State pilots test ID management for online services

Establishing the identity of online users is a thorny issue for the electronic delivery of government services. A thorough identity proofing ensures the right person receives services, but can be burdensome to both the citizen and the state, while more user-friendly techniques to encourage cost-efficient online access can open programs up to fraud.

To help solve this problem, the National Institute of Standards and Technology has awarded $2.4 million to Michigan and Pennsylvania to test innovative tools and techniques for identity proofing and to enable use of secure credentials across departmental boundaries.

Michigan received $1.3 million to pilot an automated system for validating identity to replace in-person identity proofing for those applying for benefits through the state’s MI Bridges portal. “That has been quite expensive for the state to run and quite burdensome for the applicant,” said Jeremy Grant, NIST’s senior executive advisor for identity management. “They are piloting ways to do remote identity proofing.”

Pennsylvania’s program is more complex, Grant said. It is using a $1.1 million grant to develop an ID infrastructure for multiple state departments, combining both automated identity proofing with federated use of credentials so that the same token can be accepted for  multiple programs without duplicating effort and personal data across departments.

The pilots are focusing on effective implementation of existing technology rather than on breaking new technological ground, Grant said. “Most of what they are looking at are commercial software and services,” he said.

But there is a difference between a technology being available in the marketplace and being widely used. The pilots will help to determine the effectiveness of these tools with an eye toward getting them widely adopted. A lot of states have an interest in the success of such programs and are watching the pilots closely to see how they pan out, Grant said.

To evaluate the programs, NIST has awarded a $300,000 grant RTI International to conduct cost-benefit analyses and assess their impact.

The grants, announced last fall, were made through the National Strategy for Trusted Identities in Cyberspace (NSTIC), an initiative to develop an identity ecosystem of user-friendly credentials that can be widely used. The money, however, came from the Partnership Fund for Program Integrity Innovation, administered by the Office of Management and Budget to pilot ideas for improved delivery of state assistance programs. Because identity verification and management is such an important element in delivering benefits online, OMB decided the Partnership Fund would help fund the NSTIC pilots.

Automated, remote identity proofing

“Bridges” is Michigan’s online system supporting applications for public assistance programs. It was rolled out in 2010 as a back end to support state workers who verify the identity and eligibility of applicants. At the same time, there was a limited rollout of the MI Bridges portal, a front end that lets applicants go through at least some of the application process from their computers. The portal was expanded to all of the state’s public assistance programs in 2012, but much of the required identity proofing still is done manually, said project manager Cathy Fitch.

There are different levels of identify proofing for applicants, and cash benefit programs require face-to-face meetings. “There is very little fraud in that program for that reason,” Fitch said. But, “there is always room for improvement.” The Michigan program hopes to raise the bar for fraud and at the same time off-load some of the manual work of identity proofing to a third part identity provider.

The pilot program will maintain the current ID proofing process, but would add an additional automated challenge as a second factor for verification. After the applicant enters basic information online—address, date of birth, etc.—the system connected with a third party—very likely a credit bureau—with additional questions. Questions might include “things that the person should know and that wouldn’t be easy for someone else to find out” on short notice, Fitch said, such as, 'what street did you live on in 1989? Or, what kind of car do you drive?'

During the pilot phase, scheduled to begin in May and run through September, a score will be generated by responses to the automated challenge. The pilot will be used to determine whether the automated challenge is as accurate as the manual process. That state will not provide any information to the third party, and the link for the challenge will be encrypted.

“For all intents and purposes we are not making major changes in our business process,” Fitch said. But if it is successful, it could streamline the job of verifying an applicant’s identity at a high level of assurance.

Federated identity in Pennsylvania

Pennsylvania’s Department of Public Welfare already has a mature identity management program in place, said the state’s CISO Erik Avakian. The department has one of the largest identity databases in the state, with millions of names, and will be a key player in the program to enable the expanded use of digital credentials for citizens.

“What NIST is asking us to do is pretty complex if you don’t have some things already in place,” Avakian said. “Right now it’s kind of kludgy,” with each agency using its own database and its own application for issuing credentials. The pilot will extend the Welfare Department’s digital Keystone ID for use by other departments.

Currently, creation of a Keystone ID account requires no real validation. Identity proofing is done when a citizen using the online ID applies for benefits. Under the pilot, an identity proofing service would verify identity at the time the Keystone ID account is created, much like in Michigan’s Bridges pilot. However, Pennsylvania will add a layer of federation, that will allow other departments to accept and trust the Keystone ID credentials for online services. The federated bridge between departments will be created by Deloitte.

The decision whether a department will trust a given Keystone ID credential will depend on the level of validation that was done when it was created. Getting a fishing license, for example, does not require the same level of trust as registering for cash benefits, so a credential created to get a fishing license probably would require additional validation before it would be accepted by the Welfare Department. But once validated at a higher level of trust, it could be accepted by any department for uses at or below that level.

Accepting credentials issued by other departments could not only streamline delivery of online services for both citizens and agencies, but also could reduce the amount of personal information each department has to maintain, improving security and privacy.

The pilot is expected to begin this spring and run through September, Avakian said. “But that’s a moving target. NIST is interested in seeing successful pilots.”

NIST has awarded grants for NSTIC pilot programs to 10 other organizations in addition to Michigan and Pennsylvania in the 2012 and 2013 rounds of funding, and the application period for a third round of funding closed in March. Successful applicants are expected to be announced in August.