4 ms·

Are you working with a specific org or initiative? I'm also an American interested in this (and an e-resident who formerly worked for the Estonian government).

toomuchtodo 6y ago
Mostly activist citizen efforts from the outside, as legislation is going to be required to appropriate funding and direction from Congress, and the legislators I interface with are busy with arguably more pressing work (unfortunate but entirely understandable, such are the times). I intend to apply at the USDS for the Login.gov team in some capacity to help on the tech side if the necessary legislation can be put in place to support such an initiative. Their system already supports the DOD CAC (common access card), which is a short walk away from a citizen digital ID card (would be a different org and PKI root to administer and govern citizen cards, to grossly simplify). Login.gov recently expanded to support city and local gov IAM needs (when they have ties to federal programs) [1] [2], so there is roadmap momentum and executive branch will. "Digital identity is a big deal. [3]" They're already serving 30 million users, and 500k DAUs, really just a matter of scaling up. [1] https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-authentication-and-identity-proofing-services-to-a-limited-number-of-federally-funded-state-and-local-government-programs https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth... [2] https://www.govloop.com/login-gov-expands-use-to-cities-states-seeking-to-ease-access-to-government-services/ https://www.govloop.com/login-gov-expands-use-to-cities-stat... [3] https://www.youtube.com/watch?v=YaZdpEp0eYs https://www.youtube.com/watch?v=YaZdpEp0eYs
- dogman144 6y ago
  I get the spirit and a m familiar with the CAC and general benefits, and using that for all .gov stuff is attractive (taxes, bills, FASFA, etc) I think you’re glossing over two major implementation factors that need to be part of the discussion from get-go: * how much CAC use is dependent on fairly specific govt tech infra to be widely deployed, and how will that work for everyone (ever tried to setup a CAC on a civ computer) * key control, either extremely decentralized like the iPhone (lock yourself out of your passport?), or extremely centralized and the newest honeypot OPM holds (root cert for all e-citizen PKI). US currently doesn’t have the internal cybersec chops to run that at all (closest equivalent is CISA).
  - toomuchtodo 6y ago
    You're right to point this out, but my counter argument is that these are solvable pain points for such an implementation (either done today in competent zero trust security architectures in progressive orgs or at nation state levels such as Estonia). You won't need a CAC reader on computers, for the most part, if you have mobile apps that can perform the identity proofing (such that's already done with examples like Apple's biometrics systems, FIDO2/WebAuthn, Apply Pay, etc). You'd still have the card for interfacing at endpoints (banks, postal service, IRS/SSA offices, other trust anchors and government services endpoints). I already login to my US CBP Global Entry account with Login.gov and 2FA, why can I not today use the same IAM system to login to my Social Security account? Or my IRS tax account? Or to attest to my citizenship or other attributes that I'd normally need a certified document for (yuk!). I'm not arguing for such a system without robust support and reasonable downgrades for failure scenarios (identity reproofing if you lose your digital ID, for example). I'm arguing for, admittedly challenging, digital ID modernization without disenfranchisement. I genuinely appreciate you pointing out the challenges, as they must be addressed. US DHS CISA is absolutely a resource that needs to be leaned on heavily to implement what I describe, and to ensure a strong security posture throughout the federal government's infrastructure.
    - westurner 6y ago
      FWIU, DHS has funded [1] development of e.g W3C DID Decentralized Identifiers [2] and W3C Verifiable Credentials [3]: [1] https://www.google.com/search?q=site%3Aw3.org+%22funded+by+the+United+States+Department+of+Homeland+Security%27s+Science+and+Technology+Directorate%22 https://www.google.com/search?q=site%3Aw3.org+%22funded+by+t... [2] https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/ [3] https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/ Additional notes regarding credentials (certificates, badges, degrees, honorarial degrees, then-evaluated competencies) and capabilities models: https://news.ycombinator.com/item?id=19813340 https://news.ycombinator.com/item?id=19813340 westurner/blockchain-credential-resources.md: https://gist.github.com/westurner/4345987bb29fca700f52163c339a270f https://gist.github.com/westurner/4345987bb29fca700f52163c33... Value storage and transmission networks have developed standards and implementations for identity, authentication, and authorization. ILP (Interledger Protocol) RFC 15 specifies "ILP addresses" for [crypto] ledger account IDs: https://interledger.org/rfcs/0015-ilp-addresses/ https://interledger.org/rfcs/0015-ilp-addresses/ From "Verifiable Credentials Use Cases" https://w3c.github.io/vc-use-cases/ https://w3c.github.io/vc-use-cases/ : > A verifiable claim is a qualification, achievement, quality, or piece of information about an entity's background such as a name, government ID, payment provider, home address, or university degree. Such a claim describes a quality or qualities, property or properties of an entity which establish its existence and uniqueness. The use cases outlined here are provided in order to make progress toward possible future standardization and interoperability of both low- and high-stakes claims with the goals of storing, transmitting, and receiving digitally verifiable proof of attributes such as qualifications and achievements. The use cases in this document focus on concrete scenarios that the technology defined by the group should address. FWIU, the US Department of Education is studying or already working with https://blockcerts.org/ https://blockcerts.org/ for educational credentials. Here are the open sources of blockchain-certificates/cert-issuer and blockchain-certificates/cert-verifier-js: https://github.com/blockchain-certificates https://github.com/blockchain-certificates Might a natural-born resident get a government ID card for passing a recycling and environmental sustainability quiz.
- atlasunshrugged 6y ago
  Cool, I've heard good things about USDS. My understanding from Estonia is that really the challenge here isn't technical (e.g. the tech exists and just needs to be implemented) and what is really needed is legislative changes but I certainly don't think it hurts to have advocates in influential agencies in apolitical role. I recently moved to DC and am trying to do some networking and figuring out how I can influence some of these topics. If you're considering USDS I recommend also looking at Techcongress and Presidential Innovation Fellows
  - Bluestein 6y ago
    > the challenge here isn't technical (e.g. the tech exists and just needs to be implemented) and what is really needed is legislative changes Totally on point.

toomuchtodo 6y ago

Mostly activist citizen efforts from the outside, as legislation is going to be required to appropriate funding and direction from Congress, and the legislators I interface with are busy with arguably more pressing work (unfortunate but entirely understandable, such are the times). I intend to apply at the USDS for the Login.gov team in some capacity to help on the tech side if the necessary legislation can be put in place to support such an initiative. Their system already supports the DOD CAC (common access card), which is a short walk away from a citizen digital ID card (would be a different org and PKI root to administer and govern citizen cards, to grossly simplify). Login.gov recently expanded to support city and local gov IAM needs (when they have ties to federal programs) [1] [2], so there is roadmap momentum and executive branch will. "Digital identity is a big deal. [3]" They're already serving 30 million users, and 500k DAUs, really just a matter of scaling up. [1] https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-authentication-and-identity-proofing-services-to-a-limited-number-of-federally-funded-state-and-local-government-programs https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth... [2] https://www.govloop.com/login-gov-expands-use-to-cities-states-seeking-to-ease-access-to-government-services/ https://www.govloop.com/login-gov-expands-use-to-cities-stat... [3] https://www.youtube.com/watch?v=YaZdpEp0eYs https://www.youtube.com/watch?v=YaZdpEp0eYs

dogman144 6y ago
I get the spirit and a m familiar with the CAC and general benefits, and using that for all .gov stuff is attractive (taxes, bills, FASFA, etc) I think you’re glossing over two major implementation factors that need to be part of the discussion from get-go: * how much CAC use is dependent on fairly specific govt tech infra to be widely deployed, and how will that work for everyone (ever tried to setup a CAC on a civ computer) * key control, either extremely decentralized like the iPhone (lock yourself out of your passport?), or extremely centralized and the newest honeypot OPM holds (root cert for all e-citizen PKI). US currently doesn’t have the internal cybersec chops to run that at all (closest equivalent is CISA).
- toomuchtodo 6y ago
  You're right to point this out, but my counter argument is that these are solvable pain points for such an implementation (either done today in competent zero trust security architectures in progressive orgs or at nation state levels such as Estonia). You won't need a CAC reader on computers, for the most part, if you have mobile apps that can perform the identity proofing (such that's already done with examples like Apple's biometrics systems, FIDO2/WebAuthn, Apply Pay, etc). You'd still have the card for interfacing at endpoints (banks, postal service, IRS/SSA offices, other trust anchors and government services endpoints). I already login to my US CBP Global Entry account with Login.gov and 2FA, why can I not today use the same IAM system to login to my Social Security account? Or my IRS tax account? Or to attest to my citizenship or other attributes that I'd normally need a certified document for (yuk!). I'm not arguing for such a system without robust support and reasonable downgrades for failure scenarios (identity reproofing if you lose your digital ID, for example). I'm arguing for, admittedly challenging, digital ID modernization without disenfranchisement. I genuinely appreciate you pointing out the challenges, as they must be addressed. US DHS CISA is absolutely a resource that needs to be leaned on heavily to implement what I describe, and to ensure a strong security posture throughout the federal government's infrastructure.
  - westurner 6y ago
    FWIU, DHS has funded [1] development of e.g W3C DID Decentralized Identifiers [2] and W3C Verifiable Credentials [3]: [1] https://www.google.com/search?q=site%3Aw3.org+%22funded+by+the+United+States+Department+of+Homeland+Security%27s+Science+and+Technology+Directorate%22 https://www.google.com/search?q=site%3Aw3.org+%22funded+by+t... [2] https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/ [3] https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/ Additional notes regarding credentials (certificates, badges, degrees, honorarial degrees, then-evaluated competencies) and capabilities models: https://news.ycombinator.com/item?id=19813340 https://news.ycombinator.com/item?id=19813340 westurner/blockchain-credential-resources.md: https://gist.github.com/westurner/4345987bb29fca700f52163c339a270f https://gist.github.com/westurner/4345987bb29fca700f52163c33... Value storage and transmission networks have developed standards and implementations for identity, authentication, and authorization. ILP (Interledger Protocol) RFC 15 specifies "ILP addresses" for [crypto] ledger account IDs: https://interledger.org/rfcs/0015-ilp-addresses/ https://interledger.org/rfcs/0015-ilp-addresses/ From "Verifiable Credentials Use Cases" https://w3c.github.io/vc-use-cases/ https://w3c.github.io/vc-use-cases/ : > A verifiable claim is a qualification, achievement, quality, or piece of information about an entity's background such as a name, government ID, payment provider, home address, or university degree. Such a claim describes a quality or qualities, property or properties of an entity which establish its existence and uniqueness. The use cases outlined here are provided in order to make progress toward possible future standardization and interoperability of both low- and high-stakes claims with the goals of storing, transmitting, and receiving digitally verifiable proof of attributes such as qualifications and achievements. The use cases in this document focus on concrete scenarios that the technology defined by the group should address. FWIU, the US Department of Education is studying or already working with https://blockcerts.org/ https://blockcerts.org/ for educational credentials. Here are the open sources of blockchain-certificates/cert-issuer and blockchain-certificates/cert-verifier-js: https://github.com/blockchain-certificates https://github.com/blockchain-certificates Might a natural-born resident get a government ID card for passing a recycling and environmental sustainability quiz.
atlasunshrugged 6y ago
Cool, I've heard good things about USDS. My understanding from Estonia is that really the challenge here isn't technical (e.g. the tech exists and just needs to be implemented) and what is really needed is legislative changes but I certainly don't think it hurts to have advocates in influential agencies in apolitical role. I recently moved to DC and am trying to do some networking and figuring out how I can influence some of these topics. If you're considering USDS I recommend also looking at Techcongress and Presidential Innovation Fellows
- Bluestein 6y ago
  > the challenge here isn't technical (e.g. the tech exists and just needs to be implemented) and what is really needed is legislative changes Totally on point.