5 ms·

> Five years later and more than $187 million in government investment later, however, it still hasn’t been widely rolled out. I know anything like this is goi

> Five years later and more than $187 million in government investment later, however, it still hasn’t been widely rolled out. I know anything like this is going to be more complicated than it seems. Integration of lots of legacy systems, of which the federla government is probably about as complicated as it gets, with the most security-sensitive application possible. Still, and I'm really not an expert here, but I am astonished that $187 million could possibly not be enough to get this done. If it can't be done for $187 million, it seems likely it will never be done. But, intended with real humility and not sarcasm, I would love to hear more from someone who has more context. $187 million just seems astonishing. Or maybe the quote is wrong that it "hasn't been widely rolled out"?

Terretta 4y ago
$187M = $37M per year At average FAANG salaries with overhead (benefits, space, equipment both desk and datacenter/cloud, internal workplace support functions like Recruiting, IT, HR, ER, DEI...) that's 60 people. That's not many when dealing with multiple massive counterparties. You'll see ratios of non-dev to dev easily 10:1 to 30:1. Yes, they could genuinely spend $187M so far on a project accomplishing only 2 devs x 5 years worth of work and rework.
- jrochkind1 4y ago
  That's actually good perspective,thanks!
  - welshwelsh 4y ago
    Also consider the cost per taxpayer. At $187 million that's roughly $1 per person. For someone making the average income, it costs them maybe $0.15 in taxes for ID.me. The IRS estimated that the average taxpayer spends $240 and 13 hours of time on their taxes. Multiply by 157 million taxpayers and that's $37 billion and 2 billion hours of labor. Although likely skewed by a small % who hire professionals, plenty of people spend $100+ on services like TurboTax. The IRS spending a couple billion to make the tax process a little bit easier is really not a big deal. $187 million is nothing, and if that's all it costs to streamline their ID verification process, then it means the government is much more efficient with our tax dollars than people give it credit for.
- jjfoooo4 4y ago
  Simple to use != simple to make is so often a hard fact to keep in mind when looking at these numbers
akira2501 4y ago
> with the most security-sensitive application possible. I certainly don't see my tax returns that way.. is that a commonly held view?
- jrochkind1 4y ago
  I'm not talking about "tax returns", I'm talking about "SSO used by citizens/residents/customers for the federal government", which is what login.gov is.
- deleted 4y ago
  [deleted]
- irrational 4y ago
  Doesn’t it have your social security number?
  - akira2501 4y ago
    Conventionally, yes.. but there's no reason the IRS has to use this alone to identify me. Conceivably, it would be very easy to check a box on my W-9 and have a unique yearly "Tax ID" generated and placed on my W-2. Then I can file using that unique number and the imputed need of the highest security ever can just evaporate.
  - OkGoDoIt 4y ago
    I run a small business and I need to collect W-9's from basically everyone I ever pay, which means I have an absurd amount of SSN's in PDFs sitting in a folder on my computer. It feels very wrong, but apparently that's how taxes work. Kind of makes SSN's feel less secure/protection-worthy than I used to believe shrug
    - curryberto 4y ago
      First job out of college I was given, with no oversight or training, access to thousands of peoples SSNs, names, phone numbers and addresses. I also had a private investigator locate someone from my childhood once and got not only their phone number, address, and SSN but their entire family and neighbors and anyone who had a name similar to theirs. It's outrageous how insecure everything is.
woodruffw 4y ago
> Or maybe the quote is wrong that it "hasn't been widely rolled out"? I think it's wrong in some senses: Login.gov has been rolled out to the SSA, OSHA, Treasury, RRB, VA, DHS, and quite a few other orgs and agencies. There's no one good metric for these things, but if you measure it by org/agency size and/or budget, Login.gov looks very good. I agree that $187 million is an eye-popping number, and I wish we had the ability to put it into context: it's entirely possible that $187 million spent means that each agency is saving $X million in separate/legacy maintenance each year. Edit: Another framing is that, if the GSA's user predictions are correct[1], Login.gov will end up costing a little under $2 USD per user. [1]: https://federalnewsnetwork.com/it-modernization/2022/06/gsa-looks-to-reach-100m-login-gov-users-by-years-end-starting-with-va-partnership/ https://federalnewsnetwork.com/it-modernization/2022/06/gsa-...
- jrochkind1 4y ago
  For me, it's not a question of whether the cost is "worth it", but that the cost seems very very high for what seems to have been produced.
- savanaly 4y ago
  Agree with jrochkind1 that it doesn't matter whether it's worth it or not. I suppose chairs and desks for all US Government employees pay for their cost 1000x over, but I would hope people would still not let their costs balloon to more than, say, 2x what they "should" cost by some common-sense metric.
  - woodruffw 4y ago
    Sure, but what's the common-sense metric here? As posted elsewhere in the thread: this is ~$40m/year for an IdP/login scheme for the entire USG (and, increasingly, state and local governments). That's significantly less than the engineering talent at companies like Okta and Authy probably cost each year, even before factoring in overhead and non-engineering roles. All things considered, this looks like a very efficient use of taxpayer money to me. Particularly since it seems to have been primarily paid for on GS pay grades, not with private contractors.
thayne 4y ago
Part of that big price tag is likely because of requirements for any kind of government contracted software, some of which are reasonable, some of which are not. Often companies charge a lot more for complying with those requirements. The Fedramp version of most SaaS offerings is significantly more expensive than the non-fedramp version. And part of that is just to cover paying the higher prices for their dependencies to be fedramp compliant.

Terretta 4y ago

$187M = $37M per year At average FAANG salaries with overhead (benefits, space, equipment both desk and datacenter/cloud, internal workplace support functions like Recruiting, IT, HR, ER, DEI...) that's 60 people. That's not many when dealing with multiple massive counterparties. You'll see ratios of non-dev to dev easily 10:1 to 30:1. Yes, they could genuinely spend $187M so far on a project accomplishing only 2 devs x 5 years worth of work and rework.

jrochkind1 4y ago
That's actually good perspective,thanks!
- welshwelsh 4y ago
  Also consider the cost per taxpayer. At $187 million that's roughly $1 per person. For someone making the average income, it costs them maybe $0.15 in taxes for ID.me. The IRS estimated that the average taxpayer spends $240 and 13 hours of time on their taxes. Multiply by 157 million taxpayers and that's $37 billion and 2 billion hours of labor. Although likely skewed by a small % who hire professionals, plenty of people spend $100+ on services like TurboTax. The IRS spending a couple billion to make the tax process a little bit easier is really not a big deal. $187 million is nothing, and if that's all it costs to streamline their ID verification process, then it means the government is much more efficient with our tax dollars than people give it credit for.
jjfoooo4 4y ago
Simple to use != simple to make is so often a hard fact to keep in mind when looking at these numbers

akira2501 4y ago

> with the most security-sensitive application possible. I certainly don't see my tax returns that way.. is that a commonly held view?

jrochkind1 4y ago
I'm not talking about "tax returns", I'm talking about "SSO used by citizens/residents/customers for the federal government", which is what login.gov is.
deleted 4y ago
[deleted]
irrational 4y ago
Doesn’t it have your social security number?
- akira2501 4y ago
  Conventionally, yes.. but there's no reason the IRS has to use this alone to identify me. Conceivably, it would be very easy to check a box on my W-9 and have a unique yearly "Tax ID" generated and placed on my W-2. Then I can file using that unique number and the imputed need of the highest security ever can just evaporate.
- OkGoDoIt 4y ago
  I run a small business and I need to collect W-9's from basically everyone I ever pay, which means I have an absurd amount of SSN's in PDFs sitting in a folder on my computer. It feels very wrong, but apparently that's how taxes work. Kind of makes SSN's feel less secure/protection-worthy than I used to believe shrug
  - curryberto 4y ago
    First job out of college I was given, with no oversight or training, access to thousands of peoples SSNs, names, phone numbers and addresses. I also had a private investigator locate someone from my childhood once and got not only their phone number, address, and SSN but their entire family and neighbors and anyone who had a name similar to theirs. It's outrageous how insecure everything is.

woodruffw 4y ago

> Or maybe the quote is wrong that it "hasn't been widely rolled out"? I think it's wrong in some senses: Login.gov has been rolled out to the SSA, OSHA, Treasury, RRB, VA, DHS, and quite a few other orgs and agencies. There's no one good metric for these things, but if you measure it by org/agency size and/or budget, Login.gov looks very good. I agree that $187 million is an eye-popping number, and I wish we had the ability to put it into context: it's entirely possible that $187 million spent means that each agency is saving $X million in separate/legacy maintenance each year. Edit: Another framing is that, if the GSA's user predictions are correct[1], Login.gov will end up costing a little under $2 USD per user. [1]: https://federalnewsnetwork.com/it-modernization/2022/06/gsa-looks-to-reach-100m-login-gov-users-by-years-end-starting-with-va-partnership/ https://federalnewsnetwork.com/it-modernization/2022/06/gsa-...

jrochkind1 4y ago
For me, it's not a question of whether the cost is "worth it", but that the cost seems very very high for what seems to have been produced.
savanaly 4y ago
Agree with jrochkind1 that it doesn't matter whether it's worth it or not. I suppose chairs and desks for all US Government employees pay for their cost 1000x over, but I would hope people would still not let their costs balloon to more than, say, 2x what they "should" cost by some common-sense metric.
- woodruffw 4y ago
  Sure, but what's the common-sense metric here? As posted elsewhere in the thread: this is ~$40m/year for an IdP/login scheme for the entire USG (and, increasingly, state and local governments). That's significantly less than the engineering talent at companies like Okta and Authy probably cost each year, even before factoring in overhead and non-engineering roles. All things considered, this looks like a very efficient use of taxpayer money to me. Particularly since it seems to have been primarily paid for on GS pay grades, not with private contractors.

thayne 4y ago

Part of that big price tag is likely because of requirements for any kind of government contracted software, some of which are reasonable, some of which are not. Often companies charge a lot more for complying with those requirements. The Fedramp version of most SaaS offerings is significantly more expensive than the non-fedramp version. And part of that is just to cover paying the higher prices for their dependencies to be fedramp compliant.