When applying for a Dutch identity document, there is an obligation to appear in person. For Dutch citizens abroad, this means having to travel to an embassy, consulate, or external service provider. Replacing the physical appearance requirement with an 'online appearance' or another digital variant of the steps involved could eliminate the need for this (sometimes long) journey. This study explores to what extent the application and issuance process could be conducted digitally and remotely. We map the technical possibilities and risks related to online identity verification of Dutch citizens.
Research Questions
What are the technical and procedural possibilities and risks for governmental organisations in digital identity verification and validation remotely (without physical appearance)?
For applications where the applicant cannot provide a valid existing identity document, and therefore identity verification needs to take place (including first-time applications), a physical appearance is still essential. However, other parts of the process, such as submitting other documents, could be done digitally. For applications where a valid existing identity document is available, a substantial part should be able to take place online remotely.
The main limiting factor for fully digital and remote execution of this process is that remotely capturing biometrics (technically, with the required quality and reliability, at the current moment) is not feasible. Since biometric data collection 'remotely' occurs in an uncontrolled environment, there is fundamentally more room for manipulation compared to a physical appearance in a more controlled setting.
Advancements in trusted end-user devices allow for more technical assurances regarding the authenticity of collected biometrics, but these technologies are not yet mature and not widely available in end-user devices such as smartphones. Nonetheless, there are possibilities to structure the application process in a way that minimises the need for physical appearances, and/or makes the timing more flexible.
From a fraud perspective, it is expected that fraudsters will primarily exploit exceptional situations, and relatively less the weaknesses in the regular application process. Besides focusing on the reliability of the technical solutions 'remotely', attention should also be directed here.
What does the (risk) analysis mean for the passport application and issuance process by the Ministry of Foreign Affairs and by municipalities in the Netherlands?
Issuing an applied-for identity document currently often occurs via registered mail or through couriers (at the applicant's risk and expense) in cases where it is not expected for the applicant to physically appear. The courier verifies the identity of the recipient at the time of issuing a Dutch identity card.
Replacing the physical appearance during the application with a digital remote process is more complex. A process where biometrics are captured earlier has limited added value, given that the 'shelf life' of biometric information is hardly longer than the maximum validity period of an identity document. The findings of this study do not focus on efficiency but support the conclusion that it is better to wait until the technology matures before moving in this direction. Technological improvements in fingerprint scanners (especially 'touchless' sensors) could make this option more appealing in the future. Despite this, aging may limit the maximum validity period of previously captured biometrics due to the face being less 'stable' than fingerprints.
Additionally, limitations from regulations requiring one or two physical appearances for the application or issuance of specific identity documents exist, although there is some flexibility in this area (to varying degrees for passports versus identity cards), as long as the obligations regarding biometric data collection are met.
Conclusion
When digitalising processes for identity document applications (and possibly government processes in general), the highest efficiency and effectiveness are likely achieved by facilitating (only) the most common situations digitally. In general, digitalisation involves high initial costs and subsequently low variable costs, while non-digital processes have lower fixed costs and higher variable costs. Repeat applications for identity documents are the most common, making them the most obvious candidates for digitalisation.
For all other types of applications, to address exceptions and accommodate Dutch citizens who cannot or do not wish to use a digital application process, a non-digital route must remain available. Introducing a digital process does not replace non-digital service – it remains available for less digitally skilled applicants.
Recommendations
We recommend further research into the use of technical innovations in biometric data capture, especially touchless fingerprint sensors. Additionally, gaining insight into the reusability/validity of 'old' passport photos is desirable. Lastly, we believe it is useful to develop a business case to evaluate the effectiveness (costs versus benefits) of the above option further.
For more information, please refer to the
letter to parliament sent to the Second Chamber in the context of this study.