1. Exchanging Data with Federal Agencies A Challenge and an Opportunity Jim Farmer and Justin Tilton instructional media + magic, inc. As presented to the Board of Trustees Corporation for Research and Educational Networking Thursday · February 21, 2002 · Washington, DC i n s t r u c t i o n a l m e d i a + m a g i c, i n c.

2. Mandates and Opportunities

3. instructional media + magic The federal mandates Immigration and Naturalization Service SEVIS Student and Exchange Visitor Information System, on or after January 1, 2003 Department of Education COD Common Origination and Disbursements February 2003 (pilot begins March 7, 2002) Department of Veterans Affairs VACert Certificates of attendance sometime 2003

4. instructional media + magic and usable for Internal Revenue Service National Science Foundation National Institutes of Health eAuthentication is coming to allfederal agencies Note:

5. instructional media + magic What is SEVIS? “Student and Visitor Exchange Visitor,” Immigration and Naturalization Service, Dec 18, 2001, Washington, DC

6. instructional media + magic The SEVIS History (1 of 2) Sept. 1996 Public Law 104-208, the Illegal Immigration Reform and Immigrant Responsibility Act (IIRIRA) of 1996, enacted. Dec. 1996 Task force vision concept approved by INS Commissioner. June 1997 CIPRIS (Coordinated Interagency Program Regulating International Students) pilot project began. Oct. 1999 Pilot ends. CIPRIS continues as an operational prototype at the Atlanta Hartsfield airport and district office, Texas service center, 21 educational institutions, and DOS headquarters.

7. instructional media + magic The SEVIS History (2 or 2) Jul 2001 CIPRIS renamed SEVIS project Aug.-Sept. 2001 SEVIS Vendor Conferences Sept. 11, 2001 World Trade Center attacks, student suspected Oct. 2001 SEVIS test training in Boston Oct. 2001 Public Law 107-56, the USA PATRIOT Act, enacted. “Student and Visitor Exchange Visitor,” Immigration and Naturalization Service, Dec 18, 2001, Washington, DC

8. instructional media + magic I.N.S. Model: Manual Data Entry HTTPS Login / Password University I.N.S. Scenario User: DSO Data Provider: SEVIS SIS SEVIS DSO

9. instructional media + magic I.N.S. Model: Batch File Interface HTTPS ACES Digital Signature [ Proprietary Data Transport] University I.N.S. Scenario User: DSO Data Provider: SEVIS SIS SEVISDSOWeb Server

10. instructional media + magic JA-SIG Web Services Model HTTPS SOAP Business Message HTTPS SOAP Business Message University I.N.S. Scenario User: DSO Access Provider: College Portal Data Provider: SEVIS SIS Portal SEVIS DSO

11. instructional media + magic Legislative compliance timeline GPEA E-SIGN Signed 10/21/98 Signed 06/30/00 Effective 10/01/00 Record retention requirements 6/01/01 Effective for FFEL, Perkins and Direct Loan 06/30/01 Effective 10/21/03

12. instructional media + magic QuickSilver initiatives Mark Forman, “E-Government Action Plan: Implementing the QuickSilver Task Force Results,” October 24, 2001

13. instructional media + magic e-Authentication John Sindelar, “Achieving the Vision of E- Government,” Nov 27, 2001

14. instructional media + magic e-Authentication E-Government Strategy: Solutions to Key Barriers Incorporate PKI Establish Secure transactions and Identity Authentication through GSA eAuthentication project [all eGov will use] Incorporate privacy protections into each business plan Engage in public promotion Mark Forman,Associate Director, IT and E-Government OMB, “The Value of PKI in Achieving the Vision of E-Government,” November 29, 2001

15. instructional media + magic Role of Public Key Infrastructure PKI is a facilitator of unifying islands of automation PKI is not the answer for all applications but for specific applications it can add the required authentication necessary for a trustworthy e-gov environment. eAuthentication initiative managed by GSA will organize authentication work for our critical lines of business Mark Forman,Associate Director, IT and E-Government OMB, “The Value of PKI in Achieving the Vision of E-Government,” November 29, 2001

16. instructional media + magic Convergence: Authentication December 2000June 2002March 2001 SFA [NCS Proprietary] SAML [Oasis] S2ML [Netegrity] AuthML [Securant] XTASS [VeriSign] Internet 2 [Shibboleth]

17. instructional media + magic Number of foreign students U.S. Department of State, Oct 31, 2001 US Total California New York Texas Massachusetts Illinois Pennsylvania 547,687 74,281 58,286 37,735 29,395 24,234 22,279

18. instructional media + magic School data exchanges Technology estimates based on participation in professional events. Data from Digest of Education Statistics 2001, NCES, 2001 Omits 5,437 non-degree granting schools. TierSchoolsEnrollment Federal Aid Recipients per Implementation 12341234 60 566 1,260 2,027 3,913 1,200,000 8,100,000 4,600,000 1,400,000 15,300,000 8,900 6,500 1,700 300

19. instructional media + magic Model for school data exchanges Tiers from Ken Weiner, JA-SIG, Sep 2001 Tier Information Resources Technology Skills Data Exchange 12341234 Yes Web only No Yes No G2U real-time G2U batch (via SIS products) Servicers Servicers SFA portal Agency portal

20. Mandates and Opportunities

21. instructional media + magic PKI is an economic issue Time Unit Cost Number of Users Today

22. instructional media + magic The business strategy Identify applications that: Require digital certificates Are mandated or needed by a large number of colleges and universities [e.g. market share] Provide service or cost benefits for all parties Also known as “killer applications”

23. instructional media + magic Priority applications Support of SEVIS batch interface using INS provided software and developed software for sponsor/college data exchange Support of student/staff access to SFA financial aid data Support exchange of academic records California, Florida, and Texas In conjunction with JA-SIGs uPortal to gain immediate “critical mass” and branded training

24. instructional media + magic Proposed phases 1. Planning and coordination Coordinate with federal agencies and the Office of Management and Budget and software providers and higher education associations Determine requirements based on information from the U.S. Department of State and National Association of Foreign Student Advisors Prepare a plan with schedule and estimated costs Review the plan with CREN and subsequently with a CREN-invited review panel CREN approval

25. instructional media + magic Proposed phases 2. Training and Implementation Develop training modules on CREN technology as used for SEVIS and ED pilot. Offer regional training seminars Offer training sessions at NAFSA and NASFAA regional and national conferences

26. instructional media + magic Proposed phases 3. Software development options CREN connectors for JA-SIG’s uPortal, general Web components Digital signature validation (SAML exchange) Local authentication assertions SEVIS Sponsor/school data exchange And optionally in conjunction with other projects Academic record exchanges Financial aid information access (ED/SFA or NCHELP) Library Services and Digital Libraries

27. instructional media + magic CREN Options Request INS, ED, VA honor CREN certificates Request and demonstrate prototypes Request, demonstrate, train using CREN certificates Request, demonstrate, train, and provide SEVIS components Request, demonstrate, train, provide SEVIS components, and distribute additional applications

28. The end www.immagic.com

29. Information Technology Standards

30. instructional media + magic ebXML Security Persistent digital signatureW3C XMLDSIG Persistent signed receiptW3C XMLDSIG Non-persistent IETF TSL or IPSEC [one direction or bi-directional] Persistent confidentialityW3C/IETFC XML Encryption Non-persistent confidentialityIETF TLS or IPSEC Persistent authorizationOASIS SAML Non-persistent authorizationIETF TLS or IPSEC Trusted Timestampnot yet standardized [ebXML] “Message Service Specification,” version 2.0, OASIS, Jan 11, 2002

31. instructional media + magic Convergence: Data Transport September 2000AprilMarch SOAP [NCHELP ESC] SOAP [SFA] ebXML [PESC] “Simple SOAP” [Meteor]

32. instructional media + magic Convergence: Business Messages June 2000MayDecember CommonLine XML [ESC] LoanML [IFX] Common Record [SFA] CommonLine R5 [ESC]

33. The Federal Digital Signature Initiative General Services Administration

34. instructional media + magic The federal ACES initiative ACES will facilitate public access to services offered by government agencies through use of information technologies, including on- line access to computers for purposes of reviewing, retrieving, providing, and exchanging information utilizing e- commerce in a secure transaction environment through the use of certificates. By law, access to some government computer systems can be granted only when the agency is provided with assurance that the individual attempting access has been properly identified and authenticated. From: /fedcac.gsa.gov/aces.stm, Feb 10, 2001

35. instructional media + magic ACES federal digital signatures Five categories of Government to Public communications have been identified by OMB that could require this strong authentication Stan Choffrey, GSA/FTS, Dallas,Texas, May 25, 2000 Application and Transfer of Benefits Application and Administration of Grants Submission of Reporting or Filing Requirements Exchange of Personal/Private/Proprietary Information Procurement Actions

36. instructional media + magic Who Can Use the ACES PKI? Any citizen, business entity or governmental entity may apply for and be issued ACES certificates as subscribers. Therefore, non-federal entities may participate in ACES in two ways: As a subscriber to do business with the Federal Government, or As an authorized Relying Party when duly authorized by a Federal Agency for legitimate program purposes. David Temoshok Access America for Students Program Office of Federal Electronic Commerce General Services Administration April 12, 2000

37. instructional media + magic Who will have ACES certificates? Veterans who receive educational benefits Members of the Armed Forces Citizens participating in Department of Labor employment and training programs Many college and university applicantsand students will have federally-issuedACES certificates Note:

38. instructional media + magic State initiatives Illinois has become the first state to launch a comprehensive electronic government initiative. Over the next 18 months, we hope to distribute over a million digital I.D.s to citizens and businesses, to enable them to do business with the State as an integrated, secure, web-driven government. “2001 State of the State,” Governor George H. Ryan January 31, 2001

39. Electronic IDs

40. instructional media + magic E-Signature and promissory note Students, parents will choose whose e-signature to use SFA has no business incentive to share e-signature authentication Registration is expensive ($5 to $50); authentication is cheap ($0.005 to $0.04) Different levels of authentication for different purposes Paul Tone, Town Hall Meeting on E-Signature, Dec 14, 2000

41. instructional media + magic To make U2B work we need… From comments at the NIST Electronic Documents Conference, Mar 16, 2000 Resolution of [digital] signature requirements Beth Grossman, ACCORD Legal/ trust/ non- repudiation [of electronic ID]. PKI Betsy Fanning, AIIM [Defining] the relationship between PKI certificates and signed documents? Carol Jacobson

42. instructional media + magic E-Sign legislation To promote e-commerce in private sector Legal equivalence between paper and electronic documents for binding transactions Applies to private sector SFA transactions regulated by Federal and State government Government to specify standards to ensure accuracy, integrity, and accessibility of records Requires consent and protection of [student] consumer in electronic context Charles Coleman, “Town Hall on Electronic Identification,” Washington, DC, December 14, 2000

43. instructional media + magic Shared or “remote” authentication On December 14, 2000, SFA announced that they will support authentication of SFA-issued PINS and ACES electronic signatures. SFA PINs can be used—at a cost—for authenticating Title IV transactions. SFA plans to honor school, bank, and state agency electronic Ids offering comparable or higher levels of trust. “However, on January 29, 2001 SFA said they could notget agreement from the Social Security Administration topermit others using SFA’s PIN authentication system.” Justin E. Tilton, The Meteor Project Destin, Florida, Feb 5, 2001 Quote:

44. instructional media + magic Electronic identification  Single Sign On for Students and Financial Aid Professionals  Remote Authentication of Students  SFA Pin Via Proprietary Protocol  ACES Digital Certificates Via GSA  2002-2004 Plans  Shared Authentication Using SFA PINs, ACES Certificates, School PINs, Bank PINs and Certificates Town Hall Meeting on Electronic Identification December 14, 2000

45. instructional media + magic Digital signature services The State of Illinois Public Key Infrastructure project (PKI) provides an enterprise-wide infrastructure to facilitate electronic government services. PKI utilizes public key cryptography and digital signatures, along with software to manage those certificates. Building these services into software applications provides the means to authenticate users, ensure privacy and integrity of data, and establish the audit trails needed to give electronic transactions the same or better levels of assurance that we are able to provide when we do business in paper. IL Technology, Oct 2000

46. instructional media + magic The Illinois Act protects consumers takes into account … lack of sophistication and technical capabilities of consumers; provides criminal penalties for forgery of digital and electronic signatures a signature cannot be automatically attributed to a person unless it meets certain stringent qualifications a secure signature cannot be attributed to a consumer, even if he or she was negligent in compromising the means by which the signature was created, if the signature was not in fact made by the consumer. “Illinois Enacts Groundbreaking Electronic Commerce Legislation,” Mc Bridge, Baker and Coles, Chicago, Illinois, 1998

47. instructional media + magic SFA electronic identification Single Sign On for Students and Financial Aid Professionals Remote Authentication of Students SFA PIN via Proprietary Protocol ACES Digital Certificates via GSA 2002-2004 Plans Shared Authentication Using SFA PINs, ACES Certificates, School PINs, [State PINs], and Bank PINs and Certificates Town Hall Meeting on Electronic Identification December 14, 2000

48. instructional media + magic E-Signature and promissory note Students and parents will decide whose e- signature to use SFA has no business incentive to share e- signature authentication Registration is expensive ($5 to $50); authentication is cheap ($0.005 to $0.04) Different levels of authentication for different purposes Paul Tone Town Hall Meeting on Electronic Identification Dec 14, 2000 JA-SIG Portal, Meteor will support shared authentication using industry standards recommended to the Meteor Sponsors by Justin Tilton of The Meteor Project JA-SIG Conference, Feb 5, 2001

49. instructional media + magic Legal and policy standards Standards for E-Signature Digitized Signature Digital Certificate Digital Document Note Identifiers Personal Identification Number (PIN) Other Data Retention and Retrieval of Records Submission of Records to ED “E-Signature: Implications of the E-SIGN Legislation for Student Aid” Electronic Access Conference, Phoenix, AZ, Dec 11-12, 2000

50. instructional media + magic Questions and answers (lenders) Q. If a student refuses E- MPN, how will process work? A. E- Sign gives the student the option to choose. Students and lenders must mutually consent to go electronic. Paper options will be available. Q. Who has the legal responsibility to inform the student on rights and responsibilities? A. The lender, not the school. The same place as they reside today. Q. What can be done with SFA PIN vs. the school’s PIN? A. The responsibility of enforcement of the PINs certification would be the school’s if the school PIN is used. Questions and Answers from the Electronic Access Conferences Nov 2000, (documented after the conference)

51. instructional media + magic Questions and answers (schools) Q.Schools may want the ability to confirm the validity of a student’s SFA-PIN number. How can this be done by the school? A. Security issues would prevent the schools from getting the shared secret of the SFA- PIN. Authentication is best done by SFA. Q. Could a school’s PIN number be used for E- MPN signing? A. Yes, but all other standards must be adhered to (supporting documents,verification, security, etc.) Questions and Answers from the Electronic Access Conferences Nov 2000, (documented after the conference)

52. instructional media + magic Requirements for documentation 3B. A system should be in place to track password usage and changes. Recorded events and information should include: 1.user identifier 2.successful and unsuccessful log-ins 3.use of password changing procedures 4.user ID lock-out record 5.date 6.time 7.physical location Trustworthy Information Systems Handbook [Minnesota] State Archives Department Aug 2000, Sec 9, p. 12

53. instructional media + magic Requirements for documentation 3C. A system should be in place to log and track users and their online actions. Audit information might include: 1.details of log-in (date, time, physical location, etc.) 2.creation of files/records 3.accessed file/record identifiers and accompanying activity (deletion, modification, change of sensitivity/security level) 4.accessed device identifiers 5.software use 6.production of printed output 7.overriding of human-readable output markings 8.output to storage devices Trustworthy Information Systems Handbook [Minnesota] State Archives Department Aug 2000, Sec 9, p. 12

54. instructional media + magic Colleges and universities should… Implement the infrastructure for electronic identification including digital signatures Provide for remote authentication Provide a school portal with aggregation Develop the procedures for documenting user registration and maintenance of electronic identifiers Provide for a complying electronic record of e-commerce activity In a standard format for exchange