Why it's time for a pivot on digital identity

The last week has featured two big pieces of news when it comes to what the government is doing to advance digital identity.

On March 2, the White House released a new National Cybersecurity Strategy that flagged the importance of enhanced digital identity infrastructure to improving America's cybersecurity posture. 

On March 7, the Inspector General of the General Services Administration released a report entitled "GSA Misled Customers on Login.gov's Compliance with Digital Identity Standards," that made clear just how far we have to go. 

Let's start with the good news: by flagging digital identity as a critical national cybersecurity priority, the Biden Administration has formally made improving digital identity a core part of its cybersecurity agenda. This isn't a small thing—it's the first time since the Obama Administration that a White House has made digital identity a priority. As the strategy notes, nearly 300 million people were impacted by identity theft in 2021; that means nearly every American has been impacted, with nation-state sponsored hackers and organized crime rings benefiting.  It's time to focus on prioritizing more secure digital identity solutions. 

I was also thrilled to see the strategy embrace calls for the government to take a more active role in addressing shortcomings in digital identity infrastructure, by establishing new services that would allow any American to ask an agency that already issued them a credential to vouch for them online—by validating the information from that credential.  This could take the form of new attribute and credential validation services, as well as mobile driver's license apps that provide a privacy-protecting digital counterpart to physical IDs.

As for next steps, the Office of the National Cyber Director will now be working to create an implementation plan to translate the strategy into action. 

'Depressing' oversight report

In contrast to my optimism about the new strategy, the new GSA Inspector General report is downright depressing. The report lays out in brutal detail how the GSA told multiple Federal agencies who were paying customers of Login.gov that the solution met a key NIST security requirement—Identity Assurance Level 2—for remote identity proofing services.  IAL2 is not just a compliance requirement; in the world of remote identity proofing it is the line between a system that can fend off the bulk of identity theft attacks coming from organized criminals, and one that that cannot. The problem with this assertion: it never did. Furthermore, GSA decided in June 2021 to suspend efforts to comply with NIST requirements—again not telling their customers this had happened, but still charging agencies for the service. 

Reading this report just five days after the National Cybersecurity Strategy was published, I was reminded of another key strategic objective in the strategy focused on shifting liability for insecure technology products and services to the vendors who make them. As the strategy notes, "Companies that make software must have the freedom to innovate, but they must also be held liable when they fail to live up to the duty of care they owe consumers, business, or critical infrastructure providers." 

Presumably, this concept of "duty of care" applies not just to companies—but also to government agencies that are building custom software for other agencies to use. And the IG report makes clear that GSA sadly failed to live up to the duty of care it owed its customers across the federal government, many of whom were relying on GSA's assertions that Login.gov met IAL2 requirements.

So much comes down to trust. Whether it's a hospital buying commercial software from a vendor or an agency buying custom software written by GSA, customers should be able to trust that what they are buying does not have security flaws and that they are getting what they are paying for.

Against this backdrop, the White House may be poised to double down on its bet on Login.gov. Per an article in FCW, a draft executive order envisions that "GSA would be tasked with scaling up its homegrown Login-dot-gov identity verification and authentication services to reach the entire U.S. population." And "Agencies that offer public services deemed "high impact" by the Office of Management and Budget would be tasked with developing plans to add Login-dot-gov as a sign-on and identity verification option"—meaning that the same agencies that were misled by GSA about Login.gov and its identity verification capabilities would now be forced to use it.

A new path for Login.gov

In the wake of the Inspector General's report, I don't see how the White House can move forward with a plan to make Login.gov the centerpiece of their efforts. I am assuming this EO was drafted without the White House knowing of the GSA IG's report. Now that it has been released, it would be unconscionable to proceed down this path—especially in the same month that the White House is highlighting the importance to national cybersecurity that every technology provider lives up to the duty of care they owe their customers. 

Beyond the misdeeds and deception that were detailed in the IG's report, there is also the fact that Login.gov still has not revealed its plans for achieving compliance with IAL2, despite the fact that it was awarded $187 million from the Technology Modernization Fund. If the EO is going to achieve a meaningful reduction in identity theft tied to public benefits, starting with an IAL2 solution is table stakes. GSA has been working on a path to IAL2 for more than five years; they have yet to demonstrate any path to get there.

So where can the Administration go from here? In the near term, vendors who are certified as meeting IAL2 requirements can fill the gap, but that is not the sole basis of a long term solution. What makes more sense is for the White House to rethink their approach to reducing identity theft in public benefits to align with the broader objective outlined in the National Cybersecurity Strategy—one that would invest in digital identity infrastructure that can reduce identity theft and cybercrime in every sector. 

Focusing on a national approach would be more effective and economical, in that it would address the problem at its core. 

It would also align with the bipartisan Improving Digital Identity Act that nearly passed Congress last year, which focuses on closing the "identity gap" between the nationally recognized, authoritative credentials issued today by federal, state, and local agencies—all of which are stuck in the physical world—and the lack of any counterpart to those credentials that can be used in the digital world.  

It's a much more sensible approach for a simple reason: it's the same organized criminals exploiting the same core weaknesses in digital identity infrastructure to steal billions not just from governments, but also banks, health care, retailers, fintech services, and cryptocurrency exchanges. In other words this is not a "government benefits" problem; it's a national problem. 

The White House could fund this work by reallocating some of the Login.gov TMF money to investments in digital identity infrastructure that can be used to better protect Americans in ways that extend beyond government benefits, such as in helping states accelerate their deployment of mobile driver's license solutions that can deliver more secure, equitable and privacy-preserving tools to help Americans protect themselves from identity thieves. 

Rather than force Americans to go through a new government-run process that replicates the in-person identity proofing process they already went through to get a driver's license or state ID card—which is what Login.gov has been trying to do—Americans should instead be given the opportunity to reuse a high assurance credential they already have.

Focusing federal efforts on a more holistic approach to addressing digital identity challenges would also solve a thorny problem for GSA and Login.gov—in that it would relieve them of the burden of trying to figure out how to craft an approach to remote identity proofing that can comply with NIST standards. Rather than try to create their own solution, Login.gov would be just one of thousands of parties that could leverage this new privacy-preserving identity infrastructure. I would imagine in the wake of the recent IG report that this sort of approach would also provide the GSA with some relief. 

When done right, identity becomes "the great enabler"—and as the new National Cybersecurity Strategy notes, the time is now to "encourage and enable investments in strong, verifiable digital identity solutions that promote security, accessibility and interoperability, financial and social inclusion, consumer privacy, and economic growth." As the White House moves forward in its implementation plan for the strategy, the path should be clear.