Should Florida require use of facial recognition program to access Hurricane Idalia benefits?

Image via Pixabay

Before victims of Hurricane Idalia can access disaster benefits online, they must verify their identity. The state directs individuals to use ID.me facial recognition software.

FloridaCommerce, the state agency managing many of the services, says this allows secure online activity regarding financial matters. But critics say it requires individuals in need of critical support services to compromise their privacy.

“People shouldn’t be required to undergo a facial recognition process or give up sensitive private information to a private company in order to access critical government services,” said Kara Gross, legislative director and senior policy counsel for the American Civil Liberties Union (ACLU) of Florida.

FloridaCommerce continues to use the system for individuals to access a wide variety of services. The state agency handles disaster recovery services from assisting unemployment benefits to administering business bridge loans.

After this story’s initial publication, which stated facial recognition use was required, ID.me reached out and said users have options.

“If individuals looking to access disaster benefits online are not comfortable using facial recognition to verify their identity with ID.me, they have the choice to go directly to a video chat agent and verify their identity without use of facial recognition software,” wrote Michael Cassel, ID.me vice president of government affairs.

A website for FloridaCommerce explains to users that ID.me requires the sharing of some personal information and “online identity proofing and authentication.” When users first register for services online, they can verify their identities through an online video call or a self-service online tool, and from that point on, ID.me will use video images to verify users’ identities as part of a multifactor authentication.

“ID.me has built rigorous security and privacy requirements into our technology,” the website reads.

The system has been used by state and federal agencies across the country, but with controversy. The ACLU sued the New York Department of Labor, where many users say the artificial intelligence powering ID.me would often lock users out from accessing benefits.

“ID.me raises significant privacy concerns as it places large amounts of personal information in the hands of private companies operating with minimal oversight,” Gross said.

ID.me officials said that is not a concern and the contractor is subject to significant government oversight.

“ID.me has a FedRAMP Moderate cybersecurity authorization to operate (ATO) from the federal General Services Administration (GSA) and is also certified against the Department of Commerce’s National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3 security and privacy standards by the Kantara Initiative, an independent assessment body,” Cassel wrote to Florida Politics.

Additionally, the company participates in evaluations for Privacy Impact Assessments. American Disabilities Act compliance, audits and federal Government Accountability Office studies. The company never sells personal data, Cassel wrote.

Gross said there are other practical issues.

“It is unclear how this information will be stored, utilized, and who will have access to it in the future,” she said. “Moreover, it makes it harder to access benefits for individuals who do not have ready access to or fluency with technology.”

That’s been demonstrated by any number of problems documented in Florida.

After the state contracted with ID.me to reverify those seeking unemployment benefits with Florida CONNECT, individuals complained to the media about being locked out of accounts, as reported by ABC Action News in Tampa Bay and separately by Local 10 News in Miami.

Those concerns similarly have frustrated individuals accessing benefits through the federal Veteran Affairs Administration

“This will disproportionately impact older individuals, individuals with fewer economic resources, people of color, those with disabilities and people who live in rural households,” Gross said.

The State of Oregon seemed to confirm as much when it studied the use of the system on its own employment services. Officials there found only 53% of White applicants completed the process, but that only 45% of Hispanic users and 42% of Black clients did. When asked the reasons many bailed on the process, 15% said “the process was too difficult or confusing,” while 18% cited “lack of equipment or lack of ability to use technology.”

But Cassel said numerous government officials in other states have said the technology did not create the type of inequity suggested by the ACLU.

“Multiple government agencies have publicly credited ID.me with helping increase access to digital services at their agencies,” he wrote to Florida Politics. “This step-change improvement in performance over algorithm-only solutions powered by data brokers has also been shown to positively impact traditionally underserved demographics.”

That’s discussing the technical challenges. Concerns about privacy drew outrage a couple years ago from congressional lawmakers, prompting the Internal Revenue Service to stop requiring use of the facial recognition system.

ID.me CEO Blake Hall has pushed back in the past against privacy concerns.

“We avoid disclosing methods we use to stop identity theft and organized crime as it jeopardizes their effectiveness,” Hall wrote in a LinkedIn blog post. He said the one-to-one facial recognition was more akin to similar ID software people use to unlock their phones.

Still, the IRS stopped requiring use of ID.me’s facial recognition software last year, a step taken after concerns raised by Congress from both sides of the aisle. ID.me still provides other secure login and identify verification services, and users can opt to employ the selfie system..

U.S. Senate Republicans in February of 2022 sent a letter objecting to the IRS collective sensitive biometric data through ID.me. That letter complained the IRS forced millions to “pay the toll of giving up their most personal information, biometric data, to an outside contractor or return to the era of a paper-driven bureaucracy where information moves slow.”

Similarly, U.S. Sen. Elizabeth Warren, a Massachusetts Democrat, led a letter urging the Department of Labor to stop use of the service for similar concerns.

Democrats in the U.S. Senate months later called for the Federal Trade Commission to investigate misleading statements about the facial recognition software. And in November, the House Oversight Committee found the company overstated the severity of unemployment fraud to win additional government contracts.