2_use_case_name: Login.gov
3_agency: General Services Administration
3_abr: GSA
4_bureau: FAS (TTS)
8_topic_area: Other
8_question_type: Facial matching for identity verification
10_commercial_ai: None of the above.
11_purpose_benefits: The purpose of Login.gov's identity verification service is to establish a link between the claimed identity and the subject creating a user account. The facial matching AI component of this service provides enhanced controls to protect users from identity fraud and the government from fraudulent access. 

The benefit to the user is to provide a fast, convenient way to prove their identity remotely and protect the public from identity theft.

The benefit to the government is to that government partners may use this tool to verify the identities of people accessing government websites in a remote, unattended session and protect Government systems from fraudulent access.
12_outputs: The system delivers a match/no-match output.
16_dev_stage: Implementation and Assessment
17_impact_type: Rights-Impacting

18_date_initiated: 10/1/2023
19_date_acq_dev_began: 4/12/2024
20_date_implemented: 5/1/2024
22_dev_method: Developed with contracting resources.
23_contract_piids: 47QPCA24F0002
24_hisp_support: Yes
25_hisp_name: Public Experience Portfolio – GSA 
26_public_service: Enable increased self-service through an expansion of digital costumer service tools
27_public_info: No
29_contains_pii: No
30_saop_review: Yes
31_data_catalog: Yes
33_agency_data: The model is not trained or tuned using agency data.

GSA evaluated several facial-matching models in its Identity Proofing Performance Study using GSA data in a testing environment. More information about that study and the data it collected is available on this website and in GSA's Privacy Impact Assessment for the Study, which is located here under "GSA Identity Proofing Equity Study".

In addition to in-depth studies like above, GSA upholds best product monitoring practices, such as evaluating success rates at each identity verification step, including facial matching. 
34_data_docs: Documentation is complete: Documentation exists regarding the maintenance, composition, quality, and intended use of the training and evaluation data, as well as any statistical bias across model features and protected groups. 
37_custom_code: No
38_code_access: No – agency does not have access to source code.
40_has_ato: Yes
41_system_name: Login serves HISPs at VA, USDA, and SSA
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: Yes
45_compute_request: Other
45_question_type: Since this AI is a COTS SaaS solution, GSA does not currently have a process in place to train and develop the model. GSA will monitor its performance and include performance measures in contracts as needed.
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: Documentation has been developed: Complete documentation detailing model performance across a range of benchmarks, architecture, relevant features and information regarding the appropriate use of the model for predictive tasks has been created.
51_extension_request: Yes – Agency requested an extension for this use case.
52_impact_assessment: Yes
53_real_world_testing: Performance evaluation in operational environment: The AI use case has been tested in an operational environment before being fully implemented as a solution, or has been tested in simulated or controlled environment using operational or synthetic data.
54_key_risks: AI outputs that are biased in certain ways, including by being discriminatory or have a discriminatory effect. This was identified by agency personnel through literature reviews and initial testing of facial matching algorithms.
55_independent_eval: Yes – by another appropriate agency office that was not directly involved in the system’s development
56_monitor_postdeploy: Intermittent and Manually Updated: A plan for monitoring the AI use case is in place, and requires data science teams to work with DevOps engineers to manually update models at scheduled intervals, and create metrics to detect data distribution shifts between the operational environment and the training data for the model. 
57_autonomous_impact: No - Some individual decisions or actions require direct human oversight.
59_ai_notice: None of the above
61_adverse_impact: No
62_disparity_mitigation: To assess the potential risk of disparate outcomes, GSA is conducting the GSA Identity Proofing Performance Study (the “Study”) to understand how various vendors’ facial matching services perform across various demographics in uncontrolled environments similar to how this AI use case would operate.
- The preliminary results of the Study have already been helpful in acquisition and design decisions to mitigate the risk of biased outcomes. For example, Login.gov requested that BPA Call Order vendors provide both internal and independent research on their products, including requesting the NIST FRTE 1:1 Demographic Differentials Summary that examines the false negative rate of 1:1 facial matching algorithms for different demographics, which includes testing the algorithms with photographs of people who are African or African American.
- Over FY25, the Identity Proofing Performance Study team and academic partners will continue to evaluate the data and provide Login.gov with additional recommendations, which Login.gov will consider when maintaining and developing its service. For example, data from Login.gov’s operational identity-proofing process will be compared to similar datasets from the Study to develop and validate continuous performance indicators.

63_stakeholder_consult: Post-transaction customer feedback collections
65_appeal_process: Yes
67_opt_out: Yes