IRS face recognition program raises hackles

The IRS' move to require some taxpayers to use facial recognition to identify themselves is reigniting a debate over how the government should use such technology.

Why it matters: Critics warn that, without sufficient guardrails, information collected by one agency for a seemingly benign purpose could easily be re-used in other ways.

Driving the news: The IRS will soon require taxpayers to provide a third-party company — ID.me — with a combination of documents and a video selfie to verify their identity before undertaking certain online interactions with the agency.

• The move was announced in November, but attracted widespread attention last week after security expert Brian Krebs highlighted the change on his blog.

What they're saying: "This announcement signals one of the largest expansions of facial recognition technology in the U.S. and there is no question that it will harm peoples’ privacy," says Caitlin Seeley George, campaign director at Fight For the Future.

• ID.me's terms of service, she notes, give the company the right to share peoples’ data with police, government and “select partners.”

Critics see red flags in the involvement of a private company in general, and also raise questions regarding ID.me specifically.

• "When ID.me was rolled out for state unemployment benefits we heard from many people who had issues with the system," Seeley George said. "Not only is it an issue that ID.me misidentifies people of color, gender-nonconforming people and women, but this system requires people to have a smart phone or a web camera in order to submit photos, which means economically disadvantaged and older people are going to have greater challenges getting through the system." (ID.me says its research found no disparity based on skin color.)
• "This basically is putting a private company between people and the government services that they need," says Jay Stanley, a senior policy analyst with the ACLU, noting the equity issues involved in requiring people who may have limited technology access and knowledge to go online. "They are forced to use this company if they want to access services to which they are entitled."

The other side: ID.me defended its technology and practices. In an interview, CEO Blake Hall said the company is committed to making its service both equitable and available, including a new option for people to verify their identity in person at more than 650 locations in the U.S.

• In 90 percent of cases, Hall said, people are able to get verified on their own, with about 10 percent needing to use the company's live video chat option.
• Although he said there have been time periods where wait times were long, he said most of those were due to huge pandemic-related demand spikes (or outbreaks within his company's staff that temporarily limited its workforce), and said wait times have declined significantly.
• Hall also drew a distinction between what his company does — matching a face to a known document — versus trying to pick a face out of a crowd or classify an image using face recognition.

Between the lines: An understaffed IRS is facing an especially tough battle to process all the country's tax returns a timely manner while trying to limit fraud.

• Tax evasion and underpayment remain problems, but recent years have seen a surge in fraud schemes aimed at claiming somebody else's refunds by filing false returns.
• Beefing up authentication measures is designed, in part, to help fight that scam.

The big picture: The U.S. government has been increasing its use of facial recognition technology overall, with a recent GAO report indicating at least 10 federal agencies plan to expand adoption of face recognition.

• Some cities, such as Portland, Minneapolis, San Francisco and Boston, have passed laws limiting use of the technology, but there has been little action on the federal level to set guidelines.
• ID.me's Hall said he supports legislation that would specify how government agencies can make use of facial recognition technology. "There are things around tracking and surveillance that absolutely need to be regulated," Hall told Axios.

Be smart: Verifying one's identity using ID.me is not required of everyone who needs to file taxes.

• It's for those looking to check their account online or get a transcript online.
• "There have been some wildly inaccurate statements regarding the use of selfies relating to paying and filing taxes," the IRS said in a statement. "The IRS emphasizes taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company."
• Yes, but: The IRS' use of the technology could expand.