Accredify Digest is a series of ideas, opinions, and observations from Accredify’s employees. Hiring a highly invested team also means welcoming passionate voices that need to be heard. Find out what the brains behind Accredify think about strategy, tech, operations, security, and culture in this series. 

In light of the recent furore over passport applications induced by the easing of COVID-19 travel restrictions, Accredify’s Product Manager, Prasheen Param, shares more about why passports expire in the first place. After all, if passports did not need to expire, then hopeful travellers would not have to rush to renew their travel documents in time for their long overdue vacation. Beyond exploring the need for passports to expire, Prasheen also shares more about how Verifiable Identities could pave the way for a passport-less future, where personal data protection and border security are both enhanced beyond what traditional passports can offer.

---

The resulting fallout

Beleaguered domestic immigration authorities are now grappling with an overwhelming volume of passport applications. In Singapore, for example, ever since the easing of COVID-19 travel restrictions, the Immigration and Checkpoints Authority (ICA) has been processing 7,000 passport applications a day – this is triple the volume of passport applications pre-COVID-19. And processing time, unsurprisingly, has increased from 4 weeks to 6 weeks, due to the surge in demand.

And as immigration authorities work tirelessly to grant their citizens access to the world, travellers are left with mounting anxiety about disruptions to their travel plans because of potential delays in their passport application.

With passport applications causing so much distress for both immigration authorities and travellers, the question must be asked: why do passports expire in the first place?

These challenges are testament to the shortcomings of traditional paper-based identity documents. Today, digital versions for all things paper have become the preferred alternative for most of the world’s processes for myriad reasons, ranging from easier storage to greater data security. Unsurprisingly, the solution to the challenges of traditional paper passports is to also move our identity from paper proofs to digital ones.   

Verifiable identities are better alternatives to passports

The purpose of a passport is to help governments identity a traveller as a citizen with a right to protection while abroad, and a right to return to the country of citizenship. Essentially, a passport is an individual’s national citizen identity.

With Distributed Ledger Technology (DLT), we can build digital, verifiable, national citizen identities that can effectively address the issues that necessitate the expiry of passports. DLT can easily overcome the challenges of traditional printed passports!

What are verifiable identities and how do they work?

A verifiable identity is an individual’s digital identity built from verifiable, tamper-proof, digital documents powered by DLT. These verifiable identities can provide international authorities with a reliable way to authenticate the identity of a traveller. From nationality, age, gender, to educational attainment, and even vocational qualifications, an individual’s entire library of verifiable documents can be contained within a single digital verifiable identity, which can be accessed by a secure digital app, such as Accredify’s Passport solution.

An example of verifiable, tamper-proof, digital documents is Accredify-issued COVID-19 Pre-Departure Test results (PDTs). These COVID-19 PDTs are built in accordance to Singapore’s national COVID-19 travel standard, known as HealthCerts, and are both instantly verifiable and tamper-proof. At the peak of the pandemic, such verifiable documents helped facilitate the resumption of international travel, as it provided authorities with a reliable way to verify the COVID-19 status of travellers from Singapore. Currently, HealthCerts is recognised across 4 continents, and by over 200 airlines and cities.

A big concern for people, regarding verifiable identities, is data privacy and security. Where is any semblance of personal data protection if all of their personal information can be found on one single digital app?

Verifiable identities actually enhance personal data protection by ensuring that verifiers are given access to only information that they need, and nothing more. One way to do this is through Zero-Knowledge Proofs. This means in the verification process, the verification mechanism will only return a YES or NO answer to identity checks, without ever revealing the individual’s actual data.

Let’s take a hypothetical traveller, Mary, as an example. Mary needs a visa to enter Country X. She has obtained one in a verifiable document format, which has been uploaded onto her digital identity app. This is how the verification process would look like for both the immigration officer and Mary:

The official is not given any additional information that is not required, such as whether Mary needs a visa to enter the country, or the expiry date of Mary’s visa. In addition, all the official needed to do was to scan a single QR code. There was no need to authenticate multiple paper documents or to contact issuing institutions to verify Mary’s information.

Real-life applications of verifiable digital identities in cross-border travel will undoubtedly be more complex, but this simple thought exercise very easily demonstrates how verifiable identities can enable higher levels of personal data privacy while improving the process efficiency of immigration authorities.

Greater border security does not have to be at the expense of an individual’s personal data privacy. Verifiable identities enable countries to conduct more stringent and reliable identity checks, while also allowing travellers to enjoy a higher level of data privacy.

So why exactly are verifiable identities better than traditional passports?

1. Complements biometric identification processes

Biometric identification is effective because we have distinct biological characteristics that cannot be faked or exploited – with exceptions such as identical twins.

However, the issue with biometric-based security is that an individual’s biological traits are very much public. Fingerprints are left wherever an individual goes, voices can be recorded, and faces can be captured by cameras. Moreover, once biometric data has been hacked, an individual is likely compromised forever. An individual cannot replace an eye or fingerprints on a whim.

An example of biometric security failing would be the cracking of iris recognition in Samsung S8 through the simple use of contact lenses placed over a high-definition photo of an eye.

Verifiable identities can complement biometric identification in securing an individual’s identity. By serving as an additional method of verification, an individual’s digital identity would then be secured by two deeply personal identification keys that are extremely hard to obtain. With verifiable identities, a malicious actor would not only have to replicate their target’s biometric markers, but will also have to gain access to the target’s verifiable identity wallet. Since a verifiable identity wallet cannot be duplicated, the malicious actor has no choice but to attempt hacking into a highly secure, digital app to conduct identity fraud.

2. Enables technological evolution without disruption

The second reason that passports are set to expire is the need to facilitate technological updates. With digital verifiable identities, there will no longer be a need to phase out old passports to introduce new verification technology. Verifiable identities are instantly verified by a simple QR code scan, or through an online verifier portal, and are stored in a secure, digital app. Any updates to verification technology can be implemented at scale, with the click of a button, because the entire verification process is now digital. Service providers can immediately update the verification mechanism used by verifiers to include these updates.

3. Prevents identity fraud

Lastly, while expiring passports reduces the number of stolen and forged passports in circulation, the reality is that identity fraud in service to illegal entry can still happen.

With verifiable identities, it would be significantly harder to conduct identity fraud. Verifiable identities are owned by the individual, and ownership cannot be transferred. In addition to basic identity information about an individual, such as name, age, and gender, verifiable identities also allows verification authorities to conduct more comprehensive checks such as educational and vocational background when required, to ensure that the individual is truly who they say they are.

Lastly, since verifiable documents are tamper-proof, verification authorities can also be assured that the information is true-to-source. To conduct identity fraud with a verifiable identity, a malicious actor would have to obtain the original copy of every single verifiable document of an individual – a nearly impossible feat. Also, as authorities have the ability to automate the shuffling of verification checks for each individual, a malicious actor will not be able to confidently conduct identity fraud if they are not certain they have every single verifiable identity document that their target possesses.

4. Removes the need for validity periods

Verifiable identities will always be valid, since they will never expire.

5. One less problem for travellers

Verifiable identities are digital, and its information can be updated easily and instantly. So there is no risk of misplacement, no printing fees associated with traditional passports, no cumbersome application processes, and no anxiety-inducing waiting periods. Verifiable identities are also powered by DLT, which means it can be built to be extremely secure, ensuring that an individual’s personal data is afforded the highest degree of data protection.

Can my verifiable identity get hacked?

Like any digital app account, an individual’s verifiable identity can be hacked. This breach of data security is arguably as serious as a biometric one, since an individual cannot possibly recreate their identity and history.

However, there can be safeguards in place to secure an individual’s verifiable digital identity – and these methods are not new to us. Such safeguards include biometric identification on the individual’s devices (think iPhone’s FaceID), Two Factor Authentication, and setting up passcodes to protect verifiable identity accounts.

If an individual’s digital identity account still manages to be hacked despite all these safeguards, the entity managing the digital identity app can, with the owner’s permission, revoke the validity of the individual’s verifiable identity on the Distributed Ledger it was issued to, so the hacker can no longer use the stolen identity. Following which, the entity can reissue a copy of the identity back to the rightful owner.

How can governments get started with verifiable digital identities?

Governments around the world have already recognised the benefits of digital identities, and are adopting and implementing national digital identity programmes to improve their provision of e-services to their citizens.

At the end of 2021, there were 6 million Australians using Digital Identity to access over 80 e-services. The European Union is also embracing Digital Identity with the European Digital Identity, which allows citizens in Europe to access e-services such as paying taxes to renting a bicycle. And in as early as 2003, Singapore had already launched Singpass – a personal authentication app that allows Singaporeans to access various e-services online.

Firstly, governments can begin with transforming e-services with a whole-of-government mindset. Lay down the necessary groundwork for your country to adopt a national verifiable digital identity programme – which includes regulatory frameworks, Standard Operating Procedures, technological updates, and cross-border knowledge sharing with countries that already have a national digital identity programme in place.

Then, partner with a trusted and experienced service provider to help build your citizens’ verifiable digital identities. Identify key personal documentation that defines a verifiable identity – from national identification data, to health records, to educational and vocational qualifications – and begin shifting the issuance of these documents to verifiable formats.

Lastly, create value for your citizens by bringing government services online, and allow these e-services to be easily accessible via verifiable identities. The digitalisation of e-services enables greater process automation possibilities, which boosts operational efficiency and improves citizen public sector experience.

Once the foundations for a national verifiable digital identity programme is in place, where there’s value for your citizens to participate in your national verifiable digital identity programme, then citizen adoption will come very naturally.

How can individuals get started?

As individuals, you can begin building your verifiable identity by seeking out institutions that issue verifiable documents. From your healthcare records to education certificates, if these documents are verifiable documents, then you are already well on your way to building a comprehensive verifiable identity.

The untapped potential of verifiable identities is the ability to enable individuals to freely participate in the Web3 ecosystem – including navigating the metaverse, the digital universe that the world is heading towards. By starting on building your verifiable identity now, you will be well-equipped to explore and harness the full potential of the Web3 ecosystem in the near future.

Identities are becoming clearer, yet more private

Our current ways of managing identity is becoming outdated. Verifiable identities present a more reliable and comprehensive solution to verify identities for authorities, and a more intuitive and convenient format for individuals to manage their own identity.

And while authorities have the right to ascertain the identities of individuals entering their countries, individuals also have the right to data privacy. Verifiable identity very easily bridges these two seemingly opposing needs by enabling Zero-Knowledge Proofs.

Identities are becoming clearer, yet more private, and the world is safer for it. Verifiable identities are the way forward with how we should view identity, and the great news? It’s easy to get onboard – simply start with verifiable documents.