ID Tech Digest – October 4, 2024

Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:

Irish Data Protection Commissioner Opens EU Investigation Into Ryanair’s Use of Facial Recognition

Ireland's Data Protection Commissioner (DPC) has launched an EU-wide investigation into Ryanair's use of facial recognition technology for identity verification, following customer complaints about potential violations of GDPR. Ryanair uses facial recognition to verify passengers who book through third-party websites, claiming it helps prevent errors in contact and payment information. Passengers can choose alternative verification methods, such as early airport arrival or submitting ID documents online. Ryanair asserts that both its biometric and non-biometric verification processes comply with GDPR and are aimed at enhancing security. The investigation highlights growing concerns over the use of biometric data in travel, and could set a precedent for how airlines handle sensitive customer information in the future.

Selfie Biometrics Put Login.gov ‘in a Really Good Place’ for IAL2 Compliance: Director

Login.gov , the federal government's identity verification service , is on track to achieve Identity Assurance Level 2 (IAL2) compliance, according to its director, Hanna Kim. The service, launched in 2017 by the GSA , has embraced selfie-based face matching technology to compare user selfies with government-issued IDs as part of its efforts to meet the IAL2 standard. This capability, piloted with select agencies in May and expanded to all agencies by July, aims to improve identity verification while addressing previous criticisms over misleading IAL2 compliance claims. Kim emphasized the importance of equity and the careful selection of an algorithm with good performance across demographics, and GSA is awaiting the results of an ongoing equity study. Login.gov 's push for compliance is also part of efforts to rebuild trust following a 2023 watchdog report, with increased transparency and accountability measures now in place.

UK Crime Agency Seeks Comprehensive Facial Recognition System

The UK’s National Crime Agency (NCA) has issued a Request for Information (RFI) for a future procurement of a comprehensive facial recognition (FR) system, inviting feedback from potential suppliers by October 11, 2024. Key requirements include compatibility with existing offline IT infrastructure, scalability to handle a growing image dataset, and compliance with high security standards, such as Cyber Essentials Plus and the HMG Baseline Personnel Security Standard (BPSS). Vendors with NIST or NPL-certified algorithms are preferred to ensure accuracy and minimize demographic bias. The formal procurement process is expected to launch by March 31, 2025.

Maryland Takes Flexible Approach in Updated Facial Recognition Policy for Cops

Maryland has introduced a new model policy for law enforcement's use of facial recognition technology, developed by the Maryland State Police to align with recently passed state law. The policy serves as a flexible guideline, allowing individual police departments to modify or opt-out of its use, raising concerns about consistent privacy and civil rights protections. While Montgomery County has implemented stricter rules, such as prohibiting the use of facial recognition-generated photos in suspect lineups, the American Civil Liberties Union (ACLU) of Maryland has criticized the policy for lacking additional safeguards. The ACLU sought clarifications on using facial recognition as probable cause, restrictions on tracking, and bans on using unconsented databases, but these were not fully addressed. Montgomery Police Capt. Nicholas Picerno stated that facial recognition is treated as a tool for generating leads, not as definitive evidence like DNA or fingerprints.

China Extends Blockchain Beyond Borders with New Malaysian IDV Service

ZETRIX , a blockchain-based platform, has launched ZCert, a new identity verification service enabling the digital authentication of Chinese Digital IDs outside China. The ZCert system operates through integration with China's national blockchain, Xinghuo BIF, which is supported by the Ministry of Industry and Information Technology and led by the China Academy of Information and Communications Technology (CAICT). This integration provides an official cross-border eKYC solution, allowing international entities to verify the identities of Chinese nationals. Zetrix’s Astron Supernode handles verification, sharing only essential information in an encrypted form, while employing a Web3-based Self-Sovereign Identity framework to maintain user privacy. ZCert also integrates with other digital ID systems, including Malaysia’s National ID and WorldID. The service, operated by MY E.G. Services Berhad (MYEG), is expected to expand to verify additional documents.

Officials Laud Success of Intercontinental Digital ID Verification at IVC24 Summit in Australia

At the International Identity and Verifiable Credentials (IVC24) Summit in Australia, a Proof of Concept demo successfully validated digital credentials from North America, Europe, and Australia, demonstrating interoperability across three continents. Christopher Goh, Austroads' National Harmonization Lead for Digital Identity, hailed this achievement as a "landmark" for digital identity. The demonstration involved verifying credentials certified against ISO standards at a mock Transportation Security Administration (TSA) checkpoint, using a TSA CAT 2 reader to board a hypothetical flight. The success highlights growing global cooperation in mobile driver license and digital identity interoperability. Participants included Idemia, the American Association of Motor Vehicle Administrators, representatives from the French and Dutch governments, and members of the "Potential" European Digital Identity Wallet consortium.

Bosnia and Herzegovina to Launch Digital ID Wallet by Mid-2025

A digital ID wallet is being developed for citizens of Bosnia and Herzegovina, expected to launch by mid-2025 as part of the ‘EU4DigitalSME’ project. Led by Croatian tech startup Identity Consortium in collaboration with Adverta Pro, the wallet aims to modernize identification processes with secure electronic identification, authentication, and document signing. It will enable citizens to access public and private services using their digital identity, aligning with European regulations. Key functionalities include storing identity documents, driver’s licenses, and educational certificates, empowering users to control and share their data securely. The wallet will also facilitate interactions with government services, such as tax filing and social security access, and may integrate with the European digital ecosystem, providing access to EU services.

—

October 4, 2024 — by Tony Bitzionis and Alex Perala