Pan-Canadian Trust Framework Version 1.1 — Thematic Issues Going Forward
Disclaimer: This is posted by me and does not represent the position of my employer or the working groups of which I am a member.
The Public Sector Profile of the Pan-Canadian Trust Framework Version 1.1 is now available on GitHub. This document reflects the collective effort of almost a year since we last posted Version 1.0 in July 2019. Since then, the public sector (federal, provincial, territorial, and municipal) have met on almost a weekly basis with 20–28 participants on each call. The result is a truly Pan-Canadian perspective.
For this post, I won’t focus on what is in the latest version(please read!). Rather, I want to list the thematic issues we have identified as a group which we need to work on together to resolve. While Version 1.1 represents a huge milestone, there is still much exciting work ahead, which we have captured in the 11 thematic issues below.
Thematic Issue 1: Digital Relationships
We need to work on expanding our modeling and discussion of digital relationships — currently, there is not much more than a definition.
Thematic Issue 2: The Evolving State of Credentials
We now find ourselves in the middle of some very interesting developments in the areas of digital credentials. There is a sea-change happening in the industry where there is a movement from ‘information-sharing’ to ‘presenting digital proofs’. There is good work on standards (W3C) relating to verifiable credentials and decentralized identifiers.
Due to these new developments, we are now seeing the possibility that the traditional intermediated services (such as centralized/federated login providers) may disappear due to new technological advancements. This may not happen in the near future, but we are currently adjusting the PCTF model to incorporate the broader notion of a verifiable credential and are generalizing it to allow physical credentials (e.g., birth certificates, driver’s licenses) to evolve digitally within the model.
We are not sure that we have the model completely right (yet), but nonetheless Canada seems to be moving into the lead in understanding the implications of applying these technologies at ecosystem-scale (both public and private). As such, we are getting inquiries about how the PCTF might facilitate the migration to digital ecosystems and to new standards-based digital credentials, open-standards verification systems, and international interoperability.
Thematic Issue 3: Informed Consent
Informed consent is an evolving area and we don’t think the PCTF currently captures all the issues and nuances surrounding this topic especially in relation to the public sector. We have incorporated material from the DIACC and we have adjusted this material for public sector considerations, but we feel that much more work needs to be done. In the meantime, we feel that we have enough clarity in the PCTF to proceed with assessments — but we are ready to make changes if necessary.
Thematic Issue 4: Scope of the PCTF
Some have suggested that the scope of the PCTF should be broadened to include academic qualifications, professional designations, etc. We are currently experimenting with pilots in these areas with other countries. We have anticipated extensibility through the generalization of the PCTF model and the potential addition of new atomic processes. Keep in mind, however, that digital identity is a very specific but hugely important use case that we need to get right first. We are not yet ready to entertain a broadened scope for the PCTF into other areas, but soon we will.
Thematic Issue 5: Additional Detail
Many questions have been asked about the current version of this document in regard to the specific application of the PCTF. While we have a good idea, we still don’t have all of the answers. Much of this detail will be derived from the actual application of the PCTF (as was done with Alberta and British Columbia). The PCTF will be supplemented with detailed guidance in a separate document.
Thematic Issue 6: Unregistered Organizations
Currently, the scope of PCTF includes “all organizations registered in Canada (including inactive organizations) for which an identity has been established in Canada”. There are also many kinds of unregistered organizations operating in Canada such as sole proprietorships, trade unions, co-ops, NGOs, unregistered charities, and trusts. An analysis of these unregistered organizations in relation to the PCTF needs to be undertaken.
Thematic Issue 7: Assessing Outsourced Atomic Processes
Section 2.4.3 states that:
by design, the PCTF does not assume that a single provider is solely responsible for all of the atomic processes. Therefore, several bodies might be involved in the PCTF assessment process, focusing on different atomic processes, or different aspects (e.g., security, privacy, service delivery). Consideration must be given as to how to coordinate several bodies that might need to work together to yield an overall PCTF assessment. The organization being assessed is accountable for all parties within the scope of the assessment. The organization may decide that this is not feasible, nonetheless, the organization remains accountable. Such cases will be noted in the assessment.
The Issuer in this model is the authority ultimately accountable. Although an Issuer may choose to outsource or delegate the responsibility of the Credential Issuance atomic process to another body, the accountability remains with the Issuer.
We need to determine how multi-actor assessments will be conducted. It has been suggested that the organization being assessed should have the authority to speak to how well other organizations perform atomic processes on its behalf.
Thematic Issue 8: The Identity Continuity Atomic Process
The Identity Continuity atomic process is defined as:
the process of dynamically confirming that the Subject has a continuous existence over time (i.e., “genuine presence”). This process can be used to ensure that there is no malicious or fraudulent activity (past or present) and to address identity spoofing concerns.
It has been noted that there are privacy concerns with the notion of “dynamically confirming” the continuous existence of a Subject over time. We need to come up with a more precise and privacy-respecting definition of the Identity Continuity atomic process.
Thematic Issue 9: Signature
Appendix A defines signature as:
an electronic representation where at a minimum: the person signing the data can be associated with the electronic representation, it is clear that the person intended to sign, the reason or purpose for signing is conveyed, and the data integrity of the signed transaction is maintained, including the original.
We need to explore how the concept of signature is to be applied in the context of the PCTF.
Thematic Issue 10: Foundation Name, Primary Name, Legal Name
Appendix A has definitions for Foundation Name, Primary Name, and Legal Name.
The three terms more or less mean the same thing. We need to pick the preferred term and be consistent in its usage.
Thematic Issue 11: Review of the Appendices
At some point, we should undertake a full review of the current appendices.
For each appendix, we need to evaluate its utility, applicability, and appropriateness, and determine if it should continue to be included in the PCTF document. Some appendices will remain; some may be moved to a guidelines document; while others might be discarded outright. Some of the appendices that remain may need to be amended.
In closing, we remain on a journey of defining trust in a new way — not only for each institution or program but for the digital ecosystem as a whole. We are looking for ways to further broaden this perspective and I will keep you posted on new developments.
