Last December we saw a Small Business Innovation Research (SBIR) Solicitation from the Department of Homeland Security (DHS) where topic H-SB016.1-010 called for identifying five or more alternatives to knowledge-based verification (KBV) for remote identity proofing. The topic was motivated by multiple data breaches, which, as stated in the Solicitation, showed that “KBV is broken and rapidly becoming less effective as a verification tool as a by-product of the availability of personal information on social media as well as the variety of data breaches of credit bureaus and data brokers”.
We found the topic very interesting for several reasons:
- In countries like the United States where residents do not have a national identity card, secure identity proofing is difficult but essential for cybersecurity.
- Effective methods of remote identity proofing would not only make it easier for residents to seek government services, but would also enable new ways of doing business, such as remotely opening a bank account or applying for a mortgage.
- Reducing the reliance on knowledge-based verification would reduce identity theft, mitigate its damage, and increase privacy by shrinking the market for personally identifiable information (PII). And,
- Remote identity proofing has been neglected as a research topic.