Group working on standards for identity vetting
15 February, 2010
category: Library
There are efforts underway to standardize identity vetting for U.S. citizens. Currently states and the federal government have their own individual processes to confirm an individual’s identity. But the North American Security Products Organization (NASPO) is working on standards that could be used throughout the U.S. and even potentially on the international stage. NASPO is a Washington-based non-profit organization that certifies that providers of security documents.
It’s obvious that some of the identity vetting in place now doesn’t work. Eight years after 9/11–when the hijackers were easily able to obtain fake IDs–it appears our identity verification procedures still leave a lot to be desired.
This became apparent in early 2009 when an undercover investigator for the U.S. Government Accountability Office used fake documentation, including a birth certificate and driver license, to obtain four U.S. passports. In at least one instance, he got the passport the same day and used one of the fakes to buy a plane ticket and get past security.
The goal of the Identity Verification Project is to put checks in place so this doesn’t happen. Graham Whitehead, director of Auditing and Standards Development for the North American Security Products Organization and ID Verification Project Working Group leader, related the group’s progress at a recent meeting of the Government Smart Card Interagency Advisory Board.
Verifying a person’s origins through documents such as a birth certificate, lie at the heart of Whitehead’s ID verification project. Eventually he hopes it becomes a U.S. standard and maybe even an international one.
The GAO investigation points to the fundamental problem that identity documents don’t have a lot of security. Among the fake documents the GAO investigator used were Social Security numbers of a fictitious five-year-old child and another from a dead person. “With a little bit of skill you can get yourself a document that most will agree is secure … a passport with a chip,” he said.
The project initially had three phases, he said, the first which was tentatively completed in July. That’s the concept formulation, a difficult phase that includes many philosophical positions. It involved three elements: How to build certainty in a claimed identity, the criteria for the acceptance/rejection of a claim and the methods for the detection of fraud.
The second phase is to prove that it can work. This testing portion involves looking at the birth certificate and driver license issuance processes at state vital records offices and departments of motor vehicles. All of this should lead to the third phase, methods for the verification of personal identity.
He noted that part of the solution his group has looked at involves selecting and training adjudicators, a new breed of notaries, who would be specially accredited and certified to be judges of identity documents. The verification process would involve a combination of corroborative evidence and then using that evidence to confirm the claimed identity.
Verifying a person’s identity starts with what Whitehead calls the “identity resume.” This would be something akin to the document people use when applying for a job, said Whitehead.
The resume should include a person’s origin, where he was born, the date he was born, his gender, the name he was born with, his parents’ name, basically his “primary attributes at birth,” said Whitehead. The individual would also have to confirm that the same identity has been used over a lifetime. “A lot of it contains unique events in a person’s life and it all has to be verifiable,” he said.
Whitehead said a system also has to be in place to detect symptoms of fraud and find out if the individual has ever used another identity. “For example if someone presents a passport and Social Security card but he has never had a birth certificate, that’s a symptom of fraud.”
Part of the identity vetting would be an in-person meeting to review the resume, Whitehead says. Without this, the identity verification job won’t get done. “There’s no way to escape having an in-person meeting,” he said. Verifying a person’s identity is a two-step process, he said. “If we can’t prove anything about a person or if his documents are fake, we ask that person to come back in again.”
While a purely electronic verification might make the process quicker, a human element is needed. “If in the course of adjudication, the adjudicator sees or hears something that explains why a person doesn’t have a birth certificate or birth record, he’s at liberty to say his other evidence mitigates this finding,” said Whitehead.
A contra indications table, a check list of what to look for or what has been observed, can aid in verifying a person’s identity, said Whitehead. Some of the items on Whitehead’s table, things to look for that could be a symptom of fraud, include:
- Inadequate resume
- Applicant incoherent
- No SSN
- Origins unknown
- Poor or no knowledge of places lived
- No contact disclosures
- Uncooperative/hostile attitude
- No documents tendered
- No picture ID
“At the end of the day what we are advocating is binding the person in some way to a verified identity,” added Whitehead.