2023-02918. Submission for OMB Review; GSA Equity Study on Remote Identity Proofing

AGENCY:

Technology Transformation Services (TTS), General Services Administration (GSA).

ACTION:

Notice of request for comments regarding a new request for an OMB clearance.

SUMMARY:

Under the provisions of the Paperwork Reduction Act, GSA will be submitting to the Office of Management and Budget (OMB) a request to review and approve a new information collection requirement. Respondents to this information collection will test several remote identity proofing services and provide demographic information to help better understand the behavior and impacts of remote identity-proofing technologies.

DATES:

Submit comments on or before March 13, 2023.

ADDRESSES:

Written comments and recommendations for this information collection should be sent within 30 days of publication of this notice to www.reginfo.gov/​public/​do/​PRAMain. Find this particular information collection by selecting “Currently under Review—Open for Public Comments”; or by using the search Function.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information should be directed to Tiffany Andrews or Gerardo E. Cruz-Ortiz by phone [phone] or via email to [e-mail].

SUPPLEMENTARY INFORMATION:

A. Purpose

The GSA “Equity Study on Remote Identity Proofing” will assess the impact of ethnicity, race, gender, income, and other demographic factors on the components of identity proofing, which is the process of verifying that a person is who they say they are. GSA will test remote identity-proofing tools that include both biometric checks using facial verification technology as well as non-biometric methods like mobile-device account ownership and credit history. NIST's SP 800-63-3 guidelines for remote one-to-one identity proofing serve as a framework for the study.

GSA will publish an anonymized, peer-reviewed report of our findings, to help us make informed decisions regarding identity verification capabilities. The report will present a statistical analysis of failures and successes for the proofing checks and explore the causes behind negative or inconclusive results. These results will help GSA understand the current technological barriers to equitable identity-proofing services for the public.

GSA will partner with a recruitment partner to engage the general American public to participate in the study. Respondents will be asked to share demographic information to help GSA understand if and how these variables impact the performance of various remote identity-proofing solutions; GSA will collect the respondent's race, ethnicity, gender, age, income, educational level, and other demographic data.

The identity-proofing workflow will also collect the following personally identifiable information (PII): a picture of the respondent's government-issued identification card (including face reference, name, date of birth, physical address, and document number), Social Security Number, phone number, and a picture of the respondent's face. Identity-proofing vendors will delete all respondent data from their systems within 24 hours of collection. GSA will retain records of this study in accordance with GSA's retention schedule for Customer Research and Reporting Records and any other applicable federal records schedules (See: https://www.archives.gov/​files/​records-mgmt/​rcs/​schedules/​independent-agencies/​rg-0269/​daa-0269-2016-0013_​sf115.pdf).

While respondents are using the study's web-based platform, GSA will also collect the personal mobile device's hardware and software data as well as device-behavioral information (how the device and its applications are used).

GSA will share de-identified demographic information, and identity-proofing results with an academic partner that will analyze the results and assist GSA in publishing a peer-reviewable academic paper.

Upon completion of the study, respondents will be asked to complete an exit survey that gathers additional demographic information, consent for publication, and feedback on the study.

Respondents who complete all study questions will be compensated for their participation in this study.

B. Annual Reporting Burden

Respondents: 2,000-4,000.

Responses per Respondent: 1.

Hours per Response:.75 hours.

Estimated Total Burden Hours: 3,000.

C. Discussion and Analysis

A 60-day notice was published in the Federal Register at 87 FR 57496 on September 20, 2022. GSA received two public comments discussing the following three areas:

— Mobile Device Model: The commenter discussed concerns about the impact of the mobile device type and model as well as its capabilities and age on the results of the study. GSA is aware of this potential variable and will explore the hypothesis that device type and age might influence proofing results. The study platform collects device data including mobile browser, operating system, and device model year; this data will enable an analysis of proofing results with respect to the devices' capabilities.

— Human Verification Concerns: The commenter recommended that GSA leverage automated systems given their higher performance over human evaluators. This study will not consider any identity proofing product that relies on or includes human verification or assistance. Furthermore, minimizing the number of people who are involved in verifying someone's identity will improve the system's privacy and security.

— Other Biometric Proofing Methods: The commenter suggested other biometric proofing methods including “Iris, palm, fingerprint, and voice” which are common in other parts of the world. GSA may consider these ideas for future studies.

Commenters found “little to no burden” in our information collection. GSA had already implemented the recommendation to use mobile devices. The other recommendation was to gather other biometric pieces of information that cannot be collected with our currently available commercial services nor fit within the required timeline.

GSA is consulting with the Center for Information Technology Research (CITeR) and researchers at Clarkson University to ensure that the statistical design of the study is sound. GSA representatives have met with staff from other government agencies that have conducted similar research such as DHS's Science and Technology group (DHS S&T). Both of these groups have agreed that the collection is useful and necessary to improve the delivery of government services.

Obtaining Copies of Proposals: Requesters may obtain a copy of the information collection documents from the Regulatory Secretariat Division by calling 202-501-4755 or emailing [e-mail]. Please cite OMB Control No. “3090-XXXX, GSA Equity Study on Remote Identity Proofing” in all correspondence.

Beth Anne Killoran,

Deputy Chief Information Officer.