After a swift backlash from taxpayers and Congress, the IRS recently announced it was dropping a draconian practice of collecting facial recognition data from anyone who wanted to use the agency’s website. The practice, part of a software suite developed by the company ID.me, was condemned by Congressman Ted Lieu, Senator Ron Wyden, and even The Washington Post’s editorial board.
While abandoning the idea was laudable, however, it did not solve all of the problems with the agency’s website. The IRS will continue to collect a treasure trove of highly sensitive personal data – such as copies of bills and identity documents and, according to Krebs Security, “scans of their driver’s license or other government-issued ID, copies of utility or insurance bills, and details about their mobile phone service.”
And if that data is stolen in a hack, and sold online to identity thieves (as has happened again and again in similar situations in the retail and other sectors), there won’t be a whole lot anyone can do about it.
That’s because ID.me, a company “originally launched in 2010 with the goal of helping e-commerce sites validate the identities of customers who might be eligible for discounts at various retail establishments, such as veterans, teachers, students, nurses, and first responders,” and its software agreement includes “a binding arbitration clause and a class action waiver...which affect your rights about resolving any dispute with ID.me.” That means, when you log on to the IRS site to use it, you’ll also have to sign away your right to go to court if anything should possibly go awry.
Translation: If, God forbid, Russian hackers infiltrate the IRS system and steal your details and, by extension, your identity, you cannot turn to the courts for help. And if the identity theft is widespread – as it almost always is – any of the 148.3 million U.S. taxpayers who happen to be caught up in it will each, individually, need to pursue their case in arbitration. There will be no option for the courts to quickly step in and offer any sort of remedy to the class of taxpayers who have been harmed, regardless of how large that group of impacted Americans might be.
Such a breach wouldn’t be unprecedented, as the Washington Post editorial board also pointed out. “[L]et’s not forget that hackers exposed the personal information of more than 140 million Americans when they broke into Equifax — itself once an IRS verification company,” the Post wrote. “If hackers were able to obtain the ID.me selfie records, it could be especially damaging, with potential uses ranging from committing fraud and identity theft to blackmailing people — or the company.”
Exactly who would be most at risk from such security breaches is hardly a mystery.
The likes of Jeff Bezos, Elon Musk, and Donald Trump aren’t filing their taxes or checking their refund status on the IRS website. They’re using the most sophisticated – and expensive – tax preparers and accounting firms in the world. Meanwhile, a large number of mostly lower and middle taxpayers rely on the IRS – and the IRS website – to file their taxes, access tax forms, and tables, and deal with the bureaucracy the agency has become infamous for.
Indeed, many Americans rely on the IRS website because it is free. In fact, the IRS says that nearly 90% of taxpayers will e-file this year, sharing information such as their social security numbers, income data, and name and address with the agency. For those at or below specific income levels, e-filing annual taxes can be done with the IRS site free of charge. And that means the arbitration clause is almost certainly going to disproportionately impact lower-income taxpayers.
Imagine the damage a hacker could do with a combination of your social security number, phone number, and birthday. Under the ID.me user agreement, which will still extend to every online user of IRS.gov, it does not matter how much the hackers steal – from wiping away your bank account to opening a new mortgage in your name – you’ll be barred from ever taking them to court. And if the steal ensnares millions – or tens of millions or more – each person will have to get in line and wait for their day in arbitration …. where we know that, in comparison to a day in court, victories are statistically few and remedies are frequently slim.
This isn’t likely a risk that Bezos, Musk, or Trump will need to worry about. They will never have to agree to the arbitration clause because they will never use the IRS portal to file taxes or obtain tax information. Others will take care of that for them. But for the millions of Americans in other income brackets who will need to access the IRS site to complete their required, annual filing, they will have no other choice: Sign away your right to hold the software company accountable if you get hacked, or find another, more expensive, way to do your taxes.
It just shouldn’t be that way. The federal government, of all institutions, should never be slamming the courthouse doors shut and working to deny Americans their day in court. And it should not be partnering with corporations that seek to do the same.
The Biden Administration should immediately demand that ID.me follow its pledge to drop facial recognition by also dropping its arbitration clause as a condition of continuing its contract with the IRS. (Indeed, the federal government as a whole should refuse to work with contractors who include forced arbitration clauses in their contracts or user agreements. The IRS isn’t the only federal website using ID.me software; nine other federal agencies, and more than 30 states, also currently use the same service with, presumably, the same arbitration clause intact.) And taxpayers should contact the IRS online (no forced arbitration clause required to do that! – well, at least not yet) and ask them to do the same.
Among the many things the IRS routinely asks us to give up and turn over, our day in court shouldn’t be one of them. The IRS must demand that ID.me drop its forced arbitration clause now. Accessing our government shouldn’t require abdicating our rights, and it shouldn’t further perpetuate a system that rewards the rich who can afford highly paid tax prepares while setting up a separate, and unequal, system for everyone else.
After all, at the end of the day, our tax dollars are paying for ID.me, and we should insist on something better.