By Craig Guthrie, deputy editorRealising that mobile devices could become a secure platform to deliver services with the convenience that today's citizens expect, governments are increasingly turning to mobile identity solutions.Led by trailblazing nations such as Estonia, these countries plan to make services ranging from taxation to licensing – and much more – available on smartphones and tablets.However, the opening of new domains also creates new threats and challenges – for instance, can governments alone control the secure delivery and manipulation of very personal data?GSMA, the organisation which represents the interests of mobile operators worldwide, is developing a "Mobile Connect" initiative which links authentication to devices.Security Document World talked to Marie Austenaa, head of Personal Data at the GSMA, about these issues and other aspects of the manner in which direction mobile ID is headed.Can you explain how Mobile Connect will become an important part of mobile identity?The proliferation of smartphones and connected devices has led to a massive increase in the number of digital services available to consumers, accessible from any location and device. However, this has also created new threats to the security of our data. People need a trusted way to navigate this new mobile landscape and protect their mobile identity – simply, safely, and securely.The GSMA has been working with operators and service providers to provide such a solution. Mobile Connect provides a convenient and secure universal log-in solution, which allows users to authorise their identity using a mobile phone. As Mobile Connect is based on the mobile operators' network, it provides optimum security and convenience for users. So the user can authenticate their mobile identity easily and securely, without having to remember dozens of passwords, while the service provider on the other end can also be assured that the authentication is based on trusted data and a real user.Do you expect governments to leverage the infrastructure of mobile networks in offering mobile ID linked to services?With budgets under constant pressure, governments have long been looking for ways to digitise their services. By allowing citizens to "self-serve", digital interactions can be up to 20 times cheaper than serving citizens face-to-face, while also helping to simplify existing processes for a more efficient service overall. It's unsurprising that mobile identity services could play a key role in the adoption and use of e-government services.Services like Mobile Connect offer mobile operator-facilitated authentication services, using the user's unique mobile number to provide simple and secure access to online services. This kind of service is capable of bringing the whole mobile population to these services. Providing a consistent experience across operators is vital, as it means all citizens, no matter where they're located or which mobile operator network they're subscribed to, will be able to access government services. The security and convenience of using mobile ID can drive trust and confidence in the adoption and use of e-government services.What are the flaws in the current identity solutions that consumers/citizens are using today?Mobile Connect was developed to address the growing problems that users face in their current identity solutions – particularly having to manage multiple passwords. Passwords are a prime target for cybercriminals, and once stolen can be used to access users' digital services. By using the mobile phone for authentication, a user's account cannot be accessed unless the attacker also has possession and control of the user's mobile phone. Moreover, unlike some digital identity solutions that are offered for online consumer services today, Mobile Connect will not share information about the user to other digital service providers – unless the user specifically requests to do so. Mobile Connect cannot change the kind of data the service providers request, but by letting the consumer know exactly what data is being shared, consumers are empowered to make an informed decision themselves. In this way, Mobile Connect gives control back to the user over how, where, and when their data is used.Why has GSMA been a keen supporter of Europe's Electronic identification and trust services efforts?The eIDAS regulation will have considerable impact in bringing electronic identification and trust services to the European Union. By providing a workable legal framework for using these services across borders, the new regulation will help boost economic growth by allowing customers and businesses safe access to services and secure transactions across the region.Under this regulation citizens will benefit from online services such as submitting tax declarations, enrolling in a foreign university, or even setting up a business in another EU state. We have urged national governments to engage with initiatives like Mobile Connect to help ensure that the unique strengths of mobile authentication are made widely available. Supported by the eIDAS regulation, Mobile Connect can provide an interoperable service for users than is secure, easy, and applicable across a variety of services.Where would you see Mobile Connect in 10 years time, and do you expect us to still be using federated social networks to ID ourselves?We expect that Mobile Connect will expand in the next ten years, particularly in terms of markets where the service is available, more active users, and more places where the service can be used. We also expect to see more sophisticated services available to users. While Mobile Connect today focuses on secure and simple authentication, we are working on evolving this into authorising digital transactions, as well as the capability to share and/or confirm information about the user in order to increase consumers' trust in digital transactions.Social network logins are widespread, but they do not rely on real user identities, and put users' privacy at risk by sharing additional personal data. However, users value their privacy, security and convenience above all else. We expect that Mobile Connect will become a federated log-in solution and will be an alternative to social network IDs.Do you believe a future Mobile Connect could ever become a rival to traditional identity documents?Traditional identity documents will always exist, but the way we present our credentials will likely evolve to leverage mobile authentication services. Especially as more regulations like eIDAS come to fruition and governments begin to further digitise services.Ultimately, what will drive the adoption of digital identity services is consumer demand. Consumers want services that are secure, but they are not willing to compromise on convenience. We're already seeing the mobile industry cater to this consumer demand through quick, easy authorisation technology.Mobile authentication, which represents "something I am", could be easily combined with other mobile factors like "something I have", phone and SIM, and "somewhere I am", like location, to provide a more secure method of authentication without further effort from the consumer.
Interview: GSMA’s Marie Austenaa on the future of mobile identity
