A cyberattack can interrupt essential services within moments. But the lasting harm is not confined to downtime. What happens when attackers also compromise a person’s digital identity, an administrator’s permissions or the power to approve sensitive actions? Could a different identity architecture limit the damage?
When a child goes missing, even a few minutes can make a difference. How do police, specialist organisations and public alert systems in Slovenia, Europe and the United States respond? And could the QEI research concept support faster, trustworthy information-sharing without turning child protection into permanent surveillance?
From fake online shops, investment fraud and stolen bank details to synthetic voices and AI-assisted impersonation, online scams are becoming increasingly convincing. Could digital identity be designed so that stealing a password, forging a message or manipulating a user would no longer be enough to carry out an unauthorised action?
Can digital identity be designed so that even a breach of an administrator account does not grant direct access to users’ personal data?
The internet can fail. Mobile networks can disappear. A central service can become temporarily unavailable. But a person does not stop being who they are. Should their digital identity stop working as well? QEI explores a different approach: the internet as infrastructure for issuance and synchronisation, but not necessarily as a requirement for every individual proof.
In Italy, three biometric identity cards with their microchips removed with unusual precision were discovered within a matter of days. The cases raise a question that goes beyond the physical protection of a document: what happens to digital identity when its carrier is compromised?
Fraudsters targeting Italy’s Fideuram reportedly used deceptive communications and artificial intelligence to imitate the voice of a trusted person. The result: transfers totalling about €95 million. The case exposes a growing problem: if a person’s voice, image and communication style can be convincingly imitated, what should proof of digital identity and authority rely on in the future?
On 17 September 2026, the European Commission presented the proposal for the EU KIDS Act, aimed at strengthening the protection of children and adolescents in the digital environment. Among other measures, the proposal introduces a common European approach to age restrictions and places greater responsibility on digital platforms. But alongside restricting access, an important technical and societal question emerges: how can a user’s age be reliably verified without requiring a child to disclose their identity to every online platform?
A coach, teacher, mentor, educator or another adult can play an important role in a child’s life and may hold a significant position of trust. But what happens when that very relationship of trust and authority becomes a space for pressure, fear or potential abuse? Digital identity alone cannot prevent this. But it raises an important question: can we provide children with a safe, independent and verifiable path to help that protects their rights and privacy while also protecting the rights of the person who is the subject of a report?
A recent security incident involving Revolut raises a question that goes far beyond one company or one financial institution: how can we reliably verify in the digital world not only where a request for sensitive data comes from, but also who is actually sending it, whether that person is authorized to make the request, and which data they are entitled to access? The case shows that a communication channel can appear legitimate without necessarily proving the identity and authority of the person on the other side.
