1. How Do You Establish Student Identity Remotely: A Survey Keith Hazelton, University of Wisconsin-Madison Ann West, Internet2/InCommon Federation 2010 Fall Internet2 Member Meeting – Atlanta, Georgia

2. Topics  Identity Proofing Redux  Survey Results  Process Discussions

3. What’s the Question? Recruit, admit, register, and award degrees to remote students But who are these people and how do you know they are who they say they are? No set of remote identity practices reviewed by key privacy and regulatory experts

4. Thesis Statement The process by which you link the physical person to his/her identity information and to his/her credential is critical. If this is done poorly, there is little or no assurance that the person using that credential to authenticate and access services and information is who you believe them to be. It could be anyone, or multiple people over time. If this linking is weak, even the most complete personal information and the strongest credential will not improve the assurance of identity.

5. Atomic Components Individual Identity Record Credential Identity Proofing Credentialing

6. The Actors  Identity Vetting is the process by which information about a person is gathered. Certain aspects are verified (like mail or email address).  Identity Proofing is the process by which the physical person is linked to his/her identity information.  Credentialing is the process where the user is linked to his/her credential (netid) and the credential is added to his/her identity record.  Authentication is verifying that the person seeking access to a resource is the one previously identified and approved. Proper authentication requires that the processes that precede it are not compromised.

7. ACCEPTED APPLICATION RECEIVED FIRST CONTACT MADE DEPOSIT PAID REGISTERED/O RIENTATION Admissions Registration Process Identity Management On-boarding Your Certainty Identity Vetting Identity Proofing Credentialing Identity Assured ✔ Third-party Info Received Financial Aid Info Received

10. ACCEPTED APPLICATION RECEIVED FIRST CONTACT MADE DEPOSIT PAID REGISTERED/O RIENTATION Admissions Registration Process Identity Management On-boarding Your Certainty Identity Vetting Identity Proofing Credentialing Identity Assured ✔ Third-party Info Received Financial Aid Info Received ACCEPTED APPLICATION RECEIVED FIRST CONTACT MADE DEPOSIT PAID REGISTERED/O RIENTATION

11. ACCEPTED APPLICATION RECEIVED DEPOSIT PAID REGISTERED/O RIENTATION Admissions Registration Process Identity Management On-boarding Your Certainty Identity Vetting Identity Proofing Credentialing Identity Assured ✔ Third-party Info Received Financial Aid Info Received FIRST CONTACT MADE ACCEPTED APPLICATION RECEIVED FIRST CONTACT MADE DEPOSIT PAID REGISTERED/O RIENTATION

12. Remote Proofing Survey  InCommon Federation and AACRAO  Survey of current practice  Focus on business process; not technology  Distance Education Audience  Degree-granting programs  Sent to 2,000 AACRAO Institutional Contacts  Preliminary results reflect 100 institutions

13. Q4: When do you first learn about prospective students?  22 Web queries  10 Email queries

14. Q 6: How do you establish an initial communications channel with the prospect? (Check all that apply.) Other -Facebook -N/A -In person

15. Q7: At what point is the first login credential chosen or assigned (e.g. email address, user id/password pair, etc.)?

16. Q8: For what purposes are this initial login credential used? (Check all that apply.)

17. Q10: If the initial login credential is assigned by a system, how do you communicate the credential to the remote person? (Check all that apply.)

18. Q15: At what point is supporting documentation about an individual received from external third parties (e.g., testing service, etc)? (Check all that apply.)

19. Q18: At what point do you perform primary identity proofing of the individual? (Definition)

20. Q19: Which business office is involved in doing the identity proofing of remote individuals? (Check all that apply.)

21. Q23: What document-related evidence do you require from the person to prove their physical identity and how is it sent to you?

22. Q24: What other methods do you use to prove the physical identity of the person? (Check all that apply.) Identify - Minister - Verisign - Exam Proctor - Principal -Transcripts - LMS Vendor -Pastor/Ment or -Background Checks

23. Q27: If changes were proposed to the identity proofing process for distance education students, who would be involved in the decision? (Check all that apply).

24. Random Comments  “When applying for financial aid, the FAFSA process has certain requirements and that is the documentation for most students. “  “Doing something beyond what we currently do would be extremely inconvenient for students and prospects. It would also be very labor intensive for staff. “  “My concern is access students allow parents, spouse and significant others without completing the proper consent to disclose forms for this access.”  “This information is extremely confidential, just as SS information is confidential. I am not sure anyone should look at this data except for key representatives within an assigned admission area….”

25. Preliminary Conclusions  1/3 not doing id proofing  2/3 say they are id proofing – but are they?

26. Ideas/Proposals: Off Campus In Person  Person submits an application and is accepted. There is third- party information on file.  Institution sends notary one-time password and identity information.  If subject provides convincing matching evidence to notary….  Subject is linked to identity record.  Notary hands sealed envelope with a one-time token/URL to the individual so he/she can claim the credential.  Subject is linked to the credential.

27. Ideas/Proposals: Third Party Information  By phone/website: Ask prospect knowledge-based questions on identity information obtained from third parties.  If they answer correctly, provide the subject with a one-time token/URL via email/mailing address in the identity record.  Subject is linked to the identity record.  Using an address in the identity record for delivery strengthens link between subject and identity record.  Subject is linked to credential.

28. Ideas/Proposals: And This One?  Person submits an application and is accepted. There is third-party information on file.  Application is self-asserted information.  Subject is not linked to third-party information.  Institution provides a one time token/URL to the subject to their email/mailing address on record.  Credential is linked to identity record.  Subject is not linked to identity record.

29. Resources  InCommon IAM Online – Remote Identity Proofing Webinar  http://internet2.na6.acrobat.com/p25014162 http://internet2.na6.acrobat.com/p25014162  InCommon Student Services Collaboration Group  https://spaces.internet2.edu/display/InCCollaborate /InC-Student https://spaces.internet2.edu/display/InCCollaborate /InC-Student

30.  Keith Hazelton, UW-Madison  hazelton@doit.wisc.edu  Ann West, Internet2/InCommon  awest@internet2.edu awest@internet2.edu Questions?