Decide whether Login.gov can meet need for identity proofing

[cmajel]

Background Forest Service verifies the ID of folks purchasing firewood permits because they need to ensure that the permittee themselves is agreeing to abide by the rules of the permit. We want to understand whether Login.gov could be used to meet the need for permit purchasers to verify their identity and whether we could implement this capability under the existing Login.gov agreement.

Acceptance criteria

• [x] We understand whether Login.gov could be used to meet the requirement for permit purchasers to verify their identity and how it might impact the user experience.

Tasks

• [x] Schedule mtg. w/ Laura Gerhardt and any others at Login.
• [x] Draft Qs for the Login team
• [x] Conduct mtg.

Definition of done

• [x] Meets acceptance criteria

[MelissaBraxton]

Qs and notes doc: https://docs.google.com/document/d/18F_Cv1mJqKaXdIKw9LdXR4s3EAP4Y6JAGt4DmSdH-Cc/edit?usp=sharing

[MelissaBraxton]

tl;dr - There are trade offs with going with Login.gov for ID verification.

CONS

• The authentication flow is long, and we're worried folks will bounce before taking the time to go through it.
  • The new account creation flow is very long, and folks arriving to the permitting site without an account will have to set up an account before they can verify their identity.
• A Login.gov account requires a social security number, and not every potential permit purchaser has one.

PROS

• Already ATOd
• Open Forest already has an agreement with Login.gov, and a modification is currently in process--we could easily add ID verification onto to this mod to get started quickly with little additional cost
• Login.gov is already integrated with the OF platform--USFS has already invested in it, and this will speed our path to production.
• Likelihood that users landing on the site will already have Login account will increase as Login.gov continues to diffuse throughout the USDA and government more broadly
• A lot of permit purchasers are repeat customers--once they have an account and verified their ID one time, info is stored making subsequent visits quicker than they would be if we went with an alternative ID verification system that did not require account creation and therefore the verification process would need to be repeated every visit.
  • Login.gov folks may be willing to work with us on tailoring the product and/or their service offerings to the unique needs of FS customers if needed.
• Login.gov's ability to pass PII to other services would eliminate permit purchasers' need for duplicate data entry and also let's us delay going through the SORN process until later releases.

[MelissaBraxton]

@bboddiger - Let's chat about these tradeoffs next week. My recommendation would be to pursue modifying the current agreement to add ID verification with Login.gov, but we'll want to understand the costs first.

Follow up actions:

• [ ] Chat with Shadat and Aaron about timing of current mod and when we'd need to add on to it.
• [ ] Estimate number of authentications and verifications we'd be adding (i.e., how many online firewood permits do we anticipate selling? in the pilot, after release 2, beyond...?)
  • [ ] Share this info with Login.gov folks to understand how much would be covered under the existing agreement and give us a cost estimate on any remainder.

[MelissaBraxton]

Related to comparative analysis issue here.

[bboddiger]

Hi Melissa, thanks for this. I read the comments you provided but haven’t been able yet to get to the documents themselves. One question I do have is around password usage and whether that turns out to be an issue for folks who may only access once or twice a year for their annual permits. Is a password even required for these accounts or do they just use ssn-do you know?

Beth Boddiger, USDA-FS National TIM (Timber Information Manager) Team Lead WO Forest Management -Detached 2150 Centre Ave, BLDG A/STE 316 Fort Collins, CO 80526 Phone: 970-295-5792

From: Melissa Braxton [mailto:notifications@github.com] Sent: Monday, January 6, 2020 10:23 AM To: USDAForestService/USFS-timber-permitting USFS-timber-permitting@noreply.github.com Cc: Boddiger, Beth -FS beth.boddiger@usda.gov; Mention mention@noreply.github.com Subject: Re: [USDAForestService/USFS-timber-permitting] Decide whether Login.gov can meet need for identity proofing (#76)

Comparative analysis sheet herehttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FUSDAForestService%2FUSFS-timber-permitting%2Fissues%2F81&data=02%7C01%7C%7Ceb5c73b8e5f8471e391108d792cd138d%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C1%7C637139281799463328&sdata=ObhjbN%2B5xNugqQ9%2ByLj7oZt19UGX2eV%2F5IVDrvPMFI4%3D&reserved=0.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FUSDAForestService%2FUSFS-timber-permitting%2Fissues%2F76%3Femail_source%3Dnotifications%26email_token%3DAN4LDRNCX437HP3KREPG62LQ4NSHFA5CNFSM4J2PSQM2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIGEEOY%23issuecomment-571228731&data=02%7C01%7C%7Ceb5c73b8e5f8471e391108d792cd138d%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C1%7C637139281799473280&sdata=zKGPs%2FzPt4msEMrdMcY0NkKEt6yJc9Y5sdzIq6%2B6bM0%3D&reserved=0, or unsubscribehttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAN4LDRKTVBYK45B5SE4MXIDQ4NSHFANCNFSM4J2PSQMQ&data=02%7C01%7C%7Ceb5c73b8e5f8471e391108d792cd138d%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C1%7C637139281799473280&sdata=%2Fi2aE%2BVTsyYCO%2FFeB0zi6%2F2pehmjmfOpU8IAQlLRZU0%3D&reserved=0.

This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

[MelissaBraxton]

It is a great Q!

Once they have an account, the ID proofing feature verifies their ID using their SSN.

Melissa Braxton Experience Design, 18F Cell: 425-770-2349 https://18f.gsa.gov/

On Mon, Jan 6, 2020 at 10:54 AM bboddiger notifications@github.com wrote:

Hi Melissa, thanks for this. I read the comments you provided but haven’t been able yet to get to the documents themselves. One question I do have is around password usage and whether that turns out to be an issue for folks who may only access once or twice a year for their annual permits. Is a password even required for these accounts or do they just use ssn-do you know?

Beth Boddiger, USDA-FS National TIM (Timber Information Manager) Team Lead WO Forest Management -Detached 2150 Centre Ave, BLDG A/STE 316 Fort Collins, CO 80526 Phone: 970-295-5792

From: Melissa Braxton [mailto:notifications@github.com] Sent: Monday, January 6, 2020 10:23 AM To: USDAForestService/USFS-timber-permitting < USFS-timber-permitting@noreply.github.com> Cc: Boddiger, Beth -FS beth.boddiger@usda.gov; Mention < mention@noreply.github.com> Subject: Re: [USDAForestService/USFS-timber-permitting] Decide whether Login.gov can meet need for identity proofing (#76)

Comparative analysis sheet here< https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FUSDAForestService%2FUSFS-timber-permitting%2Fissues%2F81&data=02%7C01%7C%7Ceb5c73b8e5f8471e391108d792cd138d%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C1%7C637139281799463328&sdata=ObhjbN%2B5xNugqQ9%2ByLj7oZt19UGX2eV%2F5IVDrvPMFI4%3D&reserved=0>.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub< https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FUSDAForestService%2FUSFS-timber-permitting%2Fissues%2F76%3Femail_source%3Dnotifications%26email_token%3DAN4LDRNCX437HP3KREPG62LQ4NSHFA5CNFSM4J2PSQM2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIGEEOY%23issuecomment-571228731&data=02%7C01%7C%7Ceb5c73b8e5f8471e391108d792cd138d%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C1%7C637139281799473280&sdata=zKGPs%2FzPt4msEMrdMcY0NkKEt6yJc9Y5sdzIq6%2B6bM0%3D&reserved=0>, or unsubscribe< https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAN4LDRKTVBYK45B5SE4MXIDQ4NSHFANCNFSM4J2PSQMQ&data=02%7C01%7C%7Ceb5c73b8e5f8471e391108d792cd138d%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C1%7C637139281799473280&sdata=%2Fi2aE%2BVTsyYCO%2FFeB0zi6%2F2pehmjmfOpU8IAQlLRZU0%3D&reserved=0>.

This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

— You are receiving this because you were assigned. Reply to this email directly, view it on GitHub https://github.com/USDAForestService/USFS-timber-permitting/issues/76?email_source=notifications&email_token=AE5RZHUEVJC4V7BDHRM5RGTQ4N46ZA5CNFSM4J2PSQM2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIGMWPY#issuecomment-571263807, or unsubscribe https://github.com/notifications/unsubscribe-auth/AE5RZHSLKFDDE2YFDQMZ4O3Q4N46ZANCNFSM4J2PSQMQ .