Latitude Financial hack, other data breach disasters spawn local tech security solutions

Dr Claire Barber at MATTR. Photo / MATTR

OPINION:

Following last week’s column about Latitude and sundry other technology-induced data breaches it is good to report back that there are not only solutions being worked on to prevent potentially devastating information leaks, but they’re being developed by local companies.

Grant de Leeuw from Data Masque pointed out that the International Organisation for Standardisation’s ISO27001 has been updated to use data masking (which de Leeuw’s company provides).

That standard sets out requirements for information security management to increase trust in digital technologies. By obfuscating data, it becomes useless to hackers who manage to steal it, yet remains usable to the organisations it belongs to.

Unfortunately, data masking doesn’t appear to be used much in New Zealand, ISO27001 requirements notwithstanding.

“Almost all of NZ’s corporate businesses would not meet the new ISO standard,” de Leeuw points out. If so, to say that this is potentially very problematic would be a total understatement.

Then there’s Spark-backed MATTR which is known in New Zealand as the technology provider for the government’s Covid-19 vaccine pass, and the Verifier app that is used to check that you’ve had your shot.

MATTR is making a name for itself with its digital ID and verifiable credentials tech around the world currently.

So much so that the government of New South Wales has now picked MATTR as its technology partner for the digital identity and credentials programme which has been under way since 2021.

This is a very high-profile programme that other Australian states are collaborating on as well, and quite the win for MATTR.

The digital trust company will provide its MATTR VII set of application programming interfaces (APIs) through which issuers can generate credentials, verify and manage them, add capabilities and even provide secure messaging.

The NSW government will also get the MATTR Pi toolkit to build apps with, and everything is interoperable and standards-based, as is a must nowadays.

Another recent example of what the tech is capable of is from Canada, where MATTR has been involved in the MyCreds Virtual Skills Passport pilot project.

This is with 10 colleges in Ontario and coordinated by the Association of Registrars of the Universities and Colleges of Canada.

MyCreds is a digital wallet developed by MATTR that students and graduates can use to view and share official transcripts, credentials and academic documents. It’s been expanded to allow learners to download “micro-credentials” to their wallets, to show proof of completion of studies that can be shared with, for example, prospective employers.

MATTR’s tech, even though it’s decentralised by nature, has nothing to do with blockchain, something the company is keen to emphasise.

Generally speaking, the idea is to have a decentralised system that allows you to prove who you are, and things about yourself, while remaining in control of the information given out.

MATTR chief executive Dr Claire Barber gave as an example how in real life people carry credentials like library cards and student IDs, in paper or digital format, with them. That’s the decentralised part with localised credentials verified by issuers like a library or uni, but doing it digitally allows for so much more flexibility and as it happens, better privacy protection.

All the flexibility and options available for the technologies that MATTR provide can, ironically enough, make their solutions seem complex and confusing.

Nothing beats hands-on experience, and MATTR has set up the entirely fictional Kingdom of Kākāpo to demonstrate what they can do. Get the MATTR digital wallet from Apple’s App Store or Google Play and head over to kakapo.mattr.global to try it out.

Even for non-technical users, the Kākāpo demo is pretty slick. It does require a smartphone though, and being familiar with concepts like QR codes and digital wallets but that seems a fairly low tech knowledge threshold for most users.

Barber pointed out that issuers can configure the digital IDs and credentials how they like, but in the NSW government’s case, the onus is that individuals should have the power and authority to decide what information they give out.

She explained it as: “what we’ve never really had before is flexible tools that give us the ability to share data without oversharing.”

While organisations should genuinely adopt data minimisation strategies, Barber added that “increasingly over the last decade and longer, we’ve seen more and more requirements being placed on organisations for all sorts of different reasons to check and verify things.”

That is the seemingly intractable problem MATTR is working on solving with its tools, combining privacy and security with accurate verification of your details in a way that’s easy to understand and use.

Similar efforts are taking place in Europe and other parts of the world, and it could mean that all we’ll need in the future for just about everything is a smartphone. Which many of us will grizzle about for various reasons, but that’s for another day.