TTS seeks ID management partner

The head of the General Services Administration's Technology Transformation Service wants to tackle one of the toughest issues in federal government, identity management, in a long-term project that could yield a common shared service for agencies.

"It's a game changer," Anil Cheriyan, TTS director told a Dec. 11 conference audience in Washington. "I call it my Mt. Everest project."

This past summer, Cheriyan and TTS singled out identity management, as well as robotic process automation, as possible new core areas for TSS' Centers of Excellence. Identity management is a core need for agencies such as the IRS, the Department of Education and the Social Security Administration, but has been a tough issue because of the different ways agencies have approached it, as well as the policies surrounding it.

Although GSA has login.gov, which lets federal users log onto many government websites with one email and password combination and incorporates two-factor authentication, Cheriyan said he wants a more-comprehensive framework for identity management across government. GSA, he said, doesn't want to own the ultimate result, but wants to facilitate the development of the capability.

"We want a fair amount of partnership between industry, TTS and the agencies," Cheriyan said, acknowledging that the effort could take years to develop. "We don't view ourselves as the competition. We don't want to grow our team of 300 people. I don't want to be a Booz Allen. I want to be the core group that helps" manage the process.

Cheriyan told FCW that TTS is "actively looking and having conversations with the financial services industry," which already has significant interests and capabilities in identity technologies and security practices.

Before coming to TTS, Cheriyan was CIO of SunTrust Banks.

"There's a lot of critical cool work that is going on in [the financial services] space," aimed at preventing and tracking electronic crime such as money laundering and fraud, he said.

Cheriyan said a single agency could champion a core framework for capabilities and move the effort forward within government.

"We need to get the agency head behind it," he said. "This is going to take some doing working through. In the end it's a matter of using the [National Institute of Standards and Technology] standards on identity to resolve the different levels to build a common framework of what it will look like."

"This is going to be a four- or five-year journey," he said. "One agency could solve the problem on their own, but the real value in government is how you share."

As Cheriyan sees it, ultimately, one agency could take the reins and possibly ultimately offer it as a service to other agencies. The Department of Homeland Security, the IRS or SSA are big enough and have enough experience with identity management to serve as a "base camp" for the project, he said.

"It doesn't have to be GSA. It could be a shared service under one of those and they could be the arbiter of sharing data, of what can and can't be shared," he said. "I don't think getting all these agencies to buy into an answer is the way to start. It's more start with one agency and grow it out," he said.

Cheriyan said the country of Estonia's digital identification system might inform the effort. European Union member Estonia's five-year-old e-residency program allows entrepreneurs in other EU countries secure access to its electronic business portals and information systems to start and manage companies in the nation.

"They view it as a 495 kind of bus," he said, referencing the Washington region's highway encircling the Capital city. In the U.S., he said, such a system could allow federal users to "hop on with IRS give them your credentials, and go off to different agency exits."

He added that he's not wedded to that model, however. "That's just a view. We have to establish what that view is," he said.