Who's Who in Cyberspace?

December 2001

Actually it's a surprisingly difficult question, and one which is going to become increasingly important.

Have a look in your pocket and see how many items you have which identify who you are in some way, credit cards, driving licence, membership cards, supermarket discount cards... the list goes on. Each of these items identifies us in the context of a commercial or legal relationship of some kind. Some like credit cards can also be used over the phone or on the internet. Others like a passport must be presented in person.

There is in effect a hierarchy of identification with our passport at the top of the pile. Armed with a passport to prove who we are and a utility bill or two to show where we live we can open bank accounts, set up pension schemes or even hire a video. This is the basis of the 'Know Your Customer' (KYC) procedures adopted by all financial institutions to protect against fraud and money laundering.

As an offshore finance centre KYC is a significant issue, firstly because most of our customers don't live here and secondly because we have to be particularly careful to avoid being used by the money launderers. In other words our financial institutions and their regulators are used to dealing safely with customers they never see.

This should give us an advantage in addressing one of the great challenges we face in exploiting the full potential of online business sometimes referred to as e-KYC. The idea behind e-KYC is that we should be able to prove who we are in cyberspace independently of any specific commercial relationship. In other words we should have an electronic passport. An electronic passport is something which proves that we are who we say we are when we arrive at a web site. For example it would provide sufficient proof of identity to allow us to open a bank account without leaving the comfort of our own screen.

So why is this a problem when we can already do so much online? This is actually quite a subtle issue, virtually everything I can do online today is based on a pre-existing commercial relationship such as a credit card account, which in turn derives from some physical proof of identity. True e-KYC would provide an alternative starting point for the proof of my identity, an electronic passport. The question is, who would issue it?

My passport is issued by the state and it is the state which takes ultimate responsibility for my identity, it registers all of the major events in our lives, birth, marriage death and parking tickets. The internet however does not respect national boundaries and governments all over the world have been unsure of their role in this new medium. This coupled with a general political fashion for letting market forces decide (a.k.a. fear of getting it wrong), has created something of a vacuum which many brave new ventures are falling over themselves to fill.

The problem as with so many things relating to the internet is the business model, or to be more precise the lack of one. Whilst it is plain to see that both business and the consumer will benefit from greater legal certainty in their online dealings, it is far more difficult to see who is going to pay for it. Worse still if proving who people are is going to be a commercial business it will be open to competition and competition in the world of computing inevitably means incompatibility.

I believe that ultimately the provision of electronic passports like the provision of paper ones, or for that matter the provision of public transport or sewerage services should be the province of the public sector. Not a glamorous new way to spend investors hard earned cash, but an intrinsic part of the public infrastructure within which we all do business.