Latest / Identity at the Center / #380 - Unpacking Bias and AI in Identity Systems with Sebastian Rohr

Transcript

#380 - Unpacking Bias and AI in Identity Systems with Sebastian Rohr · Identity at the Center

0:04
This is Identity at the Center. Welcome to the Identity at the
0:12
Center podcast. I'm Jim McDonald.
0:14
Unfortunately, Jeff Sedman was not made able to make it to this
0:17
episode. He's traveling, he's on his 20th
0:20
wedding anniversary, so I recommend everybody DM him and
0:24
just congratulate him on that. Him and his wife on that major
0:28
milestone. Actually, it's a bigger
0:30
milestone for his wife because she was able to put up with him
0:33
for 20 plus years and I think that's quite the accomplishment.
0:37
So yay, Barb Yeah, having fun with that.
0:40
But we'll be back together next week.
0:43
Jeff and I are doing the Fido feud at the Authenticate
0:46
conference. By the time you're hearing this,
0:48
that will be in the past. But it's something that if we
0:51
can capture the video and audio, we'll be putting it out here.
0:55
It's it's always something fun. It'll be a little extra episode
0:59
for our our listeners. So today we've got a really fun
1:03
episode. You know, I always think of the
1:06
identity of the Center podcast as an international phenomenon.
1:11
It's maybe not a phenomenon, but we've got a global listener base
1:15
and we definitely pay a lot of respect to that.
1:19
And we really appreciate all of our listeners inside the US and
1:23
outside the US. Like we've appreciate all of
1:26
you, but it's great that so many people TuneIn and we try to keep
1:31
this so that we don't become too US centric or to US focus.
1:38
And you know, to that end, last year, Jeff and I went to the
1:43
Cooper Coal conference in the the European Identity and Cloud
1:49
conference in Berlin, Germany. And there's somebody that we've
1:54
seen for multiple times and we've always been talking about
1:58
getting him on the podcast. Well, guess what?
2:00
Today is that day. I wanted to introduce Sebastian
2:05
Rohr. He's the chief troublemaker over
2:08
at Umbrella Labs. Welcome to the show, Sebastian.
2:12
Thanks for having me and I am really humbled, proud, honored.
2:19
I've been following the show for quite some time and I really
2:22
love what you do for the community.
2:25
So yeah, I, I was really, really itching, scratching to to be a
2:31
part of the phenomenon. Yes, it is one.
2:33
And yes, you have multiple fans here in Europe and I really love
2:37
that you were able to bring your entourage over to Europe for the
2:44
identity at the center. Euro Tour 2025, seeing in in
2:50
Berlin and also having one of our little breakout sessions and
2:55
the Beer barn, that was definitely highlight.
2:59
Yeah. Thank you very much.
3:01
And by the way, our entourage is myself and Jeff and but we did
3:05
make it out to the identifier. I think that's what you're
3:07
referring to. Exactly the.
3:11
You know, I wanted to make sure, you know, before every episode
3:13
to make sure that our a guest has a drink nearby in case you
3:18
get choked up. I mean, identity is such a
3:21
emotional topic that you might get choked up as you're
3:24
speaking. Do you have something to drink?
3:25
I wouldn't be who I am if I had one of those around.
3:29
That's the famous identity here. I'm holding into the camera.
3:33
For those of you guys who are listening only, it's been a
3:38
pleasure to to have my own drink with me.
3:42
Yeah, my my own brand of drinks, and that's going to keep my
3:48
throat lubricated for the next minutes.
3:52
OK, good. And so you wanted to make sure
3:55
that everybody knew was after 5:00 PM in Germany.
3:58
So it was OK that you cracked into the alcohol.
4:02
You know, it's well endorsed by me.
4:04
I think that's fine. If you want to have a beer, it's
4:07
about 9:30 AM where I am. If you want to have a beer right
4:11
now, that's it's 5:00 somewhere, right?
4:14
Yeah, it's, it's, it's actually 4:00 because it it rhymes beer
4:19
and fear. So beer and four are are the
4:23
words. So we always say no beer before
4:25
fear. So that that is ample time.
4:28
I'm, I'm really, really good. I'm already one hour 15 behind
4:32
to to start drinking and to be honest, 9:30 AM would be an
4:37
ample time to have a wheat beer here in Germany.
4:40
In Bavaria too, because there is such a thing called the vice
4:44
versa food sticks. So white sausage breakfast and
4:47
it always goes with salted pretzels and a wheat beer.
4:51
So if you come over to Germany, if you come over to Bavaria, you
4:55
will see people sitting in the beer garden AT93010AM eating a
5:01
vice versa and drinking a a bit. That sounds like an early nap
5:04
for me, like that's going to result in an early nap and then
5:07
I go back out again later. That sounds interesting.
5:11
Maybe I'll have to try that next time in Berlin.
5:13
You should. So we're going to talk a lot
5:16
today about decentralized identity and I'd say is the
5:19
intersection or conversions of real world physical identity and
5:26
this, you know, online identity concept and where it's going
5:30
and, and where it is today and where it will be in the future.
5:34
But it would be remiss of me every time we have a new guest
5:38
on the Identity Center podcast, we want to know what is your
5:41
origin story? How did you get into identity?
5:44
Is this something you chose or did identity choose?
5:48
You so I, I definitely say it's identity chose me because I,
5:51
well, again, for, for, for those of you who are not listening in,
5:55
I'm actually holding up my, my, my badge here from, from my
5:58
employer from back in 1998 when I joined German Siemens
6:02
Corporation. They actually had a product
6:05
called Derrick's Meta directory. I think it's still on the market
6:09
today, sold by Atos or something.
6:11
So it's, it's, it's really old. So I started working with
6:15
identity management products long before they were called
6:19
that way in the late 90s. And I, I still recall that back
6:23
in that day, we had those buggers here.
6:26
I'm holding up a token, an OTP token.
6:28
We had VPN, we had antivirus, we had firewalls.
6:34
And that was it about security. So the concept of having a
6:38
directory service, a meta directory service back in the
6:41
day was really, really, really new and really niche.
6:45
And yeah, somehow that's stuck despite the fact that I got a
6:48
little detour after that going back to to a Research Institute
6:52
for for a few years. I think Identity chose me
6:56
because it it kept pulling me back in no matter what I tried
7:01
to do in the security sector outside of Identity.
7:03
I think it shows most of those. I mean, that's definitely the
7:06
most common response that we get is, you know, especially for
7:09
folks who've been out of of school for the last 20 years.
7:14
Really identity wasn't even much of an industry at that time.
7:18
It was, but there weren't that many people focused on it yet.
7:22
And to your point, you try your hardest to get out of the
7:26
industry. Most people never do and they
7:29
see their benefit in the long run.
7:31
So I wanted to kind of set the stage because you recently did a
7:37
webinar that I picked up and you talked about how I am interferes
7:42
with your life as an individual and I wanted to kind of start
7:46
the conversation right there. What did you mean when you said
7:49
that? So in, in the recent years,
7:53
we've especially here in Europe, but also in the US with the
7:56
mobile driver's license talks, we've seen an uptake in the
8:01
interest of nation states to actual provide a digital
8:06
identity for their citizens. And that started quite a bit
8:13
ago. And I, I will be holding up a
8:17
fake German identity card, which has a nice holographic feature
8:20
on it. It, it switches between a
8:23
lioness and a blonde woman here. And you can see that it actually
8:30
blends out some of the personal information, the PII on that
8:35
document, that partial disclosure and minimum
8:41
disclosure of, of information. That is something that in
8:45
Germany was already being showcased between my former
8:52
employer, the Microsoft Corporation, and the German
8:55
federal government because they wanted to establish the
9:00
electronic identity component of the German ID card.
9:04
So for, for you folks out there in the US, you, you'll have
9:07
drivers licenses and you'll have a password when you travel
9:11
abroad. We in Europe actually have
9:15
digital physical identity cards and it's mandatory to have them.
9:22
You are obliged to have it with you when you hit 16.
9:27
You have to have that on you all the time.
9:31
And those have been extended with digital components over the
9:36
last 1 1/2 decades, I would say almost 2 decades.
9:41
But the adoption, especially here in Germany has been a
9:45
little weak. But in the end, it all boils
9:48
down to the fact that whenever we do digital identity in the
9:52
workforce for customers, it's KYC.
9:56
Know your customer At some point in time during the on boarding
10:02
process, no matter if you are a customer, if you are a supplier,
10:05
if you are an employee, somebody will ask you for some kind of
10:11
legal identity document, a passport, a driver's license, a,
10:16
an ID card. But how do you get that if you
10:19
can't prove to the authorities that you are really Jim
10:23
McDonald? How would you do that in the
10:26
absence of an ID card and a passport?
10:29
Because I don't know, they, they got stolen.
10:32
They, they, you, you lost them. How do you do that?
10:35
How do you prove that you are Jim McDonald?
10:38
Yeah, I mean, this is the core of the conversation, right?
10:41
Because we talked about the podcast reaching a global
10:44
audience. Well, it's not just the Western
10:46
world. So let's Level said, let's talk
10:49
a little bit about how identity verification works in the
10:52
Western world because you kind of touched on a few of the
10:55
concepts, but let's take it and just set that as a baseline.
11:00
Yeah, absolutely. So when we had mail order like
11:08
20 years ago, 2530 years ago, before the Internet, before
11:14
certain large retailers, online retailers became a thing, we had
11:21
those mail order catalogs and I think they were big in the US
11:25
from from the 1800s on. I I think in the wild, Wild
11:28
West, you got those printed mail order catalogues and you could
11:34
buy. Well, for you guys in the US,
11:38
it's absolutely normal that you go into the next Walmart and you
11:41
buy a Winchester three O 8, right?
11:43
Why you can't buy weapons in our grocery stores, but you can buy
11:49
booth and you just have to be 18.
11:52
You can buy beer or wine, you just have to be 16.
11:56
And you got to prove that to the cashier.
11:58
The famous Identity 2 Point O presentation by Descartes from
12:03
the early 2000s showed that quite nicely.
12:05
You you got to show your ID card.
12:07
Unless you do that, you don't get your both.
12:10
How do you do that online? How do you do that with a mail
12:15
order catalog provider? Well, we in Germany had
12:19
something that was called Post Edent.
12:22
So our public post office service, US post service, you
12:28
would walk into that office with a small card that the mail order
12:33
guys sent you and they requested identity verification through a
12:39
trusted third party, which would be the post office clerk.
12:44
So you go up to the to the store clerk and show them your ID and
12:49
they will fill in that form. They will stamp it because well,
12:53
in in Germany, the post office clerks were actually state
12:59
employees. They, they were public servants.
13:01
So they had a certain legit way of, of proving that, that you
13:09
are in fact Jim McDonald, but changed quite a bit in, in the
13:16
last decade, online verification services have been all the rage.
13:21
When I got one of those new fintech bank accounts, I
13:26
installed the app and that was on a Thursday evening, I think
13:30
at 9:00 PM or so. And I, I went through the
13:34
registration and then it asked me, oh, are you in a broadband
13:38
connected house? Yes.
13:41
Do you have your ID or your passport with you?
13:43
Yes. Would you have 5 minutes to
13:46
prove your identity? Is it Yes.
13:48
And so the next thing that happens inside the app, I get a
13:52
video phone call and a guy comes up in a black suit, white shirt,
13:57
black tie and a really, really oversight noise cancellation
14:03
hats that he, he more looked like a counter strike gamer in
14:07
business attire. As I said, it was like 10:00 PM
14:11
in the night. And that's really, really
14:14
strange for, for, for, for Germany because, well, office
14:18
hours are much shorter And well, he, he, he went through that
14:21
whole verification process with me, you know, showing my ID card
14:25
up to my, my hat, turning it around, you know, checking all
14:30
the security features of the ID card and stuff like that.
14:33
And BAM, I was verified next Saturday.
14:37
So it's like 36 hours later, I had my credit card in, in, in
14:41
the post. That was like, wow, I was blown
14:45
away by that. And that whole process is quite
14:48
expensive, as you can imagine. And we've been digging deeper
14:53
into ways of proving documents, vetting documents and making
14:59
really sure that you are really Jim McDonald up to a certain
15:06
level that you you need. And that is quite a high level
15:11
if you want to open a new bank account, but, you know, money
15:14
laundering and stuff like that. So, yeah, it's all about your ID
15:18
card. It's all about your national ID.
15:20
But still, how do you get 1? You lose it.
15:24
Yeah. You've worked a lot with
15:25
identity verification technology over your career.
15:30
And I kind of want to get your feedback because I've mostly had
15:33
positive experiences when I've used it myself.
15:36
But I've also heard from other folks that they've run into
15:40
issues a lot with verifiable credentials and using kind of
15:45
that liveness detection, the selfie scenario, even my own son
15:51
run into a scenario where he tried to open a crypto wallet
15:55
and he couldn't get through the verification process.
15:59
So I, I'm sure there would have been a, you know, it's kind of,
16:05
I feel like I'm getting half the story from him, but he did have
16:07
some pretty dramatic weight loss and he went from, you know, 16
16:11
when he got his driver's license.
16:13
He just turned 18. I know that when I had my
16:18
driver's license done, it was like 8 years until you get a new
16:21
picture and going different places like even TSA folks were
16:26
looking at it or the the security folks were looking at
16:29
it. Like is this really you?
16:31
You look different on my beard is, is thicker now and my
16:35
hairline is always so much better than it was 8 years ago.
16:38
That's not the way hair lights were, by the way.
16:41
No, it it just you look it starts to look different than
16:45
your ID, especially to a human. But I would think that the
16:49
verification systems have trouble with that sometimes too.
16:53
What are your thoughts? Absolutely, absolutely.
16:55
So let me show you another war story on that.
16:57
It's not about the ID card verification, but signature
17:02
verification. So when I got my first bank
17:05
account, I was like 14. I think it's a legal age where
17:10
you got a normal banking and that normal debit banking
17:13
account because well, I needed one for whatever reason or
17:19
getting, getting money wired. That is that that was a thing
17:24
in, in the, in the 1990s in, in Germany already.
17:29
So as you can imagine, being like 14, when you have to sign a
17:33
document, that signature doesn't look like my signature does
17:39
today. So that was my Savings Bank in
17:42
the small village that I grew up.
17:45
And they actually have a signature cart.
17:48
So the actual paper cart that I signed when I opened the account
17:53
when I was 14, of course you do that.
17:55
You forget about it. Fast forward 20 years, I'm
17:59
already moved like 15 times and I'm now like 1000 miles away
18:05
living in a completely different state, still running the bank
18:11
account, but because, well, why, why should I close it?
18:13
It's, it's nice. I, well, I, I knew the branch
18:17
manager personally. So whenever I needed something,
18:21
I just give her a call and she'll arrange everything.
18:24
And you know, we'll, we'll do the formalities later.
18:27
That Lady happens quit at some point in time.
18:32
And so my personal relation is known by the branch manager was
18:39
gone. And they asked me to fax them a
18:44
written transfer note, like like a assigned note that I really
18:51
authorized that transaction. And they called me back and I
18:54
said I'm really, really sorry. We are unable to wire that cash
18:59
because there's a problem with your signature.
19:02
I said what? Yeah, I think you got to come
19:06
back to the branch at some point in time because the signature
19:11
card is from 90, 88 or something like that.
19:16
And yeah, it, it was really a childish signature that that was
19:21
in the records. And of course they weren't able
19:24
to compare that and say, yes, that's Sebastian's signature.
19:27
So yeah, signature verification is a form of identity
19:31
verification in that case. And it failed miserably.
19:35
And yeah, after that I actually went there and said, yeah, we
19:38
have two choices, either I'll give you a new signature, but I
19:42
don't think that makes sense. I'll just close the account.
19:45
So that was that. But today the, the, the problem
19:49
really is if you do not have an ID card or a passport or
19:53
whatever, you need some other legal document to to show who
19:59
you are. And that is usually a birth
20:01
certificate and the the webinar that you are referencing to.
20:09
Was exactly about that and how I have been working in developing
20:13
countries in the last 1 1/2 decades helping them establish
20:18
what they call CRVS services, civil registration and vital
20:23
statistics services. Because unfortunately here in in
20:28
Europe and in North America, US, Canada, we have a birth
20:32
registration rate where 100% of our children actually get a
20:37
birth certificate automatically. But in other parts of the world,
20:41
especially developing countries, especially Latin America, but
20:44
even more so in Southeast Asia and the Indo Pacific, that rate
20:49
is lingering around 5052%. And that's where the growth of
20:56
our Earth's population happens. So there's literally hundreds of
21:01
millions of kids being born in that area who do not have a
21:05
legal identity because they do not have a birth certificate to
21:10
prove that they even exist. And that's bad.
21:13
So let's pick on that a little bit.
21:15
I mean that that does sound like a real challenge.
21:19
What do people do in those scenarios where they don't have
21:23
the birth certificate? Do they just have to kind of
21:27
work their way through the system to get one?
21:30
Obviously not everybody's going to do that, so this is not a
21:33
problem that is going to be solved overnight.
21:35
But I am interested about the individual who is highly
21:39
motivated, maybe wants to go to university or something like
21:43
that. So, so first of all, there is a
21:46
thing that, that's called the United Nations, uh, Sustainable
21:50
Development goals, SDGS and that includes that we should have a
21:56
legal identity for all of the kids.
22:00
So they, they, they have a claim at the UNICEF that says count
22:06
every, make every child count because every child counts,
22:10
every life counts. So they, they, they try to
22:13
improve the, the number of kids being, being registered.
22:18
But unfortunately, if you and, and let's take Pakistan as an
22:22
example, because I was on a UNICEF mission there, many, many
22:28
areas in Pakistan are very rural.
22:31
There is no network, that there is no computer at hand.
22:37
Childbirths are being given at home, not at the hospital.
22:42
When they are at some sort of clinic, day clinic, there is,
22:47
well, there may be electricity, a telephone network, a broadband
22:52
connection, mobile coverage. Not always.
22:56
And literacy of the parents is also a problem.
23:01
If you have to walk a day and a half to register your child
23:07
that's just been born by your wife at home, but you are on a
23:12
day's job and then getting the certificate cost you, I don't
23:16
know ₹700, but you earn ₹500 a day.
23:22
Actually registering your child makes you lose 1 1/2 days of
23:26
work and you have to pay 2 days of work or even more to get the
23:31
certificate. Many people just skip it.
23:34
There's. Got to be a payback, right?
23:36
I mean, if you're going to do that as, and if you live in a
23:39
rural village and you've never used a computer before, it's
23:43
kind of hard to envision why your kids are ever going to need
23:47
those things. You know, like even in the
23:50
Western world, right? We kind of came up in the
23:52
generation where, you know, I've, I've kind of almost begged
23:56
my dad to buy me a computer. He just thought it was a video
24:00
game system. And maybe that's how I would
24:02
have started to use it. I was a, you know, 13 or 14, but
24:06
I really wanted to get a computer because I wanted to get
24:10
in and do programming and stuff like that.
24:12
But in his mind, it was like, that's a game.
24:16
That's not something that's important to your future.
24:18
So you can imagine how those parents kind of say, all right,
24:22
well, this is going to cost a ton of money, What's the value?
24:26
But. Exactly.
24:27
Things change over time. Absolutely, absolutely.
24:30
And, and The thing is, you know, basic education, I OK, there,
24:37
there is the notion of homeschooling, but I would say
24:40
the majority of children in the Western world, the parents
24:46
receive a letter by the authority saying, oh, I have
24:51
little gym boy here. He, he just turned 6, right.
24:56
So at least that's on the records.
24:58
By the way, school starts in September and we put him in
25:04
North high School. This and this is the address.
25:07
Please make sure he's, he's capable of, of going back and,
25:13
and from school. Let's go if the state, if the
25:17
government does not know that your kid exists because it
25:20
doesn't have a registered verse at that address, who who's going
25:26
to ask that kid to go to school? If you do not have a birth
25:32
registered child, how would you even get basic health care for
25:39
that kid if it ever gets sick? Because what you you, you, that
25:43
kid just doesn't exist. You're in Germany, you are
25:46
mandated for I don't. I think it's like half a dozen
25:55
doctor's office visits with your child.
25:59
If you do not comply, the police will come and get your child to
26:05
that doctor to, to get that medical examination like at, at
26:09
three months, at six months, at one year, at two years and, and,
26:12
and so on. But what if, if the government
26:15
doesn't know that your kid exists?
26:18
How, how can they make that, make that happen?
26:22
If, if there is a famine, you know, just just imagine that the
26:27
United Nations needs to supply food support to Gaza right now
26:33
or to Ukraine. How do you know how many food
26:37
portions, how many rations you need to send there if you do not
26:41
know how many citizens there are?
26:43
And it all boils down to that birth registration.
26:47
If you do not exist in the systems, you cannot be accounted
26:51
for. And that is a real big issue.
26:53
And in the absence of that, while we have some opportunities
26:57
today, it was technology. So Sebastian, I loved how you're
27:00
starting to go into various war stories, or we shouldn't even
27:05
call them war stories since you brought up like the Gaza
27:08
situation. These aren't real war stories,
27:10
by the way. And this is, you know, just
27:13
examples that you've run into in your career.
27:16
So you've done a lot with state issued identification, national
27:21
ID card systems. I was wondering if you could
27:23
share some of the stories that you're sharing with me as we
27:26
were preparing. One was Ecuador.
27:29
So I'll give you that intro, take it from there.
27:32
I I want to hear some real world stories.
27:35
Yeah, but that that was one of the reasons I was later invited
27:41
to to Ecuador. But it all started out in 2010.
27:44
I already had like a good decade of identity management in in the
27:52
records. So the Inter American
27:55
Development Bank, which by the way sits in Washington, was
28:00
asking if I could join a workshop in Jamaica with the
28:07
Government of Jamaica, was a planning institute of the
28:10
Government of Jamaica on establishing Jamaica National ID
28:16
Scheme. Sounds like a work vacation, by
28:18
the way. It, it, it, you know, being in
28:22
Germany going to Kingston, the capital of Jamaica, it is a bit
28:27
tricky. I would actually have had to go
28:30
from Frankfurt to London to Miami to Kingston and that, that
28:35
would have been horribly expensive.
28:36
And you know, that's public service.
28:38
They, they work with very small lump sums.
28:41
And so my, my previous employer at that time coping a call said
28:46
no, can do it. It's going to be a a loss for us
28:50
if we if we send someone. But I said I'm so interested and
28:55
I asked them privately if if I could do that taking time off,
29:01
you know, and they said, well, whatever you like.
29:03
But we still can't pay more than $5000 for, for the whole thing
29:09
that's covering all said, OK, good.
29:11
And I figured, and this is the fun thing about it, Jim, of
29:17
course Jamaica is a holiday destination and if you are
29:20
willing to just take a package vacation trip, you will get a
29:27
direct flight because it's charter and that one week all
29:31
inclusive vacation, I don't know, it was like 2 grand.
29:35
And I said that sounds like a plan.
29:39
I asked them if I could do that. I said we don't care.
29:43
We don't care how you get here, we don't care how you get back.
29:46
Just make sure that it covers all your expensive set.
29:49
Done. So I actually booked a all
29:52
inclusive one week vacation to Jamaica.
29:54
Flew over, spent a few days in a really nice beach resort facing
30:00
the Caribbean and preparing the workshop that was supposed to be
30:04
Thursday and Friday. And then they had me scheduled
30:08
for a cross country bus tour, which was really nice.
30:11
I was the only white fellow in in that, of course, it was
30:16
really, really funny. I had the two days workshop and
30:19
at the start of the week they actually gave me a call, said,
30:22
ah, you're already in Jamaica. Yeah, right.
30:24
So would you be able to extend your presentation a bit?
30:28
Because the guy who was supposed to come in from Argentina
30:31
reporting on civil registry systems, he couldn't make it.
30:35
He didn't get the check of of the ministry and I wired my
30:39
friends back at Siemens because I know that they sell silver
30:43
registry. So is that OK?
30:44
Give me some PowerPoints, give me a briefing.
30:47
And then, well, that was 2010. So Skype, Webex and all that was
30:53
just in the beginning. And so in the early morning on
30:57
Wednesday, I actually had a call sitting in the lobby of that
31:04
beach resort with a camera on and the Caribbean behind me,
31:08
doing a call with the guys in Munich.
31:11
They had like -10°C, it was snowing, it was fun.
31:18
So yeah, that's, that's how I actually got into that whole
31:21
national identity stuff. And when I, when I had just
31:27
returned, they asked me if I could come back to Ecuador in,
31:30
in April, because they were doing the same thing for the,
31:34
for, for the national ID system in Ecuador and for, for you guys
31:40
only listening. And I'm holding up a real
31:42
Ecuadorian ID card here. That was given to me as a token
31:47
of appreciation by the Secretary of State of Ecuador back in the
31:51
day, because he had actually studied in Germany and was
31:55
fluent in German, and that opened a whole new world of
31:58
identity management for me. Those are some great stories.
32:01
I'm sure you learn so much. But what I'd like to kind of ask
32:05
you to do is obviously this is a podcast for the identity
32:09
practitioner, some of whom may be involved in doing this exact
32:13
kind of work where they're creating state issued IDs or are
32:18
thinking about doing something where it kind of is a
32:24
decentralized identity approach. What are the tips that you might
32:29
have for those folks? Yeah.
32:31
So first of all, if you are from a enterprise identity management
32:38
background and you want to enter the realm of national identity,
32:44
driver's licenses, ID cards, whatever, do not think that the
32:51
public services are even close to the technology level that you
32:57
are used to. They are trailing behind like
33:01
10-15 years. They might have top notch
33:05
biometric equipment though. But the computer systems, the
33:10
architectures, everything we're using your cloud first, no can
33:14
do ID cards are a matter of national security.
33:19
Germany will never ever put their national ID registration
33:23
system on the cloud. It's, it's, it's an on premise
33:27
installation, right, serving 90 million Germans.
33:31
So that that is really, really, really high security secret
33:36
level and hence the architectures tend to be a
33:39
little bit outdated. So do not demand too much of
33:44
those guys, but you can be an inspiration, you can be the
33:49
torch of enlightenment, the flame of enlightenment, bringing
33:53
innovation there because, well, especially my my own folks here
33:59
in Germany, they tend to over engineer stuff.
34:03
And a good example is actually our own ID card here.
34:08
They developed a their own authentication process and
34:13
mechanism and, and standards that are supposedly better than
34:19
what the ICAO, the organization that that defines travel
34:23
documents internationally came up with.
34:25
But what it creates problems because interoperability and
34:29
stuff and, you know, high security, that's cost that's
34:33
going to increase. So please be aware that
34:37
technology might not be that state-of-the-art if you enter
34:40
the realm and be kind with them. But do do not try to give a
34:47
Neanderthal caveman a hypersonic screwdriver that they are just
34:53
going to hurt themselves, right? So those are the first tips that
34:56
that I can share. Yeah.
34:58
I mean, that's kind of I think what the practitioner always has
35:03
to do is take the archaic ways done now, the brand new,
35:09
newfangled technology and come over the pragmatic place.
35:15
Like here's how far we can get. Here's how much change our users
35:19
can probably handle. I think it's I think it's all of
35:23
our responsibility to find that that right level.
35:27
That's the the art is not to let the way things done now, the way
35:33
things are done now to hold us back too much so that we're
35:39
really not getting much value, but not try to push things so
35:43
far to the cutting edge that we wind up having a huge failure.
35:47
So I sort of took away from what you said.
35:52
I wanted to go into a lightning round because we are kind of
35:56
like, you know, we are kind of getting to the point where we
36:00
have really hit that topic good and there's a lot of small
36:02
topics. And I'd like to get just your 2
36:06
minute or less take on different things.
36:09
And the big one that I wanted to bring up.
36:10
So when we were at the EIC, the Cooper Coal EIC last year, we
36:15
did an interview episode 354 if you're interested.
36:18
It was with Christina and Torsten talking about EUDI or
36:23
I'm so EUID and I don't know, EUDI.
36:27
And I just wanted to get your take on what they're doing and
36:32
how that's going to impact the world.
36:35
Yeah, so, so first of all, having Mr. Suda and toss Lord, I
36:40
said working on that is, is a blessing.
36:44
You know, I, I personally went to Christina and and thanked
36:49
her. She is my my savior because we
36:53
Germans tend to mess these things up royally.
36:56
We overcomplicate it. I'm, I'm really keeping my
37:00
fingers crossed that those two identity heroes really save us
37:05
and make that UDIAA success. Because else I think we're going
37:12
to screw that thing royally. As, as we, as we mentioned
37:17
before, the Baltic states are much ahead.
37:20
They are leading the way. And I'd be happy if with a
37:24
UIAUDI, we will come to a point where I, as a German citizen,
37:30
can actually consume digital public services easily and in a
37:36
secure manner. I'm, I'm, I'm really cheering
37:40
these guys onwards. I really hope for my own sanity
37:45
and well, comfort that that this is a success.
37:51
Yeah, I'm interested in kind of your concern there on
37:55
essentially being into the Baltic, said states, being kind
37:59
of like Ford, the rest holding it back.
38:03
What is your concern? Is it like bureaucracy?
38:05
Is it just kind of like, hey, we don't want to change?
38:09
It's it's definitely a typical German thing we don't want to
38:13
change. I could, I could run on for
38:16
hours how digitalization, digital transformation and
38:19
public services in Germany is going wrong.
38:22
But let's have a bear over that when we're off the record.
38:28
It's, it's definitely the complexity of the whole thing
38:32
and some tendencies here in Europe and Germany to make stuff
38:38
AD type. And that might be a problem.
38:42
It's always A2 sided market. You know, there needs to be the
38:46
infrastructure provided by the European Union and the member
38:50
States so that there are interoperable ID cards that you
38:56
can derive a digital identity from.
39:00
But those need to be countered by a demand side by services
39:05
that actually accept these kinds of digital identity.
39:10
State supported or state legitimize digital identities.
39:19
Right now people are like, well, I can't do anything with my
39:24
electronic part of of the ID card.
39:26
Why, why, why should I activate it?
39:28
We just had a talk about that on on on Monday and one of the
39:31
representatives said, as long as the public servant in the civil
39:35
registry offers tells you, Oh well, those digital services
39:40
forget it. Like you can't use them anyway
39:42
because there is no meaningful adoption of it.
39:45
That's a big, big issue. If that's going to fail, if we
39:50
fail to create the the services that leverage the EUDI wallets,
39:57
then it's going to fail miserably.
40:02
Forgive me if I if I make a joke, but you're talking about
40:05
how Germans like to keep things airtight.
40:08
Make sure that there's no flaws. That's probably why the world
40:11
loves your cars, so there's some benefit to it.
40:16
Yeah, yeah, absolutely. Lightning round, let's keep
40:18
going. Bias in identity systems.
40:22
I've definitely been sure if this could take up a whole
40:25
episode or we could talk about this kind of quickly.
40:28
You you could you could do a whole sub serious on on on that.
40:33
And it it starts with biometrics.
40:35
Of course there are certain areas in the world were the
40:42
population only has very very little distinctive marks in
40:49
their fingerprints. There is the natural bias that
40:54
that a EUR Asian person will have a hard time telling Asians
40:59
from each other. Same goes the other way.
41:02
And if you have certain other biometric features, they might
41:06
not work the same way they do work in your population over in
41:11
let's say Latin America, in Southeast Asia, in Africa, that
41:16
is definitely a thing. And always remember, you and I,
41:20
we, we, we not only share the same level of skin pigmentation,
41:25
we also share the same alphabet. But in Europe, go go to Greece,
41:32
they have a completely different alphabet.
41:35
Go to Turkey, they have completely odd characters.
41:38
We Germans have our own lauds. Go to Scandinavia.
41:42
If if you want to be internationally interoperable,
41:47
that's going to create a bias. And and if you go really global,
41:53
then see like every Southeast Asian country almost has their
41:59
own alphabet and writing. That's crazy.
42:02
If you if you want to translate those into our character set,
42:07
there's so many ways to do it right.
42:10
So is it a why is it AJ crazy? So I've, I've kind of always
42:16
thought when I heard bias and identity systems, is it look,
42:20
it's not intentional, right? It kind of comes down to like
42:24
biases and being written into systems intentionally.
42:27
It's it's probably a factor of the data that's fit in the
42:32
number of samples. Absolutely.
42:35
Skewed toward, you know, Western appearance or something like
42:41
that. Is that what it's coming down
42:42
to? Absolutely.
42:44
You know, we, we had that outrage with with Jen AI when
42:49
all the pictures that you created that had people in it,
42:55
they were predominantly Caucasian persons.
42:59
So, so because the training set, they they they used were mostly
43:06
Caucasian people in the photos, in the pictures.
43:09
So yeah, of course there's bias. And the same applies if it's not
43:13
invented here. You know, as Germans, we are
43:17
quite light skinned most of the time.
43:20
Some of us have blue eyes, some of us dark eyes, some are
43:23
blonde, some are red hair. But well, that's, that's sort of
43:26
yeah. And if you have then a, a
43:29
certain subset that you that you train your system on, if your
43:32
engineers are from, from, from Denmark, of course they will
43:37
consider that you have certain spellings, certain special
43:40
characters. If you are Italian, if you're
43:43
French, you have certain accent degree, accent circumflex,
43:46
whatever in your character set. Well, if you're from Rhonda, if
43:52
you're from Ecuador, if you're from Jamaica, quite different,
43:56
right? If you're from South Korea, very
43:59
different. And, and that diversity
44:03
sometimes is a challenge if the engineering team is not diverse,
44:07
but very, very local. And we that happens all the
44:10
time. Yeah, so let's the lightning
44:14
round again. Let's talk about AI because this
44:17
is identity at the center. But we often joke is AI at the
44:20
center becoming more and more every week.
44:24
What is a is impact going to be on all those?
44:27
Because I, I really am finding as we develop applications as
44:32
really as applications grow, this is really a paradigm shift.
44:37
You're not drilling into things on the web anymore.
44:40
You're just telling AI what you want to have it do.
44:44
It's changing the way we have to look at computing.
44:48
So how's it going to change what's going on here with, you
44:54
know, state issued credentials? Yeah, so, well, I have a hard
44:59
time responding to that right away.
45:01
So, so give me a moment to, to to chew on that.
45:04
But let me give you another example.
45:05
Just just yesterday, I had a great conversation with with
45:09
Toby, a partner from from a software firm that we work with.
45:12
And he explained to us how a, a, a certain keynote speaker figure
45:17
that he knows personally is preparing their, their new
45:21
speeches and they are leveraging AI dramatically and, and in a
45:27
very, very intricate way, in a very detailed and, and well
45:31
thought through a way that I never thought about it.
45:35
And, and one of my engineers also by the name of Toby says,
45:38
Sebastian, you're holding it wrong.
45:40
It's, it's like, you know, the beer bottle, right?
45:42
You can't drink from the beer bottle with the opening down,
45:46
right? It's got to be the other way
45:49
around. We, I think right now in AI for
45:55
IAM, we're holding it wrong. We're not approaching it in the
45:59
correct way. But I'll circle back to that.
46:02
I really love what Martin Sundren of IKEA is doing right
46:05
now with his two bears. He has a polar bear and a brown
46:10
bear, both stuffed animals of his employer that you can buy.
46:14
And the 1 is AI for IAM and the other one is IAM for AI, which
46:21
are two completely separate things, right?
46:25
The the thing that that gives me the most shivers right now is
46:29
agentic AI and how to hedge it, how to how to fence it in how,
46:35
how to make sure that these AI agents that are supposed to do
46:41
things on our behalf do not break out of the coral that that
46:46
I hope they they would work in right.
46:51
You know, not buying a ticket to Las Vegas fight anywhere next
46:55
year, but buying my whole company tickets like that was
46:59
not what you were supposed to do.
47:01
Find me a cheap ticket, not for everyone else.
47:03
Stuff like that, that, that's going to to be a tough nut to
47:06
crack. And else I say we will see minor
47:12
optimizations for, for us professionals, quantum leaps of
47:18
user experience and improvement for the users of IGA technology.
47:25
For example, talking to your IGA system the way you talk with
47:31
ChatGPT. Well, what entitlements does Jim
47:36
have? How does that differ from
47:39
Jeff's? Who's the outlier?
47:42
What, what, what, what should be reduced and then execute on
47:47
that? Delete Jim.
47:48
Well, I find that to be quite nice.
47:51
But delete Jim, do I have the authority to tell the AI to
47:56
delete Jim? How?
47:58
How does the IGA system know how, how does the AI agent know
48:03
if I have that authority? So we're going to see some
48:08
change. I'm not sure if it's for the
48:11
matter or the OR the worse right now.
48:13
You know, I just had a thought because as you're talking about,
48:16
I am for AII can see one of the one of the spaces, sub spaces
48:24
within. I am being I am for the multi AI
48:28
just like we had. I am for the multi cloud.
48:31
I mean, you know, I look at enterprises today and a lot of
48:34
them are saying, OK, we'll do Copilot because it plugs into
48:39
all of our office apps and great, great, great.
48:42
But the users want ChatGPT, the users want Gemini, they want
48:47
kind of the these AI models that are, they're moving faster than
48:52
what I see with Copilot. Anyway.
48:55
You go to enterprise and you look at they're doing Azure,
48:59
AWS, they're doing Google Cloud, depending on what applications
49:03
they're developing, they want to use the cloud that's optimized
49:07
for what they're doing. Why won't companies do the same
49:09
thing with AI or even set up their own AIS for their own
49:14
applications? Now I am become so much more
49:17
complicated than hey, if we're just doing copilot, we can
49:20
leverage what's in Antra. And if we get Antra right, then
49:25
Copilot, should you know, stop me from saying, hey, let me see
49:29
the CE OS pay slip. Yeah, this is this is going to
49:33
be a real challenge. But let me such step for for,
49:37
for, for, for one little thing that that I just learned Monday,
49:41
one of our real big German engineering companies Bosch may
49:46
have heard of them. They actually reported on on
49:49
that event that I was at Monday that they have created their own
49:55
internal Gen. AI landing page asked Bosch.
49:59
I think they, they, they called it and they have, and I, I'm for
50:04
once again, I'm proud of German engineering because I really,
50:08
really liked it because they played around a little bit, but
50:12
in a, in a sandbox. And then they asked all of
50:16
their, their employees for the use cases and scenarios that
50:20
they would like to use AI in. And then they did a few of those
50:27
Pocs and actually came up with only two handful of applications
50:34
for AI that they are now offering internally.
50:39
And it saves them hundreds of thousands of euro per year.
50:45
For example, translation of brochures for their electrical
50:50
drills, creation of marketing material for, for the different
50:55
geographies, but also for, for, for the different areas
51:00
departments of, of the organization.
51:02
Crazy. I really like that.
51:05
And, and, and that's going to be far more impactful than what we
51:09
see in the, the, the small improvements that we have in, in
51:14
identity management right now. But I'm really looking forward
51:18
to what some of the vendors will release in the next few weeks.
51:22
At least I had the the honor to to get a few previews.
51:27
And if that materializes like putting, putting shackles on on
51:33
AI agents running wild and, and preventing the the copilot to,
51:41
to answer emails with company secrets, because it was like
51:46
prompt injection somewhere in the e-mail that's going to keep
51:50
us on the back foot for quite some time.
51:53
Because we now need to well, secure what the AI guys just
51:59
ignore because they just push, push, push forward to, to to
52:03
make that next quantum leap in, in functionality.
52:08
It's what we're we're going to have to pick up some, some,
52:16
some, some broken glass at at one point in time or the other.
52:20
I think we've had some really good discussions here.
52:23
I want, I mean, Sebastian, I've got you on the podcast.
52:27
I think it would be a huge miss if I didn't hit you with this
52:31
last Lightning Round question. So I think of you and Esfenbago
52:39
as like the identity beer, like founders.
52:43
And you know, you're the the two people that come to mind when I
52:47
think of identity beer. At the same time, over the last
52:51
year and a half, it's kind of become a global phenomenon,
52:56
right? And it seems like have even, I
52:59
moved to a new area and I've been thinking about, hey, why
53:02
don't I just have an identity out here for the people out
53:05
here? Why don't I just do that thing?
53:08
So I want to ask you 2 questions.
53:09
One, what makes a good identity here?
53:13
And #2 is my idea like crazy? Like is that something that
53:17
people who want to help kind of pull the community together?
53:22
Is identity or a good way to do that?
53:25
Yeah. So, so when, when we started
53:28
this episode, you said that Identity at the Center podcast
53:33
is a global phenomenon. And it is absolutely you got
53:37
followers all around the globe and, and you're, you're
53:40
spreading your followership. First of all, though, on
53:45
identity beer. No, I'm, I'm, I'm far away from
53:48
one of the founding fathers. It's, it's definitely Aspen.
53:51
It's Sam. There are some other folks who
53:53
have been in on that identity beer meet ups that started in
53:59
Stockholm, Copenhagen, Amsterdam and and and London.
54:04
I, I was actually trailing behind and the good German that
54:07
I am, we came up with the idea of the physical identity beers
54:12
and yes, that that is my creation.
54:15
A friend of mine, Eva, she, she came up with the idea and it's
54:19
like kicking around and said, OK, I asked the, the local craft
54:23
brewery to, to, to brew me a, a, a, a special concoction and then
54:28
we'll just put a label on it. And now I'm happy that we
54:32
finally this year actually started doing identity BM
54:37
meetups in, in Frankfurt for the first time regularly.
54:41
And also the pre DIC conference ones that were not officially
54:47
identity BM meetups, but let's say IDY pro themed meetups were
54:52
also bare. What's happening?
54:54
But now Benjamin Mievis and his friends officially kicked off
54:58
the the Berlin meetups. So what makes a good identity
55:03
bier? Well, it's got to be German,
55:04
right? So shout out to Alimaty and IC
55:07
consultant and all those who try to create their own beers around
55:14
identity now. But it's it's Aspen Bargo's
55:17
brainchild and he is managing the community.
55:21
So if you want to establish your community after work identity be
55:27
a meet up, please reach out to Aspen Bargo.
55:30
There is an identity be a community.
55:32
Just get invited to that one by by Aspen or some of the others
55:38
and they will guide you through establishing it.
55:41
It's it's community. There is no sales, there's no
55:44
product pitches. There is no no, no stuff and
55:50
influencing going on. It's it's community driven.
55:54
Just get together, talk all things identity, all things
55:58
digital. We had visitors from the
56:03
procurement service of the United States Embassy in
56:06
Frankfurt last time and she was just curious because she found
56:10
that I did you be a meet up in Frankfurt.
56:12
I got to go there. That was so fun.
56:15
She she had nothing to do with with, with identity management,
56:19
but wow, you're welcome to, to listen in and learn and just get
56:25
there. And of course, if you do not
56:29
drink alcohol, you're, you're free to join.
56:31
Nobody is forced to consume beer.
56:34
There's lots of people just drinking up the shoulder or a
56:38
soda or, or just Stillwater. We don't care.
56:42
But it's all about the community.
56:44
It's it's meeting other people that are enthusiastic or
56:48
interested in identity in digitalization and you'll find a
56:53
fun crowd to hang out with and just get a nice evening with
56:59
some foreigners that turn to be friends afterwards.
57:03
So you mentioned a Liberty, which that's the Sam's company,
57:07
right? So you mention.
57:10
I I, I actually don't know that could be possible.
57:14
I I haven't made that connection yet.
57:17
I only met him on a on a completely personal relation
57:23
there so that that that might be possible, but I believe the.
57:28
Liberty is a Belgian company, right?
57:30
And so, yes, right, They're competing with Germany for
57:35
creating author beers or author beers.
57:39
Yours right? But let's just say that that's
57:42
the purple one, yeah? They'll talk about the official
57:46
beer of and, and so I think there's this Belgium beer versus
57:52
German beer debate. I'm not going to get into which
57:56
one. It's not beer, OK, the the the,
57:58
the Belgian concoction, if you bring that well, I, I, well,
58:02
Thomas is, is, is bringing their beer to, to Bavaria.
58:07
You know that there is a, a trade fair going on in, in
58:10
Nuremberg called it's a right now.
58:12
And I failed to get my alimony beer.
58:15
Apologies. I, I was so busy yesterday.
58:17
I, I didn't have time for that, but I made fun of them because
58:21
they said, they said that they are bringing Almaty beer to, to
58:26
the yitzer. And you know, the German beer
58:30
tradition requires you to be very, very clean in the beer
58:34
brewing process. It's only hops, it's barley and,
58:39
and, and, and water and nothing else.
58:41
And the Belgians tend to stick cherries and strawberries and
58:46
plums and vodka and whatever into their beer.
58:50
Some of them are really, really delicious.
58:52
But if you bring them to Germany, you wouldn't be allowed
58:55
to sell them as German beers because, well, German beer's
58:58
special. Yeah.
58:59
But let's just it's all friendly.
59:01
It's all really, really fun. And poking at each other.
59:06
Whoever brings beer to the table is a friend.
59:10
That's what I figured. I figured I'd bring it up just
59:13
to stir the pot a little bit. And now that it's been done,
59:17
let's close out on a lighter note.
59:19
I think that was kind of a lighter note, but here's the one
59:21
that I prepared for today because we talked prior to our
59:26
recording. You guys just celebrated like a
59:29
national holiday called German Unification Day, which I was not
59:33
even aware existing. I guess it was the unification
59:37
of East and West Germany, right. So that's, I guess the name kind
59:41
of like leads you to the answer. But what is the holiday, what is
59:46
the background and how did you celebrate it this year?
59:50
Yeah. So first of all, it's really
59:52
important because it's the 35th anniversary, it was 1990,
59:57
October 3rd that well, it's now what we say, it's the day, the
1:00:02
German. The Berlin Wall fell down and
1:00:06
the celebration, what was happening.
1:00:09
So, yeah, we had Eastern Germany, we had the Federal
1:00:12
Republic and Eastern Germany. And now it's just Germany.
1:00:15
But it hadn't been that that way between 45 and 1990s, two
1:00:20
separate states. And it was a a real great moment
1:00:24
in history. I was 16 at the time and I
1:00:27
couldn't care less, to be honest.
1:00:29
I was, I was having a beer when, when I was 16 and, and, but
1:00:33
right that, that, that, that, that didn't have such an impact
1:00:36
on me. But I can tell you that last
1:00:39
last week, Friday, we had that celebration.
1:00:41
We actually met with a few friends here in, in one of the
1:00:45
backyards, did a great BBQ. I, I did a nice beef roast for,
1:00:51
for the guys and we had a nice keg from the craft brewery that
1:00:56
does our identity beer. So I want that like 3 gallons
1:01:00
of, of, of good German beer we had and we, we celebrated
1:01:06
standing around the campfire chugging a few beers and eating
1:01:10
good food. There's no fireworks.
1:01:13
There's, there's no, no real big celebration like 4th of July in,
1:01:18
in the US is. It's much more torn down.
1:01:20
You know, we, we Germans are, we're, we're like all introverts
1:01:23
and no feelings yet. But yeah, it was a good day.
1:01:27
It was a good party and there's still differences but between
1:01:33
the two parts. But my wife and I, we are the
1:01:36
best example. I'm originally Western German
1:01:40
from Hamburg area and my wife is from Dresden in eastern Germany.
1:01:44
We have a wonderful daughter who, by the way, right now is in
1:01:47
New York City in the United States right now.
1:01:50
So my daughter is one of the best examples of how the German
1:01:55
unification actually worked out. Yeah, that's really unification,
1:01:58
right? I mean, and by the way, I'm
1:02:00
happy for her. She's in New York.
1:02:03
I said she should go to the Yankees game tonight.
1:02:05
They're still in the playoffs as of this recording.
1:02:08
If they're still in the playoffs by the time this goes live, I am
1:02:12
going to be a very, very happy person.
1:02:15
So, Sebastian, I'm a very happy person at the moment.
1:02:18
Thank you so much for coming on the podcast today, spending an
1:02:22
hour with me, and I wish Jeff could be here for those two.
1:02:27
I know that you guys also have a great friendship, but I see that
1:02:31
friendship continuing for many, many years to come.
1:02:35
I look forward to seeing you in Berlin over the summer, if not
1:02:39
sooner, and thank you for being here Today.
1:02:43
I'm going to close out this episode.
1:02:45
Remind everybody that we are on the web at idacpodcast.com.
1:02:51
We're on YouTube. The quickest way to get there is
1:02:53
idacpodcast.tv. That brings you right to our
1:02:57
landing page. You'll see all the episodes that
1:02:59
we've ever done in 4K video. Actually, I don't think it's 4K,
1:03:03
but we'll just say it's sparkling color video and you
1:03:08
can stream it right to your device or you can always find us
1:03:11
your favorite podcast apps. That's it.
1:03:15
Thank you everyone and have a great day and we'll talk to you
1:03:18
all on the next one. Thanks for having me, it was a
1:03:22
pleasure. See you next time.
1:03:26
You've been listening to Identity at the Center.
1:03:30
We hope you've enjoyed the show. Make sure to like, rate and
1:03:34
review, and we'll be back soon. But in the meantime, hit the
1:03:37
website at identity@thecenter.com.
1:03:41
See you next time on Identity at the Center.