ID.me, the controversial biometric identification verification company whose facial match technology provoked a major privacy backlash at the IRS earlier this year, may have misled the public and lawmakers when its CEO claimed the U.S. lost $400 billion to fraudulent pandemic unemployment claims. Its biometric services, billed as a convenient and secure way to reduce pandemic related unemployment fraud, may have actually made it more difficult for those most in need of assistance to receive their aid.
That new evidence, shared with Gizmodo by the House Select Subcommittee on the Coronavirus Crisis and the Committee on Oversight and Reform, alleges ID.me made “baseless claims,” of rampant covid-19 unemployment fraud, “in an apparent attempt to increase demand for its identity verification services.” Additionally, the committees allege ID.me’s verification process, which was used by 21 different state governments to dole out unemployment benefits, contributed to “extraordinary wait times,” for certain users trying to verify their identities. In some cases, users without access to devices required to take face scans had to wait up to ten hours to have the company verify their identity over a video call.
ID.me, whose service was abandoned by the IRS earlier this year following backlash from privacy groups and reporting from Gizmodo and other outlets, works by asking users to provide a selfie which is then run against a government document to verify an individual’s identity. The company also verifies new users’ selfies against a database of faces when they first enroll.
This biometric system, at one point used by multiple federal agencies and 27 states, is intended to cut down on potential fraud and increase efficiency. If a user is flagged by ID.me’s system for some reason, (or if a user doesn’t have access to the tech required to produce a face scan) they aren’t blocked outright but are instead redirected to a video chat verification with one of the company’s team members.
Those video chat verifications, according to the House committees, were woefully inadequate.
In 14 of the 21 states where ID.me’s service was used to verify users identity for unemployment benefits, wait times for video verification chats reportedly averaged four hours in April 2021. Those weren’t even the worst cases. During that same month in North Dakota, people seeking unemployment benefits reportedly had to wait an average of 10 hours to have their identification confirmed.
Those long wait times may have disproportionately impacted unemployment seekers who didn’t have access to smartphones or broadband internet. As multiple studies from Pew Research shows, that cohort of Americans tends to come from low-income and rural communities. Those same communities were some of the groups most in need of pandemic unemployment benefits in the first place. States’ hasty reliance on ID.me’s facial match software, and ID.me’s lack of human video reviewers, may have combined to make an already difficult situation even worse for economically vulnerable groups.
“It is deeply disappointing that a company that received tens of millions in taxpayer dollars to help Americans obtain these benefits may have hurt their ability to access that critical relief,” House Subcommittee Chair Clyburn said in a statement. “ID.me’s practices risked putting desperately needed relief out of reach for Americans who lack ready access to computers, smartphones, or the internet.”
Making matters worse, members on the committees claim they obtained documents from ID.me showing the company removed users’ ability to schedule appointments with reviewers because ID.me thought those appointments were allegedly, “hindering efficiency.”
ID.me responded to the investigation’s finding after after publication in a lengthy statement sent to Gizmodo. The company did not deny the long wait times cited by the committee but went on to blame them in part on what it called “historic” amounts of fraud.
“During Covid, the high volumes of Americans trying to sign up for benefits and states were unprecedented, and many states were equipped with outdated or inadequate technology,” an ID.me spokesperson said in an email. “ID.me employees worked overtime to help states with this massive influx, verifying identities for individuals so they could receive government benefits. While more than 80 percent of users were able to verify their identity in under 10 minutes, those who required a live agent faced long wait times, because of this massive volume, the impact of Covid, and the lack of modern technology in state governments.”
It’s worth noting here that the 80% figure ID.me cites above appears to apply to users who successfully completed a face scan, which wasn’t what the committee findings took issue with. The spokesperson said ID.me has invested in additional personnel and technology to deal with future volume surges and claims its average wait times are now generally below 30 minutes, “excluding specific episodes.”
“We worked tirelessly to serve Americans who needed aid, and we regret the long wait times that individuals endured while we fought to clear fraud out of the system. This situation was short-lived and temporary and caused by historic fraud,” the spokesperson added.
Some members on the committees said they found no evidence supporting ID.me CEO Blake Hall’s widely reported claims that the U.S. had lost “as much as 50% of all unemployment monies,” due to fraud. Though many states did acknowledge some level of pandemic unemployment fraud did occur, statewide figures reviewed by the committees were not nearly as high as ID.me’s figures. Strikingly, the company’s estimate of potential unemployment fraud was nearly ten times higher than the $45.7 billion in potential fraud estimated in an analysis conducted by The Department of Labor Office of Inspector General.
When the committees asked ID.me to provide data supporting its claims, the company allegedly provided estimates from the right-leaning Heritage Foundation. Yet, after reviewing those figures, the Committees discovered the Heritage Foundation actually used ID.me’s own claims to arrive at its figure.
So, in other words, ID.me’s evidence to support its wildly inflated fraud claims was….itself.
ID.me responded to these criticisms by providing Gizmodo many of the same figures they appeared to share with the committees and said a current lack of fraud data would “understate actual improper payments.”
“Calling ID.me’s estimate too high or baseless is premature and we welcome additional oversight on this important matter,” the ID.me spokesperson said.
Olga Akselrod a senior staff attorney with the ACLU’s Racial Justice Project, told Gizmodo that ID.me’s long wait times, in particular, “erected a barrier to accessing government services,” particularly among Black, Latinx, Indigenous and rural households, who are often amongst the most negatively impacted by internet and device digital divides. More broadly, Akselrod said the findings raise questions about the efficacy of public agencies relying on private firms to conduct identify verification.
“Government agencies should not be outsourcing such a core function as identity verification, and the dangers of that are particularly acute where they have failed to do a thorough assessment at the front end of the vendor and its product to ensure privacy, equity, and accessibility,” Akselrod said.
The Surveillance Technology Oversight Project agrees with the ACLU’s concerns. “ID.me should never have been used for pandemic unemployment assistance or any other government services,” Surveillance Technology Oversight Project Communications Director Will Owen told Gizmodo. “No one should have to give up their biometric data simply to access the benefits they’re entitled to.
Owen, who’s privacy focused focused organization has spoken critically of ID.me in the past, said ID.me’s biometric solutions weren’t as efficient as the company let on.
“The absurd wait times show that there is nothing efficient or accurate about facial recognition,” Owen added. The algorithmic biases baked into these tools put people of color and women at risk of being denied essential services.”
The House Committees’ findings are the result of a more than six-month long investigation launched in April. At the time, Representatives Clyburn and Carolyn Maloney, expressed serious concern over the efficacy and security of ID.me facial match technology, which they described as “complex and problematic.” Those concerns are shared by numerous privacy and civil liberties groups which have criticized state and federal government partnerships with ID.me. One of those groups, Fight For the Future, has led a campaign calling on all government agencies to end their partnerships with ID.me.
And some are. Following the IRS’s decision to abandon ID.me in February, a spokesperson for the Department of Veterans Affairs told Gizmodo it was examining market research to see if continuing its relationship with ID.me is, “in the best interest of the agency.” Another spokesperson from the U.S. Patent and Trademark Office told Gizmodo they were considering other identity verification alternatives as well.
Fight for the Future’s Campaign Director Caitlin Seeley George told Gizmodo it was “unbelievable” ID.me had managed to successfully secure its large amount of government contracts in the first place despite numerous warning from rights groups.
“ID.me’s entire system—including the ‘option’ people were given to have their identity verified by video chat was never reasonable,” Seeley George said. “Its facial recognition algorithm couldn’t accurately identify Black and Brown faces, and using ID.me required people to have smart phones or a quality web camera, which excluded economically disadvantaged people as well.”
“We need the IRS, Veterans Affairs, the Social Security Administration, and the 30-some states that still use ID.me for identity verification to dump ID.me so that people can access information and benefits without having their rights abused,” Seeley George added.
ID.me CEO Blake Hall shot back at the investigation’s findings in a LinkedIn post Thursday afternoon where he accused the committee of “inaccurately” accusing him of using questionable fraud figures to win government contacts.
“We released our estimate as concerned citizens who were shocked at the extent of the fraud we were witnessing across states,” Hall said.
Though Hall didn’t elaborate on how he came to his $400 billion fraud estimate he did say those claims were made after ID.me had locked in deals with 43 government agencies.
“Any assertion that we made a claim about fraud to advance our business omits the fact that 43 agencies chose ID.me before the statement was ever made,” Hall said. “The procurement process to select a vendor is based on capabilities, not fraud context.”
Updated 11/17/2022 2:23 p.m ET: Added comments from ID.me and Fight for the Future
Update 11/17/2022 5:48 p.m ET: Added comment from Blake Hall