US President Donald Trump has signed a new executive order that revokes core digital identity components established under the Biden administration’s cybersecurity framework. The order, signed on June 6, 2025, eliminates federal guidance that supported the development and deployment of secure digital identity infrastructure, prompting concern among cybersecurity experts who warn the move could leave Americans more vulnerable to cyber threats.
Cybersecurity Experts Warn of Increased Risks
The Trump administration’s fact sheet framed the revoked Biden-era provisions as “a mandate for U.S. government-issued digital IDs for illegal aliens,” claiming such measures would have facilitated entitlement fraud and other abuse. However, cybersecurity leaders have disputed this characterization. Jeremy Grant, a well-known digital identity and security advocate, described the Biden policy as “common-sense, modest measures” intended to improve online identity systems. “Biden’s order did not mandate that the government issue digital identity documents,” he said in a statement quoted by Politico.
Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, echoed that sentiment. He warned that focusing on revoking digital ID guidance appeared to prioritize “questionable immigration benefits over proven cybersecurity benefits.”
The Biden administration’s original executive order, issued in January of this year, had encouraged states and federal agencies to implement secure digital identity tools, including mobile driver’s licenses and other verifiable credentials. These efforts aligned with the NIST Digital Identity Guidelines (SP 800-63), which continue to serve as a technical framework for digital ID initiatives nationwide.
Cybersecurity experts have raised concerns that rescinding the guidance without offering a replacement weakens national defenses. Recent intelligence reports have highlighted the growing use of deepfakes and fake identities by state-sponsored actors, including operations by North Korean IT workers who infiltrated U.S. tech firms and used the access to fund the country’s nuclear program through identity fraud.
Remaining Measures and New Directives
In addition to revoking digital ID guidance, the order introduces new initiatives. The Commerce Department has been tasked with working alongside private industry on secure software development practices, beginning in August 2025. Meanwhile, the NSA and the Office of Management and Budget are expected to publish post-quantum cryptography standards by December.
This U.S. policy reversal comes as global counterparts continue to embrace digital identity infrastructure. The European Union, for example, is advancing a standardized digital identity wallet ecosystem across member states, seeking to modernize online authentication and improve interoperability within the bloc.
—
By Cass Kennedy
