NEW PORT RICHEY, Fla. — Concerns the ABC Action News I-Team first revealed a year ago about ID.me's facial recognition blocking legitimate applicants from collecting unemployment have now sparked a national debate over privacy, access and oversight of the technology.
Under mounting pressure from lawmakers, questioning taxpayers' privacy and security, the Internal Revenue Service (IRS) has announcedit's dropping the use of ID.me's facial recognition tool as a requirement for Americans to access tax documents online.
This is the same technology the Florida Department of Economic Opportunity (DEO) and 29 other states use to verify identities and prevent unemployment fraud — a crime the FBI has described as a "crisis situation."
ID.me admits it uses a 'problematic' form of facial recognition
But the I-Team discovered the company does use a form of facial recognition it previously emphasized it did not.
The admission, lack of transparency and barriers to critical government services have digital rights and civil rights groups sounding the alarm.
RECOMMENDED:
- IRS no longer plans to require a selfie to access certain online tools
- FBI: Unemployment fraud is 'a crisis situation'
Caitlin Seeley George, campaign director for Fight for the Future, a nonprofit advocating for a ban on facial recognition technology, said the 30 states who use ID.me to verify identities for unemployment benefits should end contracts with the company.
“The basic problem here is that ID.me has been lying about what they’re doing. Which is not a way to build trust with the public and should not be something that a company that the government is contracting with should be doing," Seeley George told the I-Team. “They’re doing a broader type of facial recognition that can cause more problems.”
For months, ID.me said it only uses what's called "one-to-one" facial recognition to make sure people are who they say they are. So comparing a selfie to that person's ID, like a driver's license, rather than comparing someone's image to an entire database of images. That's referred to as "one-to-many" facial recognition.
Last year, in multiple emailed statements to the I-Team and during an interview with CEO Blake Hall, ID.me repeated what the company said was a crucial difference.
Statements from emails to the I-Team:
"This is One-to-One Face Matching and Liveness, which is massively different from One-to-Many Face Matching, commonly used by law enforcement."
"One-to-Many Face Matching is much more complex and should be subject to additional scrutiny based on how the technology is employed and for what purpose. ID.me does NOT use One-to-Many Face Matching."
In May 2021, Hall told the I-Team, “They shouldn’t be conflated because one-to-one face match is good and one-to-many face match is problematic."
Studies have found facial recognition can be biased and doesn't work as well on people of color, women and seniors.
Hall recently confirmed on his LinkedIn web page that there are times the company does use the very facial recognition check he called "problematic," posting, "We avoid disclosing methods we use to stop identity theft and organized crime as it jeopardizes their effectiveness."
Hall went on to write, "ID.me uses a specific '1 to Many' check on selfies tied to government programs targeted by organized crime to prevent prolific identity thieves and members of organized crime from stealing the identities of innocent victims en masse. This step is internal to ID.me and does not involve any external or government database."
RECOMMENDED:
- Facial recognition meant to stop unemployment fraud is blocking legitimate applicants
- Petition calls on states to stop requiring facial recognition for unemployment benefits
Private company used to access essential government services
Seeley George said the fact that ID.me is a private company raises even more issues.
“This database can also be a target for cyberattacks, and so the fact that it’s a private company just adds an extra layer of concern in terms of how your data is being protected," she said. “If there is a breach of a database of credit cards or even your social security information, you can replace that information. But you cannot replace your face."
In a letter to the Secretary of Labor, U.S. senators wrote that facial recognition should not be required to access unemployment or any other essential government services, saying steps to confirm identities "should be run by the government, and certainly not a company with a track record of misleading the public."
The letter, signed by Senate Committee on Finance Chairman U.S. Sen. Ron Wyden and members, Sen. Sherrod Brown and Sen. Elizabeth Warren, also said, "It is particularly concerning that one of the most prominent vendors in the space, ID.me, not only uses facial recognition and lacks transparency about its processes and results, but frequently has unacceptably long wait times for users to be screened by humans after being rejected by the company's automated scanning system."
Floridians struggling to confirm IDs
After reporting on hours-long wait times for Floridians trying to verify their identities, to apply for unemployment, day after day last year, the I-Team found those wait times continue.
Ren Dubois, who lives in New Port Richey, contacted the I-Team after spending days trying to access his account to file for unemployment.
"I had all of my paperwork, my numbers, everything," Dubois said.
Dubois successfully applied for unemployment at the beginning of the pandemic. He then went back to work at a Tarpon Springs restaurant before his bosses announced they were retiring. This second time applying for unemployment marked his first encounter with ID.me.
“We went through the scanning process," Dubois said of the facial recognition step in ID.me. "We went through the numbers, we went through whatever steps they wanted us to do and it kicks out."
Dubois said ID.me then provided a four-hour time window that someone from the company would be reaching out to video chat and verify his identity that way.
"I waited and then the last half hour it said that something wasn’t matching. They needed more proof or something, and I said to myself, oh my God, how much more do they need? I mean I gave them my license, I gave them my passport, I gave them my pay stubs, I mean what more could they want?”
The I-Team asked DEO several times about any plans for in-person verification.
“Put us somewhere where you can actually talk to somebody, physically talk to somebody," Dubois said.
The agency continues to direct Floridians to their closest CareerSource. But Dubois and many others say the staff was unable to help.
There is no phone number listed on ID.me's website to call directly.
Eventually, the I-Team was able to get Dubois the help he needed.
“Why does a faithful citizen, who’s been paying his dues and his taxes all his life, have to go through this? It’s crazy," Dubois said.
In addition to access, some people, like Jim Averill, worry about how their information is being stored.
“I have some concerns about facial recognition," Averill said.
As a tax preparer, Averill first learned of ID.me when he logged on to his IRS account. He then tried to access his unemployment account for documentation to file his own taxes.
He couldn't get through. Not until the I-Team contacted ID.me and DEO.
ID.me: Facial recognition 'enormously effective' at preventing ID theft
Last year, Hall told the I-Team, “What our data shows, is that it is enormously effective at preventing identity theft and preventing criminals from attacking the state."
“I’m all in favor of security, but it’s an extra layer that’s just nonsense," Averill said of the facial recognition component of ID.me's identity checks. “How can you convince me that ID.me is going to take my picture and all my personal data that I’ve had to show to prove who I am, and going to make sure that that is absolutely and totally secure? That’s the real issue with ID.me.”
DEO has declined, denied, or most recently, ignored multiple interview requests to speak with Secretary Dane Eagle about the agency's contract with ID.me, especially in light of the IRS announcing it would "transition away" from ID.me's use of facial recognition for the same concerns surrounding privacy that still exists for thousands of Floridians.
DEO pointed to a one-sentence response from ID.me:
“ID.me protects all sensitive data with stronger encryption than many financial institutions… Data security is our #1 priority. We do not share information with third parties without our members’ explicit permission.”
ID.me also declined an interview. In a statement, it said it does not share data collected through facial recognition with any government agency without "a subpoena, or as part of an investigation into an identity theft or fraud case" and that "no third party organizations, including government agencies, have access to ID.me's database."
Seeley George remains unconvinced.
“People should definitely be concerned about who is holding their data," she said. "Seeing that this tool has expanded to the point where it’s being used across the country on millions more people, there is a lot more attention being paid to it, which is good, and hopefully because of that, we can roll back not only the use at the federal level, but also with the state level.”
Florida Department of Economic Opportunity stands by ID.me
As pressure mounts, the I-Team asked DEO if it's standing by the technology impacting thousands of Floridians.
"DEO remains committed to securing claimants’ information, and continues to evaluate fraud prevention and security measures to support these efforts. The Department does not have plans to discontinue the use of ID.me to verify claimants’ identities, as this method has allowed the department to successfully combat and reduce fraud," a DEO spokesperson emailed.
ID.me gives option to skip facial recognition, delete selfie
ID.me has now announced a new option to verify identity without using facial recognition, saying the company has listened to feedback.
“In recent weeks, we have modified our process so government agencies can empower people to choose to verify their identity with an expert human agent without going through a selfie check. Agencies can now select this configuration. Additionally, all ID.me users will be able to delete their selfie or photo at account.ID.me beginning on March 1," Hall said in a statement.
ID.me said the deletion will take place within seven days.
A spokesperson for ID.me told the I-Team, "DEO remains committed to securing claimants’ information, and continues to evaluate fraud prevention and security measures to support these efforts. The Department does not have plans to discontinue the use of ID.me to verify claimants’ identities, as this method has allowed the department to successfully combat and reduce fraud. DEO has prevented approximately $23 billion in fraudulent benefit payments, as well as prevented more than 90% of identified fraudulent activity on claimant accounts."
The I-Team then asked DEO if it plans to select the new option ID.me is making available, so Floridians can skip the facial recognition portion of verifying their identity.
We are waiting to hear back.
After declining multiple requests for an interview, an ID.me spokesperson provided the following points in a statement after this story published:
- ID.me is an identity verification company. Our capabilities extend well beyond facial recognition. We have thousands of customer support agents who verify people through video chat. ID.me believes in choice. Our customers and the public asked for more options to choose the identity verification pathway that works best for them and we have provide additional features for state government partners that verify identity without using automatic facial recognition.
- On access/bias. We are committed to providing equitable, bias-free access to Americans. ID.me has pioneered alternative pathways to verify identity online, particularly for individuals who do not have credit history, are underbanked, are without a home, or live overseas. ID.me remains the most effective solution available for government agencies that provides the most access for under-served Americans with customer service in as many as 16 languages, 24/7 customer service, and identity verification that accepts 14 different types of documentation and does not require individuals to have a credit history.
- The FTC reported identity theft tied to government benefits increased by 2,920% during the pandemic. Sophisticated criminal enterprises have been successfully penetrating government benefits systems with fake identities, resulting in hundreds of billions in losses to state and federal treasuries, victimizing millions of Americans and causing a breach in trust between citizens and their government. ID.me is an essential tool to deliver secure access at scale.
- Four states have credited ID.me with preventing $210 billion in fraud.
ID.me said those four states are California, New Jersey, Georgia and Arizona.
If you have something you’d like the I-Team to investigate, email kylie.mcgivern@wfts.com or call 1-866-428-NEWS.
