People are the API
A framework for discussion on self-determined identity in the context of the Immigration Authority
A Bachelor’s project by: Julia Podlipensky
7th semester, 2024
Supervising lecturers: Prof. Andrea Krajewski, Prof. Tsunemitsu Tanaka
Identity management
In an age of ever-increasing digitalisation, it is becoming increasingly important to consider how our data is handled. At present, identity management is approached either centrally or in a federated manner. Our data does not belong to us; instead, it is stored, managed and shared with others by identity providers. What if we could own this data about us? So that we could decide who we grant access to this information? Store certified proof of our identity and all its attributes ourselves? Become, so to speak, our own interface for our data? And do so in a way that also benefits others? These are the key questions that form the motivation behind the project.
The Immigration Authority
As key players in the migration and integration process, these authorities are currently under considerable pressure. Staff shortages, a lack of end-to-end digitalisation and the dynamic nature of immigration law are causing difficulties for the authorities. There are also obstacles to cooperation with other relevant authorities; a lack of transparency in data exchange leads to avoidable duplicate checks of the same client documents, thereby prolonging the verification processes.
An alternative common basis for transparency
A common basis for data reconciliation between public authorities already exists – the Central Register of Foreign Nationals (AZR). Any expansion of this register requires further legal reviews and amendments and, despite its comprehensive data storage, does not contain all the data required by case officers at the immigration authorities. The question also arises as to whether such comprehensive centralised data storage is even desirable from a regulatory perspective.
An alternative approach could be to record the authorised issuers of certificates and data, along with their responsibility for the accuracy and validity of the data, in an immutable shared register. In this way, the certified and tamper-proof encrypted documents can be linked to and stored under a unique digital identity held by the customer. The customer then transmits the data from the documents to the authorities who require it for the legal verification process.
Not only does this give people a degree of control over their data, but it could also automate the application process, document verification and the exchange of data with the authorities. This frees up more time for the in-depth legal scrutiny of applications, the coordination of tasks and advising customers.
Outlook
Building on this foundation of transparency regarding the authenticity of certificates and the immutably documented accountability of authorised certificate issuers, a cornerstone can be laid for building trust within a regulatory context.
Furthermore, establishing such a cryptographically based structure can mean that proofs do not necessarily have to be transmitted in their entirety. The data from the proofs could be disclosed selectively, or verifiable statements regarding requirements could be made without transmitting the data from the proofs themselves (zero-knowledge proof). This not only contributes to data minimisation. In a regulatory context, attention can now be focused on the essential information required from the customer that is actually necessary for the legal verification process governing participation in society.