RAW FILE

FIGI SECURITY CLINIC: SECURING THE INFRASTRUCTURE AND APPLICATIONS FOR DIGITAL FINANCIAL SERVICES ​

GENEVA, SWITZERLAND
9:30 AM CET
DECEMBER 4, 2019

Services Provided By:
Caption First, Inc.
P.O. Box 3066
Monument, CO 80132
1‑877‑825‑5234
+001‑719‑481‑9835
www.captionfirst.com 

***
This text, document or file is based on live transcription.   Communication Access Realtime Translation (CART), captioning, and/or live transcription are provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.  This text, document, or file is not to be distributed or used in any way that may violate copyright law. 
***

>> BILEL JAMOUSSI:  Good morning.  In order to hear, you might need to use the earpiece on the desk and touch the volume button.  Okay?  This is Jamie Zimmerman, senior program officer, Financial Services For the Poor, Bill & Melinda Gates Foundation.  
	Good morning, distinguished friends, colleagues.  Welcome to ITU.  Let me begin with a few words of introduction to ITU and its place in the world.  
	ITU is the United Nations' specialized agency for communication and information technology for ICT.  We coordinate the global allocation of radio frequency ranges and satellite orbits.  ITU standards are critical to the operation of today's telephone, optical, radio, and satellite networks.  And we also assist developing countries in the application of advanced ICTs.  
      ITU's global membership included 193 Member States and some 900 leading companies, universities, and international and regional organizations.  ITU is a unique platform.  Unique in the ICT standard world as the only body to include Governments.  All Governments.  And we are unique in the United Nations system as the only body to include the private sector and Academia.  
      ITU is unique ‑‑ in a unique position to bring the benefits of ICT innovation to all areas of the world.  Today we will discuss Digital Financial Services, but this discussion is emblematic of a larger trend.  We are living through a time of accelerating conversion.  Technologies are converging.  Industries are converging.  Our world has become highly interconnected.  ITU standardization work is now supporting digital transformation in areas ranging from energy and transportation to healthcare, agriculture, smart cities, and of course, financial services.  
      It is in this context that the ITU standardization platform, for many years, central to building trust within the ICT sector is now helping ICT sector build trust with its many new partners, from automotive to fintech to healthcare and many more.  
      Working together, thinking in a multidisciplinary way and playing to our complementary strengths, we can create very meaningful improvements in the quality of life enjoyed by billions of people worldwide.  This is exactly the thinking behind the strategy and structure of the financial inclusion global initiative known as FIGI.  FIGI is designed to advance research in digital finance and accelerate digital financial inclusion in developing countries.  
      It is the successor of an ITU focus group on Digital Financial Services and FIGI was not the only successor.  It also gave rise to another ITU focus group to investigate Central Bank issued digital currency.  Our focus group on Digital Financial Services was active from 2014 to 2017.  It was successful in building a clear picture of the digital finance ecosystem.  And this work came at exactly the right time. 
      We were seeing excellent country case studies emerging with developing countries leading the way in the use of digital channels to increase financial inclusion.  Innovators were finding their feet, developing the business case for digital financial inclusion and gaining an understanding of their ecosystem.  
      ICT and financial services companies were moving into new shared space.  Each sector was determining the competitive advantages that they could draw from their different expertise.  And this resulted in an associated conversion of the responsibilities of ICT regulators and central banks.  With different mandates and expertise, they had different perspectives on the opportunities and risks related to digital finance.  
      The ITU focus group was the world's first initiative to bring together all sectors working in the interest of financial inclusion.  FIGI has maintained this momentum, diversity in the defining ‑‑ diversity is the defining feature of the FIGI community.  FIGI's reason for being can be described succinctly.  Estimated 1.7 billion adults are still without a bank account.  But among them, 1.1 billion have a mobile phone.  FIGI establishes financial inclusion principles of common relevance to all countries.  But it also encourages us to learn from experience.  Only by sharing experience will we clarify the practical implications of adherence to these principles and how these implications difference from country to country.  FIGI consists of two complementary work streams, operational work stream and a knowledge work stream.  FIGI's operational work stream provides technical assistance to developing countries, in their efforts to create policy environments able to stimulate financial inclusion.  
      FIGI's knowledge is led by three Working Groups looking at three dimensions of financial inclusion.  These groups are studying how we might create incentive for electronic payment to become the norm for very low‑value transactions.  They're researching the potential of digital ID systems to grant citizens access to formal systems of all kinds and proposing security mechanisms to give users the confidence to trust that their money is safe.  
	The FIGI security clinic is organized by FIGI's Working Group on Security, Infrastructure, and Trust this Working Group is led by ITU.  The group has investigated fintech security challenges ranging from SS7 and new SSD vulnerabilities to customer authentication, security of blockchain and distributed ledger technology and the impact of big data analytics and artificial intelligence on data privacy and consumer protection. 
      Today we will enjoy presentations and tutorials sharing FIGI guidance on the topics including migration of security vulnerabilities in communication protocols, digital identity and strong authentication and security assurance frameworks to increase security across the value chain.  
	Tomorrow, we will take deep dives into the implementation of decentralized identity, tracking digital Ponzi schemes, FIDU authentication, application security, and a last‑minute addition to the program, the application of homomorphic encryption in digital finance.  That is 2:00 p.m. tomorrow afternoon. 
      I would like to thank all of our speakers and moderators for their contribution to this clinic.  I would also like to thank you for your dedication to the work of FIGI, your support is highly appreciated.  
      Ladies and gentlemen, today, we see great optimism surrounding the ability of digital channels to expand financial inclusion.  The FIGI community has been instrumental in providing this basis of optimism.  FIGI has a strong understanding of the components of the digital finance ecosystem and where innovation can drive growth and innovation.  The inclusive partnership is a model of collaboration that the ITU is pleased to support.  
      ITU is assisting the ICT sector in building a coordinated contribution to the pursuit of the United Nations Sustainable Development goals or SDGs.  Digital financial inclusion is key to this pursuit.  In FIGI we see what is fundamental to the achievement of the SDGs.  We can all be proud to be part of this important work. 
      Beyond this week's clinic, our next major milestone will be the FIGI symposium 2020, which is planned to be in Latin America in June, 2020, as well as our World Telecommunication Standardization Assembly, which will be in India in November, 2020.  
      On behalf of ITU, let me conclude by thanking our FIGI partners, the World Bank Group and Committee on payments and market infrastructure, CPMI of the bank for international settlements, and of course the Bill & Melinda Gates Foundation for its leadership, financial support and trust in the FIGI partnership.  This partnership has undoubtedly proven its worth, and we look forward to many more years of productive collaboration.  Thank you, and I wish you most informative clinic.  Thank you.  
(Applause)

>> JAMIE ZIMMERMAN: Thank you, Bilel.  Thank you for the warm welcome and the overview of ITU, the predecessor groups and today's agenda.  It makes my job easier, a lot less now than I had planned.  That is wonderful.  We can move on to the program.  Good morning, everybody.  Welcome to the ITU and sunny, warm Geneva.  That is a joke.  
      And the FIGI security infrastructure and trust Working Group security clinics.  I wanted to say a few thank yous and tell you more about the foundation and why we are supporting FIGI and these Working Groups and the work coming out of them. 
      My first thank you of course is to the ITU to Bilel and Vijay and the team for hosting us this week.  And for leading the security infrastructure and trust Working Group.  And now for giving me a reason to Google homomorphic encryption as soon as I get off the panel, to the other FIGI partners here, World Bank and Committee for payments and market infrastructure.  The bank for international settlements, thank you for your partnership and participation in this event.  For the BIS to sharing the global financial regulators, perspective and World Bank for bringing their methods, tools, best practices on both Cybersecurity and digital id to this time and discussions this week.  Last but not least, the participants and speakers here.  The technologists, practitioner that are here and doing the work to ensure people are using safe and secure products on safe and secure platforms. 
      You are, in many ways, closest to the people this initiative is working to include.  And your putting into practice the technologies to build confidence and trust in the products people are reaching to protect financial lives and improve well‑being.  Quick note at the foundation.  At Bill & Melinda Gates Foundation we're committed to rapidly expanding access to high quality financial services to the poor.  We know including people in a safe financial system can lead to prosperity to families and economies worldwide.  We're working on this in multiple fronts, investing in payment systems, digital ID infrastructure.  Advocating for what we call the level 1 principles to get more pricing and security and system design and building on the aspects of financial collusion, framework developed by partners, CPMI and World Bank.  We support frameworks at the national and international level to cultivate public and private participation that includes inclusive, safe, reliable DFS markets and services provision. 
      The work we take on this week to guarantee safety for consumers and institutions drives a system to ensure integrity transactions, building the trust and confidence needed to enable access and to usage of accounts that can transform people's lives.  The initiative was established in 2017, following the successful DFS focus groups Bilel mentioned and partnership between ITU World Bank and CPMI.  FIGI was formed for many reasons.  One of them was to tuft a new model for global and local collaboration across ICT and financial sectors.  To accelerate financial inclusion. 
      The collaboration is happening not only across the three major institutions but also collaboration within them, and with other stakeholders and partners, globally and locally.  There is collaboration in testing, piloting advising, and deploying at the ground level the recommendations and tools that are being developed in Working Groups like the one that we are going to be hearing from for the next couple of days.  Multisector collaboration within and across all the Working Groups, and within and across all the oceans and within the symposia part of the initiative.  It is a complex and challenging web we're weaving with FIGI, but so too are the issues we're tackling with a community. 
      The web is being spun because of and in response to the convergence that Bilel mentioned.  It is an incredible rapid convergence of sectors, of industries and of infrastructure.  So this web of FIGI, of which you are now entangled is one poised to help us achieve the enormous possibilities of fintech.  The work you're doing as part of the Working Groups, partner country implement teams and speakers at convenings like these and global symposium, will influence the policies and practices to shape the digital transformations of economies. 
      I am grateful the FIGI team and all of you remain committed and up for the task ahead of us in it helping build infrastructures that are safe, reliable, robust and of course inclusive.  Which brings us to this week's events. 
      Security is a pressing priority for the digital financial inclusion field.  And the policies and practices that shape it.  As services get more digital, we find ourselves confronted with new types of threats and the implications for all vulnerabilities grow more heightened.  The challenges and risks are wide ranging and span the existing and emerging core systems and infrastructures used for fintech and digital ID to the applications, products, services layered on them.  We are seeing progress on many fronts, with the work being done by the FIGI Working Group, taking up SS7 infrastructure vulnerabilities with major strides made to ensure quality of service for new types of services, and we'll look forward to tomorrow's session where we hear about the ITU quality of service KPI and work happening with authorities in Ghana that piloted this methodology. 
      We are seeing work of other standard setting bodies, complementing the security protocols and best practices standardized here at the ITU.  Such as work being done with the World Bank and the practice of authentication we will hear about this week .
      It is incredible to see such forward momentum, and authorities are coming together to make the multiprong practices.  And the imperative is to move farther and faster.  The security clinics are intended to do just that.  A forum for deep exchange, to roll up our sleeves, put our heads together, ask each other tough questions and challenge ourselves to make sure consumers and risks are mitigated so financial inclusion can thrive. 
      In closing, I thank ITU and all of you.  ITU for leading in the space and bringing together a diverse group of participants.  I hope we leave, at the end of the day tomorrow, with new practical knowledge that informs our daily work, and this is the beginning of deeper sharing within our institutions, departments, and among colleagues.  Thank you very much, I hope you enjoy the proceedings over the next two days.  
(Applause)
>> BILEL JAMOUSSI: Thank you very much, Jamie.  Perhaps before passing the floor to Vijay, I would like to recognize our two hosts of the previous FIGI symposia.  The first Mr. Sharma, the Chairman of the regulatory authority of telecom in India.  As well as Mr. Syed.  The host of our second FIGI symposium.  As I mentioned in the introduction today, the third and final FIGI symposium will be June, 2020 in Latin America.  We will announce the country and exact dates in due course.  Thank you.  
      Vijay.  
>> VIJAY MAUREE: So ladies and gentlemen, so my presentation will focus on an overview of the security infrastructure and trust Working Group.  I think since we have quite a number of new participants to FIGI vents, it is good to give a brief overview of the Security, Infrastructure and Trust Working Group to get everybody on the same page before we move into the various sessions presenting the reports of the Security, Infrastructure and Trust Working Group.  
      So first of all, why do we need to address security issues?  What are the security issues that we are really addressing in the security Security, Infrastructure and Trust Working Group?  
      Don't pay too much attention on the arrows, but the message I want to convey here is the DFS ecosystem is a complex ecosystem.  And there is a lot of interconnectedness among different parties for service delivery.  
      So that means security is not just one organization's problem, it is actually the ecosystem's problem.  It needs to be managed efficiently.  Because you are only as secure as the weakest link in the chain.  So as you can see on the diagram, in the ecosystem, we have banks, we have financial services, organization, mobile network operators, fintech companies, there are agents in some countries, some merchants, manufacturers, DFS users.  We shouldn't forget the DFS user.  They're an important element in the ecosystem.  
      There is also a lot of payment service providers nowadays and you have ICT service providers providing backups and other equipment to all of these entities in the chain.  
      So what we look at ‑‑ we cannot look at also in the Working Group all the elements, in the ecosystem.  So what we focus on are the following issues.  So looking at telecom infrastructure security.  And what are the vulnerabilities and areas exploits in Digital Financial Services.  SS7 is one of the vulnerabilities that we will talk about later during the day.  We talk about strong consumer authentication, gone are the days now of the password.  We talk about passwordless technologies nowadays.  How should these be implemented?  We talk about implementing digital identity, and KYC, and what are the vulnerabilities of the DFS application.  We are moving in a mobile ecosystem.  There are a number of vulnerabilities introduced when we talk about mobile payments.  Not just the phone, but also the secure element on the phone.  There is also now cloud based support systems that is provided for payment services as well as these also introduce other vulnerabilities.  So how we handle all of the vulnerabilities in the application security layer.  We think about emerging technologies, that are coming up, there you see distributed ledger technologies.  We have during the course of the day, we will hear more about DLT payment systems how they are introduced in other countries and what are security issues?  How do we enhance trust regarding data privacy concerns.  Here we're talking mainly about use of big data analytics and Digital Financial Services and use of artificial intelligence and unlicensed digital investment schemes that can, you know affect the confidence of users in using Digital Financial Services. 
      So this is also an important element of the work that is happening in the Security, Infrastructure and Trust Working Group.  And then the availability of the network, performance, quality of service, quality of experience is another issue that we tackle in the Security, Infrastructure and Trust Working Group.  Then we have a component on Cybersecurity for finance and market infrastructures, which is led actually by the World Bank under the SIT Working Group.  They will also present the work today they have done in this area.  Here the work is more focused on cyber resilience of financial services institutions, when it comes to Cybersecurity incidents.  
      And we also have a website for the security infrastructure Working Group.  You see the work on the screen.  Just as we did, switch to the website.  On the website we have more information about the work that's happening some sometime.  We will move to the website.  The website provides more information about the work happening in the different Working Groups.  And also, you can have the links to download the reports produced by the Working Group. 
      Now you can see the website on the screen, if you can scroll down to see the different work streams.  Yeah.  You can see the outputs there.  This will be presented tomorrow on the authentication. 
      Moving to the next slide.  If you can move back to the slides.  Thank you.  
      So as you can see, these are the main areas that we are looking at in the SIT Working Group.  Accordingly, we have this structure for the SIT Working Group.  We have a group like work stream on security, a work stream on D limp T.  Another work stream on trust, quality of service and a work stream on Cybersecurity for FMIs.  In 2019, there are eight reports that have been published by the SIT Working Group.  And the first four reports were going to be presenting today at the clinic. 
      And the last ‑‑ so the reports, they analyze the investment schemes, methodology for measurement of QOS and cyber (?) of were rented.  And report on big data analytics, machine learning and data privacy was finalized this year and will be presented at the symposium June 2020.  But the report is already on the SIT Working Group website and any feedback is welcome if you have any comments.  
      So the clinic today we focus on presenting reports from security and DLT work streams.  There will be four reports presented.  Three are from the security work stream.  The report on SS7 vulnerabilities.  Work on secure authentication technologies and DFS assurance framework.  There is one report on DLTs from the DLT work stream.  
      On the fifth of December, deep dives in terms of tutorials.  The talk about how to implement decentralized ID, what are the different issues to look at when implementing the decentralized ID, there is use cases provided in these tutorials.  We have one tutorial on the tracking of digital Ponzi schemes.  And we have a presentation also from Interpol in this session talking about how they investigate, you know, the digital Ponzi schemes and look into the collaboration as well between the regulators in this area. 
      We have one session on how to implement an app security framework.  And we'll have one Central Bank that will share the experience of how they went about implementing and executing the framework.  In this session the FIDO implementation, which is the session on strong consumer authentication.  We will have presentations on, you know, implementation of FIDO and use cases and information about how developers can use the resources at the ITU.  For FIDO.  And how to use those to test the applications developed on FIDO.  These are the tutorials on the fifth and we mentioned, the new session on homomorphic encryption applications in digital finance.  It is how you process encrypted data without needing to decrypt the information, hereby providing the privacy of the user as well.  That is the addition we made to the session. 
      I think it kind of talk a bit, handle a bit the issue of trust in Digital Financial Services.  We talk about this issue as well on the report on big data analytics, machine learning, and artificial intelligence as well.  
      In terms of outcomes with what has happened.  We said we publish a number of reports.  Concretely what happened with the publication of the reports, while the report on methodology on measurement of QS KPIs has led to a new standard in the ITU‑T Study Group 12, this is being finalized this week, meeting this week.  They will finalize this as a new standard.  The reports on SS7 mitigation measures and secure authentication technologies were presented in Study Group 11 and 17, respectively.  And they have been also adopted as technical reports, in these Study Groups.  And a new work item on this issue of SS7 vulnerabilities was also created in Study Group 11 and now, actually did an event in October.  Where they have different players that came and shared their ideas on how to address this issue, and now they are going to work on this issue in the Study Group 11.  
      The other reports will also lead to new standardization work in ITU, the other ITU Study Groups.  Mainly 17, Study Group because this is the main group for security.  
      The resources for strong authentication is available for users who would like to use it to test their applications if they want to use it for FIDO, instead of investing in the FIDO server, they can use the ITU server. 
      In terms of outcomes for 2020, the reports from the SIT Working Group will support the country implications happening in FIGI.  And we're working on setting up security test lab, and this will be used for testing DFS applications under either USSD, STK or Android environments.  This will be showcased at the FIGI symposium, 2020 in June. 
      We also have a few more reports in the pipeline so there is another report on DLT legal aspects, this time.  Biometric sim application.  And the testing of best practices.  We also have a couple of reports coming up on methodology of measurement for QOS KPIs this time looking at two more use cases, one on interoperability and one on cross border payment.  We also have a study on payment KPIs which is a collaboration with the electronic payment Working Group in FIGI. 
      Okay.  So this kind of give you broad overview of the work in the Security, Infrastructure and Trust Working Group.  If you want to join our mailing list, talk to me during the break.  We will give you the details.  And if you have any questions, maybe, take a few questions?  
(Applause)

Yes, yes, please?  
>> QUESTION: Good morning, it is Stephan from QR crypto, the SG member, and next year will be a full Sector Member of the ITU‑T.  We thank you for allowing us to be here and to be entangled here as was introduced by your colleague, Zimmerman.  And actually speaking about entanglement, it reminds me of quantum physics, but we're not here to discuss that.  But still, I am very happy that Rhonda told us about this event, the existence of this event and we could register.  And we, by the way, are providing a SIM card that integrates quantum resistant cryptographics, as a way for financial inclusion for the whole world.  So to bring everyone up to speed with the latest and greatest cryptography.  And since I believe the World Bank and other institutions are here, which help to achieve that goal, I would like to ask the relevant persons, maybe they could help in motivating SIM card producers in actually producing that innovation.  As a formal, unfortunately in Europe, we didn't try yet in other continents, it is quite cold, the response from them for such innovation, because it caters to poor people.  I believe they are the World Bank and the Bill & Melinda Gates Foundation to do something to change those dynamics.  Thank you.  
>> VIJAY MAUREE: Thank you.  Yes,s one more question here at the front. 
>> QUESTION: Actually, it is not a question, this is Alexander from this session.  It is not mentioned here, but we had very good focus group on DLT and we have a lot of outputs.  Some are technical reports.  For example, I was leader of Working Group 4 for DLT, and also, what is most important that we have very good team of international experts.  I can say that we're ready to help with this work.  And you can rely on us.  Thank you very much.  
>> VIJAY MAUREE: Thank you.  Okay.  So I don't see any more questions.  Oh, one more comment.  
>> QUESTION: Yeah, thank you so much for this symposium.  My question is about the cyber resilience framework of the expectation that we have and begin to study in earlier in this year.  (Audio skipping), we have something back we will discuss this in the framework.  You can wait ‑‑ 
>> VIJAY MAUREE: You can wait for that, and we will have that discussion.  Thanks so much.  I hand it over.  Yeah.  
>> BILEL JAMOUSSI: Thank you very much, Vijay, now, ladies and gentlemen, we will have ‑‑ we would like to invite you to the front of the room for group photo.  Followed by coffee break.  And then after that, we will continue the program.  So please, come forward to the front of the room and we're going to have the photo and then the coffee break.  Thank you. 
 (Break)
 
(Audio is not at a level to be heard)

(No audio)

(No audio feed)

>> ASSAF KLINGER: So what I will do is show you how easy it is to gain access to an account, PayPal, well respected DFS provider.  They still use SMS as a means of second‑factor authentication.  By hi‑jacking second‑factor SMS, I can take control of any account.  All I have to do, all the information that I need as a hacker to take over any PayPal account is what is found on your business card.  Your email and phone number.  That is all the information I need.  For this matter of demo, to disclaimers.  
      One, PayPal is well aware of this.  This is something that has been reported, it has been reported and I don't know if they're working, but they currently are saying that they're working on fixing this.  The second thing is I'm only attacking myself.  I am not willing to attack anybody else. 
      But for that matter, I'm trying to log into a PayPal account which I don't own.  And I have the email, which I have gotten from the business card.  It says, give me the password.  I don't have it.  It is not my account.  I will use the function ‑‑ oh, yeah.  I'm having trouble logging in.  Give me the password.  Okay, I will send you a text message.  At this point, I am going over to ‑‑ also, the phone I'm using is my phone.  I will show it to you.  So you can see ... 

      I will place an intercept on the SMS.  We will wait for the phone to start streaming.  Okay?  
      I'm going to place an intercept on this.  This is basically a SS7 attack that attacks my operator, and tells it to reroute SMS traffic to me.  Basically.  Oh, sorry.  What is happening here?  Sorry.  Live demo.  (Chuckling) 
I don't know what happened here.  It worked five minutes ago.  Sorry about that.  

      If this doesn't work, I will show you a video.  
>> MODERATOR: I believe here in the ITU ‑‑ around ITU today, may have some competitors doing some attacks, which is why it may not work.  
>> ASSAF KLINGER: It is mostly an internal problem with my system.  Just a second.  I will show you the videos.

>> A problem with the library. 
>> ASSAF KLINGER: I don't want to deal with that right now.  Basically, the same thing, you see a placed the interception.  Okay.  I asked them to send me the SMS.  This is ringing my phone.  I asked PayPal to send me the message with the two F A.  The message will come to my script and not on the phone.  See, there is no incoming message the SMS were rerouted to the attacker.  Now he has the 2FA, which the attacker can use to create another password for the account.  And then log in.  You can see now they have access to it.  It is a way to gain access to an account with only the email and phone number.  This is the account for SMS.  We can go back to the presentation.  
Okay.  So what can we do about this?  
      So, for operators, GSMA has published several guidelines, FS11 and more that relate to more high‑level networks, 4G, but I'm focusing on ones for 2G networks.  FS11, IR82, if implemented correctly, can block a lot of these attacks on SS7.  They can also implement signalling firewalls and install devices like positive security is selling.  That can block those kind of signalling attacks.  But what can the SFS providers do?  They don't have access to SS7.  They have money stolen, they don't have any possibility of blocking the attacks, it is the responsibility of the Telco regulators to do that, which they don't.  
      We proposed in the report several mitigation measures, I will go through some that are the major ones, can you change the direction to FFA. 
      The first thing the providers can do is change the direction of FFA.  Like in the demo.  Second factor authentication is basically one FMS, through the provider, through the Alpha numeric code, entered in the phone, website,kiosk or ATM.  We're proposing to change the direction.  Saying instead of sending the code, present the phone on the kiosk, on the ATM.  On the website.  Send an SMS to the client.  Have the client reply the code.  Like doing the 2FA two‑way, not one‑way.  Doing that, it will make ‑‑ just doing that will make the life of the hacker far more difficult to intercept that 2FA.  Interception of incoming SMS is much easier than interception of outgoing SMS.  If you change the direction of the 2FA, you raised the bar.  This is something the providers can do regardless of cooperation from Telco.  Click again, with the mouse, thank you.  
      The second thing is tracking for SIM cards.  Every transaction, this is for sim swapping.  If there was a case of sim swap and somebody social engineered the Telco into giving him another person's SIM card, and now that person is trying to conduct a GFS transaction using the replicated SIM card that he got from the Telco operators.  Every SIM card has a unique identifier called an IMSI, but tracking, DFS provider tracking the IMSI, he can find out that certain client has switched SIM cards.  Then he can propose additional security questions before the transaction, in order to mitigate that new owner or person performing the DFS transactions has replicated the SIM card and does not know the answers to the security questions.  That's it.  Okay.  
      So these are examples ‑‑ two examples of mitigation measures that DFS providers can do without any cooperation from the Telco.  Regarding the implementation of countermeasures as I said before.  In the EU around 30%, one‑third of the operators have implemented any sort of kind of mitigation measures.  And in the developing world the research done by us, saying over 60, almost 70% of telecom regulators or companies we have surveyed are unaware this is happening.  A third, 30% are aware, and only half of a percent has implemented anything.  The 30% in Europe are reduced to a mere 1% in developing countries.  
      This is, of course, because of the regulatory gap.  The DFS fraud that stems from telecom is no man's land.  It is not the responsibility of the financial regulator who requires those to be amend it to consumers that are hurt by fraud and it is not on the telecom operators who don't care about financial fraud because they're not liable for it. 
      We have come up with several recommendations in the report.  The first, educate, raise awareness.  This message has to be echoed in all of the telecom operators in all of the financial records, because this awareness has to ‑‑ this awareness rate has to rise.  The second thing is regulate.  There has to be a Roundtable between financial regulators and telecom regulators in order to create proper regulation that eliminated the no man's land and forces Telcos to address the problem because it causes financial loss in the financial sector. 
      Create a security posture baseline.  Awareness of what each regulator needs to conduct audits to see what level of security they provide to their customers, both on telecom side and on the financial side.  Close the regulatory gap, of course, by regulatory coordination, and incentivize the industry. 
      There is not a lot of solution providers out there.  And because of those solutions are quite expensive and require considerable capital expense in order to implement that.  That is the main inhibiting factor of implementation of security countermeasures in Telcos today.  By creating Government incentives and perhaps participating or subsidizing the costs, more and more Telcos will be able to install such equipment and mitigate more and more Telco attacks. 
      Of course, cooperation and dissemination in the industry.  We have started implementing this in three steps.  Education, ITU pick this up.  This is offered as technical report.  More efforts are underway, in order to mitigate this, that will be given by my colleague Xiaojie.  More and more, this message is being delivered more and more to the people. 
      Regulate.  This is up to you, all of the people here in this room.  You have to set up Roundtables of telecom regulators and financial regulators.  You have to audit your regulated bodies and be aware of what is their security posture.  You have to do this on a regular basis.  Because without control, all of those talks are for nothing.  And incentivization.  So first of all, DFS providers can implement countermeasures without the Telcos.  That is very important for you to know.  We want to encourage a global grants program for technological innovation in the field of telecom security.  And of course, encourage the deployment of four and 5G networks in developing countries for more and more DFS providers to be able to function on the Internet, on the packet data channels and have biometric means of authentication rather than relying on old ‑‑ 20‑year‑old SMS and USSD.  Thank you. 
>> MODERATOR: Thank you, Assaf.  There is a lot of information there, especially on the velocity of the SSM attacks every day.  Some good insights for regulators in the audience and listening and taking account.  I think there are a few regulators who implemented some regulations on USSD, but not enough.  Okay.  Now, over to Milan Brezina from PositiveTech. 
>> MILAN BREZINA: Leon said I have 10 minutes only.  Okay.  Yes.  First of all, thank you for being here.  I work for PositiveTech, and we do nothing but security for Telco.  
      I have to say that I also have my offline demo here, if you want to spend lunch with me, I can show you what we can do and definitely this will work.  Nothing against you.  (Chuckling). 
      So I read ‑‑ I don't know if everybody here read this paper or this report.  I read it three times.  I miss one part here.  And it is education for subscribers, first of all, usually, you can do all protections, but still if, you know, guys working with social engineering were able to attack common people without knowledge, education, this will work all times.  
      So one missing part here, who we are.  Let me introduce my company.  We are Swiss company with headquarters here in Tuk.  Main development center is in Czech Republic, where I come from, in Bruno city.  We do a lot of for all kind of banking, RPICS, web, telecom.  We have a lot of experience.  Definitely we have competitors.  I think I am proud, we are pioneers in SS7 security.  Yeah.  A lot of people working in our company and we are spread over 10 countries. 
      When I read this report first time, I said okay.  I travel a lot.  I don't call it ‑‑ you call it "developing countries" I don't know the explanation.  For me, I visited Mexico, South Africa, India, I don't know if these are developing countries.  Definitely I visited so‑called slums, meet the people here because I wanted to know, you know, I don't trust any graph that I didn't influence.  I did my own statistics.  Yes, flip phones are used commonly.  But in Mexico, everyone on the street has smartphone.  Pretty cheap, but definitely there is a smartphone, without data plan.  That is maybe the problem.  So don't talk about feature phone.  Still alive, but everyone here has a smartphone.  
	If you visit the countries you can buy cheap tariff, SMS plans.  Definitely there are people that can't buy this.  Still one among others, advice or solution is, for example, operator can distinguish between what kind of data you spend.  And they offer, for example, free data plan for WhatsApp, so on. 
      I'm asking why cannot operators implement a special free channel for the financial services?  This will solve it also some portion of the problem.  Because once we offer free.  Because we want ‑‑ everyone can benefit from this.  So we offer free for this kind of services we're solving. 
      Graphs, I can agree with your graphs, definitely.  What is ‑‑ let me use the word "funny" for me.  It is based on European Union only.  I would expect graphs from developing countries.  Probably I will touch this later.  Yes.  Everything start.  The implementation of mitigation, definitely it starts, I can read this graph.  
      So what we do, what we advise to the operators.  Eight minutes?  Good time.  So usually, we say first do assessment.  We know operators grew up with a close ecosystem of SSF, I agree.  If I come to you say your kids are smoking, drinking alcohol, you don't trust me.  You say you are crazy.  You think about it, you say hey, maybe what he said was the right.  You do your own assessment, ask friends, colleagues, schoolteacher, so on.  If you think, realize there is something wrong, you proceed to the next step.  So what we do as a first step, we come to the operators, and say hey, we think that you are vulnerable.  3G, 4G, 5G, whatever.  Let us do assessment for you.  We shall present the results to you, and it is up to you, what is your next step.  Assessment is the first step to start.  
      Once you ‑‑ let's say think we found something or your kids probably smoke, but you are not sure, you start monitoring them.  Start asking clever questions.  You know, watching them continuously monitor your kids.  And if you realize that what I said is right, your kid is smoking, drinking beer on the street, then you start what protection.  So definitely we can implement something here for SS7, GRX, definitely we provide operators a solution to monitor their networks.  We can provide alarming, you know, monitoring stuff of report, everything what you can imagine.  Definitely.  All we need is a copy of the traffic.  There are definitely competitors have solution with fibre only.  We say this is not enough. 
      Who from you, if you buy new phone, new laptop, or I see multiple access points of 55.  Have you configure ‑‑ you probably change the big picture, you believe, you trust them that what you buy, what you bought is safe enough.  Probably you never play with the huge list of settings.  That is why I hate the word "default."  Never keep default on network.  You can buy pretty expensive PGW, but if you don't change default settings you are never really protected well.  You have to ask someone that is expert in this field and ask for help.  You don't need to invest for fibre immediately or any other ITS intrusion detection system.  
      The home routing can be solved on STP only.  If you have message controller, I worked for 12 years for a messaging company, we provided SSN.  And say definitely, we enable home routing.  It is the first step to mitigate certain problems.  So direct examination is the second step. 
      Finally, so if you are familiar with this, you understand your problems, you have a list.  It is up to you to prioritize what you will solve first and do the list of to‑do.  Target protection, you start step‑by‑step protecting your network, your assets.  
      Once you finish this, you say I'm happy.  Definitely not!  There is a circle, even though it is not a circle.  It is a circle.  Once you product something, it is coming back one year and say do assess again my network.  We or our competitors can provide you the list of new vulnerabilities and again, start mitigation plan to cover all of the gaps, and still doing the same way all the times.  
      So once you start this war, you never finish.  We are not living in the idle world.  Still, there are guys who want our money.  Everything is because of money.  If message is for free, there is no reason to spoof originator.  That's it.  
      Two minutes.  Let me remark this.  My message is, do not rely on default.  And really start working with us or others in the feed to get access.  Then you can start monitoring, once you know, once you learn something, you can protect. 
      As I said, I brought from Czech my laptop with live or offline demo, so I can show you, because I visited two years ago Africa in Cape Town.  I have semi real data from Zimbabwe, these concerns, I can show you what we can do, how we work with this. 
      I think this is my last slide.  (Applause)
>> MODERATOR: Thank you, Milan.  You mentioned my hometown Cape Town.  Such a beautiful place.  Thank you for giving us a review in 10 minutes of solutions to SS7 vulnerabilities.  And for implementation perspective, I want to hand over now to Samuel Gitta from MTN Uganda.  
>> SAMUEL GITTA: Good morning.  Mine is a bit short.  Far more interactive aspect of today's sessions. 
      So a brief about MTN Uganda, specifically.  We launched what you call DFS services in 2009.  So last year, this year we're celebrating 10 years.  Originally, it was just peer‑to‑peer, but it has grown to all manner of services.  I mentioned the remittances is MasterCard, retail payments.  The main growth area, which is similar to the others, it is to grow retail payments.  To Uganda, within the group, it is significant revenue contributor.  
      Over 20% of our revenue.  From numbers point of view, we have over five million, and that is the active wallets.  And over 30 for the group.  In Uganda, due to regulation, there was a ban on scratch cards.  So we benefitted from that.  And we have used the defense platform to distribute air time. 
      I guess the last point to note is that the DFS providers or the Telcos are pretty much ahead of our regulators.  The regulators are trying to catch up, but for now, we seem to be ahead.  One of my regulators is here, so I have to be mindful (chuckling) of my comments.  Not working.  
>> Next slide, please. 
>> Maybe if I got closer.  
Next slide.  Maybe it was the last slide. 
>> SAMUEL GITTA: It was the first.  From the growth point of view, we are seeing a lot of growth up to the space.  I know the view here is that if we go back, we are seeing a lot of growth for MTN Uganda, we have 25% smartphone penetration.  And we tend to deliver a much better service to our smartphone users.  So we're promoting a lot of growth in that space.  
      As much as we look at security from an SS7 feature phone point of view, we see a lot of growth.  If we can go back.  We see a lot of growth from a smartphone point of view, for both the users, but also what we call our enablers in the game.  That is the agents, the merchants, (off microphone)

Please click on the second slide.  Okay.  Next.  Yes, I was speaking to the growth areas.  We see a lot of growth from both the users, and also our enablers, the agents, the retail payment merchants and I mentioned we're doing a lot of air time distribution and what we call float rebalancing.  A lot of times agents are running out of cash or emoney.  So we have mechanisms of tracking the agents to quickly replenish either their emoney for exchange of cash and the reverse.  And we're using apps in the space that come with their own security concerns. 
      I've mentioned the payments, that is our growth area.  Remittances interoperability, in Uganda, the Central Bank ordered ‑‑ the regulator, part regulator for mobile money, DFS ‑‑ ordered that we have interoperability with our partners or competitors.  It came with its risks.  We had a few incidents, again, using the interoperability channel. 
      We have a lot of surging in savings and lending solutions that speak to financial inclusion, that speak to ‑‑ many of our customers are not in your traditional banks, can't access credit.  A lot of the products from the microcredit point of view have been opened up, and we have related risks in that space.  Lastly, Uganda, again, within the group set up an open API mechanism to allow any developer tests for a sound books model, and connect, maybe from a six‑month point of view to about two weeks.  Our target is one week of onboarding.  So there is a feature there. 
      Time allowing we can look at it.  You can look at it at your time, which speaks about the open API and its related risks in that space.  Next.
So with regards to the report, I wanted to speak to at a high level, the threats of mitigations and how we've mitigated some of the threats.  We have benefitted from regulation.  Again, due to security, physical terrorism, threats in our markets, the regulator ordered use of biometric registration for all nationals, which represents about 98% of our customers.  We then used that, and we extended it to our processes for SIM swaps and pin resets.  So before one swaps a card, we have to read the prints as they are on the national ID, match them to their warm‑body prints.  Link up with the national registry and then the request comes to our back office. 
      The same thing goes for SIM swaps.  Every since that came in, it literally wiped away any form of fraud in this SIM swap space.  
      We also, again, partly due to regulators, enforced what we call do not disturb.  So we subject SMS content through filtering before it is delivered.  This, in the end, protects the customer on the streets from a lot of ‑‑ big percentage of the SMS spamming that can be used to target the DFS.  
      The next one has been alluded to by Milan.  Sorry.  By Assaf.  So if it you could go back the MZ authentication.  This is something implemented internally.  We're both a DFS provider and Telco.  I guess in airport this year, we had some incidents that are taking advantage of that.  Through the banks.  We have a lot of what we call bank to wallet and wallet to bank transactions in our market.  So for the banked customers, they can move funds into the DFS wallet and vice versa.  There was a bit of compromise within the banks, funds channeled to wrongly acquired SIM cards and used to externalize the funds.  Also the high value customers, their numbers swapped and funds taken out.  We have implemented MZ authentication internally.  
      So if there is a change in the MZ, then we sort of suspend the wallet for a certain period of time.  We are currently ‑‑ we are currently engaging some of the big banks, that want this service to implement as they wish.  One of them indicated that for transactions above a certain threshold, then they will poll and check if the MZ as has changed.  We restricted this swap reversal.  That was another channel used.  A bit of compromising internal stuff within the Telco.  So we sort of wrote back on that to a restrictive pool of stuff to affect SIM swap reversals.  We implemented the SS7 firewall, twofold po ‑‑ like Milan indicated.  We have studied data, but as a group implemented a CM provider that looks at the data as it comes in.  We're sharing it with the provider and overall log monitoring provider for subsequent policy implementations. 
      Lastly, I mentioned it earlier, is the SMS firewall.  Next.  
      Emerging threats from DFS point of view.  We are seeing attempts.  So some of our payment providers enabled with the API to issue debit requests.  So we've seen some of those brief case or otherwise providers then launch unsolicited debit requests to our customers, mainly our agents and some of them have fallen prey to it.  So as we have this open API and we get so many online providers that are enabling DFS as a payment channel.  We give them the ability to issue debit requests.  So some of them then will mass broadcast the debit requests.  A bit like the email spam of old.  Some of our customers have fallen prey to this. 
      Then, obviously, the device and app related vulnerabilities that are coming with the growth of the smartphones in our markets.  As Milan indicated, the smartphones ‑‑ the price point is coming to.  MTN introduced a $20 smartphone in our markets.  But some of the open markets dealers have actually delivered an equivalent of a $12 smartphone in our market.  So the growth is really big from a smartphone point of view.  
      Next.  For the recommendations, the last slide, security by design.  We're involved right now, from any new product offering, whether it is overdraft offering to ensure security is embedded in the rollout of this product.  Some of the old email platforms, fraud detection platforms are not smart enough.  At MTN, we're trying to on board a lot smarter platforms that cannot ‑‑ don't obviously actually rely on the human being to detect abnormal trends, which are emerging in our market at least.  I have talked to IMSI‑type checks.  It is the thought that the financial regulators and as they come up with regulation ‑‑ in Uganda they are, we have a draft law meant to regulate DFS providers.  It shouldn't be designed to control the entities as banks, but to allow for innovation.  Lucky for us we're in constant engagement, and we're pushing some of the aspects that can help protect the customer and also not impede growth.  I think that is pretty much it for me.  
(Applause)

>> MODERATOR: Thanks so much.  Actually, I bought this phone that you refer to as the. 
>> SAMUEL GITTA: $20 phone. 
>> MODERATOR: It runs the new operating system and has all the usual suspects like Google Maps.  I think Google has 10% ownership.  There is a lot of the Google apps on here. 
>> SAMUEL GITTA: It is preloaded with applications, WhatsApp, Google Maps, some basic apps.  It is pushing to greater growth of smartphones, which is an inherent MTN target. 
>> MODERATOR: It is smart but not touch screen.  Very good battery life.  But ... 

      So I want to hand over now to Xiaojie ‑‑ Xiaojie Zhu.  It said Judy.  I hope the Internet guys are working.  To you.  You have 10 minutes.  She's remote.  
Okay.  We're just waiting for the technical buffins upstairs to get us going.  
>> XIAOJIE ZHU: Hello?  Can you hear me?  
>> MODERATOR: We can hear you.  Please go ahead.  10 minutes.  
>> XIAOJIE ZHU: Hello?  Okay.  Good morning ladies and gentlemen.  I'm Xiaojie Zhu from China Telecom.  On behalf of SG11, I would like to share the SS7 security related features in SG11 with all of you.  Please scroll down, the next slide.  Next slide, please.  Please scroll down, yeah.  Thank you.  
      And the current ‑‑ please go up.  The second slide.  The key issues.  Okay.  
      Current issues of SS7 security include Telco and unrestricted vulnerabilities.  From Telco aspects, the vulnerability of ISUP may deal in caller ID and parity.  They can use MAP to obtain the SC and NSC of target user.  With that may perform various attacks.  For example, the interception of the user traffic including what is core and SMS, such as interception of one‑time password for second‑step authentication to commit frauds.  The attacker can cause the service to a whole network a set of subscribers or specific target user.  The attacks is built as services and sending fake spoof or spam SMS to target users are very popular. 
      The SS7 leads to third parties or various service providers may cause the unrestricted vulnerability of SS7 security.  The operator is SS7 access such as ISUP to third party and service providers.  This is third parties that are used by attackers.  Please scroll down.  
      With the awareness of the key issues of SS7 security, SG11 has authorize series of issues since 2015.  An ITU workshop was held in June 2017.  The SS7 security issues were presented and the ITU SG leadership assembly in 2019 and workshop on brainstorming session, on SS7 vulnerabilities and impact on different industries including Digital Financial Services was held in October 2019.  In addition, there are some standardization activities for improving the existing and future protocol, securities including SS7 were held in SG11.  
      Some outcomes were made during the activities on SS7 security held by SG11.  One of the key outcome is the (?) ITU‑T Q recommendations which is one of the truths to combat of the spoofing of the number.  Another outcome is the telecom report DFS which address the mitigation measures for Digital Financial Services transactions.  
      The key ongoing activity on SS7 security in SG11 is drafting Q.SR which addresses the interconnection between trustable entities and provides potential solution to disband different stakeholder which use existing Telcos.
	In the following slide I'll introduce the outcomes that work items one by one.  Please stop here.  First is the Q7 thirty‑one series recommendation.  The recommendation of Q.731.3 is to accommodate in dealing with the spoofing of the calling number problems in the Member States of ITU.  This recommendation specifies an exceptional procedure for transit exchange in purpose of providing qualifying number by originating operator.  
      When the third parties or service providers send fake caller number to the transit exchange, the fake number shall be replaced with the predefined calling party number.  It is the two to combat with the spoofing of the calling party number.  
      Some editorial work has been done for Q.731.4, Q.731.5, and Q.731.6 to align with this recommendation.  Please scroll down.  Next.  A lot of outcome is the technical report ITU SS7 DFS that deals with the digital final service transactions.  I believe some of the experts on the floor are familiar with this report.  Because this is the result of their FIGI security infrastructure and trust Working Group.  In order to improve their security poster of SS7 towards financial services and other public interest, OTT services.  Offer other telecom structure.  This report is the research of vulnerabilities mitigation measures for operators and also for the DFS providers.  
      There is one ongoing work item, ITU‑T Q.SR‑trust, the signalling requirements for interconnection between trustable network entities in support of assisting and emerging networks by introducing signalling security gateway SSGW.  
      The security offers or security issues to the SS gateways in the domain for communication with other domains.  While SS gateway after security A, secure connection with the SS gateway on the domain fee, they should be able to authenticate, and the diagram shows the architecture of the Q.SR trusts.  Since the architecture in the draft is similar to the architecture of TCAP security defined in 3TTS, and 33.204.  It was pointed out that the previous attempt to create an authentication for TCAP needs to be studied and the lessons learned from the lack of adoption need to be integrated into Q.SR trusts. 
      Please scroll down.  Next, please.  Yeah.  
      And the outcome of ITU workshop and brainstorming session on SS7 vulnerabilities and impact on different industry including digital financial service proposed some potential standardization for SS7 security, such as to the market, to draft the implementation of Q.SR trust, to start work item on drafting requirements for secure building architecture that will enable operators to offer OTT services to public interest services.  Into draft requirement for SIP‑ISUP authentication by providing origination data to the IAM request and add digital signature to ISUP.  To create attribution of spoofed calls to Telcos.  
      Please scroll down.  The next ‑‑ yeah.  And finally, from SG11 perspective, strategic direction to be taken by ITU‑T include to keep close cooperation among related Study Groups, including SG11, SG2, and SG17 on this subject.  And to invite all ITU‑T members to implement ITU‑T Q.731 serious recommendation, and other mitigation strategies and to invite other communication members and other sectors to join the efforts to improve the SS7 security, including for Digital Financial Services.  For example, to promote workshops and training et cetera. 
      And to slab collaborate with GSMA and 3G PP and other telecom to progress with additional mitigation measures with low cost to mitigate vulnerabilities of SS7.  
      And the next ‑‑ this is ‑‑ yeah.  
>> MODERATOR: Thank you very much.  Thank you.  
>> XIAOJIE ZHU: That's all from my side.  Thank you for your attention.  Thank you very much. 
>> MODERATOR: Thank you.  We will come back to you with some questions shortly.  But I want to start with ‑‑ I will ask panelists some questions and then open it up afterwards to the audience questions.  When you do ask a question, if I ask you to identify yourself and where you are from, please.  
      Assaf, great report.  Thank you.  How does 5G solve any of the stuff that you have identified or is it same mold model or is the backward compatibility an issue.  
>> ASSAF KLINGER: In 5G, there are steps to try to include the security posture, which includes encryption of identifiers and IMSI. 
>> MODERATOR: There is feedback somewhere.  
(Very loud feedback over system)

>> ASSAF KLINGER: 5G has taken steps to improve the situation.  Main issue is as always backward compatibility.  5G is implemented along 2G networks.  Until we are able to shut down all 2G networks or 2G, 3G networks.  This problems of SS7 will be with us, regardless of the advancement of 5G.  
>> MODERATOR: The report recommends that the Telco regulators establish a baseline security to ensure more security connection environment.  In reality what type of investment does this require?  
>> MILAN BREZINA: Like politicians say, it depends.  You know, each operator has different infrastructure, portfolio, how they solve that.  Sometimes I would say none till millions.  If you use defaults and someone new comes and says, hey, buy this and this.  You buy it.  It will definitely cost you money but will not solve your problems. 
      So better to focus, to understand your infrastructure, your options you have.  If you are operator, you should know what you invested in the past, what you have, what your capabilities, and then try to tune up your network.  This is the first step.  
      Then you can think about SS7 firewall, but please do start with yourself.  That is my answer.  
>> MODERATOR: Okay.  Thank you.  So as a mobile operator, with CAPEX, with 5G around the corner, there is more of a CAPEX squeeze.  How do you strike a balance between CAPEX and security?  
>> SAMUEL GITTA: For MTN, they tend to have defensive and expensive CAPEX.  From a security point of view, it is often considered defensive.  Defensive, that is the capital investment, it is a very small portion for many Telcos.  What we have done in beyond, and adopted by others, is that we often use some of the bad incidents to motivate for expense to protect the revenue.  So then that CAPEX would somewhat be targeted as offense.  
      If we intend to grow X amount in revenue, we must protect it.  So we tend to use some of our fraudulent incidents to motivate for it.  The second one is for some of the investments there's justifiable editions, top line.  For example, our SMS firewall realized significant A to P, stop line revenue especially from international providers that were not allowed through before.  So when we then demonstrated that to the board, there were an argument and in support of further investments in this space to protect.  Sorry, to grow the revenue.  So there are two things.  You use the incidents to motivate.  And where there is additional revenue, because that is what the boards listen to.  You project the additions top line.  
>> MODERATOR: Okay.  There is a nice feedback loop, you put a security measure in place that actually improve revenues.  That is unusual.  But very welcome at a board level, right?  
      Xiaojie if you can hear me, do you have any ideas on implementation of strategies for SS7, for example, diameter?  Have we lost her?  Okay.  We seem to have a technical issue there.  Hopefully we get it back.  
      But I want to ask Assaf as a follow‑up question.  Why do you think countermeasures are so low, creatively speaking amongst all of the operators and DFS providers?  
>> ASSAF KLINGER: The main reason is the capital expense required by operators to install the countermeasures or implement the guidelines.  It is because they don't have damage.  
	There is no income no ROI ‑‑ not liable for damage, not prosecuted on one side.  Not gaining money on the other side.  That equation has to change in order for operators, Telco operators to begin to be incentivized. 
      What Samuel said, because they're also an operator and DFS provider, that is unique case where there is internal incentive to protect against those attacks.  If you are not an operator, why should you spend money on security if you are not required to?  
>> MODERATOR: Maybe reputation damage is a good motivator.
>> ASSAF KLINGER: Not strong enough.  
>> MODERATOR: Not strong enough? I don't know if we got Judy back.  If we don't, let me open it up to the floor for questions.  Let's see who is out there.  Please, sir.  
>> QUESTION: Hi, hello.  Thank you for the presentations and discussions.  Rafa, I'm a security expert.  I have a question regarding the DFS. 
      Why do they get using S7 technologies for the second‑factor, and why don't they rely on stronger types of authentication?  Thank you.  
>> SAMUEL GITTA: My comment is we are 75% feature phone.  The DFS service is predominantly still a USSD type thing.  We used to have other services but we dropped it.  The DFS use a device. 
>> MODERATOR: Another list in the U.S. has come out saying don't use SMS.  Even smartphone world, people are using SMS for two factors.  It has got legs.  Anybody else?  
>> The main issue is the authentication apps and biometric is fine, but doesn't work in all cases.  But most old companies, even in the first world, PayPal, that I load you so they give you additional options, but you can go back and convert to SMS always, because it is the lowest common denominator.  Unless other systems are shut down completely they will be with us. 
>> MODERATOR: Doesn't seem to happen seen with the IOT devices that are running on 2G. 
>> In some countries, 3G will be shut down before 2G.  
>> MODERATOR: Any other questions. 
>> QUESTION: How much it cost the unsecure sector of USSD?  Any estimation of the cost in terms of revenue. 
>> MILAN BREZINA: ‑‑ 
>> ASSAF KLINGER: Maybe my colleague is aware of something in the market.  If you use USSB, authenticate the user, not the medium.  You can't have anything and secure it.  If you cannot authenticate the user on the USSD with another channel or ask questions, security questions, I think that is maybe the way to go.  Milan, do you know anything?  
>> MILAN BREZINA: Usually, the price of any I say firewall, USSD and encryption is not so high.  Think about who is always consumer over the service.  People, maybe with less education than we are.  They are used to for 20, 30 years using SMS.  They understand this service.  They believe in the service.  Now you say, hey, use application.  My grandfather, 84 years old.  He's transferring money, playing with this SMS authentication.  He's happy. 
      If I come to him, I say, hey, don't use this.  There is application, click, use your finger to do anything.  He said I will not use it.  It is a trade between security and user experience.  So we also come to operate, say hey, please do implement this and this and this.  Let me rephrase this.  If you are operator, you earn every day ‑‑ every day you earn $1 billion.  You are happy with this.  Because you meet your, let's say expectation.  You don't care that because of SMS spam, spoofing, you lose $300,000.  You are happy with one million.  How to convince you that you can earn much more if you restrict these guys.  
	You can also ‑‑ one thing is restrict.  If you for example, restrict spam.  You pay more.  Still they pay amount for spam.  Usually 10 cents.  Gray root, 5 cents.  If I implement firewall, you lose the revenue, you have to say to them, I use SSMP protocol or any other interface.  You will pay more but still less than regular SMS.  This is a tradeoff with what you want. 
      The same with reputation.  If no one is ever ‑‑ that all of us are tracking these days, operator doesn't wear, because if I don't know that I am being tracked.  I don't care.  How I get I'm being tracked.  What are my actions. 
      If MTL has none on identify.  We know it is probably VIP person validation. 
      Do monitoring, give a report.  In Europe we have GDPR.  If something happens, operators must say we have been hacked.  That's the law.  And then play with mitigation.  The same with the functions.  Have to implement.  And Assaf said this, backward compatibility.  This is nightmare for developers.  Develop great programs. 
      If you have the backward compatibility, you keep gaps and vulnerabilities.  That is the problem.  You have to cut. 
>> MODERATOR: Backwards equals back door, in some respects?  To your point about the user experience.  In markets I have been in, spoken to providers, even though they have got an app on a smartphone, the user experience is that they will want to use in many cases USSD as the interface.  
      And then similarly there is another hybrid, I find interesting for two‑factor authentication, using push DFS on smartphones.  USSD seems to have a starring role and recurring starring role in the offensive, even though we are in the smartphone in many packets. 
>> MILAN BREZINA: You probably heard about a hacker a few weeks ago.  A nice smartphone, look at the menu, STK functions.  Every operator inserts something for security, checking balance.  Weather forecast.  This obligation.  I say why we have SIM tool kit?  I download the one I like the most.  Keep the back door for hackers to get all of this on behalf of me.  Without my knowledge.  Same, remove this. 
>> SAMUEL GITTA: I think there is a space for regulators, we have seen the value of it in our markets.  I alluded some of the incidents earlier.  The Central Bank asked us what are you doing about it.  Some of the interventions like the MZ check on account of the regulator coming in to ask questions.  
	If they are coming together, ask us questions, we must demonstrate we're doing something.  It was after an incident.  Do you always have to wait for incidents as regulators to push for some of the minimums from a security point of view?  
>> MODERATOR: If you can identify yourself, please?  
>> QUESTION: This is ESOP Peterson from Bangladesh.  There is a gap between the telecom operators and DFS providers, I would like to hear from you how much it cost to implement SS7 (?) at the same time with the 2G, 3G, 4G, and 5G.  And second question, how can regulators of the telecoms work in this regard?  
>> ASSAF KLINGER: Still questions about money.  If we go to the customer who wants, for example, the cheapest SS7 firewall, we can sell it for $50,000.  I don't know if that is reasonable for you or not.  If you have extreme budget, that is your price for Bangladesh today.  I'm sorry, what is the follow‑up question?  So price and ... 

>> (Off microphone)
>> What regulators can do.  
>> MILAN BREZINA: What regulators can do.  Recommendation is no commitment.  That is the problem.  There is committment you have to implement SF11, SF18, IR8288, for everyone, that makes sense.  Let's go for this.  I work for this.  If it is just recommendation, it is always about operator's budget.  If it is limited and it would invest in 5G, for instance, they invest in 5G, not for security.  Because, you know, with security ‑‑
>> (Off microphone)
>> MILAN BREZINA: No return. 
>> MODERATOR: Okay.  Thank you.  We are ‑‑ please, yeah.  From the Bank of Morocco.  
>> QUESTION: Once again, from my point of view, what we observed is that the regulation comes also after discovering issues in technology.  Take DLT blockchain, how can we be sure it doesn't bring issues and vulnerabilities and how to ensure it is safe again.  DFS on the channel, and lots of technologies.  We use lots of channels.  How can be sure this lost channel are always secure?  Can we change the ‑‑ if it is not technology it is in regulation. 
>> MILAN BREZINA: There is regulatory dissidence.  Technology is overwhelming regulatories to some degree.  They need to understand the technology and connect the dots of how it fits it in with existing regulation.  The issue when I advised Governments and regulators, don't regulate by technology, if you can avoid it.  Try regulating by principles.  It is amorphis and rules to follow.  It does future proof your regulations.  And it leaves it up to the innovator fintech or whoever to abide by the principles.  But that's the only advice I can give you in terms of the overwhelming number of innovations in technology that exist.  
      Assaf. 
>> ASSAF KLINGER: One thing.  Audits.  It is the regulator's way of feeling what is actually happening.  If you want to see you implemented new technology.  
      I recommend two things.  One is regular audits of every regulated body you have according to the principles, and those audits are your tool to see that everyone is up to par.  And the second thing is regulatory sand box.  Which means that with the emergence of every new technology it must go through the regulatory sand box and pass audits that can be adopted from ITU recommendations or World Bank or IMT or ATF recommendations.  But you can basically create the audit framework for new technologies and implement it on your sand box and before I allow this to go in it, the new technology, it has to pass the sand box tests. 
>> MODERATOR: Okay.  Thank you.  Sorry, Jamie, we're out of time on this session.  We can take it offline.  I want to thank everybody again for a great panel.  Very illuminating.  Thank you Assaf for your report, very comprehensive.  Yeah, I'm sorry we couldn't get through to Judy.  Again, round of applause for everybody.  
(Applause)
>> MODERATOR: Okay.  Now I'm speaking.  We will go into the next session.  Thank you, everybody.  Next session is the fireside chat with Mr. Sharma, the Chairman of the telecom regulatory authority of India.  Sorry we don't have a fire, it would be nice in the midst of the cold.  We'll make due.  Oh!
So we will talk about ‑‑ if you want to join me?  
      Okay.  Thank you for joining us today.  Hopefully the focus group and everybody.  It is a pleasure to be in India for a FIGI meeting, where you birthed Aadhaar a great success story.  And over one billion people now signed up for biometric authentication through Aadhaar.  What is India's financial inclusion going to look like today?  It is largely due to the success of Aadhaar?  
>> RS SHARMA:  One of the important things about any financial solution is to have a robust identity.  Because without identity, you can't sort of open a bank account without identity or authentication you can't have transaction.  What has been provided is essentially a unique identity.  And because it is based on biometric.  It provides a way to authenticate your identity anytime, anywhere.  These two components make it possible to A, subscribe to a new service, that is basically opening a bank account.  Today, you can open a bank account without any piece of paper, because what is required to open a bank account, that is generated by the authority.  Then you can do transactions. 
      We opened as much as three hundred million bank accounts, in a matter of five months, using the electronic KYC of Aadhaar.  It transferred the KYC from the Aadhaar database to the database of the bank.  Then we're having as much as 8 billion authentication per year.  A lot part of that is for financial transactions.  Aadhaar is a fees of that financial inclusion in our country. 
      Today, we have almost every family has got more than two or three bank accounts.  Total bank accounts is the order of 8 hundred million, which is around 1.2 billion.  You can imagine, almost everybody has a bank account. 
      We also provide financial access.  I don't need to know your bank account.  I just need to know your Aadhaar number and we transfer to you.  This is what we are using for direct benefit transfers.
Now the government subsidies are being transferred through the Aadhaar platform.  
      To inform awe ‑‑ you, there are credit transactions of almost a dollar each taking place in each other's bank account.  The entities don't need to know the financial number, Aadhaar is working as a universal financial address. 
      I think the digital identity because of its properties is actually a dissenter of the financial industry. 
>> MODERATOR: Huge success story. 
>> RS SHARMA:  Authentications?  
>> MODERATOR: You have to have a robust security behind that. 
>> RS SHARMA:  It is. 
>> MODERATOR: What are the main strengths and success of Aadhaar. 
>> RS SHARMA:  Somebody was talking just now, security by design.  When we built Aadhaar certain principles we built for security and also privacy.  One we collected minimal information.  Not demographic information.  Name, gender, age, upon communication address.  We'll collected the iris and 10‑finger prints.  It is a mechanism to make sure one person can get on Aadhaar.  Minimal information.  When you authenticate on Aadhaar, the Aadhaar does not know the purpose of the authentication.  This is a structure.  Aadhaar provides one single service, that is authenticate. 
>> MODERATOR: Yes and no. 
>> RS SHARMA:  Exactly.  When you do the authentication, you are informed on your mobile and email as to you have authenticated.  If someone else is trying to authenticate, you are informed.  Email is linked, if you have email.  So consent. 
      Information to the person who authenticated.  That provides another layer of security.  Consent of the person who is authenticating.  Without your consent, you can't authenticate.  Because you are providing a strong factor of authentication, what is called the biometric, which is, you know, as you know, the three authentications, what you know, what you have, what you are, it is the strongest form of authentication, the second factor of authentication in these transactions is pin, not the SMS.  That is another interesting part.  
	This is what you know, what you are, what you know, what you have, which is the phone.  So the consent, the information to the person concerned.  The fact that you are (?) ‑‑ that makes the authentication mechanism very safe and secure. 
      Therefore the financial transaction is secure. 
>> MODERATOR: You probably had learnings along the journey.  What new security measures have been put in place?  For what purpose?  
>> RS SHARMA:  Couple of things, one is that sometimes, as you know, biometric authentication is not really a binary kind of stuff.  It is actually kind of things which is based on some other algorithm.  We have come up with something called virtual ID.  If you don't want your Aadhaar declared, you can lock your authentication.  You can lock it.  When you need authentication, carry out a procedure to unlock your biometric or authentication.  You can say, no, I'm going out, I'm a holiday, I will not do any transactions, I'm locking it.  You have a layer of security which adds to this.  
      And the law that makes it punishable if you spoof somebody at security or impersonate.  On this digital part, if you do something, that is possible.  There are multiple layers, both technology, it makes it difficult to impregnate that security architecture. 
>> MODERATOR: Do you have any lingering concerns about security?  Anything you are working on to share with us?  
>> RS SHARMA:  I don't have concerns, it has been ‑‑ the first Aadhaar number was issued in September 2010.  Now, about nine years.  Not even a single incident has taken place where somebody's biometrics have been hacked or somebody's data has been taken out.  
	Because what we are doing is keeping the biometrics offline.  They're not available ‑‑ they're not on network.  Essentially, you can't do any hacking ‑‑ the identity hacking has not happened, we'll say. 
      Because the design was made into such a design that minimalistic philosophy, not getting any downloads done from the Aadhaar database.  Some of the principles have really stood the test of time.  I don't have any lingering doubt.  In fact, you know, some guys just said that you disclose your Aadhaar number and we will tell a lot of things about you.  I did.  You remember that?  
>> MODERATOR: Yeah. 
>> RS SHARMA:  I disclosed could not do anything.  And essentially there is a distributed database.  There is no integration, no egregious data that what your digital footprint are, so actually disclosing that number does not increase vulnerability.  
	That is very important.  It has been proved.  One of the professors of the IRT, he is in the paper where he has concluded that Aadhaar does not increase your digital vulnerabilities.  
      Of course, it goes without saying as newer and newer hacker techniques develop, our database has to be secure, the banking database has to be secure.  And one good thing is that everybody is responsible for its own database.  The banking transactions, bank is responsible.  You know, this kind of stuff is happening.  Therefore, there is no possibility for something egregious taking place.  And if you open something and everything is open.  That is not the case. 
>> MODERATOR: It has been more than eight years since Aadhaar was implemented.  It has come a long way. 
      In retrospect, from a design and user interface perspective, is there anything you could have done differently?  
>> RS SHARMA:  Wonderful, wonderful question, actually.  Wonderful question.  
      We had, initially when doing it, people told us build this functionality into it, build this functionality.  Why not have the eligibility built in, who is eligible for subsidy and those things.  We refrained from doing that, we said just one function, give an identity, give an identity number, and authenticate the identity. That's all.  We have maintained this one function.  
	From a design perspective, we are minimalistic in our approach and focused only on that. If we were doing more, you are obviously being attacked from all sides because you have too many things.  If you have only single attribute, single job.  It is very secure.  
      Because of the context of financial inclusion let me just tell you, we are discussing in the two session the issue of vulnerability and efforts, in India, you know, we created on the basis of one infrastructure.  Aadhaar what we did, we said let's divide all the functionalities in the manner where one job can be done by multiple agencies.  
	On a real online, you know manner.  And if you do one job, let's say Aadhaar does one job of authenticating the identity in a robust manner.  In that, it helps banking and Telcos.  One Telco created one hundred million customers in one month.  Because of the offering.  
      We have an interoperable system, called UPI.  The unified payment interface.  This is a set of protocols that enables any bank transaction, real‑time basis, real‑time digital handshake.  And this, you know how many transactions on UPI?  More than one billion transactions a month.  More than one billion.  More than credit cards, debit cards.  It is the level of 126 billion transactions every month we're doing.  
      All the big players, in the wallet, that is gone.  No wallets from the providers.  All of the big players in the mark are there and providing these services.  So you can be on any application.  You can be with any bank and I can be in any application, any bank account, still you can transfer money and there is not cost of money.  Absolutely free transfer.
	In fact, Googles of the world pay money because of the data.  They pay money for the transactions.  What is required, especially for the developing country, you know, this whole debate of developing when developing was taking place, what it requires is actually development of interoperable, frugal, scaleable systems which will solve the problems of ‑‑ create hard problems of financial inclusion.  
	We have an identity platform.  Platform approach.  These platforms which are an issue, from the beginning itself, they have the attributes of being interoperable. 
>> MODERATOR: That is important.  You highlighted a big issue around the world is interoperability.  But ‑‑ so based on your experience, which is vast, what would you recommend to other governments or regulators who are planning to digitize their payments and reducing measures to allow financial services to reach the unbanked?  
>> RS SHARMA:  Wonderful question.  The ITU has come up with a roadmap.  It is digital identity roadmap guide.  That tool, that book is a recommendation to the countries as to how they can develop their identity system.  I think identity is fundamental to develop any system whether it is any service or any system.  That is one point.  
      Secondly, I say all the regulators, the financial and Telco regulators, they have to coming it.  Basically, we should all promote systems which are interoperable.  Which are frugal, which are robust and which are scaleable.  These systems should not be experimental systems like if I am Telco aid, my customers can do transactions, wallets, that kind of thing.  Architecturally should be based on interoperability.  The security stuff kicks in it, no more proprietary solutions.  Open API and standards, that is extremely, extremely important.  This is the rule.  The rule should not be to create, you know, silo solutions.  Silo solutions was created.  In digital word it is more difficult to change silo structures.  Nobody wants to give up his or her market to an interoperability situation.  You see why Telco is a wonderful world in the sense that any new Telco can come in?  It is only because of the necessary interconnect regime.  You are customer of Telco B, I can talk to you because there is by law, a system where I must be able to talk to you.  There is an interconnect.  If this interconnect was not there, you would have one or two Telcos in the world, this is what is happening.  You know, Amazon, a couple of companies.  This would have happened if there was interoperability.  
      We should be focused on interoperability.  We should also be focused on data portability which will enable if I am a customer on one platform, I should be able to port my data and allow empowerment of the customer.  If I own data, my banking data, I should have a right to access the data and give up this data for my own use with somebody else.  
	We need an architecture of this data in the transport or interchange.  India has come up with the architecture.  It is the digital framework based on Aadhaar.  It is the DEPA, Data Empowerment Protection Architecture. 
>> MODERATOR: Some markets it is open banking, even though it is not banking, it is a state of vulnerability to some degree.  
>> RS SHARMA:  It allows payments to people who are marginalized, who are very poor.  If I am a rich man, I can get interest and loan of interest.  If it I am a poor man, I don't have a credit history.  It is the priority premium.  It is possible if you do all of the data, for example, I may have had make sense with the Telco, I have been paying a regular customer, you know also my credit is free.  If I edit all of it and get it before you as a bank, you can probably do the ultimate of the small loans you can distribute. 
      This digital is not opening merely of a bank account.  The inclusion means availability of credit and improvement of the 2 cents of the talk. 
>> MODERATOR: Data is a critical part.  It opens up the market and adds to the competition.  You are old enough to know ‑‑ astonishing. 
      One final question for me, as we open it up, as we are pushing up against lunch.  Just looking at the future, do you see a use for blockchain, distributed technology.  Or any other systems?  
>> RS SHARMA:  Absolutely.  In fact, we have actually used blockchain technology in what is called unsolicited communication.  This is the UCC that calls on the SMS.  We have implemented that.  Using it in a big way.  All the Telcos have found out service providers were doing that.  This is a fantastic way we can use that for mobile portability.  For financial transactions, you know, even Aadhaar, for example, we can have a common KYC history somewhere in the blockchain.  Where if you need ‑‑ if I need to access this ‑‑ I don't need to go to Aadhaar, I can access that from a distributed ledger.  There are a lot of areas, in fact, where one can use the technology and we are already A, using it for unsolicited communications and we are also thinking of using it for financial transactions, for, you know, this mobile number portability.  And other aspects in Telco. 
      As a Telco regulator, you know, I have been constantly talking to the Telcos as how to reduce their costs, because ultimately, it is not only more robust technology, it is cost‑effective technology. 
>> MODERATOR: To that point, what you identified in some degree, is advantageous to consumers, customers, it is more at the enterprise backend level, how do you see customers interfacing with blockchain technology or do they not know?  
>> RS SHARMA:  There are always entities to work on behalf of the customers.  There is a gain ‑‑ in the data portability architecture which we created in the financial space, what is happening, is we have ‑‑ the Bank of India the regulator, they have data fiduciary or aggregators.  
	They work as essentially a pipeline.  They get a digital consent from the individual.  That digital consent is presented to the entity with which the entity had digital transactions.  They encrypt that.  And it goes to the entity that is requesting that particular data of the individual.  
	In a way, what will happen is while the individuals per se may not be aware of the blockchain, et cetera, the enterprise or entities that are working to provide solutions to the individuals, they could provide the technology and got a the security, in terms of the past, and ensuring the data is safe and probably portability.  
>> MODERATOR: Yeah, very important.  Portability is a new world, right?  Data is a new world. 
>> RS SHARMA:  Yes, absolutely. 
>> MODERATOR: I will open it up to a question.  Identify yourself if you have a question.  No need to identify yourself.  
>> QUESTION: Thank you for the presentation.  I think the greatest challenge, at least in our markets is the willingness of the identity regulator to work with the financial and Telco regulators.  I don't know how far‑sighted India was, but in case it is really a struggle.  You have this data, but it is not easily available to enhance DFS.  So I don't know what ITU can do in bringing this, the identity regulators and other regulators to the same table.  
>> RS SHARMA:  Can I?  
>> MODERATOR: Of course. 
>> RS SHARMA:  It is the unique identity authority of India.  This authority is providing services to the Government and private sector.  You become the authentication agency.  It is the AUA, authentication user agency.  It can be a bank, it can be a Telco.  It can be any other ‑‑ for example, renting agency, whatever.  If you want to do authentication, this agency offers authentication service.  The other entities they actually take it, what is required, however it is, that the Government of the day will have to declare this identity as an adequate proof of identity for the purpose. 
      We have the money laundering law.  Under that law, there are multiple documents that are listed as verified documents.  Aadhaar is an added.  Aadhaar is added to the list of documents required for a mobile SIM.  The regulators recognize this is a valid document.  This is the way it operates.  Just to let you know, for example, Morocco is implementing now in the World Bank ID project.  We had a role to play in that as to telling them how digital identity in India was implemented. 
      We actually have no card ‑‑ there is no identity card issued ‑‑ this is just an identity number.  And because everything is in the cloud, so therefore, it is ‑‑ it makes it very easy to kind of implement it anywhere.  And even if you lose the ‑‑ you know, the printed card, it doesn't make a difference.  So now, identity is on the cloud, you can couple eligibility with it.  Eligibility is on the cloud.  The whole thing works in a perfect manner.  It is a question of how secure you want to be. 
      There are various flavors of water in authentication.  You can use your biometric, your iris, or using the mobile phone.  Once you do that, that is little less robust authentication.  If you are doing a minor transaction, that is good enough.  It is for the entities conducting the authentication, that is for them to decide what authentication to use. 
>> MODERATOR: We have time for one last question.  Sir, if you can make it short, please. 
>> QUESTION: I'm from the Central Bank of the southern part of Africa.  I'm sorry, this is the first time I heard of Aadhaar.  I just put that disclaimer.  For a country looking at some form of digital identity, you speak about UI.  Who performs that authentication at the initial stage?  I heard the gentlemen from Uganda saying does the identity regulator connect with the financial regulator?  Who forms part of that organization in the initial stages, thank you. 
>> RS SHARMA:  Thank you very much.  Very interesting question.  First of all, let me say what Aadhaar means.  Aadhaar in English means foundation, the platform.  Literally it means platform or foundation.  The reason is this is actually an identity platform, which was created and this is not a specific purpose.  For identity.  It says you are you.  X is X that's one part.  So because it is supposed to serve multiple entities, Aadhaar in India was initially put under an organization called planning commission.  This planning commission is an odd body that does high level stuff that is not related one department, but multiple departments.  Now it is a part of the electrics and I.T. ministry.  The problem was in India also, the problem was the new identity, you have the whole ministry or Minister of Interior, it is my job, not your job to do identity, citizenship, it is not an identity job, it is a secure job. 
      That is one part.  That is something that happens in the Government.  What was done here in this case is we said we're not connecting identity with citizen.  If you have an Aadhaar number, it doesn't mean you're a citizen of India.  Anyone that lives in India will get an identity. 
      So we fought the battle saying Aadhaar is not a proof of citizenship.  Only a proof of identity.  He lives in India, yes, certainly.  Whether he's a citizen or not.  You can build with the application on top of Aadhaar.  The whole idea was let us have a minimalistic identity.  It is done digital.  This is a common problem of all.  You go to any former system, I came here, you came here.  Show me your passport, prove your identity.  The first question they ask is who are you. 
      We solved the first question.  Thereafter, if you are eligible for a certain benefit or not, that is different.  In the world thus far, Aadhaar was of the identity. 
      We use driver's license as a form of identity.  That is an authorization for you to drive.  It says X will try to drive, qualified to drive.  That underlying person to drive is X.  That is identity.  Similarly, if you have passport.  Passport is citizenship eligibility.  Therefore vulnerability issues and identity issues inherent with that.  We will take that attribute and let us build eligibility on top of it. 
      If you if to driver's license, that job is done by Aadhaar, ‑‑ Aadhaar.  This is the broad architecture, that architecture has stead the test of time.  We were do 2 million per day enrollment Aadhaar at some point in time. 
>> MODERATOR: Those are impressive stats.  Thank you for the question.  I see a lot of people scribbling notes.  A lot of learning people am ‑‑ will take home to their countries.  Mr. Sharma, thank you.  
      We will break for lunch now.  Be back at 2:00 p.m.  Thank you very much.  Enjoy your lunch.  See you back later.  
(Lunch break)
(Session concluded 12:57pm)

***
This text, document or file is based on live transcription.   Communication Access Realtime Translation (CART), captioning, and/or live transcription are provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.  This text, document, or file is not to be distributed or used in any way that may violate copyright law. 
***