Feds Jeopardized Security Of 1M Americans’ Online Accounts, Citing ‘Equity’

[Timber Rattler]

https://www.dailywire.com/news/feds-jeopardized-security-of-1m-americans-online-accounts-citing-equity

The federal government’s central technology arm jeopardized nearly one million online accounts by rejecting facial recognition technology when it was required for the high-security accounts, then cited “equity” to justify years of lying about its compliance with federal rules, The Daily Wire has learned.

The General Services Administration’s (GSA) technology group was tasked with creating Login.gov, a service that federal agencies would use to create accounts permitting access to government websites detailing personal or sensitive information. The service was required to follow rules set by the National Institute for Standards and Technology (NIST), and included offering a hacker- and impersonator-resistant option for agencies dealing with the most sensitive data, which must conform to a NIST standard called Identity Assurance Level 2 (IAL2).

GSA earned $187 million off the service after telling a government funding board that its solution met NIST’s exacting standards, and $10 million more from agencies who purchased the highest-security solution from GSA on the basis of its representations.

But GSA knew that its system was anything but compliant with IAL2, because it disregarded one of its most important security features: Using biometrics such as facial recognition, eye scans, or fingerprints to prove those seeking access to sensitive data were who they claimed to be. Officials opted to simply ignore that category because they said facial recognition technology might discriminate based on skin color, the GSA Inspector General found in a new audit.

“Put simply, Login.gov opted to ignore the standards and instead focused on selling Login.gov to customers without regard to NIST requirements,” the IG wrote. The audit said GSA “misled their customer agencies” and “knowingly billed” them for a product they were not receiving.

In response to IG, GSA acknowledged wrongdoing.

“Given that employees misled customer agencies about Login.gov’s compliance with NIST standards,” the director of Login.gov was reassigned, employee misconduct actions had been opened, and a “top-to-bottom review” of Login.gov had been ordered, officials said.

Excerpt.