The Biden administration is laying the groundwork for wider acceptance of digital identifications, like driver’s licenses you can show on your smartphone — a push that could fundamentally reshape how citizens access everything from public benefits to pornography online.
A draft of a forthcoming executive order viewed by NOTUS pushes federal and state governments to speed adoption of smartphone-based mobile driver’s license and ID options more widely, stating: “It is the policy of the executive branch to strongly encourage the use of digital identity documents.”
Such documents could be submitted digitally and, in combination with biometric scans like facial recognition, could help better verify identity online.
The draft order, if implemented, would ostensibly address a growing problem: The government has lost billions of dollars in fraudulent claims to benefit programs using forged identification cards. It would also mandate federal agencies adopt a single government-run identity system, Login.gov, as a gateway to federal websites and offer that system to state and local governments for integration.
Already, 13 states have rolled out some kind of mobile driver’s license program, and more are working toward implementing a digital ID. But federal action pushing the transition has been delayed.
Privacy activists and civil libertarians of both parties have raised concerns that digital identifications could lead to government overreach and surveillance. Ultimately, an order could have far-reaching consequences for how Americans prove who they say they are on the web when they apply for benefits, file their taxes or even access online websites and services.
Joe Biden first promised an executive order in his 2022 State of the Union address, but it has been stuck in a bureaucratic turf war over what it should include. Four people familiar with the matter said the text of the executive order had been finalized but that the Biden administration was debating when to roll it out. One person obtained what they said was the final text of the order from a federal agency this week and provided it to NOTUS. A second person confirmed that many of the provisions matched a summary that had circulated among stakeholders within recent months and that the draft provided to NOTUS incorporated some changes sought by agencies and industry.
A White House spokesperson said: “Nothing is final until it’s signed by the president.”
Billions of dollars in corporate and government money are tied up in how to create systems that will allow people to verify who they say they are online and submit those credentials to both private and public-run websites for verification — all while addressing privacy and civil liberties concerns about moving identity documents onto smartphones.
A growing number of states are passing laws requiring age verification to view adult-themed websites or sign up for social media accounts, but few good solutions exist currently to implement those laws.
The result is growing interest in creating a form of digital ID to use on the web, ending decades of a freewheeling internet architecture in which anonymity and age verification were largely on the honor system or reliant on low-quality smartphone scans of physical driver’s licenses.
Today, physical licenses are fairly easy to forge, according to a NOTUS review of dark web material provided by researchers, some in the industry, who study identity theft. The development of AI “deep fake” technology that allows criminals to hide their real faces when submitting forged or stolen documents to systems that require a selfie or online video has only accelerated the scale and scope of identity theft.
In addition, most state driver’s license systems do not connect to identity-verification services that match faces to IDs — meaning websites have no way to prove whether a license is real or forged. And the widespread availability of personal data from breaches now available on the dark web means that licenses can often be forged with real information but fake photographs.
The issue was accelerated during the pandemic when government agencies had to migrate many services that were previously in-person to web-based systems. The Government Accountability Office estimated that more than $100 billion in fraudulent unemployment claims were paid out between March 2020 and March 2023 — representing somewhere between 11% and 15% of all benefits paid out, though not all of it was through identity theft.
Apple, Google, government agencies like the Transportation Security Administration and state-level regulators who issue driver’s licenses are all trying to build systems that would allow Americans to carry identity documents on their smartphones and frictionlessly submit them to both government and private sector websites for verification with the tap of a button.
The text of the draft executive order viewed by NOTUS could also make grant money available to states to help them build those technologies and ensure they’re compliant with federal systems.
The draft order encourages the development of systems that could securely and privately verify that someone is 18 or 21 when accessing either government or private sector websites, but without sharing biographic information — something that could help states and web providers enforce a raft of laws demanding that users verify their ages to sign up for social media accounts or access adult-themed content.
Essentially, the software would allow a website to ask a “yes” or “no” question of a digital ID — such as “is this person over 18?” — without collecting the user’s name, photograph or other details.
The draft order also pushes government agencies to accept digital IDs when building websites that allow the public to do things like file unemployment or apply for Social Security benefits, and government-run Login.gov, the standard credential for accessing federal websites. This would potentially undermine private sector options like the Virginia-based start-up ID.me, which is currently the default system Americans use to access the Internal Revenue Service website and many state government services.
While the widespread adoption of Login.gov would give Americans a potential single account to access public websites, the service has faced reliability and security questions since its launch in 2017. At the same time, ID.me has faced privacy and civil liberties questions about its facial recognition software and objections from lawmakers and other critics about allowing a private sector company to act as the gateway to public websites. (Login.gov is also now integrating facial recognition to comply with certain government security requirements.)
The draft executive order tells agencies to provide easy-to-use alternatives to people who do not want to submit to automated facial recognition scans. In plans to roll out, Login.gov allows people to have their physical IDs checked at a post office in lieu of the facial scan, while ID.me has a live video call option and in person verification at 650 retail locations. It also bans the sale of biometric data like face scans by government and contractors and prevents governments from using that kind of data for anything other than identity verification.
Questions about whether to adopt Login.gov or ID.me were a primary hang-up in the delay of the executive order, according to people familiar with the matter. They also sparked a furious lobbying battle by companies like ID.me and others trying to supplant Login.gov. Data brokers like LexisNexis underpin some of the technology used in Login.gov — sparking a public policy fight over which service to mandate. The draft order does not ban ID.me and other private sector solutions from being embedded into federal websites but would mandate that all government sites offer citizens the option of using Login.gov or other government-run sign-on systems.
An ID.me spokesperson said the industry was aware of a potential executive order and said the company’s view is that “the consumer should have a choice between private sector and government-provided solutions for login and identity verification.”
“Forced adoption of a government program would be exactly the wrong approach,” the spokesperson said.
Civil libertarians have expressed concerns about the rollout of mobile driver’s licenses and their routine implementation into everyday life, warning that it could lead to the private sector tracking people under their real names.
“It’s really good that this draft includes a lot of broad but consistent privacy language,” said Jay Stanley, senior policy analyst with the ACLU Speech, Privacy, and Technology Project. “But it’s silent on the private sector’s use of digital identity systems.”
“The private sector is going to start demanding identity presentations left and right — even when it’s not necessary,” Stanley said.
—
Byron Tau is a reporter at NOTUS.