I think from the IRS' perspective, they wanted to reach a NIST-certified level of identity verification (NIST 800-63A IAL2 [1]), and there is no governmental se

I think from the IRS' perspective, they wanted to reach a NIST-certified level of identity verification (NIST 800-63A IAL2 [1]), and there is no governmental service which offered the ability to do that[2], so they went to a private company. I have a lot of notes around this whole dustup; it's my opinion that: - The IRS acted in good faith trying to secure its website in the best way possible - It's very unfortunate that the US government at the same time promotes a particular standard, but does not provide a service matching that standard and seems to currently have no plans to do so [1]: https://pages.nist.gov/800-63-3/sp800-63a.html https://pages.nist.gov/800-63-3/sp800-63a.html [2]: login.gov is IAL1 but not IAL2 compliant; IAL2 compliance requires biometric verification and login.gov does not do this. I also think the IRS had concerns around scaling login.gov, but that the lack of biometric verification was decisive[3] [3]: https://twitter.com/llimllib/status/1490802056256532480 https://twitter.com/llimllib/status/1490802056256532480