Study finds governance, not technology, is blocking digital ID interoperability

An academic study has delved into the interoperability paradox currently hampering some of the most technically mature digital identity systems around the world, finding that such failure is due to institutional governance problems, and not technical standards or compliance deficit issues.

Co-authored by Shah Mahmood and Carsten Maple of the University of Warwick and Mark Hooper of the Alan Turing Institute, the study looked into the digital ID systems of Brazil, Nigeria and the Philippines, which are among the largest in the world. Mahmood and Maple shared their perspectives in a recent workshop organized by the Cyber Threat Observatory at the Turing Institute on the need to strengthen digital ID defense systems.

Their analysis found that while these of these digital ID systems followed divergent institutional trajectories, they all converged on the same structural failures in terms of establishing effective cross-border interoperability.

The researchers said they used a diagnostic instrument called the Standards-Aligned Assessment Framework for Interoperable Identity (SAAFII), which confirmed their hypothesis of Strategic Identity Asymmetry (SIA), showing that the three countries suffered the same structural shortcomings at the governance and assurance layers.

SAAFII revealed that all three systems collapsed at Layer 2, which has to do with Governance, Accreditation and Oversight, and Layer 4, which touches on Assurance Levels, scoring a Maturity Level of ML2, even when other layers reached much higher maturity ratings of ML3 or ML4. The framework used a five-level maturity scale from ML1 (lowest) to ML5 (highest).

The governance gaps have tangible consequences. In Nigeria, inconsistent assurance frameworks contribute to financial exclusion tied to NIN-based KYC. In Brazil, hardware-dependent PKI limits access outside major urban centers. In the Philippines, weak credential portability creates friction for overseas workers relying on digital identities across borders.

To fix the problem, the research points out the need to prioritize assurance early enough and make it a prerequisite rather than a follow-up to credential issuance.

It also calls for a rethink of the evaluation of maturity indices such that evaluators must be able to separate governance and assurance from technical deployment; a rebalancing of funding which should shift from capital expenditure on visible infrastructure toward recurrent governance expenditure for auditor training and regulatory staffing; and the building of supranational governance layers by regional integration bodies like AfCFTA or Mercosur with binding definitions before attempting mutual recognition of credentials. This last point mirrors the role that eIDAS played for Europe.

The question of DPI cross-border interoperability has become increasingly critical given the growing push by countries to advance their digital economies. Sierra Leone’s Digital Economy Minister, Monorma Bah, shared her thoughts on this in May when she emphasized the need for countries to shift from solo national efforts to all-out regional engagements.

In Europe, interoperability assessment for cross-border digital services has been mandatory since last year, as one of the obligations outlined in the Interoperable Europe Act.

Article Topics

biometrics  |  Brazil  |  digital ID  |  interoperability  |  Nigeria  |  Philippines  |  trust framework  |  Turing Institute. Cyber Threat Observatory