What This Bill Does
This bill creates a task force (a temporary group assigned to solve a specific problem) to develop better ways for the federal government and states to verify who people are online. The task force will work on creating digital versions of identity documents like driver's licenses and passports to make online transactions more secure and prevent identity theft and fraud.
Who It Affects
- Federal agencies that issue or manage identity documents
- State, local, tribal (Native American), and territorial governments
- Private companies that handle identity verification
- All people in the United States who use online services
- Identity theft victims and fraud prevention experts
Key Provisions
- A task force called the "Improving Digital Identity Task Force" is established in the Executive Office of the President to coordinate government efforts on digital identity (Sec. 4(a))
- The task force will create a strategy for secure digital identity verification that protects privacy, requires individual consent, and works across different agencies (Sec. 4(g)(4))
- The task force cannot recommend a single government-issued identity credential, a centralized national identification registry, or force anyone to use digital identity verification (Sec. 4(h))
- The task force must submit an initial report within 180 days, an interim report within 18 months, and a final report 180 days before it ends (Sec. 4(j))
- The task force will end three years after the bill becomes law (Sec. 4(k))
- Federal agencies must report annually on their progress implementing digital identity guidance (Sec. 5(b)(1))
What Changes
If this becomes law, the federal government will establish a coordinated effort to develop and recommend standards for digital identity systems. Federal agencies will need to follow new guidance on digital identity verification. States will be invited to participate in creating interoperable digital identity systems. The government will track and publicly report on digital identity services offered by federal agencies.
Important Definitions
- **Digital identity verification**: A process to verify who someone is or confirm their identity information when they access a service online or electronically (Sec. 3(2))
- **Identity attribute**: Data elements about a person, like their name, address, or birth date (Sec. 3(5))
- **Identity credential**: An official document issued by government that proves identity, such as a driver's license or passport (Sec. 3(6))
Effective Date
Not specified in bill text
II
★(Star Print)
Calendar No. 129
118TH CONGRESS
1ST SESSION
S. 884
[Report No. 118–47]
To establish a Government-wide approach to improving digital identity, and
for other purposes.
IN THE SENATE OF THE UNITED STATES
MARCH 21, 2023
Ms. SINEMA (for herself and Ms. LUMMIS) introduced the following bill; which
was read twice and referred to the Committee on Homeland Security and
Governmental Affairs
JULY 11, 2023
Reported by Mr. PETERS, with amendments
[Omit the part struck through and insert the part printed in italic]
A BILL
To establish a Government-wide approach to improving
digital identity, and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Improving Digital
4
Identity Act of 2023’’.
5
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
2
S 884 RS1S
SEC. 2. FINDINGS.
1
Congress finds the following:
2
(1) The lack of an easy, affordable, reliable,
3
and secure way for organizations, businesses, and
4
government agencies to identify whether an indi-
5
vidual is who they claim to be online creates an at-
6
tack vector that is widely exploited by adversaries in
7
cyberspace and precludes many high-value trans-
8
actions from being available online.
9
(2) Incidents of identity theft and identity
10
fraud continue to rise in the United States, where
11
more than 293,000,000 people were impacted by
12
data breaches in 2021.
13
(3) Since 2017, losses resulting from identity
14
fraud have increased by 333 percent, and, in 2020,
15
those losses totaled $56,000,000,000.
16
(4) The Director of the Treasury Department
17
Financial Crimes Enforcement Network of the De-
18
partment of the Treasury has stated that the abuse
19
of personally identifiable information and other
20
building blocks of identity is a key enabler behind
21
much of the fraud and cybercrime affecting the
22
United States today.
23
(5) The inadequacy of current digital identity
24
solutions degrades security and privacy for all people
25
in the United States, and next generation solutions
26
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
3
S 884 RS1S
are needed that improve security, privacy, equity,
1
and accessibility.
2
(6)
Government
entities,
as
authoritative
3
issuers of identity in the United States, are uniquely
4
positioned to deliver critical components that ad-
5
dress deficiencies in the digital identity infrastruc-
6
ture of the United States and augment private sec-
7
tor digital identity and authentication solutions.
8
(7) State governments are particularly well-suit-
9
ed to play a role in enhancing digital identity solu-
10
tions used by both the public and private sectors,
11
given the role of State governments as the issuers of
12
driver’s licenses and other identity documents com-
13
monly used today.
14
(8) The public and private sectors should col-
15
laborate to deliver solutions that promote confidence,
16
privacy, choice, equity, accessibility, and innovation.
17
The private sector drives much of the innovation
18
around digital identity in the United States and has
19
an important role to play in delivering digital iden-
20
tity solutions.
21
(9) The bipartisan Commission on Enhancing
22
National Cybersecurity has called for the Federal
23
Government to ‘‘create an interagency task force di-
24
rected to find secure, user-friendly, privacy-centric
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
4
S 884 RS1S
ways in which agencies can serve as 1 authoritative
1
source to validate identity attributes in the broader
2
identity market. This action would enable Govern-
3
ment agencies and the private sector to drive signifi-
4
cant risk out of new account openings and other
5
high-risk, high-value online services, and it would
6
help all citizens more easily and securely engage in
7
transactions online.’’.
8
(10) It should be the policy of the Federal Gov-
9
ernment to use the authorities and capabilities of the
10
Federal Government, in coordination with State,
11
local, Tribal, and territorial partners and private
12
sector innovators, to enhance the security, reliability,
13
privacy, equity, accessibility, and convenience of con-
14
sent-based digital identity solutions that support and
15
protect transactions between individuals, government
16
entities, and businesses, and that enable people in
17
the United States to prove who they are online.
18
SEC. 3. DEFINITIONS.
19
In this Act:
20
(1) APPROPRIATE
NOTIFICATION
ENTITIES.—
21
The
term
‘‘appropriate
notification
entities’’
22
means—
23
(A) the President;
24
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
5
S 884 RS1S
(B) the Committee on Homeland Security
1
and Governmental Affairs of the Senate; and
2
(C) the Committee on Oversight and Re-
3
form Accountability of the House of Represent-
4
atives.
5
(2) DIGITAL
IDENTITY
VERIFICATION.—The
6
term ‘‘digital identity verification’’ means a process
7
to verify the identity or an identity attribute of an
8
individual accessing a service online or through an-
9
other electronic means.
10
(3) DIRECTOR.—The term ‘‘Director’’ means
11
the Director of the Task Force.
12
(4) FEDERAL
AGENCY.—The term ‘‘Federal
13
agency’’ has the meaning given the term in section
14
102 of the Robert T. Stafford Disaster Relief and
15
Emergency Assistance Act (42 U.S.C. 5122).
16
(5) IDENTITY ATTRIBUTE.—The term ‘‘identity
17
attribute’’ means a data element associated with the
18
identity of an individual, including, the name, ad-
19
dress, or date of birth of an individual.
20
(6) IDENTITY CREDENTIAL.—The term ‘‘iden-
21
tity credential’’ means a document or other evidence
22
of the identity of an individual issued by a govern-
23
ment agency that conveys the identity of the indi-
24
vidual, including a driver’s license or passport.
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
6
S 884 RS1S
(7) SECRETARY.—The term ‘‘Secretary’’ means
1
the Secretary of Homeland Security.
2
(8) TASK
FORCE.—The term ‘‘Task Force’’
3
means the Improving Digital Identity Task Force
4
established under section 4(a).
5
SEC. 4. IMPROVING DIGITAL IDENTITY TASK FORCE.
6
(a) ESTABLISHMENT.—There is established in the
7
Executive Office of the President a task force to be known
8
as the ‘‘Improving Digital Identity Task Force’’.
9
(b) PURPOSE.—The purpose of the Task Force shall
10
be to establish and coordinate a government-wide effort
11
to develop secure methods for Federal, State, local, Tribal,
12
and territorial agencies to improve access and enhance se-
13
curity between physical and digital identity credentials,
14
particularly by promoting the development of digital
15
versions of existing physical identity credentials, including
16
driver’s licenses, e-Passports, social security credentials,
17
and birth certificates, to—
18
(1) protect the privacy and security of individ-
19
uals;
20
(2) support reliable, interoperable digital iden-
21
tity verification in the public and private sectors;
22
and
23
(3) in achieving paragraphs (1) and (2), place
24
a particular emphasis on—
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
7
S 884 RS1S
(A) reducing identity theft and fraud;
1
(B) enabling trusted transactions; and
2
(C) ensuring equitable access to digital
3
identity verification.
4
(c) DIRECTOR.—
5
(1) IN GENERAL.—The Task Force shall have
6
a Director, who shall be appointed by the President.
7
(2) POSITION.—The Director shall serve at the
8
pleasure of the President.
9
(3) PAY AND ALLOWANCES.—The Director shall
10
be compensated at the rate of basic pay prescribed
11
for level II of the Executive Schedule under section
12
5313 of title 5, United States Code.
13
(4) QUALIFICATIONS.—The Director shall have
14
substantive technical expertise and managerial acu-
15
men that—
16
(A) is in the business of digital identity
17
management, information security, or benefits
18
administration;
19
(B) is gained from not less than 1 organi-
20
zation; and
21
(C) includes specific expertise gained from
22
academia, advocacy organizations, or the pri-
23
vate sector.
24
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
8
S 884 RS1S
(5) EXCLUSIVITY.—The Director may not serve
1
in any other capacity within the Federal Government
2
while serving as Director.
3
(6) TERM.—The term of the Director, including
4
any official acting in the role of the Director, shall
5
terminate on the date described in subsection (k).
6
(d) MEMBERSHIP.—
7
(1)
FEDERAL
GOVERNMENT
REPRESENTA-
8
TIVES.—The Task Force shall include the following
9
individuals or the designees of such individuals:
10
(A) The Secretary.
11
(B) The Secretary of the Treasury.
12
(C) The Director of the National Institute
13
of Standards and Technology.
14
(D) The Director of the Financial Crimes
15
Enforcement Network.
16
(E) The Commissioner of Social Security.
17
(F) The Secretary of State.
18
(G) The Administrator of General Services.
19
(H) The Director of the Office of Manage-
20
ment and Budget.
21
(I) The Postmaster General of the United
22
States Postal Service.
23
(J) The National Cyber Director.
24
(K) The Attorney General.
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
9
S 884 RS1S
(L) The heads of other Federal agencies or
1
offices as the President may designate or invite,
2
as appropriate.
3
(2) STATE, LOCAL, TRIBAL, AND TERRITORIAL
4
GOVERNMENT
REPRESENTATIVES.—The
Director
5
shall appoint to the Task Force 6 State, local, Trib-
6
al, and or territorial government officials who rep-
7
resent agencies that issue identity credentials and
8
who have—
9
(A) experience in identity technology and
10
services;
11
(B) knowledge of the systems used to pro-
12
vide identity credentials; or
13
(C) any other qualifications or com-
14
petencies that may help achieve balance or oth-
15
erwise support the mission of the Task Force.
16
(3) NONGOVERNMENTAL EXPERTS.—
17
(A) IN GENERAL.—The Director shall ap-
18
point to the Task Force 5 nongovernmental ex-
19
perts.
20
(B) SPECIFIC
APPOINTMENTS.—The ex-
21
perts appointed under subparagraph (A) shall
22
include the following:
23
(i) A member who is a privacy and
24
civil liberties expert.
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
10
S 884 RS1S
(ii) A member who is a technical ex-
1
pert in identity verification.
2
(iii) A member who is a technical ex-
3
pert in cybersecurity focusing on identity
4
verification services.
5
(iv) A member who represents the
6
identity verification services industry.
7
(v) A member who represents a party
8
that relies on effective identity verification
9
services to conduct business.
10
(e) WORKING GROUPS.—The Director shall organize
11
the members of the Task Force into appropriate working
12
groups for the purpose of increasing the efficiency and ef-
13
fectiveness of the Task Force, as appropriate.
14
(f) MEETINGS.—The Task Force shall—
15
(1) convene at the call of the Director; and
16
(2) provide an opportunity for public comment
17
in accordance with section 1009(a)(3) of title 5,
18
United States Code.
19
(g) DUTIES.—In carrying out the purpose described
20
in subsection (b), the Task Force shall—
21
(1) identify Federal, State, local, Tribal, and
22
territorial agencies that issue identity credentials or
23
hold information relating to identifying an indi-
24
vidual;
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
11
S 884 RS1S
(2) assess restrictions with respect to the abili-
1
ties of the agencies described in paragraph (1) to
2
verify identity information for other agencies and
3
nongovernmental organizations;
4
(3) assess any necessary changes in statutes,
5
regulations, or policy to address any restrictions as-
6
sessed under paragraph (2);
7
(4) recommend a strategy, based on existing
8
standards, to enable agencies to provide services re-
9
lating to digital identity verification in a way that—
10
(A) is secure, protects privacy, and pro-
11
tects individuals against unfair and misleading
12
practices;
13
(B) prioritizes equity and accessibility;
14
(C) requires individual consent for the pro-
15
vision of digital identify verification services by
16
a Federal, State, local, Tribal, or territorial
17
agency;
18
(D) is interoperable among participating
19
Federal, State, local, Tribal, and territorial
20
agencies, as appropriate and in accordance with
21
applicable laws; and
22
(E) prioritizes technical standards devel-
23
oped by voluntary consensus standards bodies
24
in accordance with section 12(d) of the Na-
25
VerDate Sep 11 2014
22:34 Aug 29, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\S884.RS
S884
kjohnson on DSK79L0C42PROD with BILLS
12
S 884 RS1S
tional Technology Transfer and Advancement
1
Act of 1995 (15 U.S.C. 272 note) and guidance
2
under OMB Circular A–119, entitled ‘‘Federal
3
Participation in the Development and Use of
4
Voluntary Consensus Standards and in Con-
5
formity Assessment Activities’’, or any suc-
6
cessor thereto.;
7
(5) recommend principles to promote policies
8
for shared identity proofing across public sector
9
agencies, which may include single sign-on or broad-
10
ly accepted attestations;
11
(6) identify funding or other resources needed
12
to support the agencies described in paragraph (4)
13
that provide digital identity verification, including
14
recommendations with respect to the need for and
15
the design of a Federal grant program to implement
16
the recommendations of the Task Force and facili-
17
tate the development and upgrade of State, local,
18
Tribal, and territorial highly-secure interoperable
19
systems that enable digital identity verification;
20
(7) recommend funding models to provide dig-
21
ital identity verification to private sector entities,
[Text truncated for display. Full text available on Congress.gov.]