After public backlash against the idea that taxpayers would need to take selfies in order to access their IRS.gov accounts, the Internal Revenue Service is now looking at alternatives to ID.me.
In November, the IRS announced its partnership with ID.me. Taxpayers would need to register to gain access to their IRS.gov accounts. This will allow them to view their tax history and access their tax transcripts. Security researcher Brian Krebs, a security researcher, documented Brian Krebs’ process of verifying his identity, uploading documents, taking a selfie, and connecting with an agent via videochat.
“Big Brother tactic”
The process was criticized by civil-liberties and lawmakers.
The IRS has a terrible idea. It will further compromise Americans’ privacy,” Ted Lieu (a California Democrat) said on Twitter. “The IRS must reverse this Big Brother tactic, immediately.”
Senator Ron Wyden (Democrat representing Oregon) said he was “very disturbed by this development.
A Treasury spokesperson stated that ID.me accounts will not be required for tax returns filing. He also said that the agency was trying balance easy access and defending itself against criminals.
“It is impossible for the IRS, due to a lack of funds for IT modernization, to invest in state-ofthe-art technology. Third-party service providers are used by the IRS to verify that individuals who attempt to gain improper access to taxpayer accounts have been identified. The spokesperson stated that ID.me is compliant with National Institute of Security Technology standards. It is used by multiple government agencies.”
Unregonizable
Civil rights activists have long noted that facial recognition is less accurate in people with darker skin tones than it is for people with lighter skin. Face-matching technology led to the wrongfully arrest of a man accused of shoplifting and to Congress members being mismatched to a mugshot list.
Jeramie Scott (senior counsel at the Electronic Privacy Information Center) stated that, regardless of whether the IRS requires a new method to verify identity, they should not be using facial recognition. This is especially true when there is no regulation regarding the use face images and other biometrics. He said that they are planning to outsource identification to a third-party company, which will also be collecting personal data. This creates another target for your information being lost.
According to the Surveillance Technology Oversight Project (or STOP), once a user registers with ID.me, they will have to provide their information to law enforcement, if requested. Although ID.me allows users to revoke their access, the software must keep their data for years to protect against fraud and potentially expose people to identity theft.
EPIC, STOP and Fight For The Future, along with three other civil rights organizations, have created a petition asking for the IRS to cancel the contract. Fight For The Future reports that the petition already has more than 1,000 signatures.
Blake Hall, ID.me’s CEO and founder, claims that ID.me uses high security standards to make online access more secure and accessible for taxpayers than other IRS methods. This is in contrast to previous IRS methods that required credit reports. Hall stated that ID.me has prevented “tens of thousand” of potential attacks on the IRS that could have led to taxpayers’ identities being stolen.
Hall stated that what we are doing is the digital equivalent to opening a bank account.
According to a spokesperson, 9/10 users can self-verify using ID.me. The process takes on average 5 minutes.
Because ID.me is ubiquitous, this 10% of unsuccessful applicants adds up quickly to a large population. People have complained about ID.me’s ability to verify unemployment benefits. There have been many complaints since last year when ID.me was contracted to work with over half the states in the United States.
