Data Protection: Federal Agencies Need to Strengthen Online Identity Verification Processes
Released: 2019-06-14T00:00:00

Letter

Background

Individuals engage in countless online transactions every day—from checking their bank accounts and making retail purchases to signing up for federal benefits and services. However, securing such transactions is a complex endeavor. A key part of this process is verifying that the person who is attempting to interact for the first time with an organization, such as a federal agency or a business, is the individual he or she claims to be. This process, known as identity proofing, is essential to prevent fraud, which could cause harm to both individuals and organizations.

Identity proofing may occur in person or through a remote, online process. In the case of in-person identity proofing, a trained professional verifies an individual’s identity by making a direct physical comparison of the individual’s physical features and other evidence (such as a driver’s license or other credential) with official records to verify the individual’s identity. Verification of these credentials can be performed by checking electronic records in tandem with physical inspection. In-person identity proofing is considered a strong method of identity proofing.

However, it may not always be feasible to require that all applicants appear in person. In such cases, remote identity proofing is performed. Remote identity proofing is the process of conducting identity proofing entirely through an online exchange of information. When remote identity proofing is used, there is no way to confirm an individual’s identity through their physical presence. Instead, the individual provides the information electronically, or performs other electronically verifiable actions that demonstrate his or her identity. Because many federal benefits and services are offered broadly to large numbers of geographically dispersed applicants, agencies often rely on remote identity proofing to verify the identities of applicants.

Overview of the Remote Identity Proofing Process

Remote identity proofing involves two major steps: (1) resolution and (2) validation and verification. During the resolution step, an organization determines which specific identity an applicant is claiming when they first attempt to initiate a transaction, such as enrolling for federal benefits or services, remotely. The most common form of remote interaction is through an organization’s website. The organization starts the identity resolution process by having the applicant provide identifying information, typically through a web-based application form. Examples of information that an organization may collect for identity resolution include name, address, date of birth, and Social Security number.

The organization then electronically compares the applicant’s identifying information with electronic records that it already has in its databases or with records maintained by another entity, such as a CRA, to determine (or “resolve”) which identity is being claimed. For example, if an individual named John Smith were applying, the organization would obtain enough identifying information about him to determine which “John Smith” he is from among the thousands of John Smiths that it may have in its records or that may be documented in the records of the CRA that it is using for this process.

Once the resolution process is complete, the process of validation and verification occurs. In this process, steps are taken to verify whether the applicant is really who they claim to be. For example, in the case of John Smith, it is not enough simply to determine which John Smith is being claimed, because the claimant may not really be John Smith at all. Organizations need to obtain electronic evidence from the remote applicant to verify their identity. Organizations can use a variety of techniques to accomplish this goal. Knowledge-based verification is a technique that commonly has been used for this purpose.

With knowledge-based verification, organizations ask applicants detailed and personal questions, under the presumption that only the real person will know the answers to these questions. To do this, the organization poses a series of multiple choice questions through an online web form, and the applicant selects the appropriate responses and submits the answers through the web form. If the applicant has chosen the correct responses, through the remotely accessed web form, their identity is considered to be verified, and the validation and verification step is complete. Figure 1 depicts the typical process that organizations use for remote identity proofing (including the use of knowledge-based verification).

The Role of CRAs in Knowledge-Based Verification

As previously mentioned, to perform knowledge-based verification for remote identity-proofing, federal agencies and other organizations often use services provided by CRAs. The CRAs assemble and evaluate consumer credit and other information from a wide variety of sources. Equifax, Experian, and TransUnion—the three nationwide CRAs—use the personal information they obtain about individuals from organizations, such as financial institutions, utilities, cell phone service providers, public records, and government sources, to compile credit files containing detailed records about individuals. They then use the information in these files to offer a variety of services to federal agencies and other entities. These services can include identity verification, as well as verification of income and employment of a candidate for a job or an applicant for benefits or services.

To support organizations that rely on knowledge-based verification, CRAs generate multiple choice questions that organizations can use to test applicants’ knowledge of information in their credit files. The organizations using the CRA services do not generate the questions themselves, because they do not have access to the credit history information maintained by the CRAs. Rather, the CRAs’ remote identity proofing systems transmit the questions and multiple choice answers to the organization through an automated electronic connection with the organization’s website. The organization’s website then displays the questions and multiple choice answers to the applicant through the web application that the applicant is using to apply for access to benefits or services.

Typically, the questions generated by CRA identity proofing systems ask about lenders, mortgage details, current and past home addresses, or credit card accounts. Once the applicant has selected answers to the questions and enters them in the online application, the organization’s automated system electronically relays the applicant’s responses to the CRA’s remote identity proofing system; this system then compares the responses with information in the applicant’s credit file. If this comparison determines that the applicant correctly responded to the questions, then the applicant’s identity is considered to be verified. The CRA’s identity proofing system electronically transmits the results of its comparison to the organization’s website to allow the applicant, whose identity is now considered verified, to proceed with applying for benefits or services.

OMB and NIST Provide Guidance to Agencies on Information Security Management

The Federal Information Security Modernization Act of 2014 (FISMA) is intended to provide a comprehensive framework for ensuring the effectiveness of security controls over information resources that support federal operations and assets, as well as the effective oversight of information security risks. FISMA assigns responsibility to the head of each agency to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or on behalf of an agency.

FISMA assigns responsibility to NIST for developing comprehensive information security standards and guidelines for federal agencies. These include standards for categorizing information and information systems according to ranges of risk levels and guidelines for establishing minimum security requirements for federal information systems.

To fulfill its FISMA responsibilities, NIST has issued technical guidance on many different aspects of information security, including identity proofing. NIST issued its first guidance related to identity proofing in 2011. In 2017, NIST released an updated version of its guidance, which included guidance on identity proofing that outlines technical requirements for resolving, validating, and verifying an identity based on evidence obtained from a remote applicant. OMB requires agencies to implement NIST’s technical guidance on information security subjects within one year of issuance. In the case of NIST’s updated guidelines for remote identity proofing, agencies would have needed to implement the guidance by June 2018 to meet OMB’s time frames.

FISMA assigns responsibility to OMB for overseeing agencies’ information security policies and practices. OMB, in turn, has established requirements for federal information security programs and has assigned agency responsibilities to fulfill the requirements of statutes such as FISMA. OMB policies and guidance require agencies to employ a risk- based approach and decision making to ensure that security and privacy capabilities are sufficient to protect agency assets, operations, and individuals.

OMB has not issued guidance to agencies specifically on identity proofing. However, OMB developed a draft policy document in April 2018 that is intended to provide guidance to agencies on strengthening the security of information and information systems to ensure safe and secure access to federal benefits and services. While it has not yet been issued, the draft policy indicates that OMB intends to provide policy- level guidance for agencies to identify, credential, monitor, and manage user access to information and information systems and adopt sound processes for authentication and access control.

Selected Agencies Use a Variety of Remote Identity Proofing Techniques, Including Knowledge- Based Verification

The six agencies that we reviewed rely on a variety of remote identity proofing techniques, including knowledge-based verification, to ensure that the individuals who enroll for federal benefits and services are who they claim to be. These agencies typically use knowledge-based verification services offered by CRAs, which generate questions for the individuals applying for benefits or services and check the applicants’ answers to verify their identity. However, to the extent that they use knowledge-based verification, these agencies face risks because an attacker could obtain and use an individual’s personal information to answer knowledge-based verification questions and successfully impersonate that individual.

Knowledge-Based Verification Poses Risks, but Alternative Techniques Have Been Developed That Are More Secure

Although commonly used by federal agencies for remote identity proofing, knowledge-based verification techniques pose security risks because an attacker could obtain and use an individual’s personal information to answer knowledge-based verification questions and successfully impersonate that individual. As such, NIST’s 2017 guidance on remote identity proofing effectively prohibits the use of knowledge-based verification for sensitive applications. The guidance states that the ease with which an attacker can discover the answers to many knowledge- based questions and the relatively small number of possible responses cause the method to have an unacceptably high risk of being successfully compromised by an attacker. In its guidance, NIST states that the agency no longer recommends using knowledge-based verification because it tends to be error-prone and can be frustrating for users, given the limitations of human memory.

According to NIST officials, private-sector providers of remote identity proofing solutions and officials at the agencies we reviewed, alternative methods for verifying an individual’s identity are available that are not knowledge-based and can provide stronger security assurance than knowledge-based verification. Specific examples of such techniques include:

Remote assessment of physical credentials. Recently developed technology allows an agency to remotely examine a physical credential, such as a driver’s license or a passport, to verify an individual’s identity. For example, an agency may have the individual use their mobile device, such as a cell phone, to capture and submit an image of their driver’s license to an agency or commercial provider of identity proofing services. The agency or commercial provider can then compare the image to documentation on file to confirm the authenticity of the credential. Technological advances in how images are captured and processed by mobile devices, such as cell phones, can provide improved assurance that the photos transmitted by these devices are genuine and that the credentials are authentic.

Verification of mobile device possession. Many individuals use their cell phones on a near-continuous basis and keep their phones with them. These actions create a record of the owner’s connection with these mobile devices that is difficult for an imposter to falsify.

Accordingly, an organization can query records maintained by cell phone carriers to verify the identity of an individual who is in possession of a specific mobile device and phone number. By doing this, the organization can determine how long the individual has had that particular device, compare unique identifiers, and determine if the location matches the individual’s billing information. The organization can be confident that the individual legitimately possesses the device if the device has been in use for some time and its current location corresponds to one where the device has been known to be used by its owner. Since an individual’s location information is obtained directly from the device and compared with cell phone carrier records, data entry errors by the individual, such as mistyping a phone number, are minimized and the risk of impersonation is reduced.

Verification through mobile device confirmation codes. An additional method that organizations use to help verify an individual’s identity is to verify that an individual possesses a telephone number that they have supplied as part of the remote identity proofing process. Organizations perform verification of an individual’s possession of a phone number by sending a code to that phone number through the short message service (SMS) or another protocol, and ask the individual to enter the code into the online identity proofing application. This process can provide additional assurance about the individual’s identity because the verification code is transmitted through a separate electronic channel (specifically, the telephone system) from the online application where the remote identity proofing process was initiated.

However, unlike the process for verifying the possession of a mobile device, the use of these codes may not prevent an imposter from using a stolen phone or stolen phone number. An imposter may be able to successfully complete the identity verification process if the applicant’s possession of the physical device has not been independently verified. In its remote identity proofing guidance, NIST requires federal agencies to use confirmation codes as a supplement to other identity proofing measures.

Verification through postal mail confirmation codes. Another method that organizations use to help verify an individual’s identity is to send a confirmation code, such as a personal identification number (PIN), through the mail system to the individual’s address of record. The individual then enters the PIN in the organization’s online application to confirm that they received the code in the mail. Like the use of mobile device confirmation codes, the use of postal mail codes can provide additional assurance about the individual’s identity because the code is sent through a separate medium from the online application where the remote identity proofing process was initiated.

Even with these alternatives to knowledge-based verification, however, there are limitations to the security assurances that can be provided. One way to overcome these security limitations is for a trained professional to conduct identity proofing in person. This is generally considered to be a strong approach because it allows for direct physical comparison of an individual’s documentation, including photographic evidence, to the individual attempting to enroll. Verification of the credentials being submitted can be performed by checking electronic records in tandem with physical inspection.

Figure 2 provides examples of alternative identity verification and validation methods that federal agencies have reported using.

Each of the alternatives to knowledge-based verification has other limitations, including implementation challenges. For example, in-person identity proofing is expensive to implement because it requires organizations to staff and maintain offices or other physical access points in multiple locations, and it can be inconvenient for applicants because it requires travel to one of these locations. Mobile device verification may not always be viable because not all applicants possess a mobile device that can be used to verify their identity. In addition, fraudsters can manipulate or “spoof” phone numbers that redirect phone calls and SMS confirmation codes to an attacker. Sending confirmation codes by postal mail can result in a delay in an individual being able to gain access to the services or benefits he or she is seeking.

Several of the Selected Agencies Have Taken Steps to Better Ensure the Effectiveness of Their Remote Identity Proofing Processes, but Only Two Have Eliminated the Use of Knowledge-Based Verification

As previously discussed, in 2017, NIST released an updated version of its technical guidance on remote identity proofing. NIST’s 2017 guidance effectively prohibits the use of knowledge-based verification for sensitive applications because of the security risks associated with this technique.

For applications where identity verification is important, the guidance prohibits agencies from providing access to online applications based solely on correct responses to knowledge-based questions. Rather, the guidance provides detailed specifications regarding the required features of the identity evidence (such as driver’s licenses and birth certificates) that an individual is to provide and how agencies are to verify that evidence. Agencies are restricted to using knowledge-based verification only for the very limited role of linking a single piece of identity evidence to an individual and only for applications where the identity verification process is not of critical importance. As a result, agencies are effectively prohibited from using traditional knowledge-based questions—the type of questions typically used in identity verification services provided by CRAs—as part of their processes. Thus, in order for agencies to ensure the effectiveness of their remote identity proofing processes, they are required to find ways to eliminate the use of knowledge-based verification.

Three of the six agencies we reviewed—GSA, IRS, and VA—have taken steps to enhance the effectiveness of their remote identity proofing processes. GSA and IRS recently eliminated knowledge-based verification from their Login.gov and Get Transcript services, respectively. VA has implemented alternative methods, but only as a supplement to the continued use of knowledge-based verification.

Among the other three agencies, two of them–SSA and USPS–are investigating alternative methods and have stated that they intend to reduce or eliminate their use of knowledge-based verification sometime in the future; however, these agencies do not yet have specific plans for doing so. One other agency, CMS, has no plans to reduce or eliminate knowledge-based verification for remote identity proofing.

General Services Administration Eliminated Knowledge-Based Verification from its Login.gov Service and Is Implementing Additional Verification Techniques

GSA has implemented alternative methods to knowledge-based verification for Login.gov. While GSA used knowledge-based verification on its Login.gov service in the past, the agency has recently implemented alternative verification techniques that do not rely on knowledge-based verification.

Specifically, GSA conducts independent verification of an applicant’s possession of a mobile device, an alternative technique we previously discussed. GSA contracts with a third-party vendor to compare status information about the phone number provided by an individual with telephone company records to confirm the individual’s identity. Further, GSA officials responsible for Login.gov stated that they plan to include additional alternative verification methods to Login.gov in the near future. Specifically, by the end of May 2019, the agency plans to implement software capable of analyzing and validating photos of documentation, such as driver’s licenses, provided by applicants to further enhance the verification of their identities. In 2018, the agency tested this technology through a pilot program.

GSA officials responsible for Login.gov stated that they are pursuing several other initiatives to further enhance the verification techniques they use for Login.gov. For example, they are researching new software methods for confirming the authenticity of face images and other biometric information that could be transmitted by applicants to confirm their identity. According to the officials, additional work is needed to ensure that a fraudulent image, such as a photo of a mask, is not being provided in lieu of a live image—a threat known as a “presentation attack.”

The GSA officials also said they would like to work with other federal agencies to leverage data that have already been verified, such as USPS-validated mailing addresses, passport and visa information maintained by the Department of State, and IRS tax data. However, the officials cited legal and regulatory restrictions to sharing agency data as a challenge to being able to make use of resources such as these.

GSA’s recent elimination of knowledge-based verification from its Login.gov identity proofing process is consistent with NIST’s 2017 guidance on remote identity proofing and reduces the risk of fraud associated with using Login.gov. The additional enhancements and coordination that the agency is working on, if successful, will likely further improve the effectiveness of its remote identity proofing processes.

Internal Revenue Service Eliminated Knowledge- Based Verification and Is Examining Additional Verification Techniques

IRS has implemented alternative methods to knowledge-based verification for Get Transcript. While IRS used knowledge-based verification on its Get Transcript service in the past, the agency has recently implemented alternative verification techniques that do not rely on knowledge-based verification.

Specifically, IRS conducts independent verification of an applicant’s possession of a mobile device and uses mobile device confirmation codes, alternative techniques we previously discussed. IRS contracts with a CRA to compare status information about the phone number provided by an individual with telephone company records to confirm the individual’s identity. Further, IRS officials responsible for Get Transcript’s identity proofing and authentication services stated that they plan to continue to add alternative verification methods to Get Transcript in the future. They stated that, in June 2017, in response to the release of NIST’s updated digital identity proofing requirements, the agency started a task force to examine the updated requirements and make recommendations on possible changes to IRS’s processes to meet the updated guidance. According to the officials, the task force developed a digital identity risk assessment process that the agency started using to assess external facing online transactions in October 2018.

IRS’s recent elimination of knowledge-based verification from its Get Transcript identity proofing process and the additional enhancements that the agency is working on, if successful, will likely further improve the effectiveness of its remote identity proofing processes.

Department of Veterans Affairs Has Implemented Some Alternative Methods, but Has No Plans to Reduce or Eliminate its Remaining Use of Knowledge-Based Verification

VA has taken steps to better ensure the effectiveness of its remote identity proofing processes, but it continues to rely on knowledge-based verification for certain categories of individuals. As previously mentioned, VA relies on two different providers, a commercial identity verification service (called ID.me) and DOD’s DS Logon, to conduct identity proofing for its benefits systems. These providers use a mix of knowledge-based verification and alternative techniques. DOD’s DS Logon verifies applicants using knowledge-based verification, while the commercial provider uses both knowledge-based verification processes as well as stronger alternative techniques. For example, the commercial provider uses cellular phone data to verify an applicant’s identity based on the device subscriber’s relationship to a claimed identity and the subscriber’s tenure with the carrier.

VA’s commercial provider can also remotely authenticate identity documents. In this regard, applicants can scan the front and back of driver’s licenses, state identification, and passports, and upload the images to the commercial provider, which then analyzes the images to ensure that the documents meet standards and contain valid information. Further, the provider verifies applicants by having them take photos of themselves and then using facial recognition technology to match the applicants’ images with their identity documents.

VA officials in the agency’s information technology and benefits program offices believe that the alternative forms of identity proofing used by its commercial provider as a supplement to knowledge-based verification provide an acceptable level of assurance. Nevertheless, the officials acknowledged that it is important to eventually eliminate knowledge- based verification from the agency’s identity-proofing processes.

However, the agency does not have specific plans with time frames and milestones to eliminate the use of knowledge-based verification. VA officials stated that it has not yet established plans for doing so because of its reliance on DOD’s DS Logon service, which still uses knowledge- based verification. Until it develops a specific plan with time frames and milestones to eliminate its reliance on knowledge-based verification, VA and the individuals it serves will continue to face a degree of identity fraud risk that could be reduced.

Social Security Administration Intends to Eliminate Knowledge- Based Verification, but Does Not Yet Have Specific Plans for Doing So

SSA continues to rely on knowledge-based verification for its My Social Security service, but SSA officials stated that the agency intends to eliminate knowledge-based verification in the future. According to the SSA Chief Information Security Officer, in fiscal year 2019, the agency intends to pilot alternative verification methods, such as using the commercial ID.me service. In addition, the official said SSA plans to research other alternatives that could be used to replace knowledge- based verification, including modernizing its legacy systems so that they can use Login.gov or another shared identity management platform. The agency has set a goal of eliminating the use of knowledge-based verification in fiscal year 2020.

As an interim measure to reduce the risks associated with knowledge- based verification, SSA officials stated that they limit the period of time and the number of attempts that an individual has to answer the knowledge-based verification questions. These limitations are designed to prevent a potential fraudster from researching the answers to the questions. In addition, SSA also sends a confirmation code via email or SMS, which individuals must enter online before being given access to their account.

SSA does not yet have specific plans and milestones to achieve its goal of implementing enhanced remote identity proofing processes by fiscal year 2020. SSA officials stated that they cannot develop specific plans until they are able to identify an alternative method or methods that can be used successfully by all members of the public with which the agency interacts. Until SSA develops specific solutions for eliminating knowledge- based verification, the agency and the individuals that rely on its services will remain at an increased risk of identity fraud.

United States Postal Service Intends to Eliminate Its Use of Knowledge-Based Verification, but Does Not Yet Have Complete Plans and Time frames for Doing So

USPS has not yet fully implemented alternative methods to better ensure the effectiveness of its remote identity proofing processes. According to officials responsible for the agency’s identity proofing program, USPS mitigates the risk of using knowledge-based verification by sending a written confirmation to the physical address associated with each identity- proofing transaction and provides instructions for what to do if the transaction is unauthorized or fraudulent.

In addition to this mitigation measure, the officials reported that they regularly evaluate new capabilities to further increase confidence in their identity-proofing processes and are planning several additional measures to supplement the use of knowledge-based verification. Specifically, in September 2018, USPS began allowing customers to request a confirmation code via the mail to allow them to enroll in Informed Delivery. In addition, the agency is planning on implementing verification of mobile device possession and SMS enrollment code verification in 2019 and other techniques at a subsequent time. According to USPS officials, these alternative techniques are expected to reduce the agency’s use of knowledge-based verification. The officials said that USPS has not completely eliminated the use of knowledge-based verification because available alternatives to the agency’s current processes do not satisfactorily address critical factors that they consider when deciding whether to implement alternative processes. These factors include cost, projected ability to reduce fraud and protect consumers, projected extent of the population that could be covered, and the burden on customers to complete the process.

The officials stated that the agency intends to implement alternative methods in the future for its Informed Delivery service but does not yet have specific plans with time frames and milestones. The officials noted that part of the reason for the slow implementation of alternative methods is that NIST technical guidance does not provide direction on how alternative methods are to be implemented and that additional guidance from NIST would be helpful to the agency for developing and implementing a plan to eliminate knowledge-based verification for the Informed Delivery service.

While the supplemental processes implemented by USPS to date may help to reduce the risks associated with using knowledge-based verification, they do not eliminate such risks. Until it completes a plan with time frames and milestones to eliminate its reliance on knowledge-based verification for Informed Delivery, USPS and its customers will remain at increased risk of identity fraud.

Centers for Medicare and Medicaid Services Has No Plans to Reduce or Eliminate its Use of Knowledge-Based Verification

CMS has not implemented alternative methods to better ensure the effectiveness of the remote identity proofing processes used for its Healthcare.gov service. CMS officials in the Office of Information Technology and the Office of Consumer Information and Insurance Oversight stated that the agency uses a two-step email verification process to reduce the risks associated with knowledge-based verification. Specifically, individuals applying for an account on Healthcare.gov provide basic information (e.g., name, email address, password) and then are asked to acknowledge an email confirmation they receive from CMS. The email confirmation is intended to prove that the individual applying for a Healthcare.gov account is in possession of the email address that same individual provided to CMS.

However, this process confirms only the email address that was used to create the account; it does not confirm the identity of the individual who is applying for the account. CMS stated that it uses this process because other mitigating measures are not cost effective. However, NIST’s guidance does not permit agencies to use knowledge-based verification on the basis of cost effectiveness. Further, the agency does not have specific plans with time frames or milestones to eliminate its use of knowledge-based verification for Healthcare.gov.

CMS officials acknowledge that they do not have a plan to reduce or eliminate the use of knowledge-based verification because they have not yet identified any effective alternatives to knowledge-based verification for Healthcare.gov. According to these officials, based on a user study they conducted, individuals who use the agency’s services prefer knowledge- based verification over any available alternatives. In addition, the officials stated that certain alternatives, such as mobile device verification, may not always be suitable for the population they serve. As one example, not all applicants have a mobile device that could be used to remotely verify the individual’s identity. The CMS officials noted that NIST technical guidance does not provide direction on how alternative methods are to be implemented, given that they may not always be suitable for the population served by Healthcare.gov. However, until CMS takes steps to develop a plan with time frames and milestones to eliminate the use of knowledge-based verification, CMS and Healthcare.gov applicants will remain at an increased risk of identity fraud.

NIST and OMB Have Not Provided Sufficient Guidance to Ensure Agencies Move to More Secure Forms of Remote Identity Proofing

While NIST has issued guidance to agencies related to identity proofing and OMB is drafting identity management guidance, these efforts are not sufficient to ensure that agencies adopt secure methods for remote identity proofing. As previously discussed, NIST’s guidance effectively prohibits the use of knowledge-based verification during the validation and verification phases of the remote identity proofing process, but does not provide direction to agencies on how to successfully implement alternative methods for remote identity proofing for large and diverse segments of the population. Further, OMB has not issued guidance requiring agencies to report on their implementation of remote identity proofing processes, which is essential for monitoring agencies’ progress.

NIST Guidance Does Not Provide Sufficient Direction to Agencies on How to Implement Alternative Methods for Remote Identity Proofing

Best practices in IT management state that organizations should provide clear direction in order to achieve objectives. Specifically, the Control Objectives for Information and Related Technologies (COBIT), a framework of best practices for IT governance, states that organizations should provide clear direction for IT projects, including relevant and usable guidance, and ensure that those implementing the technology have a clear understanding of what needs to be delivered and how.

However, NIST has not issued any supplemental implementation guidance to its 2017 technical guidance to ensure that agencies have a clear understanding of what needs to be done to implement alternative methods of remote identity proofing, as called for in the technical guidance. For example, NIST’s technical guidance provides abstract descriptions of identity evidence that individuals must provide, such as a credential containing a photograph or other biometric identifier as well as anti-counterfeiting security features. The guidance states that such credentials can be provided in person or remotely but does not detail the processes needed for providing credentials remotely.

For example, the guidance does not discuss the advantages and limitations of currently available technologies that agencies could successfully use to remotely verify credentials provided by individuals or to make recommendations to agencies on which technologies should be adopted. As previously discussed, several potential limitations could make choosing an alternative method difficult. Technologies such as secure, remote verification of a physical credential may not be commercially available. Also, some alternative technologies require that individuals use cell phones and maintain a verifiable record of having them in their possession. The NIST guidance does not discuss how agencies should accommodate segments of the public who do not possess advanced technological devices, such as cell phones, that may be needed for successful remote verification. Because the guidance does not include specific advice or direction on implementing alternative technologies, agencies may be unable to determine what alternative methods are viable for the populations they serve.

As previously discussed, several of the agencies we reviewed send confirmation codes to applicants via cell phone, email, or postal mail, as ways that they believe compensate for risks associated with using knowledge-based verification. However, NIST officials do not consider such methods for remote verification to be effective in compensating for the risks associated with knowledge-based verification. Instead, the NIST technical guidance requires agencies to send confirmation codes by mail when they use any remote identity proofing method, including more advanced, alternative verification methods, such as verification of mobile device possession.

Officials from CMS, SSA, and USPS stated that they have not eliminated their use of knowledge-based verification in part because the existing NIST technical guidance does not provide direction on how alternative methods are to be implemented, given the various limitations of those alternative methods that agencies have identified. The officials stated that federal agencies could benefit from additional guidance on implementing the alternative verification techniques called for in the NIST technical guidance.

In response to these agencies’ comments about being unable to fully implement the remote identity proofing guidance, NIST officials stated that agencies were expected to use their own judgment to determine how to meet the remote identity proofing requirements. The officials added that it was NIST’s position that the updated guidance was comprehensive enough for agencies to follow. Thus, at the time of our review, NIST did not have plans to assist agencies by issuing implementation guidance to supplement its existing technical guidance. NIST officials stated that they are available to provide assistance on an individual basis to agencies that seek their advice.

Without additional guidance from NIST on how agencies are to implement the alternative identity proofing methods specified in an agency’s existing technical guidance, agencies may not be using the most effective and secure identity-proofing methods, thus exposing their systems to risk of fraud.

OMB Guidance Does Not Include Reporting Requirements to Facilitate Monitoring of Agencies’ Implementation of Secure Remote Identity Proofing

FISMA requires the Director of OMB to oversee agency information security policies and practices. However, OMB has not provided agencies with guidance establishing reporting requirements for OMB to use in monitoring agencies’ progress in implementing secure remote identity proofing processes. For example, OMB has not proposed including reporting requirements for remote identity proofing in its draft policy on identity, credential, and access management, nor has it included reporting requirements in its FISMA reporting guidance to agencies for fiscal year 2019.

According to OMB staff, OMB plans to issue guidance to agencies on the implementation of identity, credential, and access management. OMB issued a draft of this guidance for public comment in April 2018. However, the draft guidance does not include a requirement for agencies to report on progress in implementing secure remote identity proofing processes.

Because it does not require agency reporting on progress in implementing secure remote identity proofing processes, OMB does not have visibility into the extent that agencies rely on insecure methods, particularly knowledge-based verification. Without establishing effective oversight measures, OMB cannot adequately monitor agency progress in implementing the secure identity proofing methods called for in NIST’s 2017 technical guidance. As a result, agencies may be at risk of implementing weak methods of remote identity-proofing for individuals who seek access to services and benefits from the federal government, which may put both the federal government and individuals at risk for fraud.

Conclusions

The six agencies that we reviewed rely on a variety of remote identity proofing techniques to help ensure that the individuals who enroll for federal benefits and services are who they claim to be. Several of the selected agencies use knowledge-based verification processes that rely on CRAs to pose questions to individuals and check their answers as a way of verifying their identities before granting them enrollment in a federal benefit or service. However, given recent breaches of sensitive personal information, these agencies face risks because fraudsters may be able to obtain and use an individual’s personal information to answer knowledge-based verification questions and successfully impersonate that individual to fraudulently obtain federal benefits and services.

Two agencies we reviewed, GSA and IRS, recently implemented remote identity proofing processes for Login.gov and Get Transcript that allow individuals to enroll online without relying on knowledge-based verification. However, four agencies (CMS, SSA, USPS, and VA) were still using knowledge-based verification to conduct remote identity proofing. Moreover, none of the four agencies have developed specific plans to eliminate knowledge-based methods from their processes. Without such plans, these federal agencies and the individuals that rely on such processes will remain at risk for identity fraud.

NIST has issued technical guidance regarding remote identity proofing, but it may not be sufficient to help ensure that federal agencies adopt more secure methods. NIST’s guidance does not provide direction on how agencies can adopt more secure alternatives to knowledge-based verification while also addressing issues of technical feasibility and usability for all members of the public. In addition, OMB has not issued guidance setting agency reporting requirements that OMB could use to track implementation of more secure processes across the federal government. Without additional guidance, federal agencies are likely to continue to rely on risky knowledge-based verification that could be used to fraudulently gain access to federal benefit programs and services.

Recommendations for Executive Action

We are making a total of 6 recommendations to CMS, NIST, OMB, SSA, USPS, and VA. Specifically: The Administrator of the Centers for Medicare and Medicaid Services should develop a plan with time frames and milestones to discontinue knowledge-based verification, such as by using Login.gov or other alternative verification techniques. (Recommendation 1)

The Director of the National Institute of Standards and Technology should supplement the agency’s 2017 technical guidance with additional guidance to assist federal agencies in determining and implementing alternatives to knowledge-based verification that are most suitable for their applications. (Recommendation 2)

The Director of the Office of Management and Budget should issue guidance requiring federal agencies to report on their progress in adopting secure identity proofing processes. (Recommendation 3)

The Commissioner of Social Security should develop a plan with specific milestones to discontinue knowledge-based verification, such as by using Login.gov or other alternative verification techniques. (Recommendation 4)

The Postmaster General of the United States should complete a plan with time frames and milestones to discontinue knowledge-based verification, such as by using Login.gov or other alternative verification techniques. (Recommendation 5)

The Secretary of the Department of Veterans Affairs should develop a plan with time frames and milestones to discontinue knowledge-based verification, such as by using Login.gov or other alternative verification techniques. (Recommendation 6)

Agency Comments and Our Evaluation

We requested comments on a draft of this report from the eight agencies included in our review. In response, we received written comments from six agencies—Commerce (on behalf of NIST), HHS (on behalf of CMS), IRS, SSA, USPS, and VA. Their comments are reprinted in appendices II through VII, respectively.

Of the six agencies to which we made recommendations, four of them (Commerce, SSA, USPS, and VA) agreed with our recommendations, and one agency (HHS) did not concur with our recommendation. One agency (OMB) did not state whether it agreed or disagreed with our recommendation. In addition, multiple agencies (GSA, IRS, OMB, USPS, and VA) provided technical comments on the draft report, which we have incorporated, as appropriate.

The following four agencies agreed with the recommendations that we directed to them:

Commerce agreed with our recommendation. The department stated that it will develop additional guidance to assist federal agencies with alternatives to knowledge-based verification and expects to do so within one year from issuance of this report. Comments from Commerce are reprinted in appendix II.

SSA agreed with our recommendation. The agency stated that it will continue to seek improvements in its existing remote identity proofing process. SSA also stated that, in addition to a roadmap it developed in fiscal year 2019 to update its knowledge-based verification process to a more secure multi-factor authentication technology, it will take steps to ensure compliance with NIST standards for remote identity proofing. SSA’s comments are reprinted in appendix V.

USPS agreed with our recommendation. The agency stated that it will be developing a roadmap to implement additional identity-proofing tools and techniques through 2020. Comments from USPS are reprinted in appendix VI.

VA agreed with our recommendation. The department stated that it will develop a specific plan with time frames and milestones to eliminate knowledge-based verification from the aspects of the remote identity proofing process that it controls.

Further, in its response, VA requested that GAO direct a recommendation to the Department of Defense (DOD) to discontinue DS Logon and consider using Login.gov instead. However, we are not issuing any recommendations to DOD because our scope of work did not include auditing DOD’s remote identity proofing processes. Nevertheless, we have adjusted our recommendations to CMS, SSA, USPS, and VA to clarify that Login.gov is one option for identity proofing that they should consider when developing their plans to discontinue the use of knowledge-based verification. VA’s comments are reprinted in appendix VII.

One agency did not concur with our recommendation. Specifically, HHS raised several issues related to our findings. The agency stated that it uses a risk-based approach to designing systems controls and that a unilateral prohibition on the use of knowledge-based verification without alternatives is not a feasible solution. We agree with this comment and strongly support a risk-based approach to designing security controls, as required by FISMA. However, we believe that alternatives to knowledge- based verification exist that should be assessed and incorporated as appropriate. Similarly, HHS noted that for other applications across the department, it has considered factors such as consumer user experience, cost, and operational feasibility in addition to NIST guidelines. We agree that many factors need to be considered in assessing what method or methods of identity proofing are most appropriate for any given application but believe it is important for agencies to develop plans for addressing those factors that also eliminate the use of risky techniques, such as knowledge-based verification, that could have a negative impact on consumers and agencies.

In response to our specific recommendation to CMS, HHS stated that it does not believe that suitable alternative methods exist that would work for CMS’ population of users, such as those in the rural community, due to distance or individuals without cell phones. However, we continue to believe that CMS should develop a plan to discontinue the use of knowledge-based verification. We recognize that there are members of the population that may not be reached with certain identity proofing techniques; however, a variety of alternative methods to knowledge- based verification are available that CMS can consider to address the population it serves. Comments from HHS are reprinted in appendix III.

In addition, OMB did not state whether it agreed or disagreed with our recommendation. Further, in an email response, OMB staff from the office of the Federal Chief Information Officer provided a technical comment, which we incorporated. However, OMB did not otherwise comment on the report findings or our recommendation made to the agency.

The IRS also provided written comments on the draft report. In its comments, the agency described the status of its efforts to strengthen identity verification processes, including the fact that it has eliminated the use of knowledge-based verification. Comments from IRS are reprinted in appendix IV. Finally, GSA provided only technical comments on the draft report, as previously mentioned.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, to the Administrators of the Centers for Medicare and Medicaid Services and General Services Administration; the Commissioners of Internal Revenue and Social Security; Director of the Office of Management and Budget; the Postmaster General of the United States; and the Secretaries of the Departments of Commerce and Veterans Affairs. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Nick Marinos at (202) 512-9342 or marinosn@gao.gov, or Michael Clements at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VIII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe selected federal agency practices for remote identity proofing of individuals seeking access to major web-based applications using services provided by consumer reporting agencies and the risks associated with those practices, (2) assess selected federal agencies’ actions to ensure the effectiveness of agencies’ remote identity proofing processes, and (3) assess the sufficiency of federal identity proofing guidance developed by OMB and NIST in assuring the security of federal systems.

To address the first objective, we made an initial, non-probability selection of federal agencies that (1) maintained major public-facing web applications to provide access to federal benefits or services and (2) relied on identity proofing solutions provided by the three nationwide consumer reporting agencies (CRAs)—Equifax, Experian, and TransUnion—to verify the identities of individuals applying for such benefits or services. We considered a “major” application to be one that could involve interaction with millions of individuals across the entire country. To select six agencies from this group, we reviewed prior GAO reports to identify potential agencies for review. We then interviewed officials at these agencies and at CRAs to confirm that these agencies use CRAs as part of their identity proofing processes and to obtain information about additional federal agencies that also employ CRAs for identity proofing for major applications. We included GSA in these interviews because its mission is to support federal agencies and it was likely to be aware of additional federal agencies that fit our criteria. From the information we gained from our interviews and research, we selected these six agencies: the Centers for Medicare and Medicaid Services (CMS), General Services Administration (GSA), Internal Revenue Service (IRS), Social Security Administration (SSA), United States Postal Service (USPS), and the Department of Veterans Affairs (VA).

At each of these agencies, we reviewed documentation that described the current remote identity proofing processes the agencies are using for their major public-facing web applications. In addition, we interviewed agency officials responsible for identity proofing to obtain details of the techniques used to verify remote users of these applications. To the extent that these entities used CRAs to conduct knowledge-based verification as part of their remote identity-proofing processes, we discussed the risks associated with using knowledge-based methods as well as the potential advantages and limitations of using alternative methods that are not knowledge-based. We also obtained information from officials at NIST about the risks of knowledge-based methods and the availability of alternative methods.

To address the second objective, we assessed remote identity proofing processes used by the selected agencies to determine the extent that they rely on knowledge-based verification to enroll online applicants for federal benefits and services. We also identified alternative methods used by these agencies, either in place of or in addition to knowledge-based verification, and assessed the extent to which agencies had implemented these methods to mitigate the risk of using knowledge-based methods. We compared the remote identity proofing processes at these agencies with the requirements as specified in NIST Special Publication 800-63, Digital Identity Guidelines, to determine whether the processes met the requirements of the NIST guidance. We also interviewed officials responsible for these identity proofing programs to obtain information about agencies’ plans, if any, to eliminate the use of knowledge-based verification from their remote identity proofing processes in the future and obtained relevant documentation of such plans.

To address the third objective, we reviewed NIST Special Publication 800-63, Digital Identity Guidelines, to identify federal requirements for remote identity proofing. We compared the guidance to the Control Objectives for Information and Related Technologies (COBIT), a framework of best practices for IT governance, to determine whether the NIST guidance contained clear direction, including relevant and usable guidance, to ensure that those implementing the technology have a clear understanding of what needs to be delivered and how. To assess the sufficiency of this guidance, we consulted with subject matter experts at NIST, ID.me, a private-sector provider of remote verification technologies, and relevant officials at the selected federal entities. Based on information we had obtained about available alternative methods, we determined the extent to which gaps existed in the NIST guidance with regard to implementation of alternative technologies. We also obtained the views of federal agency officials on the extent to which NIST guidance provided sufficient direction to assist them in implementing appropriate remote identity proofing methods.

Further, we reviewed OMB’s draft Identity, Credential, and Access Management policy and compared it to the requirements in FISMA and identified shortfalls. We also interviewed OMB staff to discuss the sufficiency of the office’s current guidance and to determine whether the office planned to issue additional guidance establishing reporting requirements for federal entities or conduct other forms of oversight of federal entities’ implementation of the NIST identity proofing guidance.

We conducted this performance audit from November 2017 to May 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Commerce

Appendix III: Comments from the Department of Health and Human Services

Appendix IV: Comments from the Internal Revenue Service

Appendix V: Comments from the Social Security Administration

Appendix VI: Comments from the United States Postal Service

Appendix VII: Comments from the Department of Veterans Affairs

Appendix VIII: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individuals named above, John de Ferrari and John Forrester (assistant directors); Tina Torabi (analyst-in-charge); Bethany Benitez, Christina Bixby, Chris Businsky, Kavita Daitnarayan, Nancy Glover, Andrea Harvey, Thomas Johnson, David Plocher, Rachel Siegel, and Winnie Tsen made key contributions to this report.