That document encourages people to use long, easy-to-remember passwords rather than forcing them to frequently change them or specifying them to include special characters. It also introduced tougher ground rules for providing remote access to systems like those of the IRS and many other agencies with sensitive data.
In person, government agencies often require a photo identification such as a driver’s license. Online or by phone, many agencies previously verified identities by requesting information that could be checked against a person’s government records or credit report. But it has become easier to collect the personal data needed to spoof that kind of check in the times social network and mass data breaches.
NIST’s 2017 standard says that access to systems that could leak sensitive data or harm public programs must require a person’s identity to be verified by comparing them to a photo. — remotely or in person — or use biometrics such as a fingerprint scanner. It says remote checks can be done by video with a trained staff member or using software to check the authenticity of an ID and the “liveness” of a person’s photo or video.
ID.me is well positioned to take advantage of the new standards, which federal agencies need to compliance. The company was founded in 2010 as an exchange website for active duty and veterans and has developed a military ID check system used by the Department of Veterans Affairs. It won millions of dollars in federal grants to explore new approaches to digital identity that helped inform 2017 standards and become first company recognized as complying with them. In 2019, ID.me signed a contract with the VA has so far paid out over $30 million.
During the pandemic ID.me has won a flurry of new business — and scrutiny. Countries have hired ID.me to screen requests for Covid-19 aid, overwhelming many employment departments. But nonprofits and lawmakers have complained about the use of facial recognition and said some vulnerable citizens are unable to pass the company’s checks. The California Department of Employment Development reports that ID.me blocked over 350,000 fraudulent claims in the last three months of 2020. But State auditor says an estimated 20% of legitimate claimants are unable to verify their identity using ID.me.
Caitlin Seeley George, director of campaigns and operations for the nonprofit Fight for the Future, said ID.me uses the specter of fraud to sell technology that locks down vulnerable people and creates a trove of data. highly sensitive data that in itself would be a target for criminals. “A tool that creates more problems cannot be considered a solution,” she said. “Facial recognition is notorious for misidentifying Black and Brown faces, gender mismatches, women, and children.”
In an interview this week, ID.me CEO Blake Hall stated that his company is in fact expanding access because its remote ID check feature works for people who don’t have one. credit histories, who often don’t do routine checks. He claimed many of the problems in accessing pandemic aid were due to the lack of adequate in-person services by state agencies, and ID.me’s in-person locations as a supporting factor.
Some of Hall’s statements have proven to be smooth. Bloomberg News question his estimate that $400 billion in federal pandemic relief was stolen; Hall said a report detailing ID.me’s experience in combating unemployment fraud will be available soon. Fourth, he reversed his earlier claims that ID.me only uses facial recognition to compare a person’s face with the ID it provided.
Hall told WIRED that ID.me withholds uploaded images and videos during its verification process solely to protect the account from being taken over by scammers. He said the company used facial recognition technology from Paravision, one of the most accurate ever tested by NIST – although the algorithms can behave very differently depending on how they are implemented. declare. One year 2019 NIST Report on demographic bias in facial recognition concluded that although many algorithms show different performance for different demographics, the most accurate can be fair.
