Digital Trust

SSI in the time of COVID-19: this can help us all

Self-Sovereign Identity can be a powerful ally in our global battle against COVID-19. Here’s why.

The Self-Sovereign Identity (SSI) community is, first and foremost, a group of people caught up in the crisis with their friends, families, colleagues, communities and countries just like everyone else. However, we are also aware that what we have been developing as an open-source, open-standards, global movement can help our collective COVID-19 response right now.

This is not profiteering. SSI is an open-source, open-standards community whose members typically have a strong altruistic streak even if they, like everyone else, need to earn a living. Nor is SSI a cure for COVID-19, but SSI has the real potential to help us organise ourselves to get through the unfolding crisis.

The impacts of COVID-19 are being felt by all of us and have demanded unprecedented personal and collective action. Some responses offer hope – the collaborative response of the global medical community continues to be exceptional. Some responses offer embarrassment – panic shopping and the hoarding of toilet rolls. While changes are felt daily, this is a crisis that will be measured in months, not days. No matter who we are, or where we live, we are all having to adapt and change as we find out more about the contagion, about our societies, and about ourselves as individuals.

An essential part of managing the response is the ability to bring out new regulations with unprecedented speed and frequency. These regulations define and demand changes in what we can, and cannot, do as individuals.

What seems certain is that we will increasingly need to adapt to new and changing regulations. We will need to be able to prove things to others that have not been required before, yesterday, last week, or last month. What we need to prove, who we need to prove it to, and when we need to prove it, will be unprecedented. By definition, we do not have recognised ways to prove these things at present.

Moving forward we may need to prove things like:

• I live near here (I’m allowed to be here)

• I can shop here (I live nearby)

• I can shop at this time (I’m a medical professional)

• I can shop at this time (I’m over 60)

• I can shop on this day (I’m allowed to shop on Tuesday)

• I can purchase these items

• I have had COVID-19 and been tested as clear <on date>

• I was tested for COVID-19 on <date>, and found to be negative

• I need this prescription (I have been diagnosed and require these drugs)

• I am medical professional

• I am an essential services worker

SSI offers a way to issue these “verifiable credentials” securely to people. They can be issued using technology we have now, by existing authorities (Government bodies, Professional Organisations, Medical Authorities etc.), and delivered to people using technology they already have (mobile phones). We can carry these credentials around with us and prove that we have them to the people and organisations that need to check them. Critically, four things can be checked:

1. Who issued the credential?

2. Was it given to the person presenting it?

3. Has it been changed fraudulently after it was issued?

4. Has it been revoked

SSI is flexible (new credential definitions can be defined and credentials issued by authorities when they choose), secure, and privacy enhancing (the holder of the credential can choose the information to share depending on context).

This last point is critical. We will all need to accept losses of liberties over the coming months. That is unfortunate, but for most of us, understandable and acceptable. However, we need to avoid developing long-lasting and poor system responses, in particular we need to avoid trying to repurpose single-purpose centralised systems for a number of critical reasons:

1. They are just too slow and expensive to work with. Most cost hundreds of millions of dollars and years to build, and any change is measured in more millions and months of time.

2. They are fragile in ways that are hard to predict and govern

3. They are single point sensitive – if that one system fails, everything fails

4. They can be hard to unwind afterwards and leave toxic data collections that can be hard to manage

5. Centralised systems and data are a honeypot for hackers and those who want to further disrupt societies when they are most vulnerable.

SSI lets us rely on our existing societal and organisation structures. It relies on the legal frameworks, organisations and people we already recognise as having responsibility and authority. It enables these organisations to create the dynamic, responsive and decentralised framework of trust that these times demand. Critically, the decentralised technology means it can rapidly develop to support a myriad of credentials and social interaction scenarios. When this crisis is over, these credentials leave no central legacy of sensitive data.

I and my colleagues at 460degrees would be happy to discuss with any authority working on the COVID-19 response how SSI can help them respond to the crisis. I know this to be true for the wider SSI community too. We want to help, and this is how we can.

There is no time like the present. Literally.