Congress Opens Formal Investigation Into ID.me’s IRS Project

ID.me is still attracting scrutiny from lawmakers worried about its contract with the IRS. In January, the tax agency had announced that biometric verification with ID.me would soon be mandatory for everyone trying to access their accounts online, though it has since walked back from that decision in response to the backlash from Congress and the general public.

However, that does not appear to have been enough to placate federal legislators. The House of Representatives has now opened an investigation into ID.me’s activities, kicking off the probe with a 10-page letter to ID.me CEO Blake Hall. The letter comes courtesy of the House Oversight Committee and the House subcommittee for issues related to COVID-19.

In terms of content, the letter asks ID.me to submit records about its technology and all of its contracts with state and federal agencies to the Committee for review. The investigators specifically want to know how many people have completed ID.me’s face-based identity verification process, and how many were rejected while trying to access a government service. A high number of rejections would suggest that there are accuracy issues with ID.me’s facial recognition technology, and raise concerns about inclusion for the elderly and other people who do not have access to smartphones or computers with facial recognition cameras.

ID.me uses facial biometric technology from Paravision and iProov. The company’s solution matches a selfie to the image on a photo ID during the onboarding process.

The letter also asks ID.me to share details about its average wait time, and about its data retention policies. ID.me has previously stated that it has registered around 73 million users, and that it will delete any biometric data should a user make such a request. The IRS, meanwhile, had told lawmakers that it would ask ID.me to delete all selfies and selfie videos by March 11, though it is not yet clear if the agency has followed through on that promise.

ID.me currently has contracts with 30 states and 10 federal agencies. The states are primarily using the company’s technology to try to stop unemployment fraud during the pandemic, while the IRS is using it for authentication when people want to log into an account. The IRS contract is worth $86 million, though the House Committee is asking whether or not the agency can terminate the agreement, and how much it would cost to do so.

As it stands, the IRS is continuing to use ID.me, while ID.me has expanded its non-biometric identity verification options to ensure continuity of service. In that regard, ID.me allows people to schedule a video chat with a human agent in lieu of an automated biometric check. The same technology is used to resolve rejected cases, and ID.me now offers offline identity verification services at select in-person locations.

The House of Representatives is nevertheless worried about transparency and accountability with regard to the use of facial recognition. Attempts to regulate the technology at the federal level have not yet gained any traction, so the lawmakers are hoping that the investigation can create some oversight and lead to the development of more meaningful privacy protections.

“Without clear rules of the road, agencies will continue to turn to companies like ID.me, which heightens the risk that essential services will not be equitably provided to Americans, or will be outright denied, and that their biometric data won’t be properly safeguarded,” said New York Representative Carolyn B. Maloney, who chairs the House Oversight Committee.

Source: The Washington Post

–

April 18, 2022 – by Eric Weiss