Everyday Erinyes #305

 Posted by at 10:36 am  Politics
Feb 132022
 

Experts in autocracies have pointed out that it is, unfortunately, easy to slip into normalizing the tyrant, hence it is important to hang on to outrage. These incidents which seem to call for the efforts of the Greek Furies (Erinyes) to come and deal with them will, I hope, help with that. As a reminder, though no one really knows how many there were supposed to be, the three names we have are Alecto, Megaera, and Tisiphone. These roughly translate as “unceasing,” “grudging,” and “vengeful destruction.”

We have through this column looked at facial recognition before, and, while it can certainly have some positive uses, I personally prefer to be identified by what’s inside my head rather than what’s outside it. (Then there’s the little issue that I do not own, nor do I plan to own, a phone which is capable of downloadding an app or anything else. Nor do I own or plan to own a webcam …even assuming the technology could be downloaded to a desktop.) If the IRS wants to identify me by a body part, I’d be amenable to a fingerprint … provided it hadn’t been taken from a hand which was subsequently amputated. But that’s the problem. Body parts are not set in stone. So I was very happy to read that the IRS had backed off on making this mandatory.
==============================================================

Government agencies are tapping a facial recognition company to prove you’re you – here’s why that raises concerns about privacy, accuracy and fairness

Beginning this summer, you might need to upload a selfie and a photo ID to a private company, ID.me, if you want to file your taxes online.
Oscar Wong/Moment via Getty Images

James Hendler, Rensselaer Polytechnic Institute

The U.S. Internal Revenue Service is planning to require citizens to create accounts with a private facial recognition company in order to file taxes online. The IRS is joining a growing number of federal and state agencies that have contracted with ID.me to authenticate the identities of people accessing services.

The IRS’s move is aimed at cutting down on identity theft, a crime that affects millions of Americans. The IRS, in particular, has reported a number of tax filings from people claiming to be others, and fraud in many of the programs that were administered as part of the American Relief Plan has been a major concern to the government.

The IRS decision has prompted a backlash, in part over concerns about requiring citizens to use facial recognition technology and in part over difficulties some people have had in using the system, particularly with some state agencies that provide unemployment benefits. The reaction has prompted the IRS to revisit its decision.

a webpage with the IRS logo in the top left corner and buttons for creating or logging into an account
Here’s what greets you when you click the link to sign into your IRS account. If current plans remain in place, the blue button will go away in the summer of 2022.
Screenshot, IRS sign-in webpage

As a computer science researcher and the chair of the Global Technology Policy Council of the Association for Computing Machinery, I have been involved in exploring some of the issues with government use of facial recognition technology, both its use and its potential flaws. There have been a great number of concerns raised over the general use of this technology in policing and other government functions, often focused on whether the accuracy of these algorithms can have discriminatory affects. In the case of ID.me, there are other issues involved as well.

ID dot who?

ID.me is a private company that formed as TroopSwap, a site that offered retail discounts to members of the armed forces. As part of that effort, the company created an ID service so that military staff who qualified for discounts at various companies could prove they were, indeed, service members. In 2013, the company renamed itself ID.me and started to market its ID service more broadly. The U.S. Department of Veterans Affairs began using the technology in 2016, the company’s first government use.

To use ID.me, a user loads a mobile phone app and takes a selfie – a photo of their own face. ID.me then compares that image to various IDs that it obtains either through open records or through information that applicants provide through the app. If it finds a match, it creates an account and uses image recognition for ID. If it cannot perform a match, users can contact a “trusted referee” and have a video call to fix the problem.

A number of companies and states have been using ID.me for several years. News reports have documented problems people have had with ID.me failing to authenticate them, and with the company’s customer support in resolving those problems. Also, the system’s technology requirements could widen the digital divide, making it harder for many of the people who need government services the most to access them.

But much of the concern about the IRS and other federal agencies using ID.me revolves around its use of facial recognition technology and collection of biometric data.

Accuracy and bias

To start with, there are a number of general concerns about the accuracy of facial recognition technologies and whether there are discriminatory biases in their accuracy. These have led the Association for Computing Machinery, among other organizations, to call for a moratorium on government use of facial recognition technology.

A study of commercial and academic facial recognition algorithms by the National Institute of Standards and Technology found that U.S. facial-matching algorithms generally have higher false positive rates for Asian and Black faces than for white faces, although recent results have improved. ID.me claims that there is no racial bias in its face-matching verification process.

There are many other conditions that can also cause inaccuracy – physical changes caused by illness or an accident, hair loss due to chemotherapy, color change due to aging, gender conversions and others. How any company, including ID.me, handles such situations is unclear, and this is one issue that has raised concerns. Imagine having a disfiguring accident and not being able to log into your medical insurance company’s website because of damage to your face.

Facial recognition technology is spreading fast. Is the technology – and society – ready?

Data privacy

There are other issues that go beyond the question of just how well the algorithm works. As part of its process, ID.me collects a very large amount of personal information. It has a very long and difficult-to-read privacy policy, but essentially while ID.me doesn’t share most of the personal information, it does share various information about internet use and website visits with other partners. The nature of these exchanges is not immediately apparent.

So one question that arises is what level of information the company shares with the government, and whether the information can be used in tracking U.S. citizens between regulated boundaries that apply to government agencies. Privacy advocates on both the left and right have long opposed any form of a mandatory uniform government identification card. Does handing off the identification to a private company allow the government to essentially achieve this through subterfuge? It’s not difficult to imagine that some states – and maybe eventually the federal government – could insist on an identification from ID.me or one of its competitors to access government services, get medical coverage and even to vote.

As Joy Buolamwini, an MIT AI researcher and founder of the Algorithmic Justice League, argued, beyond accuracy and bias issues is the question of the right not to use biometric technology. “Government pressure on citizens to share their biometric data with the government affects all of us — no matter your race, gender, or political affiliations,” she wrote.

Too many unknowns for comfort

Another issue is who audits ID.me for the security of its applications? While no one is accusing ID.me of bad practices, security researchers are worried about how the company may protect the incredible level of personal information it will end up with. Imagine a security breach that released the IRS information for millions of taxpayers. In the fast-changing world of cybersecurity, with threats ranging from individual hacking to international criminal activities, experts would like assurance that a company provided with so much personal information is using state-of-the-art security and keeping it up to date.

[Over 140,000 readers rely on The Conversation’s newsletters to understand the world. Sign up today.]

Much of the questioning of the IRS decision comes because these are early days for government use of private companies to provide biometric security, and some of the details are still not fully explained. Even if you grant that the IRS use of the technology is appropriately limited, this is potentially the start of what could quickly snowball to many government agencies using commercial facial recognition companies to get around regulations that were put in place specifically to rein in government powers.

The U.S. stands at the edge of a slippery slope, and while that doesn’t mean facial recognition technology shouldn’t be used at all, I believe it does mean that the government should put a lot more care and due diligence into exploring the terrain ahead before taking those critical first steps.The Conversation

James Hendler, Professor of Computer, Web and Cognitive Sciences, Rensselaer Polytechnic Institute

This article is republished from The Conversation under a Creative Commons license. Read the original article.

==============================================================
Alecto, Megaera, and Tisiphone, I think I am even more nervous about the possibilities of false negatives than false positives. I do not take kindly to being told I am not who I am. I realize the government has a legitimate interest in being able to verify people’s identity, and I also realize that people as a whole are pretty stupid about passwords. That’s why there is a trend toward two-step verification (after inputting your password the site gives you an option of getting a one-time code by text or voice phone to a number which is already on record with them, and you input it when you receive it.) I assume we have all done that at one point or another. One of my banks has always had a two-step process where you had to have both a password and a PIN to get in (and now also has the phone/text option.) My credit union has for over a decade has a system where, upon opening an account, you select a picture from a library and then enter a pass phrase to go with it, and each time I log in they show both to me, and if either one is not right, then I don’t even enter my password (not that that has ever happened. In fact, it seems to be working.)

The Furies and I will be back.

 

Share
May 192020
 

If you thought that, now that you have input your data to the 2020 census, we are through with it … well, you were mistaken.  Although the Census greatly ramps up its hiring during years ending in zero, it actively functions all the time. not just with a skeleton crew, either, but with a whole lot of the best and brightest experts on data available. Because one of its missions is to make data – up to date and accurate data – available to anyone who needs it most. That’s how I was able to inform you all and the Furies that, within the United States, there exist over 90,000 separate governments. Not government agencies (which must far outnumber that figure) – but actual governments. As of 2017. Because the Census compiled that information and Professor Swindell researched and cited it. Professor Swindell first hand, and I (at this point second hand) are Census Data Products users.

Would you like to become a Census Data Products User? Well, that’s easy. You can sign up right here to receive the Census Data Products Newsletter (and also, if you like, their Operational Updates Newsletter), and they will send you all the scoop. Here’s a sample of the kind of information available.

I must note at this point that the Census Bureau has all kinds of data – and it is very concerned about differentiating public data from private data. Theft of personal data is a huge issue, and made even more critical by digitalization and hacking. But the Census Bureau is on it, and their Data newsletters will also contain up to the minute information on what they are doing to oppose it, including developing a Disclosure Avoidance System

Blessings upon them, they have made an introduction in comic strip form available to journalists under a Creative Commons license to freely republish. It is available as a PDF here, and you can print it, keep it, share it, whatever you like. I am reproducing it below under that license in three JPG files, one for each page of the PDF.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

As you can see, the basis of their program is the concept of Differential Privacy. I suspect we will be hearing the word a lot.  Of course at this point it is a work in progress, but progress is being made, as quickly and carefully as possible.

Share