The Flawed Federal Expansion of Facial Recognition Software
By Amar Chatterjee | March 2, 2022
The past few months at the I.R.S. have been mired in controversy over the partnership with a facial recognition technology company called ID.me. In November 2021, the agency made a major decision requiring all citizens to create an ID.me account in order to access basic online services such as applying for a payment plan or checking the payment status of child tax credits. Citing a desire to improve user experience, the I.R.S. plowed forward with the rollout clearly not having thought through possible side-effects. The arduous 13-step registration process is not for the tech illiterate, requiring photos of official documentation as well as a video selfie to be uploaded to the company’s servers for identity verification.
For the thousands of citizens who faced hurdles during the registration process due to inadequate technical skills, resources, or a myriad of other possible issues, the only option was to wait on hold for hours to speak with an ID.me “Trusted Referee”. It would be easy to repeatedly abandon or postpone the registration process for the average American balancing their daily responsibilities.
The use of facial recognition software by the government to this degree is also unprecedented, with far too much risk around how the data will be protected into the future. There are no federal regulations in existence today to govern facial recognition technology on a national scale, nor how that data might be shared externally. ID.me’s Privacy Terms do little to quell concerns on data usage and management, and registrants could easily find themselves the victim of Big Brother government tactics. There have been numerous issues associated with facial recognition inaccuracies that have disproportionately impacted certain communities, especially persons of color.
Finally, after months of horrible press due to the clunky registration process, poor customer service, and cries from civil rights groups to put a stop to the program, the I.R.S. finally walked back its strategy in early February 2022. A rare display of overwhelming bipartisan backlash put the final nail in the coffin, and the I.R.S. has stated they will “transition away” from using ID.me as an authentication service provider (Rappeport and Hill 2022).
So where do we go from here? For starters, let’s cease the use of facial recognition technology as a precursor to accessing essential services. Let’s also insist that our federal agencies think far more critically about these implementations to understand impacts prior to going live. The sad reality is that few employees in charge of devising and spearheading such programs are rarely ever in a position to need to use them, hampering their ability to meaningfully consider all perspectives. Additionally, if the federal government is serious about combatting identity theft, then it should invest appropriately in a robust government-sponsored program rather than a third-party, for-profit organization. It is worth noting that the $86 million dollar contract awarded to ID.me by the Treasury Department was not its first governmental contract, as it maintains active partnerships with the Social Security Administration, the Department of Veterans Affairs, as well as many state agencies (Rappeport and Hill 2022). Senate Finance Committee Chair Ron Wyden (D-Oregon) has suggested that the I.R.S. simply leverage Login.gov, an existing authentication system that is already used by millions of Americans for some federal services (Chu 2022).
The jury is still out on how the biometric data of millions whom have already registered for an ID.me account will be managed, or better yet, purged. Earlier this month, the company did publish a statement that “it will let anyone who created an account through the company to delete their selfies starting March 1”, but that process remains to be seen (Picchi and Ivanova 2022). While the I.R.S. has committed to helping have user data deleted, there have been no further details provided on how that will be accomplished. This is an extremely fluid situation with new information weekly, but hopefully we will see a swift and fair resolution soon.
In 1789 Ben Franklin famously said, “In this world, nothing is certain except death and taxes”. Let’s not add a violation of privacy to that list.
References:
1. Chu, K. (2022, February 7). Wyden calls on IRS to end use of facial recognition for online accounts: The United States Senate Committee on Finance. United States Senate Committee On Finance. Retrieved February 18, 2022, from https://www.finance.senate.gov/chairmans-news/wyden-calls-on-irs-to-end-use-of-facial-recognition-for-online-accounts
2. Harwell, D. (2022, January 27). IRS plan to scan your face prompts anger in Congress, confusion among taxpayers. The Washington Post. Retrieved February 18, 2022, from https://www.washingtonpost.com/technology/2022/01/27/irs-face-scans/
3. Joshi, N. (2019, November 9). Six reasons you should be worried about facial recognition. Allerin. Retrieved February 18, 2022, from https://www.allerin.com/blog/six-reasons-you-should-be-worried-about-facial-recognition
4. Krebs, B. (2022, January 19). IRS will soon require selfies for online access. Krebs on Security. Retrieved February 18, 2022, from https://krebsonsecurity.com/2022/01/irs-will-soon-require-selfies-for-online-access/
5. Picchi, A., & Ivanova, I. (2022, February 9). ID.me says users can delete selfies following IRS backlash. CBS News. Retrieved February 18, 2022, from https://www.cbsnews.com/news/irs-id-me-delete-facial-recognition-tax-returns-backlash/
6. Rappeport, A., & Hill, K. (2022, February 7). I.R.S. to end use of facial recognition for identity verification. The New York Times. Retrieved February 8, 2022, from https://www.nytimes.com/2022/02/07/us/politics/irs-idme-facial-recognition.html
7. Roth, E. (2022, January 29). The IRS is reportedly looking for ID.ME alternatives amid privacy concerns. The Verge. Retrieved February 8, 2022, from https://www.theverge.com/2022/1/29/22907853/irs-idme-facial-recognition-alternatives-privacy-concerns