A workshop summary

The expanding digital ecosystem we live in has done two seemingly contradictory things. It has created massive gaps in identification – a universe of unidentified virtual objects – while at the same time massively enhancing our ability to create, assign and track unique identifiers to practically anything. We have identifier systems for domain names, autonomous systems and their Internet protocol hosts. We have passkeys, personal advertising IDs, mobile phone sim cards, device fingerprints, and usernames and passwords for hundreds of websites or applications. We have highly institutionalized identifiers for driver’s licenses, SSN, bank accounts, passports, and other vital social functions that are now being digitized. There are areas where we may need new ones: We’re wondering who or what is controlling that drone flying overhead, for example. Identifiers created for one reason can get incorporated into other functions: our license plate numbers get scanned and communicated to a municipal government to regulate our car’s speed or check whether we are an immigrant targeted by ICE.

We’ve circulated some social media videos promoting this workshop and gotten some responses like this:

“keep your techno-fascism away from us, stop killing the free and open internet.”  

“you are trying to track and control the internet and the people on the internet.”  

The workshop leaders clarified that it is not our intention to advocate for or against digital identifiers or any specific uses, but to understand them. We know perfectly well that identifiers and identification are a means of control. We understand that more fundamental questions about what should be controlled, who does the controlling, and how identifiers contribute to those goals are implicated in the study of digital identifiers. That in fact is the cybernetic insight that motivated this project.

But you cannot answer questions about identifiers and governance unless you understand the incentives to create them and their organizational, technical and economic constraints. Governance by identification is not as easy as it sounds, as our age verification advocates are beginning to find out. Identifier systems can create as many problems as they solve. To do policy in this area, we need a better understanding of how digital identifiers intersect with cyberspace governance.

On September 24, 2026, in conjunction with TPRC 54, the Internet Governance Project (IGP) brought researchers, industry and government representatives together at American University’s Washington College of Law for a daylong workshop on digital identifiers and their role in cyberspace governance.

The workshop grows out of research funded by the Internet Society Foundation. A first grant studied how websites are authenticated. A second, running 2025–2026, extends the work to the public key infrastructures (PKIs) for domain names and Internet routing, and to Legal Entity Identifiers (LEIs). We chose these cases because each shows states and non-governmental Internet communities in conflict or collaboration over who manages identity, and on what authority.

An identifier system is a chain of decisions

The workshop opened with an analytical framework that came out of that research. An identifier system enables governance functions: exclusion, surveillance and accountability. But it is not a single thing to be governed. It is an information system built from distinct components, each one the product of decisions made by different actors, under different claims of authority, facing different economic constraints. The framework breaks any regime into five elements: purpose, tokens and protocols, assignment and enrollment, registry maintenance, and authentication. Finding which element is contested, and by whom, explains most of what follows.

Brenden Kuerbis drew lessons from the history of Domain Name System Security Extensions (DNSSEC), Resource Public Key Infrastructure (RPKI) and the Web PKI. His conclusion set the agenda for the day:

“The central lesson from DNSSEC, RPKI, and Web PKI for emerging identifier systems is that we should pay close attention to the institutions. Who grants or gains a new authorization capability, and is accountable? Who becomes dependent on whom, where can exclusion occur? Does the architecture permit interoperability and enable demand without imposing unnecessary centralized control?”

Ryan Galluzzo of the National Institute of Standards and Technology (NIST) suggested making the framework account for compatibility across identifier systems. He noted that verifying identity across organizations at scale, including for artificial intelligence (AI) agents, is a major ongoing challenge.

Who designates the root of trust?

The Web PKI is the clearest case of private coordination that works. Browser vendors decide which certificate authorities their users trust, and that arrangement secures web traffic without any government mandate. The European Commission’s push to require browsers to trust government-designated certificate authorities stress-tested that separation. Our reading is that the fight was less about web security than about installing a second, legally mandated root of trust. That would have been enough to split one global system into jurisdictional ones that no longer fully interoperate. Karl Grindal, Johannes Sedlmeir, who are researching the interaction between the EC’s eIDAS regulations and the Web PKI, discussed the current state of that controversy along with Cecilia Testart.

When the state supplies the identifier: age verification

Where the web relies on private identifiers, age verification turns to government ones: driver’s licenses and passports. About 30 U.S. states now require it, mostly for sexually explicit content, and each defines acceptable methods differently. In Free Speech Coalition v. Paxton, Justice Thomas likened an online age check to showing ID to a bartender. A panel recorded for Shane Tews’ Explain to Shane podcast spent much of its time showing why that comparison fails.

The bartender works for the bar and hands the card back. Online, sites outsource checks to third-party vendors, which cross-reference uploaded IDs against credit, address and email records. Harry Oppenheimer of Georgia Tech described his research finding:

• Vendors collecting device and browser data detailed enough to identify an individual
• No clear way for a user to contest a fraud flag
• Low compliance across the three states measured
• Checks easily evaded with virtual private networks

Paul Lekas of the Software & Information Industry Association (SIIA) called the result “collection without protection.” States mandated data collection without minimization standards or privacy law. Because a platform has to check everyone to find the minors, age verification is identity verification in practice, and it builds stores of sensitive data that get breached.

 Lekas: “Age verification is just identity verification.”

Scott Vien of the American Association of Motor Vehicle Administrators (AAMVA) offered a different model: the mobile driver’s license (mDL). It is built on International Organization for Standardization (ISO) standards and the same PKI approach as electronic passports, and the issuing state signs each data element separately. A site can request only an “over 18” answer, without name or photo, and the holder approves each release. AAMVA’s Digital Trust Service publishes the states’ public keys, so the site can confirm the credential came from a real issuing authority.

Oppenheimer, a self-described mDL fan, named what it does not yet solve:

• Confirming who is holding the phone
• Whether licenses can be issued remotely
• Accessibility
• What changes when a credential built to license a privilege (driving) starts gating a right (access to information)

The panel debated the viability of age signals at the operating-system level, an approach California has adopted and federal lawmakers are considering. Under this model, a device transmits an age signal only to websites that request it, while parental controls remain optional, application-level features exercised at parents’ discretion rather than imposed by government mandate.

Where the burden should sit (device makers, app stores or platforms) remains contested. As Lekas observed, companies tend to propose solutions that put the onus on someone else.

Organizational identifiers 

The final session asked three questions of organizational identity: determining who a legal entity is, who may act for it, and whether either answer still holds. The LEI, created after the 2008 financial crisis to identify counterparties, is the most developed answer, and its U.S. policy footing is improving. The Financial Data Transparency Act of 2022 names the LEI’s standard, ISO 17442, for entity identification. Joint rulemaking is complete, and the agencies are writing implementation plans. Many of the same agencies oversee stablecoin issuers under the GENIUS Act and will need to identify those issuers as well. The expectation voiced on the panel is that they will reuse the LEI rather than build a new identifier. Because many firms operate in both traditional and decentralized finance, one identifier across both regimes would let regulators match a firm’s records in each.

Outside those mandates, U.S. entity identity remains ad hoc, assembled from three data sources:

• Employer Identification Numbers, which not every entity has
• Privately issued Data Universal Numbering System (D-U-N-S) numbers, which government often recognizes
• LEIs

The one broad attempt at policy was the beneficial-ownership reporting created under the Anti-Money Laundering Act of 2020. It proved so convoluted that industry revolted, and the Financial Crimes Enforcement Network has since stripped out most of it. One panelist stated that while commerce still functions; it could function better. Yet participants agreed that patchwork, despite drawbacks, is preferable to a single national ID.

With LEIs, adoption tracks mandates. China shows how far subsidy alone goes: the People’s Bank of China paid for organizations to obtain LEIs and registrations surged, but with the subsidy gone, renewal falls to the firms themselves, leading to massive attrition. Adoption and renewal owes less to the roughly $40 renewal fee than to three other causes:

• Mandates tied to specific activities
• Staff turnover
• Firms not valuing the LEI beyond compliance

The verifiable LEI (vLEI) is a digital credential that lets a counterparty confirm both the LEI and the roles attached to it, such as who may sign for the firm. Europe complicates that picture. The European Unique Identifier (EUID), assigned through national business registers, covers only companies registered in the European Union (EU). The LEI is global and also records who owns whom. Yet the EU’s proposed Business Wallet makes the EUID the primary identifier and carries the LEI only as an attested attribute. That leaves the vLEI’s role in Europe’s main business credentials unsettled.

Not everyone was convinced the vLEI is needed. One skeptical view held that organizational credentials could build on the web’s existing PKI through extended validation certificates, rather than on new chained-credential schemas built on Key Event Receipt Infrastructure (KERI).

What we took away

The useful question is not only whether states or markets should govern identity. It is which part of an identifier system the two are fighting over, how that affects uptake, how it gets settled, and who bears the cost. Each regime discussed breaks at a different point:

• The web. The contest is over who designates the root of trust, and a jurisdictionally mandated one risks fragmenting a working global system.
• Age verification. Statutes name the outcome but not the evidence standard, the assurance level, or who evaluates the claim. Those decisions passed by default to a handful of private vendors. The result is over-collection by a few intermediaries at a fraction of covered sites: a failure of design.
• LEIs. There is little contest over authority and the design is sound as far as standard LEIs go. The system struggles because the main incentive to adopt is regulatory, so adoption stops at the compliance boundary. The live test is whether a new credential layer is worth building at all.

Two lessons follow. First, layered, plural approaches work better than a single mandated gate. Platform controls, device and household tools, and competition among methods spread responsibility across the parties who can see the context, without building a national identity chokepoint that undermines privacy, especially absent comprehensive privacy legislation. When platforms point to App stores and device makers point back to platforms, the user ends up handing identity documents to whichever vendor sits in the path.

Second, the decisions made now will be hard to reverse. Identifier systems resist change, as India’s experience with Aadhaar shows, and infrastructure built for one purpose rarely stays confined to it. As was pointed out, a system built to check ages can check other things and the time to ask who controls that capability is before it is designed.

A good outcome of identity systems is one where no single credential becomes the cure-all:

• People prove specific things to specific parties.
• Multiple providers coexist, so one failure is survivable.
• What a credential actually proves is legible.
• Non-digital fallbacks stay available by design.