Lawmakers press IRS to drop controversial selfie software ID.me
Lawmakers are urging the IRS to scrap its deal with ID.me, the face-recognition company that promises to verify taxpayers' identities with a selfie.
Four congressional Democrats wrote to IRS Commissioner Chuck Rettig on Monday urging the agency to pause its use of facial-recognition technology for taxpayers logging into their IRS.gov accounts, citing concerns about privacy, data security and access for people without internet access.
"[M]illions of Americans use the IRS website annually for a variety of vital functions, and, as a result, each of them will be forced to trust a private contractor with some of their most sensitive data," Reps. Ted Lieu, Anna Eshoo, Pramila Jayapal and Yvette Clarke said in a letter to Rettig. "We urge the IRS to halt this plan and consult with a wide variety of stakeholders before deciding on an alternative."
The lawmakers said that using a third party to verify taxpayers' identity endangers them by compiling sensitive information into a biometric database that would be "a prime target for cyberattacks." They cite a 2019 incident in which a government contractor's computer system was breached, exposing thousands of Americans' faces and license plates.
At the same time, the verification software "discriminates against those unable to afford reliable broadband and the required video capabilities," they write.
"We are at the beginning stages of conducting oversight on this issue and all options — from hearings to legislation — remain on the table," Rep. Lieu told CBS MoneyWatch through a spokesperson. His office has not been in touch with ID.me directly, he said.
Facial-recognition technology in general has been demonstrated to be less accurate in identifying people with darker skin tones, as well as on Black, Asian and Native American faces. Other factors, such as the lighting of a room or the device someone is using, also play a role.
"For biometrics, lighting is a huge, huge challenge," said Rick Song, CEO of ID verification company Persona. "Aside from skin tones, you also have a device challenge. If you're on lower-quality devices, that makes a huge impact."
"Lack of transparency"
ID.me has also obfuscated how its technology works, according to lawmakers. The company has long claimed that its face-matching technology, which is used by more than half of U.S. states' unemployment systems and a number of federal agencies, is more accurate than other alternatives.
Specifically, ID.me said it did not use a technology called "one-to-many" matching, which attempts to match a person's face to a database of images and which ID.me called "complex and problematic."
But late last month, ID.me CEO, Blake Hall backtracked on that claim, conceding that ID.me does use one-to-many matching to check when a person opens an account to guard against fraudsters trying to register under multiple identities. The admission came after internal discussions that ID.me's public stance contradicted its practices, Cyberscoop reported.
"Given these issues, it is simply wrong to compel millions of Americans to place trust in this new protocol," the lawmakers wrote.
On Monday afternoon, the IRS said it would drop ID.me over the coming weeks, and move to a different identity-authentication process that did not involve facial recognition.
An IRS spokesperson previously told CBS MoneyWatch that the agency has long wanted to strengthen its security systems, but has been stymied by a lack of Congressional funding for tech upgrades.
For now, anyone signing up for their first account on IRS.gov will have to go through the ID.me verification. Taxpayers who have previously set up IRS.gov accounts will be able to use their old logins until this summer.
