Ohio adopts single sign-on for unemployment claims

The Ohio Department of Job and Family Services (ODJFS) is taking advantage of the InnovateOhio Platform’s (OIP) cloud-based single sign-on solution, requiring state residents claiming or applying for unemployment benefits to set up a state identity account.

The requirement to use OH|ID, which lets Ohioans interact with multiple state agencies and access a variety of programs and services with a single user account, went into effect Nov. 17. As of Dec. 2, 61,000 people have gone through the process to link their OH|ID and Ohio Job Insurance Benefit (OJI) system accounts, said Neal Gallucci, technical administrator for OIP.

“It’s getting us closer to the step of [being] a trusted identity with the state, basically offering identity proofing services at the OH|ID level instead of making every agency partner with Experian or LexisNexis to do the services on their own,” Gallucci said.

At the same time, however, each agency, such as ODJFS, can make its own identity decisions using adaptive access.

Officials with the unemployment benefits program “early on decided that they would like every person who is accessing the website to be able to at least file a claim, so [now] they sign for an account, we validate their email address, they’re then asked to go through an Experian identity check, and they answer a couple questions,” said Brett Adamik, identity service manager for the state.

That results in a confidence score that dictates next steps. For instance, a low score could result in a denied claim, while a high one fast-tracks the applicant through the system. Someone without a credit history on file would be directed to an OJI adjudication process for further evaluation.

“We allow these agencies to make decisions with a good set of information about how confident we are that this is a good person,” Adamik said. “That’s where I think we’ve excelled with the solution for unemployment.”

Before the switchover, OJI applicants logged in with their Social Security number and a six-digit personal identification number. “That’s so easy to hack,” Gallucci said.

In fact, between April 2020 and June, JFS paid more than $3.8 billion by mistake or because of fraud, according to the state auditor’s October report.

“We needed to move that to a more complex password and not logging in with your Social,” Gallucci said. Multifactor authentication (MFA) was also added so that if someone got a credential, “they couldn’t just log into an account and adjust the bank payment to route it to their bank,” he said. “Multifactor authentication prevents account takeover, prevents credential harvesting.”

For ODJFS, OIP set up a trust between its IBM Cloud and IBM appliance server-based solution. Cloud was necessary to handle the expected scale of users. Since Nov. 17, there have been half a million login attempts on OJI, Gallucci said.

“We knew that a server-based environment would be difficult to scale … so that’s why we brought in the IBM Cloud – for the MFA and adaptive access as well as the scale,” he said. “We knew it was our future environment that we would start moving toward: an SaaS-based solution to help reduce our operational overhead.”

To stave off a call center rush when the account requirement went live, OIP followed a change management plan that included training help-desk staff and asking active filers to set up OH|IDs before Nov. 17 – something about 10,000 to 15,000 users did, Gallucci said.

Additionally, “we studied the user journey and placed the proper infographics and documentation to walk people through the process, so when people were being ported from OJI over to OH|ID, we placed an infographic, which would tell them what the process would look like,” he said.

The expected onslaught of help-seekers never came. “What we saw was essentially below-normal call volumes,” Gallucci said. “The exciting part was that it just worked.”

Ohio has had single sign-on since 2018, and ODJFS was scheduled to integrate with it in 2022 but the pandemic accelerated that.

The fruits of this labor are not for ODJFS alone. Everything OIP does is enterprise-grade; any state organization may use it. The success of this project has already caught other entities’ attention, Gallucci said.

“We’re not saying no to anyone. We’re telling people, ‘You want MFA, jump onto the IBM cloud,’” he said.

ODJFS’s director of communications, Bill Teets, said in an email to GCN that the record number of fraud attempts that accompanied unprecedented unemployment claims sent the agency scrambling for support. It partnered with private companies and the use of OH|ID is its most recent security booster.

“We’re stopping more fraud. We don’t know how much we’re stopping; we’re only two weeks into the process now [early December]. But we know we’re protecting accounts, and we’re creating a better and more secure user experience,” Gallucci said.