COVID-19 has spurred new enthusiasm for national digital identity schemes to facilitate enhanced government services. This blog post reviews notable initiatives to date this year, and critical challenges facing the implementation.
Governments have been thrust into the spotlight, as COVID-19 has brought crises to countries worldwide. This tested their ability to quickly disperse aid to individuals and small businesses, provide public services to citizens, and contain the virus’ spread. Against this background, digital identity has emerged as a critical factor for success. However, growing pains still remain, as countries struggle to react to a newly pressing need for a digital identity public service.
Spotlight on the US
The need for a digital identity infrastructure was made particularly evident in the U.S. A national identity system has never gained traction in the U.S., despite some efforts from the Obama administration. However, government agencies recognize the need for identity verification tools as they face rampant fraud in the collection of unemployment benefits and PPP loans. State agencies, such as those of California and Arizona, have consequently hired private sector companies to facilitate identity verification services to reduce the backlog and fraud.
In September, a bipartisan cohort introduced the Improving Digital Identity Act of 2020 to roll out a standards-based approach to digital identity for use in private and public sectors. The bill positions identity fraud as a central motivating factor for improving digital identity infrastructure, citing over $16 billion lost in 2019 from identity fraud. One of the leading bill writers, Jim Langevin, notes, “The COVID-19 pandemic and our increased reliance on the internet to accomplish everyday tasks has made it abundantly clear that we should build out our digital identity infrastructure.”
The Stress Test
Governments in Colombia to Madagascar have also taken this moment to advance legislation for government digitization and invest in building national digital identity infrastructure. Moreover, the World Bank has publicly championed digital identity systems to support digital economies that have taken off due to COVID-19.
However, while COVID-19 has undoubtedly accelerated the development and implementation of national digital identity schemes globally, governments continue to face many critical challenges. Some governments are confronting critical technical setbacks and issues in private-public sector coordination and the need to ensure that data privacy regimes will protect citizens’ rights and minimize the threat of widespread surveillance and cybersecurity breaches.
Meanwhile, other countries have seen their digital identity systems stress-tested. For instance, Gov.UK Verify, U.K.’s digital identity service for government services, saw their users more than double as people attempted to claim Universal Credit for financial support. Additionally, account creations increased from 35,000 in a week pre-COVID-19 to a weekly average of over 80,000 account creations between mid-March to mid-May. Identity providers for Gov.UK Verify initially struggled to meet demand at scale, with queues peaking at 155,000 people.
Second Chances for Infrastructure
U.K. citizens’ need for digital infrastructure extended the lifetime of Gov.UK Verify, which had previously faced criticism for low uptake. In April 2020, funding for the service was extended for another 18 months due to renewed interest. Moreover, the U.K. government has introduced a plan for an overhaul of the digital infrastructure, including Document Checking Service, a private-public collaboration for passport authentication.
Australia has similarly faced implementation challenges for its government identity service, myGovID, which will serve as the primary identity credential for government services and the government’s identity verification service. Initially planned for launch by May 2020, the service was delayed due to system integration errors, unsatisfactory user experience, and a lack of vendors for their “liveness detection” feature. myGovID is now planned for launch by the end of the year, while an old solution, Connected ID, has been revived to temporarily fill in the pandemic-caused demand surge.
For the U.S., U.K., and Australia, further new legislation has been highlighted as a key enabler for the continued development of digital identity. All three countries have specifically expressed interest in creating legislation governing private-public involvement. Privacy advocates will also push for clear data privacy regulation to prevent the potential insidious effects of centralized databases containing highly sensitive personal identity attributes, running from Big Brother-style surveillance to attractive honeypots for cyberhackers. The U.K. has faced criticism in this regard, while Australia has incorporated data privacy legislation for their Trusted Digital Identity Framework, which is currently up for consultation.
Governments’ Growing Appetite for Identity
To this end, we expect that as government appetite for digital identity infrastructure continues to increase because of COVID-19, so too will the conversation around data privacy grow. Contact tracing serves as a clear case study, as data collected on citizens for COVID-19 can potentially blur with that leveraged for national identity databases. For example, India’s Aadhaar has been used to facilitate the distribution of welfare more than it has been used for contact tracing. Still, privacy concerns have stemmed from the government’s data processing practices for the mobile tracking programs that it does run for contract tracing because these practices run counter to Aadhaar privacy guidelines.
China serves as a more concrete example. An intensive COVID-19 health codes system for contact tracing has continued to further pre-existing surveillance concerns. Because of the health codes’ high coverage of China’s population – all residents are required to have a health codes app – there is speculation that the government will leverage the existing health codes data to supplement their social credit system. To this end, notable cities like Hangzhou and Shanghai expand the potential use cases of the health codes and track more personal data.
Thus, contact tracing has the potential to allow governments to collect personal identity data without adhering to the same level of scrutiny over privacy that might have existed during non-crisis times. The concern is that the temporary solutions that were implemented without proper data safeguards may become permanent, creating national digital identity systems that are more invasive for citizens than helpful.
The OWI Take
2020 has seen strong traction in both interest and the development of digital identity programs thanks (in large part) to COVID-19. Still, there is no newly discovered silver bullet for the development of digital identity systems. In fact, while stakeholder interest — a common hurdle before 2020 — may have increased, other challenges still persist, as public-private sector coordination, technical infrastructure implementation, and privacy concerns have plagued many governments worldwide this year. Considering these challenges, we see tremendous opportunity for private sector initiatives to support governments as they continue to implement digital identity systems in what will hopefully be an efficient, transparent, privacy-preserving, and user-centric manner.