State pilots test ID management for online services

http://gcn.com/Articles/2014/04/08/Access-management.aspx?Page=1

[[

Establishing the identity of online users is a thorny issue for the
electronic delivery of government services. A thorough identity proofing
ensures the right person receives services, but can be burdensome to both
the citizen and the state, while more user-friendly techniques to encourage
cost-efficient online access can open programs up to fraud.

To help solve this problem, the National Institute of Standards and
Technology has awarded $2.4 million to Michigan and Pennsylvania to test
innovative tools and techniques for identity proofing and to enable use of
secure credentials across departmental boundaries.

Michigan received $1.3 million to pilot an automated system for validating
identity to replace in-person identity proofing for those applying for
benefits through the state’s MI Bridges portal. “That has been quite
expensive for the state to run and quite burdensome for the applicant,”
said Jeremy Grant, NIST’s senior executive advisor for identity management.
“They are piloting ways to do remote identity proofing.”

Pennsylvania’s program is more complex, Grant said. It is using a $1.1
million grant to develop an ID infrastructure for multiple state
departments, combining both automated identity proofing with federated use
of credentials so that the same token can be accepted for  multiple
programs without duplicating effort and personal data across departments.

The pilots are focusing on effective implementation of existing technology
rather than on breaking new technological ground, Grant said. “Most of what
they are looking at are commercial software and services,” he said.

But there is a difference between a technology being available in the
marketplace and being widely used. The pilots will help to determine the
effectiveness of these tools with an eye toward getting them widely
adopted. A lot of states have an interest in the success of such programs
and are watching the pilots closely to see how they pan out, Grant said.

To evaluate the programs, NIST has awarded a $300,000 grant RTI
International to conduct cost-benefit analyses and assess their impact.

The grants, announced last fall, were made through the National Strategy
for Trusted Identities in Cyberspace (NSTIC), an initiative to develop an
identity ecosystem of user-friendly credentials that can be widely used.
The money, however, came from the Partnership Fund for Program Integrity
Innovation, administered by the Office of Management and Budget to pilot
ideas for improved delivery of state assistance programs. Because identity
verification and management is such an important element in delivering
benefits online, OMB decided the Partnership Fund would help fund the NSTIC
pilots.

Automated, remote identity proofing

“Bridges” is Michigan’s online system supporting applications for public
assistance programs. It was rolled out in 2010 as a back end to support
state workers who verify the identity and eligibility of applicants. At the
same time, there was a limited rollout of the MI Bridges portal, a front
end that lets applicants go through at least some of the application
process from their computers. The portal was expanded to all of the state’s
public assistance programs in 2012, but much of the required identity
proofing still is done manually, said project manager Cathy Fitch.

There are different levels of identify proofing for applicants, and cash
benefit programs require face-to-face meetings. “There is very little fraud
in that program for that reason,” Fitch said. But, “there is always room
for improvement.” The Michigan program hopes to raise the bar for fraud and
at the same time off-load some of the manual work of identity proofing to a
third part identity provider.

The pilot program will maintain the current ID proofing process, but would
add an additional automated challenge as a second factor for verification.
After the applicant enters basic information online—address, date of birth,
etc.—the system connected with a third party—very likely a credit
bureau—with additional questions. Questions might include “things that the
person should know and that wouldn’t be easy for someone else to find out”
on short notice, Fitch said, such as, 'what street did you live on in 1989?
Or, what kind of car do you drive?'

During the pilot phase, scheduled to begin in May and run through
September, a score will be generated by responses to the automated
challenge. The pilot will be used to determine whether the automated
challenge is as accurate as the manual process. That state will not provide
any information to the third party, and the link for the challenge will be
encrypted.

“For all intents and purposes we are not making major changes in our
business process,” Fitch said. But if it is successful, it could streamline
the job of verifying an applicant’s identity at a high level of assurance.

Federated identity in Pennsylvania

Pennsylvania’s Department of Public Welfare already has a mature identity
management program in place, said the state’s CISO Erik Avakian. The
department has one of the largest identity databases in the state, with
millions of names, and will be a key player in the program to enable the
expanded use of digital credentials for citizens.

“What NIST is asking us to do is pretty complex if you don’t have some
things already in place,” Avakian said. “Right now it’s kind of kludgy,”
with each agency using its own database and its own application for issuing
credentials. The pilot will extend the Welfare Department’s digital
Keystone ID for use by other departments.

Currently, creation of a Keystone ID account requires no real validation.
Identity proofing is done when a citizen using the online ID applies for
benefits. Under the pilot, an identity proofing service would verify
identity at the time the Keystone ID account is created, much like in
Michigan’s Bridges pilot. However, Pennsylvania will add a layer of
federation, that will allow other departments to accept and trust the
Keystone ID credentials for online services. The federated bridge between
departments will be created by Deloitte.

The decision whether a department will trust a given Keystone ID credential
will depend on the level of validation that was done when it was created.
Getting a fishing license, for example, does not require the same level of
trust as registering for cash benefits, so a credential created to get a
fishing license probably would require additional validation before it
would be accepted by the Welfare Department. But once validated at a higher
level of trust, it could be accepted by any department for uses at or below
that level.

Accepting credentials issued by other departments could not only streamline
delivery of online services for both citizens and agencies, but also could
reduce the amount of personal information each department has to maintain,
improving security and privacy.

The pilot is expected to begin this spring and run through September,
Avakian said. “But that’s a moving target. NIST is interested in seeing
successful pilots.”

NIST has awarded grants for NSTIC pilot programs to 10 other organizations
in addition to Michigan and Pennsylvania in the 2012 and 2013 rounds of
funding, and the application period for a third round of funding closed in
March. Successful applicants are expected to be announced in August.
]]