Login.gov and the Uncertain Early Life of America’s National Digital ID
Talya R. Nevins
Login.gov is America’s new nationwide Digital ID system. In its few years of existence, it is already the only way to access an increasing number of government programs, benefits, and resources. The significance of this development hides behind technical details, confidential contracts, and jargony hyphenates like “single-sign-on” and “duo-authentication.” Yet properly examined, the story of why Login.gov was created, with whose input, and with which governance goals in mind exposes both the promise and pitfalls of infrastructural projects in the digital age.
A central facet of the Login.gov infrastructure is its reliance on a notoriously extractive and inscrutable data broker, LexisNexis. LexisNexis verifies the identities of Login.gov users—often welfare applicants, veterans, and federal employees—by comparing data input by users to a vast array of records scraped from every nook and cranny of the internet. The government’s decision to partner with LexisNexis openly flouted binding privacy and security guidelines set by the government’s own science and technology experts. Moreover, this massive aggregation of personal information, though legal, goes against the best practices for government collection and use of personal data set forth in the Privacy Act of 1974.
As ineffective as the Privacy Act of 1974 is as a data privacy law in the age of online data brokers, the law nevertheless represents a substantial effort by legislators from a bygone era to set principled guidelines for how to build trustworthy, democratically sustainable information systems. By contrast, the early years of America’s first nationwide digital identity credential are characterized by unscrupulous design judgments with dangerous consequences. But it is not too late to design tomorrow’s digital infrastructure to be safer, more equitable, and more trustworthy than what we have today.