Using credentials as money

Wikipedia defines money as “any item or verifiable record that is generally accepted as payment for goods and services and repayment of debts, such as taxes, in a particular country or socio-economic context. The primary functions which distinguish money are: medium of exchange, a unit of account, a store of value, and sometimes, a standard of deferred payment.”

When availing services, one often requires proof of age, address, caste, gender, economic status, or financial capability rather than rupees. These proofs function like money in these contexts.

In the digital world, mechanisms like UPI facilitate the exchange of money, and similar mechanisms could serve to store and exchange credentials. Digilocker has already emerged as a store of credentials and defines methods to exchange them.

However, there is much to be desired in the ease of digital credential sharing. In the past month, for purposes such as opening an account, buying financial products, staying at hotels, or my daughter’s college admission, I have had to provide photocopies of my Aadhaar card, PAN card, or other documents. Meanwhile, I rarely felt the need to withdraw physical cash. This situation poses significant risks of misuse and is generally inconvenient.

It is ironic that in digital India today, you can buy flowers worth ₹10 with a digital money exchange, but need to provide “self-attested” photocopies for buying a financial product worth ₹1 crore. This situation needs serious attention and may require both technological and policy support.

Another issue with the physical IDs today is proof of authenticity.  Technology today enables easy creation of fakes and checking for authenticity is not trivial, especially if this is meant to be established by an individual such as a hotel front desk manager.  Hotels have been requesting for a method to verify authenticity given the increase in crime and corresponding demands from the enforcement agencies.  Verifiable Credentials (VCs) that allow for digital certificates to be independently confirmed for authenticity may be a solution here.  

For example, Digiyatra simplifies the process of air travel for passengers and airports while safeguarding privacy and security. It involves sharing passenger identification, travel details, and facial biometrics with the relevant airport. An evolution of this system could enable its use in other transport methods or any place where tickets are required. However, this requires a more open and flexible system.

A key facet of Digiyatra is privacy and data protection. Once Aadhaar has been shared with the Digiyatra system, it is not required to be presented to airport or airline personnel. In most situations, a passenger is able to navigate via automated systems without sharing any detailed information with any person.  Where necessary, airline or airport personal are only shown the key relevant passenger information—name, photo, and flight details. The ID has already been verified, and the personnel can trust this. Similarly, personal information such as contact number need not be shared with personal  in most situations. This is a crucial tenet of digital data protection and can be valuable for availing various services. For example, a service may require proof that the person requesting the service is a female, under 40 years of age, a resident of Chickballapur district in Karnataka, and belonging to a Scheduled Caste category eligible for certain benefits. The address, specific age, place of birth, and exact community may not be required. In the credentials-as-currency universe, it may be possible for a trusted authority to confirm detailed identification and provide the necessary credentials. There should not be a requirement to share detailed personally identifiable information (PII) beyond what is necessary with any entity.

Digiyatra owes its adoption to the active support of airport authorities, the technology, and the improved value experienced by passengers. This has to be the key to future success in the area of using improved credentials.

The Ayushman Bharat initiative attempts to manage digital health records and adopts a system of data sharing with user consent. OCEN aims to accomplish this for the financial status of individuals. Both build on the DEPA framework.

These are all separate efforts that require their own applications and systems. It is time to recognise credentials as currency and create an open and scalable system like UPI that allows for consent-based proving of necessary credentials.

Mobiles have clearly impacted our lives.  Our phone numbers have emerged as our primary identities.  This also means that many services come to rely on it. It is required for example for ride hailing, for online deliveries etc.  It would be impossible to envision coordination otherwise.  This also means though that our numbers are distributed freely and available to more people for longer than necessary.  The taxi driver needs to contact me when he arrives if I am not at the spot - but does he need to have my number afterwards or even if I am standing in advance on the spot.  Namma Yatri, a popular ride hailing application based on an open network has a feature where they do not reveal the phone number to the driver.  Instead there is a provision for the passenger - driver call to be made via the application.  This avoids sharing the phone number with the driver and only to the application provider.  This also allows for travellers not requiring to activate roaming etc.  With live spoken language translation - it could in the future even allow for the two parties to speak in different languages and understand each other perfectly.  This proxy scheme of a trusted holder of personal information and intermediaries can go a long way in both adding capability and providing valuable capabilities previously not possible.

In summary a successful future digital life would need:

• Trusted Digital Credential Repositories: Platforms like Digilocker.
• Verifiable Credentials/Presentations: Only the minimal details required to access services.
• User-Consent base Sharing: Simple methods for sharing credentials with user consent.
• Privacy and Data Protection: Built on strong privacy and data protection principles.
• Proxy services: Allow for data protection as well as open new capabilities.
• Open and Extensible Networks: Networks that support comprehensive credential management and sharing.

As we move towards this digital future, it’s crucial to recognise the significant transition involved. We must provide pathways for those who may transition more slowly, for various reasons. It’s important to accept and accommodate these differences. Additionally, data errors or inconsistencies, such as name mismatches, should not lead to exclusion. This can be managed through the acceptance of existing physical methods or trusted notaries.

The technology for using credentials as a currency is already available and well-demonstrated. It’s time to establish user-friendly, open networks for credential storage and sharing, built on the foundations of data and privacy protection, to unlock new possibilities.