This requires a vast technological infrastructure that is not only efficient and secure, but also — depending on the context — private yet transparent. At issue is the confidentiality, integrity and availability of information as well as related concerns over authenticity, accountability and reliability. There is also the inevitable trade-off between privacy and system functionality that individuals must navigate, which often brings into focus tensions between the way people think about privacy and the way they act.²

New technologies are also raising security and privacy issues. Video analysis can reveal an individual’s identity and location but also the people they meet, their mood and even certain medical conditions. The transmission and storage of biometric data requires the implementation of new protocols, and the increasing prevalence and accessibility of a wide range of biology-based data (such as genomic information, healthcare data and access protocols for laboratory samples of weaponisable pathogens) means that “cyberbiosecurity” is an emerging research topic of significant importance. AI is also changing this landscape,³ not least because of its pattern-recognition capabilities and the potential it offers to automate many tracking processes.

This will mean consideration of indirect insecurities, such as LGBTQ+ people being unwillingly identified because of data-sharing leading to openly targeted advertising,⁴ doxing⁵ or even physical attacks. Identity security relies on data policies and software routines as well as on “unlinkability”⁶ and secure hardware implementations such as “secure enclaves”. It is likely that unlinkability will allow people to maintain several legitimate identities simultaneously, for example. Multifactor authentication is used now, but its importance is likely to grow, with distributed and independent issuers of factors making identity theft much harder than it is today.

Reliable means of establishing identity will be key as autonomous agents begin to augment people in certain decision-making scenarios. These agents will need their own identities that are securely linked to their owners. This kind of distributed decision-making raises broader issues about the way human identity will evolve in future. What’s more, establishing the identity of machines is an important issue for the “internet of things”,⁷ which consists of devices with limited power, network and computational ability. Identity in this context will have to be established by methods that do not rely on strong encryption, network connections and so on. Ensuring that these mechanisms are secure and fit for purpose is an ongoing area of study.

This has led to much work on homomorphic encryption⁸, which allows encrypted information to be searched and processed while remaining encrypted. Applications include healthcare, banking, voting, genome encryption and beyond. Zero-knowledge proofs allow data verification without revealing anything about the data itself ⁹and have applications in healthcare, electronic identity systems, arms verification and so on. Another challenge comes from quantum-computing systems, which are soon expected to become capable of breaking many public-key cryptographic systems that are in widespread use for communication, financial transactions and the like. The US National Institute of Standards and Technology is coordinating efforts to develop post-quantum cryptographic standards that will be immune to quantum attack.¹⁰ But much work needs to be done to make sure they are safe.

The “internet of things” is a network expected to connect over 40 billion devices by 2025,¹¹ but there are significant challenges in achieving this securely. These devices operate with lower power and with limited computational resources, which limits the data processing they can do. Ongoing research for securing the internet of things focuses on blockchains, physically unclonable functions and post-quantum cryptography. Many of these techniques require improvements, such as error-detection routines and practical, user-friendly hardware interfaces. Device-independent cryptography, where users can test a device’s security for themselves, removing any reliance on manufacturer-issued assurances, remains an important goal.

While formal verification is an essential part of the development process, in practice it is often applied in retrospect, which makes the task significantly harder. Simpler user interfaces and better techniques could help to change that. That’s particularly important for mobile computing and cloud computing, which have spurred the use of formal verification at earlier stages in associated platform development.

Other new types of computing introduce their own challenges for formal verification. The “internet of things”, for instance, connects a wide variety of devices together and to the internet using a variety of different technologies, communications protocols and security standards, rendering each one vulnerable to attack — especially since they are often installed by non-security experts.¹² 6G communications networks, which are being designed as open and programmable by multiple stakeholders, may be vulnerable to attack in ways that 5G networks are not.¹³

Because of the trend towards ever-larger and more complex networks and systems, formal analysis is becoming more difficult, and AI — in particular, its pattern-identification capabilities — will play an increasingly important role in formal verification routines. However, low-end devices are likely to benefit from advances in local verifiability and public verifiability protocols, which will be of particular use in small and medium-sized countries where traditional certification is not affordable and tools for trustworthy certification (and suitably qualified personnel) are not available.