U.S. states centralise digital identity platforms amid AI fraud risks

U.S. states are moving away from separate agency-by-agency login systems toward enterprise digital identity platforms. Meanwhile, growing concerns about synthetic identities, deepfakes and AI-enabled impersonation are pushing governments toward stronger identity proofing that can include biometrics and liveness detection. Those are among the findings of a new National Association of State Chief Information Officers (NASCIO) report based on a limited survey and interviews with chief information officers (CIO), chief information security officers and chief technology officers representing 47 states and territories. The report says states increasingly view digital identity as foundational infrastructure for modern digital government rather than solely as an access management or cybersecurity function. The shift could eventually give residents a single account or unified resident profile that can be used across numerous government services instead of requiring separate credentials and identity verification for motor vehicle agencies, benefits programs, tax systems and other services. NASCIO’s 2024 State CIO Survey graphic shows 51 percent of respondents using a centralized approach to citizen digital identity management, 38 percent using a federated or hybrid approach and 21 percent using a decentralized approach. Thirty-six percent cited the difficulty of resolving data conflicts when different agencies maintain different authoritative records for the same person. Another 36 percent cited the difficulty of balancing data privacy with the cross-agency data sharing needed to provide a unified government services experience. Some states said their enterprise identity platforms already support millions of resident accounts and dozens of agencies, while others are still migrating applications that use older agency-managed identity systems. The survey found that just 13 percent of respondents then considered their citizen digital identity initiatives fully implemented, although another 48 percent said they were partially implemented. The goal emerging from the new survey is what states repeatedly described as a common digital “front door” through which a resident could authenticate once and move between government services without repeatedly establishing new accounts or proving the same identity. But the move is not simply about making government websites easier to use. States increasingly are treating the identity behind the account as a risk management problem, with the level of assurance required varying according to what a person is attempting to do. More mature programs have tiered approaches that can combine identity proofing, multifactor authentication (MFA), adaptive security controls and biometric validation, with stronger measures applied to services carrying greater fraud or security risks. That approach is taking on greater significance as generative AI changes the types of fraud that state systems must detect. Respondents identified synthetic identities, AI-generated spoofing, deepfake impersonation and automated account attacks among emerging threats against citizen-facing systems. Many states said they are strengthening identity proofing at both account enrollment and authentication rather than treating AI fraud as a separate cybersecurity problem. Several respondents specifically identified biometric verification and liveness detection as defenses against attempts to present manipulated images, synthetic personas or otherwise spoof identity verification systems. States are also exploring behavioral analytics, anomaly detection and continuous monitoring to identify unusual account activity after a user has been authenticated. The findings suggest a broader change from authentication as a single event at login toward continuing assessments of whether a user or transaction should still be trusted. NASCIO says states are looking at risk-based authentication, passkeys, FIDO2 and WebAuthn technologies, behavioral and contextual signals and continuous trust evaluation. Some respondents described future architectures in which the authentication required would change according to transactional, environmental and behavioral risks rather than remaining the same for every interaction. NASCIO found widely varying levels of preparedness. Some states already combine identity telemetry, fraud analytics and threat intelligence with security operations, while others remain at the pilot or discussion stage. Several respondents said formal governance models or playbooks specifically addressing AI-enabled identity attacks have not yet been established. Seventy percent of respondents identified insufficient funding for an enterprise identity solution as one of their five biggest obstacles. NASCIO notes that requirements such as MFA can assume residents possess suitable personal devices, reliable connectivity and sufficient digital literacy to complete enrollment and authentication. More stringent controls can increase account lockouts or cause people to abandon the process altogether. Some states consequently said future systems need alternatives for people who cannot or do not want to complete digital identity verification online, bringing accessibility and inclusion alongside privacy and security as design requirements. NASCIO also found states are beginning to look beyond the conventional model in which a citizen establishes an account with each government system. Multiple respondents reported plans involving mobile driver’s licenses, verifiable credentials, reusable identity information and interoperable digital wallets. Some are exploring models that would give residents greater ownership and portability of their digital identity information, allowing verified information to be reused securely across services and potentially across jurisdictions. Some states are also examining decentralized identity concepts, provider-neutral architectures and open standards-based interoperability. More forward-looking respondents are even beginning to consider what NASCIO calls “agentic identity,” along with continuous authentication, privacy-preserving proofing and digital identity systems that are capable of supporting interactions initiated by autonomous software agents acting on behalf of individuals. NASCIO concludes that citizen identity management should ultimately be treated as a centralized statewide capability, even where individual agencies retain control over program-specific authorization. The survey suggests states increasingly know where they want to go. The harder problem is moving decades of fragmented government systems, identity records and agency authorities there with them.