Why Digital ID is Dangerous [Video

Freedom - it's soooo 19⁸⁴

You can read about "Freedom" in the history books ...

Oh wait. Those books have been rewritten.

Sorry about that, Global Citizen ...

The Clueless Sheep 🐑🐑🐑 will yawn

Direct Link to the Video

https://youtube.com/shorts/K__xZ1KY-pY

The United Kingdom and China represent the future

Digital Surveillance and Control

/Captain Obvious

AI Overview: (hehe)

Loss of Anonymity:

Critics worry that Physical Cash-like Anonymity in Daily Life will disappear when Every Transaction, Check-In, and Movement REQUIRES a Digital Scan.

Welcome to the New World Order - arriving incrementally

Wait - That's Just A Silly Conspiracy Theory™

The philosophical and practical risk question in that video is on the money - if you’re minded to think that a certain political party, or its leadership, is utterly nefarious, how much control over your digital identity would you ever want to give it.

But there is an gloriously erroneous assumption right at the very top of the video, which is that the mere existence of digital ID that government can ISSUE or CONSUME is an inherent gateway for fascistic abuse because the government or police can spy on the ID at any time, with or without your knowledge or consent, OR because it can trawl a database, OR because they can put turnstiles up at protest locations and track who’s going through the digital gates.

Frankly, all of that is based on “legacy” approaches to digital identity - it is not how “self sovereign” identity works.

I’ve NEVER trusted the British government. I don’t support the idea of compulsory ID cards - physical OR digital. I want MY identity entirely in MY hands, under MY control, and kept in MY wallet. Whether it’s my bank card or my drivers’ license.

The UK government is an ISSUER of identity documents and unique IDs related to them. But that’s always been the case. Whether we’re talking about a passport number, driving license number, the unique reference numbers for tax and National Insurance, or the NHS numbers which get issued as part of birth registration.

But that isn’t all of what I’ve got in my wallet. And the risk of revocation extends beyond government. (My bank could de-bank me whether or not I’ve still got the card they issued, in my wallet.)

With self-sovereign identity, the issuer has no real way to track how often, or even where, you’re using your bank card or passport or driving license if it’s simply being used to pass a visual check. If there is a TRANSACTION using that document/ card, then there will be an audit trail. But that is VASTLY far more likely to benefit you (or serve your defense) as it is likely to be used as evidence against you.

Wherever you go for healthcare treatment in the UK, if you have an NHS number, you can simply use that number as a pointer. If, say, you get hit by a London bus and you’re in a coma, but your GP is in Manchester, the hospital needs to know about your allergies, medications, etc. but that info’s stored in the GP record. The only way the hospital cal see that info is if they can determine your NHS number (based on other identity attributes), then look you up, and then see which GP you’re registered at, and then ask that GP for the relevant information.

There is maybe a 0.001% chance that some asshole somewhere working in the NHS will abuse this mechanism. But the other 99.99% of the times it’s used, you BENEFIT from the use.

Does the NHS have patient consent for all this? Actually, yes, they do - AND we all could, if we were utterly masochistic, revoke our consent for a whole bunch of stuff. I could assert that I never, ever, want a blood transfusion for example.

But here’s the problem - a hospital outside of my home area CANNOT know about any of that (or anything else of equal importance) if it cannot use my NHS number to look at: my active consents / withdrawn consents, my allergies, my ongoing treatments, my long term conditions, my expressions of wishes, my living will, my Power of Attorney arrangements, etc.

So the best way to ensure EVERY hospital can honor my decisions as a patient, even if I’m in a coma, is if they all have my consent to use a common unique identifier. So even if you want to totally opt out of everything else, the common and guaranteed-person-unique NHS Number is still needed for a hospital outside of your own GP’s area to confirm you’ve made those opts-out.

That’s not a defense of fascism, it’s just a defense of basic common sense.

These days, I do have more than one wallet. There’s a physical one with bits of plastic in it, and there’s a digital one. While various banks, companies, and government ISSUE me with the bits of plastic, it ain’t the government, banks and companies who are telling me what to put in the wallet. That’s MY decision, not theirs.

And this exact same principle applies to digital identity IF DONE PROPERLY.

It’s called “self-sovereign identity”.

If the government wanted to revoke my driving license or passport or National Insurance number tomorrow, and it had unfettered fascistic powers, it could revoke them in the back ends. But that doesn’t actually stop me presenting the physical artefacts at the front end.

In the exact same way, my digital wallet has digital representations of my bank cards, driving license, passport. Unlike their physical counterparts, these items can only be presented by me - because my phone’s biometrics prevent anybody BUT me from presenting them.

Now, there are questions that arise in a challenge/response workflow where I want to use my bank card and the card has been declined arbitrarily by the bank. But if it’s been declined in the digital banking system I can’t bypass that by using the physical card instead of the digital one.

And that, essentially, is the fallacy at the heart of the objections around digital ID. The ID behind your passport or driving license is ALREADY digital and it’s THAT back end that’s susceptible to abuse.

Putting a plastic card in your hands, currently, gives you the ILLUSION of control in the back end, but you only control the front end.

Self-sovereign identity extends your control over the front end AND (if adopted correctly) gives you greater oversight of abuses in the back end.

It’s definitely coming - nothing will stop it from happening

who will be in power remains to be seen

It’s going to come for a whole variety of reasons, not all of which are obvious to the layperson; and it is very easy to fall into the trap of arguing for “throwing out the baby with the bath-water” if one doesn’t have the complete picture.

It’s very much like the whole debate around voter ID.

How can you detect when a person DOESN’T have the right of residence, and doesn’t have the right to vote, and has simply overstayed on a student visa and got some dodgy spiv to run off some fake ID, if you DON’T have verified digital identity and DON’T have “reasonable suspicion” or “probable cause” sufficient enough to trigger a deeper inspection?

The uncomfortable answer is, you can’t.

Even if we did roll back governance all the way back to how things used to work in 1981, where everything was done on paper and plastic, we cannot ignore the fact that the tech to create the physical paperwork in 1981 is, by modern standards, insanely primitive.

Anyone with access to a $200 printer can now knock out totally convincing counterfeits that’d pass any manual check. If you present that to a doorman who’s distracted, or an inattentive official, you can blag your way into buildings and get hold of other stuff. Without much effort, it’s possible to layer up, so you might start with a fake drivers’ license and a fake birth certificate but end up with a massive file of “genuine” evidence all issued on the assumption the fake papers were real.

So, in effect, a completely libertarian and anti-technology posture needs constraints, otherwise it becomes totally unenforceable in practice.

(a) 90% of the time you NEED someone to think “that person’s photo ID card might be dodgy” the people you’re relying on will automatically assume it’s legit - especially if they think the photo ID is really sophisticated and difficult to forge, or if the person presenting the fake ID understands “social engineering” and can blag it.

(b) 9% of the time, when they decide it needs checking, they’re basing that decision entirely on woolly grounds - they’ve got a hunch, or they hold a prejudice, or they’re simply following a profile.

(c) Maybe only 1% occurs as the result of actual detected wrongdoing or a definitive reason to be suspicious - but if you’ve eroded the ability to detect, you’re relying on the carelessness of the wrongdoer to give you grounds for suspicion.

All of this is NOT NEW. Banks introduced Chip and PIN because cloning a card and faking a signature was ludicrously easy to do, and often impossible to detect. Banking apps for smartphones now have biometric tie-ins because Chip and PIN ain’t strong enough to stop someone who’s intercepted your long card number and CVC from being literally able to empty your bank account with fraudulent transactions.

If anyone tries to buy anything with MY bank details, without my knowledge, they’ll get unstuck. Because I get a ping on my phone, from my banking app, in effect saying “Is this definitely you?”

I even have a similar set up for my property records the Land Registry. If anyone tries to access my property title and deeds, even if they’re impersonating me while doing it, I get an alert on my phone. At their end, there’s a default “deny unless I authorise” workflow in place. As this isn’t even linked to my mobile phone number, a hacker can’t simply clone my SIM and intercept the messages to bypass this security.

The next iteration of my private healthcare app is ALSO going to support a feature like this. If a clinician attempts to access my medical records and I’m not actively participating in a treatment / consultation exercise with that clinician, it’ll actually ask me, do I permit this.

THOSE WORKFLOWS ARE IMPOSSIBLE TO IMPLEMENT WITHOUT VERIFIED DIGITAL ID.

Interesting observations you have.

Fraudulent Digital ID will continue to evolve as well as it eliminates all the risks of the “primitive physical paperwork.” IOW ... fraud will not be eliminated. I might argue that being a victim of digital fraud is more difficult to correct than being a victim of paperwork fraud.

While I have not thought this through yet, a combination of “primitive physical paperwork” + digital ID transactions + stiffer punishments for fraud might be a better approach to reducing fraud risk and ensuring individual freedom to live one’s life in today’s world.