Such problems led the IRS and many others to turn to alternatives, such as sending a code to a phone number that was checked against credit bureau records. They also announced a 2017 overhaul of the Federal Guidelines for Digital Identity, recommends that access to systems that could leak sensitive data or cause financial harm should require a person’s verification with a photo ID or biometrics such as fingerprints. Photo checking can be done face-to-face, via video chat, or using algorithms that compare an image or video of a person’s face with their ID.
At the same time, selfie-checking spread among private companies like Airbnb, Uber, Lyft, Stripesand cryptocurrency exchange Coinbase.
ID.me, a Virginia-based startup, pioneered facial recognition for identity proof at government agencies, and in 2018 it became The first certified supplier against the 2017 NIST guidelines. The pandemic has boosted its business. More than two dozen state employment agencies have implemented ID.me since the pandemic began, often touting the service as a way to speed up processing of claims while preventing the fraud that has plagued pandemic aid programs.
Even in light of the recent outcry over the IRS’s use of ID.me, the company has come under criticism. Individuals are complained about wait for hours or even month to fix failed selfie test; Privacy experts have pointed out that collecting selfies creates new vulnerabilities. California State Auditor said last year that while the company’s system improved its handling of job requests, it rejected an estimated 20 percent of legitimate claimants in its early months of use.
Daniela Urban, CEO of Workers’ Rights CenterA nonprofit organization in Sacramento, California that specializes in helping low-wage workers and their families, says that when California’s Department of Employment Development adopted ID.me in late 2020, it did immediately created “a major roadblock” for many of her clients.
The service’s default workflow requires both a smartphone and a laptop or other device, something many low-income people lack. And helping people from afar has become a lot harder. When customers called with ID.me issues, Urban and her staff asked them to sign up using a paper form instead. “We found this to be the easiest workaround, because claimants spent weeks or months trying to find someone they knew by computer or phone who could help,” Urban says. surname”.
The IRS did not respond to a query about how it would verify identities without using facial recognition. Kathleen Moriarty, chief technology officer at the Center for Internet Security, said the backlash against the IRS could prompt security experts and standard-setters to reconsider if or when facial recognition is a acceptable way to verify online identity. “Sometimes we get to a place where we have to rethink how we make decisions about using technology,” she said.
ID.me’s CEO, Blake Hall, said he’s been rethinking some of his own decisions. “There was a group of users that we didn’t take into account,” says Hall. “We are now very aware that we need to give them a roadmap.” ID.me will now allow agents to give people the choice between automated processing with facial recognition or video chat with the agent, a process that was previously only redundant if facial recognition unsuccessful. Hall said he’s hiring hundreds more agents to staff those conversations, but early tests show that more than 95% of people choose facial recognition. The company also has 700 locations for in-person ID verification across the US.
Even before the IRS controversy, at least one federal agency opposed the use of facial recognition for online ID checks. Social Security Administration NIST warning in 2020 about “privacy, usability, and policy concerns” about technology. “In preliminary testing, we found a large number of customers were uncomfortable submitting a photo or lacked the technical or hardware knowledge to do so successfully,” the agency wrote. It raised concerns about bias that could affect minorities and required that alternatives be allowed. NIST is published an updated draft of its digital identity guidelines this year and after public comment will finalize it by 2023.
Currently, the IRS and other agencies can rely on established but imperfect mechanisms such as verification codes sent by text message — despite the evolution of the Internet. “SIM swapping” attacks that can hijack the process.
