An Example to Follow: New York State’s Secure Document Measures

By Janice Kephart on December 15, 2008

New York State is a leader in assuring more stringent standards in identity verification at its Department of Motor Vehicles. Being at the forefront of taking seriously the 9/11 Commission recommendations regarding secure identification, for the past five years state authorities have worked to continually upgrade their license application process to enhance public safety and national security and reduce fraud. In fact, New York is one of the first states to have implemented the 9/11 Commission recommendation on secure IDs at the DMV level without congressional or administration prodding. Underlying the turmoil caused by former Gov. Eliot Spitzer’s proposal to issue licenses to illegal aliens was a pungent irony: the state already had many (if not all) issues pertaining to secure IDs right.

Hit harder than any other state on 9/11, New York quickly understood the value of verifying identity when issuing licenses. The state is also keenly aware of the importance of trade and traffic across its border with Canada. This is not to detract from the upgrades seen in other states, including: Washington State issuing the first Enhanced Driver’s License (EDL – used as a de facto border-crossing card) and instituting numerous new procedures to reduce fraud; North Carolina reversing its poor processing with central issuance; Montana creating one of the most secure IDs in the country; Alabama conducting criminal background checks on license applicants that uncover about 5,000 felons each year. However, with New York adding the EDL to its toolkit, as Washington State successfully did a year ago, it is using its identity verification and document authentication tools to assure that IDs are issued only to rightful applicants.

Such processes ensure that implementation of the EDL is based on the fundamental tenets of the 9/11 Commission and REAL ID. Core elements include central issuance of IDs, security background checks for employees issuing EDLs, and a series of biometric and document authentication techniques that verify the identities of applicants.

Social Security Matching. In 2003, the New York DMV did a cross-check of Social Security numbers (SSNs) provided by applicants for driver’s licenses and non-driver IDs against the Social Security Administration database as a first cut at eliminating fraud. The information from at least 600,000 license or ID card-holders did not jibe with SSA’s files. This practice was upheld by the New York Supreme Court, paving the way for other states to determine if they could eliminate waste and fraud the same way.

A couple of years later, North Carolina conducted a similar internal audit. The results showed 27,000 license and ID applicants used false SSNs, about half of whom were listed as deceased in SSA records.

Digital Photo-Matching Pilot. In 2008, New York conducted a digital photo-matching pilot of 1 million state-issued IDs or driver’s licenses to see if it was possible to determine whether individuals held multiple IDs in the state under different identities. The end goal: to see if New York could implement a one license per one driver rule for its own records – similar to the one driver/one license requirement in the REAL ID Act.

Of those records culled, 100 individuals had multiple licenses in the system. Law enforcement ended up arresting 35 individuals who had two or more valid IDs, with most of them also having valid Social Security numbers. However, the proverbial needles in the haystack were also found:

  • Public safety. One individual was on New York’s 100 Most Wanted list. Using his photo as a base for the investigation, DMV was able to determine the names he hid under and arrest him.
  • National security and identity theft. One individual had been naturalized under his given name, but was working under an alias at a nuclear medical facility, and had IDs for both identities. Initially, his name was found on a terrorist watchlist, but the digital photo showed the hit to be a false positive.
  • Fraud. One individual was a transvestite who had acquired valid IDs under both sexes. Then, while working full-time as a male nurse, she was collecting benefits as a disabled female – to the tune of over $100,000.

Driver’s License Issuance. New York uses a centralized issuance authority. It also requires applicants to provide six documents to verify identity and prove residency. New York places great emphasis on the forensics of document security, using image-scan technology to encrypt, review, and electronically maintain documents provided by applicants that cannot otherwise be authenticated, like birth certificates.

Birth Record Digitization

Birth and death record digitization is a 9/11 Commission recommendation. In New York State alone, there are more than 5,000 issuing authorities for birth records. New York City has made its birth records electronic, but the state has not yet followed suit.

Nationally, under the REAL ID Act, Kentucky is the lead state for birth record digitization, but at least five other states have digitized their birth and death records, resulting in a huge reduction in fraud related to health matters. DHS has made $4 million available through the REAL ID Vital Events Verification State Project Grant program for the systems to verify digitized birth records. The purpose is to allow states to electronically cross check birth information presented by applicants in one state with other states, to guard against identity theft and other fraud.

North Dakota was one of the first states to digitize its birth records, and initially used the new system to clean house in health benefits, finding that verifying identity through review of e-birth records reduced fraud significantly.

A list of those documents provided by the applicant is also keyed in, to cross-check documents provided at the application stage and if questions arise subsequently. Forensics experts are also on site at DMVs to review questionable documents. Passport authentication software is used to determine the validity of passports. (Massachusetts is one of a handful of states that also conduct such reviews.) Security features known to exist on documents are also scanned for anomalies.

New York’s identity verification process includes:

  • AAMVA support
    • Submission of driver information to the American Association of Motor Vehicle Administrators (AAMVA) driver point system to ensure bad drivers are not issued a license (all states do this)
  • Federal support
    • Social Security number verification through the Social Security Administration
    • For temporary licenses, verification of legal status through the Department of Homeland Security
  • New York support
    • Comparison of applicant information with New York State death records
    • Residency requirements

Even with its leadership in secure ID issuance, New York does not participate in three key pilot programs that also support more secure ID issuance and fall within the scope of both the 9/11 Commission recommendations and REAL ID:

  • Birth record digitization “hub” led by Kentucky (supported by $4 million DHS grant)
  • Digital Image Access and Exchange Program being led by AAMVA, whose stated purposes include:
      1. Improved customer service and support
      1. Enhanced public safety and security
      2. Reduced incidence of driver’s license fraud
      3. Building block to support upcoming Real ID Act mandates

Participating states in this program, funded by NHTSA through 9/5/09, are Missouri, Nevada, Arizona., D.C., Idaho, Kentucky, Massachusetts, Nebraska, New Mexico, North Dakota, Pennsylvania, South Dakota, Virginia and West Virginia.

  • One driver/one license “hub” pilot that is led by Mississippi ($17.5 million DHS grant) with pilot states of Florida, Indiana, Nevada, and Wisconsin ($1.2 million per state allocated to hub participation). These states are in discussion now to determine how to exchange information in order to attain proper results while assuring privacy.

Enhanced Driver’s License. In mid-September 2008, New York became only the second state (following the highly successful implementation in Washington State) to produce an Enhanced Driver’s License in addition to its standard variety of driver’s licenses and non-driver IDs. Remarkably, New York announced the launch of its EDL program less than a year ago.

The EDL is a win-win for both the state governments and consumers. Washington State and New York are finding the EDL is easy to use, easy to maintain, and eases traffic congestion on their northern borders with Canada because of its use as a de facto border-crossing card. Both states are also assuring that EDLs diminish fraud in DMV processing. For the consumer, the EDL’s multiple uses represent a convenience – not only for crossing to and from Canada but also as an ID to fly domestically, and as a traditional driver’s license. It is also a more-secure ID, with a chip that can relay data to a secure database – ensuring that the person presenting the ID is the same person denoted on the ID.

The EDL is only available to U.S. citizens. This new ID helps fulfill a 9/11 Commission border recommendation calling for all persons – including U.S. citizens – to produce a passport or “biometric equivalent” when entering the United States, with the understanding that identity is abused by many, including terrorists, and verifying identity is essential to border security. The EDL’s strength in New York is twofold: (1) the card itself is more secure than a standard driver’s license and (2) the identity verification and document authentication conducted before the card is issued uses some of the most cutting-edge technologies available to state governments today.

  • EDL card. The EDL card itself is made more secure by a number of features: (1) it is composed of a “sandwich” of well-secured material considered by some to be stronger and better than polycarbonate, the current industry standard; (2) it has a two-dimensional barcode (also called a matrix code or 2D barcode – with a matrix of pixels as opposed to the less-secure “1D” barcode with only vertical lines), that is compliant with the standards of both REAL ID and AAMVA; (3) its RFID chip mimics the U.S. passport’s RFID chip, with broadcasts simply a unique number that contains no personal information, to serve as a link to a secure database that can only be read by CBP agents.
  • EDL identity verification and document authentication. From the consumer standpoint, EDL vetting requires an additional New York State residency check. Conventional driver’s licenses in New York do not require residency. In addition, Social Security numbers are re-verified and extra scrutiny is given to all identification documents provided.

To be clear, the EDL is not a trusted-traveler card that attempts to verify both identity and potential derogatory information associated with that identity prior to issuance. Instead, it does a good job of identity verification upfront for those claiming to be U.S. citizens. From the standpoint of the 9/11 Commission recommendations, this is a marked improvement over the Western Hemisphere Travel Exception, which essentially enabled cross-border traffic by Americans without any identification at all.

Criminal Background Checks. One thing New York does not seem to be adding into its DMV application process is a criminal background check of applicants. Criminal background checks are conducted on those DMV employees issuing the EDLs (based on AAMVA hazmat rules), but that has not extended to the applicant pool.

Such checks have proven extraordinarily useful in Alabama, whose law enforcement personnel make about 5,000 arrests per year amongst DMV applicants. DMV inspectors are trained in fraud and conduct background and security checks on applicants. Reasons for law enforcement action include outstanding arrest warrants, criminal charges such as murder or escape, and expired green cards. Texas and Connecticut also do such checks. If New York is as concerned about security as it claims, perhaps it would find such checks of use as well.

Conclusion

New York remains on the cutting edge of secure ID issuance. Other states should consider the benefits of secure ID issuance for national security, public safety, and purging fraud. New York has taken the 9/11 Commission recommendations regarding secure IDs and secure borders seriously and created a strategy that not only talks about security, but seeks to embed it into the driver’s license application process.

Improving efficiency, security, and public safety, while reducing identity theft, are goals of the federal government as well as every state government. The Obama administration would do well to look to New York for an example of leadership in secure IDs, leadership spurred by the 9/11 Commission recommendations and the REAL ID Act.

-- Janice Kephart