4 ms·

I don't think it should be legal for either the state or federal government to outsource such a sensitive and important function.

toomuchtodo 5y ago
I agree. https://login.gov https://login.gov https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-authentication-and-identity-proofing-services-to-a-limited-number-of-federally-funded-state-and-local-government-programs https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth... https://www.congress.gov/bill/116th-congress/house-bill/8215/text?r=20&s=1 https://www.congress.gov/bill/116th-congress/house-bill/8215... https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-solve-identity-once-and-for-all https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...
- d110af5ccf 5y ago
  This is not great. It's using the current issues to push for an ID system that could be leveraged by private parties and is thus likely to significantly reduce online (pseudo)anonymity. It also explicitly calls for the involvement of the private sector in delivering any solution. I want state governments to have a reliable online identity option. I want it to be optional by law - I should be able to make an in person visit instead. I do not want private parties to have any access to the service whatsoever. I want private sector outsourcing of such services to be completely outlawed. No private third party has any business knowing about my interactions with any government provided service. I should never have to share my data with private third parties in order to receive government services. Such usage data is very sensitive and thus a huge privacy concern. Consider: If you ever had to go on food stamps, would you want retailers, potential employers, etc to be able to purchase that data? What about the risk of a data breach?
  - toomuchtodo 5y ago
    You should not expect anonymity when obtaining government services, full stop. That is the entire point of identity proofing and, at a higher level, identity and access management. I agree a private entity should not be required in the verification chain for interacting with government and obtaining government services. My last link points to a blog recommending the USPS provide in person proofing, which I believe meets your in person proofing requirement. Login.gov is a service operated by the US government's GSA agency. It is not a private entity providing this service. It was developed as part of 18F and the US Digital Service.
    - d110af5ccf 5y ago
      I don't expect anonymity from the government (I suspect that would be a fairly absurd goal given current technology). Rather, I expect that absolutely no one other than the government should ever have access to such data.
      - toomuchtodo 5y ago
        My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored.
        hungryforcodes 5y ago
        Why is that a high hill to climb? It's more like a slippery slope. Until recently it was definitely the expectation that your government information would stay only IN the government.
        toomuchtodo 5y ago
        It seems wasteful to spend this thread rehasing the utter disregard the legislative branch has for enacting strong data and privacy legislation (California's CCPA aside), Equifax's willful ignorance towards data security with no consequences for them and no recourse for citizens who had their data leaked, etc. It's not easy, it hasn't been done yet, and it's a high hill to climb. Have to get in front of the folks who write the law, who currently aren't making it a priority.
        hungryforcodes 5y ago
        Fair enough, the situation on the ground is at significant variance with people's expectations.
        dragonwriter 5y ago
        > My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored. It might be a high hill, though softening to allow contractors involved in providing the service to know but requiring them to observe privacy rules similar to what would apply in the healthcare space under HIPAA, would make it much lower. At the state level, for either version, I would recommend, if possible in your state, you to work with advocacy organizations who are willing to sponsor a public ballot initiative rather than focussing on policymakers alone; while industry insiders can and will buy ads against ballot measures, they can't cut them off by compromising strategically targeted legislators the way they often can bills in the legislature.
  - an_opabinia 5y ago
    National, standardized, digital ID is inevitable.
    - jandrewrogers 5y ago
      Very difficult in the US because the Federal government has no authority to require one, and the Supreme Court has consistently ruled that any regulatory or back door methods to effectively achieve a similar result is not legal. It is one of the reasons ID resolution in the US is largely outsourced to private entities, which have no such restrictions.
      - dragonwriter 5y ago
        > Very difficult in the US because the Federal government has no authority to require one, It absolutely could require one for functions within the federally-regulatable sphere, and not prohibit its use for private and state functions. (If it was national-but-decentralized, it could just set standards for the digital ID and let states issue them, the same way it has for physical ID, see, e.g., REAL ID.)
landemva 5y ago
The pay is INSURANCE which employees can not opt out of paying the premium when employed. Just because some States are mandating this privacy invasion does not mean it is legal. This appears to have not yet been tested in the courts.

toomuchtodo 5y ago

I agree. https://login.gov https://login.gov https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-authentication-and-identity-proofing-services-to-a-limited-number-of-federally-funded-state-and-local-government-programs https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth... https://www.congress.gov/bill/116th-congress/house-bill/8215/text?r=20&s=1 https://www.congress.gov/bill/116th-congress/house-bill/8215... https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-solve-identity-once-and-for-all https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...

d110af5ccf 5y ago
This is not great. It's using the current issues to push for an ID system that could be leveraged by private parties and is thus likely to significantly reduce online (pseudo)anonymity. It also explicitly calls for the involvement of the private sector in delivering any solution. I want state governments to have a reliable online identity option. I want it to be optional by law - I should be able to make an in person visit instead. I do not want private parties to have any access to the service whatsoever. I want private sector outsourcing of such services to be completely outlawed. No private third party has any business knowing about my interactions with any government provided service. I should never have to share my data with private third parties in order to receive government services. Such usage data is very sensitive and thus a huge privacy concern. Consider: If you ever had to go on food stamps, would you want retailers, potential employers, etc to be able to purchase that data? What about the risk of a data breach?
- toomuchtodo 5y ago
  You should not expect anonymity when obtaining government services, full stop. That is the entire point of identity proofing and, at a higher level, identity and access management. I agree a private entity should not be required in the verification chain for interacting with government and obtaining government services. My last link points to a blog recommending the USPS provide in person proofing, which I believe meets your in person proofing requirement. Login.gov is a service operated by the US government's GSA agency. It is not a private entity providing this service. It was developed as part of 18F and the US Digital Service.
  - d110af5ccf 5y ago
    I don't expect anonymity from the government (I suspect that would be a fairly absurd goal given current technology). Rather, I expect that absolutely no one other than the government should ever have access to such data.
    - toomuchtodo 5y ago
      My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored.
      - hungryforcodes 5y ago
        Why is that a high hill to climb? It's more like a slippery slope. Until recently it was definitely the expectation that your government information would stay only IN the government.
        toomuchtodo 5y ago
        It seems wasteful to spend this thread rehasing the utter disregard the legislative branch has for enacting strong data and privacy legislation (California's CCPA aside), Equifax's willful ignorance towards data security with no consequences for them and no recourse for citizens who had their data leaked, etc. It's not easy, it hasn't been done yet, and it's a high hill to climb. Have to get in front of the folks who write the law, who currently aren't making it a priority.
        hungryforcodes 5y ago
        Fair enough, the situation on the ground is at significant variance with people's expectations.
      - dragonwriter 5y ago
        > My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored. It might be a high hill, though softening to allow contractors involved in providing the service to know but requiring them to observe privacy rules similar to what would apply in the healthcare space under HIPAA, would make it much lower. At the state level, for either version, I would recommend, if possible in your state, you to work with advocacy organizations who are willing to sponsor a public ballot initiative rather than focussing on policymakers alone; while industry insiders can and will buy ads against ballot measures, they can't cut them off by compromising strategically targeted legislators the way they often can bills in the legislature.
- an_opabinia 5y ago
  National, standardized, digital ID is inevitable.
  - jandrewrogers 5y ago
    Very difficult in the US because the Federal government has no authority to require one, and the Supreme Court has consistently ruled that any regulatory or back door methods to effectively achieve a similar result is not legal. It is one of the reasons ID resolution in the US is largely outsourced to private entities, which have no such restrictions.
    - dragonwriter 5y ago
      > Very difficult in the US because the Federal government has no authority to require one, It absolutely could require one for functions within the federally-regulatable sphere, and not prohibit its use for private and state functions. (If it was national-but-decentralized, it could just set standards for the digital ID and let states issue them, the same way it has for physical ID, see, e.g., REAL ID.)

landemva 5y ago

The pay is INSURANCE which employees can not opt out of paying the premium when employed. Just because some States are mandating this privacy invasion does not mean it is legal. This appears to have not yet been tested in the courts.