Identity Crisis

My dad was in the Normandy Invasion. His unit, the 28th Infantry Division, helped liberate Paris in August 1944. They marched down the Champs-Élysées, saluted by Gen. de Gaulle. My father was subsequently captured in the Battle of the Bulge and spent several months in the infamous Nazi prison camp Stalag IV-B, near Mühlberg.

After hearing the stories from the time I was a young child, I finally decided to look up my dad’s war record. That’s when I encountered something called ID.me.

More from Robert Kuttner

It used to be the case that you had to be next of kin to get someone’s war record, or have some other good reason. But the rules were changed in 2004 and now provide that 62 years after a GI separates from the armed services, official military personnel records are public information. Since the Second World War ended 81 years ago, that covers virtually all World War II vets. So in principle, anyone can just look them up.

However, since 2016, several federal agencies have contracted with a multibillion-dollar monopoly private vendor called ID.me to provide access. So before you can get a loved one’s military service records, ID.me requires you to set up an account, which in turn requires your date of birth, Social Security number, a photo of your driver’s license or passport, and a headshot taken with your cellphone camera.

Remember, these military records are public information, so this whole process is gratuitous. ID.me has similar deals with 20 federal and 50 state agencies, including the IRS, Social Security Administration, Medicare, and Veterans Affairs, and now has about 156 million individual accounts.

ID.me claims that it doesn’t sell data but makes its money by charging agencies for verification services. It also uses its experience with massaging this treasure trove of data to sell ID verification services to private corporations, including Apple, Amazon, Bank of America, Ford, T-Mobile, 3M, JPMorgan Chase, and dozens of others.

Here’s the insidious part. ID.me harvests this personal data as a gatekeeper to public agencies—which have no business requiring citizens to use a for-profit intermediary. Providing access, with privacy and security safeguards, is a core part of these agencies’ job.

You need no intermediary to collect Social Security benefits, and the process for applying is simplicity itself. Social Security’s administrative costs are a fraction of those of private investment accounts. Nor do you need to go through some vendor to activate your Medicare when you turn 65. You can also access the IRS directly, though the IRS is awash in private-vendor profiteering.

The IRS, Social Security, the VA, and Medicare, which house confidential personal information that they zealously guard, allow you to access them directly. But ID.me, via aggressive marketing and lobbying, has persuaded these agencies to also allow access via an ID.me portal.

For instance, if you go online to access Social Security information, you will get this message, advising that you can go to Login.gov, or create an account with ID.me. And for this totally redundant and gratuitous “service,” ID.me has billed the government (the taxpayers) over a billion dollars.

ID.me is worse than redundant. It is an epic example of how private vendors are parasitic on the public sector. The more government comes to rely on such vendors, the more government loses core competence and becomes subject to vendor lock-in.

And of course, the campaign to privatize basic government functions is relentlessly moving in the wrong direction, even more so under President Trump. From private prisons to mercenary soldiers to security guards, more and more of government gets contracted out.

There was a fledgling effort to allow a public institution to perform public functions, called Direct File, created by the Inflation Reduction Act in 2022 to have the IRS prepare tax returns to save taxpayers a lot of money that they now spend on for-profit tax preparers. Trump’s Treasury snuffed it out. Efforts to revive postal savings accounts never came to fruition.

Back in 2022, when Democrats controlled Congress, Sen. Ron Wyden of Oregon, then chair of the Senate Finance Committee, investigated ID.me and pressed the IRS to stop using ID.me’s facial recognition access system and to shift to the public Login.gov system instead. Wyden did succeed in blocking facial recognition, but the IRS retained the ID.me system as an optional portal.

Wyden also joined with Sens. Elizabeth Warren and Sherrod Brown to press the Labor Department to help states move away from the use of ID.me for unemployment benefits. But dozens of states still contract with ID.me.

There has been a lot of discussion about what a progressive Project 2029 might look like. Certainly, if Democrats become the governing party, there will be a massive repair job to rebuild several government agencies trashed by Elon Musk, Russell Vought, RFK Jr., and by Trump’s illegal refusal to spend duly appropriated funds.

But in addition to this basic rehabilitation, a huge amount of damage has been done to government below the waterline, and a good deal of it antedates Trump. Restoring public functions to public agencies and canceling government contracts with ID.me would be one good place to start.

To model what government should do, as soon as I got my dad’s war records, which had no surprises, I canceled my ID.me account. I have no idea what will happen to the data that I provided.