PassW0rd – 12 November 2025 (Your Country Wants To Know You)

Speaker A: This program is brought to you by Resonance FM. If you like what you hear, please support our work by making a donation at resonancefm.com/donate.

Speaker B: Hello and welcome to Password on Resonance FM with me, Peter Warren, your monthly deep dive into the technology that now runs our lives, knows us intimately. In this program brought to you by Future Intelligence and now also available as a TV program on Tech TV, Digital identity cards, the deeply unpopular new initiative from the government that it is claimed will help some of the problems of illegal immigration and see the UK get up to speed with most of the rest of Europe, Scandinavia, and countries like Nigeria. When Rishi Sunak, the UK Premier, announced the measure, many opponents instantly derided it as a knee-jerk reaction to the success of Reform in recent opinion polls. It was decidedly odd. To combat the small boat crossings, illegal immigrants would be beaten by ID cards. Simple. In one stroke, it would deter those who wanted to take advantage of our welfare state and restore order. As a move to prevent the Elysium film-like scenario painted by Reform, though, It won’t work. In Elysium, a group of super-rich live in utopic bliss on a satellite where all illness is banished, while the poor live in misery on an arid Earth. A Robin Hood-like figure portrayed by a dying Matt Damon helps the sick and the wounded to get to Elysium, and they are miraculously healed, and everyone can become a member of Elysium. Back on Earth, in the UK, to head off the wave of immigrants intent on our social service system, we will brandish ID cards at them. Digital ID cards, the keys to the UK’s Elysium. Sorted. Only it’s not as simple as that. The measure has provoked alarm. 2,939,219 people from a very broad church of have signed a petition protesting against the initiative. Its opponents cite fears ranging from authoritarianism to state surveillance, paternalism, privacy, and cybersecurity. So we decided to flesh out the story because ID cards is a topic Future Intelligence has reported on from the word go. And oddly, its digital history goes back to the Conservative administration of Margaret Thatcher. Her successor, John Major, tried to introduce digital ID without success, and the next attempt was by Labour Prime Minister Tony Blair, who has become a champion for the technology. His Tony Blair Institute has been seen as a prime mover behind the current initiative, an attempt coloured by Blair’s association with Larry Ellison, the world’s second richest man and the founder of the US database company Oracle. Ellison, who has been pushing digital ID cards since 2001 in the US, has donated $257 million to the Tony Blair Institute so far, and there are rumours of a further $169 million in the pipeline. Ellison outlined his plans in 2001, suggesting the US government could create a national identification card. The card would contain basic information about the holder, including Social Security number and would be linked to a federal database containing detailed personal data, including digital records of the person’s thumbprint, palm print, face, or eyes. Passengers would show the card at airports, Ellison said, and would have their thumbs scanned by a digital reader to verify identity before boarding a plane. The cards also would be instantly checked against a new national database The database would link existing criminal and immigration data to screen out potential terrorists. Blair’s had a long association with Ellison. In 2003, Ellison had a photo opportunity at Downing Street to mark a gift of supplies to 40 specialist schools. Oracle has since been contracted hundreds of times by the British government and earned $1.1 billion in public sector revenue since the start of 2022, according to data collected by the procurement analyst Tussell. Ellison has seen the UK’s NHS data as a key component of digital ID card services. In February of this year, Ellison told Blair of his interest in NHS data when he was interviewed by Blair at the Dubai World Government Summit. The NHS in the UK has an incredible amount of population data, Ellison enthused. But it was fragmented. Two weeks later, Blair’s institute published a report entitled Governing in the Age of AI: Building Britain’s National Data Library. In it, the not-for-profit institute echoed Ellison on the UK’s data infrastructure, calling it fragmented and unfit for purpose. An association that many see as unhelpful. Because a lot of ID experts say there is a desperate need for a digital ID card scheme that operates in the public interest. One of the leading experts on digital ID in the world is David Birch, a former professor at Surrey University, described by the Independent newspaper as a Grade A geek.

Speaker C: Yes, I think the way to think this through, Peter, is you have to decouple two things. So you have to think about the need for a digital identity infrastructure to support a modern society, and you need to separate that from 1950s notions of ID cards, which is how people who don’t understand the technology tend to think about these things. So I think it goes without saying we all understand that we live in a networked world now that we didn’t live in before. It is just a fundamentally different world. And it’s a world in which a lot of the time you have no idea who you’re dealing with, or more importantly, what you’re dealing with. And if we’re going to protect people, I mean, you only have to watch one episode of Scam Interceptors or anything like that to understand just how terrible the situation is at the moment. I think I’m right in saying fraud is the number one reported crime in the UK. If you talk to the UK banks, they’ll tell you four-fifths of the frauds that they see come from social media, etc., etc. So we all understand there’s a problem. And the question is what to do about it. So do we try to fix that problem by looking backwards to a previous generation, in fact two previous generations ago, and saying, well, let’s give everybody an ID card, which is in a way is a bit like saying, well, let’s give everybody a butter churn or a dial telephone or something. I mean, I’m sure many people are nostalgic for this, but it’s pointless in modern society. And say instead, let’s give people access to a digital identity infrastructure. So what would be the key characteristics of that digital identity infrastructure? The fundamental one is that you would not be disclosing personal information unless it was absolutely needed. And in most transactions that most of us take part in most of the time, the critical element to the transaction is not who you are, it’s what you are.. It’s not, you know, am I Dave Birch? It’s, am I allowed to access this website? Is this my bank account? Am I allowed to go through that door? Am I allowed to drive this car? In other words, it’s a question of credentials, not identity. And I can illustrate that very simply using the canonical example that everybody uses. If you walk into a pub and they want to know if you’re over 18, you show them your driving license, whereby you’re showing them your name, address, and all sorts of other things about yourself which are completely not relevant to the transaction and none of their business. The question, “Are you over 18?” is a completely different question to, “Who are you?” And we should restrict people to asking the questions that they really need the answers to. Now, an identity card in the kind of 1950s sense of it is a dumb thing. It says all sorts of things about you, and it has no idea who is actually looking at it or what they’re allowed to do. Compare that to the example of how Apple, for example, is using mobile driving licenses in some US states already. The barman wants to know if you’re over 18, so he displays a barcode on his phone. You scan it with your phone. Your phone says, “This person,” whoever it is who is authorized to ask this, “wants to know if you’re over 18. Is it okay to tell them yes or no?” And you put your thumb or you look at your iPhone or whatever. And it tells them this person is over 18 or 21 or 36 or whatever it is to get a drink in the US. It does not tell them this is your name, address, height, weight, inside leg measurement and everything else. So what we need to do is to extend that general principle of providing credentials to enable transactions everywhere into all corners. And by doing that, we can simultaneously increase people’s security and increase people’s privacy. Now, the situation we’re in at the moment is a little bit confused, I think. I think it’s fair to say— I’m not saying that as a political point, but the current system is a little confused. There are 3 different things going on, and how they interrelate is not at all clear to me. Other people might know, but I don’t. So on the one hand, you’ve got the sort of government one login thing, which is Not in itself a bad idea, you know, the idea that you would have one login for accessing all of your— you know, like when I do my vehicle tax or log into HMRC or whatever, would it make sense for me to have one login for all of those things? Well, it would, but if you’re going to do that, it has to be very carefully protected because obviously the scammers would immediately try to get that one login and then they can log in everywhere as you, and we wouldn’t want that. So therefore we have to have some strong security around that. For want of a better concept, this means using smartphones. And, you know, there’s an argument that there is a small percentage of the population that don’t use smartphones. It’s small and shrinking. But nevertheless, we have to figure out a way around that. Could you do that by giving people some kind of cards? You know, maybe. Would it be worth doing that? I’m not sure. Could you use their bank cards instead in some way? Probably, you know, it’s worth thinking about, but in essence, the idea, you know, could you have an app on your phone which would provide security and you’d have one login for government? Not a bad idea. You know, there’s some efficiencies to be had from that. The second thing is the government created a thing called the Digital Identity and Attributes Trust Framework, and there are something like, off the top of my head, I haven’t looked it up this morning, but there’s something like 50 companies that are certified under that framework. And in a spirit of openness and honesty and full disclosure, I can tell you I’m an advisor to one of them, which is OneID. So what do these companies do? Well, if you need to prove that you’re over 18 for Pornhub, or you need to prove that you’re a company director— I mean, quite often the same people, I would imagine— you can use one of these companies to, to do that. And so what they will do is you will register for OneID or Yoti or any of these other companies, and they will tell the other people, yes, this person’s over 18. They won’t tell you anything about you. All they will do is provide the credentials that are needed. And so that’s good. And actually, those companies can also do things like assess your right to work and various other things. The third thing is the government digital identity. I mean, I’m reluctant to call it scheme. I mean, let’s call it the government digital identity notion for the time being, because Because so far, when journalists ask me, you know, what do you think about the government ID scheme, I said, well, I don’t think anything about it because I don’t know what it is. I mean, you’d have to tell me what it is before I can form any opinion about it. And I have no clue what it is, and I don’t think the government do either at the moment. So it’s all a bit up in the air and, and a little bit pointless. Now, what are the origins of this? I think this is, and you know you’ll be shocked to hear this, I think this is not a carefully thought through strategic proposition designed to enhance the net welfare. I think it’s more of a knee-jerk reaction to a variety of other problems, none of which it will solve. To summarize all of that, do I think it’s a good idea to have a digital identity infrastructure? Yes, I do. In fact, I think it’s an imperative. I think it’s insane to try to operate a modern society without that. Do I think we need an ID card to do that? No, I don’t. Do I think the ID card as proposed will help with any of these things? I couldn’t say. I haven’t the slightest idea how this proposed ID card is actually going to work or what it will do.

Speaker B: David Birch, one of the world’s leading experts on digital ID, on the incredibly muddy world of digital ID. But it gets even muddier. The UK has over 40 different ID systems on its computers, ranging from passports to driving licenses and national insurance numbers to NHS IDs and numerous other IDs for businesses. Perhaps Ellison is right. The system is definitely fragmented. It’s also chaotic. During the course of research for this program, we spoke off the record to some of the leading figures in civil society of service computing, both past and present, and they all spoke of a system in desperate need of overhaul. Computer systems so old that they dated back over 30 years that used obsolete operating systems and that are often the target of hacking attacks. In the last 2 years, the government has suffered many attacks on its computers and so far has lost the entire electoral roll, all the records of those in receipt of legal aid, and seen several MOD databases compromised. If we could only sort things out, according to Alessandro Hotami, the founder of Pacemakers and a passionate advocate of digital ID systems, then we could take the data away from government control and leave it in the hands of the subjects. That means you and me.

Speaker D: Well, the thing is, we have— we live in a world of digital services, and I think if we can’t identify ourselves for these digital services, we will be excluded and we will have to pay high prices, we’ll get low quality of service, and so on. The NHS could be more efficient, our taxation systems could be more efficient, our financial services organization will be more efficient, and most of these people who are objecting to have their ID taken, have their IDs already in all the other places that I mentioned to you. So what the digital ID helps most is not the affluent, it’s not the middle classes, it’s the less affluent that can really benefit from having a means of authenticating themselves that is not a bank account from some— with somebody else or a utility bill. So it is about equality, it is about transparency, it’s about opportunity. And I think That just for those 3 reasons, I think it’s a worthwhile effort.

Speaker B: But shouldn’t that message be being made? One of the reasons that people don’t seem to be in favor of it at the moment is they hear about people like the former Prime Minister Tony Blair lobbying on behalf of Larry Ellison, who has said that the UK needs to have a digital identity card scheme, and people don’t trust that. They instantly think politicians and big business.

Speaker D: Well, look at countries that do have digital ID, Sweden, for example, most of Europe, et cetera. Are they less democratic? Are people imprisoned and mistreated and abused? Do they get targeted by marketing messages that they don’t want to hear? I think the answer to that is no. Digital ID done well has really brought so many people out of poverty. Look at what’s happened in India, for example. I think fundamentally it is The affluent already have digital personas everywhere. They’re just fragmented all over the place. The less affluent are being excluded from services because of that. And the fact that Larry Ellison is getting involved is just a mistake by Mr. Blair. I think he could have brought a lot more people, a lot more influential people, less, let’s put it politely, less polarizing individuals to talk about the benefit of a digital ID.

Speaker B: And I think that’s a shame. But that comes to the love of it, doesn’t it? Because people, I would hazard a guess that many of those people who are opposing this are, they don’t understand it, but they claim that this is state surveillance. Does that mean that they don’t understand? Does that mean that we need to get a mass information exercise going?

Speaker E: Interesting.

Speaker D: State surveillance. So, how would that look like? So, the state would know where I bank, but the state knows where I bank. The state would know what my health situation is, but the state knows what my health situation is. The state would know where I’m trying to apply for a mortgage or a loan, et cetera, but the state already knows where I’m applying for this. So, it’s all fictitious. It’s just been manipulated by politicians that are unhelpfully damaging the UK public by creating this noise about something that is an obvious benefit to all of us. We all have, you know, our mobile phone number is actually a form of digital ID if you want. And nobody objects in having, nobody wants to have a secret mobile phone, do we? So why would we don’t want to have a digital ID? Now, what the digital ID will also do, it allows us to control where our ID is being used. We were able to see it, we were able to be more transparent about who’s using our persona and so on and so forth. It will be impossible for people to pretend They Are Us and ask for mortgages and loans, as, as you know, countless people are getting scammed with. All in all, I think it’s, it’s a, it’s something that is kind of obvious. And it was just for political reasons why it has not happened because, um, all of the Western world with exclusion of the US has a digital ID.

Speaker B: So most of the political, uh, history to all of this, that’s part of the, the, the reason why for the distrust, isn’t it? That’s part of it. The baggage that goes with this, because this has been a long-term government position. They’ve wanted to establish a digital ID. Margaret Thatcher first raised the idea. John Major tried to implement it. Tony Blair raised the idea. He tried to implement it. Just before the pandemic, there were attempts to try to introduce a digital ID. So irrespective of the political party, there seems to be an underlying imperative from government with a big G. So as you say, people can see a reason for doing it. They just haven’t really properly explained the reason for doing that.

Speaker D: I think you’re so right. I think the issue is exactly the benefits have not been highlighted. And there’s a lot of efforts going to challenge the downside. And you don’t talk about the upsides well enough. And in a digital world that we live in, ID is a very valuable tool that we as individuals have to protect ourselves. It’s not the way of the state to controlling us. And if the state wanted to control us, it doesn’t need the ID to do that. Okay, look at what’s happening in Russia. Well, the Chinese have a digital ID, but they’re not using it for these purposes. If you want to be a dictatorship, you can control your people. You don’t need a digital ID to do so.

Speaker B: Alessandro Otami, the founder of Pacemakers, on how adopting digital ID can lead to whole new industries and efficiencies in the UK. And improve life for everyone, rather than simply being seen as a device that allows you to work. One of the main messages from Keir Starmer when he announced their introduction. It’s a message of efficiency that there are many advocates for. Take Ott Velsberg, the chief data architect of the Estonian government, one of Europe’s leading lights in the adoption of digital technologies. It’s a process that has propelled the small Baltic nation of 1.3 million to the forefront of technology. For Estonia, the individual’s experience is key.

Speaker F: So in Estonia, the data owner is in the end the individual itself. So they have the right to decide over who and for what reason can actually access. Of course, for For taxation purposes, you cannot opt out. But at the same time, you can opt out in other cases that are not critical for the functioning of the state itself. In the, in the steering government, we say data holder. So you hold the data, but you are not an owner of the data. So there is a distinction. At the same time, we have the data minimization principle in place as well, data can only be collected and used for the reasons stipulated in the law itself. So a data minimization principle. Now, when it comes to the ownership of data, the most important part is citizen-centric data governance, which is not too much talked in UK, for instance. So enabling citizens to actually decide over who are the third parties or stakeholders who can actually use the data for particular reasons within a certain time frame. We just crossed 1 million consents given during the time that the consent service has been implemented in agencies. And this in a situation whereby we haven’t yet even regulated consent service in the law. This is in the process. So people have really taken up this opportunity to share, for instance, when you want to get a alone, then you know the process. It’s lengthy. You need to prove how long you have worked, what is your salary, your income over the years. Now imagine you can authenticate yourself and you— it will take 2-3 minutes and you will already receive an offer because that decision is based on the data that the government has collected information on you over the years, and you share this information with different financial institutions. Or similarly, in the healthcare sector, individuals are giving consent for different private sector medical practitioners to actually process your health records, prescribe your drugs, or different health providers giving you recommendations what drugs to take. Not to take, when you need to renew your drugs, and so forth. So it’s really about ownership in a new sense that you can decide who, when can process. And at the same time, it’s also about if this data belongs to yourself, then it’s very critical for me to understand how my data is actually being processed. And for that reason, we have developed a service called Data Tracker, which provides an overview in the government portal for what reasons the government has processed data, by whom, and so on. But in all other cases, it’s truly about providing transparency over how my data is being processed, giving individuals and companies a chance to share their governmental data Now, as a third step, we are working on what we could label as a citizen digital twin, giving individuals the right to choose their preferences on how and for what reason they can receive services, if in some circumstances the government should proactively notify them, how proactive the government itself can be. So again, You control how your data is handled, in the end what services you receive and on what terms. And at the same time giving individuals also an overview of what data the government has actually collected on them.

Speaker B: Well, you sound to be a model organization. This is everything the theorists are saying that should happen in other countries. How have you arrived at this?

Speaker F: Actually, trust is the key.

Speaker B: You achieve trust by, via transparency.

Speaker F: Exactly, exactly. So to be honest, it wasn’t easy in the beginning. So when it comes to the regulation part, it took some time. So it’s the longest standing regulatory change that I’ve had within the time. But at the same time, you cannot be stuck in some regulatory changes. We just did it via contractual basis. Not illegal, yes, not kind of the most positive way to do it as well. But at the same time, for me, when we talk about different principles or guidelines or now practical applications, then it’s always a question about what actually works. You can have great principles, but now the question is how you are going to apply it. So every time I see some government coming out with their own new policy principles that everyone needs to follow, I have just a few questions. How the hell are everyone actually going to implement it? So have a practical mindset. And at the same time, over the years, we’ve been kind of steadily every year we have done studies representative of kind of the population we’re about. What is their awareness of the services that we are either developing or we are planning to do? So for instance, just a month ago we did a nationwide survey on synthetic data. What are the areas people actually care about the most. So one of the things that we just yesterday within the team locked in was salary information on all the people within Estonia, making it transparent how your education, how long you have lived, how does it affect the salary itself, and making that data available for the whole of government. Again, it’s about transparency. If we think in terms of why we actually took that, Estonia has quite huge male-female salary differences. Transparency over how different roles, how whether if you are a woman or a man, affect your salaries. This is again transparency and the social dialogue and also more kind of equal right to get paid the same. Plus, as an employer myself, I really much care about what my competitors are paying and so on. So there are always kind of various other aspects, but the transparency trust is one critical part, but also economical support. So when we talk about the consent service, just to give you an example, During the last 2 years, data-intensive companies have grown their revenue each year more than 16% on average. Today, they provide to the economy added value close to €5.6 billion. So when the economy itself is not doing the best in Europe as a whole, then companies that are actually utilizing data, they are outperforming every sector. So regardless of the sector, and similarly, when we talk about employment, for instance, those companies are increasingly hiring more and more people across the whole workforce, 2% increase or more each year. So it’s about enabling a more efficient data economy.

Speaker B: So that basically means that you’ve got most of the population now signed up to your data initiative.

Speaker F: More or less. If you— just to give you the record weeks with Data Tracker, we had during the week last year when there was a bit of a small crisis when our population registry data was shared with the research institution who didn’t yet have the approval. Close to 450,000 people looked how their data has been processed via data tracker, one-third of population. More or less, we’re talking about over half, so not everyone, but this is increasingly coming. That’s the reality. People are actively using When we look at the kind of nationwide survey itself, over 70% of people consider this something critical that the government has to extend to everything. And the awareness itself is increasing as well. But more or less half of population, we still need to get to the elderly people.

Speaker B: Ot Velsberg, Chief Data Architect of the Estonian government, on how the Baltic nation managed to get buy-in to digital ID from the population. And Velsberg touches on one very important issue. If you are going to have digital ID, it has to be universal. And that means embracing everyone. How do you make a system work where not everyone has access to technology. In the UK, around 20% of the population are in what is described as digital exclusion, according to a recent report from the House of Lords that you can find on the Future Intelligence website. Estonia’s experience has not been shared by Nigeria, an unlikely nation to be associated with digital ID given its fearsome reputation for internet crime and extortion scams, but one that, according to Chioma Nwosu, Adaki, a prominent lawyer and civil liberties activist in the country and a former advisor to the UN, who describes a Nigerian government computer environment startlingly similar to the UK’s.

Speaker A: Well, before now, Nigeria had over a dozen separate databases, right, of identity database, and each of them was created— each government agency created different database. Like, you see, the immigration, the passport had their own database. You see, the Independent National Electoral Commission, the INEC, the voters card had their own. Driver license, telecom banks have their own database. So we have different database, but the thing is that this system did not communicate with each other. So each agency had their own system of collating, collecting story managing the database. But there were so many issues as a result of this. Issues like we had multiple duplication of personal data where— and there were consequences with that also. With— there were conflicting data identity profile, there were issues of inconsistent record, and there were also issues of fraud. You know, I’m sorry to say this, Nigeria had a long history of fraud. We have so many ghosts. Even there are also cases of ghost workers working in government institutions where they are earning benefits without really working. We have the SIM card crimes, right? We have cyber crimes because of all this data. There were also national security concerns, right, where unregistered SIM cards were used for kidnapping and all that. So we had a lot of issues because of it, and the only way we could do that also centralized database. So Nigeria decided to, to build, to have a single foundational identity, right, to clean up the mess. So that was basically one of the reasons why we decided to go on the centralized database system, to have a digital ID.

Speaker B: Has it worked?

Speaker A: Has it worked? There’s a whole lot of factors. Has it worked? I’ll say Not really. That’s the right word I’ll use. No, it hasn’t worked because there’s a whole lot of issues concerning the system, right? Where we even look at— let’s even start from how did we decide to address this issue first. In 2007, Nigeria decided to enact the law, the National Identity Management Commission, right? The law that basically the commission will be responsible to register all citizens and legal residents, right? And also this commission will also issue like a national number, identity number to everyone, and then issue the ID card, the e-ID card at the end of the day. And aside that, we’ll set the standard for like a global, as a national standard for different agencies, and then harmonize all the database. But the issue is that the implementation of the law is slow. It’s slow. And this law was enacted in 2007, where in 2025 we’re still having issues. And then, okay, so in 20— I think in 2013, Nigeria now— no, yeah, in 2013, Nigeria decided, okay, what do we do to make— to enforce this law? So they came up with 3 things. First is that, right, we said we’re going to issue— we’re going to assign the National Identity Number to everyone, and that each agency, like the bank, immigration, everyone will have to use the number, the NIN number. So if you want to, like, for us that we had a bank, we have the bank account and all that before the introduction of the law, that they gave us like days to ensure that we get the number and link like our bank, our bank profile to that number. So it took a while for them to regularize that, so for everyone to get that number. I remember when, when I wanted to renew my passport, I had to get the number, the NI number, and I had to do it like 3 times for it to work. Even to capture my thumb was an issue for me, for them to issue that. So the issue of implementing the law is a problem. The issue of infrastructure, having the right infrastructure, is a problem. That even despite the fact that we said, okay, to address this issue, let’s do a centralized database, there are also loopholes to them. So it’s not something that is going to work immediately. It might take a while. But looking at the Nigerian system, like our economy and all that, That would be the best solution to go through, I would say.

Speaker B: Do people trust it? Do people trust the government? What do they see as the, the intentionality behind this? What do they see as the motive?

Speaker A: The motive from the government perspective, the motive basically is to be able to ensure that because we have a whole lot of cases of fraud cases of identity tests. And we’re saying the government is saying that they want to harmonize this identity, they want to reduce fraud, they want to make service delivery more efficient. So let’s go through. Then do people trust it? I’ll say no.

Speaker B: The lawyer and civil liberties activist Chioma Nwondiki on Nigeria’s flirtation with a national ID card scheme designed to eradicate fraud that has not yet delivered, simply because it doesn’t work very well. So what is it about the Estonian experience that has convinced people that it is worthwhile? According to Arne Antspert, the chief technology officer of the Estonian cybersecurity company Cybernetica, the key is in understanding what sort of ID you are trying to express digitally. It should be simple and functional, something that does not appear to have worked with the Nigerian model. It has to be in your interest.

Speaker G: We have actually 3 different EID means, and, um, how does it work? I would first take a step back and, uh, and, uh, try to define what the EID is because it’s kind of like an electronic identity.. And I think that this metaphor is perhaps confusing for some people, especially when people use some definition of identity as being all the information about the person, like information about you, it defines you, it is your identity. And sometimes people assume that electronic identity is basically all the information about you in electronic form, easily usable, but also also easily abusable. And this is not what Estonian electronic identity is about. It’s not. It’s basically a technical tool that actually combines two functions. First one is secure authentication in the web environment. Very simple thing, but let’s say at a nationwide level with very high level of security. And second one is a tool for giving legally binding digital signatures. So just two very simple functions bound together, and let’s say on their own, they are not dangerous at all. But if you use them wisely at the society level, they can be very, very useful. They can really transform the way how we do the business, how we interact with government. It will streamline everything from citizens to businessmen to the government. So simple tools. And yes, in Estonia we have a national ID card since 2002, which has both those two functions, authentication and digital signature. It’s still compulsory. Every citizen has it. Every non-resident has it. Then we have two different mobile phone-based technique, like tools that have the same capability. And for the end user, there is no difference which one of those three you are using. The end result is the same. One has one advantage, different tool has different advantages. And basically everybody’s using it from like underage kids to grandmas.

Speaker B: Why, why did Estonia suddenly decide you need a digital ID? Estonia is well known for being probably the most internetted country in the world, incredibly technologically advanced. Is that the reason? That if you want to run a technological world, you have to have a digital ID?

Speaker G: Yeah, I think it was vice versa. We first had an ID and this enabled us to be so advanced in our digitalizing in our society. And why we created this digital identity in the first place, I think it was because of a vision. Our government had a vision that was supported by a technical community, I would say. That ID card is possible, that ID card is useful, and government made quite a brave decision at this time to invest integration of this tool. And I would say first 4, 5 years, there were not very much applications. Government was hugely criticized because of like making this. But I think that this kind of like 4, 5, perhaps 6 years, it’s actually time that is needed in order to kind of like convert people to make them believe that this tool that is created is secure, that it’s not going away, that government is still backing it. It is a sufficient time for applications to emerge, and at some point of time, it’s unavoidable. I mean, like, it’s everywhere. It’s so useful that it’s used for everything. And like I said, it’s this moment that when you realize that, yes, this vision was a great vision. I mean, like, it was a right decision. We took like a correct risk. The investment has really paid off for the nation.

Speaker B: I mean, a lot of people don’t realize that they have digital IDs anyway to operate in the modern internet. They’ve got a digital ID with Facebook or Meta. They have a digital ID with Google. They don’t really— and in fact, they don’t realize that Google’s seller identification service services to nation states. Do you think that there is— I mean, obviously not in Estonia, because people, the subscription to ID and the use of digital identity in Estonia is very, very high, isn’t it?

Speaker G: Yeah, but I would like to point out one very important distinction between like a Facebook identity and this Estonian electronic identity. It’s actually not electronic identity. It is Estonian identity. And, and the important bit is that in the digital transactions and in the real-world transactions, you have the same identifier. So if you do something in your real life, you go to some office, you do this over-the-counter transaction, you physically identify yourself.

Speaker B: Arne Antspur, the chief technology officer of the Estonian company Cybernetica. As he says, if you have a digital ID, then it has to work in both an online and physical world and leave as little trace as you do when you walk along the high street. It should enable rather than being a vulnerability to cyber criminals. That’s the point that Warwick University’s Professor Irene Ng is keen to underline. If all of our data is in one place, it’s vulnerable, as attacks on the UK government have shown., and that criminal focus is growing. A new report by the European Union Agency for Cybersecurity warns that public administrations across the EU have been facing a surge in cyberattacks in recent years. Central governments were the most targeted, accounting for 69% of incidents. The report identifies distributed denial of service attacks, data breaches, ransomware, and social engineering as the most prevalent threats. According to Professor Ungar, looking after our own data is important because it not only makes it safer, because it increases the amount of targets the hackers have to hit, it makes us understand our data, a point made by Velsberg.

Speaker H: Very often we have some notion of the colloquialism of what we mean by data, then we leap into some kind of logical— we have a logical jump into the AI space. And then all the fears of what AI can be, could be, must be, shouldn’t be, comes into that space and say, ah, but you see, look at the harm it has done. So then the jump is from processing to impact. And now we must do something about it.

Speaker B: Okay, so is the data that we’re talking about then, the data that is going to be dangerous to us, the data that we need to look out for, is that the data that relates to humanity?

Speaker H: All right, I’ll give you an example. If you take the last number of your passport and you change it, Digitally, you’re a completely different person. That’s your personal data. If you take the last number of your Fitbit steps today and change it, no one gives a toss. And those are both personal data. The thing about data is it has a few dimensions. One, on its own, It can be very potent, but it also can be very inert and very harmless. When combined, inert things, inert data that’s personal, can become very potent. Potent data, when combined, could lose its meaning in some way.

Speaker A: Ways.

Speaker H: You know, there are many cases. So we are now confusing— and you’re in media, you will understand this perfectly— we confuse the medium and the message, and we then say they’re all the same thing, but they are not.

Speaker B: Just to take your example there, let’s look at the Chinese state, for example. The Chinese state could combine your Fitbit steps and your passport number and know exactly where you, where you’ve gone. I mean, this is one of the accusations that’s leveled against the Chinese state, is that it’s this tremendous surveillance system that you now use as AI.

Speaker A: Absolutely.

Speaker H: So you should be— then what you’re saying is we should really try to curtail power. I believe you’ve been trying to do that for thousands of years. You don’t need data. This is basically power. It’s about power, whether it’s from data or from any other means. So you said, all right, we need some regulation, but you went from the Chinese state to— what is it exactly we’re talking about?

Speaker B: Google? Amazon?

Speaker H: That guy who just created an app that processes 3 bits of your data? Who are we talking about here? What, what, what are we talking about exactly that we’re policing? Are we policing data, AI, or power?

Speaker B: It seems to be the potential for AI to be used in a way that may not be beneficial to people, but then we start running into other issues there, don’t Yes, very quickly.

Speaker H: There is potential for knives to create great harm. There’s potential for guns to create great harm. You know, there are potential for society’s machinations to create great harm. We need to have a sensible discussion on what and where harm is created and how it interacts with power to do harm, where it interacts with the inability for people to exercise their agency to stop certain things, which is related to power. But then again, on the other hand, we have to think about choice and freedom because very often, as we know very well, even in the world without data, in the world of democracy, democracy and rights, you cannot police without destroying some freedoms. We need to talk about these freedoms and what the choices are that you are curtailing when you start to police it. But very often it’s a one-sided conversation.

Speaker B: Warwick University’s Professor Irene Ng, who is also the chief executive of the personal data initiative DataSwift. There are some, though, who are dismissive of moves to enable us to store our own data. The identity expert David Birch, author of Identity Is the New Money, who we heard from at the start of the programme, commented that if people were given their own data to look after, they would probably hand it over to Meta’s Facebook in exchange for a Mars bar. Let’s hope it’s one that’s got proper chocolate in it. Though perhaps this whole thing has all got a bit out of control, a bit too complex. According to Sasha Waldridge, the head of immigration at the law firm Burkitts, we already appear to have the basis of a digital ID card for immigration.

Speaker E: So all those EU nationals in the UK that wanted to remain following Brexit had to register their status in the UK. So the government kind of started their digital ID journey with that population. So obviously millions of people there that needed to register. And then following that, which went, to be fair to them, pretty successfully, I mean, not without some challenges for some individuals for sure, as you might expect with such a big project. But overall, I would say it was, it was pretty successful. And then on the back of that, we’ve seen transformation into the current immigration system. System for people on things like study visas, work visas, et cetera. And that’s an ongoing transformation that the Home Office are undertaking. So we’ve seen them start to roll this out. So almost anybody that’s not a British or Irish national in the UK has had some engagement with digital ID already that’s been supervised by, by, and rolled out by the UK government. That, that’s used in, in a few different areas of life. So when people need to prove their right to work, that’s already in play. When people want to prove that they want to open a bank account, that system’s already in play. And then traveling in and out of the borders. So we’re already seeing it for a very large population of people and different government bodies and different private organizations using that system. But obviously, I’m sure some push or lots of pushback from resident British and Irish nationals in the UK who don’t feel themselves necessarily wanting to be subject to an ID system. But certainly there’s a well-established infrastructure already there that the government can build on.

Speaker B: Okay, so what you’re saying is that the government have already got some experience of doing this and that they can use it, and they can use it for the purposes that they’re keen on. Many of the people we’ve interviewed have said, look, Scandinavia’s got very useful, very usable ID card schemes, Europe’s got usable ID card schemes, Why is there pushback from people in the UK? What’s the problem? I mean, do you think it’s good?

Speaker E: Do you think that it works? We need to understand what’s the purpose of introducing this scheme, because yes, it’s very possible to roll one out, but why are we doing so? Arguably, we already have a scheme whereby you can prove your right to work as a British national. You can turn up with your passport or your birth certificate and prove your right to work in that, in that way. So when the government are saying, oh, having digital IDs will stop illegal working in the UK, arguably we already have a system that does that. So any further development of, of that and rollout to British nationals arguably isn’t going to make a huge amount of difference because, as the government have already identified, things like illegal working will take place, it’s just more underground. So your, you know, most reputable companies already want to do the right thing. Those that are intending to subvert the rules are going to do so anyway. So a digital ID, I don’t think, would make a huge amount of difference in that respect. And I think the key thing is trust and what’s going to happen to my data. And I think what I have seen from the rollout with the, with the international population in the UK is if it goes wrong and the system isn’t right and isn’t showing the right details for you, it causes people a lot of problems. It locks them out of being able to rent, start work, claim benefits, and that can really affect their day-to-day lives. So I think really it comes down to trust and, and would the system be rolled out well so people wouldn’t be negatively impacted on a day-to-day basis.

Speaker B: I mean, it’s interesting, we’ve spoken to some of the world’s leading or top experts in ID, and they’re saying Hang on, everybody’s getting the wrong idea about this. You just have to assert that you are who you are. That’s really what ID is about. It’s— you don’t have to present the information that gives your exact date of birth. If you want to prove your identity in a pub, the person in the pub just needs to know you’re 18. They don’t need any information on you. They just need to know that you meet their criteria. If you want to get a job, they just need to know that you’re, you’re entitled to work in, in the UK.

Speaker E: Can we make it that simple? Well, I mean, I’m not the infrastructure expert. I mean, you would hope so, that there should be ways of compartmentalizing that data. We obviously spend a lot of time and energy in business and in life in terms of data protection and isolating that, and, and things like a digital ID have got an awful lot of highly sensitive data. And I’ve certainly already seen problems with that. So I, as an immigration advisor helping people with their visas, get registered, they’ve got a digital account, great, that works. They can start their job, they can get a property to rent. But then later down the line, as their immigration lawyer, I receive emails from the NHS for clients with some of their, you know, appointment details, and that’s none of my business. So that to me is a breach of data security, and there needs to be better checks and balances in place, I think, really. And I think that on a wide-scale basis would cause a lot of concern for people. I think that’s where that comes from.

Speaker B: I mean, it’s interesting, isn’t it? You take right to work. Well, theoretically, a national insurance number should really be all that you need as a right to work, because that’s essentially where everybody codifies whether you’ve made your national insurance payments, state pension, so on and so on and so on. But the point has been made to us that the government currently has somewhere around 24 different identity services that exist within it, whether it be your NHS account, whether it be your driving license, whether it be your national insurance number. The list is endless. Do you think that that could be codified? Do you think that that could be made simpler? Again, going to this point, one of the people that we spoke to said, What you really should have is Doctor Who’s magic paper that he just held up and it became whatever credential was necessary for that particular moment.

Speaker E: Ultimately, people want something that’s easy to use. They don’t want to get blocked out of systems. And I think, you know, that’s part of the debate around ultimately whether or not this is voluntary or mandatory. People might push back at it being mandatory from the offset, but when it makes life easier, you will get voluntary enrolment quite quickly, I’m sure.

Speaker B: Sasha Waldridge, head of immigration at the law firm Burkitts, on an immigration system that we already seem to have. That being the case, should we not really put pressure on the government to think again? If so many people are advocating for a national digital ID card scheme for the 21st century, and if it can deliver so many benefits, Then shouldn’t we really make sure that it works for us? You’ve been listening to Password, written and presented by me, Peter Warren, and produced and edited by the incomparable Blue Buffery for Resonance FM and created by Future Intelligence. To find out more about the high-tech issues now running our world, go to www.futureintelligence.co.uk.

Speaker F: UK.

Speaker B: Password is now available as a TV program via our sister organization Tech TV on www.techtv.live.

Speaker A: Thanks for listening. Goodbye. This program has been brought to you by Resonance FM. If you like what you heard, please support our work by making a donation at resonancefm.com/donate.