identity assurance level Archives

The Joint Commitment on Frontier Responsibilities is a Nothingburger

If you thought IAL1 was a nothingburger, what about the Joint Commitment on Frontier Responsibilities, which is receiving criticism from outside AND INSIDE the U.S. Government?

The commitment

Let’s review what the commitment is.

First, the signatories include President Trump, Google’s Sundar Pichai, Meta’s Mark Zuckerberg, OpenAI’s Greg Brockman, XAI’s Elon Musk, Nvidia’s Jensen Huang, and Anthropic’s Dario Amodei. We’ve talked about Anthropic before. We’ll return to Anthropic later.

Second, the “commitment” (also known as the “White House Accord on Super Intelligence”) touts “robust internal processes and controls,” promotes empowering “an internal team” to monitor safety, calls for independent external auditors/evaluators, and also discusses setting up an independent committee of each company’s board of directors to oversee things. The document also discusses future meetings of the participants and possible legislation.

Well, I guess we got super intelligence out of the deal. Yes. Sí.

Google Gemini.

What commitment?

Some are not impressed.

“Critics contend those measures are inadequate given the commercial and geopolitical pressure on companies to build capable models…

“Sen. Mark Warner of Virginia, ranking member of the Senate Intelligence Committee, said the administration has ‘resisted meaningful safeguards without offering a serious alternative’ and questioned whether the task force will establish safety standards or review advanced models….”

And no federal commitment either

Of course you could argue that this was all the art of the deal (perhaps you’ve heard the phrase before). The techies give President Trump a platform and use his preferred phrase “super intelligence” instead of “artificial intelligence.” In return, the President gives the techies lots of money and doesn’t put roadblocks in their way. Tit-for-tat, as it were.

Except that Trump’s own Department of Defense—I mean, Department of War (check the brand guide), refuses to play along. Remember how one of the signatories on the Joint Commitment was Anthropic? Well…

“A US Department of Defence official has told the BBC the Pentagon ‘has ceased the use of Anthropic products,’ months after Defense Secretary Pete Hegseth designated the AI company a ‘national security supply-chain risk’ and set a six-month phase-out.

“The February designation followed Anthropic’s refusal to lift safety guardrails on autonomous weapons and mass domestic surveillance. “

So let’s follow along. One of the participants in the government’s Super Intelligence event, touting how wonderful Sí is, is BANNED from use by a major government department because it is a “risk.”

Why is it a risk?

Because it includes guardrails.

So apparently the Joint Commitment DOES have teeth. Specifically, to let the federal government use AI—whoops, Sí—in any way it sees fit. And those who don’t agree get punished, even if they appear in the photo op.

It’s October 6, and this supposedly historic commitment is dead on arrival.

The RIVR Expansion is Not a Flood, But an Irrigation

When the land is dry, you irrigate. As threats mushroom, the Department of Homeland Security (DHS) is proposing a RIVR expansion.

Mushrooms in the desert, symbolizing the need for the 2026 RIVR expansion. — Google Gemini.

RIVR is the current name for the DHS’ Remote Identity Validation Rally, addressing ways to know who you’re dealing with. The “rally” format allows participants to test new technologies. Perhaps those technology will eventually meet Identity Assurance Level 3 (IAL3).

To encourage participation, the test results from participants are anonymized, and the identities are only revealed if participants choose to reveal them because of stellar performance. Here’s what Microblink said:

“Microblink was evaluated under the anonymized identifier DVS6. Among all participating vendors, Microblink was the only provider to meet RIVR “high performing” system benchmarks across every measured accuracy metric.”

Just a warning that RIVR tests are kind of like NIST tests. They’re sliced and diced in so many ways that almost everyone can claim to be the “winner” of the test. But as I mentioned before, this particular test resulted in a bunch of losers.

In the past, RIVR concentrated on basic identity document validation to ensure that a California driver’s license really was a California driver’s license. The rallies concentrated on topics such as basic document validation, the “selfie to ID” facial recognition matching process common in identity verification, and both active and passive presentation attack detection (liveness).

The 2026 RIVR expansion adds deepfake detection. Google Gemini.

But the 2026 RIVR expansion encompasses new testing related to deepfake detection.

“To build more robust evaluations, DHS S&T is calling on organizations that can produce or share examples of identity deepfakes attacks and the methods used to create them. Identity deepfakes, which may include face-swap videos or digitally generated or altered identity documents. This data will help the S&T develop a more complete and rigorous dataset for testing.”

This data-gathering exercise is a prelude for additional testing.

“December 2026: Applications open for companies developing presentation attack detection (detecting physical spoofing like masks or photos) and Biometric Deepfake Detection (detecting AI-generated impersonations, such as in video chats or teleconferencing).”

At the same time, DHS is also gathering “a broader set of real and fraudulent passports and driver’s licenses.”

Why? Because security of the homeland doesn’t just include keeping planes from flying into buildings. It also includes digital attacks to our infrastructure.

Watch and book.

https://bredemarket.com/watch-book/

Identity and a Car Battery

Today we will learn about identity and a car battery purchase. From personal experience.

My car wouldn’t start

The last couple of times that I started my car it was difficult to start. This afternoon it wouldn’t start at all. The battery had a sticker that read “09/19”; if that was a month and two-digit year, then it was probably time to replace the battery.

So I called the company that sold the battery to me. I won’t reveal the name of the company, but its initials are AAA. (Or “Triple A” to the kewl kids.) They sent a truck out, and informed me that I did NOT purchase my battery in September 2019. I purchased it in OCTOBER 2019. (Presumably 09/19 was the month the battery was available for service.)

Proving my identity, not the car’s

Before the driver from Golden Bear Towing arrived, I reviewed all the ways I would have to identify myself.

To receive AAA service, I would need to show my AAA membership card. Yes I submitted my service request while logged in to the AAA app, but rules said I needed to show my card.

Of course, mere possession of a card (or an app) proves nothing, so I also needed to show government-issued photo identification, such as a driver’s license.
While not always necessary, in this case I needed to have a vehicle listed on my AAA contract. (If I had a problem with a Hertz rental vehicle I would call Hertz, not AAA.)

Finally, if I ended up purchasing a new battery, I would have to provide a debit or credit card (although they also take cash).

Not my real license plate number. Google Gemini.

The one odd part? While I had to prove everything about myself, I didn’t have to prove anything about the car, such as title. I previously wrote about the importance of title from a non-person identity (NPE) perspective:

“Because of their expense, certain NPEs such as vehicles and real estate are associated with title, or proof of ownership.

“Just because I have physical possession of a car or house doesn’t mean that I’m the lawful owner. Maybe I am house sitting. Or renting a car. Or I am a squatter or thief. When it comes to legal (and financial) title, possession is NOT 9/10ths of the law. Otherwise, Hilton and Hertz would be out of business.”

Ah, Hertz has been in the news lately, regarding how its identity verification vendor handled driver’s licenses…

But back to my immobile car.

Golden Bear Towing arrives

I was sitting in said car, waiting for the Golden Bear Towing truck. AAA messaged me a handy dandy link to show me where my service person was, but by the time I got around to clicking it, he had already arrived.

I got out of the car, but as you and I know that did not prove I had title to the car. But I had the key.

And after the old battery was tested (12%, below recommendations) and replaced with a new one, it came time for my identity proofs.

AAA card? He didn’t need to see it.

Government ID? He didn’t need to see it.

Payment card? THAT he needed to see.

But he simply looked at the card, called the card number and the total into his office, and got approval over the phone.

Security lessons learned

If you always go by the book, this would be horrifying. After all, I write about Identity Assurance Level 3 (IAL3) all the time. And I never even had to show a driver’s license at all.

Why not?

Although it’s a car, it’s not an expensive car. Even a cursory read of this post reveals that this car is from model year 2018 or earlier.

The purchase was not an expensive purchase.

Although I didn’t undergo all the rigorous proofs of identity, there were enough secondary proofs that suggested that I was who I said I was. AAA dispatched its driver to my residential address, which they knew, to a particular car, which they knew.

Now presumably it is possible that I may have fraudulently induced Golden Bear Towing to replace a battery on a car that wasn’t mine.

Possible, but not probable.

In the real world, you need just enough proof of identity to keep things…running.

Google Lyria. Public Domain.

Explainer for Deborah: IAL 3

In case you are wondering why I’m addressing this post to Deborah rather than messaging her directly, I can’t.

Deborah, you see, is a fictional character.

She appeared in last night’s post “For Biometric Firms Seeking a Consulting Product Marketing Writer With Extensive Biometric Expertise.”

In the fictional story…well, the semi-fictional story…Deborah was dreading her upcoming meeting with a new outside consultant.

“Remember the last consultant we brought in? We spent an hour explaining the difference between a bifurcation and a ridge ending. And the writer was completely confused by the difference between FRTE and FATE.”

You see, Deborah had spent eight years in the biometric industry and knew it backwards and forwards…or so she thought.

Until she learned that the consultant had been in the industry since 1994.

My story touched upon a number of biometric topics, all of which I have written about. But this one time I failed to load the story with a ton of outbound links to previous Bredemarket posts. I just wanted to tell the story.

For example, the consultant asks Deborah this question at one point:

“Which reminds me: are you going for PAD Level 3 or IAL 3? Both are becoming more important, and you don’t want to get left behind.”

Identity Assurance Levels

I’m not going to explain the PAD acronym right now, but IAL stands for Identity Assurance Level, and IAL 3 is the level to which many identity companies aspire. The text below is repurposed from my August 2025 post “Identity Assurance Level 3 (IAL3): When Identity Assurance Level 2 (IAL2) Isn’t Good Enough.”

First, let’s review the three identity assurance levels.

From https://pages.nist.gov/800-63-3/sp800-63a.html#sec2.

I really need to update this to the newer NIST 800-63-4.

But anyway, the big difference between IAL2 and IAL3 is that IAL2 allows “either remote or physically-present identity proofing,” while IAL3 requires “[p]hysical presence” for identity proofing. However, the proofing agent may “attend the identity proofing session via a CSP-controlled kiosk or device.” In other words, supervised enrollment.

When do you need IAL3? Mitek’s Adam Bacia clarifies:

“IAL3 is reserved for high-risk environments such as sensitive government services.”

For more details on IAL 3 and who had achieved it (as of August 2025), visit my original post.

KeyData Cyber Sums Up The Most Visible Change in NIST SP 800-63-4

As we all transition from version 3 of NIST SP 800-63 to the new version 4 (63 63A 63B 63C), Biometric Update has published an article authored by Dustin Hoff of KeyData Cyber, “Navigating the crossroads of identity: leveraging NIST SP 800-63-4 for business advantage.”

So what has changed?

“Perhaps the most visible change is the push for phishing-resistant authentication—methods like passkeys, hardware-backed authenticators, and device binding….This shift signals that yesterday’s non-phishing-resistant MFA (SMS codes, security questions, and email OTPs) is no longer enough because they are easily compromised through man-in-the-middle or social engineering attacks like SIM swapping.”

Hoff says a lot more about version 4, including tips of transitioning to the new NIST standard. Read Hoff’s piece here on Biometric Update.

Who is Signing That Docusign Document?

Many of us have been using Docusign for years to electronically sign documents. But how does Docusign know that the person applying John Bredehoft’s signature is really John Bredehoft?

Enter Docusign’s implementation of Identity Assurance Level 2 (IAL2).

As reported by Biometric Update, Docusign published a November 6 post outlining how Docusign has incorporated identity verification technology into its document workflows.

“The Docusign ID Verification for IAL2 Compliance workflow is easy to add to workflows within eSignature and Maestro, part of the Docusign Intelligent Agreement Management (IAM) platform.

“Before a recipient can access an agreement, they will be required to verify their identity using their existing ID.me or CLEAR account. If needed, they can create a free account with either provider from within the same Docusign workflow. Once verified, they can securely sign and complete their agreement, all in a single, seamless experience.”

So Docusign has integrated with proven IAL2 vendors. See the Kantara Initiative trust status list of certified full service providers, which includes both CLEAR and ID.me for IAL2 and AAL2 (Authenticator Assurance Level 2).

But I have one teeny quibble with whoever writes Docusign’s headlines. The November 6 announcement was entitled “Identity Verification at the Highest Level: Docusign ID Verification for IAL2 Compliance.”

As you and I well know, IAL3 (rather than IAL2) is the highest level of identity verification.

But Docusign isn’t ready to jump to THAT level of identity verification…yet.

Sometimes You Don’t Need, Or Want, Identity Assurance Level 3 (IAL3)

This post is specifically for firms that sell identity verification solutions at various identity assurance levels, or IALs.

I have written a post entitled “Identity Assurance Level 3 (IAL3): When Identity Assurance Level 2 (IAL2) Isn’t Good Enough.”

Which naturally implies that IAL3 is better than IAL2, because it’s more secure.

So why doesn’t EVERYONE use IAL3?

For the same reason that childrens’ piggy banks aren’t protected with multiple biometric modalities AND driver’s license authentication.

Grok.

Kids don’t have driver’s licenses anyway.

In the same vein, in-person or remote supervised identity proofing isn’t always necessary. If your business would lose customers by insisting upon IAL3, and you’re OK with assuming the financial risk, don’t do it.

Grok.

Imagine if you had to get on a video chat and show your face and your driver’s license before EVERY Amazon purchase. Customers would go elsewhere. Amazon would go broke within days.

Which is why some identity firms promote IAL3, while others promote IAL2. (I won’t talk about the firms that promote IAL1.)

Whatever identity assurance level your prospects need, Bredemarket can help you create the content. Let’s talk about your specific needs.

Nothing Burgers

More later on IAL1 and other identity assurance levels.

Bredemarket Identity Assurance Level 3 (IAL3) Posts Over the Years

I’m preparing to promote four of my Identity Assurance Level 3 (IAL3) Bredemarket blog posts on my social media channels. You know, the posts that discuss in-person and remote supervised identity proofing. But I said to myself, “Self, why not re-promote them on the blog also?”

12/3/2020 IAL3 post

From the Bredemarket blog, December 2020:

“The U.S. National Institute of Standards and Technology has defined ‘identity assurance levels’ (IALs) that can be used when dealing with digital identities. It’s helpful to review how NIST has defined the IALs.”

“Identity assurance levels (IALs) and digital identity”: https://bredemarket.com/2020/12/03/identity-assurance-levels-ials-and-digital-identity/

7/19/2023 IAL3 post

From the Bredemarket blog, July 2023:

“If we ignore IAL1 and concentrate on IAL2 and IAL3, we can see one difference between the two. IAL2 allows remote, unsupervised identity proofing, while IAL3 requires (in practice) that any remote identity proofing is supervised.”

“The Difference Between Identity Assurance Levels 2 and 3”: https://bredemarket.com/2023/07/19/ial2-vs-ial3/

8/11/2025 IAL3 post

From the Bredemarket blog, August 2025:

“I’ve talked about Identity Assurance Levels 1, 2, and 3 on several occasions…..But as usually happens, IAL2 is yesterday’s news. Because biometric tech always gets harder better faster stronger.”

“Identity Assurance Level 3 (IAL3): When Identity Assurance Level 2 (IAL2) Isn’t Good Enough”: https://bredemarket.com/2025/08/11/ial3-when-ial2-isnt-good-enough/

9/17/2025 IAL3 post

From the Bredemarket blog, September 2025:

“Governments aren’t the only entities that need to definitively know identities in critically important situations.

“What about banks and other financial institutions, which are required by law to know their customers?

“Now the bank assumed a level of risk by [accepting a Bredemarket client check in a remote unsupervised manner] especially since the deposited check would not be in the bank’s physical possession after the deposit was completed.

“But guess what? The risk was acceptable for my transactions. I’m disclosing Bredemarket company secrets, but that client never wrote me a million dollar check.

“What about remote supervised transactions at financial institutions, where you are not physically present, but someone at the bank remotely sees you and everything you do?

“It turns out that the identity verification providers support video sessions between businesses (such as banks) and their customers.”

“Unlocking High-Value Financial Transactions: The Critical Role of Identity Assurance Level 3 (IAL3)”: https://bredemarket.com/2025/09/17/financial-ial3/

Proof of IAL3

I was up bright and early to attend a Liminal Demo Day, and the second presenter was Proof. Lauren Furey and Kurt Ernst presented, with Lauren assuming the role of the agent verifying Kurt’s identity.

The mechanism to verify the identity was a video session. In this case, Agent Lauren used three methods:

Examining Kurt’s ID, which he presented on screen.
Examining Kurt’s face (selfie).
Examining a credit card presented by Kurt.

One important note: Agent Lauren had complete control over whether to verify Kurt’s identity or not. She was not a mere “human in the loop.” Even if Kurt passed all the checks, Lauren could fail the identity check if she suspected something was wrong (such as a potential fraudster prompting Kurt what to do).

If you’ve been following my recent posts on identity assurance level, you know what happened next. Yes, I asked THE question:

“Another question for Proof: does you solution meet the requirements for supervised remote identity proofing (IAL3)?”

Lauren responded in the affirmative.

It’s important to note that Proof’s face authentication solution incorporates liveness detection, so there is reasonable assurance that the person’s fake is not a spoof or a synthetic identity.

So I guess I’m right, and that we’re seeing more and more IAL3 implementations, even if they don’t have the super-duper Kantara Initiative certification that NextgenID has.