DHS S&T, USCIS partner on digital credentials using open standards

The U.S. Department of Homeland Security’s Science and Technology Directorate (S&T) and U.S. Citizenship and Immigration Service (USCIS) announced that they’ve partnered to develop and issue digital credentials using open Internet standards.

The Document Management Division of the Office of Intake and Document Production (OIDP) at USCIS is tasked with the production of all immigration documents. OIDP designs the documents and acquires the vendors to produce them.

Jared Goodwin, chief of OIDP’ document division, said USCIS wants to be able to issue digital credentials, like a green card, to a smartphone, which would be easier to carry and use, more secure, and could be supported online. Actions like renewing and modifying immigration status would not require standing in line at an office somewhere, he said.

S&T, meanwhile, has working to make identity credentials and documents more secure.

Goodwin said the USCIS-S&T partnership emerged after she discovered S&T’s Silicon Valley Innovation Program was exploring similar solutions.

“They’re going out to industry to look for ways to partner with agencies to prevent forgery and the counterfeiting of certificates and licenses,” he said. Jared contacted SVIP and the solution that they settled on together is to use two openly developed, global standards called Verifiable Credentials Data Model (VCDM) and Decentralized Identifiers (DID).

With support from S&T, USCIS, and many other like-minded partners, the World Wide Web Consortium (W3C) is working on online standards for a secure, privacy respecting digital credentialing process.

S&T explained that “part of the promise of the W3C standards is the ability to share only the data required for a transaction.” S&T used the example of a store “cashier asking for proof that you are older than 21. The customer could use the digital Permanent Resident Card on their phone to prove their verified age without sharing any other information (not even a specific date of birth). This is an important step towards putting privacy back in the hands of the people.”

The DHS Privacy Office, which is charged with “embedding and enforcing privacy protections and transparency in all DHS activities,” has been brought into the process to review the W3C VCDM/DID framework and to advise on any potential issues.

“Beyond ensuring global interoperability, standards developed by the W3C undergo wide reviews that ensure that they incorporate security, privacy, accessibility, and internationalization,” said SVIP Managing Director Melissa Oh. “By helping implement these standards in our digital credentialing efforts, S&T, through SVIP, is helping to ensure that the technologies we use make a difference for people in how they secure their digital transactions and protect their privacy.”

“Going forward, the government wants to ensure individuals have agency and control over their digital interactions,” Goodwin added. “The user should be able to own their identity and decide when to share it, and we don’t want a system that has to reach back to an agency for verification.”

DIDs are unique identifiers that can be assigned to organizations, devices, or people. And unlike a social security number, DIDs function solely as an identifier and cannot be used for verification, as that role is deliberately separated and implemented using public key cryptography.

VCDM is a way to express credentials in a way that is cryptographically secure, privacy respecting, and machine verifiable. In addition, this standard enables a person to minimize the disclosure of personal data by implementing selective disclosure capabilities.

“Selective disclosure allows digital credentials to contain many pieces of information but gives the user discretion to share only the specific information required for a particular transaction with the government or non-government entities, rather than disclosing the entire contents of the credential,” S&T explained.

S&T said because of the “work of SVIP, USCIS and many others, digital credentials using W3C VCDM and W3C DID standards are going to become more and more common in the near future. The work will make a big difference preventing identity theft and forgery, allowing individuals to control their own personal information and privacy, especially online.”

Article Topics

decentralized identifiers (DIDs)  |  DHS  |  DHS S&T  |  digital ID  |  digital identity  |  identity verification  |  immigration  |  open standards  |  USCIS  |  verifiable credentials