DHS · DHS-2424 · record R1971

AI Assisted Compromise Email Detector (AACED)

Department of Homeland Security · ICE

Overview

Development stage: DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: 2024-06-01 (day precision)Source: 2024-06-01T00:00:00
Withheld from public reporting: Not reported

Mission

Topic area: Cybersecurity
Operational functions: Chatbot or virtual assistant Derived by keyword rules; see methodology

Problem the AI is intended to solve

This use case intends to solve the problem of the extensive manual effort required to review emails for signs of cyber compromise.

Expected benefits

The use case was developed to assist ICE SOC in reviewing a collection of emails between ICE personnel and Microsoft that were part of Emergency Directive 24-02. The use case provides a faster mechanism to the SOC analysts to determine indicators of compromise, reducing the level of effort for these individuals’ analysis exponentially. To assist the analysts, Named Entity Recognition (NER) was used to detect PII and other associated keywords to increase analyst productivity, and reduce time required to analyze emails.

System outputs

Outputs are named entities and generated text for specific questions. Chat interface for analyst to conduct Q&A with email as context.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Not reported
Custom-developed code: Yes
Public source code: Not reported

Sourcing

How it was built: Developed in-houseSource: b) Developed in-house
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Yes
Privacy Impact Assessment: Not reported
Authorization to Operate: No
Demographic features: Not reported
Training and evaluation data: Stored Agency emails used for validation.
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported