2-1--ADOT_ECD_DLSSU_RFP--NEC_Method_of_Approach_FINAL_2022-04-18.pdf

An NEC Response to the Arizona Department of Transportation – Enforcement and Compliance Division ECD Drivers License Security Software RFP – BPM004292

Section 1 – Method of Approach

Page 1-1

1 Method of Approach RFP References: APP Portal, Financial Questionnaire, Proposal Requirements for Method of Approach, Method of Approach; ADOT ECD DLSS RFP, Scope of Work

In this section, NEC Corporation of America (NEC) has described our understanding of the overall Scope of Work, the Department’s need, and of the Department’s environment in which these services would be provided. ADOT's requirements are in black text, and NEC's responses follow in blue text.

1. INTRODUCTION AND BACKGROUND

1.1. The Arizona Department of Transportation, Enforcement and Compliance Division, hereinafter referred to as the Department, is seeking offers from qualified firms or individuals, hereinafter referred to as the Contractor, for facial recognition software services (“facial recognition software services”, or “FR Services”) for use in conjunction with the credential issuance process to help eliminate fraudulent identity activities. The Department first implemented the use of facial recognition software in April of 2015. Every image captured for an Identification Card or Driver's License is verified against ADOT's database of approximately 7.5 million active ID/DL records with approximately 30+ million images. The average daily image processing volume is 5,000, with a peak of 10,000 images. The utilization of this software helps ensure the integrity of every credential issued by the Department in addition to helping the State of Arizona comply with the Real ID Act of 2005 by enhancing the security and fraud prevention standards utilized by the agency.

1.2. The Department is seeking proposals for facial recognition software services, wherein the Contractor provides such services from an outsourced (Cloud Hosted) solution and that includes all necessary installation, implementation, testing, hardware and software operation and support to provide the facial recognition software services.

Response: NEC understands and acknowledges. ADOT and NEC have worked together for the past seven years to enhance the fraud prevention services provided to the citizens of Arizona. NEC remains, as always, ADOT’s committed partner, focused on ensuring your success and supporting your continued passion on the credential issuance process to help eliminate fraudulent identity activities. To this effect we are proposing our most recent Reveal solution, which provides a web-based application and is built on our cloud-native NEC Digital Platform to provide system reliability and scalability.

2. CONTRACTOR'S MINIMUM QUALIFICATIONS

The contractor shall meet the following minimum qualifications:

2.1. Minimum of at least three (3) years’ experience operating and supporting a facial recognition software system.

2.2. Minimum of three (3) facial recognition software systems currently deployed in US public sector agencies, with an initial image enrollment of at least 5,000,000 images.

2.3. The Contractor shall have key personnel to assign with proven experience and expertise in the implementation and maintenance of facial recognition software services.

Page 1-2

Response: NEC understand and complies. The references described below include the same or similar products and services as those required by ADOT and are selective examples of NEC’s in-depth knowledge and experience in providing the most advanced multimodal biometric identification solutions, on time and within budget. Our client references, coupled with our highly regarded key personnel, demonstrate our compliance with ADOT’s requirements and validate the long-term partnerships NEC maintains through technology and industry changes and with our customers.

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

U.S. Department of Homeland Security, Office of Biometric Identity Management

NEC National Security Systems (NSS) supports the Department of Homeland Security (DHS) Office of Biometric Identity Management’s (OBIM) mission to provide biometric identification services to federal, state, and local government agencies in their fight against known or suspected terrorists, immigration violators, and other national security threats. NEC provides the multimodal matching solution for OBIM’s Automated Biometric Identification System (IDENT). NEC’s matching system runs on OBIM’s existing hardware within DHS data centers, reducing footprint, increasing matching efficiency, optimizing system performance, and lowering the overall cost of ownership.

NEC initiated the design, development, and implementation of a core biometric service for the identification and verification of face and iris images along with a custom interface/transaction layer used to integrate into OBIM’s existing orchestration systems.

While the multimodal capability NEC currently provides consists of NEC’s iris and face recognition algorithms, the system includes the option to incorporate fingerprint and latent print modalities. The matching system provides 1:1 iris/face verification, 1:N iris/face identification, transaction maintenance, and transaction queue functions.

In 2018, OBIM obtained an unlimited Enterprise License for face recognition from NEC. This Enterprise License can be used for face matching by all DHS agencies. Now, biometrics for IDENT are captured during the visa application process overseas, during entry and exit of U.S. visa holders at ports across the nation, to identify illegal immigrants, and to vet the identities of persons applying for jobs with the U.S. Secret Service. More than 10 million end users directly and indirectly use the data of the system.

U.S. Department of Homeland Security, Customs and Border Protection

The U.S. Customs and Border Protection (CBP) agency selected NEC to perform a biometric exit trial using face recognition at the world's busiest airport, Hartsfield–Jackson Atlanta International Airport. This successful trial demonstrated that CBP could use NEC technology to rapidly achieve a 2004 congressional mandate to use biometrics and, specifically, face recognition to document when foreign nationals exit the United States.

To help CBP meet this requirement, NEC deployed NeoFace® Express, a combination of hardware and integrated software for pilot testing at airline departure gates for international flights at major U.S. airports. The pilot quickly expanded and currently operates in more than a dozen major airports, including Chicago O’Hare, Detroit Metropolitan, George Bush Intercontinental and Hobby International in Houston, John F. Kennedy International in New York, Las Vegas McCarran International, Los Angeles International, Miami International, San Diego International, San Francisco International, Seattle-Tacoma International, and Dulles International near Washington, D.C.

Page 1-3

At departure gates, CBP uses NeoFace Express to capture the passenger’s face image and submit it for identification against CBP’s Traveler Verification Service (TVS), and, upon a successful match, provide a unique code that replaces a boarding pass scan at the boarding gate. For all travelers exiting the U.S. using CBP’s Biometric Exit (TVS) platform, CBP uses NEC’s AIM-ES matching engine for backend matching for all transactions, regardless of the at-gate solution provider.

This project supports CBP’s efforts to meet the congressional mandate for a Biometric Exit program, which greatly enhances the security and safety of our citizens.

Additionally, airlines and airports have seen about a 15% overall improvement in boarding times and higher level of customer satisfaction resulting from the frictionless boarding experience.

State Government of Washington, Department of Licensing

For the Washington Department of Licensing (DOL), NEC provided the matching algorithm deployed within Valid’s enrollment and facial recognition matching systems. Valid is driver license credential provider for Washington DOL.

The system enrolls up to 10,000 applicants per day using NEC's functions for biometric quality analysis, one-to-one matching, and one-to-many matching. The total photos enrolled in the facial recognition database equals approximately 27 million and DOL performs investigations using NEC's NeoFace Reveal web application on three workstations and other web-based investigation workstations.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

Key Personnel

For more than three decades, NEC's highly qualified personnel have excelled in the delivery of fully integrated, high-availability MBIS solutions for federal, state, and local law enforcement and public safety agencies, as well as private enterprises. With competencies in biometrics and ID solutions, data center solutions, data networks, servers and storage, cloud services, and managed services, NEC provides unique and state-of-the-art solutions. For more information about our project team, see Section 4, "Project Team."

3. GLOSSARY OF TERMS

Acronym Description

1:1 One to One

1:N One to Many

1:R One to Record

ADOT Arizona Department of Transportation

DL/ID Driver's License/Identification

ITG Information Technology Group

MVD Motor Vehicle Division

N:N Many to Many

Page 1-4

Acronym Description

SOC 2 Service Organization Control 2

TLS Transport Layer Security

Response: NEC understands and acknowledges.

4. CONTRACTOR (CLOUD) HOSTED SOLUTION

4.1. The facial recognition software services shall be housed on infrastructure that is managed by the Contractor with its Cloud provider. The Contractor would be responsible for procuring and managing all necessary hosting services and connectivity, as well as their updating as necessary.

Cloud based solutions shall support scalable production based images within a permanent test environment.

Response: NEC understands and complies. The ADOT ECD DLSS solution will be hosted in the Microsoft Azure Government cloud and NEC will be responsible for procuring and managing all Azure resources to meet the stated system requirements, anticipated system growth, and operational SLAs. In addition to the production environment, a reduced-size, full-function permanent test environment will be provided, which will support testing, training, and software release management.

4.2. Cloud Hosted Maintenance

4.2.1. The Contractor in conjunction with its Cloud provider shall be responsible for all repairs, maintenance for software, all necessary hosting services, and connectivity required to provide the facial recognition software services to the Department.

Response: NEC understands and complies.

5. CONTRACTOR SOFTWARE MAINTENANCE

5.1. All planned/scheduled facial recognition software services downtime (periods of time that the facial recognition software services are not available to the Department, as a result of scheduled contractor/cloud provider maintenance) shall be scheduled with the Department at least two (2) weeks in advance.

Response: NEC understands and complies. NEC will notify the Department at least two (2) weeks in advance during the weekly meetings, and then follow up via email.

5.2. All planned/scheduled downtime for maintenance shall be performed after hours of business, which are Monday through Friday 5:00 A.M. to 6:00 P.M. MST, excluding recognized State holidays and/or mandated furlough days. Any unscheduled service interruption of facial recognition software services to the Department that exceeds the service-levels described in the Scope of Work shall result in the imposition of liquidated damages to be described in section Severity Levels/Liquidated Damages.

Response: NEC understands and complies. NEC will schedule downtime after hours of business. Please see NEC's proposed SLAs and liquidated damages in our response to Table 1.

5.3. During the term of the contract, the Contractor shall be responsible for implementation, installation and maintenance of the facial recognition software updates to new versions, facial recognition

Page 1-5 algorithm enhancements, facial recognition software services enhancements/upgrades, service packs, hotfixes and patches, and shall be provided at no additional cost to the Department, as necessary for providing the facial recognition software services in addition to providing technical support to Department users.

Response: NEC understands and complies. NEC is offering its Evergreen support program. This provides new software releases including supplemental, minor, and major releases over the course of the contracted support. This encompasses both application software and biometric technology including newer facial recognition algorithms. Please refer to our full explanation of Evergreen support and our software release policy in Section 8.7.2 of the Technical Support response document.

6. CONTRACTOR SUPPORT

6.1. The Contractor shall assume responsibility for the following:

6.1.1. Providing technical support;

Response: NEC understands and complies. Maintenance and support will be provided by our Network Operations Center (NOC) and Site Reliability Engineering (SRE) teams. Please see Section 8, "Technical Support," for more information.

6.1.2. Facial recognition software services maintenance, and repairs;

Response: NEC understands and complies. Maintenance and support will be provided by our NOC and SRE teams. Please see Section 3, "Cloud Solution & Maintenance Requirements," and Section 8, "Technical Support," for more information.

6.1.3. Required upgrades to facial recognition software;

Response: NEC understands and complies. Please see Section 8.7.2 for NEC's software release policy.

6.1.4. Hosting services infrastructure, as necessary for providing the facial recognition software services;

Response: NEC understands and complies. The ADOT ECD DLSS solution will be hosted in the Microsoft Azure Government cloud. Please see Section 6, "Functionality and Reliability," for more information about NEC's hosting overview.

6.1.5. Maintenance includes technical support to Department users.

Response: NEC understands and complies. NEC will provide technical support to Department users.

6.2. The Contractor shall provide a toll free number and email address that will be available 24 hours a day, 7 days per week, to answer technical questions. During the hours of business, which are Monday through Friday 5:00 A.M. to 6:00 P.M. MST, excluding recognized State holidays and/or mandated furlough days, unlimited consultation and troubleshooting support will be provided.

When submitting problems or questions to the Contractor’s technical support team, the Department will provide the Department name, contact name, telephone number and e-mail address.

Page 1-6

Response: NEC understands and complies. NEC will provide a toll-free phone number and email address that will be available 24 x 7 to answer technical questions. NEC will also provide unlimited consultation and troubleshooting support. NEC understands that the Department will provide the Department name, contact name, telephone number, and e-mail address. Please see Section 8, "Technical Support," for more detailed information.

6.3. The Contractor shall provide access not only to their technical support or toll free number, but will also provide access to the necessary issue resolution personnel who can answer specific account questions and/or perform troubleshooting activities addressing all services provided within the contract. The Contractor shall provide tracking, analytics, and reporting for all support services.

Response: NEC understands and complies. NEC's NOC and SRE teams will answer specific account questions and/or perform troubleshooting activities addressing all services provided within the contract.

NEC will provide tracking, analytics, and reporting for all support services. See Section 8, "Technical Support," for information about our support services, and see Section 7.3, "Insights Workbench," for tracking, analytics, and reporting services.

6.4. Routine implementation of patches and/or fixes for the Contractor’s solution shall not interrupt the availability of facial recognition software services to the Department during normal business hours.

Response: NEC understands and complies. Routine patches and/or fixes will occur during scheduled and agreed to maintenance windows. All scheduled downtime and change management will be communicated, reviewed, and agreed upon with ADOT.

6.5. Performance Criteria

6.5.1. General Availability

6.4.1.1 The facial recognition software services shall be available 24 hours a day, 7 days per week, excluding pre-determined, by the Department, scheduled downtime for maintenance to be performed after hours.

Response: NEC understands and complies. The facial recognition software services will be available 24 x 7, excluding pre-determined, by the Department, scheduled downtime for maintenance to be performed after hours.

6.5.2. Problem Reporting/Tracking/Resolution

6.5.2.1. The performance standards specified within this document are of particular importance to the Department. Their purpose is twofold:

6.5.2.1.1. To define the service levels that must be maintained to meet the Department’s commitment to other Government Agencies, and most important, the public at large, and;

6.5.2.1.2. To provide a basis for ensuring the Department is receiving adequate value from the Contractor’s products and services.

Response: NEC understands and is committed to meeting performance standards for the ADOT ECD DLSS solution.

Page 1-7

6.5.2.2. Performance standards serve little purpose unless they can be monitored and tracked. As part of the contract, the Contractor shall perform data collection and reporting processes for monitoring and measuring their performance against contractual obligations. Service-level reports shall be accessible to the Department on demand. Additional report requirements shall include the ability for the Department to produce ad hoc performance reports. Performance report data shall be maintained for a period of five years.

Response: NEC understands and complies. NEC will perform data collection and reporting processes for monitoring and measuring their performance against contractual obligations.

Service-level reports will be accessible to the Department on demand. NEC's NeoFace FRS has ad hoc reporting capabilities; reporting depends on the data and system information available. NEC will work with the Department to determine which data specifically will be retained.

6.5.2.3. The Contractor shall have problem handling procedures in place for tracking the facial recognition software services. These procedures shall include how problems will be reported and documented, and the method(s) employed to determine Problem Severity levels for the prioritization and resolution of problem types.

Response: NEC understands and complies. NEC's NOC and SRE teams have procedures for tracking facial recognition software services, including how problems are reported and documented and the methods employed to determine problem severity levels for the prioritization and resolution of problem types. See Section 8, "Technical Support," for more detailed information on how NEC prioritizes, reports, and documents problems.

6.5.3. Severity Levels/Liquidated Damages

6.5.3.1. Every reported problem shall immediately be assigned a severity level according to the reported business risk and potential impact of the problem. The severity level determines how quickly the problem shall be resolved or escalated. The Contractor shall provide a severity level categorization and resolution time schedule to include a severity level Fee Amount in the following schedule (Refer to Table 1 Severity/Response/Communicate/Resolution Table attachment).

Response: NEC understands and complies. Reported problems are immediately entered into NEC's ticketing system with an assigned severity and resource or group responsible for addressing the problem.

6.5.3.2. Table 1 Severity/Response/Communicate/Resolution Table

Severity Response Time

Communicate Action Plan

Resolution Time

Liquidated Damages per Occurrence

1 min min hr Fee Amount if resolution time missed, plus additional fee % for each additional hour over resolution time.

Page 1-8

Severity Response Time

Communicate Action Plan

Resolution Time

Liquidated Damages per Occurrence

2 min min hr Fee Amount if resolution time missed, plus additional fee % for each additional hour over resolution time.

3 min hr hr Fee Amount if resolution time missed, plus additional fee % for each additional hour over resolution time.

Response: NEC understands and complies. NEC proposes the following for Table 1:

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Severity Response Time

Communicate Action Plan

Resolution Time

Liquidated Damages per Occurrence

1 30 min 240 min 12 hr $350 if resolution time missed, plus additional fee $125 for each additional hour over resolution time.

2 30 min 480 min 24 hr $125 if resolution time missed, plus additional fee $50 for each additional hour over resolution time.

3 120 min 48 hr 336 hr $50 if resolution time missed, plus additional fee $25 for each additional hour over resolution time.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

6.5.3.3. Table 2 Severity Level Assignment

Severity 1 Entire facial recognition software services are not available to the Department.

Severity 2 Significant portion of the facial recognition software services are not available to the Department.

Severity 3 Limited portion of the facial recognition software services are not available to the Department.

Page 1-9

Response: NEC understands and acknowledges. Please see NEC's exceptions, uploaded to the APP portal in the General Offer Requirements tab.

6.5.3.4 Table 3 Response/Resolution Time

Response Time The time elapsed between the report of a problem and the time it takes a technical support person to acknowledge, via phone or email, the issue with the tracking number.

Action Plan Diagnosis of issue and recommended plan of resolution.

Resolution Time The total time required to identify, diagnose, restore and permanently resolve the problem. All problems will remain open until satisfactory restoration of all the facial recognition software services are available to the Department and acceptance is affirmed by the Department.

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Response: NEC acknowledges and complies. NEC has incorporated applicable clarifications based on NEC’s previously negotiated contract with the Department within NEC’s Clarifications and/or Exceptions. Any such liquidated damages or incentives, agreed to by NEC, shall be subject to an 8% cap per occurrence, of the annual maintenance and hosting fees. The annual aggregate of any such liquidated damages or incentives paid by NEC to the Department shall not exceed 15% of the annual maintenance and hosting fees.

Liquidated damages shall exclude any delays arising from events beyond NEC’s reasonable control, including without limitation delays caused by the Department or any third party not directly controlled by NEC.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

6.5.4. Daily Processing Requirements

6.5.4.1. Daily Processing requirements are required to be followed. Failure to meet the Daily Process requirements may result in liquidated damages to be determined in Table 4 Minimum Performance Requirements. The Contractor shall provide a severity level Fee Amount in the following schedule. The Contractor may agree or propose alternative language that is fair and practical. The schedule shall include the following elements:

6.5.4.2. Table 4 Process Requirements Minimums Definitions

Image Enrollment for New Images

Statistics on enrollment success rate shall be documented with any reasons for failure to enroll included. Images meeting the quality standards incorporated in ISO/IEC 19794-5:2011 shall automatically enroll at a rate of 97% or better.

Page 1-10

Image Comparison for new Images

The facial recognition software services shall allow the Department to input ad-hoc images and conduct 1:N searches on a scheduled or on-demand basis. The results should be available between 5–10 seconds and shall not exceed 25 seconds. These results shall also be in a searchable format.

6.5.4.3. Table 4 Minimum Performance Requirements

Requirement Performance Measure

Occurrence Liquidated Damages per Occurrence

Image Enrollment for New Images

>97% Daily Fee Amount if resolution time missed, plus additional fee % for each additional hour over resolution time.

Image Comparison for new Images

<10 Seconds

- >5 Seconds Not to Exceed 25 seconds

Daily Fee Amount if resolution time missed, plus additional fee % for each additional hour over resolution time.

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Response: NEC acknowledges and complies. NEC has incorporated applicable clarifications based on NEC’s previously negotiated contract with the Department within NEC’s Clarifications and/or Exceptions. Any such liquidated damages or incentives, agreed to by NEC, shall be subject to an 8% cap per occurrence, of the annual maintenance and hosting fees. The annual aggregate of any such liquidated damages or incentives paid by NEC to the Department shall not exceed 15% of the annual maintenance and hosting fees.

Liquidated damages shall exclude any delays arising from events beyond NEC’s reasonable control, including without limitation delays caused by the Department or any third party not directly controlled by NEC.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

7. FACIAL RECOGNITION GENERAL REQUIREMENTS

7.1. The facial recognition software services shall be delivered and fully operational within no more than six (6) months after receipt of notice to proceed and shall provide the following:

7.1.1. Support enrollment of approximately 30 million+ images.

7.1.2. Support enrollment of an average of 5,000 and peak of 10,000 new images each business day.

7.1.3. Support capacity to enroll 100% of daily applicant volume and run the facial comparison for all new images near real time.

Page 1-11

7.1.4. Conduct the enrollment and processing of images from a queue accrued during the period of time between transfer of systems. The number of images is not defined due to the unknown variables of time and volume that will overlap between the possible discontinuation of the current systems and the implementation of its replacement.

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Response: NEC understands and will comply. NEC will implement our NeoFace Reveal solution, which will support enrollment of over 34 million images, support enrollment of an average of 5,000 and peak of 10,000 new images each business day, and support capacity to enroll 100% of daily applicant volume and run the facial comparison for all new images near real time. NEC will also conduct the enrollment and processing of images from a queue accrued during the period between transfer of systems. NEC understands that the number of images is not defined due to the unknown variables of time and volume that will overlap between the possible discontinuation of the current systems and the implementation of its replacement.

For the ADOT ECD DLSS project, NEC proposes the timeline shown in the figure below.

Figure 1-1: Proposed Implementation Timeline

To meet our proposed timeline, NEC has identified the following caveats, constraints, and dependencies:

• ADOT will provide the Notice to Proceed after detailed requirements are documented and signed by

ADOT.

• Feedback from ADOT on contract deliverable reviews (plans, documents, change requests, etc.) and participation in testing must be completed in a timely manner to ensure completion of tasks within the timeframes outlined in the Integrated Master Schedule.

• Any changes in scope after finalizing the Business Requirements Documentation can pose a risk to the project schedule, resource allocation, and overall project costs.

• ADOT will coordinate communications with users regarding the Project Management Plan and with external stakeholders.

Page 1-12

• Changes and/or additions to requirements throughout the project lifecycle pose potential risks to the project schedule, resource allocation, and overall project costs.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

7.2. The facial recognition software services shall support a core of approximately forty (40) concurrent users. The facial recognition software services shall be capable and scalable to accommodate additional users in the future.

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Response: NEC understands and complies. The NeoFace Reveal web-based application enables users with connectivity to the ADOT WAN to securely connect to the facial recognition system (FRS) via HTTPS, ensuring a secured connection. The solution will initially be licensed for 40 concurrent users to simultaneously access system resources. Should ADOT require additional users in the future, additional licenses can be acquired at any time.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

7.2.1. The facial recognition software services shall allow for enrollment of still images, scanned images, and video surveillance frames and shall be able to use images of varying quality levels such as:

7.2.1.1. varied lighting conditions;

7.2.1.2. small image sizes (300 x 300 pixels);

7.2.1.3. low JPEG image quality.

Response: NEC understands and complies. Our NeoFace algorithm has been extensively tested by the National Institute of Standards and Technology (NIST) as part of multiple facial recognition evaluations for its ability to detect and match faces in low-quality images, including variable lighting conditions, small image sizes, off-angle poses, and high image compression. As the current facial recognition provider for ADOT, NEC has already proven our ability to process ADOT’s facial images for both enrollment and investigation use cases, including both legacy and current enrollment formats and the broad range of image formats and quality used for investigation purposes.

7.3. Connectivity to the Department

7.3.1. To interface to the facial recognition software services, the Department anticipates that we will need to utilize an External Proxy. To connect to the External Proxy, the Department anticipates that we will utilize a Client ID and a set of Credentials to authenticate against the proxy to obtain an access token. Once authenticated, we anticipate that the vendor will call the APIs as required to perform updates for FR transactions.

Page 1-13

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Response: NEC understands and complies. Our proposed solution hosts the facial recognition services in the Azure Government cloud with a connection to the ADOT WAN and any other required network using site-to-site VPN tunnels configured on the Azure VPN gateway service.

Additional networking details will be discussed as part of the system design process, including the use of an external proxy, client-based authentication, and the APIs used to connect the ADOT MAX system to the new Reveal systems.

7.3.2. For user authentication the services/software shall provide MFA integration capabilities (for

ex. SAML, OAuth2) the Agency currently utilizes OKTA as its integration partner. Also the services shall provide support for user based access controls and role based access controls.

Response: NEC understands and complies. The NEC Digital Platform has been integrated with federated authentication services and supports SAML integration with ADOT’s authentication platform to enable MFA. The application uses a role-based authorization model in which each user is assigned roles that enable specific application functionality. Within the application, the user will only see the records and actions they are authorized for; all other functionality will be hidden.

Individual access to functions is controlled at a user level and can be managed through attributes within the MFA token, or as part of NEC's Insights Workbench administration client.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

7.3.3. All connectivity should be over HTTPS/TLS 1.2 or 1.3 (older versions are not acceptable within the State’s security policies and procedures).

Response: NEC understands and complies. All connectivity for the proposed solution, whether through the web client or the MAX interface, will use HTTP/TLS version 1.3.

8. IMAGE ENROLLMENT

8.1. The Contractor shall provide enrollment services to enroll approximately 30 million+ images.

Response: NEC understands and complies. As part of the project implementation, NEC will migrate the existing 30 million + images from the legacy database through a migration process. This will include quality analysis, template extraction, and database registration. As the current FRS provider, NEC has direct access to the existing image data and provides the option to transition images from the existing system directly, which will reduce the risk of transition, streamline the migration and catchup process, and minimize the migration timeframe.

8.2. Contractor must specify the length of time required to complete initial enrollment in the proposal.

If additional time is needed, then the Contractor must notify the Department in writing with justification of why the initial time frame may not be met.

Page 1-14

Response: NEC understands and complies. Based on our knowledge of the existing image and demographic data, NEC estimates that the full data migration process of the existing 34 million records, including planning, initial test runs, full migration, and record adjudication, will take 4 months. This timeframe has been included in our initial draft schedule. Throughout the implementation process, NEC will maintain consistent communication with ADOT and will notify the Department in writing should the anticipated timeframe not be achievable.

8.3. The facial recognition software services shall provide a manual enrollment process for any records that are rejected in the automated enrollment process (i.e., “failure to enroll” records). A report of all rejected errors shall be provided at time of occurrence.

Response: NEC understands and complies. As part of the image migration process, NEC performs a set of quality checks on the provided image data including the ability to detect a face, overall facial quality, and facial frontal pose. Should an image fall outside configured thresholds it will be placed in a quality review queue where an operator can review the image and potentially perform enhancements, which will enable the image to be enrolled. This failure to enroll queue will be available in real time allowing operators to report on and fix record errors as they occur. As the existing FR provider, NEC has already performed an initial migration of the ADOT images including any manual updates and expects very few images to fall out as part of the new migration process.

9. DAILY PROCESSING PROCEDURES

9.1. Image Enrollment for New Images

9.1.1. The facial recognition software services shall be capable of enrolling all digital images captured by the Department on a daily basis (an average of 5,000 and a peak of 10,000 new images each business day).

Response: NEC understands and complies. Cloud-based resources will be allocated for both workflow and matching processing to enable the system to support an average daily enrollment workload of 5,000 submissions per day, a peak daily enrollment workload of 10,000 submissions per day, and a peak hourly enrollment of 1,000 per hour.

9.1.2. Statistics on enrollment success rate shall be documented with any reasons for failure to enroll included. Images meeting the quality standards incorporated in ISO/IEC 19794- 5:2011 shall automatically enroll at a rate of 97% or better.

Response: NEC understands and complies. The existing FRS provided by NEC has a successful enrollment rate in excess of 99.5%, exceeding the target goal of 97%. As part of the daily enrollment process, all images will be checked for faces and image quality with any exception reasons added to the audit trail.

9.1.3. The facial recognition software services shall provide a manual enrollment process for any records that are rejected in the automated enrollment process (i.e., “failure to enroll” records).

Page 1-15

Response: NEC understands and complies. Any images that fail automatic image processing will be queued for Quality Control review as part of the QC edit process. In general, images may fall to the QC edit process for the following reasons:

• Facial image cannot be detected using default parameters

• Multiple facial images were detected

• Detected facial image did not meet facial quality threshold

• Detected facial image did not meet frontal pose threshold

As part of the QC Edit process users can manually review the images, adjust cropping, perform image enhancement, and manually mark landmarks (eye position) to successfully register images to the database. Images that cannot be corrected can be manually rejected with a reason selected for the reject.

9.1.4. Any transfer of the images and customer information files shall utilize REST services.

Processing entails enrollment, 1:1 matching, 1:R matching, 1:N matching and report generation.

Response: NEC understands and complies. We have developed and deployed the interface from the FRS to the MAX system using REST-based services and anticipate using this interface moving forward to simplify the development and testing for the new system.

Once images have passed the quality processing step, FR matching will be performed to detect fraud within the system. The following matching will be performed on incoming enrollment images:

• All images will be matched 1:N against the rest of the database to detect duplicate images across subjects. Any matches that exceed a configurable 1:N threshold will be queued for operator review as part of the verification process.

• If the image is a renewal image a 1:1 match will be performed against all previous enrollment images for the subject (1:R) looking for potential mismatches. Any matches that fall below a configurable 1:1 threshold will be queued for operator review as part of the verification process.

9.2. Image Comparison for New Images

9.2.1. The facial recognition software services shall be capable of performing 1:R comparisons for all digital images captured by the Department on a daily basis (an average of 5,000 and peak of 10,000 new images each business day), using the new image against previously stored image(s) for the same customer number. The facial recognition software services shall identify any absolute and suspect non-matches in the 1:R string of images. The results shall be in a searchable format.

Response: NEC understands and complies. Cloud-based resources will be allocated to enable performing 1:R comparisons on all daily digital images submitted for enrollment where previously stored images for the customer exist. Each match will result in a matching score, which will then be compared to a 1:1 match threshold. Any images exceeding the match threshold will be considered an absolute match. Images falling below the threshold will be considered suspect non-matches, and images and will be queued for operator review.

Page 1-16

9.2.2. The facial recognition software services shall be capable of comparing daily images (an average of 5,000 and peak of 10,000 new images each business day) to every other image in the enrolled database (1:N). Where comparisons meet or exceed a mutually agreed upon match threshold, the facial recognition software services shall generate a candidate match list that is sorted from “most likely” to “least likely”. The results shall be in a searchable format to be specified in the Contractor’s proposal.

Response: NEC understands and complies. Cloud-based resources will be allocated to enable performing 1:N comparisons on all daily digital images submitted for enrollment to every other image enrolled in the database. Each match will result in a matching score, which will then be compared to a 1:N match threshold. Any images exceeding the match threshold will be considered a possible match, placed in a candidate list, and will be queued for operator review. Candidate lists will be sorted by matching ranked from most likely to least likely.

9.2.3. The facial recognition software services shall provide the ability for the Department to configure the image match threshold when and if the Department finds this to be necessary.

Response: NEC understands and complies. Both 1:1 and 1:N matching thresholds can be configured in NEC’s Insight Workbench administration client. Department administrators will have access to the Insights Workbench and can change these parameters when necessary. See Section 7.2, "Insights Workbench," for more information.

9.2.4. The facial recognition software services shall allow the Department to input ad-hoc images and conduct 1:N searches on a scheduled or on-demand basis. The results should be available between 5–10 seconds and shall not exceed 25 seconds. These results shall also be in a searchable format.

Response: NEC understands and complies. The Reveal web application includes both investigation case management and a quick search capability where ad hoc image and video files can be uploaded by an operator and searched on demand. Cloud-based resources will be configured to provide results to ad-hoc searches in a 5–10 second range after the operator completes the quick search submission with full search time not to exceed 25 seconds. Results of ad-hoc searches are placed in a verification queue where operators can review candidate results and perform manual comparison as part of search verification.

9.3. Output of Comparisons

9.3.1. The output provided by the facial recognition software services, resulting from the comparison process, shall include the following:

9.3.1.1. A file of customer numbers for all images that passed both the 1:R and 1:N comparisons

9.3.1.2. A queue of images that failed the 1:1 or 1:R comparison (absolute and suspect non-matches)

9.3.1.3. A queue of images that failed the 1:N comparison (absolute and suspect matches).

Page 1-17

Response: NEC understands and complies. The comparison process may result in two potential outcomes as a result of the 1:1 and 1:N matching processes.

• Images that have no exceptions (suspect non-matches from the 1:R comparison or potential matches from the 1:N comparison) will have their matching results audited, be registered to the facial gallery, and return the result to the MAX system in real time.

• Images with potential exceptions will have the comparison results audited but will be queued for manual operator review in the level 1 verification queue.

9.4. Exceptions Processing

9.4.1. The facial recognition software services shall allow for multiple levels of exceptions review with different access roles and update authorities.

Response: NEC understands and complies. NeoFace Reveal supports multiple review queues for adjudication of potential fraud identified as part of the 1:1, 1:R, and 1:N comparison processes.

Access to individual queues will be controlled as part of the integrated RBAC.

9.4.2. The facial recognition software services shall support at minimum two investigator roles and access levels: level 1 and level 2. The role of level 1 is to either clear an exception or pass the exception to the level 2 queue for review. The role of level 2 is to either clear an exception placed in the level 2 queue, or mark it for investigation.

Response: NEC understands and complies. The system will be implemented with a multi-level review process for adjudication of potential fraud identified as part of the 1:1 and 1:R comparison processes. Access to each level will be controlled as part of the integrated role-based access control (RBAC) policy:

• Level 1 will provide initial review of the comparison results, enabling an investigator to clear the exception or confirm potential exceptions, which can be reviewed by more senior investigators.

• Level 2 will provide secondary review or exceptions cases identified in level 1. Investigators at level 2 will either clear the exception marked for investigation whereby a case will be created, and the comparisons results will be made available for additional review.

9.4.3. The facial recognition software services shall have the functionality that the first level of the inspection process (level 1) requires a minimum two-person approval for clearing an exception. Using a one or two-person approval process shall be controlled by the system administrator.

Response: NEC understands and complies. The enrollment workflow will be configured to enable dual review of exceptions prior to clearing. The secondary level 1 comparison review will be performed blind to ensure the first investigator decision does not bias the second investigator. The following workflow diagrams the review process through levels 1 and 2:

Page 1-18

Figure 1-2: Enrollment Workflow

9.4.4. When using the two-person level 1 approval process, the facial recognition software services shall:

9.4.4.1. Allow for the level 1 investigator role to have permissions to view any exceptions and either pass to a second level 1 investigator for confirmation of no-fraud or pass to a level 2 investigator for review.

Response: NEC understands and complies. Level 1 investigators will be able to see any exceptions occurring from either the 1:R or 1:N comparison processes. If the first level 1 investigator confirms the exception, the transaction will be placed in the level 2 queue for investigator confirmation. If the first level 1 investigator clears the exception, the transaction will be placed back in the level 1 queue for review by second level 1 investigator.

9.4.4.2. Allow the second level 1 investigator to clear an exception if the first level 1 investigator has marked the exception as no-fraud and they agree that no fraud exists. If the second level 1 investigator does not agree that the exception should be cleared, the exception is automatically passed to the level 2 queue.

Response: NEC understands and complies. First level 1 investigators will be able to see any exceptions that occur from either the 1:R or 1:N comparison processes. Second level 1 review will be performed blind (primary review decision will not be marked) and cannot be performed by the same investigator as the first level 1. If the second level 1 investigator also clears the exception as no fraud, the FRS will complete processing and return the result to the MAX system. If the second level 1 investigator feels the exception should be investigated, the transaction will be queued for level 2 review.

9.4.5. When using the one-person level 1 approval process, the level 1 investigator role shall have permissions to view any exceptions and either clear the exception or pass to a level 2 investigator for review.

Page 1-19

Response: NEC understands and complies. If the system is configured for a single level 1 review, that investigator will have the ability to view any exceptions and mark a decision to clear or investigate for each. If all exceptions are cleared, the transaction will be sent as a clear result to the MAX system. If any exception is marked for investigation, the transaction will be routed for level 2 review.

9.4.6. The facial recognition software services shall allow the level 2 investigator to either clear an exception or place it in the investigation queue.

Response: NEC understands and complies. The level 2 investigator review step will enable investigator to review all candidates and individually mark each candidate as no fraud or investigate.

If any candidate is marked for investigation, a new case will be created, and the initial comparison results loaded into the case for further review.

9.4.7. The facial recognition software services shall present level 2 investigators with the full set of records identified as exceptions.

Response: NEC understands and complies. All potential candidates identified as part of the 1:R and 1:N comparison processes, not just those marked as potential exceptions, will be available for review by the level 2 investigator.

9.4.8. The facial recognition software services allow a level 2 investigator to filter on given information when viewing exceptions in order to narrow the search for matches.

Response: NEC understands and complies. All verification processes, including level 1 and level 2, provide sort and filter capabilities, enabling investigators to narrow down search results as part of the verification process.

9.4.9. The facial recognition software services shall allow for a level 2 investigator to query a record returned as a possible match to run a 1:N comparison against all photos on the database.

Response: NEC understands and complies. Enrollment images identified for investigation by level 2 investigators will automatically have an investigation case created with which investigators can perform additional 1:N queries against the database to further investigate the fraud.

9.4.10. The facial recognition software services shall bypass the level 1 investigator process and go straight to the level 2 queue if the photo matches a photo that has been flagged as potential fraud.

Response: NEC understands and complies. The system will support a fraud flag set at the person level in the database. Individuals previously identified with fraudulent activity will have the fraud set and any 1:R or 1:N comparison results containing a candidate flagged for fraud will be automatically placed in the level 2 queue for investigator review.

9.4.11. The facial recognition software services must provide an escalation bypass option for all processing levels.

Response: NEC understands and complies. An investigation override option can be included at all levels of verification that will cancel the verification and automatically crate an investigative case for fraud…