Case Study: From Zero to A Billion - the Making of an Identity Verification Unicorn
Author’s note:
Blake and I met in 2020, during COVID, as my nonprofit organization was looking to help surge healthcare professionals into the fight against the pandemic. One of the key challenges was identifying and verifying user credentials. Enter ID.me; Blake and team offered to do it for the healthcare facilities who were vetting our volunteers - and incredibly, to do it for free. His heart for service runs deep. I’m excited to share his story - the ID.me story - with you.
Overview
Blake Hall was an Army Infantry Officer running kill / capture missions in Iraq.
After participating in over 450 combat patrols, he returned home, devoted to continuing to lead a life that mattered. He matriculated to Harvard Business School in 2008, and found himself at the management consultancy McKinsey.
Dissatisfied with corporate life, Blake returned to his passion - the military community. As a third generation military member, Blake never stopped caring about servicemembers and he threw himself into learning about new ways to support veterans. The more he learned about the benefits veterans receive, ranging from education to health care, the more he encountered a troubling statistic: veterans suffer from identity theft at nearly twice the rate of the general population.
From this insight, the kernels of ID.me were born. What if a digital identity verification system could verify that veterans are who they claimed to be? What if this digital identity could reduce the need to deal with paper identification and sensitive information such as social security numbers?
So with a check from a Harvard classmate and another from his brother, Blake started the company. In the early days, it became clear that the center of the action was in Washington. With just $10k left in the bank, Blake signed a $50k lease for a house in downtown DC.
Today, 120 million Americans use ID.me’s digital wallet – 40% of American adults, including over half of California. They have over over 500 employees and 500+ contractors. The company has raised nearly $300M in venture capital and earns close to $150M in annual recurring revenue.
Success was far from a sure thing. And yet, the ID.me story is the story of succeeding where countless others (including behemoths such as Google, Microsoft, and Verizon) had failed.
Products
ID.me is an identity utility that helps government agencies and commercial brands verify an individual’s identity and that they are part of a certain community. ID.me thinks about their products in two buckets: 1) driving efficiencies around access (remove barriers to obtaining a benefit or service, and 2) driving efficiencies around discovery (help people understand what benefits they’re eligible for).
Access Efficiencies:
● Commercial Digital Wallet: This functions like a tollbooth to a digital fast lane. Use cases range from hotel check-ins in Vegas and to retailers. The digital wallet serves as a Visa-like network to facilitate transactions.
● Government Verification: ID.me helps government agencies verify identities so people can access government benefits.
Discovery Efficiencies:
● Commercial Shop: Commercially, many target communities (e.g., veterans, students, healthcare professionals) are eligible for special discounts on goods and services. Because ID.me includes those affiliations in users’ verified identities, ID.me also shares those opportunities with verified customers when they shop using ID.me.
● Government Marketplace: ID.me helps customers understand what programs they may be eligible for. For example, if you’ve lost a job and are eligible for unemployment, ID.me can discover other products you may receive.
Entering the Federal Market
Despite the government being the primary issuer of identification, ID.me did not begin in the federal market. Blake’s approach here is clear, “We did not go into the public sector without having a solid foundation.” He knew lack of preparation, the timing of awards, and uncertainty could all kill the company in the cradle if it did not first have some solid commercial revenue to fall back on.
So only after ID.me signed up initial commercial customers in 2010 and 2011 did the company enter the federal market. It did so via a grant from the Department of Commerce, announced in 2012. Blake and team began looking more closely at the U.S. government around that time as they recognized that the federal government is organized similarly to how the private sector treats special citizen classes: the Department of Veterans Affairs is for veterans, the Department of Education for students, and Social Security for seniors. Blake realized the needs of these agencies were likely quite similar to those of existing retail partners.
The Department of Commerce in 2012 didn’t want credit agencies and data brokers to prevent individuals from accessing the U.S. government. The idea was to create an identity ecosystem that leveraged the expertise and innovation of the private sector in partnership with the government to provide users choice in how they verified and shared their identities.
The commercial-first strategy helped the firm gain traction in the market, and made it a far more competitive candidate in a pool of big fish applicants. ID.me was the smallest (Microsoft, Ubiko, etc.), but would end up being the last one standing.
The grants not only provided $3.5M to the firm, but provided a contract vehicle - a way for other agencies to access ID.me services. All the agencies would have to do is write a letter of intent and Commerce could approve it.
Certifications
“If you’re going to operate in a regulated market, you have to have certifications.”
It’s hard to invest in over-the-horizon Research & Development capabilities as a small firm. For ID.me, getting government licenses and certifications was akin to investing in future R&D, because it would only lead to revenue in the distant future. However, for a firm focused on earning the public trust, and on verifying sensitive identity information, this was really a must-have, not a nice-to-have.
So the company took a different approach: they used initial government grant funding to begin to invest in certain certifications, in order of importance. National Institute of Technology and Standards (NIST) certifications that allowed ID.me to verify legal identity came first.
Next, ID.me sought FedRAMP certification, which validates contractors’ security standards and provides continuous monitoring of cloud products and services. For FedRAMP, ID.me was able to work directly through an agency to get audited rather than a third party provider. While not all agencies and customers will do this or want to do this, going through the agencies’ direct audits facilitated their initial contracts and accelerated the time to award, rather than forcing the company to fully certify before a contract could be awarded.
Even if you cannot afford the time or money to go all the way on certification, Blake encouraged listeners to consider how they can start a process to signal they are in good shape internally. While there is no one-size-fits-all playbook, there are general principles. And when to take a calculated risk and invest in licensing depends on the company’s cash position and runway.
Additionally, Commerce employed a third party assessor, RTI, that did assessments to justify the return on investment for its grant program to Congress. Rather than see this as a hurdle, ID.me saw it as an incredible opportunity and stamp of approval. Going through the RTI process provided the company with case studies that could attest to the value ID.me was creating for government customers.
As you’re working through these certifications, so much of this process is about building relationships and buy-in. Blake spoke about the need to bring all sorts of folks into the tent up front - not just end users - to help them feel good about the product and how it is built. This could mean IT folks, call center folks, and anyone else who might use or need to approve the product. Even if you do not know who they are initially, you’ll quickly learn: once a contract begins, they’re often the ones that slow down implementation. Blake’s advice? Write down how you get through it, build the playbook for future engagement, and get better each time.
Today, ID.me holds the following certifications:
● NIST 800-63-3: Credential Service Provider under Digital Identity Guidelines as fully certified provider of IAL2/AAL2
● NIST 800-53: Security and Privacy Controls for Information Systems and Organizations
● FedRAMP: Federal Risk and Authorization Management Program
● SOC 2 Type II: Service Organization Control (SOC) audit on how a cloud-based service provider handles sensitive information
● ISO/IEC 27001: Standard for information security management systems (ISMS)
Connect.Gov and Scaling in the Federal Market
Early on, ID.me became a part of a General Services Administration (GSA) program called Connect.gov. It was a $6 million contract that required a set of identity providers to plug into a credential broker, and allow federal agencies on the other side to use the system as a single sign-on platform.
Commercially, ID.me is a digital wallet and network, but in this instantiation, it played the role of identity provider.
This brings to light another common issue facing companies that enter the federal market: because you do not control the deployment environment, or the entirety of the system, the user experience with your product is not always what you want.
In ID.me’s case, the time between when a user selected ID.me and when the service was called was multiple seconds – a completely unacceptable time lag that killed the user experience. Additionally, when agencies tried to get pricing information on the setup from the sponsoring agency (GSA) it would often take months, or they would hear nothing at all. This harmed the company’s ability to deliver, and ability to grow.
Blake saw the writing on the wall - the program was headed for failure. One agency set standards, a different agency did contracting, and yet another did the program management. So the company began to plan for how it would architect the system from scratch, if asked. And as senior government executives lost faith in the program, one reached out and asked ID.me if they would be capable of taking on a larger role in the program. They could, and they did.
In 2016, the Department of Veteran Affairs launched VA.gov, a secure portal that gives Veterans direct access to their benefits. The VA.gov team then contracted ID.me to implement its first federal contract and use case: a secure authentication process, ensuring compliance with stringent federal security standards and allowing Veterans to use existing login credentials while enhancing their security. This time, ID.me got to collaborate closely with the U.S. Digital Service to devise a modern user experience.
This success unlocked other opportunities for ID.me, but it did not immediately change the speed and timeline. Blake joked that in their IRS work, “we stopped measuring sales cycles in months or quarters, but instead in the number of children [he] fathered since [they] first talked.” (The answer, by the way, was three!)
The ID.me Niche
“The road is littered with the carcasses of these B2B2C digital identity wallet efforts.”
Perhaps my biggest takeaway from this conversation is why ID.me succeeded where so many others failed.
So many big companies tried to create identity management solutions. From Microsoft to Google, Verizon, and Symantec - some of the biggest names in tech - they each tried and failed to release an identity verification product.
The answer is one word: niche.
ID.me didn’t start trying to solve all problems - or even the biggest problem. In the beginning, they were laser focused on the needs of one community: veterans. And they delivered, time and time again, in a way that generated trust with identity issuers (government) and identity users / consumers (people and companies). They were a neutral third party, rather than a vendor with an installed base or competitive process (e.g., Visa, not Amazon Pay). The biggest companies often start with the narrowest focus. While investors often push for a big “Total Addressable Market” (TAM), trying to build a category killer on day one is more likely a recipe for disaster than success.
Case Lessons
The interview is chock-full of insights – I’d strongly encourage you to listen to it if you can. Here are just a few of the takeaways that stuck with me:
Winners make their own luck: Every single company has some luck in its story. But you have to be willing to seize those opportunities. Blake was willing to get into different fights by saying “yes” to things, even when they were a bit outside his comfort zone.
Cherish those true believers and mentors: Mentorship is a common theme on CTV, and this episode is no different. Blake’s classmate (David Tisch) and angel investor (Paige Craig), as well as his friend Kelly Perdew were willing to take a big bet early, before it was popular to do so. Not only in the federal market, but in life. Find the people in your life who believe in YOU - more than your idea - and hold them close.
Read: Secretary of Defense Jim Mattis has a quote, “If you haven’t read thousands of books, you’re functionally illiterate.” Blake quotes easily from titans of industry such as Steve Blank and Jeff Moore, and he has frameworks that make virtually every situation manageable. There is no substitute for reading.
Perseverance and iteration: There have been multiple versions of ID.me, from a Craigslist for the military to a “gated garden” for veteran discounts. At every step, Blake and team followed demand – and they kept leading to the ability to verify identities of community segments. While he didn’t intend to build a utility, that was the use case that had broad appeal far beyond the military. And today his vision could not be bigger.
And yet, embrace serendipity: Blake told a story of an early moment in the company when he happened to be sitting next to a wealthy investor, Larry Cochran, on a plane. By the end of the flight, the investor decided to write a $75k check to ID.me, without which the company wouldn’t exist! You can’t predict the future, but you can seize those opportunities!
Stick to long-term thinking: In a business that measures sales cycles in new children, not quarters, short-term investors and operators are not gonna make it.
Winners look internally and do a great job. Be excellent at what you can control. Blake takes a strong stance against people who chalk up failure to adversity. He wants to be known as someone who will always be excellent at what he can control - even when he does not have influence over the broader picture. If you’re trying to make it in a business, when people give you responsibility for a task, if you rock that and own it, you will get more responsibility. It will get noticed. It will matter. Especially if the work sucks.
For more info:
On Blake Hall: https://www.linkedin.com/in/hallblake/
On ID.me: https://www.id.me/
Crossing the Valley:
Ep. 04: Growing ID.me to a $150M ARR Unicorn