Internal Revenue Service working to expand use of Login.gov

The Internal Revenue Service is working to expand its use of Login.gov as an authentication option for U.S. taxpayers.

In a joint statement, the agency and the General Services Administration said they would “work toward further implementation and expansion of Login.gov to help taxpayers validate identities when using services on IRS.gov.”

Login.gov is currently used by IRS as an identity-proofing option for the submission of Form 990-N, which is used by small, tax-exempt organizations for annual reporting. It is used also for the agency’s Qualified Intermediary System, which is used to collect filings from foreign intermediaries that have withholding agreements with the tax service.

In February last year, the tax agency began to explore the use of Login.gov as a user authentication tool after previously agreeing to abandon the use of a commercial tool that featured third-party facial recognition technology.

The two agencies added: “We appreciate the strong partnership and continue to evaluate how best to expand the use of Login.gov to deliver accessible, secure, and privacy-protecting solutions to taxpayers and the American public.”

Login.gov was launched in 2017 to offer the public an easy way to securely log in to federal government websites. Earlier this month it was the subject of a watchdog report that identified multiple failings by the team responsible for the platform.

In particular, that report found that the General Services Administration had continued to bill agencies for Identity Assurance Level 2-complaint services, even though Login.gov did not meet IAL2 standards.

Login.gov does not meet IAL2, which is an identity proofing requirement set by the National Institute of Standards and Technology as part of its SP 800-63 guidance series that provides crucial technical requirements and guidance for identity proofing by government IT systems on open networks.

In December, that NIST guidance was revised in draft form to include a “fully remote Identity Assurance Level (IAL) 2 identity proofing workflow that provides security and convenience but does not require face recognition.”