NIST shifts focus from mobile driver’s license technology to adoption

Speaking at a recent Cybersecurity Connections event hosted by NIST and the National Cybersecurity Center of Excellence (NCCoE), Ryan Galluzzo, identity program lead for NIST, starts with a hard truth: online identity verification isn’t easy.

“I think in general people understand that there are major challenges with how we identify who we’re interacting with online, and how we manage the risk associated with potential fraud,” he says. Generative AI technology has amplified the problem, contributing to a crisis in online trust. But increased friction only exacerbates the problem.

Luckily, NIST and NCCoE are working on it. Namely, on verifiable credentials and mobile driver’s licenses (mDL), which provide a cryptographically signed, privacy preserving digital answer. But also – and more to the point – on telling others about them.

“One of the challenges we observed is that not many relying parties know what to do with this technology yet,” he says. “They haven’t figured out how to implement that technology within their online workflows. They haven’t started to think through what those implications are.”

NCCoE aims to help organizations enter and navigate that conversation. “How can we understand the potential impact of this technology and how can we give organizations a bit of a roadmap to be able to say, I would like to do that?”

Second NIST mDL use case focuses on US government services

Part of the answer is laid out in the progress of NCCoE’s mDL use case projects. The first build, for high assurance financial services, was prompted by increases in fraud; it is now complete. A second build, for government services, is in progress. The final phase will look at identity verification use cases for the healthcare sector.

For the government project, NIST is building on the base of its SP 800-63-3 Digital Identity Guidelines and working closely with partners at Login.gov and the states of Maryland and Georgia to try and capture practical, real-world implementations of mDL for access to government services. Outputs will focus on communications: a new blog series introducing the VDC ecosystem and the standards that underpin it, and an online resource hub, as well as the Special Publication 1800-42A practice guidelines, which has already been published for public comment.

GenAI makes collaborative effort necessary

NCCoE Security Engineer Bill Fisher speaks of how generative AI has upended online identity verification across sectors in a short timespan, and forced a reevaluation of fraud prevention priorities. Losses related to insufficient digital identity systems have spiked and are expected to keep climbing. Generative AI, Fisher says, has leapfrogged some biometric authentication tools that, while less than five or ten years old, are already outdated.

Mobile driver’s licenses are NIST’s proposal for changing the rules of the game. But it goes far beyond the institute: the larger mDL ecosystem CRADA consortium includes providers like Idemia and 1Password, Microsoft, Google, a number of financial institutions, standards bodies, various state DMVs and issuers, and the OpenID Foundation, among others. The collaborative approach is central to making the system work.

That applies not just to the technical infrastructure, but also to simple awareness. NCCoE’s presentation concludes with the ground-level assertion that yes, verifiable digital credentials are indeed real, and yes, you can use them.

“We need to get more use cases and we need to give people the opportunity to use these in more places,” Galluzzo says. “So, as an organization, as a relying party or potentially as an issuer, start to familiarize yourself with the VDC ecosystem. Understand what the technology is and what it could mean for you. Start to evaluate your current identity verification processes.”

Two other major takeaways are the value of engaging with standards bodies, and the importance of pilots; Galluzzo says “the only way to understand how it works, what your implementations are going to look like, what your requirements are going to be, what your procurements are going to be expected to look like, is to start putting those things into place, testing them out and understanding how you can get some data around usage.”

The presentation finishes, though, by going back to communication – a key learning from the financial services use case. “Make sure that your regulators, your compliance folks, your governance folks, your organization risk management, they understand what the technology is, how it works, and how it impacts their ability to achieve their goals and outcomes – and have that education baseline, because that will help you as you go forward in getting the technology through the processes of governance that you have in your organization.”

Adoption: half what you do, half how you explain it

Across the board, from age assurance to national digital identity to mobile driver’s licenses, there is an emergent need to recalibrate priorities in how these systems are introduced. Much emphasis is placed on tech and regulation. Much more needs to be devoted to explaining how they work.

Tech’s Achilles heel is speed. Working fast is framed as a virtue and a goal, and competition spurs teams to get products to market as soon as they are viable. Silicon Valley does not explain its tech without a business agenda. As a result, distrust is endemic.

Governments do not typically move at the speed of private innovation. But they may have adopted some of its assumptions when it comes to public comfort with technological change – for one, that mass systems can be brought online and established without an exhaustive public discussion about the long-term implications, cohesive coordination with standards bodies, and a communications effort that equals the one devoted to software. Consider that the average U.S. citizen’s first response if asked for their opinions on mDL is still highly likely to be, “what’s that?”

Article Topics

government services  |  identity verification  |  mDL (mobile driver’s license)  |  NCCoE  |  NIST  |  NIST Special Publication 800-63  |  verifiable credentials