Identity verification has become part of accessing almost every government service at every level, yet these processes can vary wildly even across offices providing the very same benefits. As government employees, it’s our mission to serve everyone. While identity verification can be critical for protecting individuals from having their identity (and benefits) stolen, when it’s not implemented equitably, it also keeps many eligible and deserving people from ever getting in the front door.
Secure, accessible identity verification was a key part of the digital transformation I led when Chief Technology Officer of the U.S. Department of Veterans Affairs during the Obama Administration. At the time, it was so difficult to register an online account that some veterans had to stay overnight in hotels to get to their nearest VA medical center to identity proof, and even as the CTO, I was unable to successfully register my own grandfather.
I’ve since seen equitable and scalable identity verification as a pillar of many solutions in my crisis engineering work, such as getting Californians their unemployment benefits and Puerto Ricans access to tax credits and refunds quickly, while also defending against fraud.
In this two-part series, I’ll share 10 ways you can make your identity verification process more accessible to all your users, without sacrificing security.
- Test your systems for every name
Every “rule” you think applies to names is wrong. If a user can’t enter their actual name in your form, they can’t access government services — and because this is often the very first step, you may not even realize there was ever a problem.
New America crowdsourced this list of real names that you can test against your current forms and systems. I encourage including all these names in automated tests to ensure future code changes don’t deny access to some users.
If you’re dealing with legacy systems that have field length, special character, or similar limitations, I’ve seen creative governments store the correct name in a separate field, and then silently transform it behind the scenes to meet the rules of the old system. This can work as long as it’s transparent and well-documented within your service line. This also improves customer services for people who go by names other than their legal name, who can now receive correspondence and phone calls using their chosen name.
- Offer options for the under- and un-banked
Individuals with little or no credit and/or banking history cannot pass credit-based “quizzes,” which unfortunately form the basis for a lot of digital identity proofing today. Only 81% of adults in the United States are considered “fully banked,” and if you serve a population that is seeking financial support, this percentage is likely much smaller.
Since these quizzes are fully automated, there’s often no way for individuals to move ahead or to correct inaccurate information, leaving them without access to government services.
- Have a scalable, automated option…
Most people, myself included, want and indeed expect a fully automated digital experience for virtually every interaction today. How does this increase equity? Because it frees up your valuable staff time for the human processing and conversations that the people who do not want, or cannot get through, automated identity verification. This is especially essential in a service that may need to scale suddenly, like unemployment claims in an economic downturn or filings around their due date.
Having a human being work with each person and manually review and process applications may sound like great customer service, but it doesn’t scale, harming every user with unnecessary delays — not to mention human biases and error.
- … and also the ability to reach a person
While most users may prefer an automated identity verification process, this is not all or nothing. Some people will have trouble, whether it’s lack of familiarity with technology or a complicated edge case. Or they may simply want to opt out of automation or facial recognition. This isn’t an either/end — you need both. The National Institute on Standards and Technology (NIST) calls the individuals who perform remote identity proofing “trusted referees,” and they have to follow specific guidelines.
Set realistic expectations for reaching a trusted referee, especially during times of high volume. It’s often not realistic to be able to reach a live person immediately, and there have been mixed experiences with scheduling callbacks. (Criminals have flooded callback requests with automated bots, taking up all the time slots.)
- Offer an in-person option
At the end of the day, some of your users really will need and/or prefer in-person help. Depending on your resources and coverage area, you could offer this in your existing offices, or through a partnership with community-based locations. (In my work in child welfare, UPS stores are the most common way for foster parents to get fingerprinted!)
If you engage community-based options, ensure that there’s good geographic coverage (one location every 35 miles is a common benchmark), and that they provide evening and weekend hours. Consider including these terms in RFPs and contracts.
Marina Nitze, co-author of Hack Your Bureaucracy, is currently a partner at Layer Aleph, a crisis engineering firm that specializes in restoring complex software systems to service. Marina is also a fellow at New America’s New Practice Lab, where she works on improving America’s foster care system through the Resource Family Working Group and Child Welfare Playbook. Marina was the Chief Technology Officer of the U.S. Department of Veterans Affairs under President Obama, after serving as a Senior Advisor on technology in the Obama White House and as the first Entrepreneur-in-Residence at the U.S. Department of Education.
Leave a Reply
You must be logged in to post a comment.