Better Identity in America: A Blueprint for State PolicymakersThe members of the Better Identity Coalition came together in 2018 to create a set of consensus, crosssector, technology-agnostic policy recommendations for improving identity in America. The “Policy Blueprint”3 we published in 2018 outlined a detailed action plan for the Federal government to take to improve identity in America. This paper is intended to serve as a companion piece to that Blueprint – focused on the vital role that states play. Today, the variety ofservices available online is greater than ever before, offering consumersthe power to engage in allsorts of transactionsfrom a device in the palm of their hand. But conversely, the ability of businesses and governmentsto offer high-value transactions and services online is being tested more than ever, due in large part to the challenges of proving identity online. ^^ The inadequacies of the nation’s digital identity infrastructure have enabled cybercriminals to steal billions of dollars and created major barriers for Americans trying to obtain critical benefits and services. These issues were only exacerbated during the COVID pandemic – and even as the impacts of the pandemic wane, the challenges posed by increased criminal attacks on identity systems remain. ^^ The lack of a widely adopted easy, secure, reliable way for entities to verify identities or attributes of people they are dealing with online creates friction in commerce, leads to increased fraud and theft, degrades privacy, and hinders the availability of many services online. While the market has responded with an array of products that aim to address the identity challenge for specific use cases, the tools available today are uneven in terms of accuracy and reliability, don’t work well for everyone, and are increasingly coming under attack. ^^ More than $56 billion was stolen as a result of identity fraud in 2020 - an increase of 333% over 2017 numbers. State governments were heavily targeted in attacks to steal pandemic relief dollars, but the private sector was hammered as well; the Identity Theft Resource Center reported that data breaches grew 23% from 2020 to 2021, with breaches impacting more than 293 million people. ^^ As the number of impacted Americans grows, consumers need better identity solutions that empower them to decide what information they share, when they share it, and in what context.Better Identity CoalitionBIC_cf6ebc0c-7cf6-11ed-a0c1-6d630583ea00The Better Identity Coalition is an organization focused on developing and advancing consensus-driven, cross-sector policy solutions that promote the development and adoption of better solutions for identity verification and authentication.Center for Cybersecurity Policy & LawThe Coalition was launched in 2018 as an initiative of the Center for Cybersecurity Policy & Law, a non-profit dedicated to promoting education and collaboration with policymakers on policies related to cybersecurity.BIC MembersMembers of the Better Identity Coalition are recognized leaders from different sectors of the economy, encompassing firms in financial services, health care, technology, telecommunications, fintech, payments, and security. Our 27 members include: AT&TCVSDiscoverEarly WarningEquifaxExperianFacetecFidelityID.meIDEMIAJPMorgan Chase & Co.LexisNexisMassMutualMastercardMicrosoftNorton LifeLockNotarizeOktaOneSpanOnfidoPNC BankPing IdentityTransUnionUnikenUS BankWells FargoYubicoState GovernmentsAt the core of our recommendations is the belief that the private sector will not be able to solve America’s identity challenges on its own. We are at a juncture where state governments will need to step up and play a bigger role to help address critical vulnerabilities in the new “digital identity fabric.” ^^ State governments are perfectly positioned to lead the way in solving these problems! Our recommendations do not purport to solve every challenge in the identity space. Rather, we have focused on a handful of common-sense initiatives that are practical for states to implement and will be meaningful in their impact; the State Policy Blueprint we put forth in this document is squarely focused on making identity systems work better.State PolicymakersAs the government contemplates new policies to improve the quality of digital identity in the United States, the Better Identity Coalition is bringing together leading companies to help develop innovative ideas that improve security, privacy, and convenience for all Americans.CompaniesBetter Identity in America_cf6ebe82-7cf6-11ed-a0c1-6d630583ea00To create a set of consensus, crosssector, technology-agnostic policy recommendations for improving identity in America_cf6ec1c0-7cf6-11ed-a0c1-6d630583ea00IdentityWhile digital identity in America is fraught with problems, they are not unsolvable. On the contrary, many of the most glaring problems in digital identity are ones that can be addressed through active partnerships between the public and private sectors. ^^ Before defining a plan of action, however, it is important to first lay out a high-level vision of what “Better” means. Collectively, we believe that Better Identity in America means that the following outcomes have been achieved:Securitya. Better Security – Less Fraud and Identity Theft – embracing the recommendation of the Commission on Enhancing National Cybersecurity to eliminate identity as a major attack vector.Convenienceb. Better Convenience – enabling consumers to open new accounts with ease, without having to go through duplicative, burdensome enrollment processes where they have to duplicate the experience they went through at the DMV.Confidencec. Better Confidence for Consumers, Service Providers, and Government Agencies – that identities asserted online are reliable and trustworthy, and that they work well for everyone.Privacyd. Better Privacy – shifting the predominant model for identity verification from one based on firms aggregating personal data without opt-in consent to one where consumers proactively request that their government-held data be shared for the sole purpose of verifying identity. ^^ Improving Identity While Preserving Privacy ~ Better Identity in America must deliver Better Privacy - shifting the predominant model for identity verification to one that is consent based rather than one based on firms aggregating personal data without consent. ^^ Against that backdrop - it is important to note that the history of government identity systems, privacy and personal data has not always been a happy one. In 1994, Congress passed the Driver’s Privacy Protection Act (DPPA) after issues arose with some state DMVs failing to properly protect personal information - leading, among other things, to a murder after a stalker obtained his victim’s home address from a state DMV. The DPPA places strict limitations on who can access DMV data, and under what circumstances. This enables DMVs to share data if the subject consents - meaning that the use case described above with mDLs would be permitted. ^^ That said, new identity proofing solutions like mDLs backed by state DMVs must be architected to protect privacy, not risk it. Beyond potential harm to individuals, protecting privacy is essential to gaining the trust of consumers to use these new solutions. The mDL standard (ISO 18013-5) accounts for privacy and should be followed closely. Accordingly, following the mDL standard will help states ensure they are crafted with a “privacy by design” approach. That means: ^^ • Privacy implications are considered up front at the start of the design cycle -- and protections are embedded into the solution architecture. ^ • Identity data is shared only when consumers request it. ^ • Identity data that is shared is only used for the purpose specified. ^ • Consumers can release information at a granular level enabling selective disclosure. ^ • Relying parties may only request attributes that are necessary to process the transaction. ^ • Relying parties only receive match/no-match, Y/N responses – such as age verification services that share that someone is over 21 but does not share their birthday. ^ • Identity providers deploy measures to prevent mDL holders from being tracked across relying parties ^^ A privacy-preserving architecture is critical for achieving mDL adoption. Accordingly, we believe the model should support full consumer control of the information they share with a relying party whether it be a governmental or commercial entity. In any mDL implementation, state DMVs should not be sharing or transmitting data. Rather, their role should be limited to issuing digitally signed credentials that individuals can use to share their data, as well as in some cases, “vouching” for individuals by validating whether data submitted matches what is in the DMV database (i.e., providing a match/no match response).Digital IdentityPlace the DMV at the center of state digital identity solutions_cf6ec49a-7cf6-11ed-a0c1-6d630583ea001It’s a rite of passage. A 16-year-old goes to their state driver license issuer, hands over a birth certificate, Social Security card, and other documents, takes a written test and driving test and then receives that ubiquitous piece of plastic that they use for so many purposes other than driving. Roughly once a decade that same individual will revisit that office to renew that license and get an updated picture. This is one of the few instances where a resident goes somewhere in person, hands over documentation that is validated and verified, and is then given an identification document. ^^ This in-person identity proofing for a document that most U.S. residents (89%) have sets it apart from every other credential in the U.S. And for in-person transactions such as buying a beer, opening a bank account, or applying for a government service, the driver’s license enables people to prove who they are. But there is no way for people to “reuse” that identity online. Instead, almost every time consumers apply for a new account online, they are asked to go through a new process to prove who they are again. mDL AppsDeploy new mobile Driver’s License (mDL) apps and other digital identity services_cf6ec634-7cf6-11ed-a0c1-6d630583ea001.1CongressCongress has already recognized the promise of mDLs; the REAL ID Modernization Act, passed in 2020, makes clear that a driver’s license can be a physical or a digital credential – and ensures that any mDL issued in accordance with Federal standards will be accepted by the Federal government for REAL ID purposes.StatesIf states had an mDL program in place at the start of the COVID-19 pandemic, officials could have leveraged the millions of state-backed identity proofing processes residents had already gone through at its DMV offices to validate the identities of most applicants for unemployment benefits... ^^ A number of states such as Arizona, Maryland, Florida, Connecticut, Iowa, Kentucky, Oklahoma, Colorado, and Utah have already started to move forward with mDLs, but rollout and adoption has been slow.ArizonaMarylandFloridaConnecticutIowaKentuckyOklahomaColoradoUtahDriversThe security and privacy benefits of mDLs are significant. Today when someone hands over their driver’s license, all of the information can be seen, captured, and stored. However, mDLs, in comparison, allows a consumer to select only information that is relevant to the transaction. For example, someone trying to buy alcohol can prove they are over 21 without sharing their birthday or address.RetailersThe retailer selling alcohol also can know with certainty that the information is accurate. Here is where states are ideally positioned to help: by deploying new mobile Driver’s License (mDL) apps and other digital identity services that create a digital counterpart to the plastic cards they issue today. ^^ Issuing mDLs will enable states to close the “identity gap” between physical and digital ID and empower their residents with a new tool that gives them greater security, better protects their privacy, and is easy to use. With mDLs, states can give every resident a tool that enables a state to “vouch” for them when they are trying to prove who they are online – by validating the information from their driver license.AttributesComplement mDLs with new attribute validation services._cf6eca4e-7cf6-11ed-a0c1-6d630583ea001.2ConsumersWhile mDL deployment will take time, in the near term, states can make a material difference in improving remote identity proofing solutions by launching identity attribute validation services that enable consumers to ask the DMV to validate whether identity data submitted matches what an agency has on file when they are trying to prove their identity.DMVsAttribute validation services represent an easy lift for DMVs, in large part because the DMV does not have to share any personal information through the service. Instead, a DMV need only provide a “Yes/No” answer as to whether identity data provided to another agency or business to open a new account matches what the DMV has on record.ResidentsThis is another meaningful way, in addition to mDLs, that states can enable DMVs to vouch for residents when they are trying to prove who they are online.StatesFor the attribute verification services states do not need to create these new systems themselves: today the American Association of Motor Vehicle Administrators (AAMVA) administers the Driver’s License Data Verification (DLDV) system, which provides a single tool that public agencies and third parties can use to confirm DMV data. A core challenge with DLDV is full participation by all states. Without this there’s a notable gap in the utility of DLDV, since service providers need a system that covers the entire country, rather than just certain states.American Association of Motor Vehicle Administrators (AAMVA)U.S. ResidentsWithout full participation of all jurisdictions many organizations will still need to have various fallback services in order to serve all U.S. residents. This will result in a varied user experience depending on where one lives and potentially varying security requirements. GovernorsGovernors and state legislatures of states that are not fully participating in DLDV – New York, California, Louisiana, Alabama, Alaska, and South Carolina – should take action to join their counterparts. This would enable DLDV to be used widely and effectively across the public and private sector to deliver more accurate identity proofing and guard against identity fraud.State LegislaturesGovernors and state legislatures should jumpstart the deployment of mDLs in their states by: ^^ 1) Directing their DMV directors to create a plan for launching mDLs. ^ 2) Considering restructuring the DMV to separate the identity division from the motor vehicle division – enabling a tighter focus on the challenges of digital identity and implementing mDLs. ^ 3) Exploring whether new legislation is needed to authorize the use of mDLs – and if so, passing it. ^ 4) Prioritizing online use cases of mDLs over in-person applications – to ensure that the most urgent needs for digital identity are addressed first. ^ 5) Implementing driver license attribute validation services that enable state residents to verify their identity with the state DMV – ideally by fully participating in the American Association of Motor Vehicle Administrator’s Driver’s License Data Verification (DLDV) service. ^ 6) Educating consumers and businesses in their state about mDLs and how they can be used.New YorkCaliforniaLouisianaAlabamaAlaskaSouth CarolinaConsumersWith this, states should also look to establish new identity validation services that allow a consumer to electronically request that the state which issued their driver’s license validate (with a Yes/No answer) whether a “selfie” image that the consumer takes matches the driver’s license image on file in the state DMV. This validation service would effectively let a third party determine whether a remote user in possession of a driver’s license is who they claim to be – rather than someone who might have stolen a license. Such a service could help enable higher-assurance identity proofing and also help to alleviate concerns about accuracy and bias issues in some current products that match selfies to a lower-quality photo obtained by having a consumer take a picture of their driver’s license. That said, it will be important to architect these new systems to ensure that they only use matching algorithms that have been proven in third-party testing to be both accurate and equitable, and that also ensures selfies are not retained by the state. Proofing & VerificationEstablish attribute validation services at vital records bureaus to support next-generation, consumer-centric remote identity proofing and verification systems_cf6ecc1a-7cf6-11ed-a0c1-6d630583ea002Vital Records BureausIn their role of issuing birth certificates, marriage certificates, and death certificates, vital records bureaus are on the front line of identity, and often have critical information that can be used to validate foundational identity information. Unfortunately, many of these bureaus are stuck in the paper world and there is no way for their data to be used to support identity proofing events online. So long as these systems are limited to paper, they will not be able to support next-generation remote identity proofing and verification systems.State Vital Records BureausState vital records bureaus should join DMVs in launching new digital services for attribute validation - enabling consumers to ask an agency to validate whether identity data submitted matches what an agency has on file when they are trying to prove their identity.National Association for Public Health Statistics and Information SystemsThe National Association for Public Health Statistics and Information Systems (NAPHSIS) introduced the Electronic Verification of Vital Events (EVVE) service that enables federal and state agencies to verify birth and death certificate information.Government AgenciesHowever, access to the service is largely limited to government agencies, with little to no ability for non-governmental entities to use it. Non-Governmental EntitiesBy launching similar programs that tie to state vital records bureaus, states can create additional “levers” for ensuring that more people are able to prove who they are online.GovernorsState LegislaturesGovernors and state legislatures should jumpstart the deployment of consent-based identity attribute validation services in their states by:Next to DMVs, vital records bureaus in states, cities, and counties are the most important agencies in the state identity ecosystem.PlansDirect vital records bureaus to create plans for launching attribute validation services._cf6ecddc-7cf6-11ed-a0c1-6d630583ea002.1GovernorsVital Records Bureaus LegislationExplore whether new legislation is needed to authorize the use of attribute validation services – and if so, passing it._cf6ecfb2-7cf6-11ed-a0c1-6d630583ea002.2State LegislaturesEducationEducate consumers and businesses in their state about attribute validation services and how they can be used._cf6ed1b0-7cf6-11ed-a0c1-6d630583ea002.3StatesConsumersBusinessesInnovationEmbrace identity innovation for better services_cf6ed37c-7cf6-11ed-a0c1-6d630583ea003GovernorsState LegislaturesGovernors and state legislatures should: ^^ 1) Pass remote online notarization (RON) laws to expand convenient and secure remote transactions and avoid passing remote ink notarization (RIN) laws due to the reliance on outdated practices and failure to provide adequate safeguards. ^ 2) Ensure that RON laws embrace a common standard and framework, such as NIST’s Digital Identity Guidelines, to deliver a policy framework for RON that is technology-neutral and avoids prescriptive technology requirements, enabling upgrades over time. ^ 3) Complement mDL and other government attribute-exchange services with commercial identity tools that are certified as meeting rigorous NIST standards. mDLs and attribute verification services are critical to enabling access to services but there are other steps states can take to also drive identity innovation. Commercial ToolsComplement mDL and other solutions with commercial identity tools_cf6ed55c-7cf6-11ed-a0c1-6d630583ea003.1Non-DriversNational Institute for Standards and TechnologyFirst, states can complement mDL and othersolutions with commercial identity tools that are certified as meeting rigorous NIST standards. While mDLs should be a top priority, there is no question that it will take time to roll them out in the states. In addition, some people may not want to get an mDL – or will not have a smartphone or other tools needed to use one. And as noted earlier, about 10% of adult Americans do not have a driver’s license today. Alternative solutions will be needed. ^^ Here, states can complement DMV-centric solutions with commercial identity solutions that have been certified as meeting digital identity guidelines published by the National Institute for Standards and Technology (NIST). Specifically, solutions that meet “Identity Assurance Level 2” (IAL2) as defined by NIST are able to deliver an alternative to government-crafted solutions, while still delivering on security and privacy.NotarizationEnable a secure, standardized approach to virtual notarization._cf6eda7a-7cf6-11ed-a0c1-6d630583ea003.2United StatesIn the United States, notarization - an official authentication certification process provided by a notary public - has provided trust in documents and transactions for centuries. Today, notarization remains a critical process in verifying the identity of a signer, providing assurance that a signature is genuine, and an acknowledgment that a signer understands a document's contents.Commonwealth of VirginiaTraditionally an in-person process, notarization was transformed in 2012, when the Commonwealth of Virginia became the first in the nation to bring notarization into the online world using the process of Remote Online Notarization (RON). RON is a modern form of notarization that enables a user to have a document notarized entirely online using audio-video technology, identity proofing tools, and electronic documents and storage.SignersWhile COVID-19 increased the demand for remote transactions generally, the demand for RON skyrocketed in 2020 and 2021, helping to propel the industry and laws surrounding online notarization forward. Available today to signers in all 50 states through interstate recognition, RON has been permanently authorized to be performed by notaries in 41 states as of the publication of this report.NotariesAs we continue to transition into a fully online world, making RON available to the notaries across all 50 states will empower notaries across the country to utilize this important digital service and help modernize our nation’s digital infrastructure from coast to coast.Second,states should embrace innovation when it comes to notarization by passing new Remote Online Notarization laws that enable a secure, standardized approach to virtual notarization... ^^ The common components of RON include identity proofing, and the use of audio-visual technologies. Identity proofing is typically done via KBV and credential analysis and then identity is verified during the audio-visual session during the transaction. Additionally, the audio and video of every signing session are recorded and retained so that if a question were to arise about a transaction, the recording could be reviewed.UniversalityMake sure identity works for everybody_cf6edc5a-7cf6-11ed-a0c1-6d630583ea004GovernorsState LegislaturesAmericansOne downside of the increased security requirements of the REAL ID Act has been that many Americans cannot easily get a driver’s license, because they cannot produce or access the multiple documents, such as birth certificates or Social Security cards, needed to prove who they are.Marginalized CommunitiesThis disproportionately impacts the most marginalized communities, including people of color, the elderly, the poor, as well as survivors of domestic violence and those reentering society after time in prison.People of ColorElderly PeoplePoor PeopleSurvivors of Domestic ViolenceFormer Prisonersthose reentering society after time in prisonCharitiesIn many states, the only option for someone “stuck” in a situation where they do not have foundational identity documents is to turn to charities and other non-profits for assistance.NonprofitsFoundry United Methodist ChurchThese groups do some inspiring work – the I.D. Ministry operated by Foundry United Methodist Church in Washington D.C. is one example – but it should not fall entirely to charities and churches to address gaps in government identity systems that exclude some Americans.StatesHere, states can help – by shifting policies in DMVs and vital records bureaus so that someone who lacks all the required documents is not just told “Come back when you have them” but also asked “Do you need assistance in getting them?” Americans should not have to seek out help from a church or a charity to get a service that is inherently governmental; states should look to lead the way in ensuring that their residents can get assistance if they somehow get stuck in the system.EconomistsThe benefits of helping people here go beyond the “do good” aspects; economists forecast that U.S. GDP could grow an extra 4% by 2030 with investments in robust digital identity infrastructure. But those benefits will only fully accrue if everyone can access “Digital First” identity infrastructure that they can use in banking, health care, retail, and government services to protect the security and privacy of their information and enables them to access more high value, trusted services online.As states invest in new digital identity systems, it is important to make sure that these new systems are accessible to all their residents – and that some populations are not excluded or left behind. ^^ So many basic necessities – getting a job, a bank account or housing – are inaccessible to those who lack “foundational” identity documents... ^^ Governors and state legislatures should:ServicesCreate services that help residents on the margins of society_cf6ede44-7cf6-11ed-a0c1-6d630583ea004.1DMVsVital Records BureausDirect the DMV, vital records bureaus, or other agencies to create services that help those residents on the margins of society if they struggle to get foundational identity documents. This may be done directly through a government agency, or by partnering with third parties that provide this assistance.AccessibilityEnsure identity systems are accessible to all_cf6ee06a-7cf6-11ed-a0c1-6d630583ea004.2When designing new physical or digital identity systems, consider ways to ensure that they are accessible to all, no matter someone’s age, income, or ability. AuthenticationPromote and prioritize the use of strong authentication_cf6ee268-7cf6-11ed-a0c1-6d630583ea005StatesStates should move both their enterprise and citizen-facing services to stronger forms of authentication, based on multiple factors to prevent these common attacks.AuthenticatorsThe good news here is that industry and government have recognized the problems with old authenticators and multi-stakeholder efforts like the Fast Identity Online (FIDO) Alliance and the World Wide Web Consortium (W3C) have developed standards for next-generation authentication that are embedded in most devices, operating systems, and browsers, and enhance security, privacy, and user experience.Fast Identity Online (FIDO) AllianceWorld Wide Web Consortium (W3C)Cybersecurity and Infrastructure Security Agency (CISA)The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has called FIDO “the gold standard of multifactor authentication” and the White House has required the use of phishing-resistant MFA in both enterprise and citizen-facing services, calling out the FIDO and W3C standards.White HouseState GovernmentsIn addition, we’ve seen the emergence of technology that can deliver continuous risk-based authentication – analyzing data from dozens of data points to create a “risk score” that determines how much and what access to provide. State governments should continue work already underway in promoting this strong authentication technology that is already used in financial services, health care, government, and consumer applications.NISTA risk-based approach is critical to ensuring that digital applications deliver the right level of strong authentication. Both government and industry should look to leverage risk- based guidance such as NIST’s Digital Identity Guidelines (SP 800-63-3), which lays out a comprehensive approach to assessing risk and selecting appropriate authentication controls to address those risks. Many commercial authentication products are built to align with NIST guidelines, enabling states to avoid creating custom solutions here.PolicymakersAn important consideration for policymakers when crafting new legislation or regulation on privacy and security is to make sure that new rules are not written so broadly that they might preclude use of promising technologies for risk-based identity proofing and authentication.EuropeFor example, while Europe’s General Data Protection Regulation (GDPR) limits the collection of data in many circumstances, it also highlights that in protecting security and preventing fraud, there are cases where an entity may have a “legitimate interest” in processing personal data – including cases where such data can be used to deliver secure authentication.CaliforniaLikewise, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) create exceptions for requirements to delete personal information about a consumer if that information: “is necessary for the business or service provider to maintain the consumer’s personal information in order to ... detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.”CompaniesHowever, if states were to pass laws that applied a different standard to data use for secure authentication and preventing fraud, it could have a chilling effect on the market. Companies would then have to grapple with a variety of laws across 50 states with each having different definitions, standards, and requirements for security and fraud prevention. Such a patchwork approach would inhibit the deployment of new, innovative authentication technologies and place consumers at risk.There is no such thing as a “secure” password in 2022, and even some widely used multi-factor authentication (MFA) tools such as those that use one-time passcodes (OTPs), or push notifications are now easily compromised through automated phishing attacks. Any authentication tool that is based on “shared secrets” can be easily defeated by adversaries. 2020 saw a 450% increase in username and password breaches with 1.48 billion breached records.16 Additionally, 61% of breaches in 2020 were conducted using compromised credentials. ^^ Governors and state legislatures should:MFAEnable phishing-resistant MFA for individuals accessing services online_cf6ee45c-7cf6-11ed-a0c1-6d630583ea005.1Ensure agencies enable phishing-resistant MFA for individuals accessing services online, as well as consider the use of risk-based analytics authentication tools used by financial services, health care, and other private sector organizations.Risk-Based AuthenticationAvoid creating restrictions on use of data that might preclude use of technologies for risk-based authentication_cf6ee6aa-7cf6-11ed-a0c1-6d630583ea005.2Ensure states avoid creating restrictions on use of data that might preclude use of technologies for risk- based authentication that can assure security and prevent fraud.HarmDo no harm_cf6ee8c6-7cf6-11ed-a0c1-6d630583ea006As detailed in this Blueprint, when done right, identity can be “the great enabler” – helping to drive innovation and new, better ways of delivering services, while improving privacy, security, and user experiences. ^^ However, there are also plenty of ways that digital identity systems can be implemented poorly, in ways that create new security challenges, erode privacy and civil liberties, make things harder for people online, or exacerbate existing inequities. ^^ The recommendations in this Policy Blueprint are carefully crafted to drive the former outcomes – and help states avoid the latter. That said, this Blueprint does not address every challenge in digital identity, and states will need to be thoughtful in their approaches to different issues. ^^ There are three aspects of “do no harm.” ArchitectureEnsure the digital identity system is secure, protects privacy, and is easy to use_cf6eee02-7cf6-11ed-a0c1-6d630583ea006.1First, make sure that any new digital identity system is architected to be secure, protect the privacy of those who are using it, and is easily used by the vast majority of individuals. ^^ As this paper has discussed, it is important that states be thoughtful and intentional as they design any new identity system to maximize the benefits while avoiding unintentional consequences.StandardsFollow NIST standards for security, privacy, and interoperability_cf6ef064-7cf6-11ed-a0c1-6d630583ea006.2GovernorsState LegislaturesGovernors and state legislatures should: ^^ 1) Look first to NIST and ISO identity standards and guidelines – and only seek to craft their own if they have clearly determined that those existing standards and guidelines cannot address a state’s requirements. ^ 2) Consult with security and identity experts when crafting new policies to ensure they do not inadvertently create new mandates that make things worse.States should follow NIST standards wherever practical to ensure they set a high bar for security, privacy, and interoperability. ^^ When it comes to digital identity, the Federal government has invested more than 15 years and millions of dollars in creating standards and guidance. NIST’s Digital Identity Guidelines outline a riskbased approach for both government agencies and private sector entities to select appropriate security controls for identity and authentication; the guidance is widely recognized across the globe and even cited by other governments, who defer to NIST standards rather than craft their own. ^^ NIST standards are also crafted in concert with security and privacy community stakeholders, ensuring that they reflect critical input from a wide array of experts. ^^ A number of states have made well-intentioned attempts to try to create their own standards, products, or requirements for how public and private entities in their state should handle identity proofing or authentication. For the most part, these efforts have fallen short, and in some cases, had the impact of mandating weak or outdated solutions. ^^ For example, a number of states have mandated identity verification approaches that require the use of KBV, despite NIST and many security experts pointing out how attackers have caught up with it. California is the most notable here; as we detail in a sidebar, their new regulations tied to the state’s recently-passed privacy laws call for KBV to be used to validate the identities of people seeking access to their data – despite security studies showing this will put some people at risk. ^^ Likewise, some states continue to cling to outdated requirements for things like password complexity that may make their systems – and their citizens – more vulnerable. ^^ One advantage of using NIST guidance is that it is updated every few years to reflect both evolutions in attack vectors, as well as innovations in industry that guard against them. Thus, by referencing NIST Digital Identity Guidelines in state laws and regulations – rather than legislating or regulating their own approach – a state can be assured that their security requirements automatically evolve over time, without a need for the state to update laws or regulations. GoveranceCraft policies to govern the use of technology responsibly_cf6ef28a-7cf6-11ed-a0c1-6d630583ea006.3GovernorsState LegislaturesGovernors and state legislatures should: ^^ 3) Avoid blanket “bans” on use of identity technologies like face recognition; instead, target polices limiting the use of biometrics technology to specific applications and the specific risks or harms associated with those applications.Finally, legislators and policy makers should not ban any identity technology outright, but instead focus on crafting policies to govern the use of technology responsibly. ^^ Across the U.S. there are numerous proposals to ban the use of facial recognition biometrics. There is a reason this has been happening: in some cases, governments have misused facial recognition systems, leading to horror stories where people have been wrongly arrested. Moreover, NIST has documented that some second-tier biometric algorithms have difficulty identifying women and people of color. ^^ What is getting lost in many of these discussions is that all face recognition applications don’t present the same risks; nor is every algorithm “biased;” in fact, NIST has stated that “those algorithms that are the most equitable also rank among the most accurate.” ^^ Moreover, while we are very concerned about surveillance applications using face recognition, there are some applications of face biometrics that have been proven to be helpful to people of color. For example, a 19-year-old African American woman with no credit history would have a good chance of failing to pass a remote identity verification solution that relied on KBV questions tied to a credit report. However, if she had a driver’s license and a smartphone, she could take a picture of that license and then a selfie, and the remote verification system could then match the selfie to the photo on the license – allowing her to quickly open an account and obtain the services she needs. ^^ Such a use case is dependent on the use of a “best in class” algorithm that meets NIST’s requirement for being “most equitable and most accurate.” And it is also dependent on the solutions being designed to mitigate risks by architecting solutions up front to set a high bar for equity, privacy, and security. We have seen a number of instances where the press or policymakers have inappropriately conflated issues tied to one application of face recognition with another – for example, suggesting that problems associated with surveillance applications mean that face recognition should not be used on someone’s smartphone. It will be important for policymakers to ensure that any polices around the use of biometrics technology are appropriately targeted to specific applications and the specific risks or harms associated with those applications, rather than apply blanket bans on the use of technology in any circumstances. ^^ As part of a focus on “do no harm,” we note that there should always be backup options for those who cannot or choose to use a system that incorporates face biometrics as part of applying for a government service. Identity solutions need to meet people where they are comfortable; while biometrics can be a valuable option for many people, they should not be the only option; multiple paths to prove identity should be made available.2018-12-312022-12-16https://static1.squarespace.com/static/5a7b7a8490bade8a77c07789/t/63937744d04cfd3dfa8d9838/1670608710401/Better_Identity_Coalition+-+State+Blueprint+-+Dec2022.pdfOwenAmburOwen.Ambur@verizon.net