Reps. Maloney and Clyburn launch investigation of face scan contractor ID.me

Placeholder while article actions load

House lawmakers on Thursday launched an investigation into the efficacy and security of the identity verification contractor ID.me, after government agencies’ use of the software to identify people accessing tax records and unemployment assistance led to a rapid expansion of facial recognition in everyday American life.

In a sweeping 10-page letter addressed to ID.me chief executive Blake Hall, lawmakers requested that the company turn over detailed records about its contracts with federal, state and local governments, as well as answer questions about how it investigates potential inaccuracies in its systems. Lawmakers wrote of “serious concerns” about 10 federal agencies and 30 state governments contracting with ID.me, given questions about the accuracy of the facial recognition service and reports of long delays in using the service to access pandemic assistance.

The letter, which was viewed exclusively by The Washington Post, was written by leaders of the House Oversight Committee, which watches for potential abuse of taxpayer funds, and the House select subcommittee on the coronavirus crisis, led by House Majority Whip James E. Clyburn (D-S.C.). The joint effort reflects lawmakers’ concerns about government use of the software. The IRS used ID.me to enable taxpayers to access their records, while states used the service to verify the identities of people seeking pandemic unemployment assistance.

Rep. Carolyn B. Maloney (D-N.Y.), the chair of the House Oversight Committee, said in a statement that she hopes the investigation leads to “more transparency and accountability” in the government’s use of facial recognition.

“Without clear rules of the road, agencies will continue to turn to companies like ID.me, which heightens the risk that essential services will not be equitably provided to Americans, or will be outright denied, and that their biometric data won’t be properly safeguarded,” Maloney said.

IRS plan to scan your face prompts anger in Congress, confusion among taxpayers

The investigation follows stories in The Post raising concerns about the system’s accuracy, technical errors and long delays.

No federal law regulates the use of facial recognition or specifies how the technology should be secured to protect privacy. The House probe is an escalation of years of controversy over the government’s growing reliance on facial recognition, which boiled over this year after the IRS said it would require Americans to scan their faces to access their tax accounts.

Government agencies have been increasingly relying on facial recognition despite warnings from the General Services Administration that the technology has too many problems for its use to be justified. The House held hearings in 2019 highlighting bipartisan concern over facial recognition, but efforts to pass legislation restricting its use have largely stalled.

Following complaints from members of Congress, taxpayers and privacy advocates, the IRS dropped its plans, announcing it would “transition away” from using the service.

ID.me subsequently said it would drop the facial recognition requirement for all federal and state agencies.

The Technology 202: House hearing highlights the lack of oversight of facial recognition technology

ID.me spokesman Patrick Dorton said in a statement that ID.me remains a “highly effective solution” for government agencies and said that the service has played a role in limiting fraud during the pandemic. He pointed to a Post column suggesting that people are having higher success rates in setting up IRS accounts with ID.me despite the privacy concerns surrounding the software.

“We look forward to providing important information to the Committee on how ID.me has expanded access to government for disadvantaged Americans, including individuals who do not have credit history, are underbanked, or are without a home,” he said.

The IRS did not immediately respond to requests for comment.

The lawmakers’ letter to ID.me underscores how little is known about the scale of governments’ use of facial recognition and the accuracy of the services. Lawmakers requested that the company report how many people completed the ID.me process to authenticate their identity to access government services and how many were rejected. The letter also asks for the service’s average wait time and details about the companies’ retention of biometric data related to government contracts.

In February, the company said that the 73 million people who had used its service would be able to delete their selfies or photo data.

The lawmakers’ letter also reflects their concerns about the company’s contracts with the IRS. Maloney in February sent a letter to the IRS revealing that the agency had directed 7 million people to the facial recognition vendor, and she demanded answers about how the agency would help people in deleting their data, and how much it would cost for the IRS to terminate its $86 million contract with ID.me.

In a response viewed by The Post, the IRS said that it would require ID.me to delete all selfies and face videos it had received by March 11 and would not notify users about this process. The agency did not indicate any plans to terminate its contract with ID.me, noting that its contract allows for that without additional costs.

The IRS directed 7 million Americans to sign up with ID.me face-scan service, according to congressional letter

Lawmakers also say that there are equity issues with requiring ID.me to access key government services — especially for older and low-income people who may not have access to a smartphone or laptop, and may need government assistance most urgently. As of 2021, about 15 percent of American adults did not own smartphones, and 23 percent did not own desktop or laptop computers, according to data the letter cites from Pew.

“The ID.me process creates disproportionate obstacles for older individuals who may face challenges using new technology, residents of rural and low-income areas without high-speed Internet access, and households that share technological devices for school, remote work, or job hunting.”