National strategy for identity management nearly done

The administration’s national strategy for identity management is undergoing a final vetting by the agencies that will be implementing it and is expected to be finalized within few months, Ari Schwartz, senior Internet policy advisor for the National Institute of Standards and Technology said Thursday.

“We expect the strategy to be signed by the president sometime this winter,” Schwartz said at an identity management conference hosted in Washington by TechAmerica.

The National Strategy for Trusted Identities in Cyberspace, released in draft form in June, calls for an interoperable, voluntary scheme for identity verification that enhances both security and privacy of online transactions and is easy to use. The draft has been revised to highlight and strengthen the role of industry in developing the tools and technologies enabling the strategy, Schwartz said.

Related coverage:

“The importance of the private sector cannot overstated,” he said. “The private sector will ultimately determine the success or failure of the strategy.”

The private sector already is at work on the development of technical standards to support wide scale, interoperable identity verification with high assurance.

“We have already agreed” that the standards will be compatible with existing government standards for identity management, said Dan Combs, CEO of the eCitizen Foundation. Those standards include Homeland Security Presidential Directive 12, which mandated the governmentwide Personal Identity Verification Card, and NIST’s Electronic Authentication Guideline, Special Publication 800-63, which is being updated.

Combs is chairing a drafting committee established by the North American Security Products Organization, a certified standards development organization of the American National Standards Institute. The committee will hold its first meeting in January.

The national strategy is one of the recommendations resulting from the Cyberspace Policy Review ordered by the president upon taking office. The draft strategy noted that “a secure cyberspace is critical to the health of our economy” and that improving the level of trust in online ID authentication is a “key step in reducing online fraud and identity theft.” The goal of the strategy is to provide a secure, efficient, easy-to-use and interoperable solution for accessing online services.

Schwartz said that although wide adoption of such a scheme is needed, the government will not mandate that citizens obtain the digital credentials or that companies require their use by consumers. He described the government’s role as a convener that will support private-sector efforts in developing and fielding the needed technologies.

Schwartz said details of a program management office will be announced with or shortly after the release of the strategy. An implementation roadmap for the strategy also will be released. The president will designate a lead agency for the program, which will work with the White House Office of the Cybersecurity Coordinator in interagency policy development specified in the plan.

Phil Reitenger, deputy undersecretary for the Homeland Security Department’s National Protection and Programs Directorate, called strong authentication for devices, software and people the missing element needed for a secure online environment.

"The current ecosystem was not designed to support the dependency we have and respond to the threats we face,” he said. “Nothing is more important” than the trusted identities program in correcting this.

One non-technical area in which work is needed to ensure a workable ID management scheme across organizations is a legal framework, said Thomas Smedinghoff, a partner at Harold, Allen & Dixon.

“The legal status quo is a major barrier to identity management,” he said. The current legal framework was not developed for a digital environment, and is ambiguous and inconsistent, he said. That does not necessarily mean that Congress will have to become involved in implementing the strategy, however; at least in the near term.

“It is easier if you just have a law or a regulation,” to clarify issues, Smedinghoff said. But getting legislative agreement on a set of rules is difficult, and it inhibits flexibility down the road. He said he that questions initially would probably be settled through the development of contractual language and court decisions.