ID.me Doesn't Have Enough Humans To Backstop Its AI, Allowed A Guy In A Bad Wig To Illegally Obtain $900,000 In Benefits

from the congrats-on-the-windfall,-McLovin dept

ID.me -- the facial recognition company that has managed to snag several lucrative contracts -- has gotten the brushback from perhaps its most lucrative government partner, the IRS. ID.me promised government agencies better control over distributions of unemployment benefits and other payments to the public, citing its own (unexamined) prowess at recognizing faces as well as an astounding claim that governments have been duped out of $400 billion in unemployment benefits by fraudsters -- a claim it has yet to back up with actual evidence.

That the pitch worked so well isn't a surprise. After all, governments hate to give money to taxpayers and most governments have deficits they'd like to trim down. Anyone promising millions in savings is bound to be given a second, third, or fourth chance even after it's become obvious claims about fraud are, at best, dubious, and that the company can't really do the job it promised to do: eliminate fraud.

Misspending tax dollars is a national pastime. The bizarre embrace of ID.me is no exception. The IRS may have walked back its reliance on ID.me for identity verification, but problems persist. States are still relying on ID.me, even if the feds aren't. And ID.me doesn't seem to have the personnel on hand to backstop questionable calls by its facial recognition tech, as Corin Faife reports for The Verge.

Internal documents and former ID.me employees say the company was beset by disorganization and staffing shortages throughout 2021, as shortcomings in the automated systems created tensions among the company’s workforce, particularly the human verification workers who have to step in when the algorithms fail. Even now, the company plays a central role in how claimants access benefits across the United States — working on behalf of 27 state-level uninsurance employment programs to verify applicants — and the underlying issues are far from settled.

Current and former employees who spoke to The Verge paint a picture of a company described as being in “permanent crisis mode,” changing policies rapidly to keep up with fluctuating demand for its services and fight a slew of negative press. In particular, they say a lack of human review capacity has been a chokepoint for the company, leading to stress, pressure, and a failure to meet quality standards.

This verifies accusations raised earlier by other critics of ID.me -- critics who were forced to become users of faulty systems due to several states making ID.me the barrier between claimants and their benefits. Those locked out of their benefits complained the company offered few options for review of their supplied info. ID.me claimed it was performing reviews on the regular, but social media comments suggested this simply wasn't true. Actual humans were nearly impossible to reach. This report confirms what was suspected: the company simply did not have enough humans employed to deal with the problems generated by its verification processes.

Claimants were given no option but to put all their biometric eggs into one malicious hacker-tempting basket owned and operated by ID.me. When glitches separated people from their payments, the company's CEO blamed users for not being better at using an entirely new verification system. When these problems persisted, the CEO claimed most false negatives were actually the company thwarting fraudsters.

But ID.me can be duped. And it can be duped fairly easily it seems. A Washington Post report shows one person illicitly secured nearly $1 million in unemployment benefits using little more than an extremely obvious wig.

[D]espite the scale of the data gathering by the company, ID.me, revealed in newly released records, the system has been exploited by scammers. Federal prosecutors last month said a New Jersey man was able to verify fake driver’s licenses through an ID.me system in California as part of a $2.5 million unemployment-fraud scheme.

ID.me has pointed to the scam as an example of how well its systems work, noting that it referred the case to federal law enforcement after an internal investigation. But the criminal complaint in the case shows that ID.me’s identification systems did not detect bogus accounts created around the same day that included fake driver’s licenses with photos of the suspect’s face in a cartoonish curly wig.

I mean… [images via DOJ criminal complaint]:

Humans might have been able to shut this fraud down immediately. But it's clear ID.me doesn't have enough humans and is relying on mostly unproven tech to decide who is or isn't entitled to government benefits.

The IRS's walk-back on ID.me use may end up causing at least as many problems as it solves, unfortunately. The IRS also suffers from a shortage of humans and now they will be expected to do more with less outside assistance as tax return season shifts into high gear. By the time the IRS was forced by public and Congressional pressure to make a change, it was already up to its eyeballs in returns. Taxpayers can now expect delays ranging from several weeks to several months at least partially as a result of the agency's regrettable decision to do business with ID.me and its questionable track record.

Filed Under: ai, facial recognition, government benefits, wigs
Companies: id.me

IRS Says It Will Move Away From Requiring ID.me Facial Recognition

from the good-move dept

Last month, we wrote about how the IRS and other federal agencies were starting to require the use of private facial recognition from a somewhat sketchy private company, for people to access their own government's services. The main company in question, ID.me, had made some... questionable decisions that raised serious questions about why the government was forcing people to make use of such a private service.

Earlier this morning, Senator Ron Wyden sent a letter to the Treasury Department calling on them to drop the facial recognition requirement, and within hours the Treasury Department told Wyden it would be "moving away" from that plan, and then the IRS put up a more official statement:

The IRS announced it will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts. The transition will occur over the coming weeks in order to prevent larger disruptions to taxpayers during filing season.

During the transition, the IRS will quickly develop and bring online an additional authentication process that does not involve facial recognition. The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," said IRS Commissioner Chuck Rettig. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."

The transition announced today does not interfere with the taxpayer's ability to file their return or pay taxes owed. During this period, the IRS will continue to accept tax filings, and it has no other impact on the current tax season. People should continue to file their taxes as they normally would.

Last week the Treasury Department had said it was "reviewing" the matter, but today's announcement is a big deal. It's rare to see a government agency move this fast, so kudos to Treasury/IRS for acting quickly (though, it can be argued that it never should have gotten this far in the first place). But also kudos to Wyden for helping make this happen as well.

Filed Under: facial recognition, irs, privacy, ron wyden, security, treasury department
Companies: id.me

ID.me Finally Admits It Runs Selfies Against Preexisting Databases As IRS Reconsiders Its Partnership With The Company

from the CEO-Blake-Hall-finally-understanding-bluster-can-only-take-you-so-far dept

Tech company ID.me has made amazing inroads with government customers over the past several months. Some of this is due to unvetted claims by the company's CEO, Blake Hall, who has asserted (without evidence) that the federal government lost $400 billion to fraudulent COVID-related claims in 2020. He also claimed (without providing evidence) that ID.me's facial recognition tech was sturdy, sound, accurate, and backstopped by human review.

These claims were made after it became apparent the AI was somewhat faulty, resulting in people being locked out of their unemployment benefits in several states. This was a problem, considering ID.me was now being used by 27 states to handle dispersal of various benefits. And it was bound to get worse, if for no other reason than ID.me would be expected to handle an entire nation of beneficiaries, thanks to its contract with the IRS.

The other problem is the CEO's attitude towards reported failures. He has yet to produce anything that backs up his $400 billion in fraud claim and when confronted with mass failures at state level has chosen to blame these on the actions of fraudsters, rather than people simply being denied access to benefits due to imperfect selfies.

Another claim made by Hall has resulted in a walk-back by ID.me's CEO, prompted by increased scrutiny of his company's activities. First, the company's AI has never been tested by an outside party, which means any accuracy claims should be given some serious side-eye until it's been independently verified.

But Hall also claimed the company wasn't using any existing databases to match faces, insinuating the company relied on 1:1 matching to verify someone's identity. But this couldn't possibly be true for all benefit seekers, who had never previously uploaded a photo to the company's servers, only to be rejected when ID.me claimed to not find a match.

It's obvious the company was using 1:many matching, which carries with it a bigger potential for failure, as well as the inherent flaws of almost all facial recognition tech: the tendency to be less reliable when dealing with women and minorities.

This increased outside scrutiny of ID.me has forced CEO Blake Hall to come clean. And it started with his own employees pointing out how continuing to maintain this line of "1-to-1" bullshit would come back to haunt the company. Internal chats obtained by CyberScoop show employees imploring Hall to be honest about the company's practices before his dishonesty caused it any more damage.

“We could disable the 1:many face search, but then lose a valuable fraud-fighting tool. Or we could change our public stance on using 1:many face search,” an engineer wrote in a message posted to a company Slack channel on Tuesday. “But it seems we can’t keep doing one thing and saying another as that’s bound to land us in hot water.”

The internal messages, obtained by CyberScoop, also imply that the company discussed the use of 1:many with the IRS in a meeting.

Those messages had a direct effect: Blake Hall issued a LinkedIn post that admitted the company used 1:many verification, which indicates the company also relies on outside databases to verify identity.

In the Wednesday LinkedIn post Hall said that 1:many verification is used “once during enrollment” and “is not tied to identity verification.”

“It does not block legitimate users from verifying their identity, nor is it used for any other purpose other than to prevent identity theft,” he writes.

Hall's post hedges things quite a bit by insinuating any failures to access benefits is the result of malicious fraudsters, rather than any flaws in ID.me's tech. But this belated honesty -- along with the company's multiple failures at the state level -- has caused the IRS to reconsider its reliance on ID.me's AI. (Archived link here.)

The Treasury Department is reconsidering the Internal Revenue Service’s reliance on facial recognition software ID.me for access to its website, an official said Friday amid scrutiny of the company’s collection of images of tens of millions of Americans’ faces.

Treasury and the IRS are looking into alternatives to ID.me, the department official said, and the agencies are in the meantime attentive to concerns around the software.

This doesn't mean the IRS has divested itself of ID.me completely. At the moment, it's only doing some shopping around. Filing your taxes online still means subjecting yourself to ID.me's verification software for the time being.

A recent blog post on ID.me's site explains how the company verifies identity as well as names the algorithms it relies on to match faces, which include Paravision (which has been tested by the NIST) and Amazon's Rekognition, a product Amazon took off the law enforcement market in 2020, perhaps sensing the public's reluctance to embrace even more domestic surveillance tech.

This may be too little too late for ID.me. Its refusal to engage honestly and transparently with the public while gobbling up state and federal government contracts has expanded its scrutiny past that of the Extremely Online. Senator Ron Wyden wants to know why the IRS has made ID.me the only option for online filing.

I’m very disturbed that Americans may have to submit to a facial recognition system, wait on hold for hours, or both, to access personal data on the IRS website. While e-filing returns remain unaffected, I’m pushing the IRS for greater transparency on this plan.

But e-filing is affected. As the IRS's spokesperson noted in a statement to Bloomberg, ID.me is still standing between e-filers and e-filing.

[IRS spokesperson Barbara] LaManna noted that any taxpayer who does not want to use ID.me can opt against filing his or her taxes online.

It may be true that people with existing accounts might be able to route around this tech impediment, but new filers are still forced to interact with ID.me to set up accounts for e-filing. If spotty state interactions created national headlines, just wait until a nation of millions starts putting ID.me's tech through its paces.

Filed Under: blake hall, facial recognition, irs, privacy
Companies: id.me

Biometric Tech Company ID.Me Continues To Swallow Gov't Agencies, Cause Problems For People Trying To Access Their Gov't Benefits

from the questionable-claims,-extremely-limited-accountability dept

A private company, that leveraged a bold (unproven) claim about $400 billion in pandemic unemployment fraud into government contracts allowing it to (mistakenly) lock people out of their unemployment benefits, is hoping to use both of these dubious achievements to secure even more government contracts.

Here's the claim:

Blake Hall, CEO of ID.me, a service that tries to prevent this kind of fraud, tells Axios that America has lost more than $400 billion to fraudulent claims. As much as 50% of all unemployment monies might have been stolen, he says.

Here's at least one immediate reaction to Halls's claim.

“The greatest theft of American tax dollars in history has risen unabated to $400 billion, with nearly half of all pandemic unemployment spending lost to fraud by criminals,” declared Kevin Brady, the top Republican on the House Ways and Means Committee.

And here's the reality:

In December, California, by far the largest state payee of benefits, said it had identified $20 billion in fraudulent unemployment payments during the pandemic, 11% of what it paid out overall. California was responsible for a quarter of all pandemic unemployment payouts in the U.S.; if its fraud experience held nationally over the past two years it would translate into roughly $95 billion. That’s a big sum, but still only a quarter of what Hall was estimating. And other states like Ohio and Texas have reported lower levels of fraudulent payments than California.

But it made for a hell of a sales pitch. ID.me is currently used to verify the identity of unemployment benefit recipients in 27 states. It also secured a $1 billion contract from the Department of Labor to modernize state systems used to handle dispersal of these benefits.

All of this snowballed into ID.me's biggest get: the Internal Revenue Service.

If you created an online account to manage your tax records with the U.S. Internal Revenue Service (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through ID.me, an online identity verification service that requires applicants to submit copies of bills and identity documents, as well as a live video feed of their faces via a mobile device.

That's from Brian Krebs of Krebs On Security. His experience with the verification process was far from painless. The process requires users to take a live, video selfie from the same device being used to apply for the account. This means users can't use a laptop/desktop computer and take the selfie on their phone, even though that would be the most convenient way to accomplish both tasks (apply and verify).

In Krebs' case, the application process got stuck when ID.me came to a halt during the phone verification process, prompting a request for Krebs to reupload three identification documents. Then it told him to wait:

After re-uploading all of this information, ID.me’s system prompted me to “Please stay on this screen to join video call.” However, the estimated wait time when that message first popped up said “3 hours and 27 minutes.”

The system has glitches, as is to be expected from any system engaging in identification verification over the internet. But the problems experienced here are far from abnormal, and that's going to cause lots of people lots of problems with tax filing season now underway. This only adds the IRS to the list of government entities that have discovered it's not performing as well as advertised.

A log of complaints for California’s Employment Development Department (EDD), which signed up with ID.me in September 2020, details issues ranging from a transgender person being blocked from accessing benefits because the gender on their driver’s license didn’t match their passport to an applicant who went through ID.me’s verification process only to find their claim still on hold six weeks later. In a January 2021 letter to the EDD, California state Senator Anthony Portantino complained that his staff had been “inundated with urgent pleas” from constituents whose benefits were on hold as a result of problems with ID.me. “This recent purge has put thousands of legitimate claims in limbo, with no instructions for how to get out of ‘ID verification jail,’ ” Portantino wrote.

Some of these problems can be traced back to ID.me's facial recognition AI, which has yet to be independently tested, despite being the only option for many people seeking access to their unemployment benefits or tax information. There has been some sort of testing, but not with any results ID.me is willing to share with the public.

Hall says the company isn’t running images through a preexisting database, the way law enforcement does, and that it selects facial-recognition vendors that comply with federal standards, though he wouldn’t name them. The company also says ID.me put its facial-recognition software through two separate tests for racial bias in 2021 and found no evidence of discrimination.

And CEO Blake Hall continues to insist ID.me is stopping billions of dollars of unemployment and tax fraud, even though it would appear that a lot of what Hall considers to be thwarted fraud may just be the inadvertent thwarting of legit benefits claimants.

For example, between Jan. 28 and March 8, 2021, ID.me had 654,292 users start its verification process in California, according to data Hall provided. Just half of those users completed ID.me’s checks. Hall argues that any users who didn’t complete the process were clearly scammers.

[...]

On Nov. 17, 2020, for example, ID.me reported that the prior week, 101,050 people in California attempted to verify their identities with ID.me. Of those, just 40% succeeded. But you could see the frustrations unemployed workers and their advocates complain about playing out in the data: Almost a quarter of the people ID.me dealt with in California that week tried to get on a video call with a company rep, but only 10% of that group succeeded. More than 7,000 people also abandoned the ID.me process by either closing their browser midway through or having their session time out. Both situations are as easily attributable to tech glitches as fraud.

This isn't very comforting. ID.me's CEO seems willing to declare failures of the company's system as victories against fraudsters. This unwillingness to even consider the possibility the system has flaws that might separate users from benefits or tax information isn't something you want to see in someone running a company that has already nailed down more than half the country's unemployment payments business. Becoming the point of entry for IRS accounts will just make local issues national issues.

It's also not exactly comforting that one company holds so much biometric and personal data. That makes it a tempting target for malicious hackers, especially now that it's also home to Internal Revenue Service data. It's going to make people start asking for some sort of biometric data federalism -- one that keeps the federal government from intermingling its sensitive info with state data stashes by using the same vendor to collect ID verification info.

Presumably, ID.me will get better at what it does. And it does appear to be doing everything it can to secure the information it's collecting on behalf of several government agencies. But it's being led by a CEO who is unwilling to allow independent inspection of its AI, who built his company's business on a questionable assertion about pandemic-related benefits fraud, and who has an alarming tendency to blame system issues on end users or to portray ID.me's failures as successful direct hits on benefits fraud.

That's a lot of buck-passing for someone who is being entrusted with the financial, personal, and biometric information of millions of Americans. And it suggests if the shit ever really hits the fan, the CEO is going to ghost a bunch of taxpayers who were never given any input or options when it comes to accessing benefits that are rightfully theirs.

Filed Under: access, biometrics, facial recognition, irs, logins, privacy, taxes
Companies: id.me