Trust is the glue that maintains social groups. From an evolutionary perspective, trust enables social animals to share their specialised skills for survival and well-being. With an ever-increasing body of knowledge, humans continue to specialise. This specialisation increases the necessity for an individual to belong to and interact with a large number of groups. Trust, ‘the shared interest and lack of malice’, becomes the key ingredient for individuals to perform efficiently in a large number of groups that form a vibrant society.[1]
Trust is pivotal for modern society.
With the advent of the Internet, human interactions have moved from the physical world to the digital world. Much like in the non-digital world, where individuals trust their doctor for health care, an aeroplane for safe transport and a restaurant for clean food, in the digital world, consumers expect that their interactions will be without malice. We trust that, when we purchase a TV online, the right amount will be charged to our credit card only once, the product will be delivered undamaged in the time frame promised and the information we provided to the merchant during this process will not be misused. Without this trust, we may choose to find a more trustworthy physical store for our purchase, a different online store or not to purchase the product at all. Without trust, commerce and innovation slow down and progress is severely hampered.
To begin with, we expect that any digital transaction entailing the exchange of money or personal information will be performed with the expected results.
We also expect it to be done without information leaking to other entities through digital theft or unauthorised sale of information. A service delivered with poor quality or followed by digital information being shared with an external entity that can then use it without the owner’s permission destroys digital trust and makes subsequent transactions with the entity less likely.
We expect that if something goes wrong, and the digital exchange is not what we expected, then the entity we do business with will be capable of reversing the adverse impacts of the interaction. This may include compensating us through refunds or undoing an unauthorised transaction. At a minimum, we expect companies to inform us that our information has been compromised so that we can be prepared and take action, such as changing our passwords to prevent further loss. We expect companies to be proactive and continually engaged to ensure that digital trust is maintained between us.
For example, we expect our banks to detect anomalous transactions based on our established historical behaviour. It is particularly important that enterprises understand and respect those customer expectations, because the digital world empowers clients to communicate dissatisfaction with a service provider via social media, news groups etc. and rapidly damage the reputation of the enterprise.
Digital assets are under increasingly sophisticated attack, a phenomenon known as cyber warfare.[2] Digital asset theft is motivated by either financial gain or socio-political activism. One of the largest known cyber thefts motivated purely by financial gain cost companies over US$300 million in 2013, when a group of five hackers from Russia and Ukraine stole 160 million credit card numbers.[3]
In contrast to blatant theft of digital assets, organisations are engaged in micro-targeting consumers by learning their online behaviour. Using cookies – artefacts that companies can read from or write to on our devices – companies now collect thousands of attributes about consumers, mostly without their knowledge. The increasing popularity of big data analytics and machine learning for micro-targeting has resulted in a stronger drive for collecting customer information without their explicit consent. Digital asset theft is a significant tool for socio-political activism.
Perhaps Ashley Madison, a dating site marketed to people who are married or in relationships, has had one of the most direct impacts on users’ lives.[4] With 32 million records of customers involved in extramarital affairs exposed, the breakdown of digital trust made a direct and perhaps irreversible impact on personal trust, a cornerstone of marriage.
Breaching digital trust for political activism can cause significant changes in the way countries conduct themselves on the global stage.
The impact of Wikileaks, the Snowden leaks and the Panama leaks continue to have a profound impact on public opinion, which translates directly into changes in government leadership and policies.
Technology, process and culture are the fundamental building blocks of establishing and maintaining digital trust. All three are interdependent: strong technology alone does not ensure digital trust without the supporting processes and culture. From cryptographic clay tablets of 1500 BCE Mesopotamia to the quantum cryptography of the twenty-first century, the desire to protect information and communication has evolved to keep in step with human technological evolution. Significant tools, products and frameworks now exist that enable digital trust. From sophisticated multifactor biometric authentication for establishing identity, to strong crypto-algorithms for ensuring communication privacy and integrity, a wide array of commercial and open-source technologies are available for establishing digital trust. Trust in the virtual world should be measurable through outcomes. If the outcome of a transaction or a process is not as expected, the trust between the transacting entities should be reviewed, strengthened or annulled.
Digital assets, for example credit card numbers, should be protected with as much, if not more, diligence as a physical asset (for example, a new car). Unlike physical assets, digital assets can be stolen quickly with minimal physical effort. Once stolen, a digital asset cannot be recovered. A stolen digital asset can be reused repeatedly and rapidly, unlike most physical assets.
Our digital presence continues to increase. This means that the digital ‘attack surface area’ also continues to increase.
Taking a holistic approach to establishing digital trust requires evaluating leading technologies (for example, face recognition as a login credential), implementing processes and building a culture in our ecosystem that considers digital trust as a fundamental pillar of modern society.
_____
[1] Warren, M. E.: ‘Democratic Theory and Trust’, Cambridge University Press, pp. 310-345, 1999.
[2] FBI, IC3, US Department of Justice: ‘Amount of monetary damage caused by reported cyber crime to the IC3 from 2001 to 2016’, Statista, 2017.
[3] Voreacos, D.: ‘5 Hackers Charged in Largest Data-Breach Scheme in U.S.’, Bloomberg, 2013.
[4] Zetter, K.: ‘Hackers Finally Post Stolen Ashley Madison Data’, Wired, 2015
