,i #aahth ,,congress #b;d ,session ,h4 ,r4 #ighc ,,in ,,the ,,house ,,of ,,representatives ,september #bd1 #bjbd,mr4 ,foster introduced the following bill2 which was referred to the ,committee on ,oversight and ,accountability ,a ,,bill ,to establish a ,government-wide approach to improving digital identity1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,improving ,digital ,identity ,act of #bjbd4 #b4 ,findings ,congress finds the following3 7#a7 ,the lack of an easy1 affordable1 reliable1 and secure way for organizations1 businesses1 and government agencies to identify whether an individual is who they claim to be online creates an attack vector that is widely exploited by adversaries in cyberspace and precludes many high-value transactions from being available online4 7#b7 ,incidents of identity theft and identity fraud continue to rise in the ,united ,states1 where more than #bic1jjj1jjj people were impacted by data breaches in #bjba4 7#c7 ,since #bjag1 losses resulting from identity fraud have increased by #ccc percent1 and1 in #bjbj1 those losses totaled #ef1jjj1jjj1jjj4 7#d7 ,the ,director of the ,financial ,crimes ,enforcement ,network of the ,department of the ,treasury has stated that the abuse of personally identifiable information and other building blocks of identity is a key enabler behind much of the fraud and cybercrime affecting the ,united ,states today4 7#e7 ,the inadequacy of current digital identity solutions degrades security and privacy for all people in the ,united ,states1 and next generation solutions are needed that improve security1 privacy1 equity1 and accessibility4 7#f7 ,government entities1 as authoritative issuers of identity in the ,united ,states1 are uniquely positioned to deliver critical components that address deficiencies in the digital identity infrastructure of the ,united ,states and augment private sector digital identity and authentication solutions4 7#g7 ,state governments are particularly well-suited to play a role in enhancing digital identity solutions used by both the public and private sectors1 given the role of ,state governments as the issuers of driver's licenses and other identity documents commonly used today4 7#h7 ,the public and private sectors should collaborate to deliver solutions that promote confidence1 privacy1 choice1 equity1 accessibility1 and innovation4 ,the private sector drives much of the innovation around digital identity in the ,united ,states and has an important role to play in delivering digital identity solutions4 7#i7 ,the bipartisan ,commission on ,enhancing ,national ,cybersecurity has called for the ,federal ,government to create an interagency task force directed to find secure1 user-friendly1 privacy-centric ways in which agencies can serve as #a authoritative source to validate identity attributes in the broader identity market4 ,this action would enable ,government agencies and the private sector to drive significant risk out of new account openings and other high-risk1 high-value online services1 and it would help all citizens more easily and securely engage in transactions online44 7#aj7 ,it should be the policy of the ,federal ,government to use the authorities and capabilities of the ,federal ,government1 in coordination with ,state1 local1 ,tribal1 and territorial partners and private sector innovators1 to enhance the security1 reliability1 privacy1 equity1 accessibility1 and convenience of consent-based digital identity solutions that support and protect transactions between individuals1 government entities1 and businesses1 and that enable people in the ,united ,states to prove who they are online4 #c4 ,definitions ,in this ,act3 7#a7 ,appropriate notification entities ,the term appropriate notification entities means-- 7,a7 the ,president2 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,c7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives4 7#b7 ,digital identity verification ,the term digital identity verification means a process to verify the identity or an identity attribute of an individual accessing a service online or through another electronic means4 7#c7 ,director ,the term ,director means the ,director of the ,task ,force4 7#d7 ,federal agency ,the term ,federal agency has the meaning given the term in section #ajb of the ,robert ,t4 ,stafford ,disaster ,relief and ,emergency ,assistance ,act 7#db ,u4,s4,c4 #eabb74 7#e7 ,identity attribute ,the term identity attribute means a data element associated with the identity of an individual1 including1 the name1 address1 or date of birth of an individual4 7#f7 ,identity credential ,the term identity credential means a document or other evidence of the identity of an individual issued by a government agency that conveys the identity of the individual1 including a driver's license or passport4 7#g7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#h7 ,task ,force ,the term ,task ,force means the ,improving ,digital ,identity ,task ,force established under section #d7;a74 #d4 ,improving ,digital ,identity ,task ,force 7a7 ,establishment ,there is established in the ,executive ,office of the ,president a task force to be known as the ,improving ,digital ,identity ,task ,force4 7b7 ,purpose ,the purpose of the ,task ,force shall be to establish and coordinate a government-wide effort to develop secure methods for ,federal1 ,state1 local1 ,tribal1 and territorial agencies to improve access and enhance security between physical and digital identity credentials1 particularly by promoting the development of digital versions of existing physical identity credentials1 including driver's licenses1 e-,passports1 social security credentials1 and birth certificates1 to-- 7#a7 protect the privacy and security of individuals2 7#b7 support reliable1 interoperable digital identity verification in the public and private sectors2 and 7#c7 in achieving paragraphs 7#a7 and 7#b71 place a particular emphasis on-- 7,a7 reducing identity theft and fraud2 7,b7 enabling trusted transactions2 and 7,c7 ensuring equitable access to digital identity verification4 7c7 ,director 7#a7 ,in general ,the ,task ,force shall have a ,director1 who shall be appointed by the ,president4 7#b7 ,position ,the ,director shall serve at the pleasure of the ,president4 7#c7 ,pay and allowances ,the ,director shall be compensated at the rate of basic pay prescribed for level ,,ii of the ,executive ,schedule under section #ecac of title #e1 ,united ,states ,code4 7#d7 ,qualifications ,the ,director shall have substantive technical expertise and managerial acumen that-- 7,a7 is in the business of digital identity management1 information security1 or benefits administration2 7,b7 is gained from not less than #a organization2 and 7,c7 includes specific expertise gained from academia1 advocacy organizations1 or the private sector4 7#e7 ,exclusivity ,the ,director may not serve in any other capacity within the ,federal ,government while serving as ,director4 7#f7 ,term ,the term of the ,director1 including any official acting in the role of the ,director1 shall terminate on the date described in subsection 7k74 7d7 ,membership 7#a7 ,federal ,government representatives ,the ,task ,force shall include the following individuals or the designees of such individuals3 7,a7 ,the ,secretary4 7,b7 ,the ,secretary of the ,treasury4 7,c7 ,the ,director of the ,national ,institute of ,standards and ,technology4 7,d7 ,the ,director of the ,financial ,crimes ,enforcement ,network4 7,e7 ,the ,commissioner of ,social ,security4 7,f7 ,the ,secretary of ,state4 7,g7 ,the ,administrator of ,general ,services4 7,h7 ,the ,director of the ,office of ,management and ,budget4 7,i7 ,the ,postmaster ,general of the ,united ,states ,postal ,service4 7,j7 ,the ,national ,cyber ,director4 7,k7 ,the ,attorney ,general4 7,l7 ,the heads of other ,federal agencies or offices as the ,president may designate or invite1 as appropriate4 7#b7 ,state1 local1 ,tribal1 and territorial government representatives ,the ,director shall appoint to the ,task ,force #f ,state1 local1 ,tribal1 or territorial government officials who represent agencies that issue identity credentials and who have-- 7,a7 experience in identity technology and services2 7,b7 knowledge of the systems used to provide identity credentials2 or 7,c7 any other qualifications or competencies that may help achieve balance or otherwise support the mission of the ,task ,force4 7#c7 ,nongovernmental experts 7,a7 ,in general ,the ,director shall appoint to the ,task ,force #e nongovernmental experts4 7,b7 ,specific appointments ,the experts appointed under subparagraph 7,a7 shall include the following3 7i7 ,a member who is a privacy and civil liberties expert4 7ii7 ,a member who is a technical expert in identity verification4 7iii7 ,a member who is a technical expert in cybersecurity focusing on identity verification services4 7iv7 ,a member who represents the identity verification services industry4 7v7 ,a member who represents a party that relies on effective identity verification services to conduct business4 7e7 ,working groups ,the ,director shall organize the members of the ,task ,force into appropriate working groups for the purpose of increasing the efficiency and effectiveness of the ,task ,force1 as appropriate4 7f7 ,meetings ,the ,task ,force shall-- 7#a7 convene at the call of the ,director2 and 7#b7 provide an opportunity for public comment in accordance with section #ajji7;a77#c7 of title #e1 ,united ,states ,code4 7g7 ,duties ,in carrying out the purpose described in subsection 7b71 the ,task ,force shall-- 7#a7 identify ,federal1 ,state1 local1 ,tribal1 and territorial agencies that issue identity credentials or hold information relating to identifying an individual2 7#b7 assess restrictions with respect to the abilities of the agencies described in paragraph 7#a7 to verify identity information for other agencies and nongovernmental organizations2 7#c7 assess any necessary changes in statutes1 regulations1 or policy to address any restrictions assessed under paragraph 7#b72 7#d7 recommend a strategy1 based on existing standards1 to enable agencies to provide services relating to digital identity verification in a way that-- 7,a7 is secure1 protects privacy1 and protects individuals against unfair and misleading practices2 7,b7 prioritizes equity and accessibility2 7,c7 requires individual consent for the provision of digital identify verification services by a ,federal1 ,state1 local1 ,tribal1 or territorial agency2 7,d7 is interoperable among participating ,federal1 ,state1 local1 ,tribal1 and territorial agencies1 as appropriate and in accordance with applicable laws2 and 7,e7 prioritizes technical standards developed by voluntary consensus standards bodies in accordance with section #ab7;d7 of the ,national ,technology ,transfer and ,advancement ,act of #aiie 7#ae ,u4,s4,c4 #bgb note7 and guidance under ,,omb ,circular ,a-#aai1 entitled ,federal ,participation in the ,development and ,use of ,voluntary ,consensus ,standards and in ,conformity ,assessment ,activities1 or any successor thereto2 7#e7 recommend principles to promote policies for shared identity proofing across public sector agencies1 which may include single sign-on or broadly accepted attestations2 7#f7 identify funding or other resources needed to support the agencies described in paragraph 7#d7 that provide digital identity verification1 including recommendations with respect to the need for and the design of a ,federal grant program to implement the recommendations of the ,task ,force and facilitate the development and upgrade of ,state1 local1 ,tribal1 and territorial highly secure interoperable systems that enable digital identity verification2 7#g7 recommend funding models to provide digital identity verification to private sector entities1 which may include fee-based funding models2 7#h7 determine if any additional steps are necessary with respect to ,federal1 ,state1 local1 ,tribal1 and territorial agencies to improve digital identity verification and management processes for the purpose of enhancing the security1 reliability1 privacy1 accessibility1 equity1 and convenience of digital identity solutions that support and protect transactions between individuals1 government entities1 and businesses2 and 7#i7 undertake other activities necessary to assess and address other matters relating to digital identity verification1 including with respect to-- 7,a7 the potential exploitation of digital identity tools or associated products and services by malign actors2 7,b7 privacy implications2 and 7,c7 increasing access to foundational identity documents4 7h7 ,prohibition ,the ,task ,force may not implicitly or explicitly recommend the creation of-- 7#a7 a single identity credential provided or mandated by the ,federal ,government for the purposes of verifying identity or associated attributes2 7#b7 a unilateral central national identification registry relating to digital identity verification2 or 7#c7 a requirement that any individual be forced to use digital identity verification for a given public purpose4 7i7 ,required consultation ,the ,task ,force shall closely consult with leaders of ,federal1 ,state1 local1 ,tribal1 and territorial governments and nongovernmental leaders1 which shall include the following3 7#a7 ,the ,secretary of ,education4 7#b7 ,the heads of other ,federal agencies and offices determined appropriate by the ,director4 7#c7 ,state1 local1 ,tribal1 and territorial government officials focused on identity1 such as information technology officials and directors of ,state departments of motor vehicles and vital records bureaus4 7#d7 ,digital privacy experts4 7#e7 ,civil liberties experts4 7#f7 ,technology and cybersecurity experts4 7#g7 ,users of identity verification services4 7#h7 ,representatives with relevant expertise from academia and advocacy organizations4 7#i7 ,industry representatives with experience implementing digital identity systems4 7#aj7 ,identity theft and fraud prevention experts1 including advocates for victims of identity theft and fraud4 7j7 ,reports 7#a7 ,initial report ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall submit to the appropriate notification entities a report on the activities of the ,task ,force1 including-- 7,a7 recommendations on-- 7i7 implementing the strategy pursuant to subsection 7g77#d72 and 7ii7 methods to leverage digital driver's licenses1 distributed ledger technology1 and other technologies2 and 7,b7 summaries of the input and recommendations of the leaders consulted under subsection 7i74 7#b7 ,interim reports 7,a7 ,in general ,the ,director may submit to the appropriate notification entities interim reports the ,director determines necessary to support the work of the ,task ,force and educate the public4 7,b7 ,mandatory report ,not later than the date that is #ah months after the date of enactment of this ,act1 the ,director shall submit to the appropriate notification entities an interim report addressing-- 7i7 the matters described in paragraphs 7#a71 7#b71 7#d71 and 7#f7 of subsection 7g72 and 7ii7 any other matters the ,director determines necessary to support the work of the ,task ,force and educate the public4 7#c7 ,final report ,not later than #ahj days before the date described in subsection 7k71 the ,director shall submit to the appropriate notification entities a final report that includes recommendations for the ,president and ,congress relating to any relevant matter within the scope of the duties of the ,task ,force4 7#d7 ,public availability ,the ,task ,force shall make the reports required under this subsection publicly available on a centralized website as an open ,government data asset 7as defined in section #cejb of title #dd1 ,united ,states ,code74 7k7 ,sunset ,the ,task ,force shall conclude business on the date that is #c years after the date of enactment of this ,act4 #e4 ,security enhancements to ,federal systems 7a7 ,guidance for ,federal agencies ,not later than #ahj days after the date on which the ,director submits the report required under section #d7;j77#a71 the ,director of the ,office of ,management and ,budget shall issue guidance to ,federal agencies for the purpose of implementing any recommendations included in such report determined appropriate by the ,director of the ,office of ,management and ,budget4 7b7 ,reports on ,federal agency progress improving digital identity verification capabilities 7#a7 ,annual report on guidance implementation ,not later than #a year after the date of the issuance of guidance under subsection 7a71 and annually thereafter1 the head of each ,federal agency shall submit to the ,director of the ,office of ,management and ,budget a report on the efforts of the ,federal agency to implement that guidance4 7#b7 ,public report 7,a7 ,in general ,not later than #de days after the date of the issuance of guidance under subsection 7a71 and annually thereafter1 the ,director shall develop and make publicly available a report that includes-- 7i7 a list of digital identity verification services offered by ,federal agencies2 7ii7 the volume of digital identity verifications performed by each ,federal agency2 7iii7 information relating to the effectiveness of digital identity verification services by ,federal agencies2 and 7iv7 recommendations to improve the effectiveness of digital identity verification services by ,federal agencies4 7,b7 ,consultation ,in developing the first report required under subparagraph 7,a71 the ,director shall consult the ,task ,force4 7#c7 ,congressional report on ,federal agency digital identity capabilities 7,a7 ,reform ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,office of ,management and ,budget1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,accountability of the ,house of ,representatives a report relating to the implementation and effectiveness of the digital identity capabilities of ,federal agencies4 7,b7 ,consultation ,in developing the report required under subparagraph 7,a71 the ,director of the ,office of ,management and ,budget shall-- 7i7 consult with the ,task ,force2 and 7ii7 to the greatest extent practicable1 include in the report recommendations of the ,task ,force4 7,c7 ,contents of report ,the report required under subparagraph 7,a7 shall include-- 7i7 an analysis1 including metrics and milestones1 for the implementation by ,federal agencies of-- 7,i7 the guidelines published by the ,national ,institute of ,standards and ,technology in the document entitled ,special ,publication #hjj-fc 7commonly referred to as the ,digital ,identity ,guidelines71 or any successor document2 and 7,,ii7 if feasible1 any additional requirements relating to enhancing digital identity capabilities identified in the document of the ,office of ,management and ,budget entitled ,m-#ai-ag and issued on ,may #ba1 #bjai1 or any successor document2 7ii7 a review of measures taken to advance the equity1 accessibility1 cybersecurity1 and privacy of digital identity verification services offered by ,federal agencies2 and 7iii7 any other relevant data1 information1 or plans for ,federal agencies to improve the digital identity capabilities of ,federal agencies4 7c7 ,additional reports ,on the first ,march #a occurring after the date described in subsection 7b77#c77;,a71 and annually thereafter1 the ,director of the ,office of ,management and ,budget1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall include in the report required under section #ceec7;c7 of title #dd1 ,united ,states ,code-- 7#a7 any additional and ongoing reporting on the matters described in subsection 7b77#c77;,c72 and 7#b7 associated information collection mechanisms4 #f4 ,,gao report 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to ,congress a report on the estimated potential savings1 including estimated annual potential savings1 due to the increased adoption and widespread use of digital identification1 of-- 7#a7 the ,federal ,government from averted fraud1 including benefit fraud2 and 7#b7 the economy of the ,united ,states and consumers from averted identity theft4 7b7 ,contents ,among other variables the ,comptroller ,general of the ,united ,states determines relevant1 the report required under subsection 7a7 shall include multiple scenarios with varying uptake rates to demonstrate a range of possible outcomes4