STOLEN IDENTITIES AT “FACE” VALUE: CREATING SECURITY MEASURES TO SAFEGUARD AGAINST DRIVER’S LICENSE IDENTITY FRAUD
2002 MARYLAND DEPARTMENT OF TRANSPORTATION FELLOWS INTERNSHIP PROGRAM
Adrienne Cousler Towson University Danielle Davenport Morgan State University Rachel Mehrbakhsh University of Maryland Baltimore County
STOLEN IDENTITIES AT “FACE” VALUE: CREATING SECURITY MEASURES TO SAFEGUARD AGAINST DRIVER‟S LICENSE IDENTITY FRAUD
TABLE OF CONTENTS EXECUTIVE SUMMARY PART I – Examining the Problem 1.0 Background 1.1 Drivers‟ Licenses – “Breeder Documents” 1.2 Criminal Activity – Legal Standards 1.3 Case Studies Part II – Introduction to Alternatives Part III – Analysis of Existing Standards: Why Improvements are Necessary 3.0 Illegal activity 3.1a Easily Accessible Social Security Numbers 3.1b Easily Accessible Birth and Death Records 3.2 Non-Integrated Drivers‟ License Databases 3.3a Inefficient Department of Motor Vehicles 3.3b Insider DMV Fraud Part IV – Recommendations to Reduce Drivers’ License Identity Fraud Cases 4.0a Integrating DMV Databases Nationwide 4.0b Creating Integrated Databases with SSA, Birth and Death Records, and Law Enforcement 4.1a Create Drivers‟ Licenses with Biometric Features 4.1b Create “Smart Card” Driver‟s Licenses 4.2a Train DMV Employees to Recognize Fraud 4.2b Conduct Internal Investigations of DMV Employees 4.3 Increase Efforts to Police Wrongdoers Part V – Cost-Benefit Analysis of Recommendations Part VI – Final Recommendations Appendices Acknowledgments Works Cited
EXECUTIVE SUMMARY In the United States, possessing a driver‟s license provides capabilities that span far beyond the scope of transportation. A license allows for free movement of persons nationwide by creating a national identity of sorts for the cardholder. Possession of a license may not necessarily indicate citizenship status, but it does relegate certain privileges to those who carry a license versus those who do not possess such identification. This paper focuses on safeguarding cardholders from driver‟s license theft, which in turn leads to cases of stolen identities. In order to implement security measures to effectively protect those who possess a driver‟s license, necessary precautions must be taken when drivers‟ licenses are issued at the Department of Motor Vehicles locations. Therefore, it is necessary to correct the system of driver‟s license issuance as it currently exists in order to diminish, and eventually eliminate, identity fraud cases in the State of Maryland. Problem The State of Maryland was ranked fourth in the nation last year with 1, 976 cases of identity-theft victims. Many of these incidents stem from cases of driver‟s license theft and fraud. Theft of a driver‟s license allows the criminal to obtain vital information pertaining to the victim‟s identity, such as his or her Social Security number, and driver‟s license fraud cases include any criminal use of false identifiers or false identification documents. The current system of operations in the Department of Motor Vehicles lacks the capabilities to effectively safeguard against such identity theft incidents. This lack of capabilities ultimately results in the proliferation of illegal activity, such as underage drinking and traffic accidents, which are either the direct or indirect consequence of identity theft cases. Goal To assess the feasibility of developing new operational changes in the Department of Motor Vehicles that will reduce the number of identity fraud cases that occur in the State of Maryland each year, while still maintaining the privacy rights of each resident. Recommendations Until a nationally integrated system of driver‟s license issuance is established, Maryland must implement safety measures within its own systems to ensure the protection of every cardholder. The following are the recommendations offered as a means of reaching this goal. Consider integrating databases of Department of Motor Vehicles nationwide. Consider linking those databases with the Social Security Administration and law enforcement agencies. Assess the effectiveness of implementing “smart card” features, such as biometrics, to detect fraud. Increase efforts to police wrongdoers. Examine the benefits of training DMV employees to recognize fraud. Evaluate the performance of DMV employees and conduct internal investigations to prevent insider fraud.
ACKNOWLEDGEMENTS
Our group would like to extend its gratitude and appreciation to the following individuals for their time and assistance: Christine Krajewski, Assistant Director, Professional Practice: UMBC -- Shriver Center Carolyn Jasmin, MDOT Headquarters Richard Woo, Director of Office of Policy and Research (SHA) Steven Gaudio, Deputy Director of Office of Policy and Research (SHA) Eleanor Huber, Senior Policy Analyst of Office of Policy and Research (SHA) Art Proctor, MVA – Finance, Planning, and Research Kevin Quinn – MPA Lori Vidil, Office of Media and Customer Relations (MdTA) Kelly Melhem, Office of Media and Customer Relations (MdTA) Terri Moss, Office of Media and Customer Relations (MdTA) Heather Brautman, Office of Media and Customer Relations (MdTA) Gregory Prioleau, Office of Media and Customer Relations (MdTA) Shirely Hill, Office of Media and Customer Relations (MdTA) Office of Communications, (SHA)
A-1
Maryland Motor Vehicle Administration: Sources of Proof
You must bring original documents or copies certified by the agency. Photocopies and documents with alterations or erasures will not be accepted. Proof of age, name, identity and residence Birth certificate; or court change of name order; or valid foreign passport with visa and valid I-94/adit stamp showing evidence of lawful admission or valid INS document, plus one additional primary source of identification with the applicant‟s signature; OR Birth certificate; or court change of name order; or valid foreign passport with visa and valid I-94/adit stamp showing evidence of lawful admission or valid INS document, plus two additional secondary sources of identification, one of which must contain the applicant‟s signature; A document or documents with the applicant‟s full name and signature if a digital image is on file with the MVA and is retrievable for identification purposes; PLUS Two proofs of Maryland residence.
Birth Certificates Must Be: An original or certified copy issued by the office of vital statistics in one of the United States, the District of Columbia, or a U.S. territory. Birth registration cards/notices are acceptable for Maryland births only. United States citizens who were born in a foreign country, must present their U.S. state department birth certificate. Foreign/out-of-country birth certificates are NOT acceptable even with an English translation. Proof of lawful admission into the United States is required from citizens of foreign countries.
If No Record of Birth Exists, Please Bring:
1. A letter from the office of vital statistics in your state of birth that certifies that no record of birth exists. 2. Two primary sources or one primary and two secondary sources (one must contain the full name and birth date and the other your current signature) 3. Two proofs of Maryland residence. Primary Sources (two items are required)
A-1
Original government-issued birth certificate or certified copy (U.S. territorial) Actual social security card Valid U.S. passport Valid U.S. military identification card or discharge record (DD214); or active duty military dependant card Maryland driver‟s license Maryland identification card Out-of-state driver‟s license (valid or expired) Out-of-state identification card (valid or expired) Certificate of naming from a religious institution such as a baptism certificate or synagogue naming certificate issued in the first year of life Certified school records Valid out-of-country passport with visa and valid I-94/adit stamp evidencing lawful admission Certificate of U.S. citizenship (INS Form N-560 or N-561) Valid alien registration receipt card (I-551) Valid employment authorization card (I-688-A or I-688-B) Valid employment authorization document (I-766) Valid temporary resident card (I-688) Certificate of naturalization (INS Form N-550 or N-570) I-94 arrival & departure record (refugee) Out-of-country driver‟s license, with translation into English, if required (valid or expired) International driver‟s license (valid or expired) must be presented with the out-ofcountry driver‟s license U.S. government driver‟s license (includes military licenses)
Secondary Sources Selective service card Handgun permit with photograph or fingerprint Vehicle registration cared or title Voter registration card Document prepared by government agency, which contains the applicant‟s name and signature Utility or telephone bill (in applicant‟s name) Checking or savings account statement Life insurance card or policy (over 3 years old) Property tax bill or receipt Mortgage account or proof of home ownership Residential rental contract
A-1
Canceled check with imprinted name and address Marriage certificate Divorce decree Retail sales/financial institution sales agreement
Proof of Residence (two items are required) Please note: The resident’s address on the document must match the ad on your application. Selective service card Maryland vehicle registration card or title Voter registration card Utility, telephone, or cable TV bill Checking or savings account statement (bank or credit union) Life, car, health or home-owners insurance card, bill or policy (over 3 years old) Property tax bill or receipt Mortgage account or proof of home ownership Residential rental contract Canceled check with imprinted name and address First class mail from any government agency Major credit card bill Installment loan contract from a bank or other financial institution Sales tax or business license U.S. savings bond Residential service contract (for example TV repair, lawn service, exterminator contract) Court order of probation, order of parole or order of mandatory release W-2 form not more than 18 months old Pay check/stub with name and address U.S. mail with forwarding address label Investment statements Retirement plan statements Current transcript from an accredited college or university Signed tax return not more than 18 months old Mail, with post-marked envelope, from an accredited college or university
The MVA will accept certification from a parent, nursing homes, and homeless shelters under certain conditions from proof of residence. A post office box number may be used in conjunction with a resident‟s address if they are in the same zip code area. The use of a post office box or private mail drop is not permitted.
A-2
BIOMETRIC IDENTIFIERS
Some current proposals would require driver’s licenses or other identity cards to carry biometric data unique to the cardholder in a magnetic strip or computer chip. The most common biometric identifiers in use are:
FINGERPRINT SCAN: A person places one or more fingers onto a fingerprint
scanner and the system stores unique characteristics of the fingerprint (such as the endpoints and junctions of ridges, whorls, loops, and tilts) for later comparisons.
HAND GEOMETRY: These optical systems map key geometric features of the
topography of a hand from measurements such as a finger length, skin translucency, hand thickness, and palm shape. Live hand scans are compared against stored scans.
FACIAL RECOGNITION: These systems compare the characteristics of a live scan
of a face against a stored template of facial characteristics by means of video or digital cameras. They can use either spatial measurements, such as distances between the eyes and ears, or a method that evaluates the entire face.
EYE SCAN: An iris scan uses a video or digital camera to take a picture of the
structure and pattern of the eye‟s iris, which then is compared to a live iris-scan image obtained by looking into a reader. A retina scan measures the pattern of blood vessels along the retina (a nerve on the back of the yet), which is unique from person to person.
VOICE RECOGNITION: These systems extract specific, unique features from a
person‟s speech such as pitch, tone, cadence, and harmonic level and vibrations, and stores the features for later comparison with a live voice. Source: U.S. General Services Administration
WORKS CITED
1. AAMVA. Move Magazine. Summer 2002. www.aamva.net. 2. Baltimore County News. January 9, 2002. “Combating Identity Theft.” www.co.ba.md.us/p.cfm/news/legislative_agenda/identitytheft.cfm. 3. Biometrics Research. July 9, 2002. 4. Browning, Dan and Chris Graves. February 10, 2002. “A Marketplace of Ids; Identity Theft Has Become a Booming Criminal Enterprise, Damaging Personal Reputations and Threatening the Nation‟s Security. Law enforcement Can‟t Keep Up, and Everyone is Vulnerable.” Minneapolis Star Tribune. 5. Dateline NBC. October 26, 2002. “Buying a Brand-New Identity: How Easy Is It To Get a Valid ID with a Fake Name?” 6. Dworaczyk, Kellie. May 31, 2002. “Standardizing Driver‟s Licenses: Security, Privacy, and Other Issues.” House Research Organization: Texas House of Representatives. 7. Emling, Shelley. May 5, 2002. “Privacy Groups Balk at License Bills; States Would Issue „Smart‟ Driver‟s Cards.” The Atlanta Journal and Constitution. 8. Goheen, Pam. December 10, 2001. “DMV Tightens Requirements for Identification Documents.” Virginia DMV. www.dmv.stat.va.us. 9. Hayes, Heather. October 04, 1999. “Identity Theft.” FCW Media Group. www.fcw.com/civic/articles/1999. 10. Hibbert, Chris. June 25, 2001. SSN SAQ Addendum. www.cpsr.org/cpsr/privacy/ssn/SSN-addendum.html. 11. Identity Theft Resource Center. February 10, 2002. “The Uniform Driver‟s License as a National ID: Address by ACLU Director Barry Steinhardt to the American Association of Motor Vehicle Administrators.” www.idtheftcenter/org/html/national-id.htm. 12. Krebs, Brian. January 11, 2002. “W. Va. First With Facial Recognition for Drivers Licenses.” www.infowar.com/law/02/law_011102c_j.shtml.
WORKS CITED
13. Lewis, Linda. January 29, 2002. “Hardening the Security of Your Driver‟s License.” Tech TV. www.techtv.com/siliconspin/features/story/0,23008,3369987,00.html. 14. Maryand Motor Vehicle Administration. www.mva.state.md.us. 15. Minneapolis Star Tribune. March 2, 2002 “ID Theft; Take Precautions, Toughen Penalties.” 16. Muller, Nathan J. 1997. True Identity Fraud. www.networkusa.org/fingerprint/page3/fp-technology-nmuller.html. 17. O‟Harrow Jr., Robert. January 14, 2002. “States seek National ID Funds; Motor Vehicle Group Backs High-Tech Driver‟s Licenses.” The Baltimore Sun. 18. Peterson, Iver. April 3, 2002. “Hold That Pose: Driver‟s License Plan Slowed.” The New York Times. 19. Social Security Online. 2002. www.ssa-custhelp.ssa.gov. 20. Structure of Social Security Numbers. May 15, 2001. www.cpsr.org/cpsr/privacy/ssn.structure.html. 21. U.S. Birth Certificate Bureau.Com. 2001. www.usbirthcertificatbureau.com/faq.html. 22. Willox, Norman A. and Thomas M. Regan, ESQ. March 2002. “Identity Fraud: Providing A Solution.” LEXIS-NEXIS. www.lexisnexis.com/about/whitepaper/identityfraud.pdf.
A-3
CRIMES COMMITTED UTILZING IDENTITY FRAUD
1) APPLICATION FRAUD 2) BANKRUPTCY FRAUD 3) CELLULAR FRAUD 4) CHARITY FRAUD 5) CHECK FRAUD 6) COMMERCIAL LOAN FRAUD 7) COMPUTER FRAUD 8) CONFIDENCE FRAUD/CON GAMES 9) CONSUMER LOAN FRAUD 10) DRUG TRAFFICKING 11) ELECTION FRAUD 12) FOOD STAMP FRAUD 13) CAMING FRAUD 14) INSURANCE FRAUD/FALSE CLAIMS 15) INVESTORS FRAUD 16) MERCHANTS FRAUD 17) MONEY LAUNDERING 18) PYRAMID SCHEMES 19) REAL ESTATE – MORTGAGE FRAUD 20) SECURITIES FRAUD 21) SOCIAL SECURITY BENEFIT FRAUD 22) STUDENT LOAN FRAUD 23) TELEMARKETING 24) TERRORISM 25) WORKERS‟ COMPENSATION FRAUD 26) MEDICAL-HEALTH FRAUD
Source: Willox, Norman A. and Thomas M. Regan, ESQ. March 2002. “Identity Fraud: Providing A Solution.” LEXIS-NEXIS. www.lexisnexis.com/about/whitepaper/identityfraud.pdf.
PART I – EXAMING THE PROBLEM
1.0 Background A recent survey commissioned by the American Association of Motor Vehicles Administrators found that 77% of Americans favor modifying the current system of issuing driver‟s licenses and ID cards.1 Each state has its own system and standards for issuing driver‟s licenses, and each state decides the necessary provisions to prove identity and residency. According to the American Association of Motor Vehicles, these systems have resulted in more than 200 valid forms of identification. Although the Bush Administration opposes a national identification card, there is a call to standardize licenses and link databases throughout the nation. Supporters hope these measures will help make licensing system more secure, while opponents believe the standardizing will erode individual privacy. 2 1.1 Drivers’ Licenses-“Breeder Documents” Breeder documents are identification documents used as a means to obtain other forms of identification such as a driver‟s license. Breeder documents involve knowledge-based questions. Knowledge-based questions are those identified by demonstrating possession of unique information, which only the bearer of the documents would be expected to know3. Knowledge-based breeder documents such as birth certificates and Social Security numbers can aid criminals in obtaining fraudulent identification. Often, these breeder documents are forged or stolen themselves. Many states try to stop fraud by asking for SSN or original birth certificates. However, because the license system is not integrated with social security database, there is no way to determine the validity of numbers submitted by the applicants.
The following table provides the number of new and replacement Social Security cards issued in the past 3 years: Table 1. Number (in Millions) of New and Replacement Social Security Cards Issued (5)-FY 1994-1996 Issuance Method Original Cards Replacement Total FY Cards FO/OIO EAB 1994 3.3 2.9 9.9 16.1 1995 3.0 3.1 10.7 16.8 1996 2.5 3.1 10.3 15.9
1 2
AAMVA, www.aamva.net, July 22, 2002 Kellie Dworaczyk, House Research Organization, May 31, 2002. 3 Norman A. Willox and Thomas M. Regan, March 2002.
Birth certificates are issued by the state or county of birth of the applicants, and they are legal document confirming U.S. birth and citizenship. Birth certificates can be requested via websites on the Internet, such as on the United States Birth Certificate Bureau website. This site will process a birth certificate in one to three days for a cost of approximately $45. Although state laws regarding licensing may vary, parents or family members can request to obtain a certificate for a person in their family. In some cases, a photo ID does not even have to be provided by these applicants. It is also fairly easy to apply for a birth certificate and do the notarizing oneself. 4
Social Security cards are issued by the Social Security Administration (SSA). Established in 1935 by President Roosevelt, social security numbers were originally intended for use by the SSA only as an identification of recompense to maintain individual earnings. (Earlier printed cards read: not to be used for identification.) In 1943, President Roosevelt signed an executive order that required federal agencies to use Social Security numbers when creating new record keeping systems. Over the course of time, the identification number was used for much more than its initially intended purpose. In 1961, the IRS began to use the number as an ID for taxpayers. The Tax Reform Act of 1976 gave authority to state and local taxes, welfare, driver‟s license, and motor vehicle registration to use an individual‟s number for identification purposes. In recent years, the Social Security number has become a common identification number for everyday activities.5 Effective March 1, 2002, the Social Security Administration stated that they no longer would assign numbers when the sole reason for needing a SSN was to comply with state requirements for a driver‟s license.6
Many factors contribute to the easy use of breeder documents to obtain fraudulent identification. Unfortunately, people assume that Social Security numbers are unique. In truth, since the passage of the Immigration Reform Law in 1986, there has been an increase in the number of duplicated social security numbers among illegal immigrants who use the SSN as means of acquiring employment. In addition, older cards are not
4 5
US Birth Certificate Bureau, 2001. Structure of Social Security, May 15, 2001. 6 Social Security Online, 2002.
forgery resistant. Finally, it is fairly easy to give any random number if tangible proof is not needed.7
1.2 Criminal Activities-Legal Standards Presently the Identity Theft and Assumption Deterrence Act of 1998 states that “anyone who knowingly transfers or uses, without lawful authority, as a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a felony under any state or local law”. 8 In Maryland the theft of personal identity information is covered by two different statutes. Article 27, Section 231 covers “knowingly, willfully and with fraudulent intent obtaining personal identity information.”9 This includes names, addresses, social security numbers, telephone numbers and information. Under Article 27, the unlawful procurement of fraudulent information is a misdemeanor and holds only a maximum imprisonment of one year. Another statue in the Commercial Law Article 14, Section 1403, “prohibits a person from possessing with unlawful or fraudulent intent any credit card number or other payment device number.”10 1.3 Case Studies Consider the case of the woman of many identities. The Minneapolis Star Tribune reported that Sadeya Rodriguez, a 23-year old Minneapolis woman, disguised herself with many identities. Rodriguez sent information to a man in California to create a fake driver‟s license, and 104 counterfeit checks totaling $74,428.25. Rodriguez used the fake license in the name of Christine Marie Lopez. Under the guise of Christine Lopez, Rodriguez received phone service, and hooked up cable TV. Rodriguez also used a fake birth certificate to obtain identification from Arkansas and Nevada.11 In the case of Rodriguez only monetary damage resulted. However, the use of fraudulent identity can result in fatal consequences, as is seen with the case with Willis Curry. Curry, a truck driver, had accumulated more than 30 traffic violations in four states. Although he was a Maryland resident and had collected enough traffic violations for an automatic revocation, he managed to obtain a new license in the District of Columbia, effectively wiping out the record of his 10 years of bad driving. However, none of this information was known to state DMVs, ultimately resulting in the death of 17 year-old Benjamin Cooper. Cooper was killed when a dump truck, driven by Curry overturned on the car he was driving.12
7 8
SSN FAQ Addendum, June 25, 2001. Norman A. Willox and Thomas M. Regan, March 2002. 9 Baltimore County News, January 9, 2002. 10 Baltimore County News, January 9, 2002. 11 Dan Browning and Chris Graves, Minneapolis Star Tribune, February 10, 2002 12 Linda Lewis, January 29, 2002.
PART II – INTRODUCTION TO ALTERNATIVES The State of Maryland requires a driver‟s license applicant to present original documents or copies certified by the issuing agency when applying for identification. One must provide proof of age, name, identity, and two proofs of Maryland residence. Applicants born in the United States must provide a certified copy of their birth certificate. Those who are not born in the U.S. (who are not U.S. citizens) must provide MVA with a valid out-of-country passport with valid INS documents.13 Effective June 2002, the MVA no longer issued identification cards over the counter. Due to security issues surrounding the September 11th events, all regular identification cards were now mailed to the applicants. The MVA believes that this measure will curb the amount of fraudulent information that pass through the agency and verify applicants‟ addresses. If an individual provides the wrong information, such as name, street address, etc., the identification card will return to the MVA because a fraudulent mailing address was provided.14
PART III – ANAYLSIS OF EXSISTING STANDARDS: WHY IMPROVEMENTS ARE NECESSARY
3.0 Illegal activity At any one time there are probably millions of fake IDs in circulation in the United States. Identity fraud is used to obtain employment, to avoid child support fees, to take advantage of public benefits and to enter restricted areas. No one list could encompass all of its daily uses.15 Some of the illegal activity that occurs as a consequence of fraudulent identification includes: Illegal immigration In 1997, there were an estimated five million illegal immigrants living and working in the United States. To collect a paycheck, these workers must possess a source of identification, whether it is a birth certificate, a social security number or a driver‟s license. 16 Criminal fraud With fraudulent identification, criminals can open a bank account, apply for credit cards and collect welfare benefits.
13 14
MD MVA. MD MVA. 15 True Identity Fraud, 1997. 16 True Identity Fraud, 1997.
Underage drinking Studies show that 38% of teenagers between the ages of 16 to 20 in the United States have used a fake ID to buy alcohol or to gain access into a club. Terrorism 13 of the 19 September 11th hijackers carried fraudulent identification that allowed them to easily pass through the United States unnoticed.
3.1a
Easily Accessible Social Security Numbers
Many states try to combat identity fraud by asking for social security numbers or original birth certificates. However, because no integrated database system among state DMVs, the SSA and the birth certificate departments, there is no way to determine the validity of the breeder document. 3.1b Easily Accessible Birth and Death Records
There is no computerized integration between birth and death record departments. It is fairly simple to apply and/or obtain birth certificates by providing information fraudulently obtained from death certificates. 3.2 Non-Integrated Drivers’ License Databases
For decades, agencies have worked in tandem, often under legislative directives, to share information. Unfortunately, data is not transferred in a timely manner between agencies. Consider the typical traffic stop. After observing a speeding driver, an officer pulls the car over to the roadside. He tickets the driver, who, in turn, takes the case to court. A judge rules on the case, and the decision is sent to the driver's home DMV.17 At each stage, weeks and months have been lost in the manual collection, transfer and update of information.18 A similar plan was implemented in Canada in 1988. The Interprovincial Record Exchange was designed to ensure “one person, one driver‟s record”. In less than six seconds, the IRE enables any province to verify any Canadian license.19 3.3a Inefficient Department of Motor Vehicles
Employees in the DMV lack the training and skills to combat identity crimes. The authority to issue licenses must be delegated to qualified employees who possess the skills, training and experience necessary to assess the assortment of supporting
17 18
AAMVA, www.aamva.net, July 22, 2002 AAMVA, www. aamva.net, July 22, 2002 19 AAMVA, Move Magazine, Summer 2002.
documents submitted by applicants. Employee programs are lacking the training employees need to spot fraudulent individuals. 3.3b Insider DMV Fraud
DMV insider fraud also can lead to the proliferation of fake IDs. The unethical decisions made by the employees can lead to a break down of trust between an agency and the public. Consider the following: In California, an estimated 250 DMV employees have issued over 25,000 genuine looking, fraudulent licenses in a two year period between 1995-1997.20 In 1997, 79 clerks were fired at the Orange County Department of Motor Vehicles in California for accepting bribes for illegal driver‟s licenses. The state reported that clerk‟s at the CDMV accepted $1,000 in bribes to issue fraudulent ID‟s.21 According to New Jersey's attorney general, thousands of fake licenses and other IDs were created and sold illegally in the state in a scam that involved six DMV offices in New Jersey.22 Authorities say the system-recruited customers who could not legally obtain a license, illegal aliens among them. The so-called brokers offered the “customer” a menu of services, including people to take their written and driving tests in their place. According to officials, $2,000 got them a legitimate-looking illegal driver's license. In all, 36 were indicted, including eight now former DMV employees.23
PART IV – RECOMMENDATIONS TO REDUCE DRIVER’S LICENSE IDENTITY FRAUD CASES
4.0a Integrating DMV Databases Nationwide The Department of Motor Vehicles, as it currently exists, lacks the electronic real-time connection required to share driver history information with other states. This lack of a real-time connection indirectly creates an outlet for perpetrators to undermine the licensing system, and it allows them to commit such crimes as concealing pertinent driving history information.24 A proposed solution to this drawback of the existing system has been to create a full-scale database with cross-matching capabilities.
20 21
Orange County Register, 1997. Orange County Register, 1997. 22 Abclocal.com, June 24, 2002. 23 Abclocal.com, June 24, 2002. 24 Linda Lewis. January 29, 2002.
A broad motor vehicle network is a critical component of fraud detection because it allows for conference between state DMVs. Security features and databases of state licenses vary immensely, and this lack of uniformity creates problems for reporting and controlling driver and vehicle data. Interoperability between states will provide a medium for exchange of critical driving information such as accident reports, citations and inspections. For instance, if a traffic stop occurs on one coast of the United States, interoperability between systems could allow a state on the other coast to determine the validity of that driver‟s license by tapping into the network database.25 Providing a resource for conducting vehicle checks that span far beyond one jurisdiction is a principal way of keeping unsafe drivers and vehicles off the road. Maintaining driver security and eliminating the threat of criminal activity associated with fraudulent Ids are motivators for enhancing information exchanges. Cross-checking capabilities between system not only provide DMVs with the power to verify driver identity, but they also provide DMVs with the power and resources to operate more efficiently and to focus on fulfilling their primary missions. 4.0b Creating Integrated Databases with SSA, Birth and Death Records, and Law Enforcement Not only is there an evident need for integrating DMV databases nationwide, but there is also a need to create integrated databases with the Social Security Administration (SSA), the birth and death records departments and law enforcement officials. As of January 2002, 32 stated did not verify the validity of the Social Security numbers submitted by driver‟s license applicants.26 Because the license system is not integrated with the Social Security database, there are no available means by which to determine the validity of the Social Security Number offered by the applicant. Moreover, there is no computerized integration between birth and death records departments. Therefore, it is easy for an individual to obtain information from death records and use that information to obtain a birth certification. In addition, it is easy for an individual to apply for a birth certificate and execute his/her own notarization.27 An identity card, such as a driver‟s license, is only as good as the information that initially establishes the individual‟s identity. Breeder documents that are used to obtain driver‟s licenses, such as Social Security cards and birth certificates, can easily be forged, bought or stolen.28 However, the problem that exists with breeder documents can be minimized by creating a broad network of databases that links the SSA and birth and death records departments with state DMVs throughout the nation. Furthermore, information technology should provide links that extend beyond traditional motor vehicle limitations. DMV connections should extend to criminal justice divisions, allowing law enforcement officials to report and track driver information. For the past
25
26
AAMVA, Move Magazine, Summer 2002. Civic.com, October 04, 1999. 27 Civic.com, October 04, 1999. 28 Identity Theft Resource Center, February 10, 2002.
decade, New Jersey‟s Automated Traffic System (ATS) has linked more than 500 court systems with its DMV, allowing the DMV to update driver records from court rulings entered into ATS. Traffic and Criminal Software (TraCS), another technological initiative currently in progress in New York, manages paperwork pertaining to driving records so law enforcement officials can focus on handling police work.29 4.1a Create Driver’s Licenses with Biometric Features Biometrics, or “life measurements,”30 refers to the automatic identification of a person based on his/her physiological or behavioral characteristics. A biometrics system is essentially a pattern recognition system that produces a personal identification by determining the authenticity of a specific physiological or behavioral characteristic possessed by the user. Researchers prefer the application of this biometrics method in the place of traditional techniques that employ the use of passwords and PIN numbers, and they cite two main reasons to support their rationale. The primary reason for this preference is that the person who is being identified is required to be physically present at the point-of-identification, thereby ensuring positive identification results. The secondary reason cited is that identification based on biometric techniques obviates the need to remember a password or carry a token.31 Due to the increase usage of computers as mediums of information technology, it is necessary to restrict access to and create safeguards for sensitive/personal data. The utilization of biometric techniques can potentially prevent unauthorized access to or fraudulent use of ATMs, cellular phones, smart cards, desktop PCs, workstations and computer networks by simply replacing PIN numbers. PINs and passwords may be forgotten at any time, and token-based methods of identification, such as passports and driver‟s licenses, may be forged, stolen or lost. Therefore, various types of biometric systems are being employed for real-time identification, the most popular of which include face recognition and fingerprint matching.32 However, other biometric systems of use include iris and retinal scans, speech facial thermograms and hand geometry analysis.33 There are two different means by which a person‟s identity may be established: verification and identification. Verification involves confirming or denying a person‟s claimed identity. Identification involves the establishment of a person‟s identity, but it does not require an establishment of claimed identity. Each of these approaches offers its own set of complexities, which could possibly be solved best by implementing biometric techniques.34 Conventional methods of fingerprint representation present two major shortcomings that are resolved by advances in biometric technology. For a significant segment of
29 30
AAMVA, Move Magazine, Summer 2002. Civic.com, October 04, 1999. 31 Biometrics Research, July 9, 2002. 32 refer to appendix A-2 33 Biometrics Research, July 9, 2002. 34 Biometrics Research, July 9, 2002.
population, representations, which are based on explicit detection of complete ridge structures, in the fingerprint, are difficult to extract automatically. The widely used minutiae-based representation does not make use of a significant component of the rich discriminatory information available in the fingerprints. Local ridge structures cannot be completely characterized by minutiae. Furthermore, minutiae-based matching display difficulty in matching two fingerprints images containing a different number of unregistered minutiae points. User verification systems that use a single biometric indicator often have to contend with noisy sensor data, restricted degrees of freedom and unacceptable error rates. Attempting to improve the performance of individual matchers in such instances may prove to be ineffective because of these inherent problems. Multimodal biometric systems seek to alleviate some of these drawbacks by providing multiple evidences of the same identity. These systems also help achieve an increase in performance that may not be possible by using a single biometric indicator.35 Biometrics is a rapidly evolving technology that is widely used in the forensics arena and in the criminal identification process. It possesses the potential to be applied in a wide range of civilian matters. For the purposes of instituting effective security measures, biometric technologies offer a broad range of solutions that are gaining the recognition and endorsement of several states‟ DMVs. California, Texas, Colorado and Georgia all require their drivers to provide a thumbprint or fingerprint stamp upon requesting a new or renewed license. The State of Georgia instituted this measure approximately six years ago and has subsequently reported a decline in the number of fraudulently obtained licenses.36 Many licensing departments have also designed high-tech digital documents bearing security features such as holograms, digital photos, magnetic stripes and encryption. Washington State implemented the new digital license once fingerprinting techniques proved to be inadequate in reducing the number identity theft incidents in the state.37 Moreover, West Virginia is the first state to use facial recognition as a biometric identifier in its Department of Motor Vehicles by comparing digital mug shots of all applicants seeking new or renewal licenses to a database of more than two million other West Virginia DMV records on file.38 Initiatives to create more effective security measures in DMVs, such as the ones employed by the aforementioned states, are evidence of the actual applications of biometric technologies in the criminal identification process. 4.1b Create “Smart Card” Driver’s Licenses
35 36
Biometrics Research, July 9, 2002. Civic.com, October 04, 1999. 37 Civic.com, October 04, 1999. 38 Krebs, Brian, January 11, 2002.
More than 200 forms of state driver‟s licenses are currently in circulation in the United States.39 Of America‟s 228 million drivers, 87% use their licenses for purposes other than driving, which has effectively made the driver‟s license the “de facto” national ID card.40 Efforts to build a national identification system are currently being pursued in the United States by the American Association of Motor Vehicle Administrators and state motor vehicle agencies. Both parties are encouraging members of Congress to pass legislation that will standardize licensing procedures, link databases of driver information between states and mandate biometric techniques to “uniquely identify” American drivers.41 The driver‟s license is the best prospect for an expedient upgrade of the national ID system because the issuing offices, personnel, and much of the data needed for rapid enrollment are already in position. The new standardized license will make it easier for state agencies to track vital personal information about the card bearer, such as driving history, medical information and residential status. The new license will also require a verified Social Security number and will feature electronic storage of digitized personal data, including a biometric identifier, all part of a new centralized licensing system. 42 A standardized approach to licensing can allow time for careful background checks of applicants, can improve the existing system for issuing and tracking driver‟s licenses, and can enhance security measures in state DMVs and throughout the nation. 4.2a Train DMV Employees to Recognize Fraud Many states try to stop fraud by asking for additional pieces of identification, such as an original birth certificate and a social security number.43 Yet it is the responsibility of the DMV employee to certify the authenticity of these documents by inspecting each driver‟s license application with the utmost care and scrutiny. The authority to issue licenses must be delegated to qualified employees who possess the skills, training and experience necessary to assess the assortment of supporting documents submitted by applicants. For this reason, the State of Massachusetts is considering implementing special training programs to help DMV employees better detect counterfeit documents.44 These programs are practical investments for every state DMV because a concept as simple as employee training can potentially help DMVs to avert the cost of pricey technological solutions in the future. 4.2b Conduct Internal Investigations of DMV Employees A key mechanism to detecting fraud is conducting internal investigations of Department of Motor Vehicle employees. Low wages and unfavorable work conditions increase the incentive for dishonest and disgruntled DMV employees to sell fraudulent IDs. In order to crackdown on cases of insider fraud and insider bribery, Department of Motor Vehicle
39 40
Dan Browning and Chris Graves, Minneapolis Star Tribune, February 10, 2002. Shelley Emling, The Atlanta Constitution, May 5, 2002. 41 Robert O‟Harrow Jr., The Washington Post, January 14, 2002. 42 Shelley Emling, The Atlanta Constitution, May 5, 2002. 43 Civic.com, October 04, 1999. 44 Dateline NBC, October 26, 2002.
officials should conduct internal investigations of their employees on a regular basis, and they should perform systematic spot checks at DMV offices. 45 It is often necessary to question employee ethics because the lure of money holds tremendous swaying power. DMV employees in three states, Florida, South Carolina and Colorado, were cited in cases involving the sale of databases of digital driver‟s license photos to an imaging company in New Hampshire. Furthermore, in 1990, Virginia DMV employees were indicted for selling licenses to illegal immigrants.46 The State of New York recognized the need for internal investigations by installing new software that allows DMV supervisors to monitor the work of their employees.47 Although implementing some investigative strategies may prove to be excessive, the problem of insider fraud must not be dismissed. 13.3 Increase efforts to Police Wrongdoers
According to many law enforcement officials, the penalties faced by perpetrators of identity theft cases are generally powerless in the face of the mounting rate of identity fraud cases in the country. Based on figures projected by the federal government, roughly 700,000 people a year in the United States are victims of identity theft, or a rate of one victim every 45 seconds.48 Punishment for this crime is similar to the penalty for check forgery, rarely rising to the level of a serious penalty. In the State of Maryland, identity theft is covered by two separate statutes. A 27, Section 231 covers “knowingly, willfully and with fraudulent intent obtaining personal identity information,” such as names, social security numbers, addresses and telephone numbers. The Commercial Law Article-Section 14-1403, a separate statute, “prohibits a person from possessing with unlawful or fraudulent intent any credit card number or other payment device number.”49 A case involving the theft of less than $500 is designated misdemeanor status in the State of Maryland, while a case involving the theft of $500 or more is considered to be a felony in Maryland. Furthermore, in the State of Maryland, the potential jail time for identity theft cases has increased from one year to 18 months.50 Increasing efforts to police wrongdoers and modifying ID fraud laws to lead to longer sentences are necessary elements in the deterrence of future incidents of driver‟s license identity theft. More stringent laws must be passed in order to achieve this goal of deterrence, and therefore, harsher penalties for the crime of identity theft must be enforced in the State of Maryland. The state should initiate efforts to make the crime of driver‟s license identity theft a felony punishable by 15 years imprisonment, the current penalty standard for unlawful possession of a credit card number, and/or a fine to exceed $5,000.51
45 46
Dateline NBC, October 26, 2002. Identity Theft Resource Center, February 10, 2002. 47 Dateline NBC, October 26, 2002. 48 Dan Browning and Chris Graves, Minneapolis Star Tribune, February 10, 2002. 49 Baltimore County News, January 9, 2002. 50 Identity Theft Resource Center, February 10, 2002. 51 Baltimore County News, January 9, 2002.
In cases of driver‟s license identity fraud, it is important to ensure that the punishment fits the crime. However, under the current penalty system, the crime exceeds the punishment.
PART V -- COST-BENEFIT ANALYSIS OF RECOMMENDATIONS As with any potentially invasive new systems, it is important to balance the benefits and risks of the proposed solutions. The risks should be balanced out by a significant and clearly demonstrable benefit of reducing the number of identity fraud incidents. The factors bearing upon prospective solutions include: cost, management, effectiveness and social impact of the solutions. The parties affected most by potential institutional changes to the licensing system include those who advocate more stringent practices and those who advocate privacy right protections. The debate centers on issues of security, privacy, potential abuses and use of biometric identifiers.52 Proponents of increasing the security of driver‟s licenses by creating a national identification system believe that enhancing the current driver‟s license with embedded “smart card” features will alleviate the identity fraud problem. According to these advocates, including biometric identifiers on driver‟s licenses would increase confidence in the accuracy of the cards and decrease the possibilities for forgery.53 Critics of this proposal believe that the use of a national ID card, especially one that is linked with law enforcement agencies, would be an invasion of individual privacy by the government.54 The social consequences of a smart card include the creation of a surveillance society and the creation of new forms of discrimination. Although the current driver‟s license is, in essence, the “de facto” national ID, enhancing the driver‟s license with smart card technologies would result in constant monitoring of citizens‟ movements. The new driver‟s license would serve as an “internal passport” of sorts, and it would further the divide in the United States between citizens and foreigners, or noncitizens.55 If this proposal was enacted as law, the government could begin to compel people to produce the cards on demand, whether or not they were suspected of any wrongdoing. A national idea with embedded smart card biometrics would increase the incentive for dishonest DMV employees to sell fake IDs, and it would enhance the value of licenses on an already lucrative black market.56 Detractors of biometric solutions also point to the cost of installation, the absence of proof of effectiveness, and their potential use as means of aggregating personal information. Once information of this nature, such as spending habits and medical history, is lost, it would become virtually impossible to recover.57 Furthermore, it is not logical to build a national identification system on a faulty foundation. Breeder documents used to obtain licenses are still problematic, and therefore, a national license would not prevent criminals or from using fraudulent documents to obtain licenses. Enhanced state driver‟s licenses might establish identity, but they would not deter a person from committing criminal acts such as terrorism.
52 53
Kellie Dworaczyk, House Research Organization, May 31, 2002. Kellie Dworaczyk, House Research Organization, May 31, 2002. 54 Kellie Dworaczyk, House Research Organization, May 31, 2002. 55 Identity Theft Resource Center, February 10, 2002. 56 Identity Theft Resource Center, February 10, 2002. 57 Norman A. Willox and Thomas M. Regan, March 2002.
These new licenses would also not deter foreign nationals, who are in possession of a license, from overstaying their authorized immigration stay in the United States.58 Thus, such a licensing system would open the way to unwanted government scrutiny instead of targeting the areas of illegal activity that need to be examined the most.
PART V1 – FINAL RECOMMENDATIONS
Driver‟s license identity theft is often categorized as “the crime that keeps on giving, because victims are victimized and revictimized over and over and over again.” 59 Identity theft is often the impetus behind many cases of purse snatchings, home burglaries and car break-ins. This victimizing crime cripples a person‟s ability to regain a hold on the vital information that pertains to his or her identity. Once a person is victimized by identity theft, reestablishment of his or her identity proves to be extremely difficult because his or her reputation has been severely tarnished. Not only does identity theft result in a considerable loss of money, but it also results in a loss of personal security and comfort. It is now widely accepted that the terrorist attacks of September 11, 2001 were well orchestrated, well financed and highly motivated. Taking advantage of the ineffective and insecure identification systems in place in the United States, these individuals were able to mask their identities, their places of residence and their motives. Global criminal enterprises, like terrorist gangs and organizations, rely upon non-descript individuals to perpetrate their crimes, and an insecure licensing system is vulnerable to the misuses of such characters. Prior to September 11, the problem of identity imposters was viewed primarily as a financial matter, as a significant component of fraud. However, it was the events of September 11 that triggered society‟s awareness of the criminal use of false identifiers and false identification documents. The recent terrorist attacks on the United States show the need for an accurate, verifiable system of identification. Moreover, criminal use of false identifiers and false identification documents is an integral part of many crimes, even those as seemingly inconsequential as fake IDs used by minors. Exploiting weak or non-existent identity verification systems is not only the work of high-financed criminal organizations, but it is also the work of simple-minded criminals who fall through the cracks of the licensing system. State-issued driver‟s licenses, the most common form of identification, are used in daily activities such as boarding planes and renting cars. Therefore, any changes instituted to the current licensing system will indirectly affect other modes of transportation, such as highways and aviation. Nonetheless, no single policy change alone will be able to eliminate the number of identity theft incidents that occur in the State of Maryland. In
58 59
Kellie Dworaczyk, House Research Organization, May 31, 2002. Civic.com, October 04, 1999.
order to accomplish this aim, the State of Maryland needs to implement a combination of modifications to its current system of driver‟s license issuance. The goal of this paper is to assess the feasibility of developing new operational changes in the Department of Motor Vehicles that will reduce the number of identity fraud cases that occur in the State of Maryland each year. Thus, based on the cost-benefit analysis of the possible solutions presented in this paper, it is recommended that the State of Maryland institute low-tech steps to thwart ID theft, without having to resort to potentially invasive high-tech solutions. Of the proposed solutions, integrating DMV databases nationwide and integrating DMV databases with the SSA and birth and death certificate departments are endeavors that can only be achieved through the spirit of national cooperation. The State of Maryland should cooperate with other states in lobbying Congress to create a network of tightly linked databases of driver information. Attempts to improve information resource management within the DMV system will result in better maintenance of driver information. The problem of identity fraud will be alleviated through the use of computer technologies to enhance the ability of the DMV system to collect, manage and disseminate relevant data. Along with other state DMVs, the State of Maryland should lobby Congress to develop new information resource techniques and to upgrade existing practices and capabilities of the licensing system. Furthermore, it is the interest of the State to impose stricter penalties on those who commit identity fraud and on those who aid them in their crimes. This includes DMV employees who participate in fraudulent activities. By cracking down on insider fraud and by taking a firm stance on identity theft, the State of Maryland will be delivering a message of zero tolerance to perpetrators of the crime, whether or not they reside in the state. Until national measures to thwart identity theft are implemented, it is the task of the state to implement modifications in its own system. Therefore, frequent spot checks of the DMV, training programs for DMV employees and internal investigations of fraudulent activities are necessary to ensure that this goal is met. By instituting these strategies, the State of Maryland will heighten the security of its driver‟s licenses, while still adhering to privacy protection laws. At “face” value, these solutions may seem to be fairly simple concepts; however, the results they offer significantly aid in the efforts to reduce the number of stolen identity cases that occur as a result of fraudulently obtained identification.