ID Verification Controls Simulator

Overview of Misrepresentation Rate and Type

The following italicized text is from the report.

Understanding its susceptibility to different types of misrepresentation allows a program office to select the most appropriate verification controls to mitigate those risks. Identity thieves can obtain sensitive personal information through various methods, such as using phishing to trick individuals or employees of an organization into sharing their own or others’ sensitive personal information. Identity theft also can occur as a result of the loss or theft of data (a lost or stolen wallet or a thief digging through household trash). Because of the varying nature of how identity theft occurs, identity thieves may have greater or lesser amounts of information available.

Improper payments, fraud, and fraud risk are related, but distinct, concepts. While unintentional error may cause improper payments, fraud involves obtaining something of value through willful misrepresentation. Whether an act is fraudulent is determined through the judicial or other adjudicative system. Fraud risk exists when individuals have an opportunity to engage in fraudulent activities, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud.

For more information, please visit page 25 in the report.

Misrepresentation Rate in the Simulation

As described above, the percentage and nature of transactions that intentionally misrepresent identities may vary significantly by program and over time within the same program. As such, the simulation allows users to select the percent of program transactions that intentionally misrepresent an identity. Further, simulation users can adjust the percent of misrepresentation in which bad actors have either “more data” or “less data” (described further below) about each identity with which they are attempting to apply.

Neither misrepresentation rates nor types are necessarily consistent over the life of a program. Changes in the program’s internal controls may deter bad actors who deliberately misrepresent identities, which in turn, could reduce misrepresentation rates of a particular nature. The simulation does not generate different transactions in response to a reconfiguration of internal controls. Instead, by selecting to reconfigure the hypothetical program’s internal controls, simulation users can view how the control changes affect the simulated outcomes of the same attempted transactions.

Within the simulation, attempts to control misrepresented identity affect all program applicants. Program controls may incorrectly classify proper applicants as misrepresenting their identities. Thus, the misrepresentation rate meaningfully influences the costs and benefits of internal controls. If a program’s misrepresentation rate is low, for example, even very well-calibrated controls are likely to have more false positives than true positives and vice versa.

Overview of Control Tier Structure: Uniform vs. Risk-based

The following italicized text is from the report.

Program offices can select from two strategies to verify identities—one that applies controls uniformly to all transactions and one that calibrates controls based on a gradation of risks. A program office may find either system ideal depending on its risk assessment.

A program office may decide to use a uniform transaction management system if all transactions are similar in risk, if it is not feasible to triage transactions by risk level, or if a program office is legally obligated to treat all transactions identically. A uniform system may be relatively easy to design and may effectively reduce improper payments but, depending on the controls the program office selects, may also cause broad burdens on both administrators and individuals not misrepresenting their identities because the system applies the same set of controls to all transactions regardless of risk.

A program office may decide to use a risk-based transaction management system if it experiences varying levels of risk in processing transactions or if a program office has sufficient data to accurately assess each transaction’s given risk level. This approach uses progressively more-rigorous tiers of controls, each of which corresponds to a given transaction’s risk level. In order to assess a transaction’s risk level, several panelists encouraged the use of predictive modeling.

For more information, please visit page 27 in the report.

Control Tier Structure in the Simulation

Simulation users can select whether the system routes all transactions to the same sets of controls (uniform transaction management) or to different sets of controls (risk-based transaction management) based on assessments of transaction risk.

By enabling the “advanced options” in the “How will the hypothetical program operate?” box, advanced users may also choose to modify the composition of controls in each tier.

Overview of Digital Footprint Monitoring

The following italicized text is from the report.

Digital footprint identifies information about an applicant’s hardware and software in order to connect past and future interactions with the same individual. This control may analyze items such as an applicant’s internet protocol (IP) address, time zone, language settings, etc. and would alert a program office if any of these features change. For example, if an application’s IP address is based out of another country, a program office may assess the transaction at a higher risk and require more stringent controls. Or, a program office reviews the applicant’s keystroke and/or mouse patterns to determine if the behavior suggests the application was completed by a bot.

For more information, please visit page 33 in the report.

Digital Footprint Monitoring in the Simulation

Simulation users can select whether the hypothetical program’s control system will try to identify the “digital footprint” of applicants, flagging those who appear to be attempting to use bots to apply using misreprsented identities.

Within the simulation, digital footprint monitoring has no applicant burden and a low administrative cost; hypothetical program applicants need only to interact with the system for footprinting to occur.

Overview of Data Sharing, Eligibility Verification, and Do Not Pay

The following italicized text is from the report.

An authoritative source has access to information from an issuing source, so that relying parties such as agencies can validate evidence that an applicant provides. A program office may be more successful in verifying applicant identities if it uses multiple sources because data from the sources are often complementary and provide additional context for verification.

Several panelists noted that data sharing among government agencies and the private sector could increase the effectiveness of identity verification and reduce the likelihood of improper payments. Some panelists noted that data sharing can facilitate risk modeling, as more data can provide more accurate analytics.

For example, the Department of the Treasury’s Bureau of the Fiscal Service’s (Fiscal Service) Do Not Pay (DNP) business center collects data elements from a number of sources to assist participating agencies in determining an applicant’s payment eligibility. Incorporating these data, which include elements such as SSNs, known aliases, and business names, may help a program office identify anomalies. The program could then use network analysis to further identify potential bad actors.

Information hubs exist in the public sector (e.g., the DNP Business Center, the National Association of State Workforce Agencies’ integrity data hub, and the Financial Crimes Enforcement Network’s (FinCEN) suspicious activity repository) and private sector (e.g., MITRE’s aviation program), and can integrate either data or metadata from other sources. Information hubs rely on well-established, secure data pipelines to improve the efficiency of data sharing. They allow for established mechanisms to request and transfer data between agencies, which reduces the administrative burden for agencies, compared with initiating ad hoc data-sharing requests without a hub.

For more information, please visit page 30, 37, and 70 in the report.

Identity Verification Linked to Eligibility Verification in the Simulation

Simulation users can enable data sharing with DNP for cross-program analysis, which helps to uncover identities enrolled in multiple benefits programs, for whom there may be an eligibility issue. By screening program applicants during the pre-payment phase, the program can identify ineligible identities prior to making payments to ineligible applicants. The option to add data sharing for eligibility verification prior to executing transactions is available at no additional direct administrative cost to the hypothetical benefits program.

As described above, data sharing across additional information sources can enhance predictive models for identity verification by reducing false negatives and increasing true positives. Resolving an applicant’s identity across multiple federal programs can also minimize the costs of verifying certain eligibility standards.

The hypothetical benefits program makes payments only to living applicants, but does not have direct access to death records. One solution, noted in the report text above, is the DNP Business Center, a free service for Federal programs. DNP provides programs with access to screen payment recipients against multiple authorized data sources to determine eligibility. DNP also offers other analytics services to assist programs in their payment integrity activities.

Overview of Predictive Models for Identity Verification

The following italicized text is from the report.

In order to assess a transaction’s risk level, several panelists encouraged the use of predictive modeling. The Office of Management and Budget (OMB) guidance notes that when establishing a robust data analytics program, using a predictive approach can move an agency from a “pay-and-chase” approach to one that allows the agency to identify the potential improper payments before they occur.

Predictive modeling is a class of statistical techniques whereby transactions that have preestablished criteria, patterns, or characteristics are associated with an estimated likelihood of being improper. Program offices can define and apply business rules based on management goals, such as the relative importance of avoiding false positive and false negative classifications. These rules, which can be automated, deem certain transactions higher risk, allowing a program office to control them appropriately during both pre- and postpayment processes.

For more information, please visit page 29 in the report.

Predictive Models in the Simulation

Simulation users can select whether the system uses no predictive model, a simple predictive model, or sophisticated predictive model to triage transactions within the risk-based transaction management process.

As described above, predictive models for identity verification estimate the likelihood that a pending transaction involves a misrepresented identity. Predictive models calculate these estimates based on information about the application as well as other information related to the program. In general, predictive models work best when previous data is representative of future data. Therefore, in the simulator, the predictive models function so that past transactions within the hypothetical benefit program are representative of the program’s future transactions.

In ideal circumstances for the use of a predictive model, applicants with one attribute always misrepresent their identity, and applicants without this attribute never misrepresent their identity. Yet, in reality, likelihoods are generally impacted only marginally for a single attribute.

As described above and expanded upon in the Metrics section, predictive models often must make a trade-off between false positive results (incorrectly labeling a true identity as false) and false negative results (incorrectly labeling a false identity as true). A false positive may lead to subjecting proper transactions to additional controls. Within the simulation, increasing the burden on applicants to complete additional controls, may deter them from completing the application process. On the other hand, a false negative may result in an improper payment to an ineligible recipient.

Overview of Funding

The following italicized text is from the report.

Costs to create and maintain identity-verification processes within a federated Identity, Credential, and Access Management (ICAM) framework may be substantial, considering direct procurement and deployment, administrative, and hard-to-measure costs, such as time, program reputation, and financial impact of fraudulent activity. Many program offices face a direct trade-off between controlling risks related to a lack of identity verification and effectively achieving goals, such as timely issuing benefits to the correct individuals. A successful identity-verification framework cost effectively improves identity determinations while avoiding undue burden on affected individuals and helps to prevent and reduce improper payments.

Centralizing the funding for implementing a federated identity framework may ensure long-term stability. Some experts favored centrally funding through the federal government because they view it as the federal government’s responsibility to effectively deliver benefits to the public, and noted that the way to do that is via effective identity solutions. One example of this type of fund is the Technology Modernization Fund, which certain agencies may use to improve, retire, or replace existing federal information technology systems. An expert noted that establishing a similar type of fund to allow program offices to invest in identity-verification processes would make more sense than relying on each agency’s own appropriated funding. A dedicated source of capital that provides program offices flexibility to invest in new identity-verification projects could generate cost savings and may reduce improper payments.

For more information, please visit page 55 and 64 in the report.

Total Administrative Costs in the Simulation

Simulation users can select a budgeted amount for the hypothetical benefits program as well as whether to apply for additional funding.

Within the simulation, the total cost of selected internal controls is visible on the “Can you improve the hypothetical program’s performance?” tab and in the corresponding summary panel under “System Settings”. After selecting the program’s budget, different combinations of internal controls will result in the hypothetical program’s being over- or under-budget. The hypothetical costs associated with each system design choice are explained on the corresponding configuration page, under the “How will the hypothetical program operate?” tab.

It is important that internal controls are cost-effective because programs’ budgets are limited, and the simulation user must assess the benefits of the implemented internal controls relative to their costs. Federal agencies may have resources available to them to help improve their payment integrity. As mentioned above, an example of these additional resources available to agencies as-of the launch of this tool is the Technology Modernization Fund (TMF), which was established to provide transfers to certain agencies that apply for help to improve, retire, or replace existing information technology systems. (TMF transfers also generally require the recipient agency to pay reimbursement and fees; however, for simplicity, the simulation tool does not reflect such requirements.)

Users of the simulation tool can select the option to “apply” for additional funding for their hypothetical benefits program. If users select this option, the simulation automatically adds funds are the budget, which must be spent on identity verification controls. For the purposes of the simulation, the hypothetical program incurs no additional adminstrative costs to select this option.

Overview of Security

The following italicized text is from the report.

The E-Government Act of 2002 requires federal agencies to conduct privacy impact assessments of privacy risks associated with information technology used to process personal information. Similarly, The Office of Management and Budget (OMB) specified actions that agencies should take to prevent data breaches, such as using encryption to protect personally identifiable information (PII).

For program offices to achieve a certain level of identity assurance, the public has to provide some identity attributes as part of the verification process. An important consideration regarding sharing personal information among government programs is whether it can be done without sacrificing an individual’s right to privacy.

For more information, please visit page 47 in the report.

Security in the Simulation

“Over 28,000 security incidents were reported by federal civilian agencies to the Department of Homeland Security in Fiscal Year 2019. Since many government Information Technology (IT) systems contain vast amounts of PII, federal agencies must protect the confidentiality, integrity, and availability of this information &#8212 and effectively respond to data breaches and security incidents. Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits.” (https://www.gao.gov/cybersecurity)

The simulation incorporates these real-life cyber threats. To simulate these risks, each simulated program participant has a chance that their data/identity is stolen via a security breach. To address this risk, simulation users must decide if they want to dedicate a portion of their hypothetical budget toward enhancing IT/system security. If so, the simulation allows users to select two levels of additional security options beyond the minimum viable security to operate the hypothetical benefits program.