Haiti, Hurricane Katrina, and Identity Management

The tragedies of Haiti have me pulling up an article I wrote regarding identifying those affected by crisis. Originally published as part of the BearingPoint "IDM Insider" July, 2006

KATRINA AND IDENTITY MANAGEMENT

As documented by the Washington Post, over $1.4 Billion was provided in assistance to fraudulent Hurricane Katrina victims. While it is imperative to provide people with assistance as quickly as possible during a crisis, this must be balanced by assuring that support is properly disseminated among the true victims and proper oversight of taxpayer dollars are performed. Such control is needed because frequently the damage caused by malfeasance is far greater than the cost of implementation.

Through the use of common credentialing and identification techniques, much of the fraud that occurred during Hurricane Katrina could have been avoided. For example, debit cards issued to hurricane victims could have been activated only after individuals had passed an identity authentication and verification of ownership and occupancy process. The identity solutions should take care not to cause undo intrusion to the participants, but yet be complete enough to verify their identity and link with adjudication for assistance decisions. Such a solution would be upgraded from each deployment so that there would be consistent improvement between deployments.

Below is a list of common fraud scenarios identified by the GAO, and the corresponding IdM solutions that could be implemented to deter, identify and counteract such behavior.

• Fraud Committed: Use of different Social Security numbers for the same person - Identity Management Redress: Many social security validation programs exist and could be incorporated for validity of issuance and ownership as well as single use within the program. A more intricate program could compare biometric information for uniqueness of the registered individuals such as done through systems that incorporate 1:N matching.

• Fraud Committed: Identity theft of others, specifically those in prison - Identity Management Redress: Since the crisis was localized, each State could have provided a “qualification” list from their local DVMs as an initial method for address verification and acquiring a picture ID. Since state and federal prisoners’ data was stolen and used to apply for assistance, it is reasonable to check future crisis registrants against such data for exclusion.

• Fraud Committed: Addresses outside of assistance area, and bogus address used - Identity Management Redress: Combining a mapping software with location tabs to verify physical location of the damaged address would provide the needed geography and legitimacy assistance. Such software is easily found and integrated with, Google maps is an excellent example.

• Fraud Committed: Registrants not occupying provided address - Identity Management Redress: Address Verification System are commonly used for credit and finance applications that can be integrated as part of a verification system.