Treasury weighing alternatives to ID.me over privacy concerns

The Treasury Department is reconsidering the Internal Revenue Service’s reliance on facial recognition software ID.me for access to its website, an official said Friday amid scrutiny of the company’s collection of images of tens of millions of Americans’ faces.

The Treasury and the IRS are looking for alternatives to ID.me, a department official said, but did not specify the agencies are attentive to concerns around the software. The company has faced growing criticism over its software and its use of facial recognition technology.

“The IRS is consistently looking for ways to make the filing process more secure,” spokeswoman Alexandra LaManna said in a statement to Bloomberg News.

Samuel Corum/Bloomberg

Spokespeople for ID.me did not immediately respond to requests for comment about the Treasury statement.

The IRS had previously announced that any taxpayer looking to access an online account on IRS.gov will be required to be verified through ID.me in a process that requires taking a selfie. The website last year began requiring taxpayers to use ID.me to access personalized information about eligibility for expanded child tax credits funded by Biden’s pandemic relief program, the American Rescue Plan, among other services.

LaManna noted that any taxpayer who does not want to use ID.me can opt against filing his or her taxes online.

“We believe in the importance of protecting the privacy of taxpayers, while also ensuring criminals are not able to gain access to taxpayer accounts,” LaManna added, arguing that it’s been “impossible” for the IRS to develop its own cutting-edge identification program because of “the lack of funding for IRS modernization.”

Without its own in-house system, the agency turned to third-party companies including ID.me, which she noted is compliant with the National Institute of Standards and Technology and is used by multiple federal agencies.

Research has shown that AI-driven facial recognition software often makes mistakes with darker-skinned people. That identified bias in the technology has prompted activists to call for law enforcement agencies to abandon using it altogether.

ID.me, which has faced criticism for its work on behalf of state unemployment systems during the pandemic, has previously deflected questions about its use of facial recognition technology by saying it only uses so-called one-to-one technology. That process compares a selfie taken by a user to their likeness on a driver’s license or passport.

The company disclosed this week that it actually also used much more controversial one-to-many technology to compare selfies to a bigger database of images that it collected.

Critics have also raised concerns about the third-party company’s access to facial images, but the Treasury official stressed that the IRS protects any data it receives and that the law protects taxpayer information from disclosure to other parties.

Controversial technology

ID.me said in a blog post Friday that it checked selfies taken by users to verify their identities against an artificial intelligence database, reversing how it has long described its use of facial recognition technology amid growing questions about its work for the tax office. The technology it uses depends on software that Amazon has stopped selling to law enforcement agencies amid bias concerns.

But CEO Blake Hall this week said that the company also used one-to-many technology, which compares selfies taken by users as part of the verification process against a larger database. The company said it maintained an internal database of selfies taken by users and compared new selfies against it using Amazon’s controversial Rekognition technology. As of January 25, 20.9 million users’ selfies had been verified against that database, the company said.

ID.me did not say how many images were in that database, but the company claims to have 70 million verified users, each of whom would have had to take a selfie to verify their identity with the company.

The company said it had not previously disclosed that function because it was concerned about revealing its methods to potential fraudsters.

“ID.me uses a ‘1 to Many’ check solely for the purpose of preventing identity theft,” the company said. “This step is designed to see if one person is stealing multiple people’s identities.”

It said that process flagged less than 0.1% of all selfies scanned as potentially fraudulent and stressed that the one-to-many process was not used to verify people’s identities. The actual verification of identities is done with one-to-one processes employed by separate vendors Paravision and iProov.

The company said no one outside it had access to the vast majority of selfies in its database. “The only time biometric information is shared with a government agency is when there is apparent fraud and identity theft tied to the account associated with the agency,” the company said.

Amazon moratorium

ID.me’s use of Amazon technology has raised more questions about its facial recognition processes.

Amazon in 2020 announced what has become an indefinite moratorium on the use of its Rekognition technology by law enforcement after experiments showed it sometimes struggled to identify people of color, sparking concerns it could lead to wrongful arrests.

Pressure on Amazon intensified after a January 2019 study by artificial intelligence researchers Inioluwa Deborah Raji and Joy Buolamwini showed the Amazon software made more mistakes when used on people with darker skin, particularly women. Separately, the ACLU tested the software on members of Congress and found it falsely matched 28 of them with mugshots, disproportionately selecting minority lawmakers. Amazon did not immediately comment.

In a letter to the White House this week, Buolamwini called for the Biden administration to review the IRS’s use of ID.me.

“The absence of effective public consideration prior to the adoption of such technologies has profound and disparate impacts,” she wrote in a letter to the White House’s Office of Science and Technology Policy outlining her concerns with the use of ID.me. “This places all Americans at the mercy of unverified and under-scrutinized algorithms, from a field whose algorithms are already known to have biased properties.”

The White House did not immediately comment.

The researcher, who founded the Algorithmic Justice League, also disputed ID.me’s claims that one-to-one face-matching doesn’t suffer from some of the same bias issues, calling them a “mischaracterization of the literature.” She cited a 2019 NIST report that she said showed higher rates of false positives for Asian and African-American faces relative to Caucasian faces when the researchers tested one-to-one systems.

Members of Congress have raised questions about requiring any facial recognition software to set up an IRS account online. “No one should be forced to submit to facial recognition as a condition of accessing essential government services,” said Senator Ron Wyden, chairman of the Senate Finance Committee, in a statement to Bloomberg News. “I’m continuing to seek more information about ID.me and other identity verification systems being used by federal agencies.”

— With assistance from Laura Davison