IRS drops facial recognition plans after criticism
The agency said it will no longer require taxpayers to use a third-party website to authenticate identity and will develop its own tools to boost security and prevent fraud.
After protests, the IRS said it will drop its plans to use a third-party facial recognition vendor to authenticate taxpayers.
The agency last November started requiring taxpayers who were applying for services such as the Child Tax Credit or trying to access transcripts online to create an account with facial recognition vendor ID.me including a photo of their face.
Starting this summer, all taxpayers would have had to use the facial recognition system to pay taxes online.
And despite ID.me's insistence that it uses the less intrusive one-to-one face match instead of the prone to bias one-to-many face match, criticism continued to grow, including most recently from two Republican senators who sent the agency a letter expressing concern about using a third-party service to verify taxpayers' identities.
On Feb. 7, the IRS said in a statement that it will now "transition" in the next few weeks from using ID.me to authenticate people creating new online accounts.
The agency acknowledged concerns about facial recognition technology and said it will develop new authentication methods that will allow taxpayers to create an account and access online tools, at least in the short term, without using facial recognition.
Meanwhile, on Feb. 8, ID.me said users now can verify their identity without using the company's automated facial recognition feature, by going on the ID.me website and working with a human agent, instead of taking a selfie.
Facial recognition critics apparently prevail
Privacy advocates said the IRS reversal shows that Americans are opposed to facial recognition technology.
Every time the public sees this technology being used, they're outraged.
Albert CahnExecutive director, Surveillance Technology Oversight Project
"Every time the public sees this technology being used, they're outraged," said Albert Cahn, executive director at Surveillance Technology Oversight Project (STOP).
News about the IRS using the technology also revealed that other government agencies are using ID.me and the facial recognition technology, Cahn said.
"I think the only reason so many government agencies were able to get away with this for so long is because the public just didn't realize what was going on," he said. "Now we're hoping to build on that momentum and see more agencies ditch ID.me."
The main reason for the backlash against the IRS was that people are don't like government agencies and private businesses building databases of biometric "or personally identifiable facial features for any purpose, especially that of accessing basic government services," said Ronald Schmelzer, an analyst at Cognilytica.
Exactly how ID.me was using facial recognition with the IRS is unclear, because the vendor has backtracked on how it is applying the technology and acknowledged using Amazon's controversial Rekognition image analysis system and not only one-to-one face match.
"I think it's a good thing to be walking back on facial recognition," Schmelzer said. "First, it's full of vendor hype. Vendors are overstating their abilities, and AI systems are just not perfect enough when it comes to facial recognition."
"Databases of faces and biometric information is a current and future cybersecurity vulnerability," he continued. "Without addressing those issues first, I think facial recognition will be a hard sell for any government application, let alone critical enterprise application."
Twenty-seven states have used or are still using ID.me for various purposes, including to verify the identity of people applying for unemployment benefits, according to the company and state officials.
Preventing tax fraud
Some have cited tax fraud as a good reason for the IRS to use facial recognition technology. But Cahn noted that STOP proposed last year to the Biden administration that instead of Americans getting personal identification numbers (PIN) after filing taxes, they should get cryptographic keys as a form of identification.
"These sorts of things are not going to be perfect," Cahn said of cryptographic key technology. "It's not going to work for everyone. But it's going to allow at least the vast majority of people to confirm their identity with the government online without the dangers that come with biometric surveillance."
The IRS -- which is hampered by short staffing, delays in processing returns and a backlog of millions of tax returns and correspondence from last year -- said dropping the facial recognition requirement will not prevent taxpayers from filing returns or paying taxes and won't affect the current tax season.
