In June 2025, President Donald Trump removed the digital-identity and fraud-prevention section of President Biden’s broader cybersecurity order. The June 6 executive order dismantled a specific effort to strengthen safeguards, without supplying a comparable replacement for that work. That was a dangerous decision.
While digital identity may sound like a wonky topic, the implications of the Trump digital ID repeal are practical. Who is applying for public benefits? Who controls an account? Can an agency distinguish a legitimate applicant from someone using stolen information? Removing work on those questions does not make the underlying fraud disappear. It leaves government with fewer coordinated initiatives for addressing it.
The timing makes the reversal especially troubling. Pandemic unemployment fraud had already exposed costly weaknesses in public systems. North Korean IT-worker schemes were exploiting false identities, including AI-assisted deception during interviews. Neither problem began with Trump’s order, and digital IDs alone would not solve either one. They are compelling reasons to improve identity defenses rather than abandon useful work on them.
This article examines what Biden’s plan proposed, what Trump removed, and why that choice risks weakening security and public trust. The criticism is about a concrete policy retreat: Trump undid safeguards and anti-fraud coordination when the country needed to strengthen them.
Key Takeaways
- The Trump digital ID repeal removed the January order’s digital-identity and fraud-prevention section, not the entire federal cybersecurity framework.
- Biden’s plan encouraged mobile ID acceptance, practical guidance and anti-fraud cooperation. It did not mandate a national ID for everyone or itself award state grants.
- Removing those initiatives without a comparable replacement makes coordination harder and is a risky policy choice.
- AI and face-swapping were already part of documented North Korean IT-worker schemes. Stronger identity proofing can help, but it cannot replace account security and hiring checks.
- Other countries’ approaches offer lessons about privacy, implementation and coordination. They are not proof that every foreign system is safer than America’s.
- Congress and the executive branch should restore a clear, accountable approach to identity modernization that protects privacy and keeps services accessible.
What Was in Biden’s Digital ID Order?
National Push for Mobile IDs and Shared Federal Services
The January 16, 2025 cybersecurity order included a dedicated section on digital identity and fraud prevention. It encouraged agencies to consider accepting digital identity documents, including mobile driver’s licenses, for access to public benefits. It also called for practical NIST guidance, consideration of identity-attribute validation services and a Treasury fraud-notification pilot. Grantmaking agencies were to consider available funding for states; the order did not itself award grants.
These were useful, concrete steps. A mobile ID is a digital credential rather than simply a photograph of a driver’s license. Its value depends on whether a service can validate the credential and handle the information appropriately. Federal encouragement matters because an ID can be technically sound yet of little practical use if agencies cannot accept it consistently.
Login.gov was already part of the federal landscape. The IRS’s July 2024 FATCA announcement identified Login.gov and ID.me as sign-in options for that registration system. The Social Security Administration also announced a transition to Login.gov for older online accounts. Those shared services predated the January order and remained part of the federal identity landscape.
Signing into an account and proving someone’s real-world identity are different tasks. A shared sign-in can reduce the burden of maintaining separate credentials, while a particular service may require additional identity evidence. The policy goal should be to make those requirements understandable and proportionate, rather than treating the existence of one login as proof that every identity problem has been solved.
Focus on Privacy and Non-Surveillance
A central feature of the Biden plan was its attention to privacy. Its digital-identity provisions addressed limits on tracking credential presentation and location, as well as minimizing disclosed information. The order’s encouragement of digital documents was not a requirement that every citizen enroll in a national digital ID scheme.
That distinction matters. People should not have to choose between weak fraud protection and a system that exposes more personal information than a transaction requires. A well-designed identity service should establish the relevant fact without becoming a record of everywhere a person goes. Privacy protection is part of the security problem, not an obstacle to be brushed aside.
The broader questions remain familiar: who can see the information, what can they retain, and what happens when a legitimate user cannot pass an automated check? Our Privacy and Identity Protection guide places these choices in their wider context. Modernization should reduce unnecessary exposure while preserving usable alternatives and a way to correct mistakes.
A More Coordinated Federal Approach
The broader goal was to address fragmentation in digital identity. An agency’s choices about proofing, authentication and data handling affect the people who use its services. When requirements differ, applicants may have to learn several processes and submit sensitive information repeatedly. A coordinated approach can make those decisions more consistent without requiring one database or one technology for every purpose.
The Biden digital identity executive order offered a route toward that coordination. It was not a completed national system, and its promised benefits still depended on implementation. That is a reason to scrutinize the work, fund it appropriately and measure results. It is not a persuasive reason to delete the effort before demonstrating a better way to meet the same needs.
What Trump’s Executive Order Repealed
Removal of Digital ID and Fraud-Prevention Initiatives
The June order struck section 5 from the January order, removing the initiatives just described. Existing state programs, federal standards and services such as Login.gov remained. The loss was the additional direction and coordination intended to improve identity verification and fraud prevention.
The harm is more specific, and the political responsibility is clear. Trump removed an executive direction to improve coordination, investigate practical tools and help prevent fraud. His order did not provide a comparable replacement for those deleted initiatives. A government can retain older standards while still making a serious mistake by dismantling work intended to improve their implementation.
Withdrawing federal encouragement and coordination risks slowing progress and making cooperation less predictable. States, agencies and service providers need a dependable direction for work that spans their separate responsibilities. Trump removed that support while leaving the underlying need for cooperation unresolved.
Rollback of Additional Software-Security Scrutiny
Trump’s executive order did not stop at identity verification. It also removed January’s proposed centralized software-attestation evidence and validation measures. Those measures concerned whether suppliers could substantiate their claims about secure development practices.
Earlier obligations already existed. OMB’s September 2022 software-security memorandum required agencies to obtain producer self-attestations for software within its scope. Those earlier obligations remained. January’s additional measures would have subjected the assurances to more centralized evidence collection and validation. An attestation concerns development practices; software still requires assessment and ongoing vulnerability management.
The policy criticism remains serious: asking suppliers for evidence and validating their assurances offers a stronger basis for accountability than accepting a statement without that additional scrutiny. Removing the January additions weakened that proposed oversight. Digital identity and software security are distinct issues, but both raise the question of how much confidence government should place in claims that have not been adequately checked.
Political Framing and Controversial Justifications
The administration’s June 6 White House fact sheet claimed the change removed a government digital-ID mandate for immigrants without lawful status that would have facilitated benefits fraud. That was the administration’s political justification. It was not what the January text required.
Identity verification asks whether someone is the person they claim to be. Eligibility rules determine whether that person qualifies for a benefit. Conflating those questions does not strengthen fraud prevention. It obscures what an identity initiative does and makes it easier to attack a policy on grounds unrelated to its actual provisions.
In Nextgov’s June 9 interviews, digital-identity expert Jeremy Grant disputed the claim that January’s order mandated government IDs for anyone. Former National Security Council adviser Carole House argued that its removed measures would have supported the administration’s stated fight against fraud. Their criticism highlights the contradiction: Trump invoked fraud prevention while deleting initiatives meant to help prevent it.
This is a sharp policy reversal with consequences that deserve scrutiny. The immigration rhetoric does not answer the practical question: what replaces the deleted work? Without a convincing answer, the Trump digital ID repeal is a retreat dressed up as protection.
Why Digital ID Infrastructure Matters
A National Security Component
Digital identity is no longer a niche IT issue. It is important security infrastructure. NIST’s 2017 digital-identity guidelines already addressed identity proofing, authentication and federation. Those are related but separate functions: establishing an identity, checking control of an authenticator, and conveying trusted identity information between services.
That distinction helps explain both the value and the limits of modernization. Proving the right person enrolled does not keep their account safe forever. An agency still needs appropriate access controls, monitoring and recovery procedures. Similarly, a strong password cannot establish that an applicant’s underlying identity claim is genuine. Sound policy has to address the whole chain.
Identity controls support decisions about access to government systems and services. If government cannot distinguish an authorized user from an impostor, other safeguards can be undermined. Keeping that responsibility fragmented or poorly implemented is a national security concern.
The Economic Cost of Fraud
The scale of public losses should have strengthened the case for action. GAO estimated between $100 billion and $135 billion in unemployment-insurance fraud from April 2020 through May 2023. The estimate covers fraud in those unemployment programs.
The scale of that loss is alarming. Identity checks are one part of preventing improper payments; agencies also need to assess eligibility, identify suspicious claims and provide a workable process for legitimate applicants. No single credential should be sold as a cure for every form of fraud.
The private-sector burden is substantial too. Javelin’s 2024 study announcement reported about $23 billion in traditional identity-fraud losses to consumers in 2023. Those losses illustrate the cost borne by people when identity systems and account protections fail.
The Trump digital ID repeal should be assessed against that need for improvement. Removing useful anti-fraud work does not save victims the effort of resolving a stolen identity or recover public money. It risks leaving problems unresolved that government had already identified as important enough to address.
Identity Is One Part of an Attack
SolarWinds showed how software compromise can undermine identity protections. Microsoft’s December 2020 SolarWinds analysis described a compromised software update followed by credential theft and abuse of identity trust. The attack connected software supply-chain security with the protection of trusted accounts and systems.
For Colonial Pipeline, June 2021 congressional testimony established that attackers used a legacy VPN account without multifactor authentication. Investigators described reuse of credentials from another breached site as possible, not confirmed. Neither incident proves that accepting mobile IDs would have prevented the attack.
Trust must be earned and protected at more than one point. Our guide to passwords, passkeys and two-factor authentication explains the account-protection side. A government identity strategy must complement those defenses rather than claim to replace them.
The Hidden Risks of Repeal
Growing Exposure to State-Sponsored Cybercrime
The AI-enabled threat was already concrete. In its January 23, 2025 alert on North Korean IT workers, the FBI reported AI and face-swapping during video interviews, alongside company-data theft and extortion. These schemes exploit employers’ trust in an applicant’s claimed identity and the access granted after hiring. The FBI’s warning called for stronger checks during interviewing, onboarding and employment.
Reducing coordinated defensive work while deception becomes more convincing is dangerous. Agencies need tools and standards that can evolve with that challenge, while employers need their own verification and access controls. Public-benefit identity initiatives do not automatically govern private-sector hiring.
Trump withdrew useful work in an area where documented threats made improvement urgent. A president who claims to prioritize security should explain how deleting that work makes people safer. The June order does not supply a comparable anti-fraud program in its place.
Erosion of Trust in Public Infrastructure
Digital ID frameworks were never just about convenience. They also raise questions of consistency, transparency and security. When requirements differ between services, people may struggle to understand what information they must provide and how it will be used. A poorly explained process can undermine trust even if an individual security check has a legitimate purpose.
The Biden digital identity executive order offered a way to address some of those questions together. Trump withdrew that cross-government push. That makes the case for clear responsibilities and public accountability more urgent, especially when sensitive evidence is collected or an automated decision blocks access.
Trust cannot be restored by attaching the word “secure” to a credential. People need understandable rules, meaningful privacy limits and recourse when something goes wrong. The Trump digital ID repeal leaves less coordinated work toward those goals without showing that its removal improves the public’s position.
Loss of Policy Momentum and Federal Leadership
Perhaps the most far-reaching risk is the loss of policy momentum. Digital ID systems require sustained attention, collaboration and coordination. A sudden executive reversal makes it harder to plan around a shared direction. That is a reasoned concern about implementation, not evidence that every state pilot or vendor rollout stopped.
The absence of leadership is not just symbolic. Even well-intentioned individual projects can struggle to work together if agencies do not resolve common questions. Who accepts which evidence? Who is responsible for errors? How should a service balance fraud checks with access for legitimate users? Leaving these issues to separate initiatives can preserve the very fragmentation modernization is supposed to reduce.
Trump could have retained useful provisions while proposing narrower safeguards or better implementation. Instead, he removed the identity and fraud-prevention section. That choice left important modernization and anti-fraud work without the executive direction it had been given.
Global Context: Different Models, Shared Challenges
China’s National Online-Authentication Initiative
China offers a different approach to online identity verification. Measures published in May 2025 described a national online-authentication service using identity numbers and certificates based on legal identity documents. The measures provided for voluntary applications and alternative verification methods. They were due to take effect on July 15, after this article’s publication.
The initiative shows government attention to digital identity while raising important questions about governance and control. For the United States, a credible response must connect effective verification with safeguards against misuse. Centralization alone is a poor measure of whether an identity system serves the public.
The United States should offer a credible approach grounded in privacy and accountable institutions. It does not need to copy China to recognize that digital identity is a strategic policy issue. Abandoning useful domestic coordination makes it harder to advance a clear alternative consistent with American rights and public expectations.
North Korea’s Identity-Based Cyber Infiltrations
The North Korean hiring example makes a different point. A state-backed actor does not need to operate a superior national ID system to exploit another organization’s weak checks. The FBI’s warning describes deception directed at employers, followed by the abuse of access. The AI component makes the example particularly relevant to a debate about what counts as reliable identity evidence.
Our article on North Korean deepfake job scams examines those hiring risks. Stronger proofing can provide one layer, but employers still need to verify applicants, limit access and investigate warning signs. A mobile credential or Login.gov account would not, by itself, establish that a remote worker is trustworthy or authorized to access sensitive systems.
The lesson for policy is to support complementary defenses. The Trump digital ID repeal moves in the wrong direction by removing coordinated work rather than improving it. Recognizing the limits of a particular tool should make the strategy more realistic, not become an excuse to abandon the problem.
Europe and Allies: Progress and Implementation Gaps
The EU’s March 2024 digital-identity framework set a course toward wallets intended to support cross-border identification and sharing of credentials, with member-state availability planned for 2026. Individual use was to remain voluntary. Implementation remained ahead in June 2025.
Canada illustrates the difficulty of delivery. Its December 2024 Auditor General report found little progress on a national approach because of missing funding, while federal single-sign-in procurement had received support. The audit underlines how a national approach requires sustained support beyond a single sign-in project.
Australia’s November 2024 implementation explanation described stronger accreditation, privacy protections and phased expansion under its Digital ID Act. State and territory services could apply to join the government system; private-sector participation was still prospective. That is a useful example of putting governance and privacy into the framework while acknowledging that expansion takes time.
These comparisons support a practical conclusion: coordination requires sustained work. Neither centralization nor a published strategy guarantees success. But removing useful U.S. initiatives without a comparable replacement is hardly a plan for doing better.
What Comes Next Without a Replacement Strategy
A Roadmap for the Work Trump Removed
Existing federal standards and services remain important. The question is who will carry forward the specific modernization and anti-fraud work Trump deleted. A credible successor should identify responsible agencies, practical milestones, resources and privacy requirements. Without that, assurances about continuing to fight fraud are difficult to assess.
The Trump administration should explain which of the removed initiatives it considers unnecessary and how it will meet the underlying needs. If a proposed tool creates privacy or access problems, officials should address those problems openly. Deleting a section on the basis of a misleading immigrant-ID claim does not supply that analysis.
Congressional Responsibility
Congress and the executive branch should work toward a durable identity framework rather than rely entirely on an initiative that can be stripped away by another executive order. That framework should clarify responsibilities, support interoperable systems and make privacy protections enforceable. It should support cooperation while allowing agencies and states to use appropriate tools for their needs.
Lawmakers should ask for evidence about costs, fraud reduction, false rejections and the handling of personal information. Those are meaningful measures of success. Counting enrollments alone would not show whether a system helps people or protects public funds. The same scrutiny should apply to any replacement the Trump administration proposes.
Opportunity for Adversaries to Exploit Unresolved Gaps
In cybersecurity, delays are opportunities. Leaving a known identity weakness unresolved gives attackers more time to exploit it. Policymakers should take responsibility for the foreseeable risks of withdrawing defensive work.
AI-assisted impersonation makes that responsibility harder to dismiss. A convincing video interview is not conclusive identity evidence. Neither is possession of personal information that may already have been stolen. Agencies and employers need a layered response that addresses enrollment, account control and the permissions granted afterward.
Trump removed initiatives intended to improve parts of that response, without providing a comparable replacement. The United States cannot afford to treat digital identity as an afterthought simply because it is politically convenient to attack a predecessor’s plan.
Conclusion and Future Outlook
The Trump digital ID repeal was a risky mistake. It removed practical identity and fraud-prevention initiatives at a time when public losses and AI-enabled impersonation made stronger defenses urgent. Existing standards survived, but that does not excuse dismantling work intended to make them more useful.
Trump weakened the coordinated policy response while offering a misleading political rationale for doing so. A government serious about reducing fraud should improve useful safeguards, test their effectiveness and protect privacy—not discard them without explaining how the same needs will be met.
Congress and the executive branch should prioritize a clear path forward:
- Restore coordinated identity work. Establish responsibilities, realistic milestones and appropriate support for implementation. Preserve useful federal and state cooperation while avoiding claims that a single credential solves every security problem.
- Strengthen supplier accountability. Require meaningful evidence behind software-security assurances and scrutiny proportionate to the risk. Identity controls cannot compensate for compromised software, just as a supplier’s signature cannot guarantee a vulnerability-free product.
- Build privacy and access into the design. Minimize disclosure, limit tracking and retention, and provide workable alternatives and correction processes. People should be protected from fraud without surrendering unnecessary personal information or losing access to essential services.
- Rebuild public trust through results. Explain decisions, measure outcomes and make responsibilities clear. Government earns confidence by showing how its systems protect people, handle errors and prevent abuse.
Digital identity modernization is a national security and public-service imperative. Trump’s decision took the country away from that work when it should have been moving forward. The time to restore a credible, privacy-preserving approach is now.
To get breakdowns like this each week, including how cyber policy shifts could affect your organization or agency, sign up for the Quantum Cyber AI newsletter.
Frequently Asked Questions (FAQ)
Why did the Trump administration remove the digital-identity provisions?
The White House fact sheet claimed they mandated government digital IDs for immigrants without lawful status and would facilitate benefits fraud. The January order did not contain that mandate. It addressed ways to improve identity verification and fraud prevention; proving identity does not determine eligibility for a benefit.
Was the Biden digital identity executive order mandatory for citizens or states?
It did not require everyone to enroll in a national ID program or require states to adopt mobile IDs. It directed federal work and encouraged agencies to consider digital documents and available state funding. It did not itself award those grants or mandate universal acceptance.
What is a mobile ID, and why is mobile ID security important?
A mobile ID is a digital credential representing a government-issued identity document. Its usefulness depends on secure issuance, validation and handling. Mobile ID security also requires protecting privacy and avoiding unnecessary disclosure. A picture of an ID on a phone is not equivalent to a verifiable digital credential.
How do cyberattack threats from North Korea relate to identity?
The FBI documented North Korean IT workers using false identities and AI or face-swapping in interviews, with some operations involving data theft and extortion. Better identity proofing can help employers, but it must be combined with hiring checks, limited access and monitoring. These employer responsibilities complement public-sector identity and fraud-prevention work.
What can policymakers do after the Trump digital ID repeal?
Restore a coordinated approach to the work that was removed, with clear responsibilities, privacy protections and evidence of effectiveness. Congress and the executive branch should support implementation and assess digital verification risks while keeping identity proofing distinct from eligibility decisions and account security.