Search AFCEA Site

Enable breadcrumbs token at /includes/pageheader.html.twig

States Struggle to Adapt Their Identity Management Under COVID-19 Conditions

The federal government, meanwhile, turns more to research centers for contracting identity solutions.
By Kimberly Underwood
Credit: Shutterstock/Golden Sikorka
Credit: Shutterstock/Golden Sikorka

States across the country are facing challenges around the ability to provide services and benefits during COVID-19. The underlying factor is how jurisdictions can verify and trust a citizen’s identity when the citizen cannot appear in person due to the pandemic, experts say.

“On the states’ side, if we think about how we as citizens establish our identity in our day-to-day lives, in most cases, we use our driver’s license,” said Tracy Hulver, senior director, Digital Identity, Idemia.

Hulver spoke about increasing trends in identity management during the Federal Identity Virtual Collaboration event on September 8.

Known as FedID and held since 1995, the annual conference on identity management also featured Scott Swann, president and CEO, Idemia National Security Solutions; Dakota Gruener, executive director, ID2020; and moderator Thirimachos Bourlai, associate professor, University of Georgia.

The driver’s license is a state-issued credential, and before COVID-19, the identity cards were issued in person for residents to access benefits and services, also mostly in person. “There are about 227 million driver’s licenses out there right now, and those are mostly physical cards,” Hulver observed. “It’s a natural extension to think that if this is our de facto identity that we use as citizens, how can the states leverage those or digitize that identity.”

The pandemic, however, opened up a whole new set of challenges for states on how to prove someone’s identity to the level of trust that is required when people cannot appear in person, Hulver stressed. States were unprepared, with officials never imagining that they would have to shut down the key services and offices— such as the Department of Motor Vehicles, or DMV— that issue and rely entirely on the presentation of physical identity.

“One state DMV commissioner told me, ‘We just never saw this coming,’” Hulver said.

Beyond providing identity cards and driver’s licenses, the next largest identity-related service that states provide is unemployment benefits. Unfortunately, the Coronavirus Aid, Relief, and Economic Security Act, also known as the CARES Act, passed in late March—with $2.2 trillion in funding relief—has also seen an estimated $26 billion in fraud, he reported.

“One of the leading attack vectors of this fraud is the ability to pretend that I am someone I should not be in order to get access to those claims,” Hulver said.

States are looking more at how to open up benefits and services digitally, Hulver continued. Several states are setting up single sign-on portals through which citizens can get all state services. This type of platform is a vast improvement from jurisdictions that have multiple portals. One state had over 250 portals, he emphasized, which was “a huge burden for the citizen and a nightmare for the state” to manage those identity stores and reduce fraud.

Another trend Hulver sees is the commercial market looking to leverage state-verified identity in their systems or marketplace. “You are seeing more and more entities doing that,” he says.

Meanwhile, the federal market for identity—from a scaling standpoint—is enormous, Hulver noted. “You have all types of demographics that you have to be concerned with,” he stated.

Gruener emphasized that digital identity at the federal level “can and should” be applied to a lot of governmental functions. “A digital ID that is not portable is of little use,” she said, relaying the experience of a friend who is a homeless veteran, who, without current possession of a physical identity card, is excluded from necessary services, including care at Veterans Affairs (VA) medical centers.

“Monolithic, centralized systems can prove to be exclusionary,” Gruener warned. “Those individuals who can’t sign up due to marginalization are the those who opt not to participate could be excluded form necessary services.”

Her organization, ID2020, is pursuing a project with Gavi, the Vaccine Alliance—a public-private global partnership created by the Bill and Melinda Gates Foundation—to create a digital identity system with the government of Bangladesh to provide children a portable, biometrically linked digital health identity from birth or when first immunized. These digital credentials are intended to be used by the children to enroll in school, access care or reach other opportunities.

“As part of the program in Bangladesh, to my knowledge, we are running the first, comparative, longitudinal study of multiple infant biometric modalities, including palm prints and fingerprints,” Gruener explained. “Right now, we have good data that infant biometric solutions can be used to re-authenticate a child at a single moment in time, but there isn't great data yet on whether the infant biometric solutions can, in fact, be used to re-authenticate a child at various touchpoints during early childhood. This study should provide that needed data.”

Swann, a former FBI unit chief who was with the bureau for almost 20 years, sees challenges, as well as shifts in identity management at the U.S. federal level. “The U.S. government does not always move at a rapid pace when it is trying to implement these types of solutions,” he said. Executing a contract for such programs could take 18-24 months—and this is seen “as reasonable” in that contracting world.

He noted that there is “a bit less appetite” for big federal identity management programs at the moment, with several existing, mature programs already in place with entrenched vendors.

Budgetary matters are also of concern during the pandemic, with a Continuing Resolution quite a possibility for fiscal year 2021. “If there is a Continuing Resolution, there is not supposed to be any new program starts,” he warned, as that skeleton funding measure from Congress only provides monies for mission-critical efforts. “This year, we are actually lucky, because last year they passed a two-year budget, so only the additional discretionary spend needs to be passed. But let’s not overlook the fact of COVID-19, and the fact that we are in an election year and there are a lot of conflicting requirements, pose the question of, ‘Will there be reprogramming in the course of FY 21, after the election? And will most of the impacts of COVID-19 really occur in FY 22?”

Another trend Swann sees is the federal agencies’ increased use of federally funded research and development centers, or FFRDCs. It is easy to issue contract to such entities, but he asks government agencies to make sure FFRDCs are being used appropriately, especially as many commercial off-the-shelf solutions already exist and do not needed to be created separately by FFRDCs.

“Regardless of the market, identity is identity,” Hulver noted. “It is about making sure that the right person is getting to the right resources as seamlessly as possible and also making sure that you are preventing fraudulent activities, and all of this then has to be wrapped in privacy.”

Gruener added, “Never forget that ID at its core is about people. Being able to prove your identity is a prerequisite to a life of dignity and opportunity.”

Enjoying SIGNAL?
SIGNAL Magazine is available through subscription or as part of your membership in AFCEA.
SUBSCRIBE NOW
LEARN MORE
JOIN AFCEA