ID.me’s Remaining Federal Contracts Are in Danger

ID.me’s Remaining Federal Contracts Are in Danger
Photo: Xinhua News Agency, Getty Images

The Internal Revenue Services’ surprise decision last week to abandon ID.me’s facial recognition verification system has ushered in renewed scrutiny of a handful of federal agencies and 27 states that are still using the embattled company’s identity verification services.

Demands to re-evaluate or completely abandon those relationships gained the support of a collection of Democratic lawmakers on Monday, which included Massachusetts senator and former presidential candidate Elizabeth Warren. In a letter sent to the Department of Labour, senators Warren, Ron Wyden, and Sherrod Brown blasted the company for lacking “transparency” and called on the agency to assist states in finding alternatives to ID.me’s verification system for people seeking unemployment claims.

“It is concerning that so many state and federal government agencies have outsourced their core technology infrastructure to the private sector,” the senators wrote. “It is particularly concerning that one of the most prominent vendors in the space, ID.me, not only uses facial recognition and lacks transparency about its processes and results but frequently has unacceptably long wait times for users to be screened by humans after being rejected by the company’s automated scanning system.”

The senators urged the DOJ to work with the Government Services Administration to create a long-term secure verification system that doesn’t compromise privacy and suggested making the agency’s login.gov service available to states.

ID.me has made some major concessions in the wake of backlash from the public and digital rights groups. Last week, less than 24 hours after the IRS said it would abandon ID.me’s facial recognition service, the company announced it would make facial recognition optional for public sector government partners. ID.me said it would also allow all of its users to delete their face scans starting March 1. Both of those significant reversals are clear signs of ID.me’s efforts, however hopeful, to distance itself away from its surveillance-tinged reputation.

“ID.me is an identity verification company, not a biometrics company,” the company reminded readers.

Though privacy experts told Gizmodo they welcomed ID.me’s reversal, they largely remained sceptical of its implementation. In their letter, the senators emphasised that facial recognition was only part of the problem. “While the company’s willingness to make facial recognition optional is a step in the right direction, access to essential government services is still being gatekept by an outside contractor,” they wrote.

That sentiment was reiterated by ACLU Senior Policy Analyst Jay Stanley who told Gizmodo having a for-profit company develop what seems like an essential government service by any other stripe looked like “a broken way to build this kind of identity proofing system.”

Gizmodo reached out to four federal agencies who still have active contracts with ID.me and asked whether the IRS’ decision had caused the agencies to reevaluate their relationship with the company or if the agencies would still use facial recognition.

In an email, a spokesperson for the Department of Veterans Affairs said it is currently examining market research to see if continuing its relationship with ID.me is, “in the best interest of the agency.” The spokesperson said the agency’s current contract with ID.me, signed in 2019, is set to expire this April. After that, there are two subsequent option years available on the contract, which are currently under review.

A spokesperson for the Social Security Administration meanwhile said they plan to maintain registration options with ID.me along with a variety of other options. “Social Security offers multiple ways for the public to register for online services, and very few people choose to use ID.me,” the spokesperson said.

The other two federal agencies Gizmodo could confirm were working with ID.me — the US Patent and Trademark Office Relationship and the Federal Energy Regulatory Commission — did not immediately respond to Gizmodo’s requests for comment.

Questions still persist around the IRS’ connections with ID.me though. In another letter on Monday, U.S. senators Robert Menendez, Cory Booker, Catherine Cortez Masto, and Alex Padilla, expressed concerns over how ID.me will manage the biometric data it has collected on IRS users who have already submitted face scans and whether or not the IRS shared that data with other federal, state, or local law enforcement agencies.

“Congress has repeatedly expressed concern with the development of an unconstrained and pervasive surveillance infrastructure, fuelled by systems like ID.me,” the senators wrote. The senators also called on both the IRS and ID.me to contact taxpayers to let them know that they can indeed delete their face scans.

Meanwhile, recent reports allege ID.me’s welcome but rapid decision to make facial recognition optional for public government clients has come at the expense of its human reviewers. In interviews with The Verge last week, current and former ID.me employees said the company lacked sufficient human review capacity for its automated system and reportedly described the company as operating in “permanent crisis mode.”

In some cases, prior to the IRS’ reversal, sources told The Verge quality assurance staff (whose primary job is to ensure customer service) were spending around 40-50% of their time assisting overworked reviewers to verify identity documents. The ask for reviews could shoot up significantly if ID.me’s remaining federal clients decide to ditch facial recognition as well.

ID.me did not immediately respond to Gizmodo’s request for comment.

“Quite simply, the infrastructure that powers digital identity, particularly when used to access government websites, should be run by the government, and not a company with a track record of misleading the public,” the senators wrote in their letter to the DOL.