Why are government digital access initiatives taking off? Because the government can force you to do what it wants.
Think about it. If a certain company implements something you don’t like, you can often do business with another company instead. But how do you stop doing business with the Social Security Administration?
Biometric Update reported in September that there are now 105 million Social Security digital accounts, secured by ID.me and Login.gov. If you’re comfortable with the technology, this makes it a lot easier to manage your Social Security account, and other accounts dependent upon your Social Security account such as Medicare.
But that “if you’re comfortable with the technology” caveat is important, because most of the people who are actually receiving Social Security are elderly. And once you reach a certain age it’s hard to remember what day of the week it is, much less how to go to your computer and login to a government digital access account.
Easier for some, harder for others. Google Gemini.
But if you don’t want to use the computer to access Social Security, there are other options. For now.
For example, you can use automated telephone services to perform tasks such as requesting a benefit verification letter, claim status, or replacement Medicare card. However, those who don’t like using the danged computer for everything probably don’t want to talk to a telephone bot, either.
For those people, they can talk to a real person on the phone. Or see a real person at a local office. And, when necessary, you can even submit information via U.S. Postal Service mail or by fax.
Login.gov mDL acceptance (mobile driver’s licenses) for identity verification is live. Sort of. It depends on the wallet you use.
As Biometric Update announced, Login.gov now accepts mobile driver’s licenses (mDLs) from some wallets. As I write this, the “Accepted ID types” page states that mDLs are accepted “in select digital wallets, including Google Wallet and Samsung Wallet. Availability depends on your state, device, and wallet. We’re working to support additional digital wallets.”
I have questions.
I think it’s fairly obvious that they don’t accept IDs in Apple digital wallets. If they did, they’d certainly say so.
But what about state-specific digital wallets, such as the California and Louisiana digital wallets? They don’t say, so I guess you just have to try them and see if they work.
If Login.gov doesn’t accept your mDL, grab your physical wallet; those IDs always work.
“SUBJECT: Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services”
That pretty much says it all. More details on the problem:
“Agencies currently use a range of distinct digital identity solutions. This results in members of the public often needing to maintain multiple sign-ons to interact with agencies and services. It also results in agencies needlessly reverifying an individual’s identity, often at a significant cost, where an existing verification could satisfy operational requirements. Further, agencies often pay commercial vendors to verify identity attributes for which the Federal Government may itself maintain an official data source.”
The solution is “universal” adoption of Login.gov within one year for some sites, within two years for others.
But does universal mean that it is available, or that it is the sole supported method? I was just at a federal website this week that allowed me to authenticate with either Login.gov or ID.me. Other websites apparently use Clear. Will the alternate options disappear in the future?
Maybe not. The Memorandum allows use of other solutions, but agencies should continuously re-evaluate if they are still needed. Or as Biometric Update put it:
“That makes the final policy more than an instruction to add Login.gov alongside existing systems. It establishes an explicit presumption in favor of consolidating federal authentication and identity verification around the government-operated platform while preserving exceptions for services and users Login.gov cannot adequately accommodate.”
Technically not a rebuke of private enterprise, since Login.gov works with some private vendors as technology partners.
“As the Administration advances its updated Cyber Strategy [PDF] and new Executive Order on Ushering in the Next Frontier of Quantum Innovation, GSA’s Office of Government-wide Policy, Federal Identity & Cybersecurity Division has been entrusted with critical responsibilities for protecting federal identity and building access systems, including supporting the governmentwide migration to post-quantum cryptography outlined in OMB Memorandum M-26-15 [PDF].”
I haven’t gotten around to sharing this, but it’s significant.
“Marisol Cruz Cain, director of GAO’s Information Technology and Cybersecurity branch, told members of the House Committee on Oversight and Government Reform’s Subcommittee on Government Operations that in May 2025, the General Services Administration (GSA) ‘issued a contract modification for Login.gov that indicated the program’s Anti-Fraud Team determined that fraudulent accounts passed the identity proofing services and that the sophistication of the attempts would increase exponentially in the future.’”
The lesson learned, which extends well beyond Login.gov: just because something has a checkbox indicating standards certification doesn’t necessarily mean that it truly conforms with the standard…every time.
“Leveraging their 2024 Login.gov Next Generation Identity Proofing Blanket Purchase Agreement (NG BPA), Xcelerate Solutions and their subcontractor Socure were awarded a five-year, $163M call order for Functional Area Three on May 1, 2026.”
“Diamond Capture Associates, a woman-owned business specializing in enterprise technology consulting and large-scale government implementations, and Incode Technologies, a global leader in identity security and fraud prevention, today announced the award of a $37.4 million contract from the General Services Administration (GSA), Federal Acquisition Service’s Technology Transformation Services (TTS).
“Under this call order, Diamond Capture Associates and Incode will support the Login.gov Next Generation Identity Proofing Blanket Purchase Agreement (NG BPA), a critical federal initiative focused on strengthening digital identity verification and reducing fraud across government services.”
I unintentionally reveal my age when I use terms such as EXPLETIVE DELETED which date back to the Nixon Administration.
Or when the first “Sam” that comes to mind is Sam Winston, known for selling tires.
And you get Sam.
Sadly, Sam Winston passed away in 1995…in an automobile accident, no less.
But today I’m using SAM as an acronym for System Award Management.
The SAM.gov website is a centralized location to inform businesses of U.S. federal government procurements, saving businesses the trouble of visiting every single agency to find bidding opportunities.
When I started in government proposal management my employer focused on state and local opportunities, but today Bredemarket concentrates on federal ones. As a result I scan SAM.gov regularly. Not for me, but for my clients.
And for the record, there is one famous Sam (other than Altman) who is known to 21st century audiences: Samuel L. Jackson. Although I don’t know if Sam has the temperament to manage proposals.
For our purposes, the big difference between IAL2 and IAL3 is that IAL2 allows “either remote or physically-present identity proofing,” while IAL3 requires “[p]hysical presence” for identity proofing. However, the proofing agent may “attend the identity proofing session via a CSP-controlled kiosk or device.” In other words, supervised enrollment.
“IAL3 is reserved for high-risk environments such as sensitive government services.”
How are solutions approved for a particular Identity Assurance Level?
Now I could get on my product marketing soapbox and loudly proclaim that my service is IAL2 compliant, or IAL3 compliant, or IAL4 compliant. (“What? You don’t know about IAL4? Obviously you’re not authorized to know about it.”)
“Available to Credential Service Providers offering Full or Component Credential Management Services. Modeled on best practice (drawing from, among other sources, ISO/IEC 27001, ISO/IEC 29115), this Class of Approval ensures the provider organization’s good standing and management / operational practices and assesses criteria which are derived strictly from NIST SP 800-63 rev.3 requirements, ensuring a conformant technical provision of the provider organization’s service.
You see that the Kantara Initiative doesn’t even offer an approval for IAL1, just for IAL2 and IAL3.
It also offers approvals for AAL2 and AAL3. I’ve previously discussed Authenticator Assurance Levels (AALs) in this post. Briefly, IALs focus on the initial identity proofing, while AALs focus on the authentication of a proven identity.
Component Services IAL2 approvals…and an IAL3 approval
Now if you go to the Kantara Initiative’s Trust Status List and focus on the Component Services, you’ll see a number of companies and their component services which are approved for NIST 800-63 rev.3 and offer an assurance level of IAL2.
With one exception.
“NextgenID Trusted Services Solution provides Supervised Remote Identity Proofing identity stations to collect, review, validate, proof, and package IAL-3 identity evidence and enrollment data for CSPs operating at IAL-3. The NextGenID TSS Identity Stations enable remote operators to remotely supervise NIST SP 800-63A compliant Supervised Remote Identity Proofing (SRIP) sessions for credentialing.”
So if remote identity assurance is not good enough for you, there’s a solution. I’ve already discussed NextgenID’s SUPERVISED remote identity proofing in this post. And there’s a video.
But clearly biometric product marketers are paying attention to the identity assurance levels…at least the real ones (not IAL4). But are they communicating benefit-oriented messages to their prospects?
Biometric product marketing has to be targeted to the right people, with the right message. And the biometric product marketing expert at Bredemarket can help a company’s marketing organization create effective content. Talk to Bredemarket.
Well, Anthony Kimery of Biometric Update provided a…well, update. According to Thomas Shedd, who heads the GSA’s Technology Transformation Services (the organization in which the former 18F resided), we have nothing to worry about:
“‘“I can assure you that Login.gov’s work carries forward as a critical part of government-wide efforts to promote efficiency and fight fraud,’ Shedd wrote in a Monday email. ‘To that end we are working to accelerate Login’s roadmap. More to come on that soon.’”
As I mentioned earlier, I don’t know if Login.gov is affected by the abrupt shutdown of GSA’s 18F. Was 18F still maintaining Login.gov code, or had the Login.gov folks established their own code maintenance, independent of the now-deprecated 18F?
Perhaps we will find out Monday.
But what if 18F were still responsible for Login.gov, which therefore is nearly impossible to update or maintain?
No, Mark Cuban, DOGE will not contract with the ex-18F workers. DOGE doesn’t need them. Look at what they’ve already done with verifying identities.
IDV via SMS
For example, at the private sector company X, you cannot get a paid X Premium subscription unless you have a confirmed phone number. Because everybody knows that confirming identities via an SMS text message is a foolproof method.
“According to information provided by Google, the decision to move away from SMS verification stems from numerous security vulnerabilities associated with text message codes. These include susceptibility to phishing attacks, where users might inadvertently share codes with malicious actors, and dependence on phone carriers’ security practices, which can vary widely in effectiveness.”
“X will provide a voluntary ID verification option for certain X features to increase the overall integrity and trust on our platform. We collect this data when X Premium subscribers optionally choose to apply for an ID verified badge by verifying their identity using a government-issued ID. Once confirmed, a verified label is added to the user’s profile for transparency and potentially unlocking additional benefits associated with specific X features in the future.”
But the public sector needs IDV
Identity verification isn’t mandatory on X because some people plain do not want it. Not because they’re crooks, but because they don’t want to hand their PII over to anyone if they don’t have to.
Of course, the Internal Revenue Service, the Social Security Administration, and many other government agencies HAVE to implement identity verification from Login.gov, ID.me, or some other provider.
