The Internal Revenue Service is reconsidering alternatives to ID.me, the controversial identity verification system already used by states and other federal agencies, after the public rejected the idea thatto access their IRS.gov accounts.
A Treasury official told CBS MoneyWatch that the agency is looking at alternatives to the software.
The IRS announced its partnership with ID.me in November, under which taxpayers would have to register with the company to access their IRS.gov accounts to view their tax payment history or access to their tax transcripts. The deal received little scrutiny until this month, when security researcher Brian Krebs documented the process of verifying his identity by uploading documents, trying to take a selfie and connecting to an agent by video chat.
“Big Brother Tactics”
Lawmakers and civil liberties groups have called the process invasive.
“This is a very, very bad idea from the IRS. It will further weaken the privacy of Americans,” said Rep. Ted Lieu, a Democrat from California, noted on Twitter. “The IRS needs to reverse this Big Brother tactic, NOW.”
Sen. Ron Wyden, a Democrat representing Oregon, said he was “very disturbed” by the development.
In a statement, a Treasury spokesperson reiterated that ID.me accounts would not be required to file tax returns and said the agency was trying to balance ease of access with defending the agency against criminals.
“Lack of funding for IRS IT modernization has made it impossible for the IRS to invest in cutting-edge technology. The IRS today uses third-party service providers to validate the identification of individuals attempting to falsely access taxpayers. This includes ID.me, which is compliant with National Institute of Security Technology standards and used by multiple government agencies,” the spokesperson said.
Civil rights advocates have long pointed out that facial recognition isfor people with darker skin than for those with lighter skin. Facial recognition technology led to the wrongful arrest of a man for shoplifting and the mistaken association of members of Congress with a photo database.
“No matter if the IRS needs a new way to verify identity, it shouldn’t use facial recognition, especially when there’s a lack of regulation regarding the use of facial images and other biometrics,” said Jeramie Scott, senior counsel at the Electronic Privacy Clearinghouse. “Especially when they plan to outsource that identification to a third party company who will now collect personal information as well, creating another target for your information to be lost,” he said.
Once a user registers with ID.me, the company will be required to share their information with law enforcement if asked to do so, according to the Surveillance Technology Oversight Project, or STOP. Although users can revoke ID.me’s access to their data, the software must retain it for years to guard against fraud, potentially putting people at risk of identity theft.
EPIC, STOP, Fight For The Future and three other civil rights groups have launched a petition asking the IRS to revoke the contract. The petition has already received more than 1,000 signatures, according to Fight For The Future.
The founder and CEO of ID.me, Blake Hall,that ID.me has high security standards that make online access both safer and more accessible to taxpayers than previous methods used by the IRS, which typically required users to have a credit report. Hall said ID.me stopped “tens of thousands” of potential attacks on the IRS that could have resulted in the theft of taxpayer identities.
“What we’re doing is just the digital equivalent of what every American does to open a bank account,” Hall said.
A company spokesperson said that 9 out of 10 users can successfully self-verify with ID.me and the process takes an average of 5 minutes.
However, due to the ubiquity of ID.me, that 10% failure is a lot of people. Since last year, when ID.me contracted with more than half of the US states to administer unemployment benefits, there have been countless complaints from people whose funds were improperly suspended or who could not be verified because they did not have the correct documents, could not access the Internet or for other reasons.