Root Causes 319: EU Digital Wallets

Hosted by

Tim Callan

Chief Compliance Officer

Jason Soroko

Fellow

Original broadcast date

July 21, 2023

A new agreement mandates that European countries will make digital wallets available to their citizens in 2024. We explain what's coming and some of its implications.

Podcast Transcript

Lightly edited for flow and brevity.

Tim CallanWe have a news item we want to talk about. And this is, to some degree a predictable part of a larger trend and effort but it's still an important milestone, which is that the European Union, the European Parliament, and the council for the European Union, are in agreement, basically on the fundamental legal framework of a Pan European citizen by citizen digital wallet.

Jason SorokoRight on. And we're getting closer and closer. We've talked about this on this podcast before, but I think it's good to bring it back to everybody's consciousness, especially to our North American listeners who maybe this isn't top of mind, but I think it's important for everybody to know what's going on over in Europe because it's kind of a big deal.

So we in previous podcasts, we talked about EIDAS 2.0 regulation coming into play and that's something we had talked about, which was going to serve as the regulatory framework under which this new identity wallet for Europe would serve. And obviously then, there's a whole lot of work that had been done in there to enable businesses to be able to - - all the different legal constructs that needed to be put in place where there and that's why we're now here. But the reasoning for the timing is that basically by 2024 the edict was every EU member state needs to make a digital identity wallet available to everybody. Within those countries. And so, Tim, what I find interesting is the first thing is as North Americans, we think, well, which company is going to put that out, and what product is this going to be? And really the rule is kind of interesting, saying, look, every country needs to have it. And so I think in some cases, it's going to be, perhaps the country themselves. Perhaps it's going to be a telecom company. Perhaps it'll be a utility. Perhaps it'll be a bank. But at least every country needs to have that in place and make it available for everybody who wants to use it. So the timing is coming. It's going to be next year at some point.

Tim CallanIt is. I think it's important to say every country has to have it. Another important point, though, is that part of this agreement is that it will be free to the citizens. So citizens will not have to pay money. So if you think about today, you can get an EIDAS certificate for yourself as an individual. You can get it now. And you go to a number of trusted service providers, TSPs, and you order one. Depending on if they serve your local region or not, or if they serve your segment and you give them some amount of money and it’s based on what they're going to charge you and at the end of this, you get a digital identity for you that's verified according to specific, processes that are detailed, and that is cryptographically secure, and all of the other things you would expect. And now you have this way to identify yourself, and to do that you buy it. And that's a straightforward commercial situation because people want to sell these. And so they go into that line of business, and you find one of them, and they follow the rules, and they sell you one and they charge you enough money that their business works. And we all know how that works. That's very similar to the world of all kinds of public certificates.

But this new edict dictates that it will be free to the citizens. And what that's going to do is that's going to necessitate a fundamentally different model. You can't just say, well, I'm going to hang up a shingle, and I'm going to follow the rules, and I'm going to charge you - make up your number - 50 euros, 500 euros, whatever it is, and I'm going to give you one of these things. Rather, there's going to have to be some other way for the economics of this entire thing to work.

Jason SorokoThat is correct. That is correct. And there obviously was a lot of work done within Europe to be able to make sure that commercial industries could get heavily involved in this and all the way down even to much smaller businesses than the usual suspects.

So maybe lets me list off some of the six main use cases here.

One of them of course is access to government services. And, online citizenship procedures is what they're calling it. So you can imagine what some of those things might be. Perhaps it could even be voting or registering for social assistance or things like that. But some of the other use cases are – and you can imagine these involving private companies opening a bank account and getting a driver's license, which, presumably, again, that's another perhaps e-government service. But then the telecoms want in. SIM card registration. So if you're signing up for cell phone services, you could use this ID. Prescriptions. There's a lot of centralization and government involved in prescriptions in Europe. That's just not the case in North America, but it is over there. And then of course, qualified e-signatures, Tim, which is what we were talking about, which is I want to sign a contract, and I want to sign it with my EU-identity wallet and that will be possible.

So, those are some of the use cases that we're talking about. And that one about driver's license is interesting. I forget which states. I could look at it very quickly, but I do know that at least a few states in the United States have actually signed on with Apple to provide an alternate form of driver's license. You get pulled over by policeman, you can actually show your iPhone and say, hey, here is my driver's license. And those are not just pilots anymore. Those are those are real, usable driver's licenses you can use right now in certain states if you're a citizen of those states.

And I think that the reason I bring that up is because I think, Tim, when you are reading some of this EU-identity wallet literature right now, you’ll hear a lot about EU technology autonomy. And we brought this up before, and I don't think it can be said enough that I think that Europe just did not want to be dominated by the inevitability of big US tech companies who owned the mobile device platforms having and dominating the wallets and what EU citizens are doing with them. So, possibly payments might always be part of that, who knows. European citizens might be using US technology for that but for a lot of these other use cases, Europe just wanted to embrace that and take that completely into themselves and it's become an enormous project for them over there.

Tim CallanAnd you do see that this is part of kind of a bigger macro trend of a concern at some level of giving up the autonomy of our sovereign nations by becoming utterly dependent on technology and having the technology owned and governed by other people. And, that's part of this certainly is there's a sense of we want to be in charge of our own future. We want to be in charge of our own fate. We don't want to leave it to the likes of Apple and Google and Microsoft, all of whom are located off our shores.

And then of course, this also ties into the other thing, which is the spearhead position that the European Union takes on citizens digital privacy. And you can see how this ties into GDPR and EIDAS and all kinds of other things, where they say, look, we want to have this cryptographically, highly secure digital system in place. We're gonna mandate it's available for all the citizens and it's just a very - - it's all part of the same set of trends.

Jason SorokoExactly. Tim, as part of this, people might be wondering what other kinds of ecosystems are out there. We were talking about payments a moment ago, and I just want to bring up this idea that you can now really start to look up European consortia that are championing certain kinds of use cases, even if it's not totally all of Europe. Sometimes it's regionally and there's one particular consortium that I was just looking at, called NoBid. N-o-b-i-d.

Think of this interesting corridor, Tim. Think of your geography for a moment. Norway, Denmark, Germany - continue south now - Italy, and then off to the left and right, east and west, Latvia and Iceland. So those countries have actually come together, and a number of their financial institutions have actually looked at payment issuance. So in other words, issuing some kind of an identity into the wallet, and then treaties around payment acceptance down to the retail level within those countries. And so, it's basically a consortia of banks in those regions, governments and some other interesting players within that - some of whom I'm familiar with just because of business dealings, and I just wanted to point that out.

I find it interesting that this corridor, cutting right through what is the center of Europe, from north to south, these countries have decided to work together. I just find it interesting. What’s a Norwegian bank doing accepting cross-treaty or consortia agreements that make payment systems similar from Norway to Italy. I just find it interesting that that corridor is one that kind of shaped up even before a lot of this stuff was becoming as mature as it is right now, Tim. But there's a bunch of these if you go and look for it. So there's been a ton of work that's been done and I'm sure a lot of these people are getting quite excited for next year.

Tim CallanAnd it's interesting, because if you look at EIDAS. EIDAS has been around for a long time. EIDAS was sort of the beginning of this effort. They even call it EIDAS 2.0. This is following on the work that was done in the original EIDAS agreement. And EIDAS has use cases just all over the place. You can pay bills. I mean not even like government stuff. You can just plain pay your phone bill or pay your landlord using your EIDAS certificate. It's just sort of in the fabric of the way that people can do business and interact. And you can imagine this just extending that, right? If every citizen can get a digital ID for free, and all they have to have is a compatible device, which presumably will mostly be a smartphone, but I don't know why you couldn't use it on a laptop computer or something else. If they have a compatible device and they can use this, all of a sudden, you very much have a critical mass in a way you don't know where they have to go buy their certs and be kind of technophile. Now, all of a sudden, you can imagine your very much have a critical mass and you can imagine this becoming much more common as a method of interaction that all kinds of people, not just government offices, not just quasi government functions, but good old fashioned businesses are offering, right. And then, of course, the more of those businesses will let you connect using your digital ID, the more motivated you are to go get that free ID from the government. So you could see this being the beginning of something that's rather transformational in terms of digital identity inside of Europe.

Jason SorokoI think it will be. It definitely will be. I wonder in North America what we're going to end up with in terms of governments. I do know that in Canada, there's been noise - I know it's probably the same United States. I'm just less familiar down there. - the idea of digital currency at the federal level, and it being tied to something like this.

In other words, a type of citizen ID. If you're going to have a digital currency within a country and the country is going to mandate it, then obviously, you need some kind of digital ID to float around with it in order to be able to make the transactions, the equivalent of a crypto wallet, but it's actually a digital ID. The scarier parts, though, the scarier parts - and this is why it's probably slower to take in North America, although I really am scared it will come to Canada at some point in the next little while, because the government seems to have this kind of leaning, but I wonder how Europe feels about it as well. As soon as you have this much centralization, there's been all kinds of lip service being paid to hey, you can control certain attributes about yourself that are in your wallet, and you control what is seen and not seen. You can ask for information from private industry to be forgotten about. These are very things that Europe has challenged, and they sound good. The problem is, as soon as you start tying, bank accounts to digital currencies, you start tying it to digital IDs that are like this and then right now, a lot of what's being said is, hey, this is not a complete replacement for your passport, your driver's license, your access to your bank account. It's just to make things more convenient. Hooray. But what happens if the world isn't benevolent. And then all of a sudden, a government wishes to tie this to something like, I don't know, let's say a social credit system, which is where if you don't agree with the government of the day, they can knock a point of social credit off of you and all of a sudden, you no longer have access to your bank account. So these are the kinds of things that I think when we get all excited about digital identities and cryptocurrencies at the federal level, these are the things that go through my mind. And I think we should all be thinking about it because I just don't read enough about it. I don't read enough government assurance that that's not their plan and I find that part of it interesting because it's not just the elephant in the room, that's the herd of elephants in the room that could eventually come and trample all of us.

Tim CallanAnd even if it's not their plan today, how do you know it's not going to be the next guy’s plan.

Jason SorokoOnce it's completely in place, a government of the future that has perhaps is going through a crisis and we saw this with Covid, we saw how the government had a lot of power to keep us in our homes and for good, for bad, I'm not here to debate any of that, it's just when you give the government that much control over how you transact and how you identify yourself, wow. That might control a lot of aspects of your life that people who were born as far ago as I was, we're just not used to that level of government control. I think that this kind of inevitably leads to a government of the future saying that much power is just too seductive to me. I'm going to seize that power. My citizens be damned. I want to control them.

Tim CallanSure. Especially when you consider the government is run by individuals. So if you'd look, just think about democracies, which certainly most of Europe is, all you need is the party in power to be replaced by a different party with different ideals. Like, it's not even that hard. And so, in that regard, and we've seen wild swings in the opinions of political parties that can take over countries in terms of what is okay, and what is not, and what rights look like and what they don't and we've seen these throughout Europe and North America plenty of them in the last 10 years. And so in that regard, I mean, I think it's an interesting and difficult question to say how do you build a system like this, where you can really ensure that it is prohibitively difficult to do that kind of thing? And I don't know the answer but that is a dialogue that probably needs to happen.

Jason SorokoSo I think that with all of everything we just reported about the current state of EU digital identity wallet, I mean hey, we're getting down to the brass tacks here. It really does look like next year a lot of these what were really would be considered testbeds are going to be flipped into live real systems, and then the growth of this will skyrocket more than likely. This is the point where the point of pausing and thinking about the risks of citizen IDs has long since passed and I just got to bring it up sometimes. We're opinionated in this podcast and it’s like, geez, I just don't know if we, if the people, the citizens, who this is going to be foisted upon fully understand what it is that we're all signing up to here.

Tim CallanAlright. So hear that that European Union? Listen to Jason.

Jason SorokoThere you go.

Tim CallanThere you go. No, I hear ya. And I mean there are other things like fundamentally, if you put more power - and this is a thing that's happened societally, anyway - if you put more power, ultimately, your power as a citizen into your possession of a reliable telephone, mobile telephone, which is a relatively expensive item, compared to a lot of items that you might own, what does that do? What does that do to people who are below the poverty line? What does that do to people who are otherwise disempowered as citizens and maybe they don't want to use this technology. Maybe they have a religious objection to this technology. Maybe they don't have coverage where they are. And under those circumstances, do those people find themselves at a disadvantage? You talk about voting. If we can vote on our mobile phones, and I live somewhere where there's no mobile phone coverage, then it's harder for me to vote. That's a fundamentally disenfranchising technological situation.

So all of that stuff is going to come into this too. If we start to say, not only are we going to attach, yoke everything to your digital ID, but we're going to yoke everything to your digital ID on your phone that you own and what if your OS isn't current? And what if your battery doesn't work very well, and it runs out of charge every 30 minutes, and etc., then all of a sudden, that can be problematic, too. So there's a lot of hairy stuff around this that I'm sure is going to work itself out one way or another.

Jason SorokoFor sure. In Europe, you can probably count the number of the really big banks on a few hands. And the United States of course, regional banks are just part of the culture and part of how things are done. There's so many differences of homogenous culture in Europe versus the United States. I think that - and Canada somewhere in the middle of that - I think that that's probably one of the main reasons why you just don't see this kind of thing in North America right now. It's why Europe is leading it. It is the homogeneity of even just the availability of these coverage of cell signal. People don't think about that in North America so much, but Europe was always way, way ahead of North America with respect to that and it just it allows for this kind of technology just that much more. I don't know, Tim. I don’t know what the future holds here. There's a lot going on.

Tim CallanWell, as Yogi Berra said, predictions are difficult, especially when they're about the future. And I think that's definitely true in this case. But, it's an interesting and important development. I think this is one we're going to keep our eye on for sure.

Stay informed with expert insights

Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!