InCommon Federation Discussions About Online Student Services

["Rodney Petersen" <>]

Below is a link and the rules and analysis that I mentioned on today's call.

-Rodney


Institutional Eligibility Under the Higher Education Act of 1965, as Amended, 
and the Secretary's Recognition of Accrediting Agencies
http://www.ed.gov/legislation/FedRegister/finrule/2009-4/102709a.html

Distance Education and Correspondence Education (Sec.  602.17)

Final Rule:

§ 602.17 Application of standards in reaching an accrediting decision.
* * * * *
(g) Requires institutions that offer distance education or correspondence 
education to have processes in place through which the institution
establishes that the student who registers in a distance education or 
correspondence education course or program is the same student who
participates in and completes the course or program and receives the academic 
credit. The agency meets this requirement if it-
(1) Requires institutions to verify the identity of a student who 
participates in class or coursework by using, at the option of the 
institution, methods such as-
(i) A secure login and pass code;
(ii) Proctored examinations; and
(iii) New or other technologies and practices that are effective in verifying 
student identity; and
(2) Makes clear in writing that institutions must use processes that protect 
student privacy and notify students of any projected additional
student charges associated with the verification of student identity at the 
time of registration or enrollment.

Analysis and Comments:

    Comment: None.
    Discussion: The Department determined that there was an error in 
Sec.  602.17(g)(1)(iii) with the use of the word ``identification'' in 
the phrase ``that are effective in verifying student identification.'' 
The appropriate word to use in the phrase is ``identity'', not 
``identification.'' Verifying student identification is making certain 
that an ID card is not a fake. Verifying student identity is making 
certain that the student is who he or she is purporting to be. Under 
the statute, agencies are required to do the latter.
    Changes: Section 602.17(g)(1)(iii) has been amended by replacing 
the word ``identification'' with the word ``identity''.
    Comment: One commenter questioned whether the requirements proposed 
in Sec.  602.17 for verifying the identity of distance education and 
correspondence education students go far enough. The commenter noted a 
distinction between systems that verify the identity of an individual 
through the use of measures such as personal identification numbers 
(PINs), passwords, and knowledge-based questions, and those that 
authenticate an individual's identity by means of anatomical or 
behavioral characteristics unique to the individual, such as 
fingerprints or unique patterns of movement. The commenter suggested 
that continued use of secure logins and passwords as the sole means of 
identification is inconsistent with the intent of the statutory change, 
and claimed that only biometric-based authentication can provide 
positive identification. The commenter described software that can be 
used to capture a student's movements and create a unique biometric 
student identity that can be used to ensure that the person who 
registers for an online course is the person who does the work and 
receives the credit. A second commenter supported the proposed language 
and called the provision a common-sense rule.
    Discussion: The regulations governing verification of student 
identity were developed using information provided during the 
negotiated rulemaking discussions and the explanation of the new 
requirement that was included in the conference report accompanying the 
HEOA (H. Rep. 110-803, p. 567). In explaining the intent of the new 
statutory provision that agencies require institutions that offer 
distance education or correspondence education to have processes for 
establishing that the students who register for courses are the same 
students who complete the program and receive the credit, the 
conference report stated that institutions are expected to have 
security mechanisms, such as identification numbers or other pass code 
information, in place and to use them each time a student participates 
online. Therefore, the continued use of PINs and passwords is 
consistent with both the statutory language and the intent of the 
Congress.
    In the conference report, it is clear that Congress anticipated 
that as new identification technologies are developed and become more 
mainstream and less expensive, agencies and institutions would consider 
using them. For this reason, the regulations provide for the use of new 
technologies and practices that are effective in verifying the identity 
of students, in addition to methods such as secure logins, pass codes, 
and proctored examinations. There are at least two reasons for not 
mandating specific types of identity verification procedures in the 
regulations: Cost and availability. Different types of institutions 
have different levels of risk, and a technology that one institution 
considers necessary and affordable may be neither needed nor cost-
effective at another institution. It would also be inappropriate for 
the Department to include specific institutional requirements in its 
regulations that govern the recognition of accrediting agencies.
    Changes: None.

--------------------------------------------------
Rodney J. Petersen
Government Relations Officer & 
Director of Cybersecurity Initiative
EDUCAUSE

1150 18th Street, N.W., Suite 1010
Washington, D.C. 20036
(202) 331-5368 / (202) 872-4200

EDUCAUSE Policy Analysis and Advocacy
www.educause.edu/policy
EDUCAUSE Cybersecurity Initiative
www.educause.edu/security
Identity and Access Management
www.educause.edu/iam
--------------------------------------------------