IRS is exploring alternatives to selfie verification with ID.me

The Internal Revenue Service is reconsidering alternatives to ID.me, the controversial identity-checking system already used by states and other federal agencies, after public pushback at the notion that taxpayers will need to take selfies to access their IRS.gov accounts.

A Treasury Department official told CBS MoneyWatch that the agency was looking into alternatives to the software. 

The IRS in November announced its partnership with ID.me, under which taxpayers would need to register with the company to access their IRS.gov accounts to see their history of tax payments or access their tax transcripts. The deal received little scrutiny until this month, when security researcher Brian Krebs documented the process of verifying his identity by uploading documents, trying to take a selfie and connecting to an agent via videochat.

"Big Brother tactic"

Lawmakers and civil-liberties groups slammed the process as invasive.

"This is a very, very bad idea by the IRS. It will further weaken Americans' privacy," Representative Ted Lieu, a Democrat from California, said on Twitter. "The IRS needs to reverse this Big Brother tactic, NOW."

Senator Ron Wyden, a Democrat representing Oregon, said he was "very disturbed" by the development.

In a statement, a Treasury spokesperson reiterated that ID.me accounts would not be required to file tax returns and said the agency was trying to balance ease of access with defending the agency against criminals.

"The lack of funding for IRS IT modernization has made it impossible for the IRS to invest in state-of-the-art technology. The IRS today uses third-party service providers to validate the identification of individuals attempting to improperly gain access to taxpayer accounts. This includes ID.me, which is compliant with the National Institute of Security Technology standards and used by multiple agencies across the government," the spokesperson said.

Unregonizable

Civil rights advocates have long pointed out that facial recognition is less accurate for people with darker skin tones than for those with lighter skin. Face-match technology led to the wrongful arrest of a man for shoplifting, and to members of Congress being mistakenly matched to a mugshot database.

"Regardless of whether the IRS needs a new way to verify identity, they shouldn't be using facial recognition, particularly when there is a lack of regulation regarding the use of face images and other biometrics," said Jeramie Scott, senior counsel at the Electronic Privacy Information Center.  "Particularly when ... they're planning to outsource that identification to a third party company that is now also going to be collecting personal information, thus creating another target for your information to be lost," he said.

Once a user has registered with ID.me, the company will be required to share their information with law enforcement if asked, according to the Surveillance Technology Oversight Project, or STOP. While users can revoke ID.me's access to their data, the software is required to keep it for years to guard against fraud, potentially putting people at risk of identity theft.

EPIC, STOP, Fight For The Future and three other civil rights groups have launched a petition asking the IRS to revoke the contract. The petition has already received more than 1,000 signatures, according to Fight For The Future.

ID.me's founder and CEO, Blake Hall, maintains that ID.me has high security standards that make online access both more secure and more accessible to taxpayers than previous methods used by the IRS, which typically required users to have a credit report. Hall said that ID.me has stopped "tens of thousands" of would-be attacks on the IRS that could have resulted in taxpayers' identities being stolen.

"What we're doing is simply the digital equivalent of what every American does to open up a bank account," Hall said.

A spokesperson for the company said that 9 in 10 users can successfully self-verify with ID.me and that the process takes 5 minutes on average. 

However, because of ID.me's ubiquity, that unsuccessful 10% adds up to a large number of people. Since last year, when ID.me contracted with more than half of U.S. states to administer unemployment benefits, there have been innumerable complaints from people whose funds were put on hold incorrectly or who weren't able to get verified because they didn't have the right documents, couldn't access the internet or for other reasons.