A US Agency Rejected Face Recognition—and Landed in Big Trouble

In January that year, an Internal Revenue Service contract for online account verification with startup ID.me, which uses selfies and face recognition to verify new accounts, triggered public backlash over discrimination and privacy concerns. A WIRED story on the NIST standard driving use of the technology referred to Login.gov documentation that said it sometimes asked users to upload selfies for checking against an ID.

The GSA informed WIRED after publication that Login.gov’s documentation was inaccurate and Login.gov did not use face recognition, and the article was updated. The OIG report says that a few days later, in early February, seven months after his internal message on face recognition, Zvenyach wrote to federal agencies that were using Login.gov to inform them that it was not in fact compliant with NIST requirements, due to his group’s stance on face recognition.

“We have made the decision not to use facial recognition, liveness detection, or any other emerging technology in connection with government benefits and services until rigorous review has given us confidence that we can do so equitably and without causing harm to vulnerable populations,” he wrote. The report says that Zvenyach later told investigators he had no knowledge of NIST requirements but that Login.gov leaders knew they were out of compliance as early as 2020.

Those NIST requirements, aimed at curbing identity fraud, attempt to solve a tricky problem. When a person accesses a government service, the agency needs to check who they are, a process known as proofing. In person, you can just pull out an identification card for verification, but online it’s more difficult. For sensitive data or access, the NIST’s digital identity standards call for remote digital proofing, which uses face recognition to compare a smartphone selfie with a photo on an ID card, and also liveness detection, which analyzes an image to detect whether it contains a real live human or is fake.

Rebecca Williams, a member of the American Civil Liberty Union’s Surveillance Resistance Lab, previously worked at the White House’s Office of Management and Budget. In that role she researched government work on modernizing digital identity,  frequently met with Login.gov staff, and also heard complaints about the service. “Of the laundry list of things that Login.gov is doing that I might complain about, having somebody refuse to incorporate biometrics is not one of them,” she says.

Both the IRS face recognition scandal last year and new report on Login.gov this month, Williams says, underscore a need for conversations including citizens and lawmakers about the kinds of identity verification they’re comfortable with and whether people want a digital form of identification at all. Williams says that should mean no use of biometrics like face recognition and never sharing biometric data collected by a federal agency with a law enforcement agency.

After controversy over its ID.me contract, the IRS allowed people to opt to have their identity confirmed via video call with an agent instead of by face recognition. ID.me says people can also take a photo ID to any of 650 retail locations in the US, a small number in a large country.