IRS Says It Will Move Away From Requiring ID.me Facial Recognition

from the good-move dept

Last month, we wrote about how the IRS and other federal agencies were starting to require the use of private facial recognition from a somewhat sketchy private company, for people to access their own government's services. The main company in question, ID.me, had made some... questionable decisions that raised serious questions about why the government was forcing people to make use of such a private service.

Earlier this morning, Senator Ron Wyden sent a letter to the Treasury Department calling on them to drop the facial recognition requirement, and within hours the Treasury Department told Wyden it would be "moving away" from that plan, and then the IRS put up a more official statement:

The IRS announced it will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts. The transition will occur over the coming weeks in order to prevent larger disruptions to taxpayers during filing season.

During the transition, the IRS will quickly develop and bring online an additional authentication process that does not involve facial recognition. The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," said IRS Commissioner Chuck Rettig. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."

The transition announced today does not interfere with the taxpayer's ability to file their return or pay taxes owed. During this period, the IRS will continue to accept tax filings, and it has no other impact on the current tax season. People should continue to file their taxes as they normally would.

Last week the Treasury Department had said it was "reviewing" the matter, but today's announcement is a big deal. It's rare to see a government agency move this fast, so kudos to Treasury/IRS for acting quickly (though, it can be argued that it never should have gotten this far in the first place). But also kudos to Wyden for helping make this happen as well.

Filed Under: facial recognition, irs, privacy, ron wyden, security, treasury department
Companies: id.me

Treasury Oversight Says IRS Should Consider Getting Warrants Before Buying Location Data From Data Brokers

from the everyone-reads-Carpenter-differently dept

Last October, Senators Ron Wyden and Elizabeth Warren asked the IRS's oversight to take a look at the agency's use of third-party data brokers to obtain cell site location info harvested from phone apps. This new collection of location data appeared to bypass the Supreme Court's Carpenter decision, which said cell site location info was protected by the Fourth Amendment.

This means warrants were needed to obtain this information from cell service providers. Multiple government agencies -- including the CBP, DEA, and Defense Department -- appear to believe approaching data brokers a couple of steps removed from the location data collection process aren't affected by this warrant requirement. While both cell site location info from cell providers and bulk data from brokers can accomplish the same long-term tracking of individuals, the latter tends to be less detailed since it sometimes requires apps to be in use to produce location data, rather than just connected to a cell tower.

The IRS may have believed no warrants are needed to buy bulk data from brokers, but its oversight disagrees. The Treasury Department Inspector General says the 2018 Supreme Court ruling may cover this data as well.

A new Treasury Department watchdog report warns that law-enforcement agencies may not be on firm legal footing when they use cellphone GPS data drawn from mobile apps without obtaining a warrant first.

In a review of the Internal Revenue Service’s use of a commercial platform that allowed the agency to track cellphones, the Treasury Department inspector general for tax administration said that a landmark 2018 Supreme Court case might preclude the warrantless tracking of criminal suspects through location data generated by weather, game and other apps. The report encouraged stricter controls on use of the data.

But it's only a "may." The report [PDF] says the IRS should consider seeking a warrant before obtaining this data in the future. However, the IRS hasn't purchased data for a few years now because it doesn't consider it useful. And its only utilization of data broker Venntel occurred before the Supreme Court's Carpenter decision was handed down.

According to the purchase order, the subscription was for one year from September 9, 2017, through September 8, 2018, at the cost of $19,872. CI stated that the single-user license subscription was used exclusively by a single field office in the Cyber Crimes Unit, and Venntel was only utilized on a few specific occasions and did not produce effective results. According to CI, the last use of this database was in March 2018…

That would be two months before the Carpenter decision, which would make it a good faith effort if anyone were to challenge this evidence. But if anyone was going to, they'd likely already have done it. And the IRS's limited use (at least of this vendor) reinforces the IRS's claims that bulk location data from brokers doesn't help it with investigations.

Even given the Supreme Court's 2018 decision, IRS officials still seem to believe if the agency make use of this in the future, agents still wouldn't need to seek a warrant.

Carpenter v. U.S. was decided in June 2018. The last known attempt to use the Venntel product was March 2018, before the Supreme Court decision. Nevertheless, it is our understanding that the Carpenter decision concerned historical Cell Site Location Information which is distinct from the opt-in app data available on the Venntel platform.

Ah, but that's the same argument the government made to attempt to avoid a search warrant requirement: that the location data was voluntarily obtained from cellphone users. The Supreme Court disagreed, saying the data was collected continuously, even when owners weren't actively using their cellphones. If US government agencies continue to seek this data without a warrant, they're likely going to start generating caselaw contradicting their presumptions.

Treasury Oversight suggests warrants. The IRS suggests they aren't necessary. For now, the only thing preventing internal conflict is the IRS's determination that this particular form of cell location data is mostly useless.

Filed Under: 4th amendment, csli, data brokers, elizabeth warren, inspector general, irs, location info, oversight, privacy, ron wyden, treasury department, warrant

Audit Indicates Intuit Made $1 Billion By Hiding Free File Program From The Public

from the dr-evil-shit dept

It's been quite a long and frustrating walk for us in covering the lengths to which Intuit went to hide the free to file tax program. This is the program that it is legally mandated to offer. If you're not caught up, the IRS struck a deal with the big tax prep companies out there, promising not to offer and expand its own free file programs, but only if companies like Intuit offer their own free file programs. Intuit did as instructed with its TurboTax product, except that the company then went about hiding the website for the free to file program from search engines and the internet, all while dropping the word "free" into as many places on the website for the paid services site it also runs. Then, because evil is an addictive drug, Intuit went ahead and lied to a bunch of customers to avoid refunding their money when it got caught in all this, informed its own employees that it bilked the public for their own good, and was even eventually found to have wrapped itself in the American flag while swindling active duty soldiers as well.

So, now you're caught up. But perhaps you're wondering why Intuit would risk all of the bad PR that comes with treating tax prep services like a game of three card monty. Well, the answer, according to a recent audit by the Treasury Inspector General, is because one-billion dollars.

More than 14 million taxpayers paid for tax prep software last year that they could have gotten for free, according to a scathing audit released Wednesday by the Treasury Inspector General for Tax Administration. That amounts to roughly a billion dollars in revenue for TurboTax maker Intuit, H&R Block and other tax software companies, according to a ProPublica analysis of tax prep fees.

The audit, which was launched following ProPublica’s reporting last year, explores why so few taxpayers use the Free File program, a public-private partnership between the IRS and companies such as Intuit and H&R Block. Among the reasons, the audit found: the confusing design and complexity of the program and persistently lax oversight by the IRS.

I suppose if Intuit was asked precisely how much its soul was worth, we now have our answer. And, yet, this is still all very stupid in the end. Because now, thanks to ProPublica's reporting, the IRS has scrapped its moratorium on offering its own free to file program. So, by being so immensely greedy, Intuit turned what could have perhaps been a minor revenue generator instead into a combination of a PR shit sandwich and a competitor in the IRS. Well done?

But, in case you thought Intuit would finally be in a place where it recognizes its misdeeds and is ready to turn this PR boat around, nooooooope.

In a statement, an Intuit spokesman said the company “consistently and publicly supported recommendations and efforts to strengthen the [Free File] program as part of our commitment to free tax preparation and our mission to empower individual taxpayers to manage their finances and receive every dollar they earned and deserve.” He added that “the majority of eligible tax filers using DIY software filed for absolutely free through the Free File Program or using commercial products.”

Around 104 million taxpayers were eligible for Free File last year, according to the audit. Of those, just 2.4% actually used the free government program. Of the remaining 101.5 million, 67 million did not use tax software (most going to bricks-and-mortar tax prep services). The remaining 34.5 million used software to do their taxes, and of those, 14 million paid for tax prep they could have received for free.

So Intuit would rather play games in representing its numbers than simply admit to the truth. Not exactly the sort of thing you might want out of a tax prep service.

Filed Under: free file, irs, scams, taxes, treasury department, turbotax
Companies: intuit

Treasury Department Report Shows ComputerCOP Used Bogus Endorsement Letter To Get Police To Distribute Keylogger

from the bad-news dept

A little over three years ago, we wrote about a detailed investigation by Dave Maass at EFF to reveal that an app called ComputerCOP, that was given out by hundreds of police departments to parents supposedly for protecting their kids, was actually dangerous spyware that transmitted information typed by users (including kids) over the internet without encryption. Even worse, tax dollars were being used by police departments to "purchase" this software for distribution to unsuspecting parents. The details were ugly, and it even included ComputerCOP using a bogus "endorsement letter" from the Treasury Dept. -- leading the Treasury Department to put out a fraud alert about the software, stating:

Neither the Treasury nor the Treasury Executive Office for Asset Forfeiture endorses this or any other particular product and the use of equitable sharing funds does not in any way imply such an endorsement. A letter purporting to be from the Treasury Executive Office for Asset Forfeiture [link] is not genuine.

Incredibly, even after all of this was revealed, we noted that many police departments continued to stand behind the software and even claimed that EFF was "not credible" (and, bizarrely, said that the software would have "stopped Columbine").

Three years have gone by and Maass and EFF are back, noting that the original report spurred an investigation by the Treasury Department into the software which confirmed the EFF's reporting, even noting that the company had doctored a letter to claim that the software was endorsed by the Treasury Dept. From the report:

The investigation determined that the allegation is substantiated. Specifically, no less than three law enforcement agencies solicited by ComputerCOP reported the TEOAF memorandum in the solicitation influenced the law enforcement agency's decision in purchasing ComputerCOP's software. After discussions with TOIG, DOJ/U.S. Marshal Service, and Treasury Office Counsel, ComputerCOP agreed to post a disclaimer on their website to dissociate the Treasury Department from their products. Additionally, ComputerCOP agreed to immediately cease use of the altered letter from the Treasury Department.

However, as Maass also notes, ComputerCOP evaded prosecution because the three-year statute of limitations had run out. Of course, I'm curious how that's true, given the claim that the company had continued to use the letter until all of this was revealed.

New FOIA documents show that, after a multi-year investigation, the Inspector General concluded that ComputerCOP had indeed “altered the 2001 letter from TEOAF and made it appear to be blanket permission for all law enforcement agencies to use equitable sharing funds to purchase the software.” Indeed, ComputerCOP made this claim on the rate card it provided to agencies. 

As part of its investigation into the letter, Treasury investigators sent questionnaires to 240 agencies that had purchased ComputerCOP. Of the few dozen that responded, three law enforcement agencies—the Peabody Police Department in Massachusetts, the Alaska Department of Public Safety, and the Greene County Sheriff's Office in Missouri—told Treasury that the fraudulent letter had directly influenced their decision to purchase the product. 

The closed investigative report indicates the Treasury Inspector General was unable to send the case for prosecution “due to the fact that the three year statute of limitations on the offense had lapsed.” Instead, after discussions with the Justice Department and the U.S. Marshal Service, Treasury concluded it was enough for ComputerCOP to cease using the altered letter and to post a disclaimer on their website.

And Maass also notes that while ComputerCOP promised to post a disclaimer on its website, that disclaimer appears to have gone away -- and is still pushing misleading (at best) claims about the software.

Unfortunately, it may be time for the Treasury Department to re-open the case. While ComputerCOP did once advertise the disclaimer, EFF could no longer find that language anywhere on its website.  

Making matters worse, the company’s website now claims that the keylogging feature “is not intrusive in any way.” This is an outrageous claim considering that this type of technology is more commonly deployed by stalkers and malicious hackers, and, in certain circumstances, its use could violate wiretapping laws.

And, yes, incredibly, there are still police departments out there purchasing the software and handing it out to unsuspecting parents -- including just this summer when McGruff the Crime Dog was handing out the software on Long Island.

There are enough problems with police these days and how they interact with the public. They shouldn't be contributing to making computer security worse by handing out dangerous software.

Filed Under: computercop, forged letter, keylogger, treasury department
Companies: computercop

How A Treasury Terror List Is Preventing Americans With 'Scary' Names From Using Online Services

from the scary-names dept

We've talked a few times before about the US Treasury Department's Office of Foreign Assets Control, a government office theoretically designed to keep money from flowing to and from scary people in scary countries or whatever. Its work typically amounts to keeping businesses from doing business-y things with people in places like North Korea and such. On the other hand, sometimes the folks at the OFAC get their knickers in a twist over a graphic novel about some of these scary people, so it's not like these folks have a spotless record when it comes to keeping the proper targets in its collective sights.

But a couple of stories have been trickling in having to do with non-scary people who share names too-closely associated with actual scary people suddenly being denied online services due to the OFAC scare-list. The first of these concerned a man named Muhammad Zakir Khan being refused a registration for a multiplayer video game.

Gamasutra, which broke the story, reports that when Khan submitted his request, he received an unusual denial, one explaining that his name had come up as “a match against the Specially Designated Nationals list maintained by the United States of America's Office of Foreign Assets Control.” Epic was, in other words, refusing Khan the opportunity to try out its new game simply because his name resembles that of someone who might be financially involved with terrorism.

Khan tweeted a a screengrab of the rejection form and hashtaged it “#Islamophobia.” Surprisingly, Epic Games founder Tim Sweeney replied to another tweet about the issue, claiming that it had been caused by an “[o]verly broad filter related to US trade restrictions.”

Which, you know, good for Epic Games. And I wouldn't really refer to this as "islamophobia" so much as I'd refer to it as broad laziness by both a government agency and a corporation. Let's think this through for one moment. If our Treasury Department is going to cast a worried eye towards Islamic terrorism such that it compiles a list of names that businesses are refused from interacting with, and if those names come from a region of the world where there is a certain repetition of these sorts of names (Muhammad Khan sounds like it could be akin to John Smith), then how useful is this directory of scary people to begin with? The point of the list is to identify bad actors, but if innocent folks are getting caught up in it, then it isn't serving its chief function particularly well, now is it? But no matter, says the government agency. Just add the name to the list and damn the fallout to hell.

The broader question, of course, is why an online game should be checking registrations against the CFAC list to begin with. In this particular case, it appears the check was ported over from the game engine itself.

Unreal Engine 4 has a wide range of uses, both domestic and foreign, that apparently bring it under the umbrella of trade guidelines. Under ordinary circumstances, those restrictions should only apply to people who are using the engine to create new games. (For instance, the U.S. government presumably doesn't want ISIS to use the engine to create a recruiting game.) But when Epic used the engine to make Paragon, it accidentally left those restrictions in place. Thus, the filter shouldn't have been there in the first place, and no one should have been banned from Paragon, regardless of whether they show up on a watch list.

As I said: government laziness and corporate laziness combine to keep an innocent person from playing a video game. Success!

Such innocent circumstances don't appear to be replicated in the story of Noor Ahmed's attempt to sign up for a payment app called Venmo, which is normally a cinch to register for, but for which Ahmed still isn't able to use.

When she tried to sign up last year, Venmo refused to add her. The company sent her an email instead, asking Ahmed to provide a stack of additional information to verify her identity. What followed was the opposite of simplicity: Ahmed had to obtain paper copies of her utility bills as well bank statements, and then find a fax machine (a practically unheard of technology for many younger people) to send them to Venmo. After complying with this rigamarole, Ahmed still was unable to sign on to Venmo.

It turns out that she, like thousands of other Americans, shares a name with someone on a list created by a Treasury group called the Office of Foreign Assets Control. This list is called “Specially Designated Nationals and Blocked Persons,” and includes (on page 33) a 41-year-old Afghan man also named Noor Ahmed. The New York-based Ahmed, said she is familiar with such mix-ups.

“I was born and raised in California, but I’m taken into secondary customs at the airport no matter what because of my name,” said Ahmed. “I think it’s now extending to other parts of my life.”

Whatever your thoughts on terrorism and international politics, it's quite clear that this isn't helpful. It isn't stopping a terrorist from using the app; it's stopping a US citizen from using it. It isn't helpfully identifying a person for a US business to steer clear of; it's mis-identifying a US citizen. Hell, the list can't even keep men and women straight. For the CFAC list to useful, never mind non-discriminatory, it should at least be able to keep a valid US citizen from being caught up in the web.

If it can't manage that simple task, it's probably worth revisiting whether this list should be employed at all.

Filed Under: ofac, office of foreign asset control, terrorists, treasury department, watch list

Legislators Send Letter To Treasury Department Demanding Release Of Funds Seized In Bogus Structuring Case

from the IRS:-we-won't-do-this-anymore,-but-probably-not-any-LESS,-either dept

Asset forfeiture finally found its way into the mainstream after years of coverage by media outsiders. The sudden increase in negative attention brought about some needed reform efforts. The DOJ issued new guidelines on civil asset forfeiture, as did the IRS, which announced it would no longer pursue seizure of funds under "structuring" statutes unless there was evidence the money came from criminal sources.

One of the victims of the IRS's bogus "structuring" seizures (made pre-policy shift) is Randy Sowers, a dairy farmer who had $63,000 seized by the agency in 2012. The cash came from sales made at local farmers' markets, but the IRS viewed it as a criminal act simply because Sowers never topped the magical $10,000 mark with his deposits.

The Sowers were "working" with the IRS to have the funds returned (this implies a modicum of due process that doesn't actually exist in civil forfeiture). Then Randy Sowers almost screwed things up, as Melissa Quinn of the Daily Signal reports.

While the couple was in the midst of settlement negotiations with the government, hoping to have most of their money returned, Randy Sowers spoke with a reporter from The City Paper in Baltimore, Md., about his experience with structuring and civil asset forfeiture.

On the day the article was published, Stefan Cassella, the assistant U.S. attorney overseeing Sowers’ structuring case, told the family’s lawyer he had a “problem” and was no longer willing to negotiate a settlement amount, according to court filings.

This attitude seems to be common to IRS prosecutors. They don't mind taking your money for the flimsiest of reasons and they don't mind fighting you every step of the way should you choose to challenge the seizure, but goddamn if it doesn't piss them off if you decide to discuss your situation in public.

If you'll recall, another victim of a bogus structuring seizure took his case (mostly anonymously) to a Congressional hearing. The prosecutor in that case reacted just as badly to the public airing of IRS-related grievances. He sent a letter to the Institute of Justice (which is representing the convenience store owner who had $107,000 seized by the IRS) that basically stated any publicity resulting from this would only harm this person's case. Because vindictiveness.

I do not know who did that, and I am accusing no one, but it was not from our office and could only have come from your clients. That was certainly not my intent in making this available. Whoever made [the document] public may serve their own interest but will not help this particular case…

Your client needs to resolve this or litigate it. But publicity about it doesn't help. It just ratchets up feelings in the agency.

The prosecutor then offered a take-it-or-leave-it deal of 50% of the seized cash back. C-store owner Lyndon McLellan chose the latter.

Sowers, however, did eventually settle with the IRS, receiving (coincidence?!) half of the seized funds. Why settle when you're clearly in the right? Because it's tough to run a business when your liquid assets have suddenly vanished. Half is better than nothing, especially if you want to remain solvent.

Now, he wants the other half. And he's brought backup.

A bipartisan group of lawmakers on the House Ways and Means Oversight Subcommittee is coming together to ask the Treasury Department to return nearly $30,000 it seized from Maryland dairy farmers in 2012.

The letter, sent August 11 to Treasury Secretary Jack Lew, calls on the agency to return $29,500 the Internal Revenue Service seized from Frederick-based dairy farmers Randy and Karen Sowers through civil asset forfeiture.

The lawmakers also asked Lew to review similar cases and return money seized by the tax agency under the practice.

The letter reminds the Treasury Department that the seizure program is in place to stop money laundering, drug trafficking and disrupt the funding of terrorist organizations. It is not just a quick and dirty way for the government to take money from cash-heavy businesses who frequently deposit cash in sub-$10,000 quantities. In many of these cases, it appears business owners have received bad advice from well-meaning family members or friends. In other cases, the bad advice comes from the bank employees themselves. What doesn't appear to be integral to these disputed cases is any link to criminal activity.

A very long petition for the return of the money has been lodged with the DOJ. It points out that under the agency's current rules, the sort of seizure they've experienced would not even be initiated. It also points out that the couple was apologized to by several members of the Congressional committee and the IRS Commissioner himself. And yet, the Treasury Department refuses to cede any ground on the other half of the Sowers' funds. Hopefully, a three-page letter from a bunch of legislators will compel the return of the Sowers' money -- something their 209-page complaint has yet to accomplish.

Filed Under: asset forfeiture, asset seizure, irs, legislators, treasury department

Treasury Dept. Won't Put Wikileaks On Terrorist List; Tells Rep. King It Doesn't Meet The Criteria

from the not-everyone's-crazy dept

Following the request by Rep. Peter King that the Treasury Department list Wikileaks and Julian Assange on various terrorist/organized crime lists, which would prohibit US companies from dealing with them, the Treasury Department has, quite reasonably, said it will not do that. A spokesperson noted that there is not nearly enough evidence for such a designation:

"We do not have evidence at this time as to Jullian Assange or WikiLeaks meeting criteria under which OFAC [the Office of Foreign Assets Control] may designate persons and place them on the SDN [Specially Designated Nationals] list."

Filed Under: peter king, treasury department, wikileaks
Companies: wikileaks

Rep. Peter King Wants Treasury Dept. To Put Wikileaks On Terrorist List

from the overreact-much? dept

Apparently Rep. Peter King is in a competition with Senator Joe Lieberman to see who can overreact more to Wikileaks. It seems like a neck-and-neck competition, with Peter King's brand of craziness potentially taking the lead. King, of course, was the guy who insisted that Wikileaks should be declared a terrorist organization and claimed (with nothing whatsoever to back this up) that the cable leak was worse than a military attack. His latest move is to ask Treasury Secretary Timothy Geithner to add Wikileaks to the Treasury Department's "Specially Designated National and Blocked Persons List," which is usually used to designate terrorist and organized crime operations.

So while Lieberman merely used political pressure to get companies to block or censor Wikileaks, King wants it to become official government policy that no US companies or individuals should be doing anything with Wikileaks. Overreact much?

Filed Under: peter king, terrorist list, timothy geithner, treasury department, wikileaks
Companies: wikileaks

Why Is The Administration Fighting Transparency On TARP?

from the this-is-not-good dept

We haven't written that much about the economy lately, as others seem to be doing a great job on it, but back when the TARP program first came about, we were quite concerned with the nature of the program, and specifically the lack of transparency. With the change in administrations -- especially to one that insisted transparency was a key factor, we hoped that things would get better. Now, it's no secret that we've been upset about some of the new administration's failure to live up to its own transparency promises. But there had been some evidence lately that it really was becoming increasingly transparent with how some taxpayer funds are being spent.

Apparently, that doesn't apply to the bailout, though.

Here's a disturbing story about the guy who's in responsible for being the independent watchdog over how the TARP money is being spent. While he's a long-term Democrat and Obama supporter (so his views aren't political), he's been quite critical of how the administration is not being at all transparent concerning how TARP is being used. He wanted the administration to force the banks to explain what they were doing -- and was told that was impossible. So he did it himself -- and asked the banks to let him know how the funds were being used, which they did. He used that and some other info to put out a report, suggesting that the funds aren't being used as was expected. That sounds exactly like what the independent watchdog should be doing.

But the administration (mainly the Treasury Department) has been fighting him, and is now trying to have it declared that the independent watchdog actually is under the control of the Treasury Department -- which would basically take away the whole "independent" part. That seems to go against the very concept of the transparency we were promised. It's great that this guy and his very small team of folks are actually monitoring what's happening with our taxpayer money (whether you agree with how it was used or not). It's not a good sign that the Obama administration is now trying to muzzle him. That's not transparency people can believe in.

Filed Under: obama administration, tarp, transparency, treasury department