Welcome, everyone. It is great to be here, once again for the Women in Tech Global Conference.I think this is my year attending and participating, and I've been listening in throughout the day on the different sessions, and it's really fantastic, the three days of content that the event organizers have put together. So congratulations once again for a fantastic agenda, full of great contact. My name is Daniella Barbosa, and I'm the general manager of decentralized technologies at the Linux Foundation and executive director of LF decentralized trust. We're really living in remarkable times. As many of the presentations this morning have already covered, AI is transforming the world around us, really at an incredible pace, never as seen before. It's really exciting, and it's full of possibilities for everyone gathered here today, and there's many great sessions around how, women can get involved in the AI space.

But to be honest, it can feel a little overwhelming at times, certainly for me and many of us that are in the forefront of the technologies, that are delivering, these solutions to the market. That's why today I wanna talk about something that really is essential on how we build trust in this new era through digital identity, verification, and decentralized systems, that will help us navigate an AI powered world, with confidence. We're really at the dawn of an age where the lines between machine and human initiated content are becoming increasingly blurred. This brings incredible possibilities, but also raises some critical questions about things like trust, identity, and control over our personal data. We all know how to make trust decisions in the real world. We have had centuries to evolve the necessary infrastructure for identification, registration, credentialing, monitoring, and enforcement of the trust relationships we have with both individuals and organizations.

So let me give you a clear example of what many of us consider a normal day, everyday occurrence of driving a car. Right? Driver's licenses and vehicle registrations, they all have a layered trust system that enables safe public interactions. When you drive a car, you're relying on a trust infrastructure that spans identity, your driver's license, credentialing, that driving test that you took and have to keep renewing in order to be licensed to drive, registration of your vehicle with license plates, and enforcement with police and insurance systems around that.

When you're going down the road and you're driving and it's a beautiful day and you your windows are open, you're listening to music, as you look to other drivers, you don't have to verify a driver's identity personally. You trust the system in place that that driver is licensed to drive their car. These are examples of normal day systems that have the necessary infrastructure needed for us to trust. But trust in the digital world is a much newer and harder problem, a problem made worse because the Internet was really not designed with security, privacy, and trust as primary objectives. The Internet success has magnified these flaws into everyday headlines that we see, Things about data breaches or ransomware attacks, misinformation, surveillance, and other collapses of digital trust, around the world. It's not just in one region. Today, AI can create incredibly realistic deepfakes. They can mimic voices perfectly and generate content that's almost indistinguishable from human work.

And AI, as we saw through this morning and afternoon's content is everywhere, and it's starting to create content to mimic people. For example, executives or customer support reps, that are tricking people into doing things and shaping how we engage with this new world. This raises a huge challenge. How do we know what's real? How do we verify identities in this new landscape? The old systems we rely on, centralized databases and even our own eyes, are no longer sufficient. The old systems fall short in the face of AI's ever growing sophistication. And every day, we're seeing new tools. I personally can't even keep up with the amount of tools coming out to make this easier and easier to do with better and better quality.

And it's becoming really hard to distinguish between real and machine generated content. And that confusion opens doors to serious risks from impersonation to misinformation. For example, take fake news or AI generated videos and impersonation campaigns that have already been used to manipulate voters and undermining democracies around the world. The growing challenge of trust comes to one simple truth. In the new world, being able to control your personal data and verify identities and credentials will be key to making it all work safely and reliably. But centralized identity systems are failing at this. Take examples of data breaches. In 2024 alone, approximately two hundred and seventy five million individuals had their protected health information compromised. That's about an average of over 750,000 records per day. This is your health information compromised and leaked. Weak passwords, which we are made even weaker when reused.

Forbes report last summer reported that seventy eight percent of people use the same password across multiple accounts. Yes. I'm looking at all of you. And the long term issue of centralized control of identity that falls into the biggest tech companies. These systems we've relied on for passwords and decentralized databases are just not cutting it anymore. The key challenge today is trust. How do we verify that someone or something is who they claim to be? We need a new model for trust. Trust decisions are no longer just human to human or human to machine, but more increasingly machine to machine as well. Let me give you an example. I live in San Francisco where Waymo's autonomous vehicles at intersections are a very common occurrence. Very often, they also have tourists in them.

I hear it's one of the biggest tourist activity going on right now in San Francisco. So if you visit San Francisco, make sure you download the Waymo app and check it out. It's pretty cool. So at these intersections, when two self driving cars approach, and there's no traffic light, they must communicate with each other. So we have two cars communicating with each other to determine which car goes They use vehicle to vehicle protocols to share intent, location, speed, and trust signals. These are instant automated and without any human intervention. Even if you're in the car, you can't intervene. This machine to machine trust negotiation. If one car transmits incorrect data or fails to follow the protocol, it can cause an accident, and sometimes it does.

The truth here depends on secure identities, validated credentials, and real time communications between the vehicles, just like humans, but scaled and automated between machines. So trust must evolve and is evolving alongside technology. This is where things get very interesting. We need new models, new ways of thinking about trust and verification, and we need to shift from centralized systems where our data is held by a few large entities to decentralized systems where we have more control. We need technologies that can authenticate individuals and information in a way that's resilient to AI manipulation. So what are some of these technologies? At the core of these new verification systems are decentralized technologies. These systems use cryptography and often distributed ledgers to create secure, verifiable identities and credentials. They enable users to hold their own credentials, control how and when information is shared, and ensure that identities are verified in context, meaning a person can just prove enough things without really revealing everything about them that they need, and I'll give you some examples of that in a bit.

So let's imagine you're buying software online, and the software online vendor needs you to verify that you're a student so that you can take advantage of a student discount. Traditionally, you might upload a photo of your student ID or enter your full name, school, and enrollment year into a form, that goes into a centralized database. But with decentralized identity, you share a verifiable credential from your digital wallet that simply proves I am currently an enrolled student. Right? This is a verified credential that proves that you are an enrolled student at an institution. The importance of it is that you do that without exposing your name, your student ID, or your date of birth, information that is not needed by that vendor to give you that student discount. These technologies also enable more nuanced context aware identity verification, helping us distinguish between real users and AI powered impersonators.

These technologies are already in use, providing real practical solutions to enhance trust and authenticity in everyday digital interactions. They're being deployed around the world. For example, we're seeing examples of digital identity wallets that allow individuals to prove who they are without, once again, revealing unnecessary personal information about themselves. Before we see some examples, let's talk about decentralized identifiers and verifiable credentials. Decentralized identifiers or DIDs are like digital names, that individuals or devices control themselves. Unlike an email address or a username, they don't deploy, depend on one company or one government to manage them at all. Verifiable credentials are digital documents like, diplomas and licenses and other employment certifications, for example, that can be cryptographically signed and selectively shared. Together, DIDs and VCs form the foundation for secure privacy preserving digital identity.

They're essential for AI ecosystems with both people and agents that need to interact in a way that's verifiable but not overexposed. Once Once again, giving out data that you don't necessarily need or want to do. Here's an example. In October of twenty twenty three, Bhutan, which is a country in South Asia Asia launched the NDI, the National Digital Identity Wallet. This is a decentralized identity wallet that allows citizens to store and share their verifiable credentials, such as their national IDs, academic records, and bank information directly from their smartphones. A couple of things that, I would like to highlight on how this works is the users hold their credentials locally and share only, once again, the necessary information for that given transaction. So what is known in the industry as self sovereign identity. The access to the NDI wallet is secured through facial recognition and fingerprint scanning by biometric, biometric authentication.

And citizens can provide the specific attributes, whether it's their age or which city they might live in, without revealing, once again, the full personal details. So there's selective disclosure. The citizens decide what they wanna disclose, and the applications they're engaging with, decide which data points they need. And all this is built with decentralized infrastructure, and the system operates without any central authority, reducing obviously the risk of data breaches and unauthorized surveillance of the data. I am proud to say that Bhutan's NDI uses, Linux Foundation, code projects and standards projects, Credible, and the work that's being done over a trust over IP with the four layer TRIST framework, and I'll talk a little bit about that in a bit. So now let's talk about another use case, which is content providence verification. We talked about digital identity and having your digital identity in your wallet in order to navigate, you know, government requirements and other use cases.

But, look, content providence verification, will help us determine the authenticity and the origin of digital content, and this is certainly essential for trust in the AI powered world as we talked about. And we're seeing systems that via that verify the providence of content, ensuring that it hasn't been tampered with. And these world examples are really demonstrating the power and potential of decentralized identity and verification and the standards that our communities have been working on. An example of this from our Linux Foundation ecosystem is the content credential standards by the Coalition for Content, Providence, and Authenticity or c two p a. This is a Linux Foundation project that has really reached adoption, with the likes of organizations like YouTube and Adobe and Microsoft and many others that are implementing the c two p a open standard. For example, the newest version of the Leica SL three s, includes content credential technology. This is the full frame mirrorless camera with authenticity built in.

There's quite a few other cameras already using the protocols and the standards, but this one's the that, has a mirrorless camera. The images are signed in a tamper proof matter with metadata about the camera model. Right? What camera took this image? As well as the creation and editing information of that image. With the certificate and the private key, they're safely stored in the chipset of the camera itself. So every photo is signed using the c two PA compliant algorithm embedded in the content credentials directly into the image file. And so, for example, photojournalist, who might be embedded in a different zone, can embed exactly who they are, what picture they took, where they pitch it, and really complete verify that providence, that stays uniquely with that image that then you can validate. In the Genic AI, for example, as it evolves from simple chatbots to systems making complex decisions, and we're seeing that more and more, and there's a couple sessions earlier on the topic.

Developers enterprises need infrastructure that prove what AI has seen, what they did, and why. A new tool from Hedera, which is called the Hedera AI studio, is an example that provides just that kind of toolset. Using the Hedera network, which is a public layer one blockchain, it anchors every action in a verifiable time stamped ledger, the Hedera network, and its practical, open source toolkit that really, combines transparency, compliance, and observability in AI workflows. This is really important, because it's not just a matter of technical rigor, but accountability, especially as you think about datasets and data models and AI agents, in regulated or mission critical environments with cross jurisdictional requirements, how do you prove where the data came from, how the decisions were made?

There's a lot of great work happening. Hedera is also powered by one of our LFT centralized trust projects called Hairo, and we're very proud of the work that that ecosystem is doing in this space. But technology alone can't solve the trust problem. We also need governance, clear rules for how systems interact, who's accountable, and what ethical boundaries should guide design and deployment of these systems. we need secure interoperable systems that work across borders, industries, and platforms. We are a global economy, and therefore, we need to make sure that our tools and the systems and ecosystems that we build will work across borders and industries and different platforms.

And, you know, without these shared standards, digital trust will break down at every hand off. There is no doubt that we need to collaborate on these, standards, around the industry. Ethics must be baked and not bolted on. Right? From content and privacy to inclusion and bias mitigation, these frameworks are essential for aligning tech with human values and there's many organizations and ecosystems that are really working on that governance framework, that is so critical to us building, these systems.

And this isn't just a job for one sector or one organization. We really need collaboration across governments, industries, academia, and civil societies, to create these governance models that are global, open, and trustworthy. And we're seeing a lot of organizations and a lot of communities getting together, across the Linux Foundation and other organizations as well, in order to do that. So giving you an example, here at the Linux Foundation, with the trust over IP project is the trust spanning protocol or TSP. This is developed under the trust over IP project, which is part of Linux Foundation decentralized trust. And it's a proposed standard that enables verifiable digital interactions across different platforms, ecosystems, and networks.

So even when those systems use different technologies and there is going to be optionality and choices and technologies and governance models as well that you choose, TSP is the protocol designed to serve as a universal trust layer. It allows any two parties to securely exchange verifiable information. This is much like s m p SMTP in the email industry, alright, that enables email to be sent between different systems across the Internet regardless of which provider or software software you use. You can send an email to anyone around the world, thanks to this SMPT, protocol. A real life example of where this is critical is let's imagine a refugee, is using a wallet issued by the United Nations agency. Right? And the U UN agency, has given them a verified credential of who they are and that they're a refugee.

And the refugee can then present that verified credential to, let's say, a European government digital services in a European nation that maybe they're, have immigrated into. And both of those systems can trust each other's credentials without really needing to be on the same technical platform or the same legal ecosystem. So it's really important to have, that trust spanning protocol requirements. So I'll call attention to a new white paper that was just released by trust over IP community. It's over on our website, LF decentralized trust. It covers the TSP as straightening trust in human and AI interactions, and it is really a paper that enables the TSP as the foundational layer, between verifiable privacy preserving trust relationships that I've been talking about, not just before between people, but also between AI agents and models and service providers in the industry.

The white paper does include some real world examples like tracing the providence of AI generated content on social media, and proposes a new model of digital accountability that's, certainly urgently needed in the world of generative AI, in autonomous systems. So I encourage you all to check that out. An exciting approach that our communities are also working on is the concept of person credentials. person credentials are an approach to providing strong cryptographically verifiable proof that the holder is real, a unique person, and not a bot. The work is ongoing across the Linux Foundation and other community ecosystems like the Aira Foundation, and a recommended read with the focus specifically on personhood credentials and AI that I'm focusing on today is this paper from 2024 that really sets the stage on the value of privacy preserving tools in the ecosystem.

And this is where you all come in. I hope that this overview of what our communities are doing and some of the core technologies has been helpful. There is no doubt that we need to stay ahead of the rapidly evolving AI landscape. It's hard to just even keep up, as I mentioned before when you're even in the industry. So whether you're a developer or a policymaker or a business leader, your role in shaping these tools is vital. So I ask for you to, you know, look at contributing to standards and joining these trust networks that are being formed and really bringing your organization and your projects into our ecosystem work. There are many communities that are working hard to develop these key decentralized technologies and solutions here at the Linux Foundation that really put individuals back in control of their data, right, and makes ongoing verification of this information really seamless, much easier for us to navigate in this new world.

So we have projects like LF Decentralized Trust, which I'm honored to be the executive director of. We now have over 17 different projects under this umbrella organization, including Hyperledger Indie, Hyperledger Identis, Credible, a non creds, and trust over IP that I already talked about a bit. We have the decentralized identity foundation or diff, and they are really a key technical community developing open standards like DIDs and DIDCOMs. They make decentralized identity and verifiable trust possible across many platforms. I'll give you an example. Their hospitality and travel working group is working right now to create standards, schemas, and processes and the related documentation needed to support the exchange of self sovereign data of travelers, so travel in the travel industry, and intermediaries travel industry as well.

So lots of great work and other working groups working there. The Open Wallet Foundation is the community that is building open source interoperable wallet infrastructure, and then I mentioned also c two p a in previous. So there's a lot of great work here happening at the Linux Foundation and across the ecosystem. So I wanna thank you for your time, and I hope that we can build a future where trust is foundational to our identity and our data. So thank you so much for your