The federal government&#8217;s central technology arm jeopardized nearly one million online accounts by rejecting facial recognition technology when it was required for the high-security accounts, then cited “equity” to justify years of lying about its compliance with federal rules, <a href="https://www.dailywire.com" target="_blank" rel="noopener">The Daily Wire</a> has learned.
The General Services Administration’s (GSA) technology group was tasked with creating Login.gov, a service that federal agencies would use to create accounts permitting access to government websites detailing personal or sensitive information. The service was required to follow rules set by the National Institute for Standards and Technology (NIST), and included offering a hacker- and impersonator-resistant option for agencies dealing with the most sensitive data, which must conform to a NIST standard called Identity Assurance Level 2 (IAL2).
GSA earned $187 million off the service after telling a government funding board that its solution met NIST’s exacting standards, and $10 million more from agencies who purchased the highest-security solution from GSA on the basis of its representations.
But GSA knew that its system was anything but compliant with IAL2, because it disregarded one of its most important security features: Using biometrics such as facial recognition, eye scans, or fingerprints to prove those seeking access to sensitive data were who they claimed to be. Officials opted to simply ignore that category because they said facial recognition technology might discriminate based on skin color, the <a href="https://www.oversight.gov/sites/default/files/oig-reports/GSA/GSA-Misled-Customers-Logingovs-Compliance-Digital-Identity-Standards-JE23-003Redacted.pdf" target="_blank" rel="noopener">GSA Inspector General found</a> in a new audit.
“Put simply, Login.gov opted to ignore the standards and instead focused on selling Login.gov to customers without regard to NIST requirements,” the IG wrote. The audit said GSA “misled their customer agencies” and “knowingly billed” them for a product they were not receiving.
In response to IG, GSA acknowledged wrongdoing.
“Given that employees misled customer agencies about Login.gov&#8217;s compliance with NIST standards,&#8221; the director of Login.gov was reassigned, employee misconduct actions had been opened, and a “top-to-bottom review” of Login.gov had been ordered, officials said.
The audit found that top officials ignored insiders who pointed out that a product whose sole aim was cybersecurity was not actually secure, and that once they were caught, they misled agencies into believing they were withdrawing the webcam security feature because of new policy on “equity.” In reality, it had been out of compliance the whole time, with GSA having tricked agencies into using insecure software for years—sending federal agency officials tasked with online security into a tailspin when they learned the truth.
“As of May 2022, Login.gov had 906,187 users of Login.gov services that GSA purported to be IAL2 but did not comply,” the IG said. “Notwithstanding GSA officials’ assertions that Login.gov met [the] requirements, Login.gov has never included a physical or biometric comparison in production. Login.gov officials informed us that biometric comparison was not included in products offered to customer agencies, initially because the feature required testing before implementation and later because they further delayed it due to equity concerns.&#8221;
At multiple points, senior leaders with GSA’s Technology Transformation Services (TTS), the division under the Federal Acquisition Service (FAS) in charge of the project, &#8220;learned that Login.gov did not comply with IAL2 requirements. They did not, however, notify customer agencies of the noncompliance. The inability to meet IAL2 NIST standards became the topic of discussions among Login.gov leaders and personnel at least as early as 2019, and included concerns that using individuals’ selfies to verify their identity could impact Login.gov’s rejection rates based on physical traits, such as skin color and tone,” it said.
&#8220;GSA misled the Technology Modernization Board in securing funding for Login.gov,&#8221; the IG wrote in September 2021.
GSA secured $187 million in federal funding after TTS Director/FAS Deputy Commissioner Vladlen “Dave” Zvenyach, then-GSA Chief Financial Officer Gerard Badorrek, and GSA Chief Information Officer David Shive attested that &#8220;Login.gov is currently used in production and complies with NIST’s 800-63-3 standard for strong authentication (AAL2) and identity verification (IAL2).&#8221;
Back in 2019, the GSA touted its “selfie” feature in marketing materials, stated in an “Agency Authorization to Operate” that the system “can support user validation at Identity Assurance Level 1 or 2 (IAL1 or IAL2),” and authorized agencies who were required to use IAL2 authentication to use Login.gov, even though a former Login.gov Product Manager told the IG “that the team knew that Login.gov did not comply with NIST 800-63-3 [another name for IAL2] as early as 2018.&#8221;
By January 2020, a senior advisor went to the top to sound the alarm about noncompliance, telling then-GSA Assistant Commissioner Dominic Sale and others. Sale &#8220;told him that because he was not the Director of Login.gov, it was not the Senior Advisor’s role to pursue the issue,&#8221; the IG found. In August 2020, a consultant flagged the same issue for a TTS employee, but the employee did not do anything about it because &#8220;he believed that everyone knew that Login.gov was not compliant.&#8221;
Zvenyach was put in charge of TTS in January 2021, and his boss, FAS Commissioner Sonny Hashmi, told the IG that &#8220;Zvenyach told him clearly that Login.gov met the IAL2 standards, and they were signing interagency agreements that stated they met the standard.&#8221;
Yet internal records showed that by June 24, 2021, not only was it not compliant, but Zvenyach had disavowed taking any steps that could get it into compliance. “The position of TTS is that the benefits of liveness/selfie does not outweigh any discriminatory impact, and therefore should not be used as a proofing requirement,” he wrote to staff in a Slack message.
The IG noted that there was no formal &#8220;documented justification&#8221; of this, &#8220;Zvenyach did not notify customer agencies when TTS suspended efforts to implement selfies to meet the NIST biometric comparison requirement,” and GSA “continued to withhold information from customer agencies about Login.gov’s lack of biometric comparison capabilities.”
The jig was up in January 2022, when a federal agency asked point-blank how the login system could possibly be compliant when it didn&#8217;t use webcams, fingerprints, or eye scanners. On January 20, 2022, the GSA released an &#8220;Equity Action Plan&#8221; that it said was required by the Biden administration, and days later, the GSA relied on the new policy to say that it would not meet NIST standards with Login.gov.
“On February 3, 2022, seven months after Zvenyach’s June 2021 internal announcement, GSA finally notified customer agencies that the IAL2 service included in their interagency agreements, for which they were paying, did not comply with NIST requirements,” the IG wrote. It told them with a statement that cited the days-old equity policy and &#8220;linked the lack of a biometric comparison feature to equity concerns. It omitted any mention of the duration and nature of Login.gov’s noncompliance with NIST’s IAL2 requirements.”
Federal security officials were shocked that they could no longer count on a secure login. &#8220;I reiterate how frustrating this is,&#8221; one wrote. &#8220;We have been promoting the use of IAL2 solutions pretty heavily,&#8221; another wrote. “Having a clear understanding of this is critical.”
&#8220;This is quite an issue. &#8230; You are now stating that IAL2 is no longer available as of today?” a third wrote. But the truth was worse&#8211;contrary to the message that misleadingly blamed a new equity policy, the agencies had unknowingly been out of compliance the whole time.
Agencies who relied on secure logins from GSA told the IG that &#8220;Login.gov’s noncompliance with the IAL2 standard created a greater risk of fraud for the customer agency,&#8221; &#8220;had an impact on the credibility of their program,&#8221; and could create liability because &#8220;the customer agency would be held responsible for allowing access to individuals at the wrong level.&#8221;
The IG said that after learning of TTS&#8217; equity-justified misrepresentations, GSA &#8220;reviewed the agreements for other misrepresentations,&#8221; and found that its authentication system was also not in compliance.
GSA Deputy Administrator Katy Kale notified the Technology Modernization Board that its proposal made statements “that could be interpreted to say Login.gov’s service meets NIST guidelines.” The IG slammed Kale for attempting to soften it, noting that “in fact,” GSA explicitly stated that it did verbatim.
“On August 16, 2022, the GSA Administrator announced the Zvenyach’s departure from GSA,” the IG said.
This is the first installment in a series.
Part 2: <a href="https://www.dailywire.com/news/federal-tech-arm-had-pattern-of-gross-mismanagement-before-equity-induced-cybersecurity-fiasco" target="_blank" rel="noopener">Federal Tech Arm Had Pattern Of ‘Gross Mismanagement’ Before ‘Equity’-Induced Cybersecurity Fiasco</a>
Part 3: <a href="https://www.dailywire.com/news/federal-agency-focused-on-leftist-politics-and-pronouns-as-gross-mismanagement-put-cybersecurity-at-risk" target="_blank" rel="noopener">Federal Agency Focused On Leftist Politics And Pronouns As ‘Gross Mismanagement’ Put Cybersecurity At Risk</a>
Part 4: <a href="https://www.dailywire.com/news/chat-records-reveal-epic-meltdown-in-federal-agency-after-trump-win" target="_blank" rel="noopener">Chat Records Reveal Epic Meltdown In Federal Agency After Trump Win</a>

<script async src="https://www.instagram.com/embed.js"></script>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
<script async src="https://www.tiktok.com/embed.js"></script><div data-widget-host="revcontent" data-pub-id="165152" data-widget-id="290588"></div><script src="https://delivery.revcontent.com/165152/290588/widget.js"></script>

Feds Jeopardized Security Of 1M Americans’ Online Accounts, Citing ‘Equity’

CONTINUE READING

Dr. Oz Drops Into Ohio To Crack Down On Medicaid Fraud Identified By Daily Wire

Ex-Top Foreign Aid Official Cries As He Is Sentenced To Prison For Bribes

Ohio Restores Medicaid Anti-Fraud Measures After Daily Wire Investigation

He Was Convicted For Defrauding The Government. Now Medicaid Pays His Wife Millions.

Ohio Says Safeguards Exist To Stop Medicaid Fraud, But Admits Massive Loophole

Meet The Convicted Fraudster Running A Million Dollar Medicaid Business

Investigation

Diversity Equity and Inclusion (DEI)

Equity

Facial Recognition

Hackers

Inspector general

Technology

A video goes viral showing a baby being refused his mother by two gay "dads". This is just the tip of the iceberg, which is why we will have an important discussion today about surrogacy. 

Hour 1

The Matt Walsh Show

Ep. 1765 - This Video Is One Of The Worst Things I've Seen In A Long Time 

The Strait of Hormuz officially opens for business (kind of), the Pope makes “shocking” comments on immigration, and President Trump promises UFO disclosure at TPUSA. 


The Michael Knowles Show

Ep. 1956 -  Pope Leo's "SHOCKING" Immigration Comments EXPLAINED

A false miscreed has corrupted our leadership class.


The Andrew Klavan Show

Ep. 1275 - Dumb, Dumber and Progressive

President Trump announces a 10-day ceasefire between Lebanon and Israel, a murder-suicide involving former Democratic Lieutenant Governor Justin Fairfax shakes Virginia, and France and Britain hold a conference to secure the Strait of Hormuz – after the Iranian conflict ends. Get the facts first with Morning Wire.

- - -

Ep. 2738

- - -

Wake up with new Morning Wire merch: https://bit.ly/4lIubt3

- - -

Today's Sponsors:

Alliance Defending Freedom - Visit https://JoinADF.com/WIRE or text 'WIRE' to 83848 to learn more.

Pocket Hose - Text MORNING to 64000 to get a FREE pocket pivot and their 10-pattern sprayer with the purchase of ANY size Copper Head hose. Message and data rates may apply.

Morning Wire

U.S. Expands Hormuz Blockade & VA Fairfax Deaths Investigated | 4.17.26

U.S. Expands Hormuz Blockade & VA Fairfax Deaths Investigated | 4.17.26 [Member Exclusive]

A ceasefire goes into effect between Israel and Lebanon, a tragic murder-suicide rocks Virginia, and Dairy Queen deploys AI in the drive-thru. Get the facts first with Evening Wire.
- - -
Ep. 2737
- - -
Wake up with new Morning Wire merch: https://bit.ly/4lIubt3 
- - -
Today’s Sponsor:

Alliance Defending Freedom - Visit https://JoinADF.com/WIRE or text “WIRE” to 83848 to learn more.


Evening Wire: Lebanon Ceasefire Begins & Murder-Suicide Rocks VA | 4.16.26

The Pendragon Cycle

Menu

— Investigation —

Feds Jeopardized Security Of 1M Americans’ Online Accounts, Citing ‘Equity’