Attachment A Amd 1- SOO for Equity Study Outreach_Recruiting.docx

Appendix A - Terms and Conditions for Testing Participants and Recruitment

General Services Administration Federal Acquisition Service Technology Transformation Services 1800 F St NW | Washington, DC | 20405

TTS Equity Study Outreach and Recruiting Support Statement of Objectives Amendment 1 - 09 Jun 22

1.0 Background and Purpose

GSA’s Login.gov is the public’s one account for the government and provides identity proofing and authentication services to all Americans. To ensure Login.gov’s service and its vendor components provide equitable access, GSA seeks to fund and execute a study to analyze the fairness and equity of remote identity proofing software, specifically on the document verification and biometric aspects (“selfie” matching and liveness detection).

This remote identity proofing study will also assess vendor performance on the non-biometric aspects of the NIST SP 800-63-3 Identity Assurance Level (IAL) 2 flow.[footnoteRef:0] This will allow for a more informed comparison on drop-off rates, i.e., to what extent a tester passes or fails the flow is caused by the biometric versus the non-biometric aspects of the IAL2 proofing process. [0: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63a.pdf

The study will be designed, executed on and analyzed by a team led by TTS Solutions assisted by contractor support and team members that include an academic institution, a recruiting service, and an accredited Institutional Review Board (IRB).

The output of this study is a peer-reviewed report published by GSA in 2023, which will assist GSA to make better informed decisions regarding identity verification capabilities. The outcome will also enable Login.gov to provide more equitable access to diverse populations that need to proof their identity.

The overall study consists of four main phases upon GSA approval:

*Note: Phase II - Test Execution and Analysis may be shortened depending on how quickly participation requirements are met. Additionally, some activities may overlap between phases, which may impact overall duration.

The outcomes of this study are threefold:

1. Comparative vendor equity performance, based on a statistically significant user sample;

2. Pass rate data, including relevant metadata, failure reasons and number of attempts;

3. Actionable insights for the purpose of potential subsequent vendor selection

During the course of this study, outcomes will be presented through easily digestible dashboards, and at a regular cadence. Lessons learned will be captured for the purpose of conducting potential follow-on studies.

2.0 Performance Objectives

As an integral part of the study, TTS requires contractor support to perform recruiting services and participant outreach services. The recruiting service will recruit 2,000 testers across various ethnic groups, age ranges, household incomes, and education levels. The participant outreach services will work with TTS Solutions to develop a participant outreach strategy, and/or partner with recruiting services to reach target demographic groups.

2.1 Outreach Services (FFP)

Contractor shall provide holistic outreach (organic and ad efforts) plan as part of a developed and coordinated marketing strategy to work with local communities and organizations. This work effort will ensure that demographic goals are met in the respondents to the Equity Study and direct the Recruiting Services as necessary to meet those goals.

2.2 Recruiting Services (FFP)

The study is looking to work with companies that can assist in targeted advertising, working with local communities/ organizations to reach out to the desired demographic audience for the study. As such, the Government requires the contractor to provide a recruitment plan as part of it’s proposal. The plan shall detail how the contractor will recruit and deliver 2,000 unique testers across the US to test five different ID Authentication Vendor Platforms.

The following activities should also be included in Recruitment Plan:

· Use targeted advertisements (social media, platforms)

· Leverage an existing database with previous testers

· Work with Participant Outreach Service for Setup Tester Recruitment campaigns based on specific demographic requirements to ensure target of 2000 testers is met

· (Male/Female/Non-Binary Other), age ranges, household incomes, education levels

· Provide incentives for testers to participate in study

· Details for how incentives provided will be allocated and reimbursed (receipts required for payment)

· Demonstrate how PII data will be collected, maintained and adequately safeguarded.

· Milestones for reporting and submitting final report deliverable

2.2.1 Collection and Retention of Data

During this equity study, GSA will not store any PII. Recruitment Partner/Participant Outreach Service Vendors will retain the data for 90 days after the equity study and then delete the data. If however, a participant agrees to participate in future studies, the name and email will be retained. A separate consent is obtained by Recruitment Vendor for future studies. All the vendors participating in this study will delete the data no later than 30 minutes after transaction ends and no PII will be saved at the conclusion of this study.

2.2.2 Final Report

After the third party vendor determines whether the participant passes or fails their identity proofing, the third party will return the pass/fail response back to GSA. GSA will then group the study data by demographic data field and pass/fail rates, remove all PII collected during eligibility screening, and send this report to Study Evaluator to develop the final report. This report will be sent securely via (SFTP/Share file).

The Recruitment Partner will purge all PII data at the end of the study and provide to GSA a Final Report with the outreach materials used, quantity of participants per demographic group surveyed with a full accounting of incentives used (if applicable).

2.3 Desired Outcomes:

The testers shall be evenly (min. 385 Tests/Group) spread across the following ethnic groups and spread evenly across the 50 states and territories:

· White/Caucasian

· African American

· Hispanic/Latino

· Asian/Pacific Islander

· Other

The testers will also be spread evenly (Min. 385 Tests/Group) across the following Categories:

Gender

· Male

· Female

· Other / Non-Binary Age Range

· 18 to 25

· 26 to 40

· 41 to 55

· 56+ Household Income Range

· Under $25k / year

· $25k - $75k / year

· $75k - $100k / year

· $100k+/ year Education Level:

· Less than high school

· High school graduate

· Some college or university

· College graduate + Testers will also be required to complete a short survey to rate the usability of each application, their level of comfort with using similar technology for remote ID verification purposes at the end of the study.

2.4 Metrics for Success:

Key Metrics to be captured:

1. Meet established minimum respondents to each identified demographic category

2. Meet minimum demographic category in the time allocated for the Study (3 months)

3. Provide final report no later than agreed upon due date

4. Perform goals within planned budget for all services

2.5 Assumptions:

Recruiting service will not be responsible for initiating direct contracts with software vendor participants. Recruiting service will not be responsible for any custom development/code authoring work to facilitate the testing or data retrieval.

2.6 Constraints

The following are known constraints:

1. GSA provided Terms and Conditions (Appendix A) will be passed to all testers.

2. A favorable initial fitness/suitability determination must be granted for each contractor employee and a Tier 2 or higher background initiated before access to PII/CIU is granted. The authority and access shall be determined by the Contracting Officer, Data Owner, and the system’s Authorizing Official. Each system’s Authorizing Official with the request of the Contracting Officer or Data Owner shall evaluate the risks associated with each such request.

3. Receipts for tester incentives shall be provided prior to reimbursement

3.0 Performance Work Statement

As part of its response to the solicitation, the vendor must submit a Technical Approach/Performance Work Statement (PWS) in response to this SOO that describes the required results in clear, specific, and objective terms with measurable outcomes. Provide detailed explanations of how all listed objectives and requirements will be met. Include appropriate (1) tools & methods to be employed, tasks to be performed, mix-of-labor level-of-effort to perform the tasks, and a deliverables table (including artifacts) which shall detail the corresponding rate of frequency and completion date of each deliverable; (2) the principal assumptions upon which the approach is based; and (3) means by which the success of the Contractor’s efforts towards meeting those outcomes can be measured and communicated. Note that the submitted PWS will become the property of the Government and will be included as part of the award.

The PWS should include the following deliverables (at a minimum):

Milestones Outreach Plan Recruiting Plan Participant Incentive Reimbursement & Allocation Plan Final Report Quality Control Plan (detailed below)

4.0 Quality Control Plan

Performance will be measured in an effort to ensure the expected outcomes or performance objectives are achieved by the Contractor. The Contractor shall develop and maintain an efficient and effective quality control program to ensure performance of contractual requirements. The Contractor shall deliver to the Government within 10 business days of award a Quality Control Plan (QCP) detailing processes to ensure that the deliverables that were accepted as part of the PWS requirement in Section 3.0 are met.

Elements of the QCP shall include the following:

1. Overview of Contractor’s quality control process.

2. Overview of Contractor’s quality control approach to the unique scope or work detailed in this SOO.

3. Overview of the Contractor’s quality control approach to correct or address shortcomings in performance and quality standards.

Unless otherwise stated, the Government will review the submitted QCP and notify the Contractor of findings within 10 business days. The Contractor shall meet with the TTS COR to review the status of other deliverables. The Government will review the QCP and supply it’s own independent quality assurance surveillance plan.

5.0 Period of Performance

Vendor shall propose milestones to meet the Government’s deadlines above. Award is estimated to be made no later than 01 Aug 22.

Recruitment Partner Terms of Use:

Terms of Use

These Terms of Use describe the terms and conditions under which you will act as a tester for <recruiting service>, a company incorporated in the US with offices at <address> ("recruiting service", "we," "our") for the purposes of participating in research studies.

For purposes of providing these studies, we find and engage testers to test different software platforms as required by our clients who sponsor the tests. The testers will need to have an operational mobile phone with working wi-fi or data connection to conduct the test.

By indicating your acceptance in the "I Agree" field, you are agreeing to abide by and be bound by these Terms of Use. If you do not agree to these Terms of Use, do not fill in the "I Agree" field and you will not be able to act as a tester for <recruiting service>.

1. Registration

In order to participate as a tester for <recruiting service>, you will need to submit a screening questionnaire which will determine your eligibility to participate in the test. The eligibility criteria are based on the different demographic categories like ethnicity, age, ID state, household income, etc. The demographic requirements vary for each study.

When you sign up with <recruiting service> as a tester, <recruiting service> will collect personally identifiable information about you such as your name, email address, ethnicity, age, gender, education, employment status and any other information that is required for the study. You agree to the collection and use of such personally identifiable information and you represent that the information you provide to <recruiting service> will be authentic, accurate and complete and made in accordance with <recruiting service> policies and procedures.

In addition, <recruiting service> may collect details of your visits to the software we ask you to test, including, but not limited to location data, weblogs, IP address, operating system, browser type, and other communication data, if that is included as part of the study.

2.Tester Obligations

You must be at least 18 years of age to participate in one of our tests.

Before initiating a test:

· Make sure to read and follow all tasks/questions carefully.

· When answering questions or following instructions, provide authentic, accurate and complete answers.

· As you interact with the software/application under test, be sure to follow the instructions provided to step through the test.

· Make sure you have a working iPhone or Android Smart phone with a valid Wi-fi or Data internet connection to perform the test.

You are responsible for having access to all of the equipment needed to conduct one of our tests:

If you do not comply with the aforementioned requirements your submission may be rejected and you will not be compensated for your efforts.

<recruiting service> makes no representation or warranty that you will be selected to perform testing services.

You agree not to contact clients who have purchased testing services from us or through information gained from our Website with the intent of offering your own services directly to the client as a substitute for our services.

You agree to full confidentiality regarding any software or software prototypes which you are testing, have tested, or will test, as a result of your participation as a tester for <recruiting service>, and to not disclose to third parties what tests you have performed for <recruiting service>, or to copy or record any of the results, or the prototypes, media assets or files and applications tested in whatever form.

You agree not to copy or take screenshots/videos of our testing application, prototypes, files, media assets, wireframes or any other information, media asset or concept and/or disclose this information to other testers or third parties, either in person, via the Internet, or any other form of communication.

3. Payments

Gift Cards earned by participating in a test or study are made with the following conditions:

· You must be at least 18 years old

· You are paid a maximum of 30 days after fully completing a test;

· All gift cards are sent to the email address provided by the tester <recruiting service> reserves the right in its sole discretion to deny payment to any tester for the following reasons:

· Incorrect and/or misleading profile information;

· Poor set-up for purposes of conducting the test (e.g., blocked webcam, bad network, cut/cropped images, Obsolete device or OS, etc.);

· Duplicate accounts;

· Substandard testing;

· Expired tests, and test results that were not received by <recruiting service>, whatever the reason and/or, Incomplete reports (task not adhered to); <recruiting service> will ONLY pay you for complete, full reports and if the above guidelines have been met. In any event, in the case of tests performed where our client has chosen which specific testers should be invited to perform a test, and has provided us with your contact details or other means to allow us to invite you to participate, and has elected that you should not be paid for the test, <recruiting service> shall not pay you for performing the test.

4.All rights not expressly granted in these Terms of Use are reserved.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TEST CONTENT AND INTERFACES ARE PROVIDED ON AN "AS IS, AND AS AVAILABLE" BASIS WITHOUT WARRANTIES OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, <RECRUITING SERVICE> DISCLAIMS ALL WARRANTIES, CONDITIONS, TERMS, REPRESENTATIONS AND UNDERTAKINGS, EXPRESS OR IMPLIED, WHETHER ARISING BY LAW, CUSTOM, PRIOR ORAL OR WRITTEN STATEMENTS BY <RECRUITING SERVICE>, INCLUDING BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, SATISFACTORY QUALITY, NON-INFRINGEMENT, AND IMPLIED WARRANTIES ARISING FROM COURSE OF DEALING OR COURSE OF PERFORMANCE.

<RECRUITING SERVICE> MAKES NO REPRESENTATIONS OR WARRANTIES REGARDING ANY THIRD-PARTY PRODUCTS AND SERVICES YOU MAY OBTAIN OR ANY THIRD-PARTY WEBSITE OR APPLICATION YOU MAY ACCESS TO CONDUCT THE TEST

5.LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL <RECRUITING SERVICE>, ITS EMPLOYEES, SUPPLIERS OR CLIENTS, THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, SUBSIDIARIES AND AFFILIATES AND EACH OF THEM BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL, OR PUNITIVE DAMAGES, LOST PROFITS, REVENUE, INTEREST OR BUSINESS, WHETHER FORESEEABLE OR UNFORESEEABLE, ARISING OUT OF OR RELATED TO YOUR OR ANY THIRD PARTY'S CLAIM (INCLUDING, BUT NOT LIMITED TO, RELIANCE ON OR THE USE OF, DELAY IN BEING ABLE TO USE, OR INABILITY TO USE, THE WEBSITE OR THE CONTENT IT PROVIDES, OR ANY OTHER HYPERLINKED WEBSITE OR ANY THIRD PARTY PRODUCTS OR APPLICATIONS REGARDLESS OF LEGAL THEORY, EVEN IF <RECRUITING SERVICE> HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL THE AGGREGATE LIABILITY WHICH <RECRUITING SERVICE>, ITS EMPLOYEES, ITS SUPPLIERS, AND ITS CLIENTS, THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, SUBSIDIARIES AND AFFILIATES AND EACH OF THEM MAY INCUR FOR ALL DAMAGES, LOSSES AND CAUSES OF ACTION EXCEED THE AMOUNT ACTUALLY PAID TO YOU FOR PROVISION OF THE TESTING SERVICES AT ISSUE. THIS LIABILITY CAP WILL APPLY ONLY WHEN AND TO THE EXTENT THAT APPLICABLE LAW REQUIRES LIABILITY DESPITE THE EXCLUSION AND LIMITATION IN THE PRIOR PARAGRAPH.

6. Indemnity

You agree to indemnify and hold harmless <recruiting service>, its employees, suppliers and clients, their respective officers, directors, employees, agents, subsidiaries and affiliates, and each of them from any third-party claim, liability, loss, damage, cost or expense (including without limitation reasonable attorney's fees) arising out of or related to your provision of testing services, the Website or any Content it contains; your failure to comply with these Terms of Use; your infringement, violation, or misappropriation of any third party rights; or any violation of applicable laws or regulations.

7. Links to Other Internet Sites

You acknowledge, understand and agree that <recruiting service> does not have control over any third-party software or software prototype for which you provide testing services or link to. <recruiting service> will not be responsible or liable, directly or indirectly for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any such content, products or services available on such other websites or software or software prototype.

8.Changes to the Terms of Use

<recruiting service> reserves the right to discontinue the testing services at any time or otherwise make changes to the services at any time, without notice, and without liability to you or any third party of any kind.

If <recruiting service> changes these Terms of Use, it is your responsibility to review them each time you use the Website and/or the Service to ensure you are aware of the latest Terms of Use. By using the Website and/or the Services following any modified Terms of Use by <recruiting service>, you agree to be bound by those changes. Any disputes arising under these Terms of Use shall be governed by the Terms of Use in effect at the time the claim or dispute arose. Any changes apply prospectively only to new transactions or activities after the date of the change.

11.General Terms

You and <recruiting service> are independent parties. Nothing in these Terms of Use will be construed to make You an agent, employee, joint venturer, partner or legal representative of <recruiting service>. These Terms of Use constitute the entire agreement between the parties relating to the subject matter herein, and shall completely replace any prior agreements, oral or written, between you and <recruiting service> in relation to you acting as a tester for <recruiting service>. You agree that if <recruiting service> does not exercise or enforce any legal right or remedy which is contained in these Terms of Use (or which <recruiting service> has the benefit of under any applicable law), this will not constitute a formal waiver of <recruiting service> ´rights and those rights or remedies will still be available to <recruiting service>.

You may not assign or delegate any rights or obligations under these Terms of Use and any purported assignment or delegation shall be ineffective. <recruiting service> may freely assign or delegate all rights and obligations under these Terms of Use, fully or partially.

These terms of use shall be governed by the law of the State of California, USA You hereby consent to the jurisdiction of the state and federal courts in and for California, USA, for the resolution of any dispute arising out of or related to these Terms of Use.

If any court of law, having jurisdiction over the Website and/or the qualitative research testing services, rules that any provision of these Terms of Use is invalid, unlawful, void or for any reason unenforceable, then that provision shall be deemed severable from these Terms of Use and shall not affect the rest of these Terms of Use, which shall continue in full force and effect. <recruiting service> may provide notices to you via postings on the Website, via email or via any other means of communication for which you have provided contact information.

Questions, comments and requests in relation to these Terms & Conditions should be sent to <recruiting service> via email or mail.

Recruitment Partner’s Privacy Policy:

Privacy Policy

Data provided during all survey and participant screening processes are collected by <recruiting service>.

<recruiting service> is firmly committed to protecting your privacy. Personally Identifiable Information (PII) is never sold or shared with our clients without express consent from you. By practice, we will never share PII unless explicitly mentioned in the study. We may however collect contact information (e.g. Name and email address) if the participant explicitly expresses interest in participating in future studies.

Because protecting your privacy is important to us, you can always submit concerns regarding our Privacy Policy or our privacy practices to info@Recruitment Vendorlabs.com.

NO SPAM POLICY

All of our surveys and focus group programs are conducted on a per-project opt-in basis. Occasionally <recruiting service> may email you to invite you to participate in an active study we are conducting. You may opt in to the project by responding to our email invitation.

If you no longer want to receive e-mail communications, you may email info@Recruitment Vendorlabs.com and ask to be removed from future inquiries.

THE INFORMATION WE COLLECT AND HOW WE USE IT

Our participant eligibility form requires you to give us enrollment contact information (your full name, e-mail address, and additional demographic information as required for the study). This information is required to be able to participate in the study.

We do not share PII with clients as part of the study and final report. Other demographic information (i.e. ethnicity, age, household income, etc.) is used purely for statistical and reporting purposes and we do not share information that would make it possible to verify you.

Personal information is stored on secure web servers which are continuously monitored for hacking and security violations.

ANONYMOUS SINGULAR SUMMARY AND AGGREGATE STATISTICAL INFORMATION

Personal demographic and profile data regarding our research participants is only shared with our clients on an anonymous singular summary basis or an aggregate basis. Anonymous singular and aggregate statistical summary information is data that describes the interest profile and demographics data of a research participant without specifically identifying the individual. This data does not contain personally identifying information such as a name or e-mail address, nor does the combination of data make it possible to identify you.

PERSONALLY IDENTIFIABLE INFORMATION (PII)

Simply put, we do not share, sell, rent, or trade your personally identifiable information with third parties for their promotional purposes.

We reserve the right to disclose your personally identifiable information as required by law when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, or legal process served.

SURVEYS

<recruiting service> may invite you to participate in online surveys.

The information requested in these surveys may include but is not limited to, your opinions, and experience while participating in the test. These surveys may also request information defined as sensitive (e.g. data about ethnicity, age, gender, household income, etc. ).

Again, you are not required to provide us with this information if you do not want to. The information collected by these surveys is used in connection with the studies and tests we are conducting for our clients.

We reserve the right to share this information in an anonymous singular summary and aggregate form with third parties for this purpose.

OUR OPT-OUT POLICY

If you would like to opt-out of future surveys, you may request that you be removed from our database of potential study participants. You can, at any time, withdraw your consent to our use of your personal data as described in this Privacy Policy by emailing info@Recruitment Vendor.com.

CHANGES TO OUR PRIVACY POLICY

We reserve the right to update this Privacy Policy at any time. Please refer to this policy regularly.

HOW TO CONTACT US

If you have any questions about this privacy statement, the practices of this site, or your dealings with this Web site, you can email info@Recruitment Vendor.com.

Recruitment CONSENT FORM

Consent Form

<recruiting service> is inviting you to take part in a test to verify the efficacy of different real-time ID and Facial detection based biometric authentication software applications. Please read this form carefully before agreeing to take part in the Test.

What the Test is about: The purpose of this test is to analyze the integrity and equity across various demographics of different remote identity proofing software applications. Biometrics is a technology used for human identification and verification; this study will help to evaluate biometric performance of different software applications. This is best achieved using a large dataset acquired from people of different ages, gender and ethnicity under varying situations and conditions.

For this study, we will be conducting a comparative vendor study specifically on the ID verification, “selfie” matching and liveness detection aspects of remote identity proofing. You must have a working iPhone or Android phone and a valid state-issued driver’s license in order to participate in this test.

The test will also assess vendor performance on the non-biometric data such as Phone Number and SSN to compare the different vendors capabilities and performance in the remote identity proofing process.

Your information will be kept confidential at all times. All the vendors participating in this study will delete the data after the transaction is completed and no Personally Identifiable Information (PII) will be saved at the conclusion of this study. We will only retain the names and email IDs of the testers who have explicitly expressed an interest to participate in similar tests in the future.

What you will need to do and why: If you are selected to participate in this test you will be provided with the instructions to conduct the test, namely:

• Take an image of the front & back of your valid State Issued Driver's License

• Take a Self Portrait (Selfie)

• Provide personal information

All the vendors participating in this study will delete the data after the test is completed.

You will have to repeat these steps multiple times to test different vendor platforms. Once you’ve completed all the tests, you’ll be routed to fill out a short survey to rate your experience.

The images you take and data you provide will be used to test the effectiveness of the underlying authentication platform and the degree to which it correctly detects the validity of your ID, verifies if your self-portrait matches the image on the ID, and scores the validity of the information you provided.

All the tests will be conducted on secure, encrypted environments and your information will be kept confidential at all times. All demographic data (e.g. Ethnicity, Age, Household Income, ID State) will be used purely for statistical analysis. Any reports or test results that are generated and shared with third parties will not include any information or PII that will make it possible to identify you.

What are the risks involved: A risk associated with the storage of data is the potential theft of that data; there is the risk of a laptop computer or hard drive being stolen or a risk of a database being hacked. While we take precautions to prevent these types of situations (training, passwords, etc.) there is still a risk of theft. The computers used to store the data will be kept in a locked area when not in the possession of a researcher.

Compensation: You will receive an (insert incentive) for your participation in this study upon completion of the entire test.

Taking part is voluntary: Taking part in this Test is completely voluntary and you are free to withdraw at any time. If you have questions later, you may contact <recruiting service> at IDtesting@Recruitment Vendor.com or <POC> @ person@Recruitment Vendor.com

By signing below, you are accepting the above terms and agreeing to participate in this study.

GSA Consent/Terms and Conditions Page (via Google Forms):

Consent Page Verbiage:

Thank you for volunteering to participate in the U.S. General Services Administration (GSA) sponsored study that will assess the performance, fairness, and equity of several third party vendors’ remote identity proofing software for identity verification capabilities, specifically on the document verification and biometric aspects (“selfie” verification and liveness detection) and their ability to provide equitable access against various demographics (e.g. ethnicity, age range, gender). This study will evaluate efficacy using the NIST SP 800-63-3 Identity Assurance Level 2 flow. As NIST SP 800-63-3 provides a digital identity framework to Government agencies, compliance to the flow allows the agencies to have their applicants prove who they say they are remotely and become valid subscribers.

The output of this study is an anonymized, peer-reviewed report published by GSA, which will assist GSA in making informed decisions regarding identity verification capabilities.

Apart from the information you have already provided during the eligibility process, you will need to upload an image of your driver's license; take a “selfie,” and provide your phone number, and Social Security Number as part of the verification process. Upon your consent, this information will be shared with the third party vendors to complete the verification during the study.

The remote identity proofing software will try to:

a. match your “selfie” against your driver’s license photo

b. verify your identity with your phone number

c. use your SSN to validate your name, date of birth, and address (pulled from your driver’s license)

Please review the overview of the study and privacy policy before consenting to participate in the study:

Identity Proofing Software Study (hyperlink - Note: see Identity Proofing Software Study section for content) (Technical Note: a mechanism requiring the tester reads this before Yes/Agree at the bottom can be selectable.)

Privacy Policy (hyperlink - Note: see Privacy Policy Statement section for content) (Technical Note: a mechanism requiring the tester reads this before Yes/Agree at the bottom can be selectable)

If you understand and agree to the terms above as part of your participation in the study, enter your Participant ID and click “Yes/Agree” to confirm your consent, and you will be redirected to begin the GSA study.

I, Participant ID: _______________, understand the above terms and agree to participate in GSA’s Equity Study.

· Yes/Agree

· No/Cancel Continue<button>/ Cancel <button>

Identity Proofing Software Study Verbiage:

Identity proofing is the process of establishing whether a person is who they claim to be. National Institute for Standards and Technology (NIST) – through its Special Publication (SP) 800-63-3 – has provided guidelines for government agencies on how to perform identity proofing. There are three major steps in the identity proofing process:

1. Resolution – making sure the applicant is uniquely distinguished within a population, for example the right “John Jones” out of the many “John Joneses” living in the US;

2. Validation – checking whether the identity evidence “John Jones” has provided (date of birth, social security number, phone number etc.) is valid and related to a real-life person;

3. Verification – establishing the link between the validated evidence and the person (“John Jones”) presenting it.

In the case of remote identity proofing, verification is typically performed by comparing a picture of the applicant’s photo ID evidence (e.g., driver’s license) to a “selfie”. There are several software vendors in the market that offer this type of remote identity verification service.

GSA wants to analyze the fairness and equity across various demographics of these remote identity proofing software vendors. It is therefore conducting a comparative vendor study specifically on the “selfie” verification and liveness detection aspects of remote identity proofing.

The study will also assess vendor performance on the non-biometric aspects of the NIST SP 800-63-3 identity proofing flow. In other words, it seeks to get more insight regarding to what extent a tester passing or failing the remote identity proofing is caused by the biometric (“selfie”) verification versus the non-biometric aspects (identity validation) of the Identity Assurance Level (IAL) 2 proofing process. If “John Jones” is able to pass biometric verification at every vendor, but fails to have his phone number validated – then the proofing inequity in that case may not be caused by the verification software.

All study data (driver’s license, “selfie,” SSN, phone number, age, gender, location, household income, education level, ethnicity) will be collected and grouped demographically and de-identified using the following techniques:.... All the vendors participating in this study will delete the data after transaction and no Personally Identifiable Information (PII) will be saved at the conclusion of this study.

The outcome of this study will enable GSA to provide more equitable access to diverse populations that need to proof their identity.

Privacy Policy Statement Verbiage:

Introduction This Privacy Statement explains how GSA and our partners handle the personally identifiable information (PII) that you provide during the eligibility screening and participation in the Equity Study. PII includes information that is personal in nature and which may be used to identify you. The PII you provide in this Equity Study will be used only for the purpose for which you provided it. We will protect your information consistent with the principles of the Privacy Act of 1974, the E-Government Act of 2002, and the Federal Records Act.

Collection and Use of Personally Identifiable Information To support this study, GSA has partnered with several vendors to assess their remote identity proofing software. Specifically, the Equity Study will facilitate the collection and transfer of personally identifiable information (PII) to test the performance, fairness and equity across different demographic groups (e.g., ethnicity, age range, gender) of each vendor’s remote identity proofing software.

Eligibility for Participation To initiate the study and determine your eligibility to participate, GSA partnered with <recruiting service> (hereinafter Recruitment Vendor). Recruitment Vendor will recruit 2,000 testers across various ethnic groups, age ranges, household incomes, and education levels, and conduct the field testing to compare the vendors on their biometric verification capabilities. Recruitment Vendor has previously obtained consent to collect name, email, ethnicity, gender, ID State, current location (City, State), age, device type, and connection speed. Please note that GSA will not receive this information from Recruitment Vendor and will only receive a unique ID generated by Recruitment Vendor that will be used for tracking pass/fail rates. GSA cannot link your identity to the unique ID.

Vendor Performance Using the eligible volunteers who have consented to participation, GSA will test the software of the five IdP vendors. This equity study will test the performance of document verification and biometric aspects (“selfie”) verification and liveness detection of the participating vendors. In addition, this remote identity proofing study will assess vendor performance on the non-biometric aspects of the NIST SP 800-63-3 Identity Assurance Level (IAL) 2 flow. This will allow for a more informed comparison on drop-off rates, i.e., to what extent a tester passes or fails the flow is caused by the biometric versus the non-biometric aspects of the IAL2 proofing process.

Identity proofing helps establish a person is whom they claim to be. The identity proofing software used in this study requires the collection of the following data elements by vendor.

Once GSA passes this information to the third party, the third party software verifies the photo ID and matches your photo with your live selfie. The software will then validate your PII.

After the third party vendor determines whether you pass or fail their identity proofing, the third party will return the pass/fail response back through GSA and onto Recruitment Vendor. Recruitment Vendor will then group the study data by demographic data field and pass/fail rates, remove all PII collected during eligibility screening, and send this report to Study Evaluator to develop the final report. This report will be sent securely via (SFTP/Share file).

Final Report Study Evaluator will receive the anonymized report from Recruitment Partner Vendor and develop the output of this study: a peer-reviewed report to be published by GSA. Study Evaluator will deliver, design, analyze, and publish the study.

As stated above, this report will assist GSA in making more informed decisions regarding identity verification capabilities. The outcome will also enable GSA to provide more equitable access to diverse populations that need to proof their identity.

GSA

GSA will serve as a pass-through of the information and at no time will retain any PII.

Retention of Data During this equity study, GSA will not store any PII.

Recruitment Partner/Participant Outreach Service Vendors will retain the data for 90 days after the equity study and then delete the data. If however, a participant agrees to participate in future studies, the name and email will be retained. A separate consent is obtained by Recruitment Vendor for future studies. All the vendors participating in this study will delete the data no later than 30 minutes after transaction ends and no PII will be saved at the conclusion of this study.

Study Evaluator will not collect or store PII for the Final Report.

Additional Information Sharing There may be circumstances where we are required to share certain data. For example: if the information is relevant and necessary for an authorized law enforcement purpose; in order to respond to a breach; or to assist another agency as it responds to a breach. For additional information, see the system of record notice number GSA/TTS-1 that GSA’s Technology Transformation Service (TTS) published on August 10, 2017. Even when we share the information with law enforcement, GSA cannot access PII because the information is not stored by GSA.

The Authority - Who authorizes the collection of this data?

The information you provide is collected pursuant to 6 USC § 1523 (b)(1)(A)-(E), the E-Government Act of 2002 (Pub. L. 107–347, 44 U.S.C. 3501 note), and 40 USC § 501.

Routine Uses - With whom is the information routinely shared?

To an expert, consultant, or contractor of GSA in the performance of a Federal duty to which the information is relevant.

Consent - How can you control what information is shared?

Participants in this study have consented to the collection and use of the information as described in this Privacy Statement and the consent forms. Participants may revoke consent at any time.

Records - Where can you find more information?

Please see the GSA system of records notice (GSA/TTS–1) at www.gsa.gov/SORN.

Website Analytics – Other data we collect Other data, like the pages you visit and the length of your session, are aggregated into reports to help us better understand how the site is being used and how we can make it more helpful. The data is anonymized. No personally identifying user information is tied to this data and it is only shared anonymously with the GSA team.

Privacy Impact Assessment View all GSA privacy impact assessments at www.gsa.gov/PIA.

Contact Information If you have any questions regarding our Privacy Statement or the use of your information, please contact the GSA Privacy Office.