Decentralised identities and the war for our data

Preface: Anti-Money Laundering and Blockchain

I professionally engaged with blockchain in 2018, contributing to one of the first Italian studies on the money laundering risks inherent in cryptocurrencies.

During the 2020 pandemic, with the team of developers who would later create Mopso in 2021, we focused on technological solutions to hypothesize and anticipate what would go down in history as the Covid pass. Through encounters with various Italian identity providers, we discovered the world of so-called Self-Sovereign Identity (SSI): a framework that seemed suitable for safeguarding security and privacy, two fundamental needs within the healthcare sector. Since many SSI solutions are based on blockchain, I have maintained a connection with this world until today. Of course, you all know how it ended: the green pass was not implemented with anti-tampering technologies and ended up being scanned in chats.

Data Warfare

Although I’m not a fan of war metaphors, especially during a period of very serious conflicts looming on the borders of Europe, I believe that what is happening in the world of the Internet is very dangerous for the autonomy of our continent.

Data is central to training artificial intelligence models: I do not have the expertise to assess the recent intellectual property issues faced by OpenAI, but they certainly raise a question.

With which data do we train the LLMs, and to whom do they belong?

In this race of increasingly powerful systems, those who have had years to accumulate billions of pieces of information and train their own artificial intelligence models are at an advantage. We are of course talking about the GAFAMs and the strong positional advantage they are further benefiting from, showing us that the possession of our personal data is no longer simply a matter of “I have nothing to hide” but a geopolitical challenge. A challenge in which Europe is lagging behind, lacking champions capable of competing as search engines, social networks, or platforms at the moment.

In an interview on Bill Gates’ podcast, Sam Altman, founder of OpenAI, one of the most important AI entities, discussed some future developments of his creation.
I mention them because they are very interesting compared to what was anticipated:

“Personalization will become important. People want very different things from ChatGPT. Different styles and different sets of hypotheses. Everything will become possible.”

And furthermore: “GPT-5 will also be able to use your data. The ability to know about you, your email, your calendar, your scheduled appointments, connection to external data sources…”

Where will GPT-5 collect our data from? Will it integrate with all the systems that already collect information about us? The hypothesis is both interesting from an entrepreneur’s point of view, as having such virtual assistants seems truly useful, and dangerous: misusing personal information can, for example, surreptitiously lead us to buy things we don’t need, to get into debt, to get into trouble.

How will we control that AI is collecting only strictly necessary information and not, as it has been so far, everything it can access?

A Countermeasure in Decentralized Digital Identities

Those who have followed the debate around the European identity wallet will have grasped several relevant aspects from a geopolitical point of view. Firstly, wallets are born with a very solid privacy-by-design concept: they put the holder back in control of their personal data. Never again giving away data, full control of their use, in the philosophy of the GDPR. Secondly, decentralized digital identities adopt important security solutions such as the use of encryption to issue and manage digital certificates and the adoption of open-source code for the wallet. Encryption is used to ensure the integrity of the data collected on the identity wallet: a counter to fraud and a strengthening of trust in purely online and digital interactions. The possibility of having open-source code allows for extensive verification by the computing community in order to reduce threats such as zero-day attacks and the presence of backdoors.

I can now answer the question from the previous paragraph regarding control over data usage: wallets can offer “selective disclosure” solutions, ensuring that only necessary personal information is shared, sometimes even pseudonymously.

An often-cited example is the request for identification from a young bar customer who wants to purchase alcohol: today, the bartender requests identification, where they also discover the customer’s name and surname, in addition to their date of birth. They can take advantage of this information to search for the customer on a social network – I have collected many testimonies supporting not so elegant behaviors in doing so.
With the wallet, it will be sufficient to derive proof of age and transmit the information “I am of legal age,” truly respecting the privacy of the young customer.

Secondly, whenever a public administration or private entity intends to request information from your wallet, a window will appear (as is the case today with SPID) specifying the requested information. If you try to compare this technology with what any online newspaper asks you when you accept cookies today, you can understand what huge progress lies in the wallet and in the transparent way it will allow you to manage requests for your personal data.

The Financial Sector

The banking and financial sector is facing increasing fraud risks: synthetic identities, documents stolen on the dark web, more or less sophisticated attacks on biometric systems. The battle for correct identification is worth tens of billions: how many funds disappear today because those who accessed them used a stolen identity? The wallet can provide a valid contribution, but to become a winning weapon, it must be enriched with several attributes of the person. Not just name, surname, place, and date of birth, but broader information regarding our work, income, assets, and family situation.
These are among the most sensitive data because they could make it impossible for us to access central services for our lives such as a mortgage.

The GAFAMs still cannot access our incomes and assets: they can infer apparent wealth from the photos we publish on social networks, but, we have had hundreds of examples, it is not difficult to purchase and immediately return expensive clothes with Yoox or Zalando, given their very quick and advantageous return policies.

The uses of Apple and Google wallets for payments are too partial to provide an accurate portrait of our purchasing power: at least, so far. Since the mentioned giants are also investing significant resources in building their own identity wallets, it is important to start a public debate as soon as possible on how to properly regulate this technology.

For this reason, it is the opinion of the writer that, within the debate related to the ongoing formal approval of the eIDAS Regulation in European institutions, it is necessary to discuss how to manage attributes other than demographic data. With this article, I wanted to raise the issue but also draw the attention of all those private actors who could greatly benefit from the wallet revolution: the use cases are countless. There are less than two years left, it is the right time to be prepared and reflect properly on how to preserve central assets for the future of our continent.