The federal watchdog said the General Services Administration has improved its identity-verification platform but still lacks firm deadlines for resolving technical problems reported by participating agencies.
By yourNEWS Media Newsroom.
The General Services Administration must establish clearer plans and deadlines for correcting unresolved problems with Login.gov or risk leaving federal agencies vulnerable to identity theft, fraud and continued technical disruptions, according to a new Government Accountability Office review.
Login.gov is the federal government’s centralized identity-verification service, allowing members of the public to use a single secure account when accessing participating government websites, benefits and services.
The platform is intended to confirm users’ identities while limiting the exposure of personally identifiable information, including Social Security numbers, driver’s license details and other sensitive records.
In its report, “GSA Needs to Address Fraud Threats and Technical Issues,” GAO found that the agency has made progress on most previously identified shortcomings but has not fully addressed concerns involving fraud prevention, remote identity verification and agency-reported technical problems.
The remaining weaknesses are particularly significant as cyberattacks and data breaches make stolen personal information increasingly available to criminals seeking access to federal programs, financial accounts and government payments.
“The proliferation of cyberattacks on federal agencies and other organizations has led to an increased risk of stolen personally identifiable information (PII) being used to commit fraud,” GAO wrote.
According to a Just the News report on the findings, stolen credentials have been used to obtain government benefits fraudulently, redirect Social Security payments and open accounts using another person’s identity.
GAO said those schemes can produce consequences extending beyond the immediate loss of money.
“In this type of fraud, thieves use identifying data, such as Social Security numbers and driver’s license numbers, to open new financial accounts without a person’s knowledge,” the report stated. “These types of attacks can result in financial loss and damage to the reputation of federal agencies and financial institutions.”
“Protecting PII and preventing identity theft is critical, as the harms can range from lost funds to emotional distress,” GAO added.
The watchdog examined whether Login.gov regularly backs up user information, complies with federal digital-identity requirements, responds effectively to technical complaints and documents lessons learned through its pilot programs.
Congress provided approximately $187 million from the Technology Modernization Fund in 2021 to expand the service. The funding was intended to improve security, strengthen protections against fraud and make the platform easier for federal agencies to adopt.
GSA has resolved most of the issues previously raised by GAO, according to the latest review.
However, testing remains underway on Login.gov’s procedures for backing up user data and on whether its remote identity-proofing system fully complies with federal digital-identity guidance.
GAO also found that GSA has not completed a central recommendation involving how quickly technical problems should be addressed.
“Specifically, GSA has not established timeframes with its partners for addressing agency-reported technical challenges,” the report stated.
“Without GSA-proposed actions and timeframes for addressing the challenges, agencies will continue to experience technical issues with the system.”
The absence of defined deadlines means participating agencies may not know when recurring problems will be corrected or what steps GSA intends to take to prevent them from affecting users.
Because Login.gov serves multiple federal departments and programs, weaknesses in the system can extend across government rather than remaining confined to a single agency.
Technical failures may prevent legitimate users from accessing services, while weaknesses in identity proofing could make it easier for criminals using stolen information to impersonate victims.
GAO said full implementation of its remaining recommendation “would help the federal government ensure PII is better protected and lessen the risk of identity theft.”
The report did not conclude that Login.gov is broadly unsafe or that GSA has failed to make improvements. Instead, it found that unresolved operational and fraud-related concerns require additional action before the government can be confident that the platform is meeting its security objectives.
GAO said it will continue monitoring the agency’s response and tracking whether GSA creates enforceable timelines for resolving technical problems.
The findings place renewed attention on Login.gov’s growing role as a gateway to federal services. As additional agencies adopt the platform, its ability to verify identities accurately, protect sensitive information and respond quickly to technical failures will become increasingly important to preventing government-wide fraud.
Original article
Comments