Identification Levels

So, just looking at the Good Practice Guide 45 levels in discrete sections, we have level 1, again where we’ve said that there is no identity checking or where we have at least one reference number that uniquely identifies the evidence to which it relates. Very low level of assurance. That doesn’t mean it’s bad or not fit for purpose. That just means we need to consider where we use level 1 identity proofing. Where we have a requirement for lower levels of identity proofing, this can be a valid approach. The barriers to this approach are very, very low. If we’re an organization making online transactions, or we want to engage with citizens, it may not matter too much who they are.

We may not be too interested in high levels of assurance. Level 2, we said, is the next step up in terms of the level of evidence and the level of assurance. Here we’re confirming an identity exists through the checking of some kind of link to unique reference number. So here we start to see that checks are taking place. Digital identity evidence is protected using cryptographic methods supporting integrity, that the information cannot be changed or has not been changed, and the authenticity of the claimed issuing source. The issued identity evidence includes a physical object that requires proprietary knowledge to reproduce. So again, here we’re starting to see a little bit stronger of, a little stronger requirements.

And the kind of examples we could see at this stage are our education qualifications, our certificates, or maybe a marriage certificate. For level 3, this includes the requirements of level 2, but, also, here we’re starting to look at financial identity checks, potentially. And, also, the personal name on the issued identity must now match the name of the claimed identity. So we want to make sure that the name of the claimant matches the name of the identity that is being claimed. Evidence that would allow us to confirm a level 3 identity would include things like a non-biometric passport, a mortgage account, a driving licence. I say non-biometric.

A biometric passport would confirm a level 3 identity, but, biometric passports, we’re talking about more at level 4. So it would exceed the requirements of level 3. So we’re looking for non-biometric evidence as a minimum. Ideally something that represents that individual as having a financial background, as having interacted in some way with the government. For level 4, we have those cumulative requirements from level 2 and 3, but also here we’re looking for some kind of photograph and image and also a biometric template of the claimed identity. And you’ll remember we said that the biometric template helps as part of the proofing process, but also helps to protect the identity in the future from falsification, potentially.

So here we see, as examples, our biometric passports. And there’s a particular standard they have to meet in order to be classed as level 4. That’s ICAO 9303. We’re also looking at things like national ID cards with biometric templates embedded, and both India and Indonesia have these in place already as good examples, Estonia as well.