Latest / Identity at the Center / #354 - Kristina Yasuda & Torsten Lodderstedt on the EUDI Wallet and its Global Impact

Transcript

#354 - Kristina Yasuda & Torsten Lodderstedt on the EUDI Wallet and its Global Impact · Identity at the Center

0:00
If you ask me, in the end it is a vision, political will and
0:04
funding. Those are the three requirements
0:06
and those requirements are fulfilled right now in the
0:08
European Union, especially in Germany.
0:10
So we have really great support by the government.
0:13
We've got funding early this year to to start the roll out of
0:16
the ecosystem. So we're on a good way to do it.
0:19
But those are the three preconditions that it really
0:21
flies. I think the the fact that we're
0:26
at the point where no one questions the value of doing
0:30
this is honestly a significant achievement because in my 10
0:34
year journey, it was this like forced wave, like getting all
0:37
these different parties aligned in what direction has actually
0:40
been, yeah, a challenge. And also.
0:45
Catching on. I I was one of those.
0:47
Go ahead. Yeah.
0:48
So no, no, it's actually a funny story here because Tristan, as
0:52
he introduction mentioned, he he was mainly involved with the
0:56
OS2, which is this, you know, Federated identity authorization
1:00
space. And as I said, I came from the
1:02
blockchain background, right? Like and like back then,
1:06
blockchain people are like those Federated people don't care
1:09
about privacy. The Federated people who are
1:11
like, oh, the broaching people are just nuts.
1:14
So it's like kind of, you know, we met in the middle and I think
1:16
that was the true power. We kind of combined the
1:19
knowledge from both sides and tried to find the pragmatic
1:22
solutions. This is identity at the center
1:31
if it has anything to do with IAM.
1:34
This is the go to podcast now your host Jim McDonald and Jeff
1:41
Stedman. Welcome to the Identity of the
1:48
Center podcast. I'm Jeff, and that's Jim.
1:50
Hey, Jim. Hey, Jeff, how are you?
1:52
Not so bad yourself. Great man here at EIC 2025 EIC
1:57
European Identity and Cloud Conference.
1:59
Good job you did it. I don't know what happened at
2:01
the last C, but it's it definitely is EIC.
2:04
It's not EICC. It's the EIC conference.
2:07
Right, that probably makes more sense.
2:08
Yeah, you know what is also special beyond it being a
2:12
fantastic conferences, fantastic food.
2:15
Food's been good, Yes, I'm enjoying my first visit to
2:18
Berlin. My first time at EIC has been
2:20
fantastic. This is our last sort of on site
2:23
episode that we're recording from the stage here at EIC.
2:26
So yeah, it's been, it's been cool.
2:27
I dig it. Very cool and gets us out of our
2:31
normal day today for sure. And, you know, everything's a
2:35
little bit different. Yeah, yeah, no, I'm, I'm
2:37
enjoying myself quite a bit. So thanks to Martin, thanks to
2:39
Marina for hooking us up with all the help that they've given
2:42
us for this. And I have to say, you are very
2:44
well dressed today. I'm kind of disappointed though
2:46
that there isn't the jacket. Oh, really?
2:49
No, that was intentional. OK, It's this is like a it's
2:52
like a Western dealer. I saw Carson.
2:57
What's the last name? Wentz.
3:00
Joseph Carson, No. Carson's his last.
3:03
Name. Yeah, so this is how he kind of
3:05
dressed yesterday. I was like.
3:07
No, he did very well. So other former guest of ours,
3:09
former guest. He's gone on to great things
3:11
since being on the podcast. He was like great things when we
3:13
have him on. Yeah, exactly.
3:15
All right, why don't we get to our main guest for today?
3:18
So let me go ahead and introduce a couple members of the German
3:21
EUDI Wallet project and we're going to find out what that
3:24
means in a second. They're also part of Sprint, so
3:26
I'm going to ask about what that what that means.
3:28
But we've got Christina Yasuda, she's the product owner and then
3:31
Dr. Torsten Lottersten, who is the project lead.
3:33
So welcome to Identity, the Center guys.
3:35
Thank you. Thanks for having us all.
3:37
Right. So we're out.
3:37
We've already got some some chuckles coming out of
3:39
Christina, which is great. So let me start with you.
3:42
How did you get into identity? Is it something that you chose
3:45
or did it choose you? Something in the middle in a
3:49
sense that, So the problem I was originally trying trying to
3:53
solve was marginalized populations, refugees and single
3:57
mothers and not having means to identify themselves and hence
4:02
not being able to get access to society, different opportunities
4:07
and all that. And that's how those people are
4:12
kind of forgotten on purpose by the government.
4:15
So that's how I got introduced to what bags then was known as
4:18
self sovereign identity, OSA, distributed leisure technologies
4:22
and all that back in 2016 I think.
4:26
So we did few on pilot projects. I was running my own NGO back
4:31
then and but I pretty quickly realized that it was probably
4:36
not the best fit for what I was looking for.
4:39
And the solutions we had back then, we're not very scalable
4:42
and did not really meet the, I think, privacy and security
4:44
requirements we had. But the idea, the concept just
4:48
hooked me and I just, I went deeper instead of being like,
4:52
doesn't work, let's go somewhere else.
4:54
I was like, I just keep digging deeper if technology is not
4:56
there, but I believe in the use case, let's make it real.
4:59
And that's how I started digging into technical standards.
5:04
And actually, so I did that work for a while.
5:08
And now I'm like super happy to be in a position where we're
5:12
actually building a product that we hope to deliver to what
5:16
maximum 80 million Germans hopefully, and even more beyond
5:20
that because Europe has 440 million people, right?
5:23
And yeah, that excites me a lot because we've been working on it
5:27
for almost 10 years now. So finally having a product
5:29
that's so close because this idea of kind of users being able
5:35
to proof who they are to the services, not through the big
5:40
identity providers, so not through Microsoft but Google,
5:42
but directly. I feel like many of that people
5:45
in I am like wanted to do is it's not even the first wave.
5:49
And finally, I think the technologies and API's and all
5:51
that are more or less kind of aligned with the funding and the
5:55
public interest. So I feel we have an opportunity
5:58
that I really want to write on. So there's a lot I want to
6:02
unpack there. Yeah.
6:03
Let me get to Doctor Torsten here.
6:05
Tell us about your identity background.
6:07
Yeah. First of all, you can tell me,
6:08
call me Torsten, OK? I was going to ask you something
6:11
like some friends, right? So I used to be an IT consultant
6:15
specializing in software architecture and security.
6:17
I did my PhD and and and secure software development and after a
6:24
project I did with the New York City Subway I I was hired for a
6:29
consulting job with Deutsche Taylor com in Germany and there
6:33
I started to work in identity. So it was partially stumbling
6:39
into it. Yeah.
6:41
So I started as a as a as a yeah.
6:44
I was responsible for the consumer identity management for
6:47
the German market. So and over time I really fell
6:50
on off with the topic. So I mean, this is really a
6:52
niche topic in the end, but it's really fascinating.
6:56
And after couple of years, I started also with
6:59
standardization. So we had to invented our own
7:02
stuff. And then I got in touch with the
7:03
international community, which is my first Internet identity
7:06
workshop and got sucked into the oaf 2 dot O standardization.
7:11
So did the security shrub model. And so it it went on and on and
7:14
on. Yeah.
7:16
And now I got the pleasure to work with Christina in different
7:20
capacities. So first of all, we started
7:24
while back in 2020 to work on open ID for verify the
7:27
credentials. And yeah, now we are working
7:30
together in the project, right? Building, building cool
7:32
projects, cool building cool stuff.
7:34
And that's what always what counts for me, right?
7:36
Building, building stuff. And it was mostly consumer
7:38
identity that I've done never enterprise on tonal stuff,
7:41
building services and products that really work with real
7:46
users, that we solve real problems that scale right to
7:50
high, high, high number of of users.
7:52
And, and with the wallet, we have a completely new quality,
7:56
right? Federated systems work for web
7:58
SSO. And now with the wallet we can
8:01
do amazing things in, in proximity, right.
8:04
With the same technology, we can, we can walk into a website,
8:08
we can pay in a point of sales. And this is really amazing that
8:12
the number of use cases and what we can do for the society is
8:15
quite amazing. So and having the opportunity to
8:17
build up for the German market is, yeah, for society.
8:21
That I said is really amazing. It's a project with significant
8:24
impact and sometimes it's takes a while to see that impact.
8:28
I would imagine you guys have been toiling over this for a
8:31
while. So maybe give us a little bit of
8:33
background of the EUDI wallet project itself.
8:36
And I assume it means EU as in European Union and DI as in
8:39
digital identities. So, OK, good.
8:40
I got that right. Tell us a little bit how the
8:43
project started. And I'm really curious about
8:45
your side of this, Christine as well, because you actually
8:49
transplanted from Seattle to Berlin, I think for this.
8:52
Maybe we'll start with you and then Torsten, we can go after
8:55
that. Yeah, so I moved to Berlin
9:01
because of this person. So.
9:04
It's your fault. Left left, you know, well paying
9:09
big tech job. I think it's a it's a no, but
9:12
I'm I'm really happy. I'm happy that I did it.
9:15
But back to your question, interesting, right?
9:19
In EU, I think it ties back to the regulation EIS 2.
9:23
So EIS one passed in 2014, which says make sure every citizen has
9:27
a plastic card and you can do this legally binding signatures
9:30
from American audience. It's like a DocuSign, legally
9:33
binding DocuSign and for EIS 210 years later, 2024 European
9:39
Commission said digitize that so you can get the government
9:43
issued identity into your digital wallet.
9:46
But not just that, try digitize anything you can.
9:48
So driving licenses, a prescriptions like digitize any
9:52
part of what's pay for now. So that scope just became
9:56
massive right already. And then they said because it's
9:59
inherits EIS one, make sure you can do signatures in the wallet
10:03
too. And because there's digital euro
10:05
work coming out, they said make sure there's some payment
10:07
related, you know, payment feature also in the wallet.
10:10
So it's like this massive project.
10:13
And so European Commission has regulation, but the way European
10:16
Union works, every single member state is responsible for
10:19
implementing it. So now every single country
10:21
including Germany before the end of 2026 needs to have this
10:24
wallet in production. And when we say wallet, we
10:27
actually don't mean just this application that in users hands,
10:31
because that application needs to have this digital data issued
10:35
to it and it needs to be able to present the data to the service
10:39
providers. And to trust OS, you need to
10:42
have this trust fabric and the orchestrators to like make sure
10:45
everything works right. So that's a scope we're looking
10:48
at. And that's when German
10:50
government, maybe Josen can pull up here, the German government
10:55
kind of assigned spend or the company we work for, the Federal
11:00
Agency for Breakthrough Innovation.
11:03
Which is a very cool. I love it, right it sounds.
11:06
So cool, you should be with that by the way.
11:07
It's not. It's actually, it was originally
11:11
the spend agency itself was founded as DARPA of Germany, but
11:15
without defense. So it's main job is actually
11:17
venture capital of a German government, which I also find
11:19
really cool. But yeah, that's how, yeah, I
11:24
was working in Microsoft. Microsoft had the product in
11:26
that area. But I said the hot potato, the
11:29
hot thing's happening in Europe right now.
11:31
I wanna be in the middle of it. And also another, I think part
11:36
of the story is this technical standards.
11:38
So because you have this 3 distinct players, entities
11:43
issuing data into the wallet and wallet presenting at the service
11:46
providers to interoperate, you need to make sure like the
11:49
protocols you send this data through and how you trust each
11:53
other. That has to be standardized.
11:55
And luckily, when the regulation got passed, I became very clear
11:59
that some of the standards that they've been working together
12:02
will be the underpinning layer of all this.
12:06
So, so yeah, I really wanted to contribute the expertise and
12:09
keep building on that, getting implementations.
12:11
So yeah, fashion based. Yeah, impact.
12:17
Impact is the keyword here. So first of all, the German
12:20
government decided to pursue a pretty new and unique way.
12:27
They started the project with the Federal Agency for
12:30
Breakthrough Innovation, and we built A-Team.
12:36
Basically we built a team with experts, international experts
12:42
and first of all the atmosphere and Sprint is pretty different
12:45
from typical public administration organizations, so
12:50
flat to non horror hierarchy and good working culture.
12:55
Can my travel expenses reimburse in a day?
13:00
No, it's, it's, I mean, I have worked in startups and it's more
13:03
like a startup than a than a than a federal agency.
13:06
And I have worked in private sector previously.
13:09
So this is my first engagement as a federal employee.
13:13
So, so maybe it's a little bit spoiled because maybe you had
13:15
that preconception going in. That would be one thing, and now
13:18
this is the way it should be working.
13:20
Perhaps, but during the government decided to set up
13:24
that project and not only to, to, to set it up in the way it
13:28
was set up, but also to, to a fully transparent consultation
13:32
architecture process. So what we do is not closed
13:34
shop. We're not closing the door,
13:36
coming up with some ideas. Design it, implement it, and
13:39
then boom, it's there. No.
13:41
We really do that in, in interaction with the with the
13:46
society. So we have published our ideas,
13:50
we have there's open code, it's open source platform, German
13:53
government where you can find a blueprint document, you can file
13:57
issues, you can file pull requests if you want.
13:59
We have public consultation where people can, can give their
14:02
feedback and, and contribute to, to, to what we do.
14:05
And I was what I worked out amazing.
14:07
So we have talking to been talking to civil society,
14:10
science, private sector and so on.
14:12
And they all were able to contribute their perspective to
14:15
this. Because our final, our final
14:16
goal is that the, the EU idea wallet ecosystem is something
14:21
that is really appreciated and, and, and embraced by the, by the
14:23
German society. And I would like to mention that
14:26
especially in Germany, digitization is a really, really
14:30
hard thing, right? I mean, you know, the term of
14:33
German angst, right? And it's real, it's real.
14:37
So people mostly focusing on, on, on, on issues and
14:41
challenges. And that's an opportunities.
14:44
And so we try to balance that, right, to really highlight
14:48
opportunities that we have in the for all society, because our
14:51
degree of digitization is really low in comparison to all the
14:56
other European member states, for example.
14:58
So for us, it's an opportunity of really, yeah, make a
15:03
breakthrough when it comes to digitization of the, of the
15:05
society. So that's this real impact.
15:07
And this is in the end also, which caused the attention of,
15:10
of talents like Christina, right?
15:11
So making an impact, being able to build this, this huge
15:14
infrastructure is really amazing.
15:17
And I'm all super grateful for having the opportunity to work
15:21
in that in that project. So Tirsty, you and Christina
15:23
were on this stage yesterday and I remember one side that which
15:28
was kind of like a road map or a timeline.
15:30
It looked very aggressive to me. I guess my question is, are
15:34
there any things out there in the wild in production today?
15:38
Is anyone actually using the wallet or when will this
15:41
actually get on to people's devices?
15:45
Yeah. So first of all, I would like to
15:47
mention what is different from difference between what we're
15:50
doing here in the EODI wallet and previous attempts is wallets
15:54
have been around for I would say 10 years roughly, but they never
15:58
they never really saw their breakthrough because it is a
16:04
three party model. And in the three party model,
16:06
it's even more difficult to get enough adoption that it really
16:09
flies. So in the end, declaring that as
16:13
a public private or as a public digital infrastructure is a
16:16
different thing, right? So previous attempts were mostly
16:19
funded by the private sector and they failed, right.
16:22
But because of a lack of adoption, building this
16:24
infrastructure has a real chance.
16:28
They're all wallets are there today, obviously most of us so.
16:32
Do you mean payment was or identity wallets?
16:34
Identity wallets you. Want to challenge me?
16:38
No. Basically, basically wallets, I
16:41
mean most, most wallets have both functionalities today,
16:43
payments and kind of data in it. Don't know whether you would
16:47
call it identity wallets. I was referring to the previous
16:50
attempts though. Those were identity wallets, for
16:52
example, the SSI space, right? Right.
16:54
But that's an interesting question because, yeah, I think
16:57
of from my viewpoint, it's an American and America side is
17:00
mostly a payment wallet because that's really what we have
17:03
things like Apple Pay, Google Pay, Samsung Pay and is it
17:07
payment? Yes, but there's an identity in
17:08
there. So how do you define an identity
17:10
wallet? Versus slowly, slowly MDL's are
17:13
getting into your wallets in the US So yeah, So to your question,
17:17
no, no, go ahead. So, so which means that in my
17:22
perception, there were previous attempts in this self sovereign
17:26
an empty space, but they are more, more, more or less
17:28
isolated, right, more more proof of concept kind of work.
17:31
But they never get real traction because lack of adoption, as I
17:35
said. And what we saw is that, yeah,
17:38
the main driver for for wallets on smartphones were payments,
17:41
obviously. But over time we cut tickets
17:44
and, and, and boarding passes and then mobile driver's license
17:47
into those into those wallets. So that's in the European Union,
17:50
we typically have a government issued ID.
17:52
So we do not use our driver's license to do identification.
17:55
So the question is how do we get those credentials into the
17:58
wallet and that is the starting point for the UDI, right.
18:01
So one of our slides we also said that the current, the
18:04
current wallets lacked the security level and their privacy
18:07
level that we desire for our identity credentials.
18:11
And that's one of the main points of the UDI wallet.
18:14
So and there is no, there's no UDI wallet yet in production.
18:18
Christine, did you have a follow up?
18:20
Yeah, just few clarification points.
18:22
You picked up on that, huh? That's very sad little, right?
18:27
Me. It's a Japanese part of me,
18:29
right? Like I need to raise my hand.
18:30
No joking. I think it's important to
18:33
clarify that yes, like in America, like Real ID law had to
18:38
be passed to consider driving license to be an identity
18:40
document versus in Europe driving license or just driving
18:44
privileges. Identity documents are
18:46
different, right? But to your production question,
18:49
I think for surely in America like they are, you know, Google
18:54
with Apple, but also some startup wallets are rolling out
18:58
in production like California, for example.
19:00
Not just California, but in different states.
19:02
I'm sure there's a list on the Internet.
19:04
So yes, we do see them in production and we also see that
19:07
in the standards work, I think because the contributions and
19:11
requirements and feedback we're getting in the standard space
19:14
are very real now, right? Like this is the deployment
19:17
problems we're having like can be improved.
19:19
And within the EU context, I think there are countries that
19:22
are having like the closed beta, like with real users already.
19:25
So each member states are trying, as I said, we have the
19:28
deadline and yeah, not like large scale production of anyone
19:33
can download, but like, yeah, there's steps that are being
19:35
taken for sure. That's very cool.
19:36
So after you guys got off the stage yesterday, did people
19:40
stick around to ask you questions or have you gotten
19:42
questions from people who are in the audience and what kind of
19:46
anything Very insightful. I think people get very excited
19:53
that I mentioned Tinders. Yeah, we have.
19:57
Heavy standards. But it's true, as I said, right,
20:00
we need to build an ecosystem. So we need help from everyone.
20:04
And as we've been saying, the value of the wallet increases
20:08
with the amount of data goes in and the places where you can use
20:11
it. So we really need this like
20:13
larger excitement from the industry basically.
20:18
And it's interesting because. Google Wallet made an
20:20
announcement that they're deploying all those protocols on
20:24
and they mentioned huge relying parties like Amazon on CVS and
20:28
whatnot. And like, it's interesting
20:30
because we want those big relying parties in Europe to
20:34
take this wallet seriously too, right?
20:36
So I think that's going to be, I think at least the questions I
20:39
hear a lot is like, how did we get there?
20:41
Yeah. Yeah.
20:42
And there's another question that we also wanted to to
20:45
address yesterday and this is about digital sovereignty,
20:49
especially from the from the Member States perspective.
20:53
And most people or a lot of people interpret the UDI wallet
20:58
as an alternative to the wallet of the platform providers.
21:02
That's not the way we see it, right?
21:04
The way we see it is the UDI wallet is a concept, right?
21:08
It's basically a regulatory framework and a standard feature
21:12
set that you can expect the wallet to provide.
21:16
So we are super happy to cooperate with the big platform
21:20
vendors like Google. They just need to play to all
21:23
rules. It's very important because we
21:25
have special security requirements.
21:27
Otherwise we can't put our Eid into such a wallet, right?
21:31
Because we in the end are liable that it really works in a secure
21:34
fashion and, and, and, and, and a privacy preserving fashion.
21:37
And I had over over dinner, I had the conversation about the,
21:41
the non discriminatory access to all the thing, right?
21:44
Because since we are building a a government provided wallet and
21:48
the question is what are those private wallets even have a
21:50
chance? Because the policy makers could
21:54
make a policy that basically the public, the back public wallet
21:57
has, has a pole position. And what is interesting is since
22:00
we said any wallet must work with any provider of a
22:05
credential, must work with any relying party, it's in the end
22:09
user that is in the driver's seat.
22:12
So the user selects the wallet and if the user, the user goes
22:15
with Christina's wallet, fine. If the user goes with Google
22:18
Wallet, this is also fine. In the end, we want to this
22:21
ecosystem to to flourish, right? That's that standards.
22:25
Yes, yes, yeah, that's that's the point.
22:27
But. For me, it was fascinating
22:28
moving from America to Europe, right?
22:29
Like in America, if Google or Samsung or whoever publishes a
22:33
new feature, everyone's like, yeah, let's go try it.
22:36
But it's like in Europe and maybe particular Germany, it's
22:39
like, can we trust it? Are we sure they're?
22:41
Not hesitancy. Are we sure they're not going to
22:44
steal even more data from us? The answer?
22:46
Is no, we're not sure. Also, it's surprising.
22:50
I'm thinking from the platform provider.
22:52
So is it like the browser where they see it as a competitive
22:56
edge to have the user use their wallet rather than we?
23:03
Really need to separate those companies providing the
23:05
infrastructure and the browser engine, mobile operating system
23:08
that we cannot go around for any product, right versus like those
23:13
companies actually building their own product using those
23:17
primitives, right And that's where for example, Google and
23:19
Apple strategies are different, right?
23:21
Like Google is pretty like, I mean, I mean, I shouldn't say
23:24
like Apple's been, I think changing a little bit, but like
23:28
basically making sure these good security privacy features built
23:33
into the browser and the operating system are available
23:36
to any wallet, any third party wallet versus like making sure
23:40
those best features are available only to the platform
23:43
provided wallet, right. There's this big difference.
23:45
And I think the the key point we were trying to make yesterday in
23:48
the keynote is, yeah, like we want to have this playground.
23:54
Like as a government, we want to make sure that playground is
23:57
guarantee security, privacy, interpretability for the users.
24:00
So like, if users are making a choice, we send the options in
24:04
that playground, the user is safe and it gets a convenience.
24:07
And they, you know, life's becoming better.
24:10
And also obviously the big driver behind those regulations
24:13
in the work is digital economy in Europe, right?
24:15
Like making sure digital services are flying better.
24:18
But yeah, if you want to play with them, that great.
24:20
Anyone's welcome outside that? Not true.
24:24
And in the end, digital serenity also means we can make our
24:26
choices and we do not have a lock in.
24:29
And that's important, right? We need to be able to, to make
24:32
our own decisions as a government and as a society.
24:34
That's, that's basically what it is.
24:36
And most of the platforms are not operated by, by companies
24:39
that are located and, and, or situated and in the European
24:42
Union. This is our challenge, right?
24:44
And that challenge has come up several times throughout this
24:47
conference is, you know, what happens if something happens.
24:51
Why is it coming up now? I don't.
24:53
Know it's always been there, but I think it's a little more,
24:55
yeah, realistic at this point. But this, this idea of having a
25:00
wallet that is interoperable with other wallets is very
25:06
interesting. I don't know if we get to the
25:08
point where we can say who's running the wallet and do we
25:11
trust them? So I think this is more
25:14
regional, maybe more country specific or whatever maybe.
25:17
But you know from in the US side of things and you give a .50% of
25:21
the population doesn't trust the government.
25:24
So I don't know if the government is the right entity
25:27
for the US to do that. Now they of course have real
25:30
IDs, and today is May 7th, which is like real ID apocalypse for
25:34
airports. Right, so.
25:36
Who knows what's happening in airports right now, but we've
25:38
had like 23 years. I think of kicking the can down
25:41
the road so, but people wait till the last minute and I'm
25:45
getting to the point is basically, is government the
25:48
right choice to run that infrastructure for a digital
25:52
identity wallet when you have private companies who can do it?
25:55
How do you separate that? Google's a great example, right?
25:57
They have a ton of different things, including a browser that
26:01
has mass market share, but it is a product of Google.
26:06
How do you even try to separate something like that to make it
26:08
vendor neutral? Hopefully as sovereign as
26:11
possible that I can manage that identity of my own.
26:15
I just don't know how that how that would actually work.
26:17
It's a, it's a pretty difficult to answer question.
26:19
I, I will try to separate it a bit.
26:22
So first of all, the, the government tries or we as a
26:26
government project try to come up with a concept where the, the
26:30
government or the member states only runs the minimal
26:33
infrastructure that is needed to leave whatever the market can
26:37
address to the market. Because we do not want to spend
26:42
taxpayer money on, on things that, that private companies can
26:45
do. Which means you need to govern
26:48
the ecosystem. That's policy, which means you
26:51
need to be able to, to, to manage the trust in the
26:53
ecosystem. Which of the wallet providers
26:56
are certified? I, I mentioned that yesterday on
26:58
stage, there's a concept of certification and recognition.
27:01
So only if you are certified to certain security and, and
27:05
functional requirements, then you can be eligible for being
27:09
recognized. And if you're recognized, then
27:11
you are, you're added to a list so people can can see, OK, this
27:15
is a certified and recognized wallet.
27:16
So this is, this is the, this is the responsibility of the
27:19
government. To do that.
27:21
And the second thing, and this is and this is the big cultural
27:24
difference right in, in, in, in continental Europe, we are used
27:29
to government provided I DS, right?
27:31
So I've got my ID card in, in, in my wallet and I will going
27:35
forward to have my government issued Eid in my wallet.
27:38
So this is this is generally accepted, this is a cultural
27:41
thing which is completely different in in Australia and
27:44
the US and the US and UK, for example.
27:46
So those two different things are expected to be provided by
27:49
the government. The government provided wallet
27:52
is a different thing. We built that first of all to to
27:55
be really to have more control over how we hit the timeline.
27:59
And the aggressive timeline that you mentioned is a political
28:01
timeline. So it was, it is buried in law.
28:05
So the law says after a certain time ellipse, you need to
28:09
publish the bullet to really have pressure on the member
28:11
states to do it. It's a pretty tough timeline, I
28:15
can tell you so. And that's why we built that
28:18
that wallet on our own, because we do not want to be dependent
28:21
on external parties that we do not really control, right, other
28:24
than giving them tons of money. So.
28:26
Germany remains compliant. Yeah, we are, We are complying
28:29
with our legal obligations because if we do not comply with
28:31
the legal obligations, we most likely will see AI don't know
28:35
what the right terms lawsuit or something like that from the
28:37
European level on us because it's our contractual obligation
28:40
to provide that wallet. I was.
28:41
Going to ask what is the repercussions if?
28:44
Fines. It's fines.
28:45
Fines. Yeah, Mostly fines, yeah.
28:50
Money talks. And that's why we, that's why we
28:52
are, that's why we are building the government provided wallet.
28:54
That's the one reason. And the other reason is to
28:56
really have something that we can rely on.
28:59
So we do not on the long run depend on other providers
29:04
because the wallet is the center of the infrastructure.
29:06
If you don't have a wallet I mean the rest is just useless.
29:10
I think there are two extremes possible within the same
29:13
framework right? Like 1 extreme is government
29:16
issuing the digital version of government ID into the
29:19
government provided wallet and users using it.
29:23
I don't know when doing certificate of residency, right,
29:28
like all government versus like within the same framework within
29:31
the same EUDI What it's also completely possible that a
29:36
pharmacy is issuing an E prescription into a private
29:39
company provided wallet again, doesn't have to big platform
29:42
could be a Deutsche Telecom, I don't know.
29:44
And that being presented to another hospital in the
29:49
Netherlands, for example, another kind of private company,
29:51
like within the same framework, both are completely possible.
29:53
And it's like our job to enable both, right.
29:56
And I think that's true power here and the tools, you know,
29:59
I'm not gonna repeat at 1st and said is yeah, certifying, making
30:02
sure everyone's complying with this playground, right,
30:05
Basically making sure, just making sure that that playground
30:08
and recent that it's it's user choice.
30:10
And if you trust the government goes this way.
30:11
If you don't trust, goes this way.
30:14
What do you think is holding back more widespread adoption in
30:18
general? Because I think it's hard to
30:20
argue against this idea. I feel like it makes so much
30:23
common sense. And maybe that's just, maybe
30:27
this is just, you know, my, I'm an identity and I get it.
30:29
I know why it's needed. But what do you think is holding
30:32
back players in this space? And probably countries or
30:36
cultures or whatever that aren't keeping up because EU is
30:39
definitely further, hard, further ahead of this than I
30:42
would say, like North America. So what does it take to get
30:46
other countries, other regions to get on to this thing?
30:49
Because I don't think it's a matter of if, it's more of a
30:53
matter of when, but until everyone's doing it.
30:56
You have to like support so many different ways to do this.
30:59
What is it that's going to be like, let's do it?
31:02
Is it just, hey, the the law is now and EU does this and
31:06
everybody in EU is doing this because they want to avoid a
31:07
fine. And so that's sort of like the
31:09
tipping point or is it something else?
31:13
Me. I have opinions too but yes.
31:16
Christina is going to raise her hand if she.
31:21
We are both very opinionated. Well, that's great because this
31:25
is an opinion podcast. Early, early attempts to build
31:29
wallet based solutions all failed because basically a free
31:33
party system is so complex, right?
31:35
You need data. First of all, the people need to
31:38
to to install the app. You just need to get the data
31:42
into the wallet. And then you need to rely on
31:44
party that accepts the data. This is much more complex than
31:47
than any Federated identity system, right?
31:49
And any identity system, your user base is your capital,
31:54
right? So in the wallet based system,
31:56
it's even more complex because you need the wallet installed
31:58
based and you need the credentials.
32:00
And so that's why private initiatives all failed.
32:04
And that's why I think we need, we needed to learn and accept
32:09
this is a public infrastructure. It need to be built like
32:13
railways were built and streets were built and so on.
32:15
And at least in Europe, mostly with tax money, right?
32:18
So this is the infrastructure that needs to be built by the by
32:21
the state so that can private, private sector companies can
32:25
build products on top of it. And not just built, but it has
32:28
to be supported too, right? Exactly.
32:30
Yeah, It has to be built, it has to be supported.
32:32
So if you ask me, in the end it is a vision, political will and
32:36
funding. Those are the three
32:38
requirements. And those requirements are
32:40
fulfilled right now in the European Union, especially in
32:42
Germany. So we have really great support
32:45
by the government. We've got funding early this
32:48
year to to start the roll out of the ecosystem.
32:50
So we're on a good way to do it, but those are the three
32:53
preconditions that it really flies.
32:56
I think the the fact that we're at the point where no one
33:02
questions the value of doing this is honestly a significant
33:05
achievement because in my 10 year journey, it was this like 4
33:08
slave like getting all these different parties aligned in
33:12
what direction has actually been yeah, a challenge and also.
33:18
By catching on. I was one of those.
33:20
Go ahead. Yeah.
33:21
So no, no, it's actually a funny story here because Tristan, as
33:25
he introduction mentioned, he he was mainly involved with the
33:29
OS2, which is this, you know, Federated identity authorization
33:33
space. And as I said, I came from the
33:35
blockchain background, right? Like and like back then,
33:39
blockchain people are like those Federated people don't care
33:42
about privacy. The Federated people who are
33:44
like, oh, the brochain people are just nuts.
33:47
And so it's like kind of, you know, we met in the middle and I
33:49
think that was the true power. We kind of combined the
33:51
knowledge from both sides and tried to find the pragmatic
33:55
solutions. But that's not what I wanted to
33:58
say. I wanted to say that this kind
34:01
of technical specifications being settled finally is also
34:07
what's pushing this because my last year's keynote, I talked
34:11
about can you please stop fighting because before that it
34:14
was like, and different layers of product called credential
34:18
format, stress framework identifiers, key resolutions,
34:20
people just like pulling in different directions, use
34:22
blockchain, not use blockchain, like keep doing what you're
34:24
doing, not doing. And I think it's finally we're
34:27
seeing a real convergence around one stack and we send the same
34:31
stack. All the standards are going
34:32
towards maturity because now even now if you build it, you
34:36
have to align on like which version are you using and all
34:38
that. So there is still like political
34:41
real money given there's still some left uncertainty.
34:43
And I think that's kind of potentially one last milestone.
34:47
Like I don't have milestones, right, English term, but like
34:49
one last kind of push, right. And once we have that all stable
34:52
at that point, really it's build to meet the deadlines, right?
34:57
And I think we'll hopefully we'll see that across the globe.
35:02
For example, Japan is definitely looking at what's happening, EU
35:05
and the US. So immediately between US and EU
35:08
too, right. And within in Southeast Asia and
35:12
Africa, most of is doing an interesting work, but I think
35:15
they have a slightly different requirements because smartphones
35:18
are just not as good as in the global N so to say.
35:23
So the movement is there and I think the components are there
35:26
and I would see, I would expect to see a huge push starting ends
35:30
this year to like end of 2026 and yeah, they'll see.
35:34
You use the magic word that I wanted to talk about, which was
35:36
requirements. Oh, OK.
35:37
So I'm wondering like were the requirements all set up front or
35:41
do you have stakeholders? Who are those stakeholders?
35:45
Are they helping to refine the requirements?
35:47
And then you brought up another topic.
35:49
So that's question number one. I do this very often.
35:52
I do great three-part questions and expect you to remember them
35:56
all. No, it will be two.
35:58
So the requirements and then, well, why don't we just stick to
36:02
that for now? Let's talk about EU.
36:05
So EU, it's a multi step process, right?
36:08
So we have a regulation which is really high level non-technical
36:12
requirements, right? Like for example, users have to
36:15
be able to do these features using the wallets.
36:18
So that's where I started, right?
36:20
There's like everything has to be digital also signatures also
36:23
payment authorization and synonyms, for example, and all
36:26
that, right? And then that needs to be one
36:29
row level more broken down into technical implementation.
36:34
And that's implementing, it's technical implementing acts and
36:37
that too to actually achieve interpretability among 27 member
36:42
states. There was an architecture
36:44
reference framework. So it's kind of like 3 step
36:46
process is in terms of like process and who are involved at
36:50
different levels, different people.
36:51
But overall, yeah, European Commission and before that,
36:53
because it's a law, it's elected representatives of European
36:57
citizens and then each member state also gets to involved in
37:00
different level. And also Commission has been
37:02
opened where everything happens on GitHub.
37:05
So if you're like an industry body or standards body or you're
37:08
present a specific interest group, you can contribute and
37:12
communicate and you know, it's arguably A transparent process.
37:17
Not always obviously everything goes as smoothly.
37:20
There are timelines and the number of people involved is
37:23
massive, but yeah, I think there is a serious attempt to collect
37:28
requirements and needs from as many stakeholders as possible
37:32
and try to meet in the middle. Yeah, what I was wondering.
37:37
I would like to add jomay. Sure.
37:40
So on the on the level of the of the Member State Germany, we
37:43
have another set of requirements.
37:45
So what Christina explained, is basically the regulation.
37:48
It's a law. Right.
37:49
The law already has a pretty, pretty detailed product
37:52
description. But with what we did in a
37:54
consultation process, we also talked in detail with the
37:56
different stakeholders about what are their needs, what other
37:59
opportunities and that's why that's why we used to develop
38:01
our own road map. So we on our own develop a road
38:04
map and and how we in the end prioritize features and how we
38:07
going to roll them out. So we also do as part of this
38:10
consultation. Process.
38:12
When I talk about something like this, I can't help but try to
38:16
figure out how it's going to work in reality.
38:18
So I've been thinking two different use cases and I'm
38:22
wondering if they are the requirements that you're looking
38:25
at and trying to solve for One is there's got to be some kind
38:28
of transition period, right? Not everybody has a smartphone
38:32
and there are some people who may not even have EU credential
38:37
but are here. For example, me, I have AUS
38:40
passport, which leads into the second use case, which is
38:45
global. You know, beyond the EU is the
38:49
set of requirements that you should be able to support kind
38:53
of anything beyond what is needed in the ESO.
38:57
In other words, travel globally, either incoming or outgoing.
39:02
Yeah, that's those are very important questions.
39:04
So on the first part, the European Digital Identity Board
39:07
is first of all supposed to be a additional component.
39:16
You can get one. So it is, it is basic.
39:21
I mean, first of all, we need to get it started, right.
39:23
We need to build the ecosystem we need, we need to get started.
39:26
So we cannot expect anyone at at in the beginning to have that
39:30
wallet and we cannot expect any relying party to support it.
39:33
So that that means we will have a parallel structure.
39:36
We will keep our existing processes even paperworked the
39:39
base processes and and and start with the more digitized versions
39:43
are using the wallet. So that's the answer to the
39:45
first question. So we will have a very long,
39:48
very, very long transition period.
39:50
And even in the EUDI law and in EI does it is stated that if
39:54
people do not want to use the EUDI, one of they are not forced
39:57
to. So it's not mandatory from the
39:59
users perspective. On the second point, I would
40:04
admit that right now we are looking onto Europe under the
40:07
European Union to be more precisely, which excludes
40:10
Switzerland, for example. And then in the European, the
40:14
UK, yeah. However, and that it's, it's
40:20
basically due to the fact we, we we first need to do all
40:22
homework, right? We need to build the ecosystem,
40:25
we need to get it in trouble in Germany across the European
40:27
Union. But we already looking into
40:31
point to point into our ability with Switzerland, for example,
40:33
right. For example, today we had a
40:35
panel where a representative of the Swiss EDED i.e.
40:39
ID project was first present. So we're looking into that as
40:42
well. And I think the fact, at least
40:45
on a technical level, that we more or less have settled around
40:48
the same set of standards makes it easier.
40:51
The hard part is to get the legal interrogability done, so
40:55
mutual recognition and so on. And this is, this is going to be
40:58
a hard task. I, I personally expect it will
41:01
happen in domains. So the mobile driver's license
41:04
most most likely will be the first domain because I mean, you
41:07
rent cars around the globe. So most likely that will be one
41:11
of the use cases that we will enable globally and we will see
41:15
what what other domains might be.
41:17
I mean the COVID vaccination certificate right back then was
41:20
an example of a domain specific credential that worked on a
41:23
global basis. And I think this is something we
41:25
should we should run. Yeah.
41:27
Those are conferences like this. It's really help, right?
41:30
Because like before it happens at that level, like, like people
41:33
leading their own things in different countries in this kind
41:36
of conferences meeting and being like, yo, what's up?
41:40
Yeah, that really helps. There's really people from
41:45
America too, right? American Motor Vehicle
41:47
Association representative is here.
41:49
Some people from Australia are here, a lot of people from
41:53
Japan. So yeah, that really, really
41:55
helps. And maybe illustrate a little
41:57
bit, for example, that I think I don't think there's a big
42:01
disagreement among the key countries like on the pillars
42:05
and the difference. Or for example, when the
42:07
service, like when Amazon is sending a request to a wallet,
42:12
like in the EU where it's a requirement.
42:14
At this point, we're saying in the EU, we have to make sure
42:19
Amazon is registered. In the EU, we have to make sure
42:21
there's this registration that request is signed and wallet has
42:24
to validate it, right? Versus in America, there's no
42:26
such requirement. They're saying the
42:28
discrimination like even if request is not signed, even if
42:31
we're not sure it's actually Amazon still let it go, right?
42:34
So it's like differences like that.
42:36
But at that point, it's sovereignty arguably.
42:39
So we're not gonna try align on that globally.
42:41
So it's like different levels like what we need to align
42:43
globally to make it work versus like versus regional differences
42:47
will remain for good reasons probably you know?
42:49
You brought up the digital driver's license, and I feel
42:52
that's an area where in the United States a lot of progress
42:56
is being made. But I think it's so dependent on
43:03
the readers. Has to be, you know, I'm not
43:07
going to open up my phone and hand it to a police officer.
43:12
I don't trust that person to go through and look at the
43:14
information. I've got to just bump my phone
43:16
and it'll transfer just the information that they need in a
43:20
traffic stop kind of situation, so.
43:24
So stop speeding man. That's another well, I can't
43:27
promise anything but the it's just another level of standards
43:32
that's probably required, right? I think these driving licenses,
43:37
the interesting dynamic is the majority of work that has been
43:41
done in that area is this in person over Bluetooth, NFC
43:45
presentation where you're imagining like tapping and all
43:48
that, right? But like in reality, the big
43:51
need is over the Internet. Like there are only so many
43:54
cases where you're like you're speeding in the middle of the
43:57
mountain or in the middle of, I mean, America, it's a huge
44:00
country. So maybe you have, you know,
44:01
highways where there's no connection.
44:02
To be fair, like a majority of cases you have Internet
44:05
connection, you get a request remotely, you're you're like in
44:08
proximity physically, but the request is being sent over the
44:11
Internet, it's encrypted and all that.
44:13
And I send like over the HTTPS, no need to hand any phones.
44:17
And that's where like as long as the the same protocol is
44:20
supported, it works, right? And that's where arguably the
44:23
barrier of the what you call the readers or the verifiers I'm
44:27
supporting the same protocol is much higher, right?
44:30
And I think there's actually some work happening in Fido,
44:33
starting in Fido to make sure the same protocol that works
44:37
over HTTPS also works over Bluetooth using CTAP Hybrid.
44:41
And once that becomes real, every single like even reader
44:45
that only is offline right now, like the Android OS readers can
44:49
automatically upgrade and you can use the same open EVP
44:53
protocol over the HTTPS and the Bluetooth.
44:55
I think that's where the adoption actually gonna, you
44:57
know, boom. But it's steps by step.
45:00
Yeah, the solution is there. It's just, well, everybody,
45:03
what? How long is it going to take for
45:05
everybody to get online? Because if you end up in, say,
45:08
you have a driver's license in New York City and you're driving
45:12
a cross country and you end up in the middle of the country and
45:16
they don't have the reader, but then you have to keep a wallet,
45:20
a physical manifestation. Do you?
45:26
I have to unlock your phone and show them I mean.
45:29
As always. Yeah, I mean, I mean, it's the
45:31
current situation. I mean, basically I used to pay
45:33
with my phone. But yes, I have still my my
45:35
credit account in my pocket as a Plan B, right?
45:38
Plan B. Yeah, it's a Plan B, and I think
45:40
it will take time up until, I mean, when I can't.
45:44
I can't remember when computers were introduced in the company
45:47
where my mom worked, and they still printed out everything,
45:50
right? Just to be sure, right?
45:51
They have a Plan B when the computer is not available,
45:54
right? No one would do that.
45:59
I think, I think, you know, we're in the midst of the very
46:01
beginning part of the transition and to be honest, I feel like
46:04
this is like a decades long thing.
46:06
Just knowing you're trying to get what 100 and 8090 countries
46:10
eventually on board with this. That just takes time.
46:13
I would not, but it has to start somewhere.
46:14
I. Would not argue with you.
46:17
You guys have been really generous with your time and I
46:18
want to ask a very, very important question before we
46:22
wrap things up. If you were a potato, how would
46:26
you be potato or potato or however you want to do it?
46:30
If you're a potato, how would you want to be prepared?
46:33
And then I'm going to analyze your answer.
46:35
Uh oh. So who wants to go first?
46:39
Yeah. So I'm, I grew up in Japan.
46:43
We value our rice cookers in Japan.
46:45
And I don't know if you know, but you can actually cook
46:47
potatoes in the rice cooker. You just put the potatoes with
46:51
water in the rice cooker, you press the button and then it's
46:53
just done. I want that.
46:56
So I'm, I'm I'm I was not aware of this and I have a rice cooker
46:59
so I can try this. What is, I guess what's the
47:02
consistency? Is it like a baked potato?
47:04
Is it like a Mashed potato? Like what does it come out as?
47:06
It's boiled dish. So it's very soft.
47:08
Boiled, I would say. Yeah, all right.
47:11
I use it for a club. It's really good.
47:12
Okay, all right, that's good. I don't have any clue of
47:16
cooking, okay, So I would like to be delicious, okay, yeah.
47:20
So you order out and. Have as a requirement or maybe I
47:25
wanna be like a fried they French fries, but they're a good
47:31
one, you know what I mean? There's a difference between a
47:33
bad French fries. Really good French fries.
47:35
How would you be like a straight French fry or a curly fry or
47:38
like a waffle fry? Don't make me curly, OK?
47:43
That's where you draw the line. You already fry it.
47:48
See, I took this question. I've heard this question a lot
47:50
of times. Yeah, it's chef's favorite.
47:52
And I always thought of what's the least painful way to die?
47:56
I don't want to be thrown in a fryer and I don't want to be
47:59
boiled in my rice cooker. So that's the most mildest, you
48:02
know what I mean, You can. Throw me in the compost file and
48:04
let me die a natural death. Oh yeah, put me in the in the
48:09
ground so I can. Grow my.
48:10
Family. That's a good one.
48:12
I grow a family. So the I'm, I'm glad you brought
48:15
that up because this is a question I've asked several
48:17
times over the years and people generally answer this as the
48:22
delicious factor. What do I like?
48:25
How do I want to be prepared? Because This is why I like rice
48:28
cooker French fry a gratin for me, right?
48:31
You want a delicious, Yeah, a gratin or maybe like something
48:35
like that scalloped, right, etcetera.
48:37
Gem. And this is kind of a well known
48:40
thing at this point tends to be more of a downer on some things.
48:43
And so he took it and I hadn't thought about this was the pain
48:47
aspect of I'm a potato. And now I'm going to.
48:51
That's my identity, right? And now you're going to put me
48:54
through some torturous death being thrown in boiling oil.
48:57
Make. Me a digital potato.
48:59
Turn me into digital. Potential your potato and now
49:01
with 100% more AI or something like that.
49:03
Yeah, yeah, so there's that. And then I have heard the one
49:07
about being planted to become more potatoes, so more of like a
49:10
nurturing type of answer. So for me, it's a little bit
49:13
like a little bit of psychology test.
49:15
Like, all right, well, where's this?
49:16
Where's the headspace at? Who?
49:18
Cares about pain. Yeah, obviously I'm not a
49:20
doctor, so please don't take medical advice on, you know,
49:22
potato Ness and how that. Goes to you disclaimer, don't
49:26
sue me. All right.
49:28
So that was a great conversation.
49:30
I really appreciate you guys taking time.
49:31
I know it's a very busy time. You have panels, you've been on
49:34
the stage. You guys have been awesome.
49:36
You're doing great work too, so thank you for the effort.
49:40
Yeah, we need pushers and I am heroes out there to drive things
49:43
forward and a lot of organizations have I am heroes
49:47
internally and it's sheer will that things get done in spite of
49:52
politics, funding, governments, you know, just all the things
49:56
that are going to happen. So I really do appreciate you
49:58
guys efforts and and hopefully becomes sooner rather than later
50:01
because I'm all in like the one thing I don't want to happen
50:04
though is like 48 different wallets and it just replaces the
50:09
ID and password to some degree. Like let's try to figure out how
50:12
we can not have a wallet for every single thing.
50:16
I think that would be really nice.
50:17
We're making it very, very easy for you to select one out of 48,
50:22
so even if you have 48. You can stick you stick with the
50:24
1 then. Yeah, stick with the paper.
50:27
And we are very dedicated to make it the universal.
50:30
Thing well, I appreciate it guys.
50:32
We'll go and wrap it up here for this episode.
50:35
Let's see what else. Thanks again to cover your Cole
50:37
and especially Marina and Martin for bringing us out here and
50:41
helping us and Warwick and Warwick for the shout out on the
50:45
stage. That was that was awesome.
50:46
That was cool. That was unexpected.
50:48
So it wasn't I didn't know that was happening, right.
50:50
I said, oh, that's pretty cool. And then when he said it, it was
50:52
like, oh, that's neat. And then when people started
50:54
clapping, that was even neater because that could have very
50:56
quickly turned into nobody knows, no clapping or even
51:00
worse. So I definitely appreciate the
51:03
support that we've gotten on here and I hope we'll be able to
51:05
come back again next year. So you can find us on the web,
51:08
IDC, podcast.com, everywhere you get podcasts like share, spread
51:12
the gospel of I am and the work that these guys are doing and
51:15
let's get it done. So with that, thanks everyone
51:17
for watching and or listening and we'll talk with you all in
51:19
the next one. You've been listening to
51:24
Identity at the Center. We hope you've enjoyed the show.
51:28
Make sure to like, rate and review, and we'll be back soon.
51:32
But in the meantime, hit the website at
51:34
identity@thecenter.com. See you next time on Identity at
51:41
the Center.