Digital Citizenry: Identity, Metadata, Credentialing & Reputation

so uh coming up again uh russell will be on the stage with fadbat um as a moderator um also uh some other colleagues from the office of information technology in colorado kate mcroy and uh clayton hollingshead from the department of revenue take it away guys what's up dad excellent yeah thank you guys so much for the handoff and leave it to my colleague russell to start getting into the weeds about the most complicated integration that we could possibly face with the tsa right at the very end of his uh allotted time good job russell no of course that was a that was a great presentation uh clayton and cassie thank you guys both for for participating in that it's wonderful to see that footage i never uh never thought i would get to see cassie pulled over uh by the police in real time so that that was that was excellent um so i'm thadbot i'm a blockchain solutions architect for the state of colorado uh in the governor's office of information technology um and once again we've got a great panel of subject matter experts with us today i think we should probably be expecting a late joiner or two as we progress through the conversation but um let's see if we since we are starting a new panel we can go ahead and at least uh bring up introductions uh russell casanaro uh digital transformation director at oit just gave his great product priso and much appreciated uh clint do you want to go ahead and introduce yourself russell didn't didn't give you your required self-introduction time on the last panel but that was quite okay he did a great job uh clayton hollingshead i am the program manager for the dmv's mobile driver license program as well as a product owner for digital uh dmv where we're trying to move all of our services online um to make you know even more convenient for customer access um so a varied bag of excellent thank you we are uh i think waiting on uh mr andrew bondi to be uh brought in who is with there he is mr andrew bondi would you like to introduce yourself sure afternoon everyone uh my name is andrew bondi i am a senior project manager and project lead for identity resolution out of the office of ehealth innovation fantastic um so we are going to be talking about uh sort of the blockchain technology use cases around digital identity and what it means to our various different uh agencies in order to sort of get a definition around digital identity and how that impacts each of their areas for me it's always been sort of a bullseye of blockchain technology use cases because almost every other peripheral use case that keeps track of stuff needs that anchor that anchor to a person or to a business identity sort of spans more than just the individual for me um and i feel like it in providing that anchor it really enables transactional interactions um that people need to engage in with both uh businesses government agencies and even with other residents in terms of transferring ownership of a vehicle for instance um i'd like to get an idea of how our original initial rollout of digital identity in colorado has impacted each of your areas um andrea let's let's talk to you about that first yeah absolutely so in the office of e-health innovation uh we are very focused on improving health i.t as a whole across the entire state of colorado and with covid you know the the rise of cohen the disruption of pretty much just everyday life in general uh the the digital id and just digital identity in general has really taken the entire field by storm so it's you know something as simple as being able to go into a doctor's office and be able to show your driver's license along with the remainder of all your information to be able to get onboarded and begin you know that the hipaa process and going through all of that work um completely disrupted right you know it's it's uh to russell's point or in the earlier session right you're trying to hold up your driver's license to your camera and show your face at the same time but then you run into the issue you can't properly side forms right you know it's it's you then have to go through you know whatever mechanism it is that the office has kind of pulled together randomly to get that taken care of and so digital id has really um you know stepped up in that space and we've had some partners with the mental health center member specifically out of our our consent management work group in our office to push that forward and really speed up the onboarding to individuals that need access to behavioral health and you know just general mental health services additionally we're you know one of the big places we're looking at leveraging digital identity is the ability to be able to enable interoperability between state services uh one of the biggest problems and biggest gripes that you know everybody has you know i i have it on a regular basis is whenever you have to interact with another state service you gotta fill out all the exact same paperwork uh you and then you know as you fill out paperwork for you know service a uh it's immediately ages right you know it's you maybe you move maybe you have an update to whatever your data is in that regards when you go over to service b you fill out the exact same paperwork again and uh you know now it's updated but now your data between the two services you know the system's maintaining that or out of sync and so we're we're working with russell um on that space to be able to try and keep all that data in sync and you know a little bit more under control on the back end of the state systems to enable that better quality interoperability and ultimately uh turn it over to the end citizen and recipient of the service to be able to control and manage their profile data uh and and how the state is is able to access and um you know share that data around that's that's an absolutely fantastic point andrew um clayton do you want to maybe speak a little bit to how how the digital id has enabled that sort of real-time data and and and updating of information um and contrast that to maybe how long it would have taken in the past to get that data refreshed wow um there is a lot there um our system currently we're not the dmv itself has not uh pushed it out as much as we can or we're still working with russell to do so um i think one of the major considerations for the design from russell's point is that we've got to make a cost consideration for adoption for a verification system and so for law enforcement for the other agencies that will be using it how do we minimize the cost of adoption and i think they've done a great job with the system they've rolled out now and then as we look forward to the actual mdl how what those costs might be um for you know all sides of the equation not just law enforcement um but um it's a very interesting as far as the fact that you know the driver license was initially just to give someone uh proof of verification that you're eligible to drive a vehicle and over time it evolved into our primary identification form and the information that a highway patrol officer needs is nowhere near the same information that a retail clerk needs or that your bartender needs to see so the ability for the customers to limit the data they're sharing rather than just give everyone here's my home address here's my birthdate uh full name um so a lot giant privacy consideration i think as far as able to customers able to limit the data they are sharing yeah that's a great point russell do you want to talk a little bit about how about how that works because i didn't hear about any of that in in the earlier preso sure so so what's already like what was part of the initial release was that you could have a filtered view of your id um in the app and so you could actually hide like your address and your you can even hide your birth date and then we just show the the whether you're over 18 or not right so um and this is popular because you know anybody who's dealt with a creepy bouncer before knows that they can get all the information off of your driver's license right so we carried that over into that consent model that we have for what attributes do we really want to share uh and i think you know some some cooler things that we're even talking about is like with the dmv is um you're making it so you could get on a chat and you could actually confirm that you're the right person with them by scanning a qr code and letting them know that you are that person they can look up your record and make changes that you're going to need eventually um and you know another really interesting thing that that uh going back to like the bar and restaurant case is there are these books that they make every year on what does what are the security features and what are all the things of specific drivers licenses all over and so i remember when i lived in hawaii i came up and aside from the fact that whenever i showed somebody my id on the mainland they said oh mclovin um they would um you know they would say oh i don't know if this i actually went places and i'm not like a spring chicken and they would say oh i don't think this is a legal id because you know it had the wrong banned color or something like that and with uh the the electronic um an electronic or digital id you've got one that can be updated in real time so when we went to the new format back in what was it may clayton i think everybody was automatically given that new format of driver's license right so that that went out when you move from like being um being being under 21 to 21 your driver's license gets converted to the right format immediately you don't have to go and take a new picture you don't have to go buy a new id none of that has to happen it happens in real time from uh from a learner's permit to a driver's license the same sort of same sort of thing so um it really makes things a lot easier on a lot of different levels whether it's confirming people are who they say they are or it's using um or it's just keeping your your own record up to date yeah that's absolutely right and i think that that sort of serves as a little bit of a of an on-ramp towards the towards the concept of self-sovereign digital identity because that's you know really a lot of the point is that you only need to share some of the information with the entity or person that has requested it um you know having to show your physical id with all of the information on it really should be a thing of the past it should be a binary a binary answer to the question are you of age to purchase x yes or no not necessarily your date of birth certainly not your home address um so yeah that that is that is a point well taken and i think um does serve the interest of of advancing digital identity towards that self-sovereign goal um let's see i think uh john go ahead clayton as a related point to that uh if someone were just pick up your wallet slide your driver license out uh they can then use that driver license for any purchase they want to do anything they want but with the driver license or mobile license tied to a phone you're actually a they'd have to steal your phone okay that's easy but then they have to open it up and they have to use your pin or your biometrics to activate the sharing so you've got a level of protection there that isn't there with just a physical card that can someone can walk away with and with the digital license you can turn it off um if it's reported stolen it can be canceled remotely with the physical card it's out there until it's found right that's that's a super interesting point and i think that in in striving for perfection it's often very easy to ignore what the incremental improvements are and so you know when when folks discuss all of the all of the failings and and problems and and issues that might arise with the digital id they're sort of forgetting the fact that those are really inherently baked into having a physical id and there are a ton more problems um so yeah great point um i think one of the big aspects that we've talked about and i think this was a question in the last in the last round about the kyc stuff is how how can that digital id reduce the friction involved in transactions and certainly we found that at least among law enforcement um certainly there was a big much more of a demand for it once the pandemic came into sort of full effect and there was a realization that you know getting getting up close and physical and exchanging a physical document was definitely not something that um was a optimal solution for uh for the police officers and certainly also for the general public um and i think that there are a ton of different areas that uh that digital id does reduce that that transactional friction andrew do you have any examples of that in your in your realm yeah so one of the big things we're actually working on is uh streamlining the the colorado benefit just application process as a whole right so when covid hit everybody was becoming you know having to go onto unemployment or having to sign up for uh rental assistance or you know utility assistance things along those lines one of the big issues right was is that we were still very much set up to be in a world of you go in and you meet in person with you know accounting case worker or you know a state representative and be able to work through all the paperwork and the process and the forms in that space and one of the things that really ended up happening that slowed a lot of that down was that you had to schedule appointments well in advance right we were limiting the number of individuals that were allowed to be in a facility at the same time not only just people coming in but also um you know the people that were able to serve uh you know serve the the recipients that were signing up for services and so one of the big things that we're looking at is how can we streamline that onboarding process right how can we leverage something like my colorado to be able to pull in all of that information that is needed you know to be able to actually fill out that application get that all prepared and then possibly even take you all the way to eventually scheduling an appointment with that caseworker that you can do in you know a digital format you get you know over zoom or you know something along those lines but you can use my colorado to be able to validate that you are who you say you are on the other side right because that's again one of the biggest issues that we have in here being able to provide state services in general is that ability to be able to truly validate who that individual is and being able to speed up that entire process of getting that information through and so you know the ability to be able to effectively pass data between these state systems to be able to speed up that will also be a huge huge factor in here there's a lot in the uh especially over in the unemployment space right you know there's a lot that you have to pull in um you know door information for tax information you have to bring in medicaid information you have to bring in basically all of your benefits information to get that lined up with what's your unemployment payment gonna be looking like um you know that's all factor in there well if we don't have the ability to be able to accurately identify you across all of those systems when you're you know you're receiving all those various benefits it just becomes really difficult as a whole and there's a lot of backtracking and a lot of uh duplicative entry of information and then having to confirm that you are who you say you are between all different systems and being able to get that unified identity between all of those different services really helps to speed up that process and um it can be as simple as you know you you go when you need now you need to get access to you know energy assistance you go in and you just click you know button saying please apply and it pulls all your information from the other profiles and goes out and hits you know the unemployment office or you know the different groups that have different parts of the information needs to come together and the best part about it is you can consent all of that in my colorado and it can all be captured and it can all be logged so that in the future you know it can be looked up and verified that that was indeed one that ended up happening and if you then end up no longer needing to be on that benefit you can revoke that consent and that that state agency and you know that program no longer has access to those those parts of your data so it really helps to alleviate some of that big brother feeling of all your demographic data is floating around there and pretty much every single database that exists and uh you know really you're in control of that and knowing where it's all at hi carrie welcome hi everyone it sounds like you're you've solved the the state identity um i guess efforts how could where should i take this conversation what would what would be helpful i think i could add a little flavor in a lot of ways but uh absolutely um if you just want to give yourself a quick introduction and talk about talk about uh you know what you do and uh then we'll just sort of pick up the conversation where we left off sure so i'm carrie pico to the director of the offseal innovation i worked really closely with russell and andrew on a few identity projects but our office establishes and leads state health i.t strategy where we're steered by a governor-appointed e-health commission and we report to the the governor lieutenant governor that are focused on several priorities and for health care that's where we're focused um is saving people money on health care and increasing equitable access to affordable and quality care and so where i can kind of take this is you know i think there's a lot of ways that this data is advancing how to better serve our clients and patients across the state but from an equity for sex perspective we're really trying to think through like even at the the simplest level uh do people have access to cell phones do people have access to broadband and and cellular connectivity in their area and so we've been really trying to advance and advocate and get funding to those areas that don't have that so that if they choose to use great state tools and technology to do that and that we don't have to worry about filling out paperwork a lot of different ways in a lot of different times and then from the kind of the broader state and national perspective with identity and access to health information uh what we're we're seeing and what's being driven by policy is that i as a patient should have access to my health record when and how i would like that and share it with whomever i want and that's just simply not the case there's been a lot of work within our office to encourage use of safe and secure methods of health information exchange but there's a lot of work to do there and then how do we leverage new and evolving technologies to accelerate where policy just is still gray if i'm in a crisis situation and i want to share specific information about my mental health condition or physical condition how do i do that in a way that isn't incredibly burdensome to the patient as well as to the system at hand and i think this conference and technologies like blockchain can help us by really thinking about putting the the patient or the coloradan and driving where their information goes meanwhile we'll keep modernizing our our systems to get us there absolutely that's um fascinating to talk about what that um what that looks like from the equitability perspective in terms of access not only to to the devices themselves because certainly we do find that um mobile devices are prolific throughout you know almost all socioeconomic classes at this point um what have you what have you found in your research around um around what that digital divide looks like um certainly i know in terms of access in colorado um we do have a very uh strong initiative for broadband access to 100 of colorado so that's that's really one of governor paul's objectives and and as we as we pursue that goal i think that um that might help close that digital divide a little bit but certainly from a from a device ownership perspective have you found anything uh sure so so i think um one prime example is for example right now rolling out the the vaccine distribution much of the information is available on on our covet website but if you don't have a laptop access to the internet you wouldn't know about that and so where we're seeing kind of slow uptick in some of our rural and more elderly populations is they just don't know about it so if it's not printed in a newspaper or someone doesn't call them they just won't know about that so although although there are there's a ton of cell phones out there and use of cell phones for a variety of reasons i don't think that everyone's using them in the same way one of our projects right now through ojai is to you know fund rural health providers and get them cell phones and devices in the community so that as they're doing things such as telehealth telemedicine vaccine outreach that there's devices there earlier this this year in our governor's stimulus package they carved out 160 million for broadband funds and out of that about 20 million for broadband and devices to support telemedicine because of that that gap and i don't have any specific numbers that just spat off on the top of my head but we know that it's it's still a divide and even if people do have access to cell phones and laptops they may not have minutes or funding to pay for for said devices and so we're seeing state funding to help support that with the recent stimulus package through the special session there's 20 million given to educators to fund hot spots and other devices and help subsidize and then the federal government's going to be releasing a subsidy to consumers to help pay i think it's up to fifty dollars per cell phone bill and broadband bill if you can't afford it and then if you're a native american or live in tribal land it's up to 75 five dollars so i think locally and nationally we're recognizing that um we're all stuck in these square boxes all day if we're lucky to have work and do service for our state but if you don't have a consistent broadband or a device to do it on that it's just not not possible or you're sharing it with a family a household of five and how do you split up one device across school education health care and work all on the same day one additional thing i i would add on to that is is that we also need to remember that not everyone is comfortable with accessing state services in a digital manner you know there's there's a lot of individuals that i mean let's be honest uh accessing state services is complicated um you know it's it's the programs are not always the easiest to navigate some of the the requirements to be able to accessing state services can be cumbersome to to overcome and when you are you know you're not used to dealing or working with uh that new that bureaucracy you know we'll call what it is it's bureaucracy uh it's really helpful to be able to have that um that human element to being able to help guide you through and and walk you through that process and it's just right now um most of our state systems just aren't at that level of being able to help walk people through and guide them in that manner we're definitely making strides and getting better at it but having that human element being able to interact with a caseworker or with um you know a clinician or an individual like that to be able to help you navigate through the process is absolutely huge yeah great point andrew thanks um what what seemed to be the biggest um the biggest concerns outside of those that perhaps perhaps we've already discussed some things that come to mind especially um after after having um watched let's see i guess it was maybe two panels ago uh john pauler had some some great remarks regarding uh sort of the the ethereum community's resistance to uh resistance to sort of government ownership of data and and distrust of government ownership of data so to the extent that we can say yeah my colorado application dumps dumps the data doesn't doesn't maintain anything outside of the traditional uh chain of chain of custody for that data people don't necessarily buy that and believe it um how do we how do we address sort of those those concerns i wonder well i think you know a big part of this is uh is setting people's expectations so right now the bulk of the bulk of the connected world gives their information out for free the social media where it's abused they're victims of identity theft through um ui scams or credit you know or or reach out for new credit cards or you know there's so many different places where um where people are being scammed and so strangely the place where their information is the safest is is uh is is the government and where we actually have a responsibility for first you know actually keeping people safe and i think once um once everybody realizes that like with the internet you know pandora's box is open and all you can do is really choose not to share or to share judiciously and have really heavy penalties on those that share without your permission and adding things like like consent and permission schemes that can be implemented in a much more real-time way and and have direct shares coming from an individual to the organization that's asking them will become the the norm because it is inherently much safer i mean right now if i go to um if i want to get a quote from my insurance company i've got to send them a copy of my driver's license they're going to go and they're going to ask like lexus nexus or one of the other companies to go pull my record from the dmv to get my you know there are so many hands touching every single one of these data requests um and so there's a bunch of complicated legalese that goes between each of those but it has to be enforced and it's always another potential attack vector right when you're going directly to that organization you can know where you know you'll know where your information is it isn't screwing about all over the place and i think you know you've got to choose some way to share and the answer for the vast majority of the world is not that they're going to have their own not their own wallet that they have custody of and it's nowhere else right and people are going to be backing things up and you know that's not a solution that's going to work uh broadly anytime soon so we have to have one where someone is trusted the group that already has that information is the government and the government is the first one that's going to be able to get it maybe once the government actually executes this stuff then sovereign identity and owning all of your own information will happen but still it'll you know once you let once you share that information it's out of the box you know it's it's out of your control yeah no that's that's an interesting point and one of the one of the panelists earlier today talked about um trying to encourage her friend to start using start using crypto and and the pushback and and i totally get it now that i've thought about it a little bit more was that if if she was to lose the hardware wallet or her phone that had a software wallet on it everything would just be gone um whereas with a credit card if you lose it there's somebody to call right so you can always you can always get that replaced um i don't think there's a calculus that that works for uh government to make a decision to disregard privacy rules of any sort in favor of of profit um whereas with with private companies and businesses that that calculus is there there's a possibility that it would be more profitable for them to pay the fines for whatever uh whatever indiscretion happened and earn the money from selling the data yeah i think that's always a consideration from the the health side though currently right now state or federal government has not been successful at aggregating and sharing and some would say that that's not the role of government in having access to my own personal health records and i think there's an innovation opportunity out there to think about within blockchain and various types of evolving technologies could there be a trusted provider that could ensure my health record or even my bitcoin doesn't just automatically disappear one part and that might very well be the the role of government helping incentivize that i think for in colorado the exchange of health information is covered under the health information hipaa portability accountability accessibility i get i'm adding an extra a in there sorry um there we go see um so i think you know with that guardrail and framework providers health providers can't sell your information for capital gain and that's outside of the the rules of that and as a state we recognize certain data aggregators that are not for profits known as health information exchanges to be that connectivity between siloed health providers so that if you show up in an emergency room for example in southern colorado that they know you're allergic to penicillin and if you show up uh in denver health if they at least have some foundational information it's at least a step in that direction and we're at least trying to leverage them and work with our trusted community partners in that regard and i think governance is an opportunity for for individuals that are streaming right now to get engaged from a citizen perspective we've got a number of public work groups and meetings to talk about how information is accessed and for what purposes so i think there are there's lots to dig into around state information sharing around new technology like my colorado to ensure that you're not getting arrested or there's unintended consequences consequences for having information accessible or available within state infrastructure around that's great thank you so much kerry um let's see we've got about what do we have maybe four if not 10 minutes left i think from here we'd probably like to dig into a little bit more around um with digital id as an anchor um where might blockchain fit in in terms of maintaining transactions that are related back to that digital anchor so we've talked um we've talked quite a bit about healthcare from a patient's perspective but we have not yet touched on um on blockchain as related to the provider's perspective so um is there is there a solid use case that involves having that identity anchor um mapped out to some form of credentialing and obviously that's um important in the medical world but also in the education world um and certainly in in any professional services that involve state licensing russell do you want to sure i think that one of the things that um spencer and taylor's panel they were talking about was um was was the use like in the universal wallet spec that's out there and um and so there are some really good approaches to where we could share credentials um in a way that is compatible on a cross-wallet basis right so um and at the very least they can be verifiable um in real time on a non-um you know in a non-state system or not by not by the issuer right if you've done any of these continuing education systems or credentialing systems that is really important you've got like in colorado we have the secretary of state the issues uh certificates of good standing it would be relatively straightforward to you know to put those kinds of credentials out there confirmable and then portable into a wallet um to where you could really integrate with that and that that that same sort of approach that's in one of our bounties and i think it's in a couple of the um of spencer's bounties as well but you know that kind of approach is what um is what you can do once you have identity established and it enables us to do things even you can even sort of come up with the idea of a credential for consent say i you know i memorialize this agreement to to provide you access to you know to this system until this time and then you can revoke that any time and revoke that from you know that as well and that can be immediately clear if someone went to go try and verify it so the technology is there um and we're trying to provide like the safe space to implement that kind of stuff and show the regulators that it's something that's doable that it's something will work and then they can say okay well now we can move our state systems over to that right you can't just do it without having a lot of a lot of proof of concepts and a lot of technology demonstrations that show that it really really works yeah that's that's absolutely makes sense russell um it feels like there's some some great opportunities around consent and around those those credentialing to to really leverage blockchain in ways that can that can allow for both um providing providing authentication to a hash document but also revoking consent as well yes yeah a revocation of consent i mean managing consent now is not something most organizations do well right it's normally they oh they take the signed piece of paper and put it and file it away or make an image of it to be able to um to allow people to go back and find the consent that they gave and revoke it um that's what we're working with with carrie and and andrew on right now is actually making that revocable consent model um even though they you know the the parties using it don't necessarily have a great way to to handle the fact that we could do it putting it forward might actually save them from some liability issues and things like that so we're hoping that it will make make things a lot easier and it's a huge it'll be a huge advantage to all businesses you know there's lots of businesses lots of agencies that need consent yeah i think that could that could also end up being a double-edged sword for for their liability as well assuming that blockchain distributed ledger type solution would be there you would know exactly when consent was granted exactly when consent was taken away and what that window was so encourages more responsibility on behalf of the of the providers as well the very level up one of the one of the really interesting use cases that we've been investigating uh is that uh from kind of the provider side of looking at that requesting data from an individual you know let's say we have a healthcare provider is trying to pull up information on an individual and they're trying to pull from the dmv you know normally that requires data entry right you know you've got a person typing it in doing all that involved in there so there's time and energy spent on that to russell's point you know they're signing hipaa forms they put in a filing cabinet that then eventually ends up in a filing box that ends up in a storage unit somewhere and so it's that you know that management and that handling of all of that really brings it to the forefront for easy look up easy easy access um but more more importantly what it does is to your point of double edged sword it also protects them from the fact that if someone were to revoke their consent to someone having access to their dmv data the next time that you know their their um you know their front desk person or you know their system goes to try and pull that dmv data it's rejected right you know it goes it tries to check the consent to see if they can pull the dmv data and open up the you know your patient pulled that consent back and so you no longer have access to it you know it kind of flips the script on how are we storing this data instead of having that individual provider storing a full copy of the dmv record available locally you know effectively a cache of that for them to be looking that up um it's acquired in more of a real-time manner through you know some sort of an api layer integration layer with the dmv or you know system and that then gets us into this space where we can have real-time checking on that you know every time that they go and say you know can i get fads driver's license information or i need that birthday um you know go and look has dad still consented to this you know he consented a year ago the consent has one year you know do we need to prompt him again to consent to this um so there's you know those those automatic timeouts on that um you know the management handling of that consent and then also the ability to be able to revoke it and now you have the assurity that you know as long as that provider is not storing a local copy of that and instead they're trying to pull it in a real-time manner um they no longer have access to that information and you know so you start baking those ideas into the structure and the way that they're consuming that data so that you again don't have the sprawl of your individual identity data ending up everywhere and having copies of it you know and you know in filing cabinets in pretty much every doctor's office it's more maintained and managed perfect thanks for putting a bow on it andrew uh and thank you panelists all of your info was much appreciated that was a great conversation loved it and i'm gonna flip back over to matt