subheading appears: "Creating Market Conditions." Two arrows head away from it. One leads to a text box reading, "Standards." Below it, text reads, "The source of authority for digital identity standards across the economy is unclear due to parallel working body efforts across Canada." The other arrow leads to a text box labelled "Regulatory." Its following text reads, "Government has an important role to play in digital identity. The provinces and territories are primary sources of foundational identities. Regulation needs to allow digital identity solutions, including the controlled opening up of data."]

So in terms of the key challenges that we have around the digital identity space and moving it forward, particularly, we need the right market conditions to help create the ecosystem and the space to enable digital identity to move forward. Specifically, we're talking about standards—the standards development space; standards are not the solution for digital identity. They are tools to help solve digital identity move forward. There's important work being done to normalize and bring standards together, both from the Canadian perspective and when we look at solving identity—well the Internet doesn't stop at the Canadian borders, so we need to be working in the global ecosystem for how we solve for digital identity. And another area that needs to move forward and innovate is around the regulatory scheme. We have some really strong foundations here, again, in terms of security practices, in terms of know your customer and anti money laundering in the financial sector as far as regulated industries. We believe that there are some regulatory changes that our policies could benefit from to both enable digital solutions that work for Canadians as well as reduce barriers for participation. So there's strong work that needs to be done there across the board. Next build on this slide, please?

[A second subheading reads, "Promoting market growth." One arrow points to the word "Sustainability" with text following: "While each scenario provides a varying perspective, commercial sustainability and viability are either unclear, underdeveloped, or unproven. Considerations for liability should also be included in this category of challenges as the responsibility around personal data exchange needs to be carefully examined." A second arrow points to the word "Inclusion" followed by: "Ensuring that a critical mass of providers and users adopt digital identity products is significant across all scenarios, while also ensuring those that are typically excluded can get access to services or can be provided with better experiences than those that exist today."]

And then also promoting the right market growth. When we're looking at how digital identity moves forward, some of the things I'll ask you to look at and think about are what are the sustainability? How are the solutions and services for digital identity sustained? Are they solutions and services that are fully inside the public sector, funded through public sector means and sustainable through public sector means? That's one path forward for sure. And we might have an ecosystem as well with some commercial aspects for how that ecosystem is funded, whether consumers and citizens are funding there, or whether we have private sector entities who are gaining value funding through those. There's no single model in terms of sustainability, so you should look at when you're looking at these systems, different kinds of ways of these systems would be sustainable. And last but absolutely not least: inclusion. We have to ensure that we have the right inclusion in these ecosystems. Next slide, please.

[The slide is titled "A Framework to Unlock Identity Networks Utility." Text below reads, "Consent, privacy, ethical use of identity information with the Pan-Canadian Trust Framework™. There are two lists on the slide. One reads, "Data verifiers: Governments, universities, banks, telco providers, credit agencies, more." The other reads, ""Data requesters: Governments, universities, banks, telco providers, credit agencies, more." Between them is a graphic of a person holding a tablet. The person is labelled "You." The word "Verified Data" is at their side.]

What this ecosystem looks like, and I think there are a couple of builds that you can do here for some bubbles, but what this slide really talks about is you should think about this ecosystem as organizations that are requesting data to be verified and organizations that can verify that data. Now, what's most important here is you: you are in the middle. So this means that you provide the consent, you provide the permission for these organizations to both connect with each other, in a sense, to be able to verify data about you in a secure, private and ethical way. Next slide, please.

[Beside the person four text bubbles pop up, reading Income, Date of Birth, Address of Record, and Phone Number.]

And you can keep going a few bubbles, these are the kinds of data your address, your income, your date of birth. So these are the kinds of data you might want verified. Thank you. Next slide, please.

[The side reads, "The digital ID & Authentication Council of Canada. Leading Canada' full and beneficial global digital economy participation by delivering a digital identity and authentication interoperability framework. The DIACC is a growing non-profit coalition of 85+ public and private sector members created as a result of federal government' Electronic Payments System Task Force."]

Perfect. So where is some of this work happening? The organization that I work for is the Digital ID and Authentication Council of Canada; we're a non-for-profit organization. When we're outside of Canada, people tend to get confused and think we're representing government. When we're inside of Canada, people think we solely represent the private sector. Neither of those are the case. We actually are a collaborative of public and private sector entities who believe that the best way forward is to work together here. So if you'd like to get involved, we'd be happy to speak with you. Next slide, please.

[The slide reads, "Secure our digital future. DIACC/CCIAN. Let' build trust together as global leaders connecting Canadians to each other and to the world." Below the text is a graphic of two huge arms shaking hands. On top of them, people hold magnifying glasses, puzzle pieces, megaphones, arrows, and other objects.]

And so that's the work that we're doing now. I would say that if you're interested in this space, something that you'll probably hear a bit about today is the Pan-Canadian Trust Framework. This is a framework that points out to the different kinds of standards and practices that are required for digital identity. We'll talk a little bit more about that as we go. I'm excited today to share the virtual stage with this panel and talk about some of the high-level concepts of identity and where and how we can work together—public and private, federal, provincial, municipal, territorial—to move this space forward in a way that works for all Canadians. Thanks so much for joining us today, and I look forward to this discussion.

Francis Bilodeau: Thanks, Joni. That was great and very useful. So from the perspective of the national collaborative to the provincial perspective, why don't we move to Colleen, now?

[A title slide reads, "Smart Province New Brunswick." The Service New Brunswick logo is beneath. Colleen' video window is to the right of the slide.]

Colleen Boldon: Hi, folks. Colleen Boldon from New Brunswick. I represent Service New Brunswick and what I'm going to talk to you about today is a little bit about Service New Brunswick. We're a crown corp. We were set up probably about 10 years ago and many mergers later, we are the shared services organization for the province of New Brunswick. So we do everything from IT and servers and applications right through to laundry and our service centres in all the regions. This set us up well for digital. Like every other province, we also have a digital strategy in most provinces. You could just Google that and see it. I know most of you are in Ontario and certainly Ontario's new digital strategy Onwards hasn't gotten a lot of press lately. So you'll be able to find all of that.

But I want to focus on Smart. And the Smart Province initiative, that digital identity was announced about five years ago and we went through a proof of concept and a production pilot, as well as naming it, what it meant to us. So Smart—the term smart comes from Gartner. Many of you would know about Gartner. And to Gartner it is the highest level of maturity, digital maturity, where the Tell US Once approach is predominant. So you provide your information once and it's shared across various applications. It's also about interconnected jurisdictions as well as interconnected within your own province. So it's very, very different than just any form that you fill in online and potentially just have to print. It is the highest level of digital maturity. In New Brunswick, we went to Estonia, prompted by the private sector, to go take a look at digital and how that might move the province's economic strategy forward. So that's the backdrop for Smart. I'm going to talk a little bit more about what's in that vision for New Brunswick, the work of joint councils, the federal government, the policy gaps and the collaborative roadmap. Next slide, please.

[The presentation moves two slides ahead.]

Could you go back one?

So in New Brunswick, we called it MyID; it's a trusted digital identity which is used to do things online that represents you as securely as if you were standing in front of me at a service centre asking to do a particular service like renew your driver's licence. Next slide.

[The slide is titled "Digital Identity." A bullet point list follows:

• "Government trusted source ("I am who I say I am")
• Establish single source for NB citizen identification
• Re-engineer and leverage current GNB systems
• Develop provincial technology architecture
• Built on well-established processes to protect privacy and security
• Pan-Canadian standards."]

So what we looked at is "I am who I say I am," and if for many of you who know that anything about digital identity, that's a common way to describe it. I am who I say I am. Wendy, standing at the counter or Wendy's coming online—Wendy is who she says she is. It's a single source for New Brunswick citizen identification. It does mean we have to reengineer and leverage current systems because we do not have the luxury of throwing out our legacy systems and every government would be in that same boat. However, Estonia, the poster child for digital economy, was able to start from scratch when they broke off from the Russian government. So we need to develop architectures built obviously on a very strong match between privacy and security and built to pan-Canadian standards. Next slide, please.

["Pan-Canadian Approach: Collaborative effort between jurisdictions and sectors. Principles:

• Respect privacy
• Client choice
• Governments have a key role to play
• Collaborate with trusted private sector institutions
• Phased approach to evolving services and infrastructure."

To the right is a map of Canada with text reading, "Federated approach. Trusted credentials and identities across jurisdictions, across sectors, and internationally. Federating credentials: Trusting credentials issued by other jurisdictions and industry sectors. Federating identity: trusting identities that have been established by other jurisdictions."]

At the national level, it's all about collaborating together, sharing lessons learned, respect obviously for privacy and security and client choices, Joni mentioned. But governments have a key role because we hold foundational evidence of identity. So in provinces and territories, that's our vital statistics registries. It's proof of citizenship for immigrants, it's held in IRCC and those immigration papers that prove they're Canadian citizens or a landed immigrant. For the highest level of trust, we need to prove citizenship because that matters to Canadians and our confederation gives rights and freedoms based on citizenship. Obviously, we need to collaborate and it's not going to happen overnight. Folks, this really is a marathon, not a sprint. We have to be able to issue credentials and trust that we can use them across individual governments. But also, I need to be able to trust something issued by BC or vice versa, New Brunswick credentials need to be trusted by other provinces and then by extension, across other sectors and then internationally. And the work internationally is being done through the federal government and the digital nations, but also through a lot of these standards bodies that are collaborating to help set up these ecosystems. Next slide.

["Approach to Trusted Digital Identity. The GC vision is to build a federated, digital identity ecosystem where trusted digital identities are used to deliver GC services in a seamless manner on any platform, with any partner, on any device. In a graphic, an arrow points from an icon of a person to a section reading "Trusted Digital Identity Ecosystem (governed by the Pan-Canadian Trust Framework)." It features logos for Canada' provinces and service sectors, as well as a few icons for banks, telcos, eIDAS, and IDESG. Arrows point between these to an icon of money, an icon of three people, an icon of the world on a book, and a poppy.]

Here's a slide from my partners at Treasury Board. So you can see the federal government vision has always been to accept identity from the provinces and also eIDAS on the right-hand side. That's the European Union Standard and there are many others. Obviously, banks and telcos play into this, and it's all about finding a way to trust each other's credentials and ensure the right level of proofs are presented for highly sensitive transactions. Next slide.

["Identity is a key enabler to defend the new Security Perimeter."]

So you're hearing a lot about hacking, so why is identity a key enabler and what's changed on the perimeter? If you wouldn't mind tapping one more time?

Thank you. So we used to be able to just put a firewall around it and everything was on site, and now that's not the case. Most of you are working from home, you're using mobile devices, things have migrated to the cloud, et cetera. You have partners at the table, vendors, contractors, and all of these endpoints have different requirements and tools to keep them secure. So as part of cybersecurity practice, there are many, many ways and tools being deployed to protect end users and corporate systems. Digital identity is one of those, so you've probably heard about multifactor authentication, which is basically using more than one way to authenticate somebody coming in, or you've probably heard of single sign on, which is just a username.

Today we didn't actually have to use a password to come in; it was a single factor sign on. But there are many ways to protect—digital identity ties you to foundational evidence of identity. It might tie you to a driver's licence. It might tie you to other things that prove you're you coming in. And then using the standards approach, we can tighten it up to match the level of sensitivity to the transaction coming on. Next slide.

["Public Policy Lags Technology Adoption..." A graph charts the rate of change from the 1970' to today. Each line rises as the decades go on, with the upward curve growing stronger since the 2000'. In descending order, the lines represent technology, individuals, businesses, and public policy at the lowest, slowly starting to curve more sharply. Text on the graph reads, "There is an opportunity to help close the gaps between technology, individuals, businesses, and society and government."]

What's happening? So technology obviously is moving really, really rapidly and individuals have adapted quite well, but we all recognize the rapid, disruptive changes going on. Businesses tend to take a little longer. Public policy is longer again. So I would challenge each of you in your lines of business, you know your lines of business, you know your clientele—how can you use policy updates and modernization for this new digital world? How can you help businesses and citizens and your clients adjust to this rapid change and more importantly, leverage it to create new innovation, new GDP models, and really increase privacy and security but it also allows you to increase throughput efficiencies, faster service delivery and ultimately happier clientele?

One of the things that we've been able to do through collaboration at the national level is we have the White Horse declaration, which was done by the clerks. And in some of the materials you'll get, you'll see the link to get help on that. And that was signed by all clerks to collaborate on this new world of digital identity and no province or jurisdiction left behind. We also created the first public policy document that was drafted to look at roles and responsibilities. Your federal government has the digital charter, along with work that was brought into the house to make it a bill and many, many policy instruments there. With the Pan-Canadian Trust Framework, both Alberta and BC have gone through the first reviews around their digital identity credentials to allow those trusted identity credentials to be accepted by the federal government.

And finally, at Joint Councils, this file is so important it's seen as one of the top things that can improve service delivery to Canadians and businesses. So an individual is hired and sourced by Joint Councils and that person will focus on digital identity. Lots and lots of work that has gone on. The public sector profile has been done to ensure that credentials accepted by public entities can be trusted, and what level of assurance. So all of these are progress. Next slide, please.

["Digital ID Roadmap: Communication and collaboration; pilots and public launches; pan-Canadian trust framework; technology; policy and governance."]

 So the roadmap at the national level is really about communications, and I can't emphasize enough the importance of collaboration. We share pilots. We share lessons learned. We look at what has happened, what we've learned, how it can be leveraged in other jurisdictions. Obviously, the Pan-Canadian Trust Framework is incredibly important. The public sector profile work at the federal level was led by Treasury Board and that fed into the Standards Council of Canada and the DIACC work. Technology continues to be disruptive and changing, but technology really is the easy part of this very, very complex file. Policy and governance are key and you can see the partners at the table. So again, it's all about collaboration. My colleagues across the country are all working on this and road mapping it, and there really is great collaboration between all levels of government in Canada, but also through the federal government into international areas of expertise. So, that's it.

Francis Bilodeau: Thanks so much, Colleen. So going from the perspective of a national organization now to the perspective of somebody delivering for a provincial government, we'll move to our private sector participants who are helping to shape the technology and the implementation of this. We'll start with Debbie Gamble. Debbie, over to you.

[A title slide reads, "Digital ID as a catalyst for Canada' Future Digital Economy. CIGI – January 12, 2021." Debbie' video window is to the right of the presentation.]

Debbie Gamble: Thanks, Francis. Good morning, everybody. You might wonder what Canada's national payment system is doing talking about digital identity. And I think some of the things that you've heard this morning already are very key to us at Interac. So we've heard about the necessity for a Canadian digital identity set of capabilities, the necessity for collaboration, the importance of standards as we move forward on this. I'd like you to think about the role of companies like Interac—and we'll hear from Andre and SecureKey in a second—but when you think about the path forward for digital ID and certainly the path for digital ID as it relates to our economy, I'd encourage you to think about it as a journey around establishing that network, ultimately a network of networks. So as Interac have been a key player in the payments industry in Canada for over 37 years, we know a little bit about how to evolve a network and how to engage ecosystem players across the country in that collaborative effort. Next slide, please.

[The slide is titled "Why Digital ID Matters." In the center of a slide is a yellow circle with text inside reading, "Digital Identity. Entities, people, devices, things." Yellow lines extend out of the circle and lead to text boxes:

• "Healthcare: For users to access insurance, treatment; to monitor health devices, wearables; for care providers to demonstrate their qualifications
• Financial services: To open bank accounts, carry out online financial transactions
• Food and sustainability: For farmers and consumers to verify provenance of produce, to enhance value and traceability to supply chains
• Travel and mobility: To book trips, to go through border control between countries and regions
• Humanitarian response: To access services, to demonstrate qualifications to work in a foreign country
• E-commerce: To shop; to conduct business transactions and secure payments
• Social platforms: For social interactions; to access third-party services that rely on social media logins
• E-government: For citizens to access and use services – file taxes, vote, collect benefits
• Telecommunications: For users to own and use devices; for service providers to monitor devices and data on the network
• Smart cities: To monitor devices and sensors transmitting data such as energy usage, air quality, traffic congestion."]

Some key themes that you will hear us repeat throughout this morning session is the importance of a digital ID and why it matters not just to a particular segment of the country, but to industries and to businesses across Canada and to each of us as individuals. The reality of the pandemic over the last 10 months or so has really accelerated the focus on the digitization of our day-to-day lives and the necessity for secure digital capabilities, including digital ID for us to continue to work, to interact as a society and to ultimately create prosperity across Canada. But it's not just about this creation of secure engagement for individuals. It is certainly to be able to prove I am who I say I am, as Colleen just mentioned, but it is also necessary for us to think about a secure ecosystem that we can trust as it relates to being able to secure relationships of entities to entities, and that includes machine to machine. So it is also about things ultimately IoT and also delivering a convenient set of capabilities that are secure to allow Canadians to go about their day-to-day business. Next slide, please.

So our current state, of course, we are relying on analog processes in many cases, and one of the key challenges for us as we're on this digital ID journey is how do we enable and onboard people at the start of those digital journeys? We might hear a little bit more about that throughout this morning. But our current processes really do rely on that analog, in many cases, face-to-face experience of getting those credentials that we need to prove who we are and to go about our business. Many of the social networks, as you know, have created a convenient way to create identities, but these are not credentials that are secure enough for us to conduct businesses. What Canadians are really looking for, as Joni mentioned in some of the survey work that DIACC has done and I'll touch on some of the work that we've done at Interac—Canadians are looking for secure ways of engaging in a day-to-day manner in a digital experience. So part of the journey that we are embracing is how can we work best together? How do we embrace the appropriate standards and collaborate to actually create that secure, convenient experience? Next slide, please.

[The slide is titled "Current Stage." Three text boxes have bullet point lists elaborating. The text boxes read, "Governments provide trusted, foundational identities for native program purposes. "Many social networks and online platforms act as social identity providers." "Citizens want to be able to complete end-to-end digital transactions and seamlessly interact across all channels of their choice."]

As Joni mentioned earlier, of course, this is critical to the vibrancy of our economy. And as we become increasingly digital, it is all about engaging with each other in a digital form and that data economy. So it's about privacy. We've got to consider these conversations, not just around the digital identity, but it actually will morph into how we authenticate data, how we authenticate each other and how we share data. And we need a common set of standards and policies to be able to ensure that whatever innovation is going on across the country, that we can maximize that for the greater good. And that requires us to have a balanced approach, so it most definitely means that we have to embrace those standards, but it also means that we need processes for us to engage in those standards, to actually deliver on the promise of the new digital economy. Next slide, please.

["Public and Private Sector Alignment." The Interac logo is featured on the slide. Text reads, "Pursuing a vision to develop an end-to-end Digital ID ecosystem in Canada. Alignment between the public and private sector is necessary to successfully deliver Digital ID." A bullet point list is titled Interac' Role:

• "Ecosystem Bridging: Connect multiple sectors, allowing efficient and expedient exchange of value beyond Interac
• Exchange Platform: Facilitate seamless exchange of value (e.g. payments, Digital ID, credentials, data)
• Governance and Advocacy: Set principles and specifications to support Interac' platforms and advocate for its positions."

So, of course, you'd expect somebody from the private sector to talk about why the private sector needs to be involved in these conversations; this absolutely needs to be a collaborative effort across the ecosystems and allow us to bridge those capabilities. And we need a common set of services for us to be able to accelerate the promise of new business engagement, new business models, new ways of digitizing the services that we offer to the marketplace. I'm just going to talk a little bit about the role that we have played at Interac over the past three decades or so around building a network. One of the things that I think is going to be important for today's conversation is once we've solidified the standards approach, how do we embrace those standards? How do we engage across the country, across businesses? How do we ensure that approach is inclusive? And how do we ensure that it is governed efficiently so it can continue to grow? Next slide, please.

["Canada' Digital Future Requires a Common Viewpoint." Text reads, "Fostering an inclusive and safe online environment for Canadians to exchange value (e.g. payments, data) requires common, foundational capabilities that enable convenient, secure and transparent digital interactions. The commonality across these themes requires them to be considered together: Payments, digital ID and data sharing each place similar demands on business as they are forced to take on new accountabilities individually. A common view encourages transparency and innovation, accelerating the growth of the Canadian economy."]

When we look at the world of digital ID at Interac, it really does touch on some key initiatives across the country as it relates to our business—the efforts around payment modernization across Canada, the efforts around data portability, data privacy, and even how do we take those analog experiences and move them to a digital form as we're grappling with our new normal around the pandemic. And in order to do that, we really need to champion digital ID as a catalyst to enable these new ways of interacting. Next slide, please.

["What are Canadians Saying?" Text reads, "Our lives are increasingly digital and authenticating ourselves has become a daily activity. But our foundational identity documents (e.g. passport, driver' license) are still analogue. 83% of Canadians describe their identity as one of their most valuable assets. But 77% say they don't know enough about how to protect their identity online. As a result, 45% of Canadians are improvising by taking photos of their physical IDs in order to access their documents digitally... 72% of Canadians believe using digital ID to access governments should be as secure as making a payment online."]

So we've also done a number of surveys over the past couple of years. There's a snapshot here. I'm not going to go through too much of this, but our research shows that, as Joni mentioned, Canadians see the opportunity, they see the benefits, but they're also concerned around security issues. So we've got work to do around education. Next slide, please.

["Canadians want convenience and security. We value convenience but want high levels of security and privacy to protect our identity information while needing to control how that information is being shared." Various statistics are listed, including "65% want stronger identity verification while conducting business online," "50% are more likely to use digital ID if they can verify an organization' identity," and "70% want endorsement from reputable institutions in order to trust digital IDs."]

If you're interested in some of this data, we are more than happy to share this. You can go to developer.interac.ca or newsroom.interac.ca for more information. I'd encourage you to go to DIACC. We are also members of DIACC to be able to get more of that information and we are happy to engage in conversations as this discussion progresses. Thanks.

Francis Bilodeau: Thank you, Debbie. Really interesting presentation. And now last but not least, I would ask for Andre to move forward with his presentation.

Andre Boysen: Thanks so much. Thank you to everyone for you attention today. [Translated from French] I am Andre Boysen. I want to talk about a service that we already had that's in market today; something you may be familiar with called Verified.Me. Verified.Me is an example of a digital identity network that Joni, Debbie and Colleen have already been talking about. Many of you will be familiar with the first generation of service used by GC that was called SecureKey Concierge, that is now called the Government Sign-In by Verified.Me. The first generation of service was a simple way for Canadians to access online government services using their bank login credentials as a convenience rather than having to remember a username and password that maybe they only use once or twice a year. The service has been operating now for eight years and has over 17 million login credentials used by Canadians. It has also saved GC a lot of money over the prior generation of service.

Verified.Me takes the SecureKey Concierge Service concept a little bit further to allow you to prove who you are at online destinations that you choose. When you think about your own life, you recognize that you can't sign up for many services online; you can't get a new bank account, you can't get a new cell phone, you can't see your healthcare records, renew your driver's licence or your passport. We can't do these things online because it's too risky. There's no way for the online service to know if it's really you, so we force people to come to a counter on the first visit so you can present your documents in person. This is what Verified.Me is designed to do; to take what we do in person that we know and understand and make it work digitally, to make it easy for you to sign up for these new services when you choose to, while also making it trustworthy and cost effective for all types of businesses, including government services.

Importantly, it also has a triple-blind privacy—give Canadians confidence that limit how their information is being used. Triple-blind privacy means when I use my bank account information to prove who I am online, the bank doesn't get to see who I gave the information to. And the service who receives the information—the government or bank, telco or in healthcare and so on—they know the information came from a trusted source, but not who provided it. In our network, which operates the service, we don't know who you are. So what this means is not the bank, not the government, not the service got to see a complete picture of the user journey. And it's this privacy model that's been so successful in making SecureKey Concierge successful today. It's designed for Canadians to work across the economy using the Pan-Canadian Trust Framework that Joni, Debbie and Colleen have already been talking about. Next slide, please.

["Digital has to build on what Canadians know already and it has to work everywhere – by channel and destination." A graphic depicts an icon of a person, labelled "Me." Text bubbles surround her: "Open bank/telco account," "See my medical records," "Prove age of majority," "Change address," "Prove that I am trusted." Two icons of clouds are on either side of her. One is labelled "My digital asset providers" which is filled with logos including TD, Telus, TransUnion, and a driver' license. The other is labelled "My places to share" and is filled with logos including TD, LCBO, LottoMax, Ryerson University, eHealth Ontario, and a few other repeating logos.]

So this picture explains how identity works in person today and uses it as a template for how we want to make digital services online better. The first thing to notice is the bubbles on the left and on the right. On the left is a list of organizations that I already have a relationship with. And on the right are new places I want to obtain services, but I don't yet have. The pattern that we use today is I used the stuff that I have on the left, government documents, banking statements, utility bills and so on, to get the new things that I want that are on the right-hand side. The second thing to notice is that it takes a village, as François said earlier, of trusted providers to make digital identity work. There is no single organization that solves the problem. And it is me, the user, in control of what documents to share. Next slide, please.

[The slide changes.]

Oh, sorry. What I want to do is actually compare the existing in-person experience and figure out what can be done to make the online service experience better. So—oops... Can we go back one slide? I apologize.

[The presentation returns to the previous slide.]

So what's important here is when you think about the in-person experience that we have today, what's important is that the destinations make the rules. Every online service makes its own set of rules; what you must have in order to get access to the things that you want, but you as a user chooses what documents you want to present. So when you come, perhaps you bring a passport and a bank statement. When I come, I choose to bring a driver's licence, a utility bill. Both of those are valid choices. And what you also see in this is that there's a plurality of providers. So each of us can show up with different things and still be successful to get what we want.

And there is some privacy in this model. When I use my driver's licence or a bank statement to prove who I am at a government service counter, the source of the documents doesn't get to see whom I gave the information to. That's a good model. We want to keep that as we move forward. And it's already common business practice; both users and businesses understand this model. Some of the things we want to overcome or fix as we get the digital identity; however, we want to fix the problem of the oversharing of data. When I share my driver's licence to prove my age as an example, they're getting way more information than they need. And if I'm using my bank statements to prove that I've lived in a province for several months, what they really wanted to know is that I actually have a living footprint in my province and they didn't really want to trawl through all of my banking details.

And so we're oversharing data in those examples. There's a document integrity challenge that we have today as well. When I present documents at a counter, the service counter has no way to know if the documents are real. You'll look at them and you'll examine them to see if they're internally consistent or if there are any obvious signs of fakery going on. But in the end, if it's a well-forged document, you're really defenceless against that type of attack. So we want to fix that problem. And lastly, we want to make sure that it works everywhere I go as a user. So it's got to work in person. It's got to work online. It's got to work at the call centre, too. Next slide, please.

["Canadians" Perspectives on Digital Identity: 70% feel that a collaboration between the government and the private sector is the best approach to creating a pan-Canadian digital ID framework."]

We've already heard Joni speak on the collaboration already happening in Canada between public and private sector and organizations on the digital identity file. In fact, each of the panellists' organizations are active contributors of DIACC to bring trusted digital identity to life. And as Joni talked about, there are many organizations working together to make this happen across Canada. Canadians want and expect governments and businesses to work together to make online services easier and more trustworthy for Canadians. Next slide, please.

[The slide has a graphic of a woman holding a phone. Arrows create a path around her: Identity providers à Verified.Me Node à Secure Side Channel à Verified.Me Node à Service providers." The arrow from Identity Providers to the first node has a closed lock on it. The arrow from the second node to security providers has an open lock.]

So this is an updated version of the picture I just showed you. This is the digital version of how we share documents. On the left, we have identity providers or trusted relationships that have already gone through a registration process. And I want to use that information to share somewhere new, to get something new that I want. In this fictional example that we have on the screen, I'm going to a sharing economy app, Millennial Apartments. So I want to prove who I am because I'm trying to sign up for a new flat. Here's an example of how the flow would work. I'd start with the Millennial apps on the left, and the very first thing that happens if I want to prove who I am is Verified.Me asks you to log in and prove you are with your bank. And we're just doing this to prove it's you who's accessing the service. Then in the third panel at the bottom, you'll see Millennial Apartments is the thing that wants some information about you. In the lower part of the screen, you'll see there's some detailed information they want. They want to see your bank profile, your name and address information. They want to see some information on your credit score. They might want to verify your government-issued ID as well as verify your cell phone number. So if you're curious, you can click on those things to see exactly what information they're going to get. And if you're good to share it, then you click on confirm to provide your consent, and that information gets shared with Millennial Apartments. What's good about this is we've been able to do this all digitally now. So it's more convenient for you as a user and importantly for the landlord in this example is that they know all of the information is real because it's been trusted and verified against the issuer at the time that is being presented. So the information is real and it's being presented by me and not somebody else. Next slide, please.

["Taxpayer updating Direct Deposit at CRA: Integrity and simplicity for vital success." Arrows point from the British Columbia government and MyBANK to a person to the Canada Revenue Agency. To the right, a mobile webpage on the Government of Canada website reads, "Direct deposit – CRA. Don't miss a payment!"]

Here are two examples that I want to kind of go through quickly just to show you how CRA has been road mapping and how it might use a service like this to provide services online. So in the times of COVID, we've got the Canada Emergency Response Benefit that's being delivered to many Canadians across Canada and the government has done an amazing job of getting this out more quickly compared to other governments around the world. We're also scrambling to provide benefits to citizens in times of COVID. So one of the challenges we have today for government is that when we're signing up for emergency response benefits. If it's Andre, you want to get the benefit to Andre quickly and you'll need his bank account details but you also have to guard against the fact someone pretending to be Andre and redirecting Andre's benefit to a fake bank account. And the challenge today is when a user provides banking information in an online screen on a Web service, it's hard to know who that bank account belongs to. So here's an example of how I could sign up for a service to give government confidence it's really me and that the bank account details really belong to Andre Boysen and not somebody else. In this example, I can use my bank account to prove my name is Andre Boysen and here are my verified bank details. And by the way, here's my government-issued ID claim to show that this is Andre Boysen. So two different sources of identity, and again, this models and picks up on what we already do in person. We use multiple sources of identity to confirm identity when you sign up for a new online service. Let me just show one more example and then I'll conclude. Next slide, please.

[The graphic is the same, but now arrows point from MyBANK and the CRA to the person, and then to RBC. A mobile webpage shows the RBC website.]

Here's a different example, a different flow. Maybe I've got an existing banking relationship, but for whatever reason, I decide I want to have a new credit card from RBC. So I've decided I want to take advantage of this offer that RBC has sent me. The challenge is I'm a small business owner and it's hard for me to prove my income because my T4 is from self-generated income. So RBC wants to verify my income data before they're going to give me this new credit card. Now, I've got a relationship with my bank so I can use that to help RBC have confidence I'm already inside the banking system. I've gone through a regulated process to prove my identity. But the gap here is proving my income. Now that I've used my banking information to prove who I am over at CRA, CRA's got confidence it's me. So now CRA can give me back my verified proof of income from my tax return last year so I can then in turn take that over to RBC to prove that I am Andre Boysen, and here's my verified income as verified by CRA so I can get access to that new credit card I want. This is an example, in the first instance, where CRA wants to consume data from a digital identity network. And this second example I'm showing you now—here's an example where CRA can help me when I want to go get a new service somewhere else. And with that, I'm going to conclude. Thanks so much.

[The slide disappears and the five participants" windows reappear.]

Francis Bilodeau: Thanks so much, Andre. So a lot to think about, a lot of information provided by our speakers today. We really want to get to questions from the audience, questions from all of you. We have the benefit of a highly knowledgeable panel. So there will be a few questions from the moderator, but in the meantime, I would ask people to access Wooclap to be able to upvote and provide questions you'd like our panellists to use. Again, the access code is JAN12. J-A-N 12. And we will move on to questions from the audience fairly quickly. But first, I want to pick up a little bit on something that Andre mentioned, which is around the role that digital identity plays in the context of the pandemic. Arguably, all the people around this room are convinced of the value of digital ID. Arguably, also, we haven't necessarily done yet the great job of convincing our political masters and ministers of the importance of investing in this. What is everybody's best sort of 10-second elevator pitch on why this matters, why we should be doing this? And particularly in the context like today, where we are living through a pandemic, living an unprecedented time, how could digital identity and a proper digital infrastructure help us deal with future situations or future pandemics? I'm going to start by asking Joni to take a first crack at it. Then I'll move to Debbie, Andre and Colleen.

Joni Brennan: Thank you. That's a good and interesting question. I would say that any time that you find that you want to do something digitally online by the phone—sorry, by the mobile phone, for example, or on your computer or your tablet—when you find you can't do it, that's an identity problem. Any time you find that there's a high value transaction—so if that's your healthcare information, I think we certainly wouldn't say that we feel safer doing a remote healthcare visit right now than going into an office. Having one place where we could view our medical records and be able to be more active in managing our own healthcare and more supportive as patients in teaming with practitioners and supporting our healthcare; that's a place where identity comes into play. So I think that the identity is important for the pandemic—any time you would need to verify someone, anytime you would need to also do supply chain tracking and management about how do we even get the vaccine to people? How many people do we need to get it to? Have they had it yet or not? Are they due for their second dose? All of those things require that we can identify this person and that this person can identify themselves as well as identifying the organization and the entities and the practitioners along the way. In terms of making this more real, perhaps, for some of the folks inside of government, I would say that we really need to close the chasm of what identity is and what identity does. When we're talking about identifying someone in order to get them the vaccine and do that tracking that needs to be done to deliver the vaccine and know where and how to distribute it, that's an identity issue. Knowing that the vaccine actually came from the company, that's an identity issue. But that said, when we're able to solve those baseline identity verification problems—well, if you think about NexGen pay, if you think about CERB delivery benefits, if you think about monetization of pension delivery; all of these initiatives and projects at the federal level all benefit from that same architecture, that same capabilities for solving digital identity. So what's so important here is that if we're able to solve the identity verification piece in the COVID context, we're able to then draw that out into so many other initiatives because identity really is at the root foundation of any transaction that has value, that has risk and actually does matter to people, whether that's personally or whether that's as an employee acting on behalf of some organization that they might work for.

Francis Bilodeau: Thanks, Joni. Debbie, same type of question. You're in the elevator with the Prime Minister and the Minister of Finance and you've got the 30-second pitch as to why this should be a priority. What do you think it is?

Debbie Gamble: I don't even think it's a "should we?" I think it's a "how do we?" The reality of our existence today is we are reliant on communicating, engaging—this is a perfect example of that—digitally. And so to do that, to touch on all of the points that Joni just mentioned, whether it be supply chain management, whether it be health management, whether it be education and how we're going to set up the future of our education system so that we are building the leaders of the future and to enable business to grow. And, of course, our economy relies on small to medium businesses; that's the backbone of our economy and these businesses need to be able to work, they need to be able to conduct their business and engage with Canadians across the country. So my elevator pitch, it should be: how do we do this? What's the plan to move this forward? How do we engage public and private sector entities? And what's the path for us to be able to allow our provincial and federal governments to work together with the private sector to get this in the market?

Francis Bilodeau: Thanks, Debbie. And Andre, your 10-second pitch—why senior ministers, officials should be paying attention to this issue?

[Andre' mouth moves silently.]

You might be on mute, Andre.

Andre Boysen: Thanks. Sorry about that. Yes, thanks. The short answer is the problem with the digital identity infrastructure we have today is that it's easy for crooks and it's hard for all of us. And if we want to move this file forward, we've got to find how to make it easy for all of us and hard for the crooks. That's actually the really short answer. The challenge we have in times of COVID is that we're pushing more and more stuff online, which increases the amount of security required. The challenge is that users can't keep up with all these new security requirements and they're getting lost in the shuffle, which is actually increasing the attack service or the risks that we face in online service delivery. So if we want to make this better, to have a true digital economy, we need to have good digital identity. What good digital identity is something that's simple for Canadians to use, it's accepted everywhere I go and it's trustworthy and cost effective for business. And most importantly, it's not something crooks can use. The challenge we have today—if the crooks have my data or your data, they can be online as you in 10 seconds pretending to be you. When we have good digital identity, they won't be able to do that anymore.

Francis Bilodeau: Thanks, Andre. Now, Colleen, on the same theme, but you're coming from a province; why is it important and why is it important for the federal government and provinces to be working together in this space?

Colleen Boldon: Well, I guess I'd probably use an analogy. Can you honestly imagine operating today without a debit card or Visa card? How many of us are even carrying cash because of the pandemic and cash not even being accepted in many areas? Some of these quick pivots have caused us to push things online faster, as Andre said, and Joni and Debbie. It's critical to a lot of the transactions that we have to do at a distance, but we don't have the tools in place. We don't have the Visa card that allows us to access all these services in a trusted way. And chip and PIN is certainly part of what has solidified and protected and increased security and privacy. So to me, it's as simple as saying usernames and passwords don't work. Every day, you open up the news and you see Facebook's been hacked or some other service that we all use. We know we need to do better. And it's this stacking of proofs, of identity, of who Colleen is that can spot abnormalities. And in the physical world, maybe my husband—I'll use Alan Foster from [indistinct] analogy—he says, "You know, honey, you're not feeling well today." That's what your husband would say. You're not acting like you normally would. And that's what happens online when we stack proofs of identity and patterns go out of whack. As Andre said, you can identify quicker, faster, sooner that things are going awry and get them off. That's really, really important in this new world whereas we move services online, things move faster and faster. We need some mechanism and we don't have it today. We don't have that Visa card that allows us to access services, and digital identity really is like a Visa card.

Francis Bilodeau: Thanks, Colleen. Actually, in your remarks, you spoke about visiting Estonia. I visited them as well as other countries who've done good things around the digital identity, like Belgium and Denmark and others. This is sort of a lightning round because I want to get to audience questions and a reminder that people can submit their questions through Wooclap, and JAN12 is the code, but maybe right back to you, Colleen. Have we fallen behind, in a lightning answer, compared to other countries, in building a digital identity infrastructure for Canada? And if so, are there specific causes that you can think of for which we may have fallen behind?

Colleen Boldon: Yeah. New Brunswick did, as I mentioned, visit Estonia. It was a multiparty approach, which is a rare situation because we recognized early on that any initiatives around digital had to sustain themselves beyond any particular four-year period or party in power. So political support was really critical. In Estonia, again, they had the benefit of starting from scratch because they had broken off from the Soviet Union and the EU actually provided additional funding for them to get their infrastructure in place. They are the poster child for the digital economy. Having said that, they also did some work on laws around privacy—no curious poking around. The laws say very clearly you can't do that and there will be severe repercussions. I think our laws need teeth. I think we need to work on the policy and I showed you that slide on the gap. The policy work is tough; it is complex and requires a lot of stakeholders. None of that is easy and the political will is really critical. But at the end of the day, each of our folks on the line today are in different business units and it still is incredibly important for us to understand that digital identity is not the be all end all. It is the tool or the visa card. And if I can't access anything online or do services online, it's useless to me. So each of the folks online are in different departments. They need to be looking at business cases where maybe they're not delivering the top level of level value to their clientele, and how they can look at what a roadmap might look like, because to improve it—we just don't have the benefit of a huge cheque coming our way. We need to take a proactive, systematic, overtime approach to moving increased services and efficiencies forward in our individual jurisdictions.

Francis Bilodeau: Thanks, Colleen. All right, I'm going to go Andre, Debbie and Joni to close us off on this one. Lightning round: are we behind and if so, why? Andre?

Andre Boysen: Yeah, I want to share a picture here.

[Andre displays a photo on his phone of a white man holding up a small document and smiling.]

This is my brother-in-law, Eric, and he's an industrial mechanic. So he does all of the eight-track systems for the hospitals in Toronto and he actually does the CN Tower, too. He's holding his COVID certificate, a piece of paper that Ontario gave him. Now, he's very grateful to get his COVID vaccination, but they've given him a piece of paper. So how is this meant to work? He's going to show up at the hospital—now, the problem is the security guard at the hospital needs to understand, is this guy really Eric Bateman and is this piece of paper real? This is the same kind of thing we're seeing at every service counter. How do we rely on the information that's being presented, particularly in the digital economy? This is the challenge that we face and it's the challenge of our time. We need to do this in a way that's simple for the person to present it and the receiver to be able to rely on the result, and do it digitally and in person.

Francis Bilodeau: Debbie, same question. Thank you.

Debbie Gamble: Yeah, I think this is actually about political will. Are we behind? We're marginally behind some countries. We're certainly behind countries like Estonia that took the bold step to create a clean piece of paper and approach the world of ID and engagement from the digital perspective. But I think in Canada, we actually have a majority of the elements needed. You can tell by the energetic conversation today; these conversations have been underway for many years. The organizations like DIACC, like the CIO Strategy Council, like IdentityNORTH, have energetic conversations with people who are eager to move this forward. So I think this is about how do we actually corral all of those elements; the public, the private sector, the policy. As Colleen mentioned and used the analogy of when Canada moved to chip and PIN a number of years ago, it wasn't just standards that were necessary. It was an ecosystem that was working together to progress a roadmap to deliver the capabilities to the market. I think the time is perfect for us to do that, but it actually needs some teeth, as Colleen said. It needs political will to pull the various players across the public and private sectors together. And together, I am confident that over a number of years we can actually start to become leaders in the marketplace.

Francis Bilodeau: Thanks, Debbie. So, Joni, you've got a national organization that is playing a leadership role in this space. Is Canada behind when you look at your international competitors?

Joni Brennan: I think so much—I really agree with all the panellists and especially with what Debbie just said in that we need the political will and that we do have—talking about the energy that's there, when I first came to the DIACC, we had about 30 members and now we're at about 90 members, of which the panellists here are sitting on our board of directors; all of whom who have believed since at least 2015, if not before, that a significant and sustained investment was necessary and a collaboration. It's more than standards. It's more than solutions. It's a full collaboration and the political will that's required. Now, to answer the question: is Canada behind? I think you have to say, behind in what? If we're talking about the specific implementation of actually being out there with our digital identities on our phones, through mobile, through in-person and mobile, we're behind on that. We absolutely are and we need to move forward. If you talk about the commitment and the clarity of the vision that this only works when public and private come together, that people don't live in a "I transact with government only" bubble and they don't live in an "I transact with the bank only" bubble, they have a wealth of transactions and that if we want to get security right, we have to do it as an ecosystem. If we want to get privacy right, we have to do it as an ecosystem, public and private. That space we are ahead. We are the visionaries. And in that space, organizations from around the world have been looking at us and pulling from our DNA around how to get the public and the private to the same table. We have this moment and if we don't act on it, though, we will be behind in that side as well. So we've got a mix there behind an implementation way ahead on vision, and now is the time to act and really put it into action and solve this for Canadians.

Francis Bilodeau: Thanks, Joni. I'm moving to questions from the audience right now. Feel free if you want to take a first crack at the question just to lift your hand and I'll turn to you. Our first two questions are linked. The question is: what are the best measures, practices to ensure privacy is considered and protected when developing and rolling out digital identity? So a privacy angle. And then, relatedly, knowing that governments and banks have been hacked and people's information stolen, how can we ever completely trust in anyone's ability to protect our personal data? So combination of privacy and security concerns. And how do we address them in a digital context and with digital identity? Anybody want to take a first crack at this one? If not, I may just turn to Andre to provide us some insights first, in this space.

Andre Boysen: Yeah, I've touched on this point already. One of the challenges today is the way identity works online is we ask a lot of questions and this is manifestly the wrong approach for a couple of reasons. One is you're putting me, the real user, through an interrogation and I get a little bit indignant when you don't believe it's me. But the reason services are asking me so many questions is because they want to get a high level of confidence it's really me and the way to do that is ask me lots of questions. After I've gotten through enough information, you will have enough confidence it's really me. The challenge at the back of that process is you have all my data. Now you are a target and a breach risk yourself. So what we need to do is find a way to do this without creating big honeypots of data, which is what we're doing online today. And if we can get to a place where we can trust a smaller set of information, but know it's reliable, we won't have to gather all the data. First, it'll be easier for the user to accomplish. Two, you'll be able to trust the result. Three, you won't have all the data. And then you don't become a breach risk yourself. Most importantly, where we need to get to is making sure that having possession of a user data alone is not sufficient to masquerade in another transaction. We need to get beyond asking questions and gathering information as a means to get confidence. We need to get to something only real users can possess, like a cell phone and a digital passport or driver's licence; only one is in service at a time. That will solve this problem.

Debbie Gamble: I'd like to build on that, too, if I may, Francis. I think we also need to move away from putting our whole ecosystem based on the authenticity of some analog documents. So we can build some beautiful firewalls around various different systems, but if we are relying on a laminated piece of plastic to authenticate who we are, already we're at risk—so I think that kind of digitization of those foundational attributes, the things that we use to get the documents that prove we are who we say we are, things like our birth certificate and our passports, et cetera. If those are digitized and then we can use those to get further documentation and credentials, then it helps actually create a much more robust ecosystem and using some of the technology that, frankly, some of the nefarious actors are using might help, too. It's very hard for us to plug a hole when we're still basing the whole system on, as I say, an analog process.

Francis Bilodeau: Thanks, Debbie. I'm going to go to the next question. But I'm going to ask—

Colleen Boldon: Francis, if I might just jump in before you move on. I think it's really important to understand what we've just expressed in terms of digitization. I'll use a common example that many folks have rented, an Airbnb. They're scanning a copy of their driver's licence and sending it online to Airbnb to prove who they are. That's a form of digitization, but it's not what we're talking about. We're talking about getting a proof that I, a citizen of New Brunswick, own a driver's licence and sending that from an authoritative source, which is only government, through a channel to a third party like Airbnb, to prove I am who I say I am. Now, I'm not going to send my entire driver's licence; I'm going to only send the minimum required. It would be a proof—it might only be a checkbox that says Colleen has a driver's licence. So you think about privacy by design from the beginning of all of these analog processes and what does true digital mean—not scanning, not making a copy of what's already in play in the paper-based world. I really want to make that distinction before we move on. Passports would be no different. Just because you scan it, doesn't make it an e-passport.

Joni Brennan: I think the other thing is people lean on driver's licence because that's the only thing we have and that's the only thing we know. And driver's licence is not defined as an identity document, but when somebody says bring your government-issued ID, we all pull out our driver's licence. Right? In this ecosystem that we're talking about, I think acceptance is important here, too. So we're thinking about what do we require? What does Airbnb really require? They say driver's licence because that's the easy one. If also they might be able to get a proof from your bank, that you bank with, that you actually have an account, that you bank with this bank, that you pay your bills—I mean, they really want to be able to pay their bills and identify you. So they could also say, "OK, we would accept a digital proof of your driver's licence. We would accept a digital proof that you are a financial institution customer signed by that financial institution." So there could be more than one way to fulfil that requirement. But all we have right now is driver's licence. So that's what we do.

Francis Bilodeau: Thanks, Joni. So recognizing we have, I think, three minutes left to the session. I'd actually go right back to you, Joni, with a question. And people, if they want to add in, just lift your hand for final quick comments. Joni, one of the questions we have from our audience members is how long, realistically, will it take before digital identity has a tangible impact on the lives of Canadians? When will they could do a large majority of their transactions via apps and mobile?

Joni Brennan: Digital identity has a large impact on you now. You're already feeling that impact, whether it's being able to do something new remotely, which might have come from COVID. I'm certainly finding doctors are much more receptive and able to see you remotely now than they were in the past. But the lack of it; you're definitely feeling the lack of it and the user IDs and passwords that you have to manage and the things that you can't do without going online. I have a family member who had COVID. She's having a hard time paying her bills. Nobody can come visit her to bring her the chequebook. She can't find anything. The bank says, "Well, come in to see us." And that's not a solution, especially with somebody who's getting over COVID. So you're feeling it now. We do have, there are networks that are in the ecosystem now. There are solutions that are in the ecosystem now. Andre talked about the Verified.Me solution. Debbie talked about a network of networks leveraging existing capabilities. There are pieces of the puzzle that are here now. I think that we will see more and more of that accelerated over this next year. I know there are some federal departments that have committed to new digital identity systems and solutions before the end of 2021. So I think we're just going to see incremental adoption and innovation using trusted technology that we've worked with over the next year to three, and that will continue going forward.

Francis Bilodeau: Thank you so much. That actually, I think, is a great note to finish on. That brings us to time. I really do want to thank all of you—Joni, Debbie, Andre and Colleen—for the conversation. I'm sure we could actually keep talking about this for a while, because it is a fascinating and important topic and it is about the government stepping into the 21st century. I'd like to invite our viewers to register for the next event in the New Economy series on Tuesday, February 16th. The event is on winner-takes-most economics and competition policy in the new economy. Another great topic from the Canada School and what is sure to be an interesting session. Thank you again to all our speakers and thank you to all of you for joining us today to discuss this.

Andre Boysen: Thanks for having us.

Colleen Boldon: Thanks so much.

Joni Brennan: Thanks for having us. Appreciate it.

[The participants smile and the Zoom call fades out. The animated white Canada School of Public Service logo appears on a purple background. Its pages turn, closing it like a book. A maple leaf appears in the middle of the book that also resembles a flag with curvy lines beneath. The government of Canada Wordmark appears: the word "Canada" with a small Canadian flag waving over the final "a." The screen fades to black.]