Oversight body lists risks for the US’ mired Login.gov project

The U.S. government’s Login.gov program continues to provide lessons to review for future public administration, public policy and digital identity students.

Officials from a Department Treasury’s inspector general’s office, a watchdog agency, last month published a significantly redacted 20-page memo (largely a timeline) recounting the Internal Revenue Service sign-on travails.

The memo is one of the more unflattering portraits of government, generally, and digital ID and access management by government, specifically. It very much is worth the time to read. Trade publication Nextgov/FCW has a good summary of the timeline and results.

The single sign-on program Login.gov has proved problematic in Washington. At the same time, the program is entangled with the federal government’s unpopular, tentative and sometimes chaotic efforts to add facial recognition as an anti-fraud tool.

Inspector general staff reviewed events and communications occurring between June 2019 and last July and circled three unresolved security risk, only two of which have been made public.

Login.gov is not yet in compliance with Identity Assurance Level 2, devised by the National Institute of Standards and Technology.

IAL2 is met when a process can use evidence to support someone’s claimed identity and verifies an applicant remotely (with biometrics) or physically. And attributes can be asserted by a credential service provider to relying parties.

Another risk hangs on Login.gov’s not fully implanting specific controls. These controls would improve the program’s anti-fraud functions, which are mandated by the Office of Management and Budget.

The third risk is largely redacted, but still bodes no good. There are potentially fraudulent activities by an unknown actor that should be investigated.

The response by the Treasury Department, a brief memo from the deputy commissioner for operations support says nothing more than officials appreciate the inspector general’s efforts and that protecting taxpayer data is a top priority.

Article Topics

biometric authentication  |  biometrics  |  digital ID  |  government services  |  GSA  |  identity assurance  |  identity verification  |  Login.gov