Blockchain and Digital Identity for Refugees

Interview with Johannes Ebert (Gravity)

Blockchain and Digital Identity - Unknown Artist

There are 1 billion people in the world today without an identity, many of whom are refugees.

Even if they have food and shelter. How on earth do these billion people get an education, a job or even access to finance? Equally, how can organizations and businesses look after them when they know nothing about them?

Working with refugees in Kenya, the organization Gravity is helping individuals to take control of their identities, creating mobile data-wallets for people's phones where they can log, store and share personal data whenever they apply for education, for health care or even for a SIM card. Because it's on the blockchain, the data can't be tampered with, but Gravity has also gone to huge lengths to make sure that the people entering the data can be trusted as much as the technology itself.

The result: refugees who can create and manage their own identities as a first step towards taking back their place in society.

It's a real pleasure to have Johannes here from Gravity to explain how this works.

Johannes, maybe we can start by describing the problem as you as you saw it when you started Gravity?

First of all, thanks for having me. It's true that the digital identity problem has gained a lot of traction. There are figures out there estimating that there are 1.7 billion unbanked globally and 1 billion people without an identity: with budgets for refugees decreasing every year. But in Kenya for example, the number of refugees who depend 100% on aid is actually not decreasing. So self-reliance, and dignity of choice are super high on the agenda.

There's also lots of confusion I think. On one hand, there is the legal identity part: lots of people don't have a legal identity and that is an issue that governments eventually have to resolve. The technology is not the limiting factor here.

But then there's the wider sense of identity: what can I prove about myself that goes beyond just my date of birth and my name? And that is where digital identity and systems that help to aggregate trusted credentials can have a big impact.

Take a refugee kid, for example. If a refugee arrives in a camp, obviously they are very much unknown, especially in East Africa. They don't even have an ID credential. So they will be registered by the UNHCR, who take a biometric and then add some attributes that the individual basically self-claims (like my name is this and this is my child and I am this age). And then it's basically the government's responsibility to issue legal identities for these people so that they can access services where official government issued identity are required - like financial and telecommunication services, etc. But many governments are quite slow with that, so refugees who are there for years still might not have a legal identity.

So an economy develops informally - and that makes it very difficult because very little is known then about this huge population of more than a hundred thousand people. What is known is not very reliable (it's basically self claimed data from the beginning) and so it's hard for private businesses, aid organizations or even governments to provide their services. If people don't have identities from the government and are therefore able to access the traditional economy, they get stuck with the alternative - namely the grey economy within camps. And some of these seem to work quite well actually, these informal systems: Kakuma camp (in Kenya) is a whole micro-economy in itself. There has been a World Bank report that was released to draw attention to the topic, but of course it would be much better to integrate them into the formal economy: to take them from "I get my credit from my savings group" to "I get business credit from a bank - or a digital lender - to scale up my business".

And that's what keeps 400 million people unbanked. Presumably that's what Gravity is for, right?

Yes. That's what Gravity is for: What do these stakeholders (businesses, aid organizations, governments, etc.) need to know in order to serve their products or to employ these people? And what, on the other hand, do refugees need to prove to be economically included. Do they save? How much do they save? Do they own a business? What services do they use? Do they go to school? What are their skills? If I'm a private business, I want to know what skills there are in a refugee camp. And all these things are unknown.

Gravity is about empowering individuals by providing them a means to aggregate credentials about their identity and their personal data.

All the things that I mention (which stakeholders need to know) are often already somewhere: but either they are not yet digital (for example NGOs train lots of refugees and skills are created; but the skill-creation and the credentials are not digitized and they are not handed over to the refugee) or maybe they are in a UNHCR database somewhere. But our vision is to give each individual a digital wallet where they can pick from all these different sources - and even where their neighbors or their community-leaders can make statements and issue credentials to their wallet - and hence give these people a chance to build a rich economic profile that can then be accessed by all kinds of other servers.

So essentially, if a refugee is relying on a number of providers (for example healthcare, education, banking services, etc.) Gravity exists to be able to strengthen the bridge between the refugee and those institutions.

It's kind of like the inter-operable layer between all these services, but instead of building a centralized database, that point of aggregation is the individual's wallet. So effectively the individual takes control of their data: building it and getting it validated such that it becomes useful.

transcript heading_the big picture.jpg
transcript heading_the solution.jpg

The major question then is how do you go about doing this? What does the actual platform looked like that facilitates that bridge?

There is the wallet platform: where individuals can create a wallet that can be securely stored in the cloud. They then access it with a basic phone and do basic operations; or as they access it as a smartphone app, in which case data can be stored exclusively on the smartphone.

We've built an education product for example: where it is easy for an NGO or even a university set up defined credentials in minutes and then they are able to start issuing digital credentials. Education is an important important thing, especially for refugees, and so having trusted education credentials that are reconciled on their wallet with, perhaps, their UNHCR ID is important. If they want to apply for a scholarship (which is a 'high-impact identity transaction') if you can't do that because there's a data mismatch then your life takes on a completely different trajectory.

And then it's also a way to get standardized education data: because credentials and achievements can be stored on these wallets and then accessed from the outside.

So you have your kind of central pool of data and then you have an education app (for example) or there might be a healthcare app - and there might be other ones that are all tailored to the specific ecosystem of that industry. Is that right?

That's right. Savings groups can digitize their business, for example. The members of a savings group can look at their accounts on a simple interface and then have a better bookkeeping. That would be a product that we would sell and that then feeds into the wallet.

The fundamental question here then is trust. It's one thing to publish a lot of information on Linkedin or Facebook - and all those things have a lot of information - but the trust element is the make or break here I assume, right?

Yes. Trust in terms of the users. Trust in how the data is stored and that they actually have full agency over their data. And then trust in that the receiving parties trust these credentials, based on being able to prove that they come from a certain entity.

And where does blockchain come into that?

Blockchain itself serves as the registry. No data is stored on the blockchain. But if a transaction is made, such as you making a statement about me doing this podcast, then this would be issued to my wallet as a credential and then the hash of this transaction or of this statement would be stored on the blockchain. And then it's essentially a registry. Someone else can look up "hey, did this transaction actually happen?" and people could verify that you actually issued that credential.

If I am an employer and someone applies for a job and they've sent their university certificate, there are very few places where you can go today (like a “”) to check whether this person actually graduated from university. A centralized registry would be already quite useful - but the benefit that comes with blockchain is that it is also tamper proof. So I know that once I put something on the registry, your proof of transaction, it cannot be changed. And that is the big benefit.

And the other benefit is that it is decentralised: so no one entity needs to host that registry and no one entity can have data agency over that registry.

So it's essentially it's tamperproof but also there's no single institution that needs to vouch for the authenticity of the data. It's essentially self-evident because it's all the transactions are all recorded transparently on the blockchain.

Yes, exactly. So basically if I write a statement on the blockchain now, then I won't be able to change it later.

The thing is that I could still make up something and write it and it could be wrong: and that is something that blockchain cannot provide. In that case, it can only provide it if the check of the actual data is part of the protocol - and for that we have to add another layer. And our other layer is that those same attributes can be validated by different entities around you. These entities have different trust values (so it's not the same if your cousin says you're 19 years old versus if it's your community leader or if it's an entity that is an official trust entity listed by the UNHCR in their trust scheme. To every identity attribute, we can attach a level of trust.

Presumably then, pre-Gravity, you've got a refugee who wants to go into higher education and ultimately is scrambling around to be able to demonstrate their academic credentials. But with Gravity, they have an identity validated by trusted people (the UNHCR or a village elder) and they can share the right data attributes with the university for example, in order to be able to pass straight into the kind of traditional economy that we're talking about at the beginning.

Yes, in the very specific of applying for university education, with Gravity you have your diploma from Your Secondary School Institution and for simplicity, assume they've issued it digitally on your wallet. Then you can request the UNHCR to validate that credential - or another trusted entity that has been endorsed by UNHCR. So this gives a digital attestation for this document. And then using their own database, the UNHCR may submit a couple of basic identity attributes about you (your name, etc.). With this collection of credentials that is certified and attested by these trust entities, you can then share it with a higher education institution.

And this is actually something that the UNHCR are looking into building. They are aware that digital wallets are the way to go in order to leverage what they already collect in terms of identity data. They can’t just go ahead and share the data with everyone: they have to go through the individual.

And that’s the polar opposite of what's being built out in certain countries where you have, in China or India for example, very centralized databases who ostensibly aim for the same objective but don't put the individual in control of the data.

That's true. That's the opposite of a decentralized wallet architecture: where of course it is very convenient to aggregate everything in one place because then every business or every bank can tap into it for their credit scoring or for their marketing, etc. It's just that the security cannot be provided. And of course, the entity that controls this huge database that records every aspect of your life can do very powerful and very frightening things.

transcript heading_blockchain.jpg
transcript heading_where are we now.jpg

Presumably also the availability and the standardization of this data must also help health aid organizations, governments and others to provide services back into the refugee community through of more transparency and more intelligent or structured information. Is that right?

Yeah, of course. If you contribute and others contribute to a person’s wallet then you get the benefits as an organization as well.  For example, if you are a healthcare organization, you contribute to a person’s health profile; then UNHCR adds ID attributes; and the community adds other ID attributes. If the organization then needs to make a cash transfer (to pregnant mothers or if there’s a disease) then you can use all ofthese attributes (which weren't necessarily provided by you) by requesting them from the wallet.

This is really the interoperability part: you don't need to aggregate everything in a centralized database for millions of people if you have a layer where it can be aggregated for each individual.

What's the journey been like so far? What are the kind of the unexpected surprises, particularly in terms of the technology and applying it to the real world?

We looked a lot and KYC in the beginning: how can we provide alternative KYC based on identity data that is validated through community, etc.? But really there is a legal block here: some businesses simply are required or want to have the level of assurance that a legal identity brings. So we moved away from that and widened the definition of identity to include all kinds of attributes around what businesses-people have: if they employ someone or what kind of skills they have.

And then we spent some time in the Kakuma camp where we have a partner who works in education.

We decided to go for more like a product driven approach, prove the concept: that people can aggregate data, can store digital credentials from different sources and get a very broad economic profile for a restricted user base.

So we used education as an entry point (working with youth development NGO’s etc.) and then proved that this is useful for organizations - in particular cash transfer programs that always have lists of attributes that have to be verified for an individual to be eligible.

And that's what we're doing now. In Kakuma we’re just rolling out that education product - where we also have a component that collects standardized test data (because there's a lack of globally standardized education outcome data).

So you’re starting with the unregulated side of the world and making sure that people can get access to education and then you’ll move up into the purely regulated space as and when legally you're allowed to go there I guess?

Yes, exactly. And I think with this kind of data there’s already a lot that can be done.

You can bring money to those verified wallets, for example. If you think of a young university graduate who just wants to start a business, the party providing the financing or funding doesn't need to know the graduate in person because they can see and verify their credentials instead. That’s an interesting usage case where you don't need to get into the space of legal identities at all.

So it's like an avalanche almost: you start with identity for education let's say, but as you build out the identity around that, presumably it accumulates its own momentum - where two thirds of the identity for education could easily flow into healthcare or flow into credit worthiness or, or other areas. And so ultimately it takes on a little bit of a life of its own...

I hope so!

I think you have to make sure you find consumers for your data.

Insurance, for example. There is lots of potential for insurers to customize their plans to especially low income individuals, for example, and to make it more affordable and more accessible for them. But there needs to be a little bit of verifiable data knowledge.

So back to the individual, obviously there are benefits in gathering and validating this data (if I'm a refugee and I want to be able to get into university), but what reactions have you had from individuals? Because if somebody came to me and said, “we're going to take your data and I'm going to use the blockchain help store it - and it's going be wonderful..” Presumably it's not an easy sell is it?

What doesn't work is to try to tell them the story of the digital identity wallet. It has to be the product as well. So in the education case it could be just an SMS interaction to see the credentials you have and to provide consent to sharing them. That works quite well.

In that journey towards having a kind of complete rich dataset on as many people as possible, how do you see the question of interoperability between, for example, your data-set  and other data-sets in helping to fast track the benefits of this?

For example, if a hundred people are all going and the setting up their own form of an identity: whether they use blockchain or not you still end up with a hundred different isolated datasets and so all you end up doing is moving all one problem from old technology to the same problem on new technology. So it sparkles with it more, but ultimately it's still the same problem.

That's like blockchain protocols.

Every business, every service, every organization creates an identity for a person. The question is how do you reconcile all of these identities? Even if you only had a wallet where the identifiers of each of these systems would be shared, that would already be a good start.

But don't think it's the main challenge: in the UNHCR case, just having someone take a picture of your paper certificate and then issue a blockchain attestation for it is enough.

And it doesn't need to be a standard. If you'd send your bankers a company registration certificate from a different country, that's also no standardization.

Yes, that's true. It's easy to over complicate this. Looking ahead then, scale is obviously one question, but how does the next 12 to 24 months play out for you in terms of how Gravity evolves?

We are focused on this rollout for refugees; we want to do way more in terms of user research (how people feel about this concept, about state of sharing, etc.); we will try to test P2P cash transfers; and health is a big point.

So I think we will focus on scaling the education bit whilst widening the scope in Kakuma:  and we want to look into health and cash transfers as well.

That’s great. In summary, if I understand it right, identity is essentially the stumbling block between camp life and traditional life. Pre-Gravity, we had refugees struggling to make the jump into the traditional economy and being trapped in the kind of the ‘camp-economy’. But through building the bridges between the NGO and the individual in the camp, those same refugees can now get access to services and goods that they just couldn't get access to before - and hence participate more in the economies of the countries where they find themselves.

That’s quite a journey. I really look forward to hearing about how the next 12 months play out. Really, thank you very much.

Thank you very much for having us.

I'm Barney Nelson and thanks for listening to this week's good start episode. Next week there'll be another amazing story about how blockchain is being used for good and so make sure to join us.

In the meantime, if you'd like to get involved, look us up on or on Linkedin or Facebook. Thanks and see you next week.