Identity Exclusion in the United States [Intermediate]

I was really delighted that that last conversation ended on the topic of edge cases, because as the great Hank Marsman once said, it's those edge cases that just might be central to our humanity. I'm Elizabeth Garber. I'm going to let these people sit down, actually.

Welcome, welcome. Thanks for being here. I'm Elizabeth Garber, and today I'd like to introduce you to Linda. I encountered Linda's story on the Invisible Peoples Project. Linda became unhoused after having lost her eyesight, or deteriorating eyesight, and she could no longer work as a dental hygienist. Once she was, let's say, housing unstable, she experienced an act of violence that then resulted in the theft of her identity documentation.

At the point that she was interviewed by Invisible People, she had been unhoused for four years, and she was on a path of trying to recover those lost identity documents. She had recently replaced, with the help of a homeless shelter, she had recently replaced a birth certificate from the state of New Jersey, and was in the process of gaining a credential in the state of Massachusetts, where she lives, where I also live. Linda's story is common. You will see a lot more of them on InvisiblePeople.tv, if you go there and visit.

Periods of housing instability and homelessness are often inextricably linked to identification. Identification, the theft, the loss, the destruction of identity credentials can often be that tipping point that leads someone who's experiencing housing instability to become long-term unhoused. I'm lucky. I have a fantastic career. I'm lucky. I have a fantastic career. I've worked as a technologist in a number of major organizations. I have founded an identity startup and raised millions of dollars. I chair an affordable housing charity in my local area. When I was 12, my family lost our home.

There was never a time that I lived on the streets, but there was a time when the safety net between me and the streets was full of holes. And it's very easy for me to imagine that if me or my mother had lost our identity documents, that we might just have slipped through one of those holes. And that's one of the reasons why now I'm so passionate about the work that I do across a number of organizations, to try to ensure that everybody has access to safe, rights-enhancing identity.

And that work brings me to places like the OpenID Foundation, where we facilitate the development of privacy-preserving, safe, interoperable standards. It brings me to try to build capacity in this industry at places like IDPro and the Digital Identity Advancement Foundation. I also work with CityHub, trying to create policy and tech tools that are rights-enhancing around the world. And I work with the UN on safeguarding digital public infrastructure. A lot of this work is super global, and I'm delighted to say that I get to work with many of you in this room on that work.

It being so global, though, sometimes I forget to stop and look around at what's happening on the streets of my own city. And I think it's important that we all do that, and we take a look at the identity systems that are in place, and the places that are making these decisions about which identity infrastructures get funded around the world. A lot of what I do is...

Oh, there's a bit of formatting problem there. A lot of what I do is looking at the different frameworks that exist around the world, the different principles. And these are things that are used by funders in the West to decide whether we're going to invest in a DPI program in another country. When you strip back a lot of these principles, which are all really, really super important, like governance, sustainability, all of that, it's very important. But when you strip it back to just the human needs at the heart of identity systems, I think you come up with about five key themes.

Themes of access, agency, integrity, redress, and protection. Now, this is a 20-minute talk, and this talk is about identity exclusion in the US. So I'm not going to cover all five of these today. I'm going to focus primarily on access, redress, and protection. So let's start with access. To cover this topic, I'm going to take you to ID Ministry. ID Ministry is an organization at the Foundry Methodist Church in Washington, D.C. They work with at-risk populations to try and recover foundational ID documents. It's fully volunteer-led.

Last month, I went to visit them in preparation for this talk, and I met with their organizers, and I sat with them and basically shouted them for a while, and I heard some incredible things. First of all, 70% of the people that they work with are experiencing housing instability or are unhoused. 80% of those people have no birth certificate, and that's why they're coming to ID Ministry. Like I mentioned, I think that everyone in this room, myself included, have had a few pieces of good fortune follow us through life, right, that enable us to be here at EIC.

Number one, our birds were registered. Not everybody at ID Ministry had their birds registered. In the United States, that's not very common, but what I heard is that actually in older Americans, especially those born in rural areas, maybe on a farm or in a religious community, and also, honestly, Black Americans who were born in the Jim Crow South, a lot of them did not have their birds registered. Identity suppression at that time, or identity deprivation was a form of suppression at that time. So there are people who come to ID Ministry who need the very basics of identity.

The second piece of good fortune that I assume that we all share is that when we were children, we had parents who kept our documents safe. In the case of Americans, our birth certificates and our social security numbers, those documents were kept safe for us. Not every parent, even loving parents, not every parent has the skills to do that. And so some people grow up without having access to those documents. The other thing that never happened to me was my house was never, you know, burned up. I never was a victim of a natural disaster or anything.

I heard Jonathan Prisby from DHS give a talk in Tokyo last October, and he spoke about how identity documents in the United States are purposefully designed to last a human lifespan. But paper disintegrates in water, and it turns to ash and fire. So the moment you lose your home, you lose everything. That's the moment you probably most need those documents, and they are gone. We also have access to our birth certificates if we need to recover them.

I had no idea, and I feel a little foolish, but I had no idea that so many people in the United States who were adopted or entered the foster system actually can't gain access to their birth certificates. That's a huge deal. And the last piece on this slide is because we've had all of these privileges, we've been able to use our identities, we've been able to have a history, build up a history of documentary evidence that we can then use later on to prove who we are, we are able to recover our identity documents if we need to.

And all of these privileges that I enjoyed growing up enabled me to renew my passport two weeks ago when I needed to come here to Germany. So that last point about recoverability, I want to linger on for a bit. So how does somebody recover these foundational documents in the United States if they need to?

Well, that varies widely in the United States. So when I visited ID Ministry, one of the things that they offered to me was a copy of their operations manual, which they call their state book. And it's called their state book because it differs in every single state. There are some states where you need to ensure that your credit card and the details on that credit card match the person who's applying, which makes it really hard for an unhoused person working with a homeless shelter or another nonprofit to actually pay for and process that thing.

There are some states, many states, in fact, that offer knowledge-based authentication questions as a key form of recovery. And in some cases, like South Carolina, that's South Carolina there, if you don't pass that test, you are not getting your birth certificate. On the other hand, there are states where you can just go get anyone's birth certificate. I got two up there. Ohio and Kentucky, they're open records. There are some where the wait period is three months long.

And then there is one state, if you recognize it, I get shouted at if you want, where Social Security numbers are not accepted, or Social Security cards, but a gun permit is, which is Pennsylvania. Absolutely. All right.

So, for fun, I went ahead and tried to request my own birth certificate, a replacement copy. And it was dead easy for me to do, although I would say that it's been a month and it still hasn't arrived. And then also, if you look closely at the things that they're asking me here, I'm being asked knowledge-based authentication questions about somebody else.

In fact, three other people show up on this form. Some of them are not on my birth certificate. Two of them were not using their, it's not their current legal name. I did gray it out because, you know, privacy. But it's not their current legal names. And then I paused over some of them, and then I also recognized after the fact that for one of these people, my sister, there are periods of my life where I may not have known what county she lived in, and we weren't in a position to call her up and ask her the answer.

So I would have failed this, and if I'd lived in South Carolina, I wouldn't have had my birth certificate recovered, not via this channel anyway. So what do you do in that case?

Again, it varies widely state by state. It varies widely. You might have to go through a vouching process involving medical professionals, notaries. Requirements for notaries are very different. And it can take weeks and weeks of effort, multiple visits to multiple entities to get it done. And for a lot of people, this is prohibitively difficult. ID Ministry's clientele are, you know, they lack money. They probably lack time, the ability to get around.

And I saw the light go out of several people's eyes as they realized that they were going to have to make multiple trips across a geography as small as the District of Columbia. And add to that any sort of cognitive or physical differences that make it hard for them to do it, this is seriously hard. Let's talk now about redress. A lot of ID Ministry's clientele, they do have errors that need to be fixed on their birth certificates or other identity documents, and they will work with them to do that.

But one of the things that kept striking me, especially when I was hearing about open record states, and the volume of people whose stories are mixed up with acts of violence and the theft and the stealing of their identity documents, is that this community must be profoundly affected by identity theft. And that's exactly what happened to this man, William Woods, who went through a period of housing instability decades ago. He was in New Mexico, and he met another man, also unhoused at the time.

That man stole his wallet and was able to piece together information from the wallet and information he reportedly found on Ancestry.com. He was able to acquire this man's birth certificate and then built a life from there. And this man, William Woods, went to jail while trying to prove that he was himself and was later released and found to be who he is. That is so upsetting, right?

Now, that problem needs to be solved. Both problems need to be solved. We can't make it harder for people like Linda to access and replace her foundational identity documents. We have to make it hard to steal Linda's identity, but we can't make it harder for Linda to access her own identity. So before we move on to protection, I want to talk a little bit about the size of the problem here. And I also want to talk a little bit about some of the innovations, and then we'll talk about protections. It's really hard to size this problem. You cannot just Google it.

A lot of it is happening inside homeless shelters and nonprofits like ID Ministry, and their data, I'm sorry to say, it's not their top priority. They use a free version of some software, and it means that they have to delete all of their files like every six months. So they roughly know that they serve 2,000 people per year. But beyond that, it's hard to say.

But, as all of us know, business case math is, you know, creative. So we're going to try and size the problem here. So if we know that ID Ministry serves 2,000 people a year, what I can tell you from HUD data is that that's roughly 25% of the unhoused population of Washington, D.C. 25% of the people that are reportedly living on the streets.

If you extrapolate that to the United States, and you assign a value of that labor, let's call it minimum wage, which is not fair, but let's call it that, minimum wage, and you account for things like three hours of labor and the postage costs and whatnot, it's all very conservative, really. We're talking about $60 million a year being absorbed by homeless shelters to help support people replace and recover their identity documents. So homeless shelters should be providing food and a place to sleep, and this is a hidden cost to them.

But added to that, there are estimates that any one unhoused person, you know, it costs money to provide them with services, right? And so the U.S.

taxpayer, according to Brookings Institute, is paying roughly $35,000 a year per homeless person. And if we assume that half of those people, by recovering their identity, could then be moved into a position where they're no longer unhoused, then that could save us $3.4 billion a year. This is not a small problem. It's a hidden problem, yes, but it's not small. And of course, there's the opportunity cost of these people being completely unable and boxed out from the economy.

And of course, this is all intersecting with other numbers that we all know super well, bigger numbers, of course, the $230 to $520 billion lost to identity fraud, and of course $212 billion suspicious transactions per year associated with identity compromise. There is a huge business case here for solving these problems. Now let's look at the innovations that are happening in this space that might help. And I thought Priya in the last talk did a great job of describing some around the world. So we've got mobile credentials coming along. California is doing a great job of rolling these out.

So these are identity credentials that can be issued using the MDoc standard to your phone. That is fantastic. The state of California is doing great work. They are doing things like issuing multiple formats in their digital driver's licenses and ID cards. And they're also working hard to ensure that they're accepted across society by a number of different verifiers. They're also working on a project to issue credentials to the unhoused population in California.

Now that's not going to be without challenges, of course, because in order to get any one of these credentials, you still have to have foundational ID. But it could be that this is something that helps because not only are they going to be issuing them to the phones, but they are also in a position to be issuing cards that are scannable with QR code, et cetera. So it's an interesting innovation that they're doing over there in California. And it's not dissimilar to what's happening at UNHCR. UNHCR issues refugees with these credentials. They are linked to biometrics. So they scan irises.

They scan fingerprints, facial templates, et cetera. And these are issued to refugees around the world. And it enables them to do well. That depends on what country they're in, really. But a verifier downloads the MyVerify app, and they can just verify that this is a valid credential, and they'll see the face of the refugee and be able to verify that it is indeed them.

Now, what's good about this is that the linkage to biometrics makes it highly recoverable. They do that to dedupe their database, and they do it to make sure that these refugees can come back if these cards are lost, stolen, or destroyed. So that's an interesting fact.

Now, what I said before about it depends what country they're living in. Those credentials are usable. In Malaysia, for example, those credentials are critical for ensuring that the refugee is not going to be detained by police or deported. It's not really good for much more than that. In Ethiopia, however, they live under a different policy context. This woman here uses her refugee credentials, UNHCR refugee credential. She uses it to live, work, and she even owns a business. She's legally allowed to do that because of her legal status as a refugee.

So policy matters just as much as the technology. And that brings us to protections and the current state of identity protections in the United States. We are living in interesting times, times that make the problems that Linda faces all that much more urgent.

Linda, dare I say black and brown people on the streets without identity documents are at tremendous risk now in the United States. You've all heard the stories about the Salvadoran prisons. But it's also important to note that the definition of legal is changing in the United States. You have the administration revoking visas, green cards, etc. You can now be declared dead by the government if we decide that we want you to self-deport. And even for just, you know, Elon Musk's team might think you're dead. The trans community is being targeted pretty significantly.

And they're using, they're able to use the identity markers that we have in your passport or other ID credentials to do that. So that's worth bearing in mind. There are new barriers to voting coming into place or which may come into place that could prevent women who've changed their names or people without access to their foundational documents from being able to vote. There are new threats to privacy. As the DOJ team is correlating data about every American citizen.

And of course we've all seen the stories about threats to cybersecurity in the United States now where we're making some pretty bad choices and removing key protections in the federal government. So it's easy to look at some of that and think, God, what good are these policies? Are they even worth the paper they're printed on sometimes?

Yes, they are. They really are. These policies, these institutional legal protections, they really, really matter. Not only do they slow things down when these changes are coming into place. They slow the administration down as they're stripping away rights. But also they help us to ensure that technologies and systems are built with technical controls, operational controls, in place in the first place.

The ACLU, for example, this is just an example. The ACLU published a document that offers guidance to state legislatures who are looking to issue mobile credentials. That includes things like contextually banning surveillance-style architectures. So the language that they put in here is really useful guidance to legislatures who are looking to create these credentials. And I think that's really important for all of us to think about. What are the technical and the operational controls that we can put in place to ensure that the technologies we build protect people from harm?

And we need to manage important trade-offs as part of those discussions. Where do you put the credential? Do you put it on the device? Does that help people like Linda? A lot of the people at ID Ministry don't have phones, or those phones are going to get stolen or broken. Then again, a birth certificate is easy to steal. A mobile credential could be revocable by the government if they make certain decisions. How do we prevent that?

The paper, irrevocable. As long as you have access to it, you've got something to prove who you are and where you came from. We need to think about biometrics, obviously. It enables foundational recovery, but obviously the effects of a breach are profound. So how do we do this thoughtfully? Online presentation. Obviously it enables access, it prevents fraud, but there are profound risks of surveillance from the government, from verifiers, from wallets, et cetera. So how do we build protections into those processes? And we have to take that seriously.

Everybody in this room has a part to play in this. We can identify and mitigate risks in the products we're building. We can consider the ethical and social protections that are required when we're writing standards. Do we think it's good enough for standards to be silent about some of this stuff some of the time? I don't know. Where do we build that guidance in? We can advocate for policies that ensure protections. All of us have a part to play. Linda deserves to have access to irrevocable, irrefutable proof that she's a unique person under the law.

She's also entitled to protection from identity theft. She's also entitled to protection from surveillance. She's also entitled to protection from targeting based on her demographics or her behavioral patterns. We have to think about all of these things together and think holistically about the technologies, the standards, the products, the services that we're building. And if you're thinking about Linda as you do your job, solving for Linda or the edge cases that are central to our humanity, you're going to solve for all of us. Thank you. applause