The IRS’s Dependency on Vendor-Powered Identity Proofing
Digital identity proofing has become an essential hurdle for taxpayers attempting to access sensitive IRS applications. The Internal Revenue Service (IRS) relies heavily on vendors like ID.me to verify identities online, especially in light of increasing security demands. However, a recent report from the Government Accountability Office (GAO) has raised significant concerns about the IRS’s management of these services, specifically pointing out a lack of quality control and independent oversight in the identity-proving process.
Quality Control Checks: A Missed Opportunity
One of the crucial allegations in the GAO report is that the IRS is not conducting quality control checks on the digital identity verification services offered by vendors such as ID.me. This has raised numerous red flags, especially considering that taxpayers’ sensitive information relies on the effectiveness of these systems. The IRS appears to be taking ID.me’s own performance assessments at face value, without a more rigorous method of verification. This situation could lead to unaddressed inefficiencies or vulnerabilities in the identity verification process.
The Background on ID.me and Identity Checks
ID.me is not just another tech vendor; it plays a pivotal role in how millions of taxpayers navigate the IRS’s online applications. Between 2021 and 2024, users logged into IRS applications requiring ID.me’s services a staggering 150 million times. The process generally involves one of two avenues: a self-service option, where users submit a selfie alongside a photo ID, or a video call with a live agent for real-time verification. Given the volume of users employing this service annually, the implications of ineffective identity proofing are profound.
Limited Options and Legislative History
In 2022, following outcry from Congress members and advocacy groups over privacy issues related to ID.me’s facial recognition technology, the IRS pledged to introduce a government-run identity proofing option. However, as of now, ID.me remains the sole provider for most IRS applications demanding stringent identity verification. This lack of alternatives is problematic, particularly for taxpayers concerned about privacy and data security.
Performance Measurement: Inadequate Data and Goals
The GAO’s report extends beyond just quality checks; it notes a troubling absence of measurable goals or performance objectives associated with ID.me’s services. In terms of accountability, the IRS has not listed its identity proofing solution in its required artificial intelligence inventory, despite the fact that the technology leverages AI for facial recognition. This oversight raises questions about whether the IRS can fully ensure compliance with internal agency expectations or broader governmental standards regarding AI usage.
Financial Commitments and Future Considerations
The IRS has entered into contracts committing over $242 million to ID.me for licenses, support services, and fraud analytics. These financial expenditures highlight the agency’s reliance on ID.me, which utilizes a third-party vendor, V3Gate, for its solutions. The potential for continued dependence on a single vendor poses risks, especially when there is a lack of independent evaluations to back up ID.me’s performance claims.
Privacy Concerns and Biases In Technology
While ID.me claims to have improved pass rates for identity proofing from 40% to over 70%, concerns persist regarding the reliability of technology that matches selfies to photos on IDs. Studies have shown that some identification technologies struggle to accurately distinguish between authentic and forged IDs. Moreover, the use of facial recognition technology has raised alarms about privacy violations and demographic biases, which could unfairly disadvantage certain groups while navigating online identity checks.
Legislative Recommendations and Future Directions
The GAO not only pointed out these deficiencies but also made recommendations for the IRS to establish measurable goals and regular evaluations of its digital identity verification. Although ID.me itself welcomed oversight and called for the establishment of performance metrics by the National Institute of Standards and Technology, the onus remains on the IRS. As the current blanket purchase agreement is set to expire in August, this upcoming renewal period presents an opportunity for the IRS to inject more oversight into its relationship with ID.me and potentially consider other solutions.
Moving Toward Diverse Identity Proofing Solutions
As of last fall, it became evident that ID.me is no longer the IRS’s only viable option for stringent identity proofing that meets established NIST standards. With the introduction of Login.gov, which now meets the higher identification requirements, taxpayers could potentially face less friction when it comes to proving their identities. Future IRS plans to incorporate additional identity assurance technologies could pave the way for a more diversified and secure approach to digital identity verification.
The Ongoing Need for Oversight
In summary, the revelations from the GAO report underscore the urgent need for stronger oversight over the identity proofing processes that the IRS employs. Without clear performance metrics, independent evaluations, and multiple options, taxpayers remain in a precarious situation, balancing the need for secure access to crucial services against the risks associated with relying on potentially flawed technology. The challenges surrounding digital identity proofing are complex, requiring thoughtful consideration and action from the IRS and related stakeholders to ensure the protection of taxpayer data and trust.
