How Leading Digital Workplace Vendors Are Enabling Hybrid Work

Dion Hinchcliffe

Vice President and Principal Analyst
Constellation Research

Title: About Dion Hinchcliffe Dion Hinchcliffe is an internationally recognized business strategist, bestselling author, enterprise architect, industry analyst, and noted keynote speaker. He is widely regarded as one of the most influential figures in digital strategy, the future of work, and enterprise IT. He works with the leadership teams of large enterprises as well as software vendors to raise the bar for the art-of-the-possible in their digital capabilities. He is currently Vice President and Principal Analyst at Constellation Research. Dion is also currently an executive fellow at the Tuck School of Business Center for Digital Strategies. He is a globally recognized industry expert on the topics of digital transformation, digital workplace, enterprise collaboration, API…...

Read more

The phenomenon of hybrid work is now well upon us in 2023, as the world shifts into broad new patterns for how workforces are divided between office and remote. Roughly speaking, workers went from a high of about 46% remote during the pandemic, down to about a quarter of workers today and still falling a bit according to my research. This was from a small cohort of approximately 5% of workers who were remote before it became a major global phenomenon. Now workers -- especially in knowledge intensive businesses -- have become distributed between two primary locations: In-office or at a remote location, the latter typically their residence or a co-working space.

Now one of the leading questions about digital employee experience has become how to best enable this hybrid work environment. Business leaders, executives, digital workplace/employee experience teams, human resources, and other stakeholders are now realizing that this is a fundamentally new posture for our workplaces. Indeed, for many workers, all they really have now is a virtual workspace, not a specific physical place. What then are the vital adjustments to the design of the employee experience that must be made? What is the best route to achieve them, given that a growing percentage of work is done entirely in the digital realm in any case. Also, as we'll see, there are real challenges in having such a physically divided workforce.

The Steady Shift to Hybrid Work

The shift to mass remote work in early 2020 required a set of fundamental shifts towards a more digital overall employee experience, but one that few organizations were properly prepared for. This included everything from enabling basic access to devices and networks for everyone in the organization, then on to comms/collaboration, applications, data, along with (hopefully) matching new digital skills, all in a workable, secure package. This shift was a prompt imperative as the pandemic sent workers home en masse, and happened quickly and successfully in most organizations.

However, the subsequent shift to hybrid work is characterized by less urgency than the move to remote work was. And it's qualitatively different than remote work. As a result there are some significant challenges with hybrid work for which there are still few clear answers. This more gradual move is rather unlike what was largely the instant need for a remote work foundation (though the more advanced aspects of remote work are certainly still works in progress.) So the hybrid model will likely not get nearly as much attention or priority. Yet the challenges with hybrid work are in fact vital ones that go directly to what matters most to organizations: Attracting and retaining talent, fostering a strong and positively differentiating organizational culture, and not losing the distinct productivity dividend that emerged in many sectors during remote work, boosted by both automation and less time commuting.

Designing for Hybrid Work

With the ever growing jumble of apps and digital tools put in front of workers, the research increasingly shows that today's sophisticated workspaces now require organizations to put genuine investment and effort into coherently designing their digital employee experiences and digital workplaces, especially in the core journey, in order to have an effective and efficiently operating organization. As a result, a designed digital workplace is a key practice that I've been increasingly advocating in my research, advisory, and consulting work in developing next-generation workplaces, with gratifying results for those that have done this well.

My research currently shows that organizations are seeking to put a growing amount of effort into designing their core worker experience upfront in order to:

• Reduce onboarding time, effort, and cost
• Make new workers more effective on the job earlier
• Reduce complexity and friction in the most common/important processes
• Make existing and new work processes more effective
• Create more personalized and purposeful workspaces

However, achieving these goals requires that we have platforms and tools that are actually designed for the unique aspects of hybrid work. But up until recently that has not been the case, as the majority of the applications that organizations have used were instead designed for an earlier, mostly in-office era. Using these older solutions in a hybrid work environment as-is can become problematic, because of the unique aspects inherent to hybrid workplaces. This aspects are those characterized by having two separate cohorts of workers that are either in the office much of the time or workers that are remote much of the time, but have many tangible and intangible barriers between them. Fortunately, few digital work vendors have stood still and we are now seeing many of them seriously attempting to address the needs of hybrid workplaces.

Reducing the Challenges of Hybrid Work

Without explicit design for the significant and unique issues of hybrid work, the result is a digital work experience that inevitably perpetuates -- or actually creates -- a number of key issues that are essential to address for an effective, inclusive, and equitable hybrid workplace. These issues and challenges include:

• Cultural divide between in-office and remote workers
• Communications/collaboration gaps
• Productivity hits to hybrid teams
• Differences in equity and inclusion
• Disparities in visibility, transparency, and access

To that end, I've surveyed what the top providers of digital workplace tools have done to address the requirement of hybrid work. Since it is still early days in the hybrid work journey, many of these are experiments or educated guesses on what will address the issues. So it's safe to say that many providers are making a good effort to improve the state of the art in hybrid work, but the true effectiveness of these features aren't well understood yet. I will share what I learn as the results of these vendor experiments come in.

How Digital Workplace Vendors Are Supporting Hybrid Work

Below is a summary of the main improvements and additions that the most common used providers have made. I've emphasized communication, collaboration, and productivity tools since they are used a large percentage of the day and directly cross the intersection of the two main cohorts of hybrid work. The list below is sorted in rough order of the scale of efforts and general marketshare, to reflect the likely impact to the number of hybrid workers in the population.

Microsoft has been one of the leaders when it comes to providing specialized capabilities or updated features for hybrid work. Here is a non-exhaustive list of the notable additions to Microsoft365, Office365, and the company's other tools/platforms for hybrid work:

• RSVP for Outlook. Finding a good way to meet together a leading challenge for hybrid workers. Outlook now enables workers to indicate whether they will attend a meeting in-person or remotely. This helps workers plan better the days they will be in the office or remote, by seeing how others will attend meetings that are important to the worker.
• Hybrid-Enabled Working Hours. Outlook will now allow users to include work schedule specifics directly in a worker's calendar, so colleagues can find out when and where they'll be working. Key to bringing parity and inclusion to remote workers, who tend to have more flexible work hours and locations.
• Teams Rooms with Front Row. With this hybrid work feature, the video gallery appears at the bottom of the screen so in-room participants can see remote colleagues in a way that feels more face-to-face, so that they seem like they are in the same room.
• AI-Enhanced Video Presence. Microsoft is in the process of enabling a variety of smart video streams that focus on people and make them visually more present, especially for remote workers. The new category of AI-enabled cameras makes this possible, best embodied right now in a growing number of features for Microsoft Teams. There are three key technologies that deliver this new category of intelligent video presence:  a) Active speaker tracking, which uses smart technology in in-room cameras to tap into audio, facial movements and gestures to detect who in the room is speaking, then dynamically zooming in for a closer view. b) Multiple video streams that enable in-room meeting participants to be positioned visually in their own video pane. c) People recognition, which will automatically identify and then display the profile name of users within the current video pane, if they have previously opted in.
• Video Presence in Powerpoint. Last year Microsoft introduced cameo, a new PowerPoint features that integrates the Teams camera feed into a presentation to allow the presenter to customize how, when, and where they'd like to appear in the presentation deck with their slides. This increases the presence of remote workers when the presentation is played back.
• Voice coaching in Teams. To help workers off all kinds collaborate better across the hybrid divide, there is a new AI-powered speaker coach in Microsoft Teams that privately shares tips and guidance on pace, any tendencies to interrupt others and remind workers to check in with your audience as they talk.
• A new end-to-end hotdesking experience. To help remote workers and more occasional in-office workers visit in-person, Microsoft now offers a more dynamic hotdesking experience right within Microsoft Teams displays that enables workers to locate and reserve flexible, on-demand workspaces in the office. Workers can book a physical working space within the device or before-hand using either Outlook or Teams. They can then access their personal Teams calendar, chats, meetings and more right on the device. Teams displays are designed be used as a stand-alone device or as a second screen while hot desking. After an employee signs out, all personally identifying information will be removed from the device.
• LinkedIn support for hybrid work information. LinkedIn has added new fields in job postings so organizations can now indicate if the open job is remote, hybrid or in-office only. This helps job seekers seek out and discover jobs that align with how they prefer to work. LinkedIn also has way for organizations to share how they are approaching work presence on their company page including vaccination requirements, and their current status on remote or hybrid work.

Sources: Great expectations: A road map for making hybrid work work, Microsoft and LinkedIn share latest data and innovation for hybrid work

For its part, Google Workspace has add a variety of features for hybrid work as well. These include:

• Virtual meeting onramps. Google has added a quick button to met directly in Docs, Sheets, and Slides. Workers are able to quickly start a meeting and bring the meeting session to a document, spreadsheet, or presentation.  They can present this content to all the meeting attendees. This enables everyone in a meeting to collaborate in real-time while having a conversation, right from the same tab. This helps make it easier for remote workers to achieve better parity with in-office workers, who can more easily call physical meetings on the fly.
• Setting current work location. Like Microsoft has provided in Outlook, workers can now set their location for the work day right in Google Calendar. The feature is designed to allow meeting organizers as well as on-site teams to plan for the right mix of in-person and remote attendance. This feature also provides greater visibility and can help set expectations across hybrid teams.
• Companion mode for Meet. In-room meeting attendees now have a way to be more engaged with their personal devices while using in-room audio and video to improve the in-room experience. Google has started rolling out features for people in conference rooms to be able to add their own personal video tile from Companion mode using their laptop camera. This it easier for other attendees to see their expressions and gestures and connect better across the hybrid work divide.
• Connect hybrid teams with Spaces. Formerly known as Rooms in Google Chat), Spaces are a central virtual location for teams to collaborate in Google Workspace. Spaces brings in many of the Workspace tools like Meet, Calendar, Drive, Docs, Sheets, Slides and Tasks so that a living workspace can be created that's friendly for every time of worker, and persists after a collaboration session or planning meeting takes place.

Sources: Boosting communication and collaboration for teams of all sizes in Google Workspace, Make the most of hybrid work with Google Workspace, Bridging the hybrid work gaps with Google Workspace

From my ShortList of Employee Digital Workspaces of the same name, which are collaboration hubs designed for workers to get much of their work done in a team settling, here are the recent hybrid work features from some of the digital workplace providers on the list:

• Dropbox Spaces. While eschewing the term hybrid work, and preferring to talk instead about distributed work, the company's Spaces product was introduced just before the pandemic started (I was in attendance at the announcement.) As company, Dropbox now has a well-known policy of Virtual First, and uses its own products to enable hybrid work. As it turned out, Spaces was prescient in the need to create more context between in-office and remote workers. Spaces is designed to centralize and provide more context around content related to structured work like projects, no matter where workers are located. Spaces enables hybrid work by centralizing information and collaboration, and removes friction from the process of work (by storing comments instead of popping up endless notifications, for example), regardless of physical location. The latest version of Spaces is optimized for remote working, and has features that lets workers manage top priority tasks, even across multiple projects. Always one of my favorite features, Spaces includes integration with key 3rd party systems and tools like Hubspot. Sources: How to manage distributed work with Dropbox Spaces, The new Dropbox Spaces makes remote work easier and more organized
• Happeo. A social intranet designed around Google Workspace that has steadily climb the rankings over the years, Happeo offers a wide range of collaboration features that are appealing for both remote and in-office workers. Perhaps most important is creating a hybrid culture, as Happeo is designed to help remote workers feel like they are a part of the organization by keeping them informed about happenings from around the company. Happeo has an unusually deep analytics tool to help companies understand hybrid work engagement patterns and address shortfalls. It also specifically has high security standards for remote work, which has been a notable issue for remote workers. Happeo has a highly customizable mobile app which lets hybrid workers build the views they need to stay connected to the company. Source: Happeo's Remote Work Software
• HCL Connections. Long an industry stalwart, Connections remains one of the pre-eminent social workspaces in the industry. The recent v7 release of Connections added dynamic community creation wizard that helps hybrid teams more quickly create the groups they need to span in-office and remote workers. New Microsoft365 integration further helps break down silos between distributed teams. Source: HCL Connections v7 Is Here
• Igloo Software. The company has a networked enterprises feature that allows the creation of nuanced hybrid teams based on the audience type. Using a hub and spoke architecture, enterprise administrators can bring in different groups, divisions, geographies, and affiliates while deferring some local control to site administrators. Developed before the pandemic, the feature is particular powerful today, as companies build distributed organizations with far flung boundaries and borders. Source: Networked Enterprises
• Lumapps. A digital workspace solution that has won top intranet awards, Lumapps is not as well known as some of the solutions here but has been delivering a distinguished offering for some years now, and I run into it more often in clients that I used to. The platform offers features that help remote/distributed workers (in addition to in-office ones), including a digital headquarters to allow workers to access files and information and stay connected with each other. Features to foster belonging, including virtual onboarding, training, and employee generated content, are offered as well. These features are used by well known highly distributed/remote companies like Thoughtworks. Source: A Platform for Remote and Hybrid Work
• Salesforce. The well-known SaaS giant created their Success from Anywhere program, through which it has learned what large global organizations must do to empower hybrid and remote teams and rolled what they learned from the program into their products.

What Actually Works to Enable Hybrid Work

As you review these various new features and capabilities for hybrid work above, and you come to the conclusion that many are point features that are not highly strategic, you would not necessarily be wrong. The reality is that we are still learning what organizations really need when it comes to hybrid work. 2023 is a year of mass experimentation for how organizations will try to better enable hybrid work, not just with technology, but with process and education as well. In particular education about the capabilities above will be central to shifting behavior so that hybrid teams work more optimally. We now live in a time where how-to videos, just-in-time training, and digital adoption platforms can help workers rapidly pick up the new mix of skills and techniques that these hybrid work features enable.

To that end, I've embarked on a major research study to learn what organizations are actually doing this year with hybrid work, including what is working and not working. If you're responsible for some aspect of realizing hybrid work at your organization and would like to participate (and get early access to the data), please send me a note.

Also, if you are a digital workplace tool provider and would like your hybrid work features added to the list above, also drop me a line.

My Additional Research on the Future of Work

Every Worker is a Digital Artisan of Their Career Now

How to Think About and Prepare for Hybrid Work

Why Community Belongs at the Center of Today’s Remote Work Strategies

Reimagining the Post-Pandemic Employee Experience

It’s Time to Think About the Post-2020 Employee Experience

Research Report: Building a Next-Generation Employee Experience: 2021 and Beyond

The Crisis-Accelerated Digital Revolution of Work

Revisiting How to Cultivate Connected Organizations in an Age of Coronavirus

How Work Will Evolve in a Digital Post-Pandemic Society

A Checklist for a Modern Core Digital Workplace and/or Intranet

Creating the Modern Digital Workplace and Employee Experience

The Challenging State of Employee Experience and Digital Workplace Today

The Most Vital Hybrid Work Management Skill: Network Leadership

News Analysis: Microsoft Bing with ChatGPT vs Google Bard AI

R "Ray" Wang

Principal Analyst and Founder
Constellation Research

R “Ray” Wang is the CEO of Silicon Valley-based Constellation Research Inc. He co-hosts DisrupTV, a weekly enterprise tech and leadership webcast that averages 50,000 views per episode and blogs at www.raywang.org. His ground-breaking best-selling book on digital transformation, Disrupting Digital Business, was published by Harvard Business Review Press in 2015. Ray's new book about Digital Giants and the future of business, titled, Everybody Wants to Rule The World was released in July 2021. Wang is well-quoted and frequently interviewed by media outlets such as the Wall Street Journal, Fox Business, CNBC, Yahoo Finance, Cheddar, and Bloomberg. Short Bio R “Ray” Wang (pronounced WAHNG) is the Founder, Chairman, and Principal Analyst of Silicon Valley-based Constellation Research Inc. He…...

Read more

The $450 Billion Ad Tech Market Is About To Be Shaken Up By AI

When Google was officially launched in 1998 by Larry Page and Sergey Brin, it was the 21st search engine to enter the market. In 2022 Google generated over $200 billion in revenue off of search advertising and other digital advertising.  MIcrosoft launched the Bing search engine in 2009, built from the assets of Live Search which was released in 2006.  By all accounts, Microsoft Bing was the laggard among Google and Yahoo in the space.  Round 1 of the search engine wars was won by Google which has dominate for almost two decades.

Microsoft - Open AI Alliance Challenges Google Ad Dominance

The recent announcements on Tuesday, February 7th by Microsoft that the new Bing engine would use technology with a more powerful large language model than the one that underpins ChatGPT.  Microsoft's model would add massive data sets of online data for user queries and prompts.

Google countered with Bard AI, an experimental conversational AI service that would do the same and be released soon. Feburary 7th, 2023 will be recognized as the day conversational AI disrupted traditional search advertising.

Round 2 in the battle will be remembered when large language models, NLP, and conversational AI changed the game.  Will Microsoft come in first for technology in this decade, century? What will Apple do with its large data sets?

ChatGPT vs Google Bard AI (What We Know For Now)

So what started all this was the launch of ChatGPT on November 30, 2022.  Chat GPT is an AI language model that communicates with users in a conversational manner.  The AI and large language model (LLM) summarizes text, translate languages, answers questions using a technology called Natural Language Processing or NLP

Google Bard AI is like Chat GPT, but it’s build on Google’s Language Model for Dialogue Application (LaMDA). Google Bard AI can access the entire Internet, ChatGPT can’t yet, but the new Microsoft Bing Search is expected to.  Today, ChatGPT is limited to the data it’s trained on. So it’s good with stuff before 2021.  When available, Google Bard AI will be fresh and current by pulling vast data troves from the web.

From preliminary insights from engineers at Google and Microsoft, Google’s tech will use less computer power so it could handle more users and consume less energy than ChatGPT.  However, Chat GPT is available now and being trained, Google Bard Is coming soon.

The Bottom Line: AI Is An Exponential Game Changer

How we access information on a search bar has fundamentally changed. Expect AI to suggest ideas, explain complex concepts, write code, prepare speeches, and translate languages.  At Davos this year, every third presentation began with "ChatGPT wrote this speech".  With 100 million users in less than 10 days, this is just the power of LLM's, AI, NLP and text.

On the computer vision side, other cool tech like stable diffusion, Midjourney, and DALL-E2 will do to images and computer vision what conversational AI is doing to text.  AI is an exponential game changer in the enterprise and how humans interface technology is about to be changed right in front of one's eyes.  (This blog post was created by a human)

What’s Unique About NFTs?

Steve Wilson

Former Vice President and Principal Analyst
Constellation Research

Steve Wilson is former VP and Principal Analyst at Constellation Research, leading the business theme Digital Safety and Privacy. His coverage includes digital identity, data protection, data privacy, cryptography, and trust. His advisory services to CIOs, CISOs, CPOs and IT architects include identity product strategy, security practice benchmarking, Privacy by Design (PbD), privacy engineering and Privacy [or Data Protection] Impact Assessments (PIA, DPIA). Coverage Areas: -  Identity management, frameworks & governance-  Digital identity technologies-  Privacy by Design -  Big Data; “Big Privacy”-  Identity & privacy innovation Previous experience: Wilson has worked in ICT innovation, research, development and analysis for over 25 years. With double…...

Read more

NFTs (non-fungible tokens) are one of the hottest applications for blockchain at the moment. The initial craze has died down, and indeed there has been a backlash against the multimillion dollar cartoon monkeys. So what was THAT about? If putting graphics on the blockchain was some kinda of proof of concept, what is the concept exactly?

Enterprise applications for NFTs are emerging, and many see the technology as foundational in the Web 3 or metaverse to come. 

In this blog I am going to compare the purpose and functions of NFTs with Bitcoin and Decentralised Identifiers (DIDs).  I think it’s important to see the common patterns in these three blockchain applications. They share the same techno-libertarian roots, and they all pull off a very similar trick.

They all prove the uniqueness, or equivalently, the originality, of certain digital events, without relying on any official or central authority.

What sort of problem are we solving?

Understanding how these decentralized technologies are all similarly specialized, sheds light on their limitations. Let’s heed and learn from the fact that the early promise of blockchain has not led to matching benefits realisation. I find it especially sobering that two of the best thought through third generation blockchain – IBM-Mersk Tradelens and the ASX-Digital Asset stock market settlement system – projects have recently folded.

So let’s be more careful as we head into the metaverse with high expectations of NFTs.

The key is to understand precisely where decentralization surfaces with these technologies.

Decentralization is part of the digital zeitgeist but historically it’s unusual in business and society. The vast majority of us live and work within myriad authority structures. We deal on a daily basis with intermediaries and institutions that have evolved over decades (or even centuries) as the most efficient ways of organising complex communities. It is rare that these structures can be decentralized, and ever rarer that the benefit of decentralization is worth the cost.

Bitcoin, NFTs and DIDs all do something that is truly unique, but it is very specialised.

What’s the big deal with NFTs? 

I am not going to comment on the vagaries of the art market, where NFTs are getting perhaps the most attention. As a technology analyst, I don’t have a professional opinion about whether JPEGs of monkeys count as art at all.

Instead, I will focus on really special technical property of NFTs: their ability to prove originality of digital artifacts.

The token in a Non-Fungible Token is a compact and unique numerical proxy for something like an image. This is the same basic type of “token” used to mask credit card numbers. An NFT is a digitally signed token which is registered, usually on a blockchain, so it can be transferred as a unit but never divided or duplicated without detection.

Decentralised digital currency

Let’s revisit cryptocurrency. This was the exemplary and original use case for public blockchain , from which all contemporary decentralization has emerged.

Remember that to prevent double spending, Bitcoin uses the blockchain algorithm to monitor all BTC movements.  The community determines by consensus the order of every attempted BTC transfer, and the blockchain data structure memorializes the agreement.

This is really a matter of originality. The essence of the Bitcoin blockchain is to decide, without any official, which BTC transfer came first; that is, which transfer is considered to be original.

Decentralised Identifiers

When I first met Decentralized Identifiers (DIDs) the problem being solved was how to self-publish an identifier that is assured to be unique on a large name space. Some communities wish to allow their members to manage their own lifelong identifiers without being beholder to governments or banks. How can people “bring their own” ID and be sure they’re not going to clash with someone else’s choice of ID?  The task of proving uniqueness of an ID on a given domain generally requires an authoritative register and a trusted registrar.

It dawned on some people that a pubic blockchain could provide the means for a community to have self-published identifiers that are provably unique on the community’s domain, without any central registration. This led to the foundational blockchain DID method, in which a user creates an identifier (essentially a long, largely random and hard-to-guess string) in an agreed format, signs the DID using their private key, and publishes it to be ratified.

The community votes on whether that DID has ever been seen before, and if not, deems it to be unique and memorialises it. Thence the DID is attributed to (owned by) the holder of the private key that signed the first appearance. As with Bitcoin, no one need know the identity of the key holder; there is no central trusted registrar or naming authority of the actors, their key pairs and IDs.

A common pattern

I have come to the view that the real mission of public permissionless blockchains is proof of originality in settings where you have the option to reject authority. This is what they do that is special.

At some level, NFTs, BTC and blockchain DIDs are really the same thing.

They each rest on decentralised consensus that a certain event took place for the first time, whether it be that

• Alice sent some number of coins to Bob, or
• Alice generated and self-published a never-seen-before DID, or
• Alice authored a given digital object.

Each event is verifiably signed by Alice using a key pair which she owns and everyone in a community is satisfied she owns, without any central registrar or administrator.

The blockchain creates order out of the chaos https://www.constellationr.com/blog-news/order-out-chaos  where no one knows which key pair goes with which account, and no one cares.

But this is a self-imposed chaos!

Now, where does it matter?

BTC, NFTs and DIDs all have very similar motivations: to make certain actions “official” without central administration. BTC, NFTs and DIDs each bind a certain event to a key pair; the owner of that key pair is deemed by consensus to be the one and only sender of the BTC, or the subject of the DID, or the creator of the tokenised digital work.

So that’s the special technical trick they all share, but whether proving originality in this way is sensible or worth the cost, is another question. The benefits matter most to communities that reject central authority.  By the same token (no pun intended) the benefits are diluted or entirely academic in settings where a central authority is necessary for other reasons.

There actually aren’t many things that can be accomplished without a central authority.  We must take great care with use case selection. The really good use cases for BTC, DIDs and NFTs are rarefied and fragile.

Hybrid use cases in which the decentralized log of events import critical facts established by external sources of truth render the hybrid architecture pretty vacant. If Sotheby’s for example vouches for an artwork and then mints an NFT to that effect, or a winemaker attaches an RFID tag to a special vintage bottle, or a government agency tokenizes a land title deed, then what’s the point of crowdsourcing the order of subsequent events and transfers?

Make Data Better: How Should We Respond to the Optus Data Breach?

Steve Wilson

Former Vice President and Principal Analyst
Constellation Research

Steve Wilson is former VP and Principal Analyst at Constellation Research, leading the business theme Digital Safety and Privacy. His coverage includes digital identity, data protection, data privacy, cryptography, and trust. His advisory services to CIOs, CISOs, CPOs and IT architects include identity product strategy, security practice benchmarking, Privacy by Design (PbD), privacy engineering and Privacy [or Data Protection] Impact Assessments (PIA, DPIA). Coverage Areas: -  Identity management, frameworks & governance-  Digital identity technologies-  Privacy by Design -  Big Data; “Big Privacy”-  Identity & privacy innovation Previous experience: Wilson has worked in ICT innovation, research, development and analysis for over 25 years. With double…...

Read more

One of Australia's worst ever data breaches occured in September 2022 when the telecommunication carrier Optus was attacked by cybercriminals and personal data on approximaley half the population was leaked. It triggered a mass response, knowing that so much personal data used to establish identity was coming onto the criminal black markets; many governments expedited the renewal processes for driver licences and the like. 

And there was sudden renewed interest in the various digital identity initiatives of Australian state & federal governments.  It just so happened that the federal myGov program was under review, andthe scope of that examination was broadened (at least unoffocially) to consider if the newish myGovID could be modified somehow to provide improved "digital identity resilience". 

But it's a mistake to think of these as identity problems. They are data problems.  To be precise, it’s the quality of the data that we use in identification that needs to be addressed.

Frankly, there is no such thing as "identity theft". What happens after a brach is that personal details used to establish identity fall into criminal hands and get reused behindour backs to impersonate us. That sounds like I’m splitting hairs, but the point is we can’t protect people by just updating their data. That’s no lasting fix. Changing driver licence data or passport data is not a sustainable response when another breach is inevitably around the corner. People deserve better safety in a modern digital economy. 

The root problem that makes people vulnerable after a breach today is that businesses can’t tell the difference between original data and copies. Websites can’t tell if a form is being filled in by a genuine customer or an imposter. So stolen data is traded on black markets and used by imposters behind our backs.

Data is the lifeblood of the digital world. Data sharing can only expand in coming years. Of course excessive, nefarious, covert and deceptive data collection must be fought, but well-intended data collection must continue. Instead of changing the way data is used, we must change the way data is presented.

We must make data better.

Instead of having people type raw numbers into forms to establish their bona fides, we should transition to digital presentation of cryptographically protected facts and figures. Digital credentials should be signed by their issuers when issued, to prove their origin, and must be signed again by their holders when presented, to prove the owner consented to each transaction, or was at least actively involved.

The signing is relatively easy. It’s built into mobile technologies and used seamlessly every time we bring up a virtual credit card from a mobile phone wallet.

We should be adding official digital copies of driver licences, Medicare cards, passports, and all official facts and figures into digital wallets — whether they be government mobile apps such as that of Service NSW, the Apple and Google wallets, or new versions of the future Open Wallet standard.

People should be able to move their important data around with exactly the same convenience, privacy and security as they move their digital money.

Stay tuned through 2023 as I publish more on Data Protection as a Service, andcheck out our Constellation Shortlist of Data Protection Infostructure solutions. 

Trust in the Post-Identity World

Steve Wilson

Former Vice President and Principal Analyst
Constellation Research

Steve Wilson is former VP and Principal Analyst at Constellation Research, leading the business theme Digital Safety and Privacy. His coverage includes digital identity, data protection, data privacy, cryptography, and trust. His advisory services to CIOs, CISOs, CPOs and IT architects include identity product strategy, security practice benchmarking, Privacy by Design (PbD), privacy engineering and Privacy [or Data Protection] Impact Assessments (PIA, DPIA). Coverage Areas: -  Identity management, frameworks & governance-  Digital identity technologies-  Privacy by Design -  Big Data; “Big Privacy”-  Identity & privacy innovation Previous experience: Wilson has worked in ICT innovation, research, development and analysis for over 25 years. With double…...

Read more

The Internet, e-commerce, and digital discourse are dominated by identity. Until recently, identity was all we had to go on when trying to trust other people online. We developed a terrible habit of over-identifying: Relying parties tend to collect circumstantial clues, like credit card verification codes and social security numbers, instead of properly verifying what really matters. People divulge excessive personal data (often unwittingly) which then leaks and gets abused by criminals. We have way too much identity, sloshing around.

Is there a paradigm shift coming? The most important developments in our industry — Self-Sovereign Identity, the FIDO Alliance, and verifiable credentials — are really not about identity at all, but authorship, provenance, integrity, and control. Let’s move beyond identity and imagine a world where cryptographic infostructure is as universal as electricity or clean water. All the data we need is hallmarked, traceable and trustworthy thanks to authentication technologies.

An Unhealthy Obsession

I make this call with great respect for my friends and colleagues in the industry: we must end our obsession with identity. For thirty years, identity has dominated digital practice and discourse. We overcook the Peter Steiner gag that “On the Internet, nobody knows you’re a dog”. That was just a wry joke about dogs getting up to mischief, not an editorial commentary on digital trust. Until recently, when trying to "trust" anyone online, identity was all we had to go on. When faced with higher risk, we would seek higher trust and ask for more identity. We put the quantity of identity ahead of quality. We put identity first.

Bad Habits

Obsessed with identity, we developed terrible habits. Instead of verifying the particulars that really matter about people we deal with, we drag in circumstantial evidence — almost always extra identifying data — from unrelated contexts, such as CVVs and SSNs, much of which is then stolen and bought and sold and replayed by fraudsters. Consider Knowledge Based Authentication (KBA), which places a premium on “out of wallet” details that ought to be less likely to be known to criminals. But personal information is everywhere on the Internet and KBA backfires by motivating a black market for personal data.

Identification for digital risk management is like putting out fire with gasoline. We should do more to secure the specific facts and figures that each transaction really depends on.

Data as a Utility

Meanwhile, data has become the lifeblood of modern society. The World Bank last year in its world development report Data for better lives called for a “new social contract for data” to protect citizens against harm arising from the information and power asymmetries created by big tech. Data is now a resource almost as important as clean drinking water. Yet we access, accept, and recommend data on an ad hoc basis; outside certain professions and intelligence circles, data is handled without any standards for quality or provenance.

Regulatory Pressure

And so regulatory pressure is building, quite properly, on data flows and processing, and also on what customers know about data. There is more onus on transparency and accountability. There should be no more digital Wild West!

Digital Truth

Cynics say we are “post-truth” but as cyberspace grows in importance, surely our biggest challenge really is digital truth. From payment card fraud and online scams through to misinformation and AI-driven Deep Fakes, every one of these problems is fundamentally about poor-quality data. We can’t trust the evidence of our own eyes anymore. Are we really contemplating digital twins in a synthetic metaverse without first taking better care of fidelity?

Concerted multidimensional responses to the data quality problem are underway (not to mention some narrow legislated bans on Deep Fakes). For one, several major mastheads have teamed with Microsoft Research in the Coalition for Content Provenance and Authenticity (C2PA). The group’s first draft standard draws heavily on technical measures familiar to the identerati, such as digital signatures and certificates.

And the new Verified Information Exchange (VIE) is an interdisciplinary research program hosted by UW with a work program focused on network or scheme-based business models for data supply. According to the VIA, “The global information environment is a form of 'market' that needs exchange protocols and local standards”

Another new effort, the Global Assured Interoperability Network (GAIN) was prominent at Identiverse 2022. It means different things to different stakeholders; even the ‘I’ in G.A.I.N. since the initial publication has been reframed to interoperability. One of the best features of the concept is the Service Provider: a fourth party in the data flow, intermediating the familiar End User, Issuer and Relying Party, to enhance scalability.

Infostructure

The payment card processing networks exist purely so that certain customer data — account numbers and some metadata — can be reliably presented to merchants and verified. GAIN represents an extension of the four-party model for presenting and verifying data more generally.

Card schemes are a paragon of infostructure: An organizational structure used for the collection and distribution of information (usually hardware, networks, applications, etc.) used by a society, business, or other group (Ref: Oxford English Dictionary). That is, verifiable data sharing will be underpinned by rules, technologies, and business models.

Data Means Business

We know data is big business — good and bad — and that information is being organized into value and supply chains. We are still in the very early stages of digital transformation. As cyberspace becomes civilized, we need data business to be more orderly and transparent.

If there is any truth in the comparison of data and crude oil, then let’s think in terms of assaying data. That is, let’s start to measure the properties of data that make it reliable, fit for purpose, and valuable. And then let’s bind the assays to the data records as they move through the information value chains. I envision a world with widespread cryptographic infostructure, so that verifiable data is available everywhere, just like stable electricity and clean drinking water. We have the tools to build such infostructure. We IDpros know we have these tools because we have already built them!

The Post-Identity World

So let’s shift focus from the abstract to the concrete. Notice that I haven’t used the word “identity” since the start of this piece. The idea of identity is simply not helping. I know that it strikes some as a sterile perspective but what we think in the digital identity echo chamber doesn’t matter because the tools developed by our industry have shown the rest of the world how to design for verifiable facts and protect them cryptographically. We can trust without identifying. We are familiar with “zero trust” - let’s try zero identity!

We can break old habits. Instead of starting with identity, let’s ask:

• What do you really need to know?
• Where will you get the data?
• How will you know if it’s true?  

It is perfect timing for a paradigm shift. We have intelligent devices at the edge, we have mobile digital wallets that make ideal verifiable containers for data, and we have clouds full of APIs for signing data. We can do better with digital identity; indeed, we can do something much bigger and better for all of cyberspace. Let’s apply our proven tools to build an infostructure that delivers data as a true utility.