I have a subject about digital identities and whoop thank you and we have the
pleasure of welcoming Amalyan Das Data and Gregor Little Franksky, you know Gregor
Bronsky, sorry I tried to say you're pseudonym at the same time as well, I invite
you both to come stay here and to have this little microphone for the recording.
Do we need to hold it?
Okay.
Also attach it to ourselves.
Yeah.
But we're going to be on.
Yeah, it will be fine.
So the mic is just for the screen so you still have to speak.
Very, yeah.
We'll try to organize everything like logistically.
Everyone is sitting down at once to be sitting down in the room and if not, we'll sort
of a problem out later.
My name is Amalyan Das Data.
I'm from Sweden.
Where we have a very high level of the idea adoption.
It's very used.
We have the most authentications.
Paranum, per citizen.
You can do your taxes with your electronic identification in Sweden.
I also used to work in the European Parliament on the first EIDAS regulations.
So not the first trust services legislation in the EU ever.
But in 2013, 14 when they were creating the first directly applicable law for EID in the European Union.
Hello.
My name is Gregor Bransky.
I'm from Germany.
Our EID adoption is currently at 6%.
But higher at the younger generation.
Our EID usage is rare.
We can pay our taxes digitally without using EID.
We're very worried about over-identification because in Germany we believe people are not numbers.
We tried that.
It didn't work 80 years ago.
And I'm very, very unhappy with the current approach where the EID is heading because it's going that way.
Our funds today will relate to the second EIDAS regulation from the European Union, which was passed in 2024.
And which seeks to establish a generalized European identity wallet for the benefit of citizens when interacting with private or public parties.
Hopefully, we will have convinced you at the end of our 10 minutes that the word identity makes people in particular politicians,
discussed the lives of private citizens in a way that isn't helpful.
And that maybe the beneficial use cases for a European identity.
In fact, we can find more in the authentication and authorization of business-to-business transactions.
And when persons are acting on behalf of their organizations in commercial settings.
Developing this presentation has been very interesting.
We come from different countries in the EU with different approaches to identity and different levels of introduction of identity and authentication and online environments.
Even offline environments for that matter.
Trying to wrap our heads around the state of our own Germany and Sweden business models visions of authorization, etc.
It has been an adventure and continues to be so.
But that said, we have some real problems, we agreed also.
That's my. Okay, so why EID?
I'm not sure if you actually were online sometime, but you get this button's jumping in your face, which is signing with Google, signing with Facebook, signing with Apple, and signing with Twitter.
And every time an app or website asked us to create a new digital identity to easily lock on via big platform, we have no ideas what happens to a reality.
ACID that the European Union took on that and they decided that they want to protect the digital sovereignty of their citizens.
And basically this seems to be part of the vision that is argued publicly.
Well.
But so we identified a different problem, which we think makes more sense to solve at the European level.
And it was kind of a mind blowing experience for me to figure out.
This that apparently it is in the European Union a problem that when you're handing over a concrete truck on a construction site.
There is no easy way for the driver of the concrete truck to hand over the keys to the truck to the right recipient and knowing where the concrete goes.
And so there's this concrete theft problem where people are handing over concrete trucks to the wrong person, causing massive delays.
For construction companies when trying to lay the groundwork for buildings, I mean we could only intuitively see how this is an international logistics chain.
Where you have people generally of lower educational backgrounds having to perform complex tasks that require proper authorization and they have no easy mechanism of doing so.
So this would not be such a big problem for the construction sector if there was a reliable cross-border interoperable way of authenticating those persons who should hand over a concrete truck and receive a concrete truck.
For instance with the mobile phone application using NFC.
And so in these business to business transactions there's really a lot of benefits to begin.
There's a lot of money that goes into these ideas of a generalized European identity.
But it's also kind of obvious that a generalized identity scheme would have a lot of stakeholders.
So to often the political parlance is kind of dominated by this vision of the EU as a shield between the citizen and Google.
But the real problems, the real benefits for European citizens and businesses are insolving other problems entirely than how we're faced with this login screen.
So let's not underestimate the challenge of developing the systems for multiple sectors of coordinate across multiple borders requires a lot of common capacity.
This is why companies turn to the government to help set up the right cooperation mechanism to get a good technical outcome.
You can see the problem harmonizing infrastructure when it comes to getting trains runs through all of Europe.
If you look at train train tracks with different gauges, you can either build train tracks that work for all gauges, or you can build trains that run on multiple gauges.
Those are painful and expensive.
There is hope on the horizon. There is 22040870 CNS which is the security of identity cards of the European citizens and a president's document issued to the Union citizens and their family members.
Which we will have available by 2031 according to current planning.
So AEDS 2 is pointing the question that it doesn't have a harmonizing infrastructure to run on and still doesn't want to achieve stuff.
So back to real problems.
So one of the very real problems facing the European Union in this field is that harmonizing infrastructure across member states causes the member states to be territorial.
And so the current theory of change is that you will have a bunch of lawyers at the European Commission discussing with a bunch of lawyers in the member states,
whether you can make delegated acts to kind of force everyone to use different wids of train tracks to follow on that analogy.
And so that's starting out to be more challenging than originally for a scene. They have been added for like 20 years in their defense. So this is like just the latest iteration of attempting to solve infrastructure problems.
But there is several other challenges with building identity schemes. Like, how do you make the proper economic model?
So one challenge and authentication is that if I'm trying to buy something from Gregor, and he wants to authenticate that it's me, but we're using an identity provider that's a third party to authenticate my who I am.
Yeah, how does that third party get paid? Who's going to pay them? I have no relationship with them. My relationship with Gregor is from him. I want to service. His relationship is with me. He wants my money.
The identity provider is kind of left hanging, like there's not really clear how how they would get paid.
Is it per authentication? This is the method currently adopted in Sweden. Is it some kind of subscription service where you can make a number of authentications per month?
Is it some other scheme that you know, it's just provided us a common infrastructure? We don't really know.
And it's creating problems when we're trying to work out. What is the value chain that we need to do to make these, you know, concrete handovers work?
So there has been a study by Fraun who for who shows that actually there is no private business model working for identity providers and the current German setup, which seems to apply to other European states.
There is an initiative called Glyph who's trying to solve that for basically corporations that are trying to do business, but not for private citizens.
And it's about the successful with the OCD20.
And when we want to talk about helpful solutions, we found that there are two caveats out there, which is legislatures need to be empowered to understand what is possible.
For example, that you do need to identify as to match identities. SSI is a privacy and security nightmare for everyone who actually thought about it for more than five minutes.
And we should really empower non-digital communities because writing digital text standards is really hard. People present here might be familiar with it.
And those people in the construction industry know their stuff, but they don't know how to build digital standards and we should try to empower them to do so.
Like the initiative, finally, for sure.
Now, so we found this interesting initiative from the construction sector, finally for sure.
Where there is still much about it like XML.
And we thought wouldn't it be better if all of these lawyers at the European Commission and in the member states, but dedicate some time to locate these industry initiatives to solve real problems for like real people and companies.
And then try to help them with the digital expertise necessary instead of hammering their way through 29 delegated acts that nobody anyway wants.
Presumably, though, come to realize this after some years of trying to do these delegated acts.
But why not make a shortcut? Do it immediately.
So the question is what's left to do? And what the e can do, they can provide infrastructure and regulation, like harmonizing incoming using the infrastructure with the harmonization of the EID cards by 231.
And until then make a regular, make a regulation to allow log in by pass key, for example, so that you don't have to log in with the UD wallet, but can choose what you want to do.
And they could also provide an initial infrastructure which would be basically one to propose here, which would be called the EOLI, the European Union Organizational Identifier.
Because organizations don't need privacy, they can be actually rubber stemmed.
And what you can basically take is the organizational registers of every European member state and add them to CPEI, and because transforming those organizations might be painful.
It's easier to just pop up a Pan-European PKI to allow organizations to identify themselves and people whom they delegate authority to.
And so that's our humble proposal for the European Legislature and for people in the room.
We thank you so much for your attention. Think our ten minutes are already up.
We'll be available outside if you want to have further conversations about this.
Identity schemes are by no means an easy political topic, and we hope that this has given you a brief overview of the current state and what is possible.
Thank you.
So, since we have...