ID.me’s Facial Recognition – Still a Problem at IRS

​In February, the IRS announced it would transition from using ID.me, a third-party, verification company that uses face scans to authenticate people seeking to access their IRS accounts.
 
ID.me has contracts with 10 federal agencies and 30 state governments. And as it expands, lawmakers continue to question the disparity between its comforting statements and its record.
 
The initial IRS turn away from ID.me was prompted, in part, by a letter from 15 leading Republican U.S. Senators who were concerned about the protection of “confidential taxpayer information and fundamental civil liberties.” They noted that ID.me requires a “trove of personal information” that can variously include a government-issued photo ID, a passport, a birth certificate, form W-2, social security card, a utility or insurance bill and a recorded video interview with an ID.me employee. People seeking to contact the IRS may be required to take a “selfie,” in which the applicant must submit his or her face to be digitized into a “faceprint.”
 
The senators expressed concern that the IRS, which has suffered massive data breaches and the leak of confidential taxpayer information, might leave millions vulnerable to identity theft. Moreover, ID.me, a commercial company not subject to government oversight, would possess a rich ocean of data on millions of Americans that it pinky-swears not to monetize.
 
Rep. Carolyn B. Maloney, chairwoman of the Committee on Oversight and Reform, and Rep. James Clyburn, Chairman of the Select Subcommittee on the Coronavirus Crisis, recently wrote to Blake Hall, CEO of ID.me, asking for documentation in support of their questions about ID.me during this period of transition from the IRS.
 
Revelations from their letter include:

• ID.me had, the two chairs wrote, promised to use one-to-one facial identification, instead of one-to-many. The latter uses an algorithm to match faces to a large database, a process prone to many false results. In a press release in January, ID.me stated it does not use one-to-many facial recognition, “which is more complex and problematic.” Yet leaked company messages reportedly discuss uses of one-to-many technology, including in IRS authentication.

 

• Americans trying to access their IRS accounts are still subject to ID.me if they fail to opt-out for the IRS system’s video selfie and facial recognition approval process. ID.me is still collecting Americans’ biometric information that is not subject to new retention requirements.

 

• By the time of the IRS announcement, 7 million Americans had already turned over their biometric data to ID.me and IRS.

 

• Applicants in Colorado faced up to 10-hour waits for help with the company’s verification process. In Nevada, it could be up to eight hours a day.

 

• In Florida, some applicants report they were locked out of their accounts for up to six weeks, with bills piling up in the interim.

 
Reps. Maloney and Clyburn listed document requests in the letter as the beginning of an investigation into ID.me’s practices and impacts. Worse for ID.me, their spin has made them a figure of fun in a parody talk show put together by the digital advocacy group, the Algorithmic Justice League.