Document ID: chunk:federal_register_of_legislation:F2024L01435:front:0:p5
Version: federal_register_of_legislation:F2024L01435
Segment Type: other
Provision Reference: 
Character Range: 12472–15651

and can include document tampering or creation of a counterfeit document.
document fraud instrument means an object or image used in a credential fraud attack.
Example: A forged or counterfeit photo ID.
document fraud instrument species means a class of document fraud instruments created using a common production method and based on different persons.
FIDO document authenticity verification requirements means the requirements developed by the FIDO (Fast Identity Online) Alliance for testing eIDVT solutions.
Note: At the time this instrument was made, located at https://fidoalliance.org/specs/idv/docauth/document-authenticity-verification-requirements-v1.0-fd-20220815.html.
test set has the same meaning as in section 6.2 of the FIDO document authenticity verification requirements.

2.2  Biometric testing entity
 (1) Biometric testing must be conducted by a person that:
 (a) uses personnel experienced in conducting biometric testing;
 (b) is, or uses, a laboratory accredited against ISO/IEC 17025:2017 that is certified for the assessment of biometric technology testing standards;
 (c) has, and applies, a policy for working with human test subjects that has been approved by a relevant national body;
 (d) has established test methods for:
 (i) presentation attack detection testing informed by ISO/IEC 30107-3:2023, if conducting testing of presentation attack detection technology; and
 (ii) testing of accuracy of the biometric matching algorithm informed by ISO/IEC 19795-2:2007, if conducting testing of a biometric matching algorithm; and
 (e) is independent from the design, implementation, operation and management of the accredited entity's accredited services and DI data environment and is:
 (i) external to the entity; or
 (ii) if the entity is part of a group, external to the group.
Note 1: An ISP that conducts authentication using biometric information using custom biometric capability must ensure its presentation attack detection technology is tested by a biometric testing entity—see item 4 in the table in section 3.13.
Note 2: For paragraph (d), a person accredited to conduct presentation attack detection testing according to ISO/IEC 30107-3:2023 and/or biometric performance testing according to ISO/IEC 19795-2:2007 under the National Voluntary Laboratory Accreditation Program coordinated by the National Institute of Standards and Technology ordinarily would meet the requirements in that paragraph.
Note 3: For testing of eIDVT, the biometric testing entity must also meet subsection 2.7(2).
 (2) A person that meets all the requirements in subsection (1) is a biometric testing entity.

2.3  Testing of presentation attack detection technology
 (1) In this section:
level A presentation attack instrument species means a category of presentation attack instruments which:
            1.      have an elapsed creation time equal to or less than one day;
            2.      can be created or undertaken by a layperson;
            3.      can be undertaken with standard equipment; and
            4.      involve a source of biometric information which is easy to obtain such as a photo from social media or a voice recording.
level B