Bhutan’s Identity Transformation

By June Ramli

Sydney, July 6: Bhutan, a small Himalayan kingdom with a population of approximately 780,000 people, is known for its unique approach to development, focusing on Gross National Happiness rather than GDP. Despite being a relatively small and rural country, Bhutan has made significant strides in digital transformation. The median salary in Bhutan is around BTN 200,000 per year (approximately USD 2,500). While the country boasts a 100 per cent mobile penetration rate, digital literacy remains at 49 per cent, indicating a significant portion of the population may not be as tech-savvy.
In this context, Bhutan’s National Digital Identity (NDI) project marks a significant leap by implementing the first Self-Sovereign Identity (SSI)-based system at a national scale. Part of the Digital Drukyul Flagship Program, this initiative aims to create a thriving digital ecosystem rooted in trust and privacy.
In an exclusive interview with DailyStraits.com, Pallavi Sharma, Lead, Marketing & Communications at Bhutan NDI, provides an in-depth look at this groundbreaking project.

She shares insights into the project’s objectives, the unique features of the SSI model, the motivations behind the National Digital Identity Act 2023, and the challenges faced during implementation.

Can you provide an overview of Bhutan’s National Digital Identity (NDI) project and its key objectives?
The Bhutan NDI Project has been developed as one of the key digital transformation projects under the umbrella of the Digital Drukyul (Bhutan) Flagship Program. The Bhutan NDI platforms have been designed around the philosophy of Self-Sovereign Identity (SSI) and are developed with decentralised identifier (DID) technology. The project’s key objectives include: 

• Empowerment: Bhutan NDI empowers citizens by providing easy access to essential government and business services, promoting digital inclusion for all.
• Data Privacy: Citizens maintain control over their personal data, selecting which entities they authorise to access their information, thus ensuring privacy and safeguarding sensitive data.
• Data Security: The platform establishes a highly secure National Digital Identity system with a biometrics-enabled edge wallet, leveraging decentralised public key infrastructure to enhance the security and integrity of personal data.
• Inclusivity and Accessibility: Bhutan NDI promotes inclusivity, accessibility, and equity by catering to individuals with limited digital literacy, financial stability, and those who are differently abled – in terms of both product and use case designs. 

Bhutan is the first country to implement an SSI-based digital identity system at a national scale. Could you explain what an SSI-based system entails and how it differs from traditional digital identity systems?

Self-sovereign identity (SSI) is an identity model wherein the identity information and other credentials (information related to that person e.g., bank account number, driver’s licence, academic transcripts, etc.) are in sole ownership of the said individual. That means the individual controls what data to share, and with whom. 
In the Bhutan NDI wallet, which has been designed on the principles of SSI, a citizen’s personal credentials will be stored on their personal edge devices. This will allow individuals to control who has access to their personal data, and to share only the information that is necessary for a specific transaction or interaction (leveraging selective disclosure protocols), still providing the necessary verification and authentication mechanisms for trusted interactions with other parties.

The National Digital Identity Act 2023 is a pioneering regulation in decentralised digital identity. What were the key motivations behind adopting this comprehensive regulation?

Citizen’s data privacy is at the heart of Bhutan NDI. Bhutan NDI was conceptualised upon the vision of His Majesty the King to provide every citizen with the right to privacy while meeting necessary trust and compliance requirements for a trusted digital ecosystem. The NDI Act of Bhutan has been deemed a pioneering regulation because it formally mandates that these two core requirements be met to ensure a seamless and trusted digital economy. 

How does Bhutan’s decentralised digital wallet ensure the privacy and security of its citizens’ data?

Bhutan NDI’s decentralised technology has been designed in such a way that users’ verifiable credentials are not controlled by one central authority. As a result, no single entity has complete control over the user’s personal data. Rather, these credentials are issued to the user by different authorities and stored solely in the user’s Bhutan NDI edge wallet. 
Adding another layer of security, the user’s personal data cannot be found on Bhutan NDI’s server or a third-party cloud server. Bhutan NDI does not maintain any centralised database for information retention.  Bhutan NDI enables the users to retrieve their data from the source of truth (such as the Department of Civil Registration and Census or The Royal University of Bhutan), acting merely as a facilitator in the digital ecosystem. All data transfer between the user and the service provider happens through an encrypted peer-to-peer channel. Thus, in the absence of the users’ PII data on Bhutan NDI’s central repository or a cloud server, reducing the possibility for a single point of failure. 

Can you share any challenges you faced during the implementation of the NDI project and how they were overcome?

Communication was one of the key challenges. Given the fact that Bhutan NDI has been built with emerging technology, getting users to understand the value, particularly around data security and privacy, has been a big challenge. The Bhutanese society is a very small, tight-knit, and trust-based society. While the mobile penetration rate is at 100 per cent, digital literacy stands at 49 per cent. Citizens don’t worry too much about personal data security. We had to therefore tailor our communication and messaging in a language they understand and value. Selling the core value proposition of privacy and security was not effective. 
Another big challenge was that we did not have existing models/implementations to learn from. The learning curve was very steep, and, most often, entailed failing and iterating as we developed the products and the platform. 

How do you see the role of digital identity evolving in Bhutan’s digital ecosystem in the coming years?

The goal of Bhutan NDI is to create a highly trusted, seamless, and integrated digital economy. We’d like to accelerate access to government, business, and financial services for Bhutan’s residents and citizens everywhere – from those living in the urban hubs to the highlands and even outside of the country. The long-term goal is to create an inclusive digital economy. Until we get there, we are working to continuously design, develop, and iterate the platform and its applications that get us closer to this goal; we are looking to automate compliance, security, and privacy at a technical level so that even individuals with limited digital literacy can participate in the digital economy without having to first understand the threats of interacting with digital players in a virtual environment. 

Are there any specific features or functionalities in Bhutan’s NDI system that you believe set it apart from other digital identity systems worldwide, including those in Australia?

Bhutan NDI’s capabilities around selective disclosure and zero-knowledge proofs, I believe, sets it apart from other digital identity systems in the world. All verifiable credentials consist of various attributes on the Bhutan NDI wallet. For example, the Foundational Identity (ID) credential consists of a citizen’s name, Citizenship ID (CID) number, household number, date of birth, and gender as its attributes. The users have complete control over each of their credentials and can share only those attributes—even if they were issued by different authorities—required for a specific digital transaction. To put this in perspective, a user of Bhutan NDI may share their name, date of birth, and CID number issued by the Department of Civil Registration and Census (DCRC) and mobile number issued by TashiCell (a private telecom company) to apply for a Driver’s License without disclosing other attributes of the same Foundational ID credential like household number issued by DCRC. Thus, data sharing is on a need-to-know/selective basis as opposed to the widely used practice of submitting a copy of an ID proof with no user control over the attributes that are disclosed while accessing services. 

What lessons can other countries, such as Australia, learn from Bhutan’s experience in rolling out a national digital identity system?

I think it is crucial to first set a clear goal as to why a digital identity system is being deployed. When that north star becomes clear, the steps involved – be it designing the product/application or the use cases – become easier to design and implement. 

What are the potential benefits and ramifications of implementing a digital identity system on a national scale, particularly in terms of privacy, security, and citizen trust?

The global technological landscape is constantly evolving; everything is moving online. Establishing a national digital identity system will create a trust layer in the digital economy, expanding the potential for economic growth. On the flip side, as the landscape is continuously evolving, threats to digital systems continue to evolve too. I believe it is important for governments to be agile and adapt as the landscape evolves. 

Considering the concerns in Australia about signing up for digital identity systems, what advice would you give to policymakers and technologists to help build public trust and encourage adoption?

Being transparent is the key – transparency around the technology and the goals will definitely make a difference in driving adoption. Additionally, having a robust regulatory framework is important – it puts everything within a legal context, providing users with the assurance that there is accountability for actors of the ecosystem. Lastly, constantly communicating with the public will bridge the gap between the developers, policymakers, and users, leaving little room for misinformation or unawareness. 
Further, strategically designing use cases, I believe, is very important. Most often, even with public distrust, convenience is a driver for adoption. If use cases are designed to solve individual and business problems, adoption can automatically increase. It does not always have to be a government-push approach. With Bhutan NDI, we not only hope to improve convenience for citizens while accessing business and government services, we also prioritise and design use cases to solve business problems at the same time. For instance, we have automated compliance and eKYC so that businesses can save on verification and customer onboarding costs. We are also looking to provide passwordless login service to OTT platforms to address their business problems around password sharing between users. It is important to be creative in designing use cases.  It is often user convenience that drives adoption. 

How do you ensure that the digital identity system remains inclusive and accessible to all citizens, including those who may not be as tech-savvy?

One of the main goals of Bhutan NDI is to enhance digital inclusion. We are taking all measures to ensure inclusion. We are working closely with the Desuung Organization (a national volunteer group) to drive adoption in all 206 Gewogs (districts). The Desuups (volunteers) are trained directly by the Bhutan NDI team to avoid any miscommunication during and post launch. The trained Desuups go door to door in rural parts of the country to provide help with one-on-one onboarding, especially in remote locations with limited access to broadcast and social media. 
Further, we developed a real-time feedback loop that enabled Desuups to relay errors, questions, and comments in real-time to the NDI’s Communications, Quality Assurance, Product Development, and Business Development teams to address issues and errors during onboarding. The documented user experiences also get incorporated into the UI/UX and product designs.
Additionally, we are also prioritising features of the app itself to make it usable for rural residents, including the launch of a web app supported by feature phones and ultra-budget smartphones (such as KaiOS and Android Go). We are also working on developing wallets that support custodial and guardianship features for those individuals who are physically or legally incapable of managing their verifiable credentials/digital identity.  

What future advancements or upgrades do you foresee for Bhutan’s NDI system, and how will they continue to support the country’s digital transformation?

As mentioned above, inclusion is a key driver of the project, and therefore, most aspects of the roadmap have been aligned with the goal of inclusion. We are looking to design custodial and hybrid wallets to increase adoption of the product among citizens who’d need assistance in managing their private keys. The NDI Act also mandates Digital Identity wallets to include in-built features around guardianship and controllership – all at functional and technical levels rather than through written or legal authorization protocols. We are at the development stage for both digital signing and pee-to-peer chat features of the wallet. 
In terms of use cases for additional service sectors, we are looking to integrate with government and business organizations in the health, telecom, finance, aviation, and natural resources sectors. The design of our use cases focuses heavily on solving problems around digital trust, regulatory compliance, and verified customer identification. As per the design of our product, we will be focusing on enhancing user experience while keeping security and privacy at the center. 

Can you share any feedback or reactions from Bhutanese citizens since the rollout of the NDI system?

We have received a combination of reactions. Digitally literate individuals have expressed excitement and continuously have also shared ideas to enhance the product features. Those who do not care about data security have mainly expressed their discomfort in having to adopt a new way while interacting with businesses and governments. Either way, this feedback contributes to our product iteration and is very helpful for us to conduct customer segmentation and design our messaging strategy for driving adoption. 

Lastly, how do you see the success of Bhutan’s NDI influencing other nations considering the adoption of similar digital identity frameworks?

Bhutan has been seen as a pioneer of the SSI-based national digital identity system and we certainly hope that governments, businesses, and product designers can take lessons from Bhutan and incorporate it into their work. Knowledge exchange for projects of any kind is very important. We hope to learn from others just as we can help others.