Making digital identity work takes more than technology

The takeaway from many of the top stories on Biometric Update this week is that making digital identity work depends on appropriate architecture, effective governance, communication and accountability. Biometrics’ effectiveness An independent analysis for the European Commission says that age assurance can be implemented in a way that preserves fundamental rights, even at costs near the current average of 7 euro cents per check. While age checks can introduce risks to privacy and other rights, there are clear ways to mitigate those risks, according to the report.

The Association of Digital Verification Professionals (ADVP) echoes the privacy-protecting possibilities of age assurance technology in a post by SmartSearch CEO Phil Cotter. The ADVP acknowledges the AVPA's expertise on the issue and calls for greater alignment between the UK and international regulators. Spanish regulator AEPD says alternatives to biometrics can satisfy GDPR without being as fast or convenient, as long as it is equivalent in terms of effectiveness.

The clarification also acknowledges that biometric verification carries less privacy risk than one-to-many identification. Contractors under scrutiny eu-LISA is seeking to hold IBM, Atos and Leonardo accountable for problems with Europe's Entry/Exit System (EES), which has faced widespread delays and complaints even before its biometric functionality is fully operational. It has chosen new contractors Sword, Netcompany and Sopra Steria, and is suing the old ones.

USCIS has raised the estimated contract ceiling for its planned Immigration Biometrics and Identity Services (IBIS) program to $250 million. A solicitation is expected in the coming weeks for a contract to run through early-2032. Judging effectiveness requires transparency UK police cannot show comprehensive records for the investigative benefits of using retrospective facial recognition, according to a government inspection of policy and practice.

Evidence from individual forces suggests weak governance and inconsistent record-keeping are contributing to the lack of transparency. The right credential in the right place The World Bank’s new policy paper on digital wallet implementation emphasizes the difference between the kind of distributed architecture it is recommending and a government smartphone app. The paper advises setting up the right kind of ecosystem, including early adoption of international standards and governance frameworks, and taking a phased approach to wallet rollout.

Private sector digital identity providers can now participate in Australia’s digital ID ecosystem, and businesses can use the government’s myID. How commercially viable private sector tools will be in an ecosystem with a free government alternative available remains to be seen. Africa’s problem with uncollected ID cards may be best addressed not by getting the credentials to the people, but by avoiding printing them in the first place, ID30’s Jaume Dubois tells Biometric Update in an interview.

People may want a physical ID card before they get a digital ID, but once they can access services their priorities change, as the experiences of many countries attest. Cybersecurity at scale Serpro says Brazil’s digital identity platform has fended off a six month-long DDoS attack without a service disruption, though some authentication systems appear to have had problems during the same period. The stakes are high: Gov.br supports access to over five thousand digital services for nearly 180 million active accounts.

The cybersecurity resilience of the weakest partners in Japan’s digital government services ecosystem seems to be a disadvantage of its more decentralized architecture. The responsible government ministry has disclosed a pair of recent data breaches, and experts allege the My Number system has structural weaknesses. Please tell us in the comments below or through social media if you see any podcasts, online video presentations or other content that we should share with the people in biometrics and the digital identity community.