Hacker News Reader

Comment by dragonwriter | Hacker News Reader

> I'm not saying that facial recognition is a reasonable way to try to fix this, but we're talking about $400,000,000,000 being stolen

No, we’re talking about a firm whose business depends on the perception of the magnitude of the problem claiming that. The source of that number in the article you cite is...the CEO of ID.me.

And when pressed by CNN to support that staggering figure ID.me responded with...promotional material for their product, instead. [0] It couldn't be any more clear that its a BS number the CEO pulled out of his colon for promotional reasons.

[0] https://www.cnn.com/2021/06/10/politics/what-matters-unemplo...

View on HN

Perhaps someone should be FOIAing agreements between state unemployment departments and ID.me, and perhaps even the Veterans Administration, the Social Security Administration, and other federal agencies (mentioned in the posted article) who are leveraging a private firm for identity proofing services using facial recognition.

Fraud should be prevented, for sure! But a private corporation black box governing access to social safety nets is not to be tolerated.

I don't think it should be legal for either the state or federal government to outsource such a sensitive and important function.

I agree.

https://login.gov

https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth...

https://www.congress.gov/bill/116th-congress/house-bill/8215...

https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...

This is not great. It's using the current issues to push for an ID system that could be leveraged by private parties and is thus likely to significantly reduce online (pseudo)anonymity. It also explicitly calls for the involvement of the private sector in delivering any solution.

I want state governments to have a reliable online identity option. I want it to be optional by law - I should be able to make an in person visit instead. I do not want private parties to have any access to the service whatsoever. I want private sector outsourcing of such services to be completely outlawed. No private third party has any business knowing about my interactions with any government provided service.

I should never have to share my data with private third parties in order to receive government services. Such usage data is very sensitive and thus a huge privacy concern.

Consider: If you ever had to go on food stamps, would you want retailers, potential employers, etc to be able to purchase that data? What about the risk of a data breach?

You should not expect anonymity when obtaining government services, full stop. That is the entire point of identity proofing and, at a higher level, identity and access management. I agree a private entity should not be required in the verification chain for interacting with government and obtaining government services.

My last link points to a blog recommending the USPS provide in person proofing, which I believe meets your in person proofing requirement. Login.gov is a service operated by the US government's GSA agency. It is not a private entity providing this service. It was developed as part of 18F and the US Digital Service.

I don't expect anonymity from the government (I suspect that would be a fairly absurd goal given current technology). Rather, I expect that absolutely no one other than the government should ever have access to such data.

My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored.

Why is that a high hill to climb? It's more like a slippery slope. Until recently it was definitely the expectation that your government information would stay only IN the government.

It seems wasteful to spend this thread rehasing the utter disregard the legislative branch has for enacting strong data and privacy legislation (California's CCPA aside), Equifax's willful ignorance towards data security with no consequences for them and no recourse for citizens who had their data leaked, etc. It's not easy, it hasn't been done yet, and it's a high hill to climb. Have to get in front of the folks who write the law, who currently aren't making it a priority.

Fair enough, the situation on the ground is at significant variance with people's expectations.

> My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored.

It might be a high hill, though softening to allow contractors involved in providing the service to know but requiring them to observe privacy rules similar to what would apply in the healthcare space under HIPAA, would make it much lower.

At the state level, for either version, I would recommend, if possible in your state, you to work with advocacy organizations who are willing to sponsor a public ballot initiative rather than focussing on policymakers alone; while industry insiders can and will buy ads against ballot measures, they can't cut them off by compromising strategically targeted legislators the way they often can bills in the legislature.

Anonymity and privacy are not the same thing

National, standardized, digital ID is inevitable.

Very difficult in the US because the Federal government has no authority to require one, and the Supreme Court has consistently ruled that any regulatory or back door methods to effectively achieve a similar result is not legal.

It is one of the reasons ID resolution in the US is largely outsourced to private entities, which have no such restrictions.

> Very difficult in the US because the Federal government has no authority to require one,

It absolutely could require one for functions within the federally-regulatable sphere, and not prohibit its use for private and state functions.

(If it was national-but-decentralized, it could just set standards for the digital ID and let states issue them, the same way it has for physical ID, see, e.g., REAL ID.)

The pay is INSURANCE which employees can not opt out of paying the premium when employed.

Just because some States are mandating this privacy invasion does not mean it is legal. This appears to have not yet been tested in the courts.

From your article:

> The US Department of Labor Inspector General Office in late March estimated that at least $89 billion of the estimated $896 billion in federal unemployment program funds could be paid improperly, with a significant portion attributable to fraud. This is based on a historic improper payment rate of at least 10%.

This is lazy BS from the other side; they know for a fact that the rate of fraud is going to be higher than it was pre-COVID. We know how much has been paid out and the only question is what the fraud rate is.

I agree that you have to be skeptical given that id.me is selling a product, and to be honest, I only put two-and-two together after making my comment and revisiting the axios article since I first came across it. That being said, given how many states are using id.me, they have unique visibility into the problem and I don't think it's fair to write them off as entirely untrustworthy.

tl;dr: The number is probably between $100B and $400B. It's hundreds of billions of dollars either way.

Fraud is a subset of that 10%, it could 10% of the total improper payment rate aka 1% of the total.

Assuming it’s higher with covid seems without justification is just an assumption. If anything it might be lower if a higher percentage of people applied for unemployment without quickly finding a new job.

That's fair. But the general consensus among media and government agencies has been that the rate of fraud (and not just the overall amount of fraud) is higher. ie: in Maryland

> According to the Maryland Department of Labor, as of July 13, 1,443,211 or 92.31 percent of all out-of-state and in-state claims were confirmed as fraudulent.

https://www.wmar2news.com/unemploymentguide/several-arrests-...

Again that 92% could be true, but those are clams not money actually being handed out. That said, if under 8% of clams where legitimate then paying out 50% incorrectly might actually be accurate.

> This is lazy BS from the other side; they know for a fact that the rate of fraud is going to be higher than it was pre-COVID.

As a percentage of total claims? I don't think they know that. What's the reasoning? Obviously, both numerator and denominator would go up, but beyond that...

Reply on news.ycombinator.com