We’re Tracking the Future of Security

Tag: Digital Identity

  • Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia is considering its mGrađani digital identity application as a tool for electronic age verification while European institutions develop new online child-protection rules. The government says the application already supports a privacy-preserving way to confirm that a user is over 18.

    Age proof without full identity disclosure

    The Croatian Ministry of Justice, Public Administration and Digital Transformation said more than 204,000 citizens use mGrađani. Its age-verification function is designed to provide an eligibility result rather than disclose a person’s full identity record to an online service. That distinction can reduce unnecessary data exposure when a service only needs proof of age.

    The proposal is being discussed as Croatia prepares its position on the emerging EU KIDS Act framework. The final European rules and the technical role of national identity applications are still developing, so the announcement should not be read as a completed mandatory deployment.

    Implementation questions remain

    Age-verification systems need clear legal purpose, data-minimization controls, accessible alternatives and testing against exclusion or circumvention. Operators also need assurance that relying services cannot silently expand the information requested beyond the age claim. SectechMedia follows related identity architecture in its access control and identity channel.

    Sources

  • UNCTAD Evaluation Highlights Digital Identity Training for Small Island States

    UNCTAD Evaluation Highlights Digital Identity Training for Small Island States

    An independent evaluation published by the United Nations Conference on Trade and Development has assessed a three-year capacity-building program for small island developing states. The project used UNCTAD’s TrainForTrade model and covered digital identity for trade and development, legal aspects of e-commerce and digital-economy statistics.

    Training across dispersed jurisdictions

    The project ran from March 2022 through December 2025 and reached participants across Africa, the Caribbean and Asia-Pacific. According to the evaluation, 153 participants completed the digital-identity course, while the wider initiative reached 920 participants across 58 countries and territories. The assessment drew on document review, stakeholder interviews and a participant survey.

    Digital identity was treated as enabling infrastructure for secure digital trade and access to online services. The report also records practical constraints, including geography, resource limitations and remote data collection. Those limitations are relevant when translating training outcomes into national systems and policy.

    Implementation remains country-specific

    Capacity building does not by itself establish a trusted identity system. Governments still need legal authority, privacy safeguards, cybersecurity controls, inclusive enrollment and interoperable credentials suited to local conditions. The evaluation is useful as evidence about training delivery and institutional learning rather than as proof of a single technical architecture. SectechMedia follows related developments in its identity technology coverage.

    Sources

  • Ofcom Investigates Pornhub Device-Level Age Checks Under UK Online Safety Rules

    Ofcom Investigates Pornhub Device-Level Age Checks Under UK Online Safety Rules

    UK communications regulator Ofcom has opened a formal investigation into whether the age-assurance process used by Pornhub operator Aylo satisfies duties under the Online Safety Act. The inquiry focuses on a device-level approach that uses operating-system age signals rather than requiring a fresh identity or age check inside the service.

    Investigation focuses on effectiveness and due diligence

    Ofcom said it will examine whether the service uses highly effective age assurance and whether Aylo completed an adequate children’s access assessment. The regulator also raised the question of whether sufficient due diligence and testing took place before the process was introduced. Opening an investigation is not a finding of non-compliance, and Ofcom said it is not making a determination about Apple’s age-verification system itself.

    The technical distinction matters because a device-level signal may describe an account holder without proving who is using the device at a particular moment. Shared devices, known passcodes and household account practices can therefore affect the assurance provided by the overall workflow.

    Age assurance is a system-level control

    Organizations assessing age controls should document the signal source, binding between the signal and the current user, fallback methods, privacy boundaries and testing evidence. They should also record how exceptions and account recovery are handled, because those paths can weaken an otherwise strong primary check.

    The case is relevant to broader Access Control & Identity design: assurance depends on the full chain between enrollment, device, account and transaction. A vendor feature alone does not establish that the deployed service meets a regulatory or operational threshold.

    Sources

  • Kantara Becomes First Body Accredited for UK Digital ID Framework 1.0 Certification

    Kantara Becomes First Body Accredited for UK Digital ID Framework 1.0 Certification

    Kantara Initiative has become the first conformity assessment body accredited to certify digital identity providers against version 1.0 of the United Kingdom’s Digital Verification Services Trust Framework. The accreditation also covers the supplementary codes used for regulated right-to-work and right-to-rent checks.

    What the accreditation covers

    The DVS framework defines requirements for organizations that verify identity and attributes for digital services. Kantara’s role is to assess providers against those requirements and issue certification when the evidence supports compliance. The organization already performs conformity assessments against other identity and authentication specifications, including assurance criteria associated with NIST and OpenID.

    Framework version 1.0 took effect on September 1, 2026. Updated supplementary codes for right-to-work and right-to-rent checks were introduced at the same time, with certified-service requirements applying from October 1. Certification does not eliminate implementation risk, but it provides an independent assessment against a published rule set.

    Why independent assessment matters

    Digital identity services combine document checks, biometric comparison, fraud controls and data-governance decisions. A recognized assessment process gives relying organizations a clearer basis for evaluating whether a provider follows the applicable framework rather than relying solely on vendor claims.

    SectechMedia tracks the operational implications of identity assurance in its Access Control & Identity coverage. Buyers should still examine scope, exclusions, renewal conditions and incident-reporting responsibilities before treating a certification as sufficient for a specific deployment.

    Sources

  • Login.gov Adds Mobile Driver’s Licenses for Remote Identity Verification

    Login.gov Adds Mobile Driver’s Licenses for Remote Identity Verification

    Login.gov has begun accepting eligible mobile driver’s licenses and state IDs stored in supported digital wallets for remote identity verification. The federal identity platform currently lists Google Wallet and Samsung Wallet among the supported options, with availability depending on the issuing state, device and wallet.

    A cryptographically verifiable credential path

    The mobile credential option gives users an alternative to photographing a physical identity document. Login.gov’s official help guidance lists mobile driver’s licenses alongside physical state IDs and U.S. passport books and cards. The service says additional wallet support is planned, while users whose state or device is not eligible can continue with another accepted document type.

    Reporting published on September 23 says the digital credential can be authenticated cryptographically, helping the service verify that the credential has not been altered. That is relevant as identity-proofing systems face counterfeit documents, synthetic media and AI-assisted impersonation attempts. The option is voluntary and is used for identity proofing rather than as a general-purpose replacement for every physical ID use case.

    Deployment questions remain important

    Support for a mobile credential depends on the full trust chain: the issuer, wallet, device, verification service and relying government agency. Programs adopting similar technology should define fallback processes, data minimization, user consent and recovery when a device is lost or replaced. SectechMedia covers related design and procurement questions in its access control and identity channel.

    Sources

  • ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    The Age Check Certification Scheme has published ACCS 1:2026, a set of conformity-assessment requirements linked to ISO/IEC 27566-1, the framework for age-assurance systems. The organization says the document is intended to help conformity-assessment bodies prepare for accreditation and certification work covering age verification, estimation and inference services.

    From a framework to assessable controls

    Age-assurance standards describe objectives and system characteristics, but certification also requires a repeatable method for evaluating whether an implementation meets those expectations. ACCS says the new requirements work with its general scheme rules and have been reviewed by the United Kingdom Accreditation Service for suitability in an accreditation process.

    The development comes as regulators and service providers face growing demand for age checks in online environments. Relevant systems can use identity documents, biometrics, account information or other signals, and each method introduces different privacy, security, accessibility and error-handling considerations. A conformity-assessment scheme does not eliminate those trade-offs, but it can give buyers a structured basis for reviewing claims and audit evidence.

    What buyers should verify

    Organizations evaluating age-assurance services should confirm the exact scope of any certification, the version of the referenced standard and whether the assessment covers the deployed configuration rather than only a generic product. They should also examine data minimization, retention, appeal procedures and performance across the intended user population. Marketing language should not be treated as a substitute for a certificate and its scope statement. SectechMedia monitors related requirements through its Standards Watch coverage.

    Sources

  • MojeID Adds Post-Quantum Protection to Digital Identity Logins

    MojeID Adds Post-Quantum Protection to Digital Identity Logins

    Czech digital identity service MojeID has introduced post-quantum cryptography protections for encrypted server communications and login confirmation in its mobile application. The change is intended to prepare authentication services for a future in which sufficiently capable quantum computers could undermine widely used public-key algorithms.

    Protection at the transport and login layers

    According to reporting published September 21, MojeID has enabled a post-quantum key-exchange option for connections to its servers. The MojeID Klíč mobile application has also added post-quantum algorithms for identity-confirmation operations in version 16.0.0. The application was developed with security technology company Wultra.

    New users receive the updated protection automatically. Existing users can update cryptographic keys through the application’s settings, with authorization by PIN or supported biometric confirmation. MojeID says further stages of its quantum-safe identity roadmap will be discussed in October. The implementation does not mean every component of the identity ecosystem has completed a post-quantum migration; it is one step in a broader transition that also involves protocols, certificates, devices and relying services.

    Operational considerations for identity teams

    Post-quantum migration should be treated as an inventory and lifecycle-management program rather than a single algorithm replacement. Organizations need to identify where cryptographic dependencies exist, determine which components can support hybrid or post-quantum mechanisms and plan key rotation without locking out users. Authentication recovery and device replacement procedures remain important because stronger cryptography does not remove account-recovery risk. SectechMedia follows related developments in cyber-physical security and identity infrastructure.

    Sources

  • DHS Expands RIVR Tests to Deepfakes and AI-Generated Identity Documents

    DHS Expands RIVR Tests to Deepfakes and AI-Generated Identity Documents

    The U.S. Department of Homeland Security is expanding its Remote Identity Validation Rally to test how commercial identity-verification systems respond to AI-generated documents and biometric deepfakes. DHS Science and Technology announced the 2026 program on September 21, adding a dedicated deepfake-detection track alongside broader document-validation and presentation-attack testing.

    What the expanded evaluation covers

    The program is designed to examine technologies used in remote onboarding, where a person submits an identity document and a selfie or video rather than appearing at a service counter. DHS says the new evaluation will include synthetic or altered documents, face-swap video and other impersonation techniques that can be used during video calls or teleconferencing. Applications for document-validation and selfie-to-document systems are scheduled to open in October, followed by presentation-attack and deepfake-detection submissions in December.

    DHS also plans to request real-world deepfake samples and information about attack methods from organizations able to contribute threat data. That material is intended to strengthen the test dataset and make evaluations more representative of current fraud techniques. The agency has not yet published the full technical protocol, so details such as how digital injection attacks will be separated from camera-presented attacks remain open.

    Why it matters for identity programs

    Government-run comparative testing can help buyers understand where products perform consistently and where results vary by device, document or attack type. Earlier RIVR testing found substantial differences among document-validation and liveness systems. The expanded work also reflects the direction of NIST identity-proofing guidance, which calls for controls against forged media and digital injection. Organizations reviewing remote access and onboarding technology should therefore assess fraud resistance together with usability, privacy and operational fallback processes. SectechMedia tracks related developments in access control and identity technology.

    Sources

  • Malaysia Opens Applications for New MyKad With Restricted Biometric QR Verification

    Malaysia Opens Applications for New MyKad With Restricted Biometric QR Verification

    Malaysia has opened applications for a new generation of its MyKad national identity card. The updated credential includes a QR-based verification mechanism and is designed to support live facial matching against National Registration Department records when authorized equipment is used.

    The department has stressed that the QR code is restricted to authorized enforcement use, cannot be read by an ordinary smartphone camera and is not currently intended for payments. That clarification narrows broader claims by supplier NexG about possible future commercial verification and optional wallet functions. Those additional capabilities have not been announced as active government services.

    Reporting by Malay Mail says the card includes 53 security features that will be introduced progressively. The new design removes the Touch ‘n Go function included in the previous card, directing users to a separate card or wallet instead. Enrollment and verification governance will determine how consistently those controls operate.

    Why it matters

    The rollout shows how physical identity documents are becoming gateways to digital verification while still retaining strict control over who may read protected data. Clear separation between deployed functions and supplier roadmaps is essential when evaluating identity and access-control systems.

    Sources

  • Indonesia Says IKD Digital ID Has Passed 20.5 Million Users

    Indonesia Says IKD Digital ID Has Passed 20.5 Million Users

    Indonesia’s Directorate General of Population and Civil Registration says 20,598,478 residents had activated Identitas Kependudukan Digital, or IKD, by the first half of 2026. The authority presented the figure alongside broader electronic identity registration data.

    The official account describes IKD as a gateway to multiple public services rather than only a digital copy of a physical identity card. Biometric Update separately reported the figures and noted continuing barriers involving connectivity, smartphone access and digital literacy.

    Adoption counts show reach, not security performance. They do not on their own demonstrate fraud resistance, service availability or equitable access, and those outcomes need separate operational evidence.

    Why it matters

    National digital identity becomes critical infrastructure as more services depend on it. Growth should be matched by resilient enrollment, secure account recovery, accessible alternatives and clear governance for verification data shared across agencies.

    For wider context, see SectechMedia’s related technical coverage.

    Sources