IRS backs away from facial recognition technology

The Treasury Department is directing the Internal Revenue Service to back away from the use of the online identity proofing service ID.me as part of a new process for filing tax returns online.

The ID.me system required users to submit a selfie video as part of the identity verification process used for taxpayers who want to file their tax returns directly to the IRS – a new service being offered for the first time this filing season.

In a Feb. 7 press release the IRS said it would transition away from the third-party service and "quickly develop and bring online an additional authentication process that does not involve facial recognition." 

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised. Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition," IRS Commissioner Chuck Rettig said in a statement. 

The move comes after a letter from Senate Finance Committee Chairman Ron Wyden (D-Ore.) pressed the IRS to pivot from private vendor ID.me to the government's shared sign-on service, Login.gov, calling digital identity management a "core government service." 

"Quite simply, the infrastructure that powers digital identity, particularly when used to access government websites, should be run by the government," Wyden wrote in a Monday letter to the IRS. He said it is  "alarming that the IRS and so many other government agencies have outsourced their core technology infrastructure to the private sector."

Wyden noted that the homegrown government service isn't yet in wide use, "in part because many agencies have flouted the congressional mandate that they use it, and because successive administrations have failed to prioritize digital identity."

Login.gov, the government's single-sign-on service, is operated by the General Services Administration. It offers some identity proofing capabilities. According to an official at the Government Accountability Office, the IRS had considered using it but ultimately decided against it because it couldn't offer a high enough level of assurance. 

The Oregon Democrat greeted the pivot by the IRS in a statement saying, "I understand the transition process may take time, but I appreciate that the administration recognizes that privacy and security are not mutually exclusive and no one should be forced to submit to facial recognition to access critical government services."

Wyden isn't the only member on Capitol Hill pushing for the government to take a more substantial role in identity management. 

A bipartisan bill sponsored by Rep. Bill Foster (D-Ill.) would require the government to look for ways to be more active in digital identity verification.

Republicans on the Senate Finance Committee have also pointed to the government's role in their response to the use of ID.me, writing last week that "the IRS has unilaterally decided to allow an outside contractor to stand as the gatekeeper between citizens and necessary government services."

Login.gov got a nearly $187 million investment from Technology Modernization Fund last fall. At the time, a GSA spokesperson told FCW that Login.gov wanted to use that money to attract larger agencies with high-profile public- facing missions. 

But login.gov is limited by several factors, including the fact that it must be cost recoverable. Agencies also currently have to use the program in its entirety without the option to use only some of the login.gov capabilities. 

Wyden urged the Biden-Harris administration to "take ownership of this problem" by "clearing red tape that is preventing GSA from accessing and using for identity verification photographs and other data held by Departments of Motor Vehicles and the Social Security Administration."

Login.gov currently has ongoing pilots with the United States Postal Service and the Veterans Administration for people, as opposed to tech, to verify applicant photos to official government-issued ID cards, Wyden wrote.

"These pilots should be expanded nationwide, along with a call center that can verify by video people who, for a variety of reasons, are unable to be verified in-person," he continued. 

The IRS is continuing to face pushback from Capitol Hill for its decision to use the service, which uses biometrics to verify identities. 

Reps. Ted Lieu (D-Calif.), Anna Eshoo (D-Calif.), Pramila Jayapal (D-Wash.) and Yvette Clark (D-N.Y.) penned another letter sent to the IRS on Feb. 7 where they asked about the potential of cyberattacks targeting a biometric database and the accuracy and potential bias in biometric tech. 

"We urge the IRS to halt this plan and consult with a wide variety of stakeholders before deciding on an alternative," they wrote.

NextGov executive editor Frank Konkel contributed reporting to this story.