What GAO Found

To verify license applicants' identity, all 50 states and the District of Columbia have procedures that may detect counterfeit documents. For example, all states are now verifying key personal information, such as Social Security numbers (SSN) through online queries to a Social Security Administration (SSA) database, a significant increase from about a decade ago. This effort helps ensure that the identity information presented belongs to a valid identity and also is not associated with a deceased person. Additionally, most states verify non-citizen applicants' immigration documents with the Department of Homeland Security (DHS) to ensure these individuals have lawful status in the United States. Many states are also using facial recognition techniques to better detect attempts to obtain a license under another's identity. While most states have taken steps required by the REAL ID Act of 2005 (Act), officials in some states indicated that they may not comply with certain provisions--such as re-verifying SSNs for license renewals--because of state laws or concerns that these requirements are unnecessary and burdensome.

State officials interviewed by GAO report that identity verification procedures have been effective at combating certain kinds of fraud, but vulnerabilities remain. Officials in most of the 11 states GAO contacted reported a decline in the use of counterfeit identity documents, and officials in states using facial recognition said they detected a number of identity theft attempts. However, criminals can still steal the identity of someone in one state and use it to get a license in another because states lack the capacity to consistently detect such cross-state fraud. A system for addressing such fraud would enable states to comply with the Act's prohibition against issuing licenses to individuals who already have a license from another state, but may not be fully operational until 2023. Furthermore, officials in many states said they have difficulties detecting forged birth certificates. Verifying date of birth is also required by the Act, and a system exists for doing so, but no licensing agencies are using it because of concerns about incomplete data, among other reasons. Partly because these two systems are not fully operational, GAO investigators were able to use counterfeit out-of-state drivers' licenses and birth certificates to fraudulently obtain licenses in three states.

By improving their respective verification systems, SSA and DHS have helped states enhance their identity verification procedures. For example, SSA has established timeliness goals for responding to state SSN queries and DHS has addressed data accuracy issues. DHS has also provided funding for states to develop new systems. However, DHS has not always provided timely, comprehensive, or proactive guidance to help states implement provisions of the Act related to identity verification. For example, DHS did not issue formal, written guidance in this area for more than 4 years after issuing final regulations, even though officials from most states GAO interviewed said they needed such guidance. Additionally, even though relevant national systems are not yet fully operational, DHS has no plans to promote certain alternatives states can use to comply with the Act's identity verification requirements and combat cross-state and birth certificate fraud. Officials in some states indicated they needed direction from DHS in this area.

Why GAO Did This Study

Obtaining a driver's license under another's identity can enable criminals to commit various crimes. The 9/11 terrorists, for example, possessed fraudulent licenses. The REAL ID Act sets minimum standards for states when verifying license applicants' identity, which go into effect in January 2013. If states do not meet these requirements, their licenses will not be accepted for official purposes such as boarding commercial aircraft. DHS is responsible for establishing how states may certify compliance and for determining compliance. SSA helps states verify SSNs. GAO was asked to examine (1) states' identity verification procedures for license applicants, (2) the procedures' effectiveness in addressing fraud, and (3) how federal agencies have helped states enhance procedures. GAO analyzed DHS and SSA data on states' use of verification systems; interviewed officials from DHS, SSA, and other organizations; and conducted on-site or phone interviews with licensing agency officials in 11 states. GAO tested state procedures in three states that have known vulnerabilities; results from these states are not generalizable.

What GAO Recommends

GAO recommends that DHS work with partners to take interim actions to help states address cross-state and birth certificate fraud. DHS did not concur with these recommendations, saying its ongoing efforts are sufficient. GAO has demonstrated that vulnerabilities remain as long as national systems are not yet fully operational. Therefore, GAO continues to believe additional DHS actions are needed.

For more information, contact Daniel Bertoni at (202) 512-7215 or bertonid@gao.gov.

Status Legend:

Review Pending-GAO has not yet assessed implementation status.

Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.

Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.

Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.

• Review Pending
• Open
• Closed - implemented
• Closed - not implemented

Recommendations for Executive Action

Recommendation: To enhance state driver licensing agencies' ability to combat driver's license fraud, consistent with the requirements of the REAL ID Act, and while national systems to detect cross-state and birth certificate fraud are being developed, the Secretary of Homeland Security should work with state, federal and other partners to develop and implement an interim strategy for addressing cross-state license fraud. Such a strategy could include, for example, expansion of American Association of Motor Vehicle Administrators (AAMVA's) photo sharing program or enhanced utilization of Social Security Online Verification (SSOLV) to identify SSNs that are queried multiple times by different states. This strategy should include plans for sharing best practices and ideas for alternative solutions among the states.

Agency Affected: Department of Homeland Security

Status: Open

Comments: DHS did not concur with this recommendation, noting that interim strategies for addressing cross-state fraud are not needed. The agency said it has informed states that existing systems and procedures may address these issues and meet regulatory requirements, and has provided grant funds to help states develop their own new solutions. DHS emphasized that states need the flexibility to adopt solutions that best fit their individual circumstances. GAO believes that DHS needs to assume a more proactive role in these areas--and that it is possible to do so without being overly prescriptive. State driver licensing agencies remain vulnerable to cross-state certificate fraud and existing systems and methods are not sufficient to address the vulnerabilities. Many state officials reported being confused about how to comply with certain REAL ID provisions, such as those related to cross-state certificate fraud, despite DHS' efforts to provide information through conferences and responses to individual state questions. DHS involvement in this area is also critical because establishing date of birth is a central part of the driver's license application process. To close this recommendation, GAO would need documentation of interim strategies/plans for helping state driver licensing agencies address cross-state license fraud, until national systems are fully operational.

Recommendation: To enhance state driver licensing agencies' ability to combat driver's license fraud, consistent with the requirements of the REAL ID Act, and while national systems to detect cross-state and birth certificate fraud are being developed, the Secretary of Homeland Security should work with states and other partners to develop and implement an interim strategy for addressing birth certificate fraud. Such a strategy could include, for example, coordination between driver licensing agencies and state vital records agencies to verify birth certificates for license applicants born in-state.

Agency Affected: Department of Homeland Security

Status: Open

Comments: DHS did not concur with this recommendation, noting that interim strategies for addressing birth certificate fraud are not needed. The agency said it has informed states that existing systems and procedures may address these issues and meet regulatory requirements, and has provided grant funds to help states develop their own new solutions. DHS emphasized that states need the flexibility to adopt solutions that best fit their individual circumstances. GAO believes that DHS needs to assume a more proactive role --and that it is possible to do so without being overly prescriptive. State driver licensing agencies remain vulnerable to cross-state and birth certificate fraud and existing systems and methods are not sufficient to address the vulnerabilities. Many state officials reported being confused about how to comply with certain REAL ID provisions, such as those related to cross-state and birth certificate fraud, despite DHS' efforts to provide information through conferences and responses to individual state questions. To close this recommendation, GAO would need documentation of interim strategies/plans for helping state driver licensing agencies address birth certificate fraud, until national systems are fully operational.