In February, the IRS announced it would transition from using ID.me, a third-party, verification company that uses face scans to authenticate people seeking to access their IRS accounts.
ID.me has contracts with 10 federal agencies and 30 state governments. And as it expands, lawmakers continue to question the disparity between its comforting statements and its record.
The initial IRS turn away from ID.me was prompted, in part, by a letter from 15 leading Republican U.S. Senators who were concerned about the protection of “confidential taxpayer information and fundamental civil liberties.” They noted that ID.me requires a “trove of personal information” that can variously include a government-issued photo ID, a passport, a birth certificate, form W-2, social security card, a utility or insurance bill and a recorded video interview with an ID.me employee. People seeking to contact the IRS may be required to take a “selfie,” in which the applicant must submit his or her face to be digitized into a “faceprint.”
The senators expressed concern that the IRS, which has suffered massive data breaches and the leak of confidential taxpayer information, might leave millions vulnerable to identity theft. Moreover, ID.me, a commercial company not subject to government oversight, would possess a rich ocean of data on millions of Americans that it pinky-swears not to monetize.
Rep. Carolyn B. Maloney, chairwoman of the Committee on Oversight and Reform, and Rep. James Clyburn, Chairman of the Select Subcommittee on the Coronavirus Crisis, recently wrote to Blake Hall, CEO of ID.me, asking for documentation in support of their questions about ID.me during this period of transition from the IRS.
Revelations from their letter include:
Reps. Maloney and Clyburn listed document requests in the letter as the beginning of an investigation into ID.me’s practices and impacts. Worse for ID.me, their spin has made them a figure of fun in a parody talk show put together by the digital advocacy group, the Algorithmic Justice League.