Reconceptualising Levels of Assurance

The popular meme by Peter Steiner in The New Yorker, ‘On the internet, nobody knows you’re a dog,’¹ is an oft-quoted phrase in digital identity design discussions. As stated in the latest version of the Levels of Assurance technical guidelines by NIST², ‘when accessing some low-risk digital services, “being a dog” is just fine; while other, high-risk services need a level of confidence that the digital identity accessing the service is the legitimate proxy to the real life subject.’ The most recent guidelines recognise the need for dynamic levels of assurance, retiring the ‘the concept of a level of assurance (LOA) as a single ordinal that drives implementation-specific requirements’ and instead suggesting combining ‘appropriate business and privacy risk management side-by-side with mission need.’ The essence of the guidelines are captured below:

By introducing pseudonymous identifiers, and encouraging ‘minimizing the dissemination of identifying information by requiring federated identity providers (IdPs) to support a range of options for querying data, such as asserting whether an individual is older than a certain age rather than querying the entire date of birth,’ the guidelines clearly express its intent for privacy preserving decision making in the design of identity systems. However, it is limited in its view of approaching privacy and business interests are the primary competing values. This approach further continues the top-down approach in designing identity solutions by centering reduction of identity fraud. A competing value that is consistently ignored by LoA technical documents including the above, is that of inclusivity This is all the more perplexing as inclusivity has fast emerged as one of the primary rationales for digital identity systems.³ Centering ‘inclusivity’ in digital identity design would entail that the interest of individuals to not be excluded from services, benefits, entitlements and exercise of rights is a driving value.

Let us consider what inclusivity may (or may not) look like through an example. One of the biggest concerns around the Aadhaar project is its exclusionary impacts.⁴ The proviso to Section 7 of the Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act states that, “if an Aadhaar number is not assigned to an individual, the individual shall be offered alternate and viable means of identification for delivery of the subsidy, benefit or service.” This is an example of a legal provision attempting to factor the need for inclusivity in the implementation of an identity system. Despite this attempt, overall, it is an inadequate measure for the following reasons. First, instead of building inclusivity into the design of the digital identity solution, it seeks to retrospectively ‘fix’ through law what technology has ‘broken’. Second, the nature of protection it provides is limited and covers only those who have not been ‘assigned’ an Aadhaar Number yet. Therefore, those who have not applied for the Aadhaar Number or are unable to use the service due to technical glitches are offered recourse for inclusion.

Increasingly as digital identity solutions are used in exercise of both civil and political rights (use of identity in elections), and economic and social rights (access to essential benefits and services), the denial of services due to faulty design as well as failures of identity solutions imposes both real-life human costs as well as denial of fundamental human rights. Rather than a top-down approach where the ‘business’ or ‘state’ interests of those in charge with making decisions about what level of assurance to use dictates the design of identity solutions, it is imperative that levels of assurance are designed with ‘inclusivity’ as its guiding principle.

Recommendations

SELECTING LOA BASED ON PRIVACY, INCLUSIVITY, AND REDUCTION OF FRAUD

The digital identity system should be designed in such a way that a Relying Party is able to select levels of assurance based on consideration of privacy, inclusivity, and reduction of fraud.

DRAWING FROM PROPORTIONALITY STANDARD

IAL is selected to mitigate potential identity proofing errors in a privacy-preserving and inclusive manner. The definition of ‘privacy-preserving’ ought to draw from the proportionality standard.

NON-NEGOTIABLE DEGREE OF INCLUSIVITY

If we look at the Authenticator Assurance Levels under NIST’s LoA, the range of choices available to individuals reduces as we go up to the levels. AAL1 requires single-factor authentication using a wide range of available authentication technologies. In AAL2, proof of possession and control of two different authentication factors is required through a secure authentication protocol. In AAL3, proof of possession of a key through a cryptographic protocol is required. An additional consideration that needs to be introduced is the degree of inclusivity that is non-negotiable. Access to civil and political rights, and social and economic rights may require the highest degree of inclusivity, and consequently, the need for a range of options of authentication technologies.

Notes