ID.me’s Remaining Federal Contracts Are in Danger

The senators urged the DOJ to work with the Government Services Administration to create a long-term secure verification system that doesn’t compromise privacy and suggested making the agency’s login.gov service available to states.

ID.me has made some major concessions in the wake of backlash from the public and digital rights groups. Last week, less than 24 hours after the IRS said it would abandon ID.me’s facial recognition service, the company announced it would make facial recognition optional for public sector government partners. ID.me said it would also allow all of its users to delete their face scans starting March 1. Both of those significant reversals are clear signs of ID.me’s efforts, however hopeful, to distance itself away from its surveillance-tinged reputation.

“ID.me is an identity verification company, not a biometrics company,” the company reminded readers.

Though privacy experts told Gizmodo they welcomed ID.me’s reversal, they largely remained skeptical of its implementation. In their letter, the senators emphasized that facial recognition was only part of the problem. “While the company’s willingness to make facial recognition optional is a step in the right direction, access to essential government services is still being gatekept by an outside contractor,” they wrote.

That sentiment was reiterated by ACLU Senior Policy Analyst Jay Stanley who told Gizmodo having a for-profit company develop what seems like an essential government service by any other stripe looked like “a broken way to build this kind of identity proofing system.”

Gizmodo reached out to four federal agencies who still have active contracts with ID.me and asked whether the IRS’ decision had caused the agencies to reevaluate their relationship with the company or if the agencies would still use facial recognition.

In an email, a spokesperson for the Department of Veterans Affairs said it is currently examining market research to see if continuing its relationship with ID.me is, “in the best interest of the agency.” The spokesperson said the agency’s current contract with ID.me, signed in 2019, is set to expire this April. After that, there are two subsequent option years available on the contract, which are currently under review.

A spokesperson for the Social Security Administration meanwhile said they plan to maintain registration options with ID.me along with a variety of other options. “Social Security offers multiple ways for the public to register for online services, and very few people choose to use ID.me,” the spokesperson said.

The other two federal agencies Gizmodo could confirm were working with ID.me—the US Patent and Trademark Office Relationship and the Federal Energy Regulatory Commission—did not immediately respond to Gizmodo’s requests for comment.

Questions still persist around the IRS’ connections with ID.me though. In another letter on Monday, U.S. senators Robert Menendez, Cory Booker, Catherine Cortez Masto, and Alex Padilla, expressed concerns over how ID.me will manage the biometric data it has collected on IRS users who have already submitted face scans and whether or not the IRS shared that data with other federal, state, or local law enforcement agencies.

“Congress has repeatedly expressed concern with the development of an unconstrained and pervasive surveillance infrastructure, fueled by systems like ID.me,” the senators wrote. The senators also called on both the IRS and ID.me to contact taxpayers to let them know that they can indeed delete their face scans.

Meanwhile, recent reports allege ID.me’s welcome but rapid decision to make facial recognition optional for public government clients has come at the expense of its human reviewers. In interviews with The Verge last week, current and former ID.me employees said the company lacked sufficient human review capacity for its automated system and reportedly described the company as operating in “permanent crisis mode.”

In some cases, prior to the IRS’ reversal, sources told The Verge quality assurance staff (whose primary job is to ensure customer service) were spending around 40-50% of their time assisting overworked reviewers to verify identity documents. The ask for reviews could shoot up significantly if ID.me’s remaining federal clients decide to ditch facial recognition as well.

In an email, ID.me said it has plans to 750 new customer support personnel and plans to have a total of more than 2000 customer support personnel by the end of February.

“It is critical for ID.me to offer many different pathways for customers, including the ability to have video chats, as part of identity verification,” ID.me said. “Obviously, there is a current increase in seasonal demand, and as a result ID.me is increasing the size of our trusted referee and overall customer support workforce.”

“Quite simply, the infrastructure that powers digital identity, particularly when used to access government websites, should be run by the government, and not a company with a track record of misleading the public,” the senators wrote in their letter to the DOL.

Update 3;18 p.m. ET: Added statement from ID.me