This page has been translated using TexTra by NICT. Please note that the translation may not be completely accurate.If you find any mistranslations, we appreciate your feedback on the "Request form for improving the automatic translation ".

FY 2025 Advisory Council on Identifying Issues in Attribute Certification (1st)

Last Updated:

Outline

For the overview of this conference, please see the Advisory Council on Organizing Issues for Attribution Certification .

Event Information

Date:
Thursday, October 23, 2025 from 10:00 a.m. to 12:00 p.m.
Location:
Online (Microsoft Teams) * Live distribution has ended.

Proceedings

  • 1. Opening
  • 2. How to proceed with the review meeting
  • 3) Mutual election of the chairperson
  • 4. Agenda: Discussion on "Issue 1: Approaches to encourage appropriate technical and operational measures"
  • 5. Closing and Communications

Data

Minute

Office (Kitainoue): Now, I would like to start the first meeting of the Expert Panel on Summarizing Challenges of Attribution Verification. Ladies and gentlemen, thank you very much for taking time out of your busy schedule to meet with us today. I am Kitainoue from Digital Agency, who serves as the secretariat. It is my pleasure to meet you. To begin with, I would like to say a few words from Nakagawa from Director, Group of Common Functions for Digital Society, Digital Agency on behalf of the secretariat.

Secretariat (Nakagawa): . Thank you very much for gathering here today, including Professor Kokuryo. On behalf of the secretariat, I would like to say a few words in greeting.

Thank you very much for your support, including last year. You had a different name last year. The DIW Advisory Board and the Advisory Council on Governance in the Use of Verifiable Credentials (VC/VDC), which is located in "Mission, Vision and Values" in Digital Agency, were established to promote the use of the so-called VC / DIW. The DIW Advisory Board and the Advisory Council on Governance in the Use of Verifiable Credentials (VC/VDC), which is located in "continuously evaluating our actions in pursuing our goals" in Tokyo, were established to promote the use of the so-called VC / DIW. When I was wondering what the purpose of the DIW Advisory Board was, I thought the DIW Advisory Board would be a place for broader discussions on the digital completion of administrative procedures and the future vision of data utilization. In this sense, I would like to make it a place for broader discussions such as the completion of administrative procedures digitally and the future vision of data utilization. In this sense, we have changed the name of this meeting to the "Expert Meeting on Identifying Attribution Challenges." In that sense, both in Japan and the EU are considering moves such as educational credentials. The digitization and sophistication of attribution credentials are increasing. In that sense, I believe it has been discussed in some places, but it is specific in the sense that it includes Verifiable Credentials (VC), a copy of a residence certificate that is issued electronically. The name was changed this year. The DW The DC / VDC The DC. The DC. The DC. The DC. The DC. The DC. DC. The DC. The DC. The DC. The DC. The DC. The DC. The DC. DC. The DC. The DC. The DC. The DC. Dc. The DC. The in the DC. The DC. The DC. V. In this year. The DC. The DC. In. In the DC. In The DC. The DC. In the DC. In in in this DC. In the DC. In the DC. In the DC. In the DC. In DC. In the DC. The DC. In DC. In the DC. In this DC. In DC. In. The DC. In In the DC. In DC. In the DC. In In. In I hope. DC. In the DC. In. In In the DC. In In the DC. In In the DC. In. In the DC. In In the DC. In DC. In the DC. In In. In. In the DC. In the In DC. In the DC. In the DC

At last year's meeting, a risk that arose at this time was the pooling of names that were not paper certificates. Basically, it did not end there, but there would be a risk that someone would pool names and various information would be combined. I believe you pointed out this. What kind of measures should be taken to reduce the risk will be the subject of discussion, I believe. It may be that we can respond technically, but it may also be that we need to do it by some means due to the legal system. I would be grateful if you could discuss how this kind of method should be. In that sense, I would be grateful if you could discuss this while constantly questioning the purpose. In the past, there may have been this kind of technology or this kind of method. In particular, various methods may have been discussed here and there. In that sense, I would be grateful if you could discuss this while constantly questioning the purpose. This is a long story, but that is all from me. Thank you very much.

Office (Kitainoue): Next, I would like to explain how to proceed with this plenary session. Please refer to the installation guidelines in Document 1. I would like to ask the members of the audience to refer to the material currently projected, not the material published on the website.

Then, I would like to explain from the beginning. In this conference, we would like to realize proof of attribution, which is necessary for the digital completion and automation of administrative procedures, and we would like to promote the use of VC and DIW toward our major goal. On the other hand, the situation is that the risks that can be assumed due to the new technology and appropriate technical and operational measures against the risks have not been organized. For this reason, we would like this plenary session to discuss methods, etc., to promote the implementation of these measures. The members are 11 people as shown in 3. Due to time constraints, I would like to omit the introduction of each person.

Please refer to the next page. The Chairperson is elected by mutual vote of the members, and the Secretariat is Digital Agency. Next, there are 6 working groups. There is a provision that a working group will be established to conduct detailed deliberations on specific agenda items. Please refer to Document 3. I will explain the details later, but as stated here, the plenary session is expected to discuss technology to a certain extent, so we plan to establish a technical working group. Specific plans and other matters will be explained again at the end as an administrative communication, so they will be omitted here.

Let me return to Exhibit 1. As stated in Exhibit 7, guest speakers and observers may be invited, if necessary.

Lastly, in principle, this plenary session will be open to the public as it is now. Materials and minutes will also be open to the public. That is all from my explanation.

If there are any questions or opinions on how to proceed with this plenary session, please raise your hand. If you are a committee member participating online, please press the "function" button.

<No question or comment>

There does not seem to be anything special, so we will proceed with the plenary session as shown here. Next, in accordance with the guidelines for the establishment of the DIW Advisory Board, we would like to decide the chair of the plenary session by mutual election of the members. As the secretariat, we would like to continue recommending Dr. Kuniryo for the DIW Advisory Board last year. If you have any objections, please raise your hand. If you are a member participating online, please press the button.

<No objection>

There were no objections, so I would like to ask Professor Kokuryo to chair the plenary session. Professor Kokuryo, could you please say a few words?

Chairman: Good morning. Although the name has changed since last year, it is a great honor for me to be able to organize this meeting. I feel that the time has become quite ripe, and I hope that we can see even a little of a concrete path forward. Therefore, I would like to ask for the efforts of all the members of the committee and the secretariat. Thank you very much.

Office (Kitainoue): Domain Thank you very much. Now, moving on to the next agenda item, before getting into the discussions, I would like to ask the secretariat to explain the materials in advance regarding the purpose of establishing the meeting, the goal of this fiscal year, the scope of the discussions, and the risks and countermeasures. After explaining the materials, I would like to ask the Chairman of the Domain Council to proceed with the discussions. Thank you very much. Then, the secretariat will explain each based on Document 2.

Secretariat (Nakagawa): . I will be the first to explain, and later we will take turns to explain in more detail.

First of all, with regard to the purpose and objectives, I believe the background issues have already been explained. I believe we need to produce concrete outputs to some extent, so I would like to explain the purpose, background, and issues once again.

Just last week, I visited a hospital. Medical treatment covered by health insurance is now available at the My Number Card. At this level, even smartphones can be used. At this level, I believe digitalization has already realized things such as identification documents and proof of health insurance. However, there are certificates that are not issued by public institutions but are also issued in the private sector, such as copies of residence certificates and academic transcripts and enrollment certificates required for enrollment and employment. In many cases, digitalization has not yet completed this. We must do this well, and in that sense, I think it is the main point in that sense. In PDF format, the current certificates are sometimes issued. I believe there were points for improvement and suggestions made, and I think these two points are the main points. I believe it is necessary to overcome these difficulties and to computerize and advance certification of qualifications and attributes.

In this sense, regarding the purpose and objectives of this conference, in order to digitize and improve various types of certificates, I believe it is also important to spread it as a service to private companies. When we introduce the transcript I mentioned earlier, including each high school, private high school, and public high school, I think it is important that it is inexpensive, simple, and can be implemented quickly. If we do this in a technology-oriented way, it will be safe but expensive, and it will take time to introduce it. I think it will be difficult to spread it. From an institutional perspective, it will be quite difficult to make laws or impose penalties. In addition, there are cases where procedures are necessary or hurdles become even higher, so I think the costs of institutional parts must be minimized as much as possible. I think this point is really the point. I think it is necessary to conduct discussions as cheaply, simply, and quickly as possible, while making sure not to forget this point. I would be very grateful if you could proceed with the consideration while asking about convenience and safety compared to paper. In addition, I would be grateful if you could give us advice on certificates in general from an institutional perspective.

The next page will be the basic information. It talks about Verifiable Credentials, what VC is all about, and what DIW is all about. I would like to reiterate this, but I think there will be some people who will be attending the hearing for the first time, so we have included it here as well.

The next page is "Efforts to Computerize and Advance Certificates," and the far left is the current My Number system, which I believe has been implemented in My Number Card. It is equivalent to an identification card. The middle column is for eligibility verification, and the right column is for attribute certificates issued by the private sector. Eligibility certificates and attribute certificates, these are within the scope of this meeting, and I have written that they need to be addressed. Each of these has not been sorted out, and I have written what I think needs to be stipulated. That is my explanation, but I would like to continue with the explanation from the secretariat until the "Introduction".

The Secretariat (Sawada): I would now like to read out the comments received from Mr. Then, from now on, I will explain from Sawada in Digital Agency. First, I would like to review last year's discussions and introduce the latest trends.

In the last year's "DIW Advisory Board," we summarized that DIW has various benefits for each stakeholder. We organized the types of use cases where the use of DIW can be expected. We also identified the risks that may arise when using such VCs and DIW. We received opinions on what kind of governance is necessary for Verifier or Wallet Provider, as well as on what kind of governance is necessary for measures against risks and governance. The other meeting body, the "Expert Meeting on Governance in the Utilization of Verifiable Credentials (VC/VDC)," discussed in particular the responsibilities that issuers should assume and the points that issuers should pay attention to. Based on these discussions, in the report of the "DIW Advisory Board," we summarized that there are issues in terms of technology, operation, and system regarding necessary measures specific to VC and DIW, taking into account that measures have already been taken for various risks in the existing governance. We have summarized such a framework until we organize it. I hope you will consider this year as a continuation of this discussion. In addition, regarding future prospects, we have summarized the prospects that it will be possible to promote convenient and efficient data linkage through VC and DIW, it will be possible to utilize them with peace of mind, and value such as new services will be created. This is a brief review of last year's discussions.

Next, I would like to introduce two examples of the recent increase in expectations for VC utilization. First, regarding the expectations from the government side, this year, a working group in Ministry of Internal Affairs and Communications is discussing the issuance and computerization of residence certificates. I do not mean online applications, but it is related to the issuance of electronic media. Regarding this, there are concerns about the risk of spoofing, etc. with PDF, and we are considering the possibility of utilizing VC. Also, in the private sector, there are expectations for the possibility of using it in conjunction with new technologies and businesses. In the new protocol announced last month, when a AI agent receives a delegation from the user and processes some purchase payments, etc., an idea has been announced that a VC that indicates that the delegation has been duly received is issued and utilized. In this way, I am aware that interest and expectations regarding VC and DIW are increasing. That was an introduction that served as a premise for the discussion. Next, I will continue to explain the points of discussion. The explanation will be a bit long, but I will explain the entire story.

First of all, I would like to clarify the issues to be addressed at this year's plenary session. At the main body meeting held today, we will discuss how to present appropriate technical and operational measures and how to promote their implementation regarding risk measures for computerization and advancement of certificates by VC / DIW. Regarding this point, the summary for the previous fiscal year, which I introduced earlier, used the phrase "technology, operation, and system." However, as Nakagawa mentioned at the beginning, there are cases where it is possible to take measures for technology and operation without using systems. Therefore, as indicated in blue letters in the materials, we have used the phrase "a method to encourage appropriate technical and operational measures." In addition, the technical working group, which will be held in the future, will define recommended specific technical requirements for technical and operational measures and provide feedback to the main body meeting. As a premise for the discussions here, I would like to highlight one point, which is described in the main body meeting above, but this time I would like you to think about what measures are necessary for "public and high-risk use cases."

Regarding what a public use case is, a list of image examples is shown only in the materials distributed to the committee members. All committee members, please take a look at the materials in front of you. A public use case is defined as a public use case including both a Various Certificates issued by a public organization and conversely, a certificate issued by a private organization and received by an administrative organization. In addition, as for what is a public and high-risk use case, I think it is difficult to discuss without specific examples, but for example, I think that the case where a copy of a certificate of residence, which was introduced earlier, is hypothetically converted into a VC applies. A certificate issued by an administrative organization and containing personal information such as name and address, and at risk of occurring because it is submitted in many situations. Please consider this as a public and high-risk use case and discuss it.

I would like to explain the risks and threats that are of concern, which are the premise for the next measures to be taken. This is based on the risk organization in last year's discussion, and it is a re-organization of threats along the life cycle of VCs. There are risks and threats related to the use of various VCs and DIWs. This is a summary of the risk types for these threats. The first is "theft and reuse of legitimate VCs and impersonation / spoofing," the second is "acceptance damage of counterfeit and derivative VCs," the third is "invasion of privacy caused by VCs," and the fourth is "decline in availability and convenience of VCs." I will explain the details of these four risks later. As a supplementary note, this year's discussion does not necessarily cover all VC and DIW risks. Risks that originate from web services in general, and risks that do not have many points of contention regarding the content and promotion of measures, are omitted from the discussion.

Next, regarding these four risks, I will explain the details of each risk and the outline of countermeasures against each risk.

First, regarding the first risk, "Misrepresentation / Impersonation through Theft or Reuse of Legitimate VCs". This refers to the overall risk that, in various stages of the lifecycle of a VC, when the VC information is stolen or leaked by an attack, a third party abuses the VC. Next, the main measures against this risk can be broadly divided into two. As described in the middle part, the first is a measure called "Holder Binding", which links information that identifies the Holder, such as the signature key and identity verification information of the Holder, to the VC. The second measure is to strengthen measures to prevent unauthorized access and duplication regarding the handling of data in the Wallet. The specific methods of these measures and how to use them will be the points of discussion in the technical working group. As for this main body meeting, we would like to have a discussion after this from the perspective of in what cases and to what extent we will urge and request Wallet Providers to implement measures such as "Holder Binding".

The second risk is "damage caused by acceptance of a forged VC or a derivative VC". In particular, it is assumed that there is an inappropriate operation in which a third party organization issues a derivative VC based on the reliability of the original, and a Verifier can refer to and verify the act performed at the time of issuance. Therefore, there is a risk that a forged Issuer with malicious intent issues a forged VC. As a specific method, as shown in the figure at the lower right of the document, it is assumed that a third party organization publishes a list of Issuers that have been examined and registered based on the reliability of the original, and a Verifier can refer to and verify the act performed at the time of issuance. As a result, there is a risk that a forged Issuer with malicious intent issues a forged VC. As for the verification of eligibility of this Issuer, what should be verified as eligibility is the point of discussion at the main body meeting. As shown on the left side, for example, in the case of a certificate issued by an administrative agency, it is possible to verify whether it is an actual administrative agency as eligibility. It is difficult to verify the eligibility of all companies, but list verification may be possible in fields where there is a list of business operators that are highly public and have already been approved, such as medical and financial services. In the EU and the United States, such a mechanism for verifying the eligibility of an Issuer has already been provided. In the EU and the United States have already been introduced. It is difficult to verify the eligibility of all companies. As a third party organization publishes a list of Issuers that have been examined and registered based on the authenticity of the original. As for verification. As for verification, it is assumed. As to verify the eligibility of the As a point. As for the main body. As shown in the main body. As another risk introduced is the verification of the eligibility of the original VC. As a derivative VC. It is difficult. As shown in the figure shown in the main. As for verification, a list in which a. As a VC. As the eligibility. As eligibility. As for verification of the eligibility. As to verify the eligibility. For the eligibility verification of the public. As a. As to verify the eligibility of the eligibility verification of the main body. I. As shown on the left. As for example, if a VC has been issued after issuing a certificate after issuing, for example, it can be verified by verifying the eligibility. As a list of an authorized. As a list verification. As a list verification may be verified as a list verification. As a VC. The verification of a VC. As a VC. As the eligibility. I. I. As a list. I. As shown on the left, the list verification may be possible. List verification, the list may be possible. As a list, the list verification may be possible. The verification of a private sector. In the EU and the VC. In the VC is highly public, for example, it is highly public. In the public authorization. In the VC, for example, the list verification of the list, it may, it may be, it is possible to verify the eligibility of a private. The eligibility of a private VC. The eligibility of a private VC is difficult. I. I is difficult, the verification of the verification of the verification of the verification of a VC, a list of a VC, the verification of a VC. As the verification. It. Vc. The eligibility. It. As verification. As a list. As a verification. I. I. I. I. I. I. I. I. The verification of the private I. The eligibility verification of all, the verification of all of the certification. A VC. As a VC. As a VC. It.

The third risk is "invasion of privacy caused by VCs." Since VCs contain information that can be easily aggregated, such as signature values, if two or more Verifiers intentionally share the presented VC information, there is a risk that the privacy that could have been protected by selective disclosure would be violated. Measures against this risk can be broadly divided into two measures. The first measure is called Unlinkability, which prevents the association of the same subject who has presented multiple pieces of information. There are various methods for technically realizing this, and the use of each of them will be a particular topic of the technical working group. The second measure is to limit the parties to which a VC is presented to those who can be trusted in the first place. However, there are almost no analog certificates that systematically limit the parties to which they are presented, except for identification. Therefore, it is necessary to be careful not to take excessive measures. Today, regarding this privacy measure, I would like to hear your opinions from the perspective of which means should be used and to what extent.

Lastly, the fourth risk, "Reduced availability and convenience of VCs." This refers to the overall risk that a VC cannot be migrated and used in cases where the VC does not have the required compatibility, such as when the Wallet Provider or Issuer ends its service or replaces the terminal. As for measures to deal with this risk, for the Wallet Provider, it is difficult to ask private companies to take measures at the end of their business. For example, it is conceivable to make mutual compatibility of VCs a recommended requirement. For the Issuer, it is conceivable to show measures in guidelines so that the certification capability of the issued VC is not impaired even after the Issuer ends its VC issuance service. As for the main body meeting, we would like to discuss how and to what extent it is necessary to indicate the requirements that such Wallet Providers and Issuers should have. Please note that in Europe and the United States, certain allowances are made for mutual compatibility. In cases where the government itself provides wallets, as in some European countries, the risk of withdrawal of the Wallet Provider does not need to be considered.

These are the risks unique to the four VC / DIWs and an overview of possible countermeasures. Lastly, the next page, which is only distributed on the desk so I would like you to take a look at it, some of the risks are considered to be subject to existing laws and regulations, but the relevant laws and regulations is shown on your hand. Although the secretariat is not able to organize the scope of application and present its views for each laws and regulations here, I would like to hear your opinions based on whether they are covered by existing governance. Up to this point, I have explained the risks that are the premise for discussion, as well as risk measures that we would like to discuss how to promote implementation. This is the end of the material explanation from the secretariat. Then, once again, I would like to hand over the progress of the subsequent discussions to the Chairman of the National Land Council.

Chairman: After this, there will be an explanation of what the goal of this meeting should be, and proposals and discussions from the secretariat. Assuming that this will be discussed later, I would like to invite questions and opinions on the materials so far. What do you think?

Committee Member Sakae Fuji: I'm Fujisakae from OpenID Foundation-Japan. I look forward to working with you this year as well. There are some things that were not included in the first half, so if there were such an explanation, it may overlap, but what I feel from listening to Mr. Sawada's explanation now is that I feel that it would be better not to mislead the overall discussion a little bit. I feel that we are focusing too much on the risk as a whole. What I want to say is that I think that there are cases where there is a risk, depending on the use and nature of digital credentials including Verifiable Credentials, of course. However, I feel that if we do not think about the way to reversely identify cases that are not risky and start implementing them in society from there, we will have too much awareness of the risk as a whole, which will lead to a misunderstanding.

For example, in terms of Holder Binding, for all credentials, is it really necessary to use Holder Binding? If the binding strength is not so strong, I think there are cases where credentials can be bound, such as IDs in Wallets. For example, as a whole, I think it is impossible to operate everything as a registered seal. Therefore, I think it is possible for the verifier to decide that a derivative work is acceptable. In that case, on the assumption that the verifier can tell that it is a derivative work, I think it is better to present some specific cases where a derivative work is acceptable, rather than strictly function. For example, in Germany, there is a problem of key management, including the use of Cloud HSM. As you mentioned earlier, various efforts are being made in various places. For example, in Germany, there is a problem of key management, including the use of Cloud HSM. As you mentioned earlier, various efforts are being made in various places. For example, in Germany, there is a problem of workaround, including the use of Cloud HSM. As you mentioned earlier, various efforts are being made in various places. That's it.

Chairman: Thank you very much. Regarding narrowing down use cases, I believe Mr. Sakae Fuji's opinion is based on a specific image of narrowing down use cases, and what he has just said is that it would be better to consider and implement specific use cases starting with those that are highly likely to be realized and have low risks. From that perspective, in this material, as examples, there are examples of residence certificates and AI agents, but can we proceed with discussions based on this idea? If possible, do you think it would be better to consider another use case as a "use case to be assumed"? If you have any opinions, please tell us.

Committee Member Sakae Fuji: . Well, as for use cases of residence certificates and AI agents, for example, in the case of AI agents, although I understand the content of the implementation using mandates and the content of the protocol, I was thinking that it would be possible to create a more lenient case, including whether state-issued credentials would be used.

Chairman: . Committee Member Matsumoto, please.

MATSUMOTO: I still have doubts about whether it is good to start with the risk. I think it is actually good to look at the risk after understanding the convenience and benefits. However, since the Architecture is not yet confirmed in the first place, it may be difficult to analyze the risk. Listening to what you just said, since I was involved last year and the year before, I don't really understand who the risk is for. I don't know, or rather, it is not specified here. Broadly speaking, there are the person, the relying party, and the verifier. I thought it would be easier to understand if the classification is at the beginning. Another one is that I think there are various categories, such as the person who is the attacker, the attacker being a third party with malicious intent, or the relying party and verifier with no malicious intent or compliance. I thought it would be better to classify them in these categories. However, in the case of paper certificates, the social problem is that the person who knows is the attacker. Since the person who does not know is unable to understand, even if we analyze the risk based on that premise. VC is clearly difficult, so even if we analyze the risk based on that premise, I thought that those who know can understand and those who do not know cannot understand.

What I was a little concerned about was the way the terms are used. This is also a detail, but although there are the words "qualified issuer" and "qualified VC" in Slide 30, if there are three, it could be an actual issuer or a derivative VC. In the European eIDAS2.0, "qualified issuer" is called Qualified Issuer. There is a Qualified Issuer, and for light applications, there is a Non-Qualified. Therefore, there are two guarantee levels for Issuers. There is no discussion here at all, setting aside whether it is necessary or not, isn't it necessary to discuss that VCs have only one guarantee level in the first place, such as LoA (Levels of Assurance)? If I write "Qualified Issuer" including this point, some people may think that this is referring to the European Qualified Issuer. This is in Japanese, and how to translate Qualified in Japanese. There are certainly problems like that, and we have to be careful about that.

Chairman: Thank you. Is there anyone else who wants to speak?

Committee Member Kasai: Thank you very much, Lawson. I look forward to working with you. On pages 17 and 18 of the explanatory material from the secretariat, I would like you to tell us about the copy of the certificate of residence issued. I think that in many cases, the issuance of a copy machine ticket at a convenience store is carried out for the copy of the certificate of residence issued. This time, you are saying that this is for a VC. This is a scene after the use, or we are saying that we have completed the VC, and how to submit the documents. Are these pages 17 and 18 all online, or do we go to somewhere face-to-face and submit the documents? As for the focus, I would like to know if you are looking at both of these, or if you can do it online to online.

The Secretariat (Sawada): I would now like to read out the comments received from Mr. residence certificate, we are considering how to proceed in Ministry of Internal Affairs and Communications, but we cannot answer that. However, this meeting focused on the possibilities of presenting the certificate in person on a smartphone, online, or via online.

Committee Member Kasai: Thank you very much, I understand. If that is the case, there were not many issues such as verification equipment when submitting documents face-to-face. Since this is related to risks and is a very important point from the perspective of narrowing down users, I asked this question just in case.

Chairman: Yes, thank you.

NAKAMURA: I am from Kyoto University. This is related to what you have said, but I think we need to consider in more detail how to classify usage scenarios when analyzing risks. There was a comment from Commissioner Fujisakae earlier that it would be better to distinguish whether there is a derivative VC or not when the content written on the certificate of residence is correct. However, even in the case of a certificate of residence, as long as it is guaranteed that the content written on the certificate of residence is correct, there are use cases where it does not matter who presents it. I think there are use cases where you confirm the fact that you can bring your own certificate of residence. I wonder if we should assume a case where a VC flows and is presented by another person, or if there is a use case where it is stored and after a certain period of time, it is verified whether it is valid or not. In such a way, the method of risk analysis or the extent to which we need to prepare as necessary technology will change.

Another point I would like to make is as follows. Although certificates, such as residence certificates, do not mention My Number or anything else, in terms of digitalization, I think the discussion will also include what to do with identifiers for individuals, and therefore what identifiers the DIW should handle and how. However, there are use cases where they need to be pseudonymized so that they are not linked, and there are use cases where they can be linked separately for administrative procedures. I think we need to consider how to classify them. Once we have classified them, if we can clarify which ones will be considered this time, it will be easier to discuss the technology.

Chairman: Is there anything else I can do for you?

Committee Member Itakura: Committee Member . Where the risks lie naturally differs depending on to whom and what is presented, but when an attack on an Issuer is dangerous, the Verifier who presents it may cause financial damage to the person himself, which is probably the highest risk, I think. The fact that a fake Verifier can be easily made is a different story, and it means that reliable information can be easily obtained rather than financial information. As reported on the news yesterday, there was a case where a fake QR code was posted on a train and the information was extracted. If it becomes possible to easily participate in Verifier, such a thing can be made even easier, and I think that allowance is needed.

As I may have mentioned last year, the bad guys completely ignore the law and try to come up with the most efficient way of attacking. In this context, we need to design the system so that it can properly deal with the people who are the least strict. A financial institution and a telecommunications company were attacked by a group of people who were the least strict. We should learn from this experience.

In addition, I think we will hear a lot from business operators. When a business operator wants to confirm attributes or make a identity verification, of course, the excuse that one cannot do it because the cost is high, I think it is good to listen to the story. This one also has the effect of reducing risk. The other type is, to be honest, there are people who want to see even strange users come in, so to be honest, no matter who you sell to, you will get a commission, so there are platforms that don't make good identity verification and want to take a commission in addition to the shop. What those people say is unfair from the beginning, so it is inappropriate. In short, I think there is no need to listen to all the business operators flatly unless you take an attitude that it is not necessary to reflect them. That's all for now.

Chairman: Thank you very much. In light of your remarks, I think it would be better to clarify a little more about where the goal of this meeting should be decided before proceeding with the meeting. This is a change from the previous meeting, but as the topics are gradually expanding, I would like to see the secretariat's draft of the goal we are aiming for. After that, we will discuss whether the goal is good or not, and then we will discuss what to do in accordance with the goal. With this approach, I hope we can improve the resolution. It is quite difficult every year, but please take care of it.

Secretariat (Nakagawa): Thank you very much. Regarding the "Points for Discussion" on page 34 shown on the screen, as discussed earlier, for example, the use case of saving once and showing it again is technically different. If all of these are included, it will be difficult to reach the point where we should start first. In the sense of creating an island to which we can attach to a certain extent, I think it is important to start from this point.

In that sense, what you have just discussed and the types of risks are presented in a general form, and examples of technical operations and measures for each of them are shown on the right. Examples include "linking VCs and Holders," "data management within the Wallet," and "ensuring unlinkability." What methods are necessary to promote appropriate technical and operational measures? Also, as in the opinion you mentioned earlier, for example, when showing a copy of a certificate of residence, it is not necessary to show that the person submitting the certificate is that person. When we focus on such cases and consider examples of technical and operational measures, if we were to say, in such cases, what should be done technically, and how guidelines or other operational aspects should be bound so that they can be useful, I think it would be good to have discussions on these points.

Next page, please. While the main focus will be on technical and operational measures, there are public and high-risk use cases to prove individuals' attributes and qualifications, as well as cases that are outside the scope of consideration for Digital Agency. For example, cases that will be publicly announced and cases that will have a significant impact. I think it is advisable to create islands to take advantage of from there. For example, copies of residence certificates have been mentioned several times, but I would like you to discuss this while keeping in mind that there may be cases where confirmation is quite critical. Even if there are no institutional restrictions, if the ecosystem will be established in a "low-cost, simple, and rapid" manner, function will be able to do so without making too many decisions, without excessive decisions by government offices, and without making heavy technical decisions.

I have arranged the points of discussion on page 37, but I have broken down each of 1-1, 1-2, and 1-3 a bit. When considering public use cases, there is a need to encourage appropriate technical and operational measures to promote this, and guidelines are written as an example. If they are guidelines, it is important to show the contents and create them. When we were discussing, I am function of Wallet, which handles public VCs. I think that Issuer eligibility verification and Verifier eligibility verification will be created from their respective perspectives, so I think that it is important to consider this. The scope and positioning of this may appear in point 1-2 of the discussion point, and with regard to 1-3 this time, in that sense, after the review meeting is held, it will move to the technical working group, so I would be very grateful if you could discuss what you would like the technical working group to discuss in particular, and what you would like to convey to the technical working group in the form of homework.

I will also introduce the next page. If the guidelines are to be developed this fiscal year, I think it would be a good idea to summarize the outline. On the right-hand side, there is a table of contents for the guidelines. In the "Introduction," there are basic concepts, recommended requirements for risk management, reference information, etc. When you use these as use cases, I would like you to create an outline of whether there are recommended requirements for risk management. I think this could be your goal for this fiscal year. As for the content, we will continue from there, but I thought it would be one idea to have discussions on these matters and present them in the guidelines, which is what the secretariat is presenting. If I explain more, it will be too long, so I would like to do it in this way to some extent. What do you think? I would appreciate it if you could discuss this point.

Chairman: Thank you very much. I think the video you are showing now is the most concise report on the goal. Does anyone have any opinion on the goal?

What do you think, Dr. Nakamura? I think there are various things, such as his order being a little too vague, and wanting a little more clarity.

NAKAMURA: As for the way to summarize and proceed with the discussion, I believe that we will have in-depth discussions in the form you have just explained. Concretely speaking, you have presented two use cases in this handout, but if you divide them into several cases and give detailed use cases that we particularly want to discuss this time as the subject matter, based on that, from each point of view, I think it would be easy to discuss to what extent we need to study and to what extent we need to consider risks. In that sense, what kind of use cases do we assume? I think it doesn't matter if they are fictitious, but if there is no sharing of that, I think it will be difficult to have discussions with the committee members with a shared awareness. If you could spend some time on that, I think we will be able to prepare for the technical WG. At this point in time, we have not been able to sort out specific viewpoints.

Chairman: Earlier, there was a suggestion that we should classify cases. Do you have an idea to some extent at this stage about the categories in the case of classification?

NAKAMURA: In that sense, I think at least five or six points of view will be presented from the perspective of using the mechanism in a simple manner. I think it would be good to start by discussing how it works in a simple situation in each category.

Chairman: Thank you very much. Your hands are up. Mr. Taki, please.

Committee Member Taki: Thank you very much for your explanation. I would like to say that I had in mind high-risk use cases like the one before, and I would like to share what I had in mind.

For example, even if procedures are conducted under high intensity for high-risk cases, including situations where the person is manipulated, has his or her weakness seized, or is under manipulate, I believe that until the very end, ordinary people's sense of risk has an aspect that the risk does not become zero, although this often happens with investment fraud and the like. Private sector businesses basically draw a matrix of calculations of the probability of occurrence and the maximum damage when it occurs for a risk, and make decisions such as not taking this risk, or daring to take this risk, or taking measures when the balance is not good. Therefore, rather than taking a flat view of only high-risk areas, I think it is necessary to look at it from the perspective of whether the damage can be controlled. I think it is better to consider one very low-risk case. To give an example, for example, what is the credential that allows a person to borrow up to five books at a library? I think the greatest damage will be to places like five books. I think libraries are responding to this rather loosely. Therefore, I think that it is often operated based on the multiplication of whether damage control is performed within the overall framework and on-site operation. I think that it is better to see at least one light point. That's all.

Chairman: .

Committee member Yokota: : Thank you very much. I also have something to say about this point of view. When we had various discussions at the previous meeting, there was a discussion that if we do not advance legislation for the situation where administrative agencies receive the documents, it will be difficult to expand the application. In particular, it depends on whether or not privately issued documents can be included in the scope this time. For example, for communication between local governments and national agencies, or for utilization of various AI agents in local governments, it has been discussed that it is very difficult to confirm the credentials, so there would be considerable merit in that. For example, in order to determine the priority of nursery schools, etc., various things are done using AI, and I would like to ask whether the guidelines include a system for such a place of acceptance or a concept of what kind of things can be accepted. Also, since it is necessary to make amendments to the law or the ordinance Amendment, I would like to provide some points of discussion on whether or not to include such discussions. That is all.

Secretariat (Nakagawa): Thank you for your comments. As for laws and regulations, we call it a matter of law. When we negotiate with Cabinet Legislation Bureau, we are often asked, but it is a matter of law that we can determine the matter by reaching the point where there is no other choice but to determine the matter. If the matter is already protected by technical measures and other measures, as well as by the customs of private sector, it is sometimes said that we should do it there. A law is said to have the minimum and only effect, so it is inevitable that the main purpose of the law is to implement it. In that sense, even if we start with it, I think it is one of the guidelines.

As we discussed, there is an example of a copy of a certificate of residence as shown on page 17. We are discussing this issue in cooperation with Ministry of Internal Affairs and Communications. Common use cases include various use cases, such as showing all family members, showing who is in the house, requesting subsidies, submitting the application to the city hall by, for example, the head of the household. The head of the household is, for example, My Number Card, and it is the case that the head of the household submits his / her own certification in addition to the attribution certification. It may be possible to consider what kind of surrounding technology is necessary for the case where the head of the household is like, and it may be possible to consider what kind of surrounding technology is necessary for the case where the head of the household certifies himself / herself in addition to the attribution certification. With that as one of the pillars, for example, if there is a case where the certification of the head of the household is not required, I wonder if there is an example of creating an outline of guidelines in which this and this are omitted.

If we were to make one theme, how about a case where the head of household holds a certificate of residence for all family members and applies for a subsidy, child allowance, or something like that? How about holding discussions while creating such pillars and holding discussions in such a way that what is needed is not needed?

Committee member Yokota: As this is the first meeting to be open to the public, I would like to say that I would like discussions to be held in such a way that it is clear that selective disclosure, as in the current situation, or completing proofs digitally, are quite beneficial for citizens, the government that receives them, and others who deploy them. If legal amendments or the ordinance Amendment are necessary for this purpose, I basically think that discussions should be held in a direction that will not be hesitated. However, I do not think it is immediately necessary. However, as a start to such discussions in the medium to long term, first of all, the appropriate lines should be clearly indicated in the guidelines, and then there should be people who will use them. Otherwise, there is nothing we can do. That is my understanding. That is all.

Secretariat (Nakagawa): Thank you very much, Professor Yokota. You are exactly right. If a law is necessary when considering a certain issue, I believe that government and ministerial ordinances and laws can be adopted. In that sense, I would like to start by considering some kind of use case. Thank you for your opinion.

MATSUMOTO: Commissioner Yokota mentioned the medium - to long-term perspective, which is another point of concern for me. I understand what he is trying to say. I understand that he wants to do what he can do without revising the law and make sure that it will be accepted by everyone. I think it is quite dangerous to do Can-Be without thinking about To-Be. I think it is necessary to point out that To-Be is To-Be and everyone is going in this direction. I wonder if we are not going to discuss that. Speaking from an extreme point of view, I think it would be good to have a law like the 2005 e-Document Law, which is a package law and enforces the use of VCs for all qualifications. The 2005 e-Document Law is a package law that allows the digitization of documents that are obligated to be stored in the private sector. We have promoted a law that enforces the use of VCs for all qualifications. However, this law alone does not promote machine-readable digital documents. As a result, just like paper documents, they can only be confirmed by human eyes. In order to move to the next step, we need to make it possible to process automatically. We are thinking that it would be good for To-Be. This may not be the point of discussion.

Chairman: . Is it still possible that Mr. Fujie raised his hand a little while ago, or is it your view again?

Committee Member Sakae Fuji: , I brought this up once again.

Chairman: I see. Then please say it. After that, I feel like I'm keeping Committee Member Matsuo waiting for quite a while, so please go in order.

Committee Member Sakae Fuji: Just one quick thing. I think it's good to have the guidelines as a goal, but I also feel that we need to make it clear to users that Verifier or Issuer is complying with the guidelines and operating the system. Especially, as you mentioned about the AI agent, unless we create a state where people can make mechanical judgments other than qualitative feelings, in the world of so-called non-human identity, we may not be able to work. This may be something the technical working group will consider, but I think it would be good if guidelines are created that go that far, and if the goal is refined so that it can be developed along with a mechanism that can enforce it. That's all.

Chairman: , thank you very much. Mr. Matsuo, thank you for waiting.

Dr. Matsuo: Thank you, Ms. . However, I would like to ask about the points raised by Dr. Yokota and others, which I would like to duplicate. In the first place, when creating the guidelines, how to enforce them and whether or not they will be used by the public are very important. Since you have already mentioned this, I have very little to add, but for example, depending on who implements the guidelines, whether the government, local governments or the private sector implements them. There are use cases in the public sector, use cases in the private sector, and use cases in the public and private sectors. In this context, there are different implementers, and if their viewpoints are not aligned, and if things that are recognized differently are implemented under the premise of cooperation, it is completely obvious that this will become a source of future conflict. In that sense, for example, if these guidelines are prepared by the public sector at the national level, the local government, or the private sector, how they will be utilized, and whether they will be included in the procurement standards, these points are taken into consideration to a certain extent when creating the guidelines, or when making a law at once for the dissemination of the guidelines, it is obviously beautiful, but it will take a long time. Even if that is not the case, how these guidelines will be received needs to be considered carefully before the guidelines are issued. That's all.

Chairman: . Committee Member Kasai, please.

Committee Member Kasai: Thank you very much, . I also have doubts about the desirability of ecosystem function even without the restrictions of the legal system mentioned earlier. The public sector is fine, but as I mentioned at the previous review meeting, the more the private sector works hard to spread the system, the more the perspective of the Antimonopoly Law comes next. Convenience stores are in a state of oligopoly, so I am concerned about the point. From that perspective, of course, guidelines that are not covered will be the goal, and from the perspective that it will be easier to spread the system if a legal system is created, I think there will be such a point of view. Therefore, it is desirable to have function even if there are no restrictions, but I would also like to comment from the perspective that such a point of view will arise in the private sector as well, although I think there will be differences between the private sector and the public sector regarding when a legal system is necessary.

Chairman: , thank you very much. Mr. Kasai wants to disclose relatively specific attributes selectively. It may sound strange to say that it is urgent, but you are asking if the data you demonstrated about two years ago has not been completed yet.

Committee Member Kasai: Thank you very much, That's right. On the reading side, I would rather do a identity verification such as a VC. On the reading side, alcohol and tobacco are being considered, but I wonder if the rules for reading are the same for all convenience stores. This becomes an issue when realistically considering a business. I think it would be good if it is public, but when the private sector finally wants to spread it, and when there is an oligopoly, it will come out there. Therefore, depending on the case, a certification system or something like that may be necessary.

Chairman: Thank you very much. If you have a concrete image like that, it's easy to think. Committee Member Itakura, please.

Committee Member Itakura: Committee Member : It's not that I can't work as an attorney without a law. Among the risks I have already mentioned, even if it is issued by a public agency, a wallet will be issued. There is a question as to whether the wallet will be permanent. Dr. Itakura: This is not that I can't work as an attorney without a law. Among the risks I have already mentioned, even if it is issued by a public agency, a wallet will be issued. There is a question as to whether the wallet will be permanent. Dr. Itakura: This is not that I can't work as an attorney without a law. Among the risks I have already mentioned, even if it is issued by a public agency, a wallet will be issued. There is a question as to whether the wallet will be permanent. There is a question as to whether the wallet will be permanent. There is a question as to whether the wallet will be permanent. Even if there is something subtly included in the Act on the Protection of Personal Information, even if it is based on an electronic format, it has to be submitted on paper. However, although it is based on an electronic format, it has been requested to be submitted on electronic format. However, although it has been submitted on electronic format, it has been submitted only halfway. In Japan, there is no such thing as the right of Data Portability. When there is no such thing as is based on data portability without a law. I am an attorney. I have already mentioned. Although there is an electronic format, there should be issued by a public one. This is whether there is no such thing as an electronic format. This is because there is a data portability since there is a law only because there is a law in Reiwa one, even if there is an electronic format. Although there is a problem whether there is a portable.

The other issue is related to the Antimonopoly Law, which was mentioned earlier by Commissioner Kasai. Even forcing security in the supply chain is not a problem related to horizontal cartels, but rather a problem related to the abuse of a superior bargaining position. Japan Fair Trade Commission has issued something like guidelines, but as I mentioned earlier, this mechanism requires raising the minimum level, and everyone must comply with it. Whether or not complete legislation will be established, at least it will not be an abuse of a superior bargaining position. The security of the supply chain must be comprehensively ensured. Therefore, I would like to point out that there is a mechanism that would not constitute a violation of the Antimonopoly Law. That is all.

Chairman: , please.

Dr. Sakimura: Thank you very much, Mr. . Many people have already mentioned this, and although there are some overlaps, I think we should do light use cases. EU Digital Identity Wallet But that's why we need to start with age verification. We are currently working on it lightly, but that is part of the work. From the children's point of view and from an international perspective, age verification or age electronic verification is very important now. We need to work on it properly by selective disclosure. This has been discussed very seriously and international standards have been issued. I would like you to think about it.

Also, the authentication of wallets is quite a problem. Even if selective disclosure is possible, unless we can show the person why the information is necessary in a sufficient, concise, and easy-to-understand manner, selective disclosure has no meaning at all. In addition, it is almost impossible for users to judge whether or not data minimization is working properly, such as whether or not what the information provider or relying party requests is appropriate. Therefore, what to do about that is currently being discussed actively in the Internet Identity Workshop, so I think it would be better to consider this point of view, even if we have to consider guidelines to some extent. The system did not go very well, but the accreditation system for information banks includes quite a few things such as how to display the requirements, so I had the impression that it would be good to proceed while referring to such things. That's all.

Chairman: . Here, I believe that you have received prior opinions from Mr. Wakae, who is absent today. Could you introduce him to us from the secretariat?

The Secretariat (Sawada): I would now like to read out the comments received from Mr. , Commissioner for Wakae.

"Hard law regulation (including co-regulation with sanctions for non-compliance) should not be off the table. The ideal is for the ecosystem to work well even if there are no national rules or systems. If distrust spreads, it may not become popular. On the other hand, Google and Apple's Wallet, which are major and secure, may be used intensively and monopolize the market. This would be different from DIW's goal of regaining control of data from the hands of platforms.

The function of a private or public certification system would be the best, but the function of a certification system is limited to the case where consumers wish to choose a safe and secure system. As the example of the information bank shows, it has been pointed out that services related to risks in data, which are invisible to the eye, are difficult to function the certification system. Furthermore, in the case of a service that is convenient but supported by difficult technology, such as DIW, consumers do not know where the risks are and may not care about the certification. Therefore, there may be no incentive for vendors to obtain certification.

There are also proposals for existing laws, but at least it is difficult to deal with the privacy risks of DIW under the Act on the Protection of Personal Information. For example, in order to minimize the acquired data through selective disclosure and to prevent tracking, it is important to take measures such as the adoption of zero knowledge proofs and the random issuance of signatures. However, the PPI Act has no legal basis for enforcing these measures. The data minimization principle of the GDPR is strict that "only the minimum necessary for achieving the purpose may be handled," and if you sell alcohol, you can only obtain data on people over 20 or under 20. However, in the case of the Japanese PPI Act, if only the purpose of use is specified and notified and published, even if a wide variety of purposes (including those completely unrelated to the original purpose) are set, it is possible to handle for that purpose. The consent of the Principal is not required. Furthermore, the PPI Act's rules such as restrictions on the purpose of use and the obligation of proper acquisition cover "personal information," and the information obtained by the verifier in the DIW does not necessarily correspond to personal information in many cases. Even if it falls under the category of "personal information," the PPI Act's regulations on personal information are limited to obtaining consent when it has been changed into personal information by provision to a third party.

A wallet provider accumulates a large amount of information, but at present, if the wallet provider specifies the purpose of use in the terms of use, etc., it is possible to use it for purposes completely unrelated to the original purpose of use. If an oligopoly of Google and Apple arises in the future, options decrease, and a situation arises in which various digital services cannot be received unless the DIW is used, wouldn't it be necessary to prohibit the use for certain purposes that are different from the original purpose?

Regarding the use cases to be examined, if it is assumed that the certificate is received by the government, it may be difficult to imagine the misuse of the verifier, and it may not be appropriate to verify a wide range of risks. A wide range of use cases should be covered in anticipation of future expansion of utilization.

In addition, I feel uncomfortable about the setting at the beginning, "' being able to implement at low cost, easily, and quickly' is important." The reason why DIW is drawing attention around the world should be "user-centered digital identity management," that is, the expectation that control of data that has been in the hands of platforms can be regained. Even if that is not possible, even if it can be used "cheaply, easily, and quickly," it is like putting the cart before the horse. In this sense, the protection of users' rights and interests is important, and "safety" should be added to "cheaply, easily, and quickly." "

That is all. Due to time constraints, I have read a somewhat lengthy portion in rapid speech. To briefly summarize, we believe that questions have been raised regarding the necessity of some kind of method, primarily from the perspective of a wallet provider, as well as the need for "something cheap, simple, and fast" to ensure a certain level of security. The secretariat introduced the views of Committee member Wakae, who was absent.

Chairman: Thank you very much. With this, your request has been covered for the time being. It is very difficult to summarize everyone's opinions related to the goal image I received today. Depending on the use case and situation, there are likely to be various variations in how it is used. The idea of identifying all the risks of all the variations and responding to all of them is a difficult and hard-edged idea. These use cases will be divided into areas with very high convenience, areas with very high risk, and usage patterns, and we will discuss how to create guidelines in these areas. After we sort out what the variables are, we will consider what kind of risks are involved in its usage, and what kind of guidelines are necessary to respond appropriately.

In this context, there are quite a few use cases in which age verification is selectively disclosed while using residence certificates, so I would like to consider such cases in detail. However you look at it, it is very difficult to imagine that comprehensive guidelines will be written this year. Therefore, I would like to focus on a rough map of the overall picture, and those areas that are highly convenient and have such a risk that it would be better to move them as soon as possible. How should we think about the risk? There are various players and people who receive it. There are verifiers, issuers, and relying parties. What kind of obligations should be imposed on each party? In addition to guidelines, should we do something like certification? That is what we should do. We should discuss that, create a concrete image, and make it this year. That was the general flow, I felt. What do you think?

Committee Member Kasai: Thank you very much, . Although I think it is very difficult to summarize them, when we use published guidelines and how to disseminate them, it is still difficult even within the company to understand VCs and digital certificates. Therefore, when some kind of guidebook or guideline is published, at the same time, I would like to ask the users to draw out the business operators who are trying hard to do it now, and although it is not an event, I would like to ask you to do something like popularization activities. In such a context, as I mentioned earlier, there will be discussions about equipment, and I believe that all the players should be involved in the study, so I would like to ask people close to the consumer side to liven up the use scene.

Committee Member Itakura: Committee Member : What you have said is that I think it is better to write in 1-1 of the "Introduction," and since the raison d'etre of Digital Agency itself is digital-first, ultimately, as long as we do this, we will eliminate paper and make it this one, and I think it is a good idea.

Another thing, if I were to say that it did not appear, it would mean that the digitalization of the certificate of residence would be taken by Ministry of Internal Affairs and Communications, but the idea of obtaining a certificate of residence through eKYC was a matter that was disputed in court, so it was decided that it was no good (Tokyo District Court, December 8, 2022, Hanji 2608, page 27). Moreover, during the trial, even the ministerial ordinance was revised and it was judged useless. I thought it was an amazing thing to do, but in hindsight, eKYC has been increasingly attacked, and now we are talking about stopping it due to money laundering. In the end, it was appropriate, but if that is the case, I think the underlying reason is that we want people to use the information on their resident certificates with a level of certainty that would say no. Even at the stage of acquisition, it is information that you can not acquire unless you make a considerable identity verification. For some reason, I read to the end and am not convinced that mailing is good, but it is based on the premise that it is done at that level of feeling (easy distribution will not be accepted). I may be saying this in a disdainful tone, but in any event, the bad guys are the ones who ignore the law and attack everyone by throwing all their strength at the place where it is most profitable. As a result, at the border of Cambodia, the bad guys think that there is a Japanese who is being held captive. The real enemy is the worldwide mafia, and if you know how and by whom profits are made, you just throw everything you have at it. The lowest line must be designed to be safe, and it must be digital-first. The number of workers will decrease and costs will rise. If we don't do this, no one will be able to survive. My Number Card has gone to extraordinary lengths to force adoption, and the result is that Public Personal Authentication is managing to work in a lot of places, until a certain threshold is reached, and then it takes off. Of course, as Commissioner Kasai mentioned earlier, there is the question of what to do with the equipment, but if software can solve that, since everyone has smartphones, I think we will continue to do this while keeping an eye on that direction. However, in this 1-1, I would not say that "digital first" is my ultimate goal and that we should do it next year, but I think it would be better to write that in the 1-1. Yes, that's all.

Chairman: Thank you very much. Anything else?

MATSUMOTO: I think use cases are important. The stakeholders involved change depending on the use case, so in a sense, there are many things that need to be considered, such as how to respond to use cases. Among them, I am not personally interested in certificates of residence, or rather, my question is whether people have certificates of residence in the first place. The point is that I can prove myself in My Number Card, and I also need information on households. This cannot be done under the current law, but I think it should be possible to ask companies to push My Number information to them on a voluntary basis based on the My Number Act. I have been thinking for a long time that this would be the solution, and that is back-office collaboration. Front-office collaboration is the VC's method, but I don't know which one is better at this stage. Including that, I feel that what we should aim for is more cooperation between the private sector and the private sector, which is the original goal. Going back to the topic, we need to consider both what we can do now and what will happen in the future.

Chairman: Thank you very much. Eventually, something like official certification for use by the private sector is naturally coming into view. Rather, he is saying that it would be better to start with that.

MATSUMOTO: checkpoint. We have not discussed the goal, and everyone has a different way of thinking about it.

Chairman: On the other hand, when it comes to communication between government officials, back-end collaboration may be better.

MATSUMOTO: That's right, I said that last time. The Once-Only Principle is exactly like that. In Europe, there is a Once-Only Principle, right? That is exactly because administrative bodies themselves should not exchange resident certificates like this at the front desk, so the original idea was. There may be cases now where it's better to do it as a VC, actually, just not sure if that's the goal.

Chairman: I think we need to have a number of specific use cases in mind and have them consider it. At that time, the government officials said that they would like to use an official certificate for the private sector.

Office (Kusunoki): So it is a use case of private and public for the private sector to carry out the duty imposed by the government.

Chairman: I think that is bigger. Personally, I also have that feeling quite a bit.

Office (Kusunoki): I completely agree with that. This is a place that obviously cannot be covered by the information provision network system, so I had high expectations for it.

However, there are some reasons why the government is used as the subject. It cannot be done unless it is for oneself. In particular, since resident records have historically been used as equivalent to identity verification documents, there are quite strict requirements such as those that must not be made, and those that must not be made. This was discussed at the Ministry of Internal Affairs and Communications Study Group. In terms of the use cases for private and public sectors, including the rather strict requirements, the use cases include grade certificates and company registration certificates. Or, when changing jobs or entering Digital Agency, I wonder how many Excel forms I am forced to fill out. I joined the Civil Service Agency in the midst of a digital defeat, so I would like to get rid of it. I don't think ordinary people can write it correctly every year. I wonder how many and what percentage of Japanese people can distinguish between income and revenue. I think it is really amazing that the General Affairs Department makes them write it properly for the year-end tax adjustment. As you say, the final point is to apply it to the private sector, which is a major scope, but it will not be convincing unless we take it as our own responsibility. In this sense, it includes scenarios of the public sector and government officials. I think you are right.

Chairman: In this case, too, there are stories of VCs issued by the government and stories of VCs accepted by the government. A VC that the government thinks it can accept has a high level of sense of level. If it is set at that level, it can withstand even a general-purpose one. If we use that as a standard, it will be too strict and we should consider the case that it will not be useful.

Office (Kusunoki): To be honest, it should be something that is so light that even the private sector would want to imitate it, and I would like to see it to the extent that it can be made into a reality. About two years ago, at the time of the digitalization of the disposition notice, etc., the requirements were expressed in words, and there were actually many ways to realize it as simply as possible with as little cost as possible, and we were working on more than just digital signatures. However, we set the requirements quite high, and with special infrastructure, we will not be doing it in a way that only the country can do. Rather, we will do it in a way that anyone can easily do, even for the issuance of receipts. I hope that we will be able to go so far as to satisfy these requirements.

Chairman: Thank you. Is this enough to get Dr. Nakamura started?

NAKAMURA: ? I wish there were more materials.

Chairman: What kind of material do you want? Is it a use case?

NAKAMURA: Well, I want a use case. Also, the graduation certificate was mentioned earlier as an example, but the starting point would be to consider making a digitalization at a level where you can make it but you have to believe it, such as confirmation of the current graduation certificate or confirmation of the diploma. Or, if we make a digitalization, we would like to make something that is reasonably reliable. This is the direction we are taking. If we want to make something that is highly reliable, such as suddenly having everyone sign it, there needs to be evidence that this is something that must be done institutionally, otherwise it will be difficult to move forward in the world. So, whether it is okay to end up discussing the VC / DIW as a thought experiment, or whether we should all start discussing it together with the aim of making something that will be useful in the world in the future, I thought I would like to discuss this with a certain degree of consensus.

Chairman: They want to use it at the end.

Office (Kusunoki): Paper is quite sloppy, isn't it? It's hard to say whether it will be accepted with the same sloppiness when it's digitized. It's easier to copy and rewrite than paper, so I have a feeling that people will want to seek a slightly higher level.

On the other hand, we are responsible for the Electronic Signatures in Global and National Commerce Act, the Electronic Power of Attorney Act, and so on. In the quarter-century of the e-Japan, we have seen that even if it is too strict, it will not easily spread. Therefore, we are wondering if it can be made lighter. For example, although the image may be good or bad, when SSL has spread, it is being used properly in banking transactions and other fairly sensitive use cases. There are various problems such as phishing.

As for commerce, various fundamental protocols for AI agents have been introduced. As seen in A2A and the Agent Payment Protocol, digital signature technology has been introduced at the protocol level, and we are now in a world where trails are clearly left behind. Regarding this responsibility demarcation point, there is no guarantee that legal matters will not emerge in the future. However, I believe that there will be many areas where interpretation alone will be sufficient to resolve the issues that cannot be resolved through interpretation or application of the current law alone. If the issues that cannot be resolved through interpretation or application of the current law are clarified here, I think it will be an opportunity to firmly take on these issues. Based on discussions with stakeholders on whether or not social confusion will be caused by clarifying the requirements, arranging what is desired, and keeping the people on the sidelines, I would be most grateful if a system that eliminates paper can be established in such a way that it can be equally used by all residents, not only in Japan but also around the world, rather than a system in which only a few people can use it, and such a system becomes universal in a certain way or can be spread without difficulty.

Secretariat (Nakagawa): Based on your discussion, I think it would be good to have use cases that would expand to the private sector as well. For example, as Commissioner Kasai mentioned earlier, when a certificate of residence is received by the private sector, for example, when it is received by a mobile phone operator as a identity verification document, what are the devices when they are received? What are the use cases? How about focusing on the time when a certificate issued by the public sector is received by the private sector, and then seeing how it spreads to the private sector?

Office (Kusunoki): Municipal Office receives documents from the private sector. Receipts come in at the time of filing income tax returns. Since there are so many relationships between the private sector and the public sector, and between the public sector and the private sector, I think there will be various typical cases where a lot of paper remains. Therefore, I think it would be good to expand the use cases and deepen the discussion, although it may not be clear until the next time. Although we have made a digitalization, we have not run out of paper at all. I hope we can organize them while receiving opinions on specific use cases.

As it happens, the resident card issue has just been handed over to us at the review meeting in Ministry of Internal Affairs and Communications, so we need to sort out this issue thoroughly. However, there are many other administrative procedures that bridge the gap between the private and public sectors. For example, when a private citizen changes jobs, a bundle of papers can cause a serious problem. There may be some things that can be solved and some things that cannot be solved. However, I think it would be good if we could put those who are in trouble and hopeless as much as possible on the table.

Chairman: Then, there are various things as expected, but I think you all have a common understanding of what we should discuss and what we should aim for. From there, at the end, under the responsibility of the ordering party, proceed with this. If you have an image after the discussion, what kind of image it will be when it is materialized in that frame, what kind of guidelines can be assumed, and later on, whether it has versatility will have to be verified again. However, if you first draw a map of what kind of patterns there are, and say that there is a very high need at this point, so please try it here, as the responsibility of the ordering party, I felt that the discussion would progress more easily, so I would appreciate it.

Can I give it back to the office?

Office (Kitainoue): Thank you very much.

Prior to the closing of the meeting, the secretariat will make an administrative communication. The opinions received today, including the points just summarized by the Chair, will of course be reflected in the agenda for the next and subsequent meetings or in the discussions of the Technical Working Group. In addition, today's proceedings will be published on the Digital Agency website after being confirmed by the committee members later. In addition, the next meeting and the holding of the Technical Working Group are scheduled as described here in Material 3, which is currently being projected. I will omit the specific explanation because it is a little past the time, but I would like to ask for your continued support.

That's all I have for administrative communications. In closing this plenary session, on behalf of the secretariat, Mr. Digital Agency, Mayor of Group of Common Functions for Digital Society, and Mr. Kusunoki, will say a few words.

Office (Kusunoki): Thank you very much for your lively discussion.

I was really looking forward to today, but since the date just happened to be the day after my appointment as Minister for Foreign Affairs, I would like to attend the meeting only for the day. I would like to thoroughly review the meeting minutes later.

The opinions we received today will be passed on to the technical working group, and we will work out the specific technical requirements we are seeking for VCs and wallets. After that, we would like to hold this main meeting again.

Looking back on the discussions of last year and the year before, at the beginning of e-Japan, operations such as downloading and uploading were easy to perform on PCs and browsers. However, with the advent of smartphones, there was a problem of how to do this within a touch UI, and it suddenly became difficult to bundle and present things. These issues had to be dealt with by Wallet, and since it was necessary to be able to verify the authenticity of the paper that was being inserted into Wallet, there were discussions on how this could be used to eliminate paper, while also controlling currently emerging technologies such as VC and mdoc.

In addition, since the introduction of minor working, I have been involved in various activities that were originally intended to link back offices in the public service mesh. However, due to institutional barriers, unless information is linked through the principal or in some other way, for example, 4 information cannot be distributed to the information provision network system. In addition, as soon as the code conversion mechanism is introduced, family registers and resident certificates, which show the relationship between multiple people, protect privacy, and there is no mechanism for smooth communication. Commissioner Matsumoto raised the issue of whether back-office cooperation should be done or whether the front desk should be involved. However, this is exactly what was vaguely intended as back-office cooperation when discussions were made around 2020. However, Digital Agency has not been able to do this properly in most cases in the history of the past few years. To this end, institutional reforms will face various obstacles. At the same time, what can be done through back-office cooperation is, after all, only exchanges between the government and the public sector. In terms of paper for procedures, the private sector comes in. Since there are so many private, public, and private sectors, we have renewed our recognition that a mechanism including the front office is necessary for how to change things upstream.

This year, the Open AI announced Atlas, and before that, the AI commented on Perplexity, so I think this year will be the first year of the AgentBrowser. I think this is quite a scary story, and my various credentials are accumulated in the browser, and the AI can tap all of them for me. This year has become a kind of year when the human race passed the gate to the AI. Probably, it will become normal for everyone to keep their residence certificate and other things for the AgentBrowser to process them in one-stop. It is a reality that some people will file their final tax return using a AI browser. I think various accidents may occur, so I am not going to settle it, but I think it is very important to discuss various tasks safely to a certain extent, while slightly anticipating what will happen in the future 10 or 20 years from now, for humanity to properly navigate the AI. It is the most important to produce concrete output and bring it to a point where I wish I had discussed properly at that time. I would like the committee members to continue to support us. Thank you.

Office (Kitainoue): Thank you very much. With this, we conclude the first meeting of the "Advisory Council on Organizing Issues of Attribute Certification". Thank you very much.

Greater Than