{"id":12199,"date":"2022-02-11T12:49:15","date_gmt":"2022-02-11T12:49:15","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/11\/id-me-accepted-false-drivers-licenses-and-faked-face-scans-to-create-verified-accounts\/"},"modified":"2022-02-11T12:49:15","modified_gmt":"2022-02-11T12:49:15","slug":"id-me-accepted-false-drivers-licenses-and-faked-face-scans-to-create-verified-accounts","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/11\/id-me-accepted-false-drivers-licenses-and-faked-face-scans-to-create-verified-accounts\/","title":{"rendered":"ID.me accepted false driver\u2019s licenses and faked face scans to create \u2018verified\u2019 accounts"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\n

But despite the scale of the data gathering by the company, ID.me<\/a>, revealed in newly released records, the system has been exploited by scammers. Federal prosecutors last month said<\/a> a New Jersey man was able to verify fake driver\u2019s licenses through an ID.me system in California as part of a $2.5 million unemployment-fraud scheme.<\/p>\n<\/div>\n

\n

ID.me has pointed to the scam as an example of how well its systems work, noting<\/a> that it referred the case to federal law enforcement after an internal investigation. But the criminal complaint in the case shows that ID.me\u2019s identification systems did not detect bogus accounts created around the same day that included fake driver\u2019s licenses with photos of the suspect\u2019s face in a cartoonish curly wig.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

An ID.me spokesman declined to explain how the suspect was able to win approval for fraudulent accounts and referred other questions to the Justice Department.<\/p>\n<\/div>\n

\n

The company said in a statement that \u201cthe tactics of fraudsters are constantly evolving,\u201d that it \u201cuses extensive analytics and models to prevent identity theft\u201d and that it is \u201ccontinuously updating controls that protect against new and emerging fraudulent activity.\u201d<\/p>\n<\/div>\n

\n

The revelations raise new questions about the McLean, Va.-based contractor, which saw its business explode during the pandemic: 10 federal agencies, 30 states and more than 500 companies now pay ID.me to confirm the identities of Americans seeking services such as unemployment insurance or online tax records. The company last year was valued<\/a> at $1.5 billion, and its government contracts have totaled in the hundreds of millions of dollars.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

The company abruptly reversed course<\/a> this week following reports<\/a> from The Washington Post and other outlets and backlash from members of Congress, saying it would no longer require people to submit a \u201cvideo selfie\u201d for a facial recognition scan to access basic government services.<\/p>\n<\/div>\n

\n

In a statement, ID.me<\/a> CEO Blake Hall said that the company is \u201cdeeply committed to access, equity, security and privacy\u201d and that it had worked \u201cto advance a consumer-centric model of identity verification where individuals \u2014 not data brokers or credit bureaus \u2014 get to decide how their data is shared.\u201d<\/p>\n<\/div>\n

\n

But the company uses other controversial technologies for what it calls \u201cidentity proofing, authentication and group affiliation verification,\u201d leading privacy and civil rights advocates to voice concerns over how that data could be misused.<\/p>\n<\/div>\n

\n

This level of data collection \u201craises a lot of questions not only on the privacy front but in the dimension of what roles are appropriate for private companies,\u201d said Jay Stanley, a senior policy analyst with the American Civil Liberties Union.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

It also suggests the company could be \u201cmorphing from a privatized identity-verification investigator into a privatized FBI,\u201d Stanley said \u2014 and without public oversight or federal guidelines like the Privacy Act, which constrains how government agencies store personal data.<\/p>\n<\/div>\n

\n

A company spokesman said its data gathering and analysis techniques are standard industry practice.<\/p>\n<\/div>\n

\n

ID.me has championed the sophistication of its fraud-fighting software in messages to government officials. In an email revealed as part of a Freedom of Information Act request, which the ACLU shared with The Post, an ID.me<\/a> manager last spring sent a \u201cthreat intelligence memo\u201d to officials with the Oregon Employment Department touting that the company\u2019s security team had identified new \u201cthreat vectors\u201d for fraud.<\/p>\n<\/div>\n

\n

Included in that memo, the manager wrote, were details of how the company had worked with the private contractor Palantir<\/a> for \u201cdata analytics and trend analysis.\u201d The software, he said, could help government clients assess whether a single Internet Protocol address \u201ctied to multiple verified accounts is, say, a homeless shelter or social service agency, or an organized crime ring.\u201d<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

The company official said the ID.me security team was \u201cspending significant time monitoring and infiltrating criminal rings on the Dark Web,\u201d but the email did not say how the software linked a person\u2019s IP address, which every online device has, to an organized crime ring, and the memo was not provided as part of the FOIA request.<\/p>\n<\/div>\n

\n

An ID.me spokesman said the company uses Palantir\u2019s Foundry<\/a> software to help process information and that ID.me \u201cis the only entity with access to the data and analysis.\u201d The Oregon employment agency said it does not use Palantir and referred questions to ID.me.<\/p>\n<\/div>\n

\n

Palantir, named for a mysterious orb from \u201cLord of the Rings\u201d and co-founded by the billionaire investor Peter Thiel<\/a>, has built software to map connections between pieces of data, such as phone and Internet records, that U.S. Immigration and Customs Enforcement agents have used to track down undocumented immigrants<\/a>. The company did not respond to requests for comment.<\/p>\n<\/div>\n

\n

Olga Akselrod, a senior staff attorney with the American Civil Liberties Union, said the software risked potentially blocking people from government services if they were falsely linked to crime. She said there could be many reasons different people might be using the same IP address, including in cases where people are family members, live in the same home or share devices because they can\u2019t afford their own.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

\u201cWe have seen time and again how these analyses are often built on discriminatory data and assumptions,\u201d she said. That, she added, would compound the technical difficulties of the company\u2019s identity-verification process, which is already \u201creally inaccessible to the many, many people on the wrong side of the digital divide.\u201d<\/p>\n<\/div>\n

\n

ID.me<\/a>\u2019s state contracts<\/a> say it stores a vast assortment of personal data alongside people\u2019s \u201cselfie\u201d photos and videos, including home addresses, geolocation data, voice recordings and \u201cinferred citizenship\u201d status based on submitted passport documents.<\/p>\n<\/div>\n

\n

An Internal Revenue Service privacy assessment<\/a> in November said people\u2019s \u201cmobile phones are used as a piece of identity evidence themselves,\u201d and that geolocation data can be collected from the wireless phone carriers \u201cin the event of an investigation into a user.\u201d<\/p>\n<\/div>\n

\n

The company says that kind of data is critical to flushing out identity theft. Its privacy policy<\/a> says it can use people\u2019s sensitive and personally identifiable information to \u201ccooperate with law enforcement activities,\u201d and Hall told The Post that the company alerts its government clients to \u201cclear cases\u201d of fraud.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

In testimony<\/a> that ID.me submitted to the Montana Legislature for a state committee meeting Wednesday, the company said it had received 35 subpoenas and three warrants. The company said it does not sell data or \u201ccontribute data in bulk to any state or federal law enforcement databases\u201d but that it shares information regarding identity theft or fraud with state agencies, who \u201cmay involve law enforcement at their discretion.\u201d<\/p>\n<\/div>\n

\n

The company has said it abides by federal cybersecurity guidelines and has helped its state and federal government clients prevent hundreds of billions of dollars in government benefit fraud.<\/p>\n<\/div>\n

\n

But as the California prosecution shows, the technology is fallible. One man, Eric Jaklitsch, was indicted last month after federal prosecutors alleged he had filed at least 78 fraudulent claims worth a total of $2.5 million in California for pandemic unemployment assistance and other benefits.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

In the claims, prosecutors said, Jaklitsch falsely used other people\u2019s names and said they had been laid off because of the coronavirus from jobs including \u201cAqua Fitness Instructor,\u201d \u201cChildren\u2019s Zoo Caretaker\u201d and \u201cChauffeur, Funeral Car.\u201d<\/p>\n<\/div>\n

\n

He uploaded fake driver\u2019s licenses with those people\u2019s names and photos of himself \u2014 several of which were included in court documents showing him wearing a curly wig \u2014 then verified those same bogus documents by submitting \u201clive photos of himself,\u201d prosecutors said.<\/p>\n<\/div>\n

\n

Those unemployment claims then went to California\u2019s Employment Development Department, which has relied on ID.me to check the identities of hundreds of thousands of people since October 2020. The fraudulent submissions were then approved \u201cbased in part on the ID verification from ID.me,\u201d investigators wrote.<\/p>\n<\/div>\n

\n
\n
\n
\n

Story continues below advertisement<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Before Jaklitsch\u2019s alleged scheme was detected, 68 fraudulent claims had been approved, according to federal prosecutors. By the time of his indictment last month, more than $900,000 of state and federal money had been lost. (The indictment does not detail how Jaklitsch allegedly obtained the information for so many false driver\u2019s licenses.)<\/p>\n<\/div>\n

\n

The case is ongoing. Neither the California agency nor Jaklitsch\u2019s attorney responded to requests for comment.<\/p>\n<\/div>\n

\n

After the case was investigated, the company began saving people\u2019s \u201cselfie data\u201d into an internal database and running Amazon\u2019s facial recognition software, Rekognition<\/a>, on the scans to ensure one is not registering multiple identities, an ID.me spokesman said. (Amazon founder Jeff Bezos also owns The Post.)<\/p>\n<\/div>\n

\n

In a previous statement<\/a>, ID.me declined to publish details about its \u201cidentity theft countermeasures,\u201d saying disclosure could \u201cjeopardize the effectiveness of our controls while putting real people in harm\u2019s way.\u201d<\/p>\n<\/div>\n

\n

Aaron Schaffer contributed to this report.<\/i><\/p>\n<\/div>\n<\/div>\n