Business
NIST Certification explained
Many companies in the identity space talk of NIST certification. What does this mean for you as a user of identity services and what does it mean for your customers? Who is NIST? NIST is the National Institute of Standards and Technology (NIST), a non-regulatory agency of the United States Department of Commerce. NIST’s remit is to create and certify measures, standards and technology to enhance trade and productivity. Formed in 1901, their remit is to provide standards and certification for business. At first this included clocks and thermometers, all kinds of ‘weights and measures’. But over time the agency has grown to include tech, such as election technology and, of interest to us, cybersecurity. What is NIST compliance? Broadly, NIST certification means the product in question meets defined standards. Liveness is an anti-spoofing process that checks to ensure we are dealing with a real person. Not someone who is, for example, wearing a mask or using a photo or image of someone else. We use it across our suite of solutions including identity verification, digital ID and age verification. What does NIST certified liveness mean? NIST provides a framework for testing performance levels of liveness. NIST Level 1 involves testing using things that could be found in a normal home or office. Materials used for testing should not cost more than $30. Masks are excluded. To pass NIST Level 1, you must detect every attack and limit false negatives to less than 15%. NIST Level 2. Involves testing against more specialist attacks, such as latex facemasks or 3D printers. Materials used for testing should not cost more than $300.To pass NIST Level 2, the you must detect 99% of attacks and limit false negatives to less than 15%. Once a liveness service has passed testing, they will be issued with a Presentation Attack Detection (PAD) Confirmation letter that provides results and methodology used and what product was tested. To learn more about our liveness products, please do get in touch.
Digital identity verification for DBS checks
The Disclosure and Barring Service (DBS) has updated its guidance on how to check someone’s identity for a criminal record check. Previously, the process was only possible by seeing physical documents. During the pandemic, employers enjoyed relaxed rules which allowed them to do this via video call. However, the government has now updated their guidance to allow for digital ID verification technology. This means candidates can prove their identity online, which is an absolute game changer for employers grappling with a remote-first world. But how does the process work and should you use it? Here’s our guide to digital ID for DBS checks. What is a DBS check? A DBS check allows employers to see any criminal convictions a candidate may have on record. In some jobs, this is a legal requirement, particularly when working with vulnerable people, such as in healthcare or childcare. The check itself is processed by the Disclosure and Barring Service (DBS) and was previously called a CRB check. There are four types of DBS checks: Basic: shows unspent convictions and conditional cautions Standard: shows spent and unspent convictions and cautions Enhanced: shows the same as a standard check plus any information held by local police that’s considered relevant to the role Enhanced with barred lists: shows the same as an enhanced check plus whether the applicant is on the list of people barred from doing the role Anyone can request a Basic DBS check on themselves directly through the government website. Employers that want to request a Basic DBS check on an employee must use a ‘responsible organisation’ (RO), which is a company registered with the DBS to submit checks. To request a Standard or Enhanced DBS check on an employee, employers must use a company known as an ‘umbrella body’. Employers that process over 100 checks a year can also choose to register with DBS. Verifying identity for DBS Before a DBS check can be processed, you first need to confirm the identity of the person being checked. Until this year, this relied on seeing original documents. However, the new guidelines now allow employers to collect and verify documents digitally. For candidates, this is as simple as submitting their documents and a selfie online. The verification process is mostly automated and uses facial matching to compare a selfie to an ID document. In addition, checks are done to make sure the image is of a real person and that the document is genuine. In addition, further checks are often completed to reach the correct level of confidence under GPG45 as required by DBS, such as a check against data held by credit reference agencies. Employers don’t have to use digital identity verification but if they do, it must be undertaken by a certified identity service provider (IDSP). Make sure you check with your chosen DBS provider if they accept digital identity checks. GPG45 for DBS When done digitally, the identity checking process must follow the government’s Good Practice Guide (GPG)45. This involves gathering evidence that supports someone’s identity and is split in five parts: Get evidence of the claimed identity Check the evidence is genuine or valid Check the claimed identity has existed over time Check if the claimed identity is at high risk of identity fraud Check that the identity belongs to the person who’s claiming it Each step in this process is scored and combined to reach a level of confidence. There are four levels of confidence: low, medium, high and very high. The levels of confidence required for DBS are: ‘Medium confidence’ for DBS Basic ‘High confidence’ for Standard and Enhanced Identity profiles for DBS There are many ways to reach a GPG45 level of confidence, depending on how each step of the identity checking process has been carried out. Different types of evidence are scored differently. For example, an ePassport scores more than a non-electronic passport or a driving licence. Similarly, the way you collect evidence is important. You can gather and verify proof of address from a driving licence or typed in by the individual and checked with a credit reference agency. The different ways you gather and check evidence to reach a specific level of confidence are called ‘identity profiles’. There are lots of identity profiles and IDSPs must be audited for each one they offer. Not all IDSPs will offer the same number of identity profiles, which means some providers will offer candidates more flexibility and less friction than others. Should you use digital identity for DBS? Digital identity is a game change for remote and hybrid working practices. Not only does it allow you to onboard employees from anywhere in the world, but it also helps you stand out in a competitive marketplace with an unbeatable candidate experience. In addition, for organisations that need to prove right to work eligibility and carry out a DBS check, some IDSPs like Yoti and Post Office are certified for both. This means you can use the same ID check for both processes, allowing you to streamline your internal practices. Of course, digital isn’t for everybody. We believe in choice and inclusivity. Candidates that would like a little assistance can verify their identity at a Post Office. Their data is digitised and returned to the business in the same way as in the online service, only they haven’t had to touch a keyboard. How Yoti and Post Office are digitising the DBS process Yoti and Post Office were the first government-certified IDSP for both DBS and Right to Work. Since the change in guidance, we’ve helped some of the UK’s biggest background screening companies make huge efficiencies in their processes. We’ve continued to add more identity profiles to our Identity Verification Service, to give candidates more flexibility and less friction over the documents they use. For DBS basic, candidates can complete the process using just their UK driving licence. To meet the required ‘medium’ level of assurance, we run an activity history check without adding any friction to the user experience. For DBS Standard and Enhanced, candidates can complete the process using an ePassport or a non-chipped passport. This new profile opens up the process to a wider range of ID documents and customers across the globe. Candidates can also prove their identity for a DBS check using our reusable Digital ID app. Alternatively, candidates that prefer some human assistance can verify their identity in-person at a Post Office. Digitise the ID process for DBS It’s been a really exciting time for Yoti and Post Office as we see what happens when innovation meets legislation. And we’ve loved hearing the feedback from valued partners like David Hutchinson, CEO at PeopleCheck: “I want to applaud your internal teams with how they have been supporting and working with the PeopleCheck tech team. The result is an exceptional candidate journey and a great product. This is a significant game changer for both on-site and remote hiring – with companies now being able to fully outsource UK Right to Work credibly and compliantly, at scale and at speed.” If you’re looking to digitise the DBS and right to work process, get in touch and we’d be happy to help.
On Facial Age Estimation, improvements and updates
We continue to invest in improving the accuracy of our world-leading facial age estimation and we will soon be releasing a new ‘Jan 2023’ model with improved accuracy across all skin tones and gender for those aged 6-70. At Yoti we constantly strive to improve all our services given our commitment to tech for good, and given the growing market importance of these services and increasing regulatory engagement. For example, coming soon we’ll be introducing multiple, concurrent age estimation models, which will help improve accuracy even further, whilst still completing a check within seconds. We will also continue to update our Yoti Age Estimation white paper, now 4 years old this month, in which we transparently publish our accuracy across age, gender and skin tones by year between ages 6 and 70. We expect to publish the updated white paper in the next couple of weeks but importantly, we can share today our Jan 2023 model further improves our accuracy and further reduces bias. Across all age ranges, gender and skin tones we are seeing a 5.1% increase in accuracy, reducing the weighted average MAE for 6 to 70 year olds from 3.0 to 2.8 years. As you can see below for this model we have been focussing on reducing the discrepancy between light skintones (tone 1) and darker skin tones (tone 3) We recognise our work is not finished in this regard. Table shows mean average error (MAE) for age range 6-70 by gender and skin tone, and the percentage improvement from our May 2022 model to our January 2023 model. So, well done for marking your own homework, you might say! But we are happy to report our May 2022 white paper has been independently verified as to the measurement methodology and accuracy of our results. On the request of one of our clients, the ACCS undertook an independent evaluation of our May 2022 white paper and had this to say: “The training, testing and results reporting presented in the whitepaper have been independently validated by ACCS, who have certified that Yoti have deployed appropriate methodologies to analyse the performance of their Age Estimation algorithm, including ensuring appropriate separation of machine learning training data, testing data and validation data.” In addition to this, we are also happy to announce that we have been invited to participate in a workshop on ICO commissioned research on the measurement of age assurance on Thursday 19th January, in London organised by ACCS and AVPA. Follow us on LinkedIn to stay abreast of Yoti news or get in touch to find out more.
Yoti digital age verification trialled at supermarkets
Last year, UK supermarkets – including Asda, Morrisons, Tesco and The Co-op – trialled our digital age verification at self-checkouts in a scheme run by the Home Office. During the trial, shoppers in participating stores could try two new ways to prove their age: Facial age estimation technology: shoppers purchasing alcohol looked at a camera on the self checkout and age estimation technology estimated their age. A privacy-preserving solution, it didn’t require any personal details or ID documents, and all images were instantly deleted once someone received their estimated age. If the system detected they looked younger than the set age threshold, customers were asked to use an alternative method. Digital ID app: shoppers could use the free Yoti or Post Office EasyID app to scan a QR code on the checkout screen and share a verified age attribute. Customers who did not wish to use digital age verification had the option to ask a staff member to come and approve them and if required show their ID to a colleague instead. We’re delighted to share some key takeaways from the trials: Participating supermarkets confirmed they support digital age verification, and would welcome legislative change in this area. There were no reported sales of underage customers purchasing age restricted items when using our age verification technology. Informed consent was gathered from all customers, who were given a choice whether to use the technology or present an ID document to a member of staff. The majority of shoppers who used Yoti digital proof of age solutions liked the technology and would use it again, once available. Digital age verification technology provided an opportunity to reduce the number of physical age interventions, giving retail staff more time to monitor other activities, including spotting proxy sales. Yoti facial age estimation is more accurate than humans which reduces the risks of incorrectly estimating the age of shoppers. Yoti facial age estimation is more inclusive because anyone who looks over the required age threshold does not need to carry around a physical ID to prove their age. Digital age verification supports the ability for retailers to achieve the Licensing Objectives Alongside these trials, Aldi has been successfully trialling Yoti facial age estimation on its mobile shopper app, and Regal Gaming technologies are trialling our technology in their gaming machines to help staff create safer gambling experiences. Our facial age estimation is now being used globally by a wide range of social, gaming, ecommerce, adult, gaming and retail organisations. To date, we have completed over 570 million age checks using our privacy-preserving technology, and have the ability to scale to tens of millions of age checks every day. Since the 2022 supermarket trials, we have continued to invest in our facial age estimation technology and have upgraded our online and offline terminal facial age estimation service to enable automatic face capture. This optimises the image taken of the shopper to further improve success rates. We transparently publish our accuracy rates across age, gender and skin tone in our whitepaper. Next steps Currently, the law requires a person to observe and approve the sale of age restricted items. The Home Office is due to publish full reports with the outcomes of the supermarket trials, and whether digital age verification will become an accepted verification method for the sale of age restricted goods. With 70% of people saying they would use facial age estimation when buying age restricted goods at self checkout, we believe shoppers and retailers are ready to embrace this new technology. We look forward to reading the full outcome of the trials. To learn more, please get in touch.
How Yubo became the first major social media platform to age-verify 100% of its users
“Yubo’s rapid, full-scale deployment of sophisticated age-verification technology with Yoti is just the latest evidence of its unwavering commitment to online safety innovation.” Annie Mullins OBE Yubo Independent Safety Advisor Yubo is a live social discovery app making it easy for Gen Z to expand their social circles and hang out online with new friends from around the world. We helped them: Age-verify all users during the onboarding process. Limit interaction between teens and adults. Detect bots and fake profiles. Solution: Facial Age Estimation Industry: Social media Read the case study
How Yoti can help you provide age appropriate experiences online
Online service providers are increasingly being called upon to provide age appropriate experiences online for their younger users. To do so effectively, service providers need to know the age of their users to make sure they’re providing the right experiences. Why are age appropriate experiences important? The ICO’s Children’s Code, originating in the UK, is driving a global movement to ensure children are able to enjoy online interaction ‘age appropriately’. A growing number of countries around the world are already reviewing legislation for a range of age restricted goods and services, particularly age assurance for online services. Specific initiatives are being developed, with the Californian Age-Appropriate Design Code Act in the US, the EU’s Digital Services Act, and the Online Safety Bill in the UK. Adult content sites are also using Yoti age estimation successfully to prevent children from accessing their websites. What are age appropriate experiences online? Child safety and protection is the significant factor here. They range from ensuring age appropriate interaction for children, protection against detrimental content and grooming, and supporting age appropriate content moderation. The ICO defines the code as applying to all service providers that have children access their services. This includes: Social media Streaming services Online gaming Chat rooms Forums Apps So how can Yoti help with age appropriate experiences online? For a long time, the discussion around age verification has centred on the practicality, effectiveness and cost of implementing such a solution. However, technical solutions have now been developed that are scalable, global and affordable for operators. For example, Yoti’s age estimation is the most privacy-preserving, quickest method of age assurance; it is a global, popular way for service providers to determine age from an image or selfie. Our experience has shown that given the option of age verification methods, around 4 in 5 users choose to use Yoti’s age estimation. Learn more about Yoti’s age estimation and age verification solutions or get in touch for a demo.
