Dear Commissioner Rettig:
I write to urge the Internal Revenue Service (IRS) to reverse its recently announced implementation of facial recognition screening software for Americans who wish to access their historical tax documents online. The IRS does not use facial recognition for tax filing or to receive a refund, and the agency should not require facial recognition for any of the other important services it provides taxpayers.
In November, 2021, the IRS announced that taxpayers wishing to securely access their tax information online would soon need to sign up for an account with ID.me, a commercial identity verification provider, which uses facial recognition technology as part of the verification process when users first sign up for an account. Although the IRS is not the first government agency to use ID.me - the company’s services are also used by nine other federal agencies and thirty states - the IRS’ use of ID.me’s services has set off an important national debate about the government’s use of facial recognition technology.
While the IRS had the best of intentions - to prevent criminals from accessing Americans’ tax records, using them to commit identity theft, and make off with other people’s tax refunds - it is simply unacceptable to force Americans to submit to scans using facial recognition technology as a condition of interacting with the government online, including to access essential government programs. Furthermore, many facial recognition technologies are biased in ways that negatively impact vulnerable groups, including people of color, women, and seniors.
In addition to the serious privacy and civil liberties issues associated with the use of facial recognition technology, it is also alarming that the IRS and so many other government agencies have outsourced their core technology infrastructure to the private sector. Quite simply, the infrastructure that powers digital identity, particularly when used to access government websites, should be run by the government.
In 2015, Congress required federal agencies to use a single-sign-on service called login.gov, which is operated by the General Services Administration, so that Americans would not have to maintain different accounts for each U.S. government website. Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts. Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this inaction has been billions of dollars in fraud, which has in turn fueled a black market for stolen personal data, and enabled companies like ID.me to commercialize what should be a core government service.
To be clear, the IRS cannot solve digital identity by itself. The Administration will need to take ownership of this problem, in part by clearing red tape that is preventing GSA from accessing and using for identity verification photographs and other data held by Departments of Motor Vehicles and the Social Security Administration. Login.gov also currently lacks one feature offered by ID.me - comparing an applicant to a photo on an official government ID. This does not need to be performed using facial recognition technology though, and login.gov is piloting verification by humans in conjunction with the United States Postal Service and the Department of Veterans Affairs. These pilots should be expanded nationwide, along with a call center that can verify by video people who, for a variety of reasons, are unable to be verified in-person.
I have long argued that Americans should not have to sacrifice their privacy for security. The government can treat Americans with respect and dignity while protecting against fraud and identity theft. The IRS should take immediate steps to address the many valid concerns that have been raised by taxpayers about its use of facial recognition technology. First, the IRS should redouble its efforts to remind taxpayers that facial recognition scanning is not now and has never been necessary to file taxes or receive a refund, as well as educate taxpayers on ways to access other IRS services without the use of facial recognition technology. Second, as a stopgap measure, the IRS should promptly revert its decision to require use of ID.me to transact online through the IRS’ website, delay the phase out of IRS.gov accounts created prior to the implementation of ID.me, and restore the ability of taxpayers to create new IRS.gov accounts, which does not use facial recognition. And finally, in the longer term, the IRS should migrate away from third-party identity verification services and utilize GSA’s government-wide login.gov service.
Thank you for your attention to this important matter.
Previous Article
