Andrew Black: Building Bank-Backed Digital ID in Australia

In this episode, we speak with Andrew Black, Managing Director of ConnectID, which is part of Australian Payments Plus. Andrew, who is an expert in the convergence of IDtech and open banking, sheds light on a unique approach to building bank-backed digital identity and the user experience that it enables. It was fascinating to unpack the role governance plays in ConnectID with some tangible examples, and analyze how the UX of an identity exchange differs from that of an identity wallet.
We also speculate a bit on why both true open banking and true interoperable digital identity have weaker-than-expected adoption, and how to balance solving business problems with building a future we all want to live in.
To contact Andrew, you can reach out on LinkedIn at https://www.linkedin.com/in/andrew-black-a5118239/. Learn more about ConnectID at https://connectid.com.au/.
Reach out to Riley (@rileyphughes) and Trinsic (@trinsic_id) on Twitter. We’d love to hear from you.

Full Transcript

Transcript lightly edited for clarity.

Riley Hughes: Welcome to the Future of Identity podcast, where we talk to the people building the ID tech products of tomorrow. I’m Riley Hughes, co-founder of Trinsic, and we build infrastructure for launching awesome identity products. Today, I spoke with Andrew Black, managing director of ConnectID, which is part of Australian Payments Plus. Andrew, who is an expert in the convergence of ID tech and Open Banking, sheds light on a unique approach to building bank-backed digital identity and the user experiences that it enables. Digging in, it was fascinating to unpack the role that governance plays with some really tangible examples, and analyze how the UX of an identity exchange differs from that of an identity wallet. We also speculate a bit about why both true Open Banking and true interoperable digital identity have weaker than expected adoption, and how to balance solving business problems with building a future that we all want to live in. One more thing before we jump into the episode. I’ve been getting some great feedback on the podcast recently.

Riley Hughes: If this episode is useful for you, please share it with a friend or a colleague. We don’t do a lot of self-promotion or ads or whatever, so spreading the word really is the best way to signal to us that the content is valuable and that we should keep doing it. I’m always open to feedback as well. So if we can make the podcast better, or if you know of a guest that we should have on, I’d love to hear from you. Thanks so much in advance, and with that out of the way, I hope you enjoy my conversation with Andrew. Andrew, big welcome to the podcast.

Andrew Black: Thanks, Riley. Good to be here.

Riley Hughes: Yeah, so I’ve been beating this drum for a while about how ID tech is the new fintech, and how verifiable credentials are going to do for personal data what Open Banking is doing for financial data. I view you as one of the people on this earth that has such a deep expertise in both areas. So I’m really excited to dive in. I think we’ll have a great conversation. You know, I’ve heard you describe ConnectID as an identity exchange. Our podcast has a lot of listeners from the reusable or decentralized identity world, and we hear terms a lot such as identity networks or platforms or ecosystems. I wonder if you could describe ConnectID as an identity exchange. You know, what does that mean? And, you know, what problems are you solving in Australia?

Andrew Black: So essentially, ConnectID is a trust network, right? And that’s sort of made up of a few different parts, and one of those parts is the exchange. The way we sort of think about it and the way we sort of talk about it, in particular with customers, is effectively like a bridge. So we connect somewhere that individuals already have a trusted source of identity or a verified attribute to what we call a relying party, so somewhere that needs to go, or a service or goods you’re trying to buy or set up. And that’s really sort of the role that we play, is facilitating that exchange, although we do it with a peer-to-peer bridge rather than going through anything in the middle. But what we also do, aside of that, for the trust network is develop the platform, the capability, but also rules and standards.

Andrew Black: So the frameworks that you sort of talk about, thinking about what the sort of operational rigor looks like for a trust network or ecosystem, and also the fun but important topic of governance, looking at how do we make sure we have verified parties in the ecosystem, making sure that businesses are meeting requirements, but also making sure that sort of standards are maintained and the future roadmap and growth strategy. So the exchange part is a small piece of what we do, which is helping bridge that data transfer and wrapped around that is a whole ecosystem of trust.

Riley Hughes: Got it. That makes a lot of sense. And I’d love to dive deeper into some of those more often overlooked elements, but also important elements of governance and standardization and stuff like that a little bit later on. But first I want to dig into sort of the core of the platform, which I understand to be sort of built in conjunction with the big four Australian banks or in some partnership with some of these banks. Do I have that right? Or maybe could you elaborate on these trusted sources of data? What are those today, and what do you envision those being over time?

Andrew Black: Yeah, we’ve been building with the major four banks. So in Australia, there’s four large banks, but also a lot of other financial institutions outside of those big four. But we’ve been partnering with them over the last sort of three years or so to bring this to market. So we’ve been working really closely with banks, but also with state governments here as well, as well as the federal government, to build, I guess, those trust anchors. And that’s why we use the word bridge a little bit as well. They’re sort of trust islands of verified data. So some of those other issuers or ecosystem players include banks, but also ConnectID is accredited under what we call trusted digital identity framework, which is the federal government’s ecosystem or federal government’s draft framework for rules of the road here in Australia, which is hopefully going through next year.

Andrew Black: And that also provides a set of transparencies to who else that could be, really importantly allowing customers choice of who they would like their identity provider to be, but having a really clear set of transparent rules and transparent set of eligibility to meet that. So we take our lead a lot of the time from customer research and thinking about, well, who do customers expect that to be and want that to be? And that’s often major banks, state governments, and also telcos. One of the things that, in terms of those roles we’ve been trying to do and roles we’ve been trying to build out and why banks are really important is also the ability to use it, the product, right? So when we think about the, I guess, multi-sided market that we’re all trying to build in the digital identity world, having the ability for customers to use ConnectID from day one because they’re already banked with a major provider is sort of circa 80% of the Australian population being able to use that capability.

Andrew Black: So that coverage challenge and the sort of scaling challenge is really appealing for relying parties in terms of being able to have their customers use the product. But also for customers, knowing there’s nothing new to sign up for, right? I can just select my bank that I already bank with, I already trust, and I already have an account and a digital service with.

Riley Hughes: I want to get into the relying party segments a little bit, but first, just to close the loop on how this relates to the banks, how should I think about what you’re building relative to things like BankID in Sweden or Itsme in Belgium or these other sort of bank-based identity services we’re seeing? Maybe how do you sort of differ and also align with some of these other types of approaches?

Andrew Black: Yeah, so a couple of similarities and then a few differentiators for our approach. We very much have built the platform and the capability and our value proposition on ConnectID not being in the middle of the transaction, so not seeing any data, not storing any data, not seeing any PII at all, right? And that’s particularly vital in Australia at the minute, where unfortunately, probably data breach capital of the world over the last sort of 12, 18 months, which is not a fun title to hold, but you kind of get it nonetheless. So that kind of conscious decision from us to not add any more data sources and not add anything else is where we differ a little bit from some of those exchanges. But some of the other similarities for us is it’s fundamental to have customer choice. So by onboarding banks, but also sort of government and other trusted third-party providers, you allow customers to choose who they want to use as their identity provider.

Andrew Black: Having that choice and not forcing them to set up a new app or sign up to something new is a key differentiator, especially in comparison to other domestic players and global markets. And that kind of really for us as well sits a lot in that governance and framework and standards, and where we’re different but also have a little bit of an edge is our sort of trusted history in doing networks and schemes. So Australian Payment Plus, which we’re a part of, has run the domestic payment infrastructure in Australia for I own 40 years. So that’s a mixture of debit payments, account payments, bill payments. So it’s already trusted by banks, by major retailers, by tens of thousands of merchants to process payments and process a value exchange payments instead of identity. But it’s also that sort of natural step for us to help play that role in effectively developing national infrastructure.

Riley Hughes: Awesome. Yeah, that’s really helpful. If you’re not seeing or storing PII at all, you know, it really makes that bridge analogy more concrete. You know, we see a lot of these domestic schemes or schemes around the world. Often they’re influenced by the cultures and the unique idiosyncrasies of each region, but oftentimes they’re influenced by maybe some things that the government is doing. So I guess how much of what you are building is a product of resulting from initiatives by the government to kind of usher in a new age of digital identity versus the big four banks and other issuers or data sources that you’ve described getting together of their own volition and agreeing on a scheme here that they want to buy into.

Andrew Black: Yeah, so it’s probably a little bit more towards the latter. So government have done a really good job, and the federal government here, of helping put together sort of a draft framework of what that looks like, what their vision for a digital economy really looks like for Australia, and also where they see sort of the real value areas. But it serves as a really strong baseline, but as that as a baseline. So where we think the partnership in particular with banks is really strong is the effort, time, investment that those organisations put into security, into fraud management, into their armies of technical teams and security teams that help support their day-to-day capabilities and the investment they put into that as well. So coming back to the why as well, customers are already telling banks they expect them to do this. They’re already telling us they expect to be able to use this.

Andrew Black: We see a world, and this is why in particular we’re accredited by the government under that framework, so we’re the first digital identity exchange to be accredited, where there’s a really strong public-private interoperability. There’ll be some sectors that government will mandate use cases or help align regulation, in particular things like financial services, so where there’s already really strict requirements on KYC and anti-terrorism sort of regulation. Government will play a really vital role in making sure that there’s equivalence of actually using paper, plastic versions today or reusable digital identity and that sort of layer of equivalence. But there’ll be a lot of sectors that sort of won’t be touched by that, and that’s where banks and ourselves are trying to help drive standards, right, and trying to help drive a little bit of a thought change of data minimisation. Government won’t, I wouldn’t imagine, mandate that you should share is over 18 flag instead of a date of birth.

Andrew Black: But that’s something that we will do with businesses and help to share that, I guess, real vision for why do you need to store that information in the first place? And that’s actually, again, as a result of some of the big breaches we’ve had, that shift internally in businesses of, do I even need to store that data anymore? And actually, I don’t want it. I just want a verification or a zero knowledge proof rather than the raw data. So that’s where I think the network, the ecosystem has a real role to play in helping drive forward maybe the pace, but sitting really perfectly alongside a strong sort of government framework as well. Something that we sort of hear from customers is, what’s the role of a scheme, right? What’s the role of a network? What’s the purpose of it? And it’s sort of providing, think about as a road bridge, thinking about the ability to set rules and standards. Again, not the most fun conversation point at times, but actually that everybody should wear a seatbelt.

Andrew Black: There’s certain requirements and safety standards for cars, but individuals choose which car they want to drive, right? And there’s different jurisdictional changes, and in Germany you drive a slightly different speed than you would in Australia. But there’s a common set of understanding of the infrastructure needed and the rules of the road, I guess, for lack of a better description, right? So choice is vital for us, for customers to choose which organization they want to use, but it doesn’t come as a Wild West. There’s got to be confidence for businesses and confidence for customers that any data sharing is done in a trusted and, I guess, managed way, right?

Riley Hughes: You know, when I think about the kinds of providers that you’re talking about, like banks, state governments, telcos, etc., you know, there’s a lot of really useful applications of that kind of data. We were just alluding to kind of your customers and the customer conversations that you’re having. I wonder, what are those first relying parties, or what are those first use cases that you’re targeting? Because it feels like there’s this tension with identity. It’s so fundamental to everything we do. There’s this temptation to want to do it all. And on the other hand, I see companies really succeeding that are really doubling down and focusing on getting really, really good at a specific thing. And so I wonder how you’ve thought about that dynamic when you have access to such a broad both distribution through the partners that you do have, as well as the usefulness of all that data. How do you think about, you know, segmenting all of the possibilities and the focus versus breadth trade-off?

Andrew Black: Yeah, it’s a really good question and a challenge of a question we’ve wrestled with over the last few years as we’ve been planning that go-to-market. But where we’ve sort of landed is thinking about actually picking a couple of sectors, a couple of verticals that do a few different things to demonstrate the viability and use of the network. What I mean by that is rental and real estate as a high paper, high friction journey, but one that you don’t go through that often, right? You rent an apartment maybe every year or 18 months or two years, so it’s a lower touchpoint, but it’s a huge value opportunity for businesses and for real estate agents. Similar vein, we’ve also looked at and we’ll be launching with employee onboarding. Again, a really sort of natural one that I think lends well to identity and also the credentials space as well, thinking about the proof and entitlements to onboard and access the new job. But then the third, which is on a slightly different end, is e-commerce.

Andrew Black: So we have a lot of partners in the payments arms of the business as well that support e-commerce and merchants as a sort of bread and butter capability, and that is one where You sort of are able to transition even further away to sharing less data, but a high frequency sort of use case. So those are the three that we sort of focused in on to help demonstrate value. The three that we’ve had the most inbound inquiries, as much as anything else, to be honest, as well, where it sort of helps provide that capability proof point, but also for individuals who start to see the service, will see it more often in e-commerce, but also will be able to see those sort of key moments and key life moments around employee onboarding and rental, and hopefully make those significantly easier.

Riley Hughes: Yeah, that’s interesting. I usually see kind of one or the other with either a really impactful, high-value, infrequent life moment, like a major purchase like a home or a car or an employee onboarding. You know, you don’t do that kind of stuff every day, versus something that you are doing frequently like e-commerce or entertainment or other things like that. It’s interesting that you’ve kind of gone down both routes and that you’re seeing traction in both. Is the service differentiated at all between the two, or is it a service that is pretty much the same experience regardless of whether it’s a high-frequency case versus a low-frequency case?

Andrew Black: The customer experience looks very similar, and then it’s more about the data required to fulfill each transaction. So if you, say, go to checkout or you’re setting up a new account with an e-commerce provider, normally today you punch in the information, you potentially scan a driving license or upload a document.

Riley Hughes: That’s my favorite thing to do, by the way. Whenever somebody makes me scan my driver’s license, I just shout with joy because it’s so much fun. No, I’m teasing.

Andrew Black: Oh, it’s great, isn’t it? As somebody who got the holy trinity of three data breaches last year, I managed to tick all the boxes of my driver’s license being out in the wild, which has been changed now for anyone who fancies trying to hack me. But exactly, right? So we’ve been trying to help businesses understand they don’t need to capture that. But for customers… Their experience of even just the manual form filling is pretty rubbish, right? Nobody really enjoys or wants to use signing up with Facebook or Google at times, but it’s convenient. So convenience is great. Everyone supports convenience, and it’s sort of where we naturally sleepwalk into using those types of services at times. So what we’ll do is allow you to verify with ConnectID. So you’ll click on that button on the ecom site. You’ll see what we call our identity selector, where you can choose from that trusted source. So you could choose one of your banks, you could choose a state government when they come online, or another trusted provider. And then when you click on that, you go to their experience.

Andrew Black: So if it’s your bank, you’ll go to their mobile app. You’ll be asked to log in, authenticate in the same way you would today. So it’s a trusted, familiar experience of either PIN, password, or biometric, or sort of auth point of login, and then be displayed the data being requested. So maybe your name, it may be an over 18 flag, maybe contact information as well for shipping purposes, but you’ll see that in the banking app, and then be asked to consent. So then there’s an express consent. So again, customer’s always in control and has a sort of sense of, I guess, transparency as to what’s being shared. You’ll click consent, and then you’ll be directed back to the ecom site with verified information and able to progress with the checkout. And that sounds like a lot in terms of me explaining it, but it’s four clicks, right?

Andrew Black: When you think about it from a customer point of view, there’s no new app to sign up, and that’s why we’ve been looking at, I guess, a couple of different sectors and been able to look at a couple of different sectors, because a lot of the challenge, I guess, is how do you also bring on board a big user base? And we’re really fortunate with our partners that we start with a big, high user base, so we can then help support a few of those different sectors from day one with confidence.

Riley Hughes: Yeah, that makes sense. I’ve used open banking products like Plaid or something like that to connect a bank account to a fintech, but it sounds a little bit similar to that, where I’m shown a screen of all the possible bank accounts that I could select. I go through that flow, I log into the bank, I consent to sharing, you know, my checking account details or whatever it is, and then it kind of routes me back to the original spot. Is that roughly the kind of model I should think about when I’m thinking about the ConnectID user experience?

Andrew Black: Yeah, it’s a similar flow. The— benefit versus open banking, and top this a little bit more, but is that open banking, a lot of those experiences are regulated in the way they have to be offered. So it’s a mandated customer flow, mandated set of data fields that have to be shared. Because what we’re doing is, I guess, opt-in and voluntary, we have a set of minimum standards that we expect from our partners, but they can innovate and develop on top of that to make it a better experience than some of the open banking flows today.

Riley Hughes: Got it. Very cool. From a user experience perspective, how do you think about identity wallets? It sounds like the experience that you’re describing is a bit different than a dedicated app or identity wallet app or something, right? And I wonder how you see the user experience provided by ConnectID versus an identity wallet.

Andrew Black: Yeah, so we do, and we think about it quite a lot. And when I talk about it with customers, and even conversations like this, I deliberately don’t talk that much about the technology because the role we have to play is providing an interoperable network and a trust network. Now that today is starting with more OIDC-based sort of transactions, but actually our role is to be agnostic in the future, whether that’s a trusted third-party verifiable wallet or a wallet that sits inside a banking app as well. Being able to share claims and whether they’re verifiable credentials or not shouldn’t be a constraint for us, and that’s very much our direction of travel. Because then again, it’s customer choice. So the ability to store an issuer into a third-party wallet, again, rules of the road and making sure they’re trusted and providing security for their customers. But that’s absolutely an ecosystem that we’ll be, yeah, hoping to build over the coming years as we launch.

Riley Hughes: It sounds like then, imagine a future where everyone has an identity wallet, or maybe more than one. And it sounds like ConnectID would be a bridge to sort of help relying parties get to the right wallet with consumer consent, as opposed to ConnectID being a wallet itself. Am I thinking about that right, or do you think there’s a role for ConnectID to also be the wallet for consumers?

Andrew Black: You’re thinking about it right. So I think our primary role is provide the bridge, provide the platform, provide the ecosystem for others to develop cool products and infrastructure. What we sort of do really well at the moment is providing that capability to partners. So we see some of those partners might develop wallets in the future, some of those existing partners maybe in the future as well. Who knows? I guess as this market sort of emerges and demands, maybe there’s a demand for a ConnectID wallet, but that’s not our sort of core focus today.

Riley Hughes: Yeah, so one topic that’s always really interesting to explore with people is how mobile driver’s licenses and government-issued identity documents will interplay with their strategy. But I don’t know if that’s a very interesting conversation to have with you, because it sounds like the answer is pretty straightforward. It’s like the government-issued ID is just one option in the identity selector screen for an individual to choose to fulfill a relying party request, and it’s that simple. Is that right?

Andrew Black: That’s it, yeah. It’s not interesting because I think we hopefully see it as a complement rather than a threat, and also the future of, for Australia having eight different states and territories, helping those interoperate. For our banks, what we hear a lot is actually I want to be able to ingest a driving license from New South Wales or from Queensland, and I don’t want to have to figure out how to integrate in different standards because they’re all building to slightly different standards. That’s again kind of the role that we have to step up and play and provide that translation layer. So that’s the kind of key for us.

Riley Hughes: I would imagine that one of the challenges of working with both high-frequency use cases like e-commerce and high-risk, high-assurance, big-deal transactions like onboarding into a job is that with an e-commerce transaction as a consumer, I might want the most seamless UX possible. And with a rental application or something, if I’m sharing enough sensitive data, I might actually think twice about an experience that’s just so seamless. You know, it might make me feel a little bit better if I have to jump through another hoop or two. How do you maybe think about the right level of friction to introduce into an interaction?

Andrew Black: We call it positive friction, because for that exact point, actually, there’s a lot of customers who would love to be challenged more, and especially in the scam sort of world. So our base capability comes with bank-grade auth. So thinking about that sort of point of login, that gives you confidence that not only it’s Andrew’s date of birth and Andrew’s information being shared, but it was Andrew logged in and consented at that point in time. So that’s, I guess, sort of base-grade, vanilla, strong capability. But those other high-value transactions is where, again, biased, but reason why we’re doing what we’re doing with banks is they do a great job at that step-up. So where there’s already a challenge, where there’s already a high-value payment, thinking about is that another form of multi-factor authentication or is it a, maybe in the future, maybe there’s a delay in the sort of transaction time of actually maybe have a think for an hour before you send this amount of money to somewhere else. But those organizations already do an awesome job at that.

Andrew Black: So when we onboard relying parties, look at what’s their use case, what’s their minimum data required to help fulfill that use case. But then also with the strength of banks and others, they have a whole heap of rules around their customer set. If X behavior has been detected, maybe we challenge that person again because there’s suspicious activity that’s gone on. So positive friction is a huge sort of feature where actually more customers and a lot of those high-value transactions are asking for it.

Riley Hughes: Yeah, that’s a fascinating concept, the positive friction. You know, I think digital identity is really a uniquely objectionable kind of technology. It feels like there are limitless reasons why someone could object to implementing a new kind of digital identity, all the way from privacy to security to user experience to, you know, it’s the front door of the application to whatever. So I thought it would be interesting if I just threw a couple. of common objections to identity products at you, and then you tell me how ConnectID would answer some of these questions. Does that sound good?

Andrew Black: Depends on the questions, Rory, but go for it.

Riley Hughes: Yeah. Okay. So one common thing that I hear about with portable data is that my identity provider, or the identity provider you’re routing me to, is bank number one. And the destination, the relying party that I’m trying to authenticate to, is actually bank number two. Bank number one maybe doesn’t want me to share my data with bank number two because there’s a competitive dynamic there. As ConnectID, how do you resolve this concern? How do you prevent situations where an identity provider maybe doesn’t want to make their data portable for certain use cases, but they do want to make it portable for others?

Andrew Black: That comes back to rules of the road for us, right? So when you join the network and you join the scheme, our rules are pretty clear that you can’t refuse that type of transaction based on the relying party. Now, we have certain rules around if there’s suspicious activity or fraudulent behavior, if there’s certain sectors that we probably won’t onboard in the early years. But once a relying party has been onboarded into the network and the use case has been validated and we’ve been through corporate due diligence, bank one can’t say no to bank two.

Riley Hughes: Great. What if the relying party is someone that I, as an individual, think is a valid relying party, but actually it’s a Russian hacker pretending to be a valid relying party? They’ve spun up a website that looks convincing, and maybe they’ve used some generative AI to create a really slick-looking logo for their website or whatever. How do you prevent against that kind of an attack?

Andrew Black: So relying parties have to actually onboard into the ConnectID platform and registry and be set up. So that involves going through a lot of corporate due diligence, a lot of security checks, procedural checks. It’s harder depending on the size of business you are. We make sure we cater for small, medium-sized organisations as well. But a Russian hacker wouldn’t be onboarded in the first place. So thinking about the bridge, they wouldn’t have the endpoint to be able to actually call into our network to consume that information. And that’s one of the, I guess, benefits and roles for us as the traffic cops, right? Who to let in, who not.

Riley Hughes: Awesome. The next one I have is: when I share my data with a relying party, suppose it is to transact with some age-restricted product or something that maybe I don’t want the identity provider to know where I’m using it. If I am driving on the bridge back to the identity provider with every authentication, is there a privacy concern with that type of a phone home mechanism, or are you doing something there to add some level of privacy or obscurity to the platform?

Andrew Black: There’s a way we think about privacy and trust together. As an individual, I want to be able to share the minimum amount of data possible, but also I want to typically have a record of what I’ve shared, where and when. So banks provide that. They provide that sort of consent log and history. But what we put as requirements on banks are what they can and can’t do with that information. So what you can’t do is use the fact that Riley’s been out buying booze every night of the week to prove he’s over 18 to do so to impact a lending decision, or thinking about the different places you’ve checked in, or actually that you’ve taken out three other bank products or a couple of the credit cards elsewhere, and then you’re going to get less favourable customer service as a result. So there’s requirements on what you can and can’t do with that data and the profiling of that information.

Andrew Black: So that’s where we sort of try to strike that balance in providing comfort and trust to customers that it’s only used for the purposes of sharing, consenting, and not for additional services or marketing or anything.

Riley Hughes: That’s a legal constraint then, similar to the constraint that, you know, the bank can’t use more than X percent of my funds to invest in risky assets. And I think if anybody’s going to follow some of those legal constraints, it’s going to be banks. And so I think that makes a lot of sense. So what if I share my data with a relying party? Suppose it’s an e-commerce transaction and I share my address from my financial institution, but the data is wrong and I actually moved and I didn’t tell my financial institution, and now there’s a mess. And somebody lost money and somebody’s angry and they want to point a finger. Who’s to blame for this? Is it the relying party that bears that risk? Is it the network, the traffic police that sort of need to bear that liability to make sure that the data going over the rails is correct? Is it the identity provider? Help me understand that.

Andrew Black: So we provide, I guess, the ability for customers to edit or review that data during the transaction for that reason. So when you go into the banking app, for example, you’ll see what your address is. And if that’s wrong, provide the ability to update that using, again, the controls that banks add, depending then on the transaction as well and the relying party, and whether that’s a legally required data point or whether it’s just to deliver home your online shopping, we also make some of those fields editable. So if actually you want it delivered to work instead of delivered home, that’s a kind of configuration for the relying party to say what’s mandatory and non-editable, and then what’s editable as a data field. So that’s where we try and control that and give the customer choice. We have requirements on what identity providers have to have done to… Effectively establish your identity. And assuming if they’ve made mistakes there and they haven’t done that correctly, then liability will sit with them.

Andrew Black: But our liability framework sits around that proof of sort of establishing the identity, establishing the data point, and making sure that the individual is given the opportunity to review it as well.

Riley Hughes: Suppose I decide I want everyone to forget my data, forget I exist. I want to move out into the middle of nowhere and live off the land, off the grid, whatever. As a user, is it possible for me to somehow go and tell everybody to forget the connections that I’ve made with them, even though I didn’t create an account with ConnectID, it sounds like? Is there a mechanism for me to do that in some central way, or how might I go about that? And then maybe similar. similarly, if, you know, God forbid something happened to ConnectID as an entity or as a corporation and it was to go away, what then happens to the connections that I’ve made between relying parties and identity providers?

Andrew Black: That’s sort of why we’ve tried to play the role as much out of the way as possible. So created the infrastructure to allow organizations to connect peer to peer in that sort of distributed network. I think we’re fairly invaluable, but we’re probably swappable, right? Someone else could do that if need be. They won’t, because we’re great, but nobody else. That capability of being able to provide that technical capability is one thing, but the rules and governance and everything’s in place to be able to do that. As an individual, today you would have to go and tell those places you’ve connected to discard you, get rid of you, so you can move to the woods. So it sort of mirrors a little bit today’s process in terms of there’s not quite the revocation. You would need to go to the bank, cancel your account. You go to Airbnb, cancel your account. Go to the online booze retailer, cancel your account. So it’s still a similar challenge as today. The benefit, I guess, is that they would have less information on you in the first place.

Andrew Black: So the alcohol provider isn’t holding your driving license, just holding that you’re over 18.

Riley Hughes: Well, you know, I don’t know how those questions felt on your end, but it feels like you’ve got a lot of good answers, so appreciate you humoring me with that little exercise there.

Andrew Black: I would like to do the same to you at some point.

Riley Hughes: Yeah. Well, I love leaving these podcast conversations smarter than I came into them, and I keep talking about everywhere how verifiable credentials are doing for personal data what— Open banking did for, you know, financial data. And, you know, I wonder if you could, like, add any nuance to that. Tell me where I’m wrong. Where is that not the case? Where are these things fundamentally different, and what caveats should I be giving when I make that statement?

Andrew Black: It’s a good statement, and I think that it’s thinking about that, I think, as an evolution rather than the same, right? So there’s a lot of differences, not only things like open banking being mandated, which comes with challenges of its own, and thinking about the information that has to be shared. There’s an oversharing of data when it comes to open banking, so you get seven years of transaction history rather than just checking a transaction or getting an attribute back. So for me, I think about it for SSI and for verifiable credentials as a, I guess, an evolution, right? It’s eras. So we’ve gone from centralized data tipping into open data or open finance. The opportunities, I think, for VCs and for businesses building solutions and capability is there is a real shift in restricting the amount of data that has to be shared and granular consent and granular data sharing rather than the mass data sharing that open banking sort of proliferates today. One of the reasons we focus on a broader sort of spectrum of use cases is verifiable credentials and identity is economy-wide, right?

Andrew Black: It could touch pretty much any sector or any segment, and you know this from the work you’re doing. But open banking, open finance is pretty finite in terms of financial services. Its intent was to help neo banks compete. In particular, that’s why in the UK it comes from the Competition and Markets Authority, and to show you sort of the equivalent. It’s effectively to open up banks to help them compete more. But that also presumes customers want to switch and want to use new products. So I think where verifiable credentials has a really strong opportunity is flipping it and looking at, well, where’s the demand? What are the use cases? Where to focus? Rather than just focusing on a regulatory framework of data out and build it and hopefully they will come, it’s actually, I think, helping find those use cases and making sure there’s that really clear focus on minimal privacy-preserving verifiable data, rather than the seven-year transaction history that you get if I share my banking consent.

Riley Hughes: I think one mental model to use to think about verifiable credentials is that they’ve maybe leapfrogged a bit in terms of the technological sophistication beyond where open banking is and into where the future of data sharing lies. At the same time, I’m sure there’s a lot that the identity industry can learn from open banking. What do you think that the SSI crowd or the verifiable credential community, including us at Trinsic, can learn from open banking? What should we be learning from and what should we be leapfrogging, I guess is the question.

Andrew Black: I think one of the learnings, and I guess SSI is probably experiencing this as well, is that adoption curve is pretty long, right? So open banking in a variety of different countries, some doing better than others, has been in the UK sort of six, seven years really, and adoption is still fairly low. Australia sort of three years, adoption is fairly non-existent, some would argue. There’s an element of patience and time, which is sometimes not a fun learning, but is still a learning nonetheless. But also how building things for consumers they really want and really need is vital, but doing it together is even more important. So that’s where we’ve lent in, in particular to a collaboration model and having partners of issuers, of verifiers, finding ways to help banks, help large organisations meet their needs and their targets and reuse some of their stuff where possible as well. There’s always opportunities there to how do you help people be efficient and sort of cost-effective in building new capability.

Andrew Black: So really for me, the learnings would be around picking good target use cases and finding great people to collaborate with. Open banking has very much been a regulatory driver for banks to open things up and hope that people will build things. I think the hope part is really a bridge in the adoption curve. It’s looking for where does it really benefit, and where’s the real demand from businesses to consume, or data holders or data recipients, to use the service. So yeah, I think it’s more of what you’re doing, Ryan, a lot of collaboration, building trust layers, and helping other people build cool stuff on top.

Riley Hughes: Yeah, I do think, though, I don’t know if this is pushing back or just building on what you’ve said, but I do see a bit of a parallel from an adoption perspective here, where I’ve been in the verifiable credential space. for approaching six years, I think, in a month or so. And I remember in my very first interview at the Sovrin Foundation, where I had my first job in the space, hearing estimates of credit unions going to be onboarding, you know, a million-plus users within X number of months or whatever, and, you know, grand visions of what adoption would look like. And, you know, when we fast forward six years into the future, there’s been adoption wins for sure, and I don’t want to minimize those, but there’s definitely been some expectations and some targets that have been missed.

Riley Hughes: And at the same time, if we take a minute to maybe draw a parallel between the lack of adoption of regulation-driven open banking and standards-driven interoperable identity, if I then look back to the financial sector and look at tools such as Plaid and Stripe Connected Accounts and MX and Finicity and other aggregators and other parties that are not open banking in the sense that they’re not standardized, they’re not truly open, but they are proxying that role, they are basically solving a very similar problem that open banking sets out to solve, but they’re doing it in maybe a proprietary way. And then if I look at the identity sphere, I see a lot of proprietary, basically things that look a lot like SSI or an identity wallet, if you squint, even some of which call themselves identity wallets, but that are totally proprietary closed ecosystems that actually have quite a bit more adoption than the standards-based verifiable credential approaches that we see emerging. Do you see this the same way, or would you adjust my thinking at all or push back on the way I’m framing this?

Riley Hughes: But then how do you think about balancing basically Getting pragmatic solutions out to solve problems in a way that is maybe just running full steam ahead and targeting the customer problem first, versus balancing those interoperability and standardization ambitions that we all have about kind of the future we want to live in.

Andrew Black: Maybe it’s my Scottish natural optimism that doesn’t usually sound do, but I think we can do a bit of both, right? So our network is built on open standards. We do a lot of work with OpenID Foundation, adopting global standards such as FAPI and FAPI 2 around security. So we’re not trying to build anything that’s bespoke. We have that sort of wrapper of trust and rules and standards around what that looks like. But technically for us, it’s reusing what’s existing and what’s already there. And that’s where we think the way to allow then others to build things and provide awesome services in the network, but also try to close that adoption gap. We are able to shorten the ability for businesses to join and build on top of the network because in large parts, they’ve already built things to those standards in the past. So we kind of help fast-track some of that, but also making it really easy to integrate because if you’re familiar with some of those standards and some of those fairly common patterns, then it’s pretty easy to do so.

Andrew Black: So I don’t know if that answers your question, but I think there’s a sweet spot for doing both. And I think the opportunity really to start helping businesses and helping customers in an open, transparent, interoperable way. I don’t think they need to be exclusive. So there’s a strong opportunity to do a bit of both, and that’s where the collaboration piece kind of comes in pretty heavily as well.

Riley Hughes: I think when the two come in conflict, it is becoming clear to me that customer need, customer problem solving, right, those need to be sort of first and foremost. And then to the extent that you can bring standards in to make that stronger, I think that’s where you really get into the sweet spot. I guess what I hope to see is governments making smart rules and building smart frameworks around digital identity, you know, including requiring things like interoperability and standardization and compatibility, privacy, and the kind of things that they want to see. And hopefully by creating those frameworks, the market will adapt and will conform to those standards. And I think that’s probably the right way to approach it. And so, you know, there are a handful of governments out there who’ve done a good job at this, and hope we see more of that across the world. One question that we like to ask everybody who comes on the podcast is, tell me what the future of identity looks like to you and why that matters for the world.

Riley Hughes: What does ConnectID look like in 10 years, 20 years, 100 years, and what does that enable for the digital economy in Australia and beyond?

Andrew Black: Wow, hefty question to finish. I’m always nervous of predicting what it’s going to look like, but what I guess I’m hopeful for what we get to, and in particular for me, is something that’s portable, something that actually moves to a point of me not needing to provide anything to verify something about me. This is a bomb to drop in for 30 seconds left, but it’s organizational identity as well, and around permissions, entitlements. We’re very much at day one for ConnectID. It’s a strong day one, but very much a day one in terms of what we’re building. But the pathway and the ability to be able to have individuals verify identities of organizations, be able to set permissions for others to act on their behalf, the sort of delegations and power of attorney world, I think there’s a huge, huge problem to solve there, and a complex one to do that.

Andrew Black: But I think that we’re starting to scratch the surface there and having a world where you can verify whether an organization is real, whether a human is real in the future, and developing AI worlds, and the entitlements and permissions and credentials as we sort of enter into Web3 world is going to be. Exciting. So I don’t know if I know what it looks like, but I just hope that we solve it.

Riley Hughes: Well, this has been an awesome conversation, Andrew. I’ve loved catching up with you and diving into some of these topics. You know, do you have anything to plug? If people want to learn more, if people are interested in potentially becoming an identity provider or a relying party in your ecosystem, you know, where should they find you? How should they get in touch? What would you recommend?

Andrew Black: LinkedIn, you can always find me, Andrew Black, or connectid.com.au is where you’ll find a little bit more about what we’re doing. We’ll be launching after sort of three years of building out with some of those kind of key banking partners in the next couple of months. So the rest of 2023 is pretty exciting, so feel free to reach out.

Riley Hughes: Well, congrats on the launch plans and wish you the best there. Hope that all goes well. And again, appreciate you very much for coming on the podcast.

Andrew Black: Awesome. Thanks, Riley. Really good to catch up.

Riley Hughes: Well, thanks for listening. You can find us on YouTube, Apple, Spotify, and wherever else you listen to podcasts. Feel free to reach out on Twitter at Trinsic underscore ID and me at Riley P Hughes, and visit Trinsic if you’re interested in building the ID tech products of the future. Subscribe to get new episodes as they drop.