Pennsylvania Legislature Gets One More Shot at REAL ID
Max Bluestein, November 8, 2016
Pennsylvanians are waking up to a huge mistake imposed on them by a totally misinformed legislator. Starting in 2011, State Senator Mike Folmer championed an anti-REAL ID bill which prohibited the state from complying with the REAL ID Act. In order to push the “REAL ID Nonparticipation Act” through, Folmer cited grossly inaccurate cost estimates, falsely called the standards a “national ID”, and ensured his colleagues in the state house that the federal government would never enforce the act. I testified against it, saying that “if this bill passes, the other states will leave Pennsylvania behind, along with Montana, Washington, and Oklahoma” (all of which are currently noncompliant). But, the misinformation campaign worked and the bill moved through the Senate unanimously and only received five votes against it in the House before it was signed by the governor.
Just a few years later, federal enforcement has already started and will only increase. The Pennsylvania Department of Transportation recently issued a release saying that Pennsylvanians now “need an alternative, secure form of identification to gain admittance to all federal facilities, military bases and nuclear power plants.” In another two years, they will need alternate identification to board airplanes.
Sen. Folmer has already created a disaster for military families who now can’t use their driver’s licenses to get on base and see their loved ones. An even bigger disaster is in store for Pennsylvania travelers, Pennsylvania tourists, and Pennsylvania commerce when the state’s driver’s licenses effectively become useless at airports in 2018. The tragic irony has become that by prohibiting the state from implementing and paying for the needed upgrades (despite already taking millions of federal dollars to do so), Sen. Folmer has forced his constituents to pay $110 out of their own pockets for U.S. passports, an actual national ID.
According to editorials from almost every major newspaper in the state, Pennsylvanians are starting to see the hole that this irresponsible legislator has dug them into.
Pittsburgh Post-Gazette: Get Real on Licenses: Start to Comply with REAL ID, for Citizens’ Sake
York Dispatch: Let’s Get REAL ID
Erie-Times News: Just Do It
Morning Call: Pennsylvania Playing Chicken with REAL ID
Express-Times: PA Needs to Clear Up ID Mess, Get Real
Reading Eagle: State’s Effort to Kill REAL ID Program Doesn’t Fly
But, it’s not too late. State Representative Ed Neilson has introduced two pieces of legislation that can help avoid this nightmare if passed and acted on immediately. House Bill 2433 repeals Sen. Folmer’s blanket prohibition of REAL ID compliance and House Resolution 1114 urges the state’s Department of Transportation to implement “all of the necessary and permissible security standards under the REAL ID Act.” Rep. Neilson understands the urgency Pennsylvania has and we hope his colleagues share the same prescience.
Pennsylvania should call a special session to comply with the REAL ID Act as soon as possible. Compliance not only avoids the travel nightmare at its airports, but it makes sense. REAL ID is a set of security standards designed in partnership with the states to prevent terrorists from using our identity documents as weapons again, as the 9/11 hijackers did. The standards also protect against fraud, identity theft, habitual drunk drivers, fugitives, and put in place safeguards that protect driver’s license holders’ privacy and data. Most states are surging forward with meeting the standards, leaving Pennsylvania and a dwindling handful of others in the dark. The Pennsylvania legislature needs to pass these two bills immediately and enable PenDOT to start the process of protecting its documents from criminals, terrorists, and enforcement at the airports.
The Truck Attack Threat: Renting a 26 foot Truck is as Easy as Sneaking into a Bar with a Fake ID
Max Bluestein, September 21, 2016
Trucks are a key terrorist tool for mass destruction. In 1995, Timothy McVeigh rented a 20 foot Ryder and packed it with 4,800 pounds of ammonium nitrate he exploded into a 30 foot crater under the Murrah building in Oklahoma City, taking 168 lives. Terrorists in Britain, Israel, Canada, and North Carolina have since followed suit, running vehicles over sidewalks and through barriers to barrel over the unsuspecting. In 2010, al-Qaeda called the truck, “the ultimate mowing machine… not to mow grass but mow down the enemies of Allah”. Mohamed Lahouaiej-Bouhlel took that to heart when, in July 2016, he walked into a rental company in France and said, “I want the biggest, most powerful vehicle you have”. He walked out with the keys to a 20-ton refrigerator truck he plowed through a national celebration in Nice, taking 86 lives, including Americans on vacation.
Could a similar truck attack happen here?
Absolutely. Since the Oklahoma City bombing, counter terrorism officials have been running through truck-borne terrorism situations over and over, including live scenarios in downtown Los Angeles, at Los Angeles International Airport, and the Port of Los Angeles. But they’re missing the key weapon terrorists are trained to use first in order to get behind the wheel of a truck - a fake ID.
McVeigh hand-made a counterfeit South Dakota driver’s license with a heated iron and a typewriter he used to rent his Ryder truck. But today, anyone with the internet and an address can order a high quality fake ID from China. If Bouhlel walked into a U-haul store in America this afternoon looking for a “mowing machine”, he would simply need to show a fake ID before he got to pick anything from a cargo van to a 26-foot behemoth with a 20,000 pound capacity.
Whether he is on a terror watch list, has warrants out for his arrest, or is simply trying to hide his identity, as instructed in the al-Qaeda and ISIS training manuals, all he would need to show is the ever-popular counterfeit Connecticut, the perpetually produced Pennsylvania, the dark web only Ohio, the unexpiring Arizona, or the always unfamiliar Maine. Or, it doesn’t even have to be from a state. According to the U-haul website, foreign driver’s licenses are also accepted for rentals. I don’t know how to verify a Yemeni driver’s license and I can guarantee the guy at the cash register doesn't either.
U-haul attendees make no effort to verify a driver’s license, they simply check the name and the date. How do I know this? I called up a U-haul store and asked them what system they use to verify licenses before renting a truck. I told them that my fictional friend is a privacy fanatic who needs to move but doesn’t want to hand over his information. The worker assured me that there is no scanning of licenses so I asked to speak to a supervisor to confirm. A customer service representative assured me that stores are instructed to simply look at the name and the expiration of a license before handing over the keys to a truck. Any truck.
My research points to a number of people actively using fake IDs to rent trucks. Following is an anonymous online post from July 8, 2016, just days before the Nice, France truck attack:
It’s not just kids renting U-haul trucks with fake IDs, it's criminals, too. In an incident also days before the France attack, a Brooklyn man with 20 suspensions on his license was arrested while trying to drive a U-haul truck in the no trucks lane through the Holland Tunnel in New York. According to the New York Daily News:
“A person must have a valid driver's license to lease a U-Haul truck, the company website says. But U-Haul officials said their system showed no one with Lewis' name with a current rental contract originating in New York. It is remained unclear how the man managed to get the truck.”
Duh. With a fake ID.
In another New York incident, a teenager was launched ten feet into the air and critically injured when a man driving a U-haul despite a suspended license slammed into the 17-year on his way to school. We rely on our driver’s licenses for so much in everyday life, yet many are so easy to counterfeit. It’s time that we all learn how important driver’s licenses are to our public safety and national security. It's time we make driver's licenses more counterfeit resistant, shut down counterfeit document mills, and use existing verification measures at truck rentals shops to stop criminals and terrorists from exploiting our identity documents before it's too late.
Insider Fraud: Is Your State's Driver's License for Sale?
Max Bluestein, September 15, 2016
A customer service representative at the Texas Department of Public Safety in Hondo, TX was sentenced to 18 months in federal prison this week for his role in doling out fraudulent driver’s licenses for a fee. Jose A. Ytuarte pleaded guilty to use of interstate communication facility in aid of unlawful activity, one of six counts he was charged with, by inputting fraudulent information into DPS computer systems in exchange for a $700 fee per transaction.
The alleged broker for these deals, Azeez Mistry, charged customers between $1,000 and $5,000 per fraudulent license. He would then meet with Ytuarte during the office lunch hour, when few employees were present, to exchange cash. Mistry faces sentencing on December 7.
When customers apply for a Texas driver’s license at a DPS location, they have to provide proof of citizenship. This is an important identity verification measure to protect against impostors and to keep driver’s licenses, an essential travel document, out of the hands of terrorists. However, Ytuarte was falsifying that these applicants were U.S. citizens in the DPS system without running the proper verifications in order to issue them valid driver’s licenses.
The scheme only unraveled when someone tipped off the Federal Bureau of Investigations, prompting a joint investigation between the FBI, the Texas Rangers, and the U.S. Customs and Border Protection Agency. However, fraud investigators in Texas have had a successful history of finding and prosecuting similar criminal schemes. In November 2015, another DPS employee confessed to selling $215,000 worth of Texas driver’s licenses. Linda Perez, now serving a two year prison sentence, exchanged money for her documents in a similar fashion as customers delivered cash tucked inside of paper lunch bags stuffed with food. Investigators estimate that Perez doled out 144 licenses, conservatively.
Officials haven’t been able to track down all the recipients of the fraudulent documents. This is a serious problem because a valid driver’s license is far more dangerous than a counterfeit one. Valid driver’s licenses will pass any visual inspection and will check out with any verification system. A fraudulent but valid identification document can only be uncovered through investigation. This means that any of the holders of these licenses can use the documents to open bank accounts, access secure locations, rent vehicles and hotel rooms, obtain credit cards, and board airplanes, just as the 9/11 attackers and ISIS terrorists have done, as well as countless common crooks and thieves.
Fraudulent driver’s licenses are a key tool for terrorists and are sought after and used by Hezbollah, al-Qaeda, ISIS, and more. Mistry’s attorney says that this case has no links to terrorists, but there is no way of knowing that until all the impostors using the fraudulent documents are tracked down. Worse, while Texas is on the forefront of fraud investigation, too many other states, namely Pennsylvania, have very weak processes and are much more vulnerable to insider fraud. How many impostors might be out there with valid Pennsylvania driver’s licenses? If you’re at DMV around lunch time and you’re in a state with weak processes, keep your eyes peeled!
REAL ID Rules and Voter Integrity when an Election is Contested
Brian Zimmer, November 2, 2016
In mid-October, 2016, WikiLeaks released a trove of emails to and from John Podesta, who is the campaign manager of Hilary Clinton’s pursuit of the Presidency. Secretary Clinton may well be the President elect in a week. In one email, dated February 4th, 2015, John Podesta addresses comments from an associate about registration drives aimed at immigrants who are not citizens. At that time, Hillary Clinton was only a candidate among several anticipating future primary contests. So the discussion was about primary victories, and the possible edge Hillary could derive from seeking immigrant votes by campaigning for a broader amnesty for illegal immigrants resident in the U.S. Podesta’s view in the email was supportive of this strategy:
email@example.com: I think Teddy’s idea scratches the itch, is pretty safe and uncomplicated. On the picture ID, the one thing I have thought of in that space is that if you show up on Election Day with a drivers license with a picture, attest that you are a citizen, you have a right to vote in Federal elections.
Commentators and pundits immediately pounced on this admission of deliberately recruiting ineligible people through registration drives. Somehow, this email was unnoticed by main stream television programs, excepting Fox News and Lou Dobbs’s show on Fox Business News (I’m sure you are shocked that it was ignored by MSNBC, CBS, CNN, and NBC).
John Podesta was correct in his assessment that it was very hard for election officials to challenge voters who are not citizens, but have already registered to vote. In the first place, there are tens of millions of legal immigrants in the U.S. for whom English is a second language. There are more than a million refugees admitted under semi-permanent status who have no English comprehension, whether written or spoken. Recruiting legal immigrants who are not citizens to vote was a “no brainer” for Podesta.
A November 1, 2015 report by the Center for Immigration Studies (CIS) shows that 1.5 million new immigrants (legal and illegal) settled in the country in 2014. The number who entered in 2014 represent an increase of 38 percent over 2011, resulting in a total of 43.3 million legal illegal immigrants resident in the United States at the end of the year. The number approximates 46 million on Election Day, November 8, 2016. That number is roughly half of approximately 90 million registered eligible citizen voters and is fertile grounds for election fraud.
So how can voting by ineligible noncitizens be prevented for future elections? First, states need to adopt REAL ID rules for driver’s license applicants, because those standards require applicants to provide either: (a) proof of citizenship or (b) proof of lawful presence in the form of a visa or immigration document. The standards also require REAL ID compliant states to record the proof of lawful presence in their record systems and capture images of the documents proving status for future reference. REAL ID rules are not fool proof because the law allows states to also issue “non-compliant” driver’s licenses to citizens or immigrants who want to opt out. So far, fewer than half of the 24 REAL ID compliant states allow “opt out” or issue non-compliant driver’s licenses to illegal immigrants.
In nearly all states, in order to register to vote it’s necessary to have either a driver’s license number or a Social Security Number, and sign a form that includes an oath that the information is correct and that you are a citizen of the United States. Election officials have to rely on that oath before the election, until Congress provides legal authorization. When a close election results are contested, DMV records in Real ID compliant states will make it much easier for election officials to confirm a person’s citizenship and the eligibility of voters. John Podesta has left us a written record of his strategy for victory. If the election is close, DMV records and non-partisan investigation may determine the result.
Only four states have laws that require even minimal proof of citizenship to register to vote: Kansas, Georgia, Arizona, and Alabama. In federal court decisions earlier this year, Arizona and Kansas were compelled to stop enforcing those laws based on judge perceptions of existing federal election laws. So until Congress acts to clearly authorize states to enact laws that require proof of citizenship, liberal judges are free to block proof of citizenship requirements. Once national election reform is completed to make citizenship proofs an option for states, states must exercise that constraint through enacting clear laws that penalize ineligible voting and set up filters to detect it when it occurs.
Can Whitey Bulger still use an alias to obtain driver's licenses in Massachusetts?
By Andrew Meehan, August 10, 2016
"As early as 1977, Whitey was already setting up fake identities for himself, taking the names of male infants who had died shortly after their births in 1929 and getting driver licenses in their names." Howie Carr, author of Hitman: The Untold Story of Johnny Martorano
Yes, but hopefully not for long. Massachusetts Governor Charlie Baker signed legislation this past July implementing the REAL ID standards. The law, coupled with planned upgrades to the Massachusetts Automated Licensing and Registration System (ALARS), should mitigate some of the fraud that has plagued the Massachusetts Registry of Motor Vehicles (RMV). Criminals, like Bulger, will find it much more difficult to hide their identities using fraudulently obtained Massachusetts driver's licenses.
The Massachusetts RMV is no stranger to fraud. Over the past several years, the RMV has been plagued by fraud ranging from employees selling licenses to illegal immigrants to systemic impostor fraud involving heroin smuggling, changes in management, and procurement challenges. All of which have limited the RMV from updating a 28 year old COBOL system to compensate for increased demand and savings. A July 2015 audit found that the RMV isn’t equipped to convert out-of-state licenses and is "consequently at an increased vulnerability for identity fraud."
The REAL ID standards, such as background checks on employees and verifying identity documents with the issuing agency, will it more difficult for criminals like Bulger to fraudulently obtain Massachusetts driver's licenses. Prior to Baker's Administration, little progress had been made on implementing the REAL ID standards in Massachusetts. Keeping IDentities Safe worked with members of the state legislature to highlight some of the vulnerabilities at the RMV in 2013. Tarr's letter was largely ignored by then-Governor Deval Patick's office. When Massachusetts did request an extension from DHS to meet the REAL ID requirements, DHS refused to grant the extension because the state had not demonstrated any real progress on meeting the standards.
Pressure began to mount. The Boston Globe featured a story in August that noted how a woman was unable to use her Massachusetts driver's license to enter a federal building in Washington, DC. Keeping IDentities Safe, then named, the Coalition for a Secure Driver's License, was quoted:
"Identity verification standards are 'extremely common sense,' said Andrew Meehan, policy director of Coalition for a Secure Driver's License, a Washington-based nonprofit. 'For states to not be doing them really puts residents [and] driver's license and ID card holders at risk."
The Boston Globe followed with an editorial:
"Yet as the US government prepares to fully enforce the law and create headaches for noncompliant states, Massachusetts needs to find a suitable solution for its residents, who need to be able to get on planes and visit federal buildings. (Only about one-third of Americans have valid passports.) The reality of REAL ID is closing in, and our state can’t put it off forever."
In its final attempt to request an extension from DHS, the RMV provided a schedule and timeline for how it would have to meet the REAL ID standards
"As the Registry begins the procurement process for a new license vendor and continues to modernize its licensing and registration system, the of the REAL ID Act are being incorporated into the framework of each project. Massachusetts is forecasting that full compliance may be with the completion of the licensing module of the modernization effort, currently scheduled for 2017/2018.
The Patrick Administration will file legislation to bring the state’s license expirations dates in line with those required under the REAL ID act in the coming weeks.
In addition to the licensing procurement and modernization projects, other ongoing efforts to bring Massachusetts into compliance with REAL ID include expanding and formalizing security training for frontline RMV employees, drafting new regulations and joining a 2016 effort to increase information sharing amongst states through the American Association of Motor Vehicle Administrators."
Additionally, the RMV committed to putting forth legislation that would close some of the vulnerabilities at the RMV and provide a pathway to REAL ID compliance. But, Governor Deval Patrick was leaving office and a new Governor, Charlie Baker, had won the election in 2014. Shortly thereafter, Governor Baker quickly made statements that he would be looking at the RMV's level of compliance with the REAL ID Act and working with DHS on meeting the REAL ID standards.
At the end of 2015, Governor Baker introduced legislation to bring the state into compliance with the REAL ID Act. The legislation authorized improvements to the licensing application and issuance process, including limiting the term of the license to an applicant's authorized period of stay. The Joint Transportation Committee did not consider the bill by the required deadline of May 2. As a result, the legislation was attached to a transportation spending bill which Governor Baker recently signed into law in July.
What does this mean for Massachusetts?
For the time being, Massachusetts is on the right track as far as providing the necessary reforms. The state will not be subject to REAL ID enforcement for at least the next year, meaning Massachusetts driver's license holders can still use their licenses to board airplanes and enter federal buildings. However, the state needs to update ALARS and enact the REAL ID driver's license standards which will require capable leadership and planning.
Does TSA know who is sitting next to you on the plane?
Brian Zimmer, August 3, 2016
Over the past five years, millions of fake IDs have been sold into the United States by overseas vendors through internet sites. College students and other underage youth are the primary customers for high quality, cheap fake IDs that can be used to enter age restricted events and clubs, and to purchase alcohol and tobacco products. More than two dozen websites offer counterfeit driver's licenses from nearly every state. Many liquor stores and bars use bar code scanning equipment to verify IDs and the ages of their patrons. However, nearly all of the fake ID vendors include encoded machine readable bar codes that scan the same data that is carried on valid driver’s licenses. Unless the liquor vendor uses sophisticated electronic scanners with software that can validate specialized security features that differentiate valid driver’s licenses, the fake IDs are virtually undetectable.
These fake IDs are widely available on the internet, ranging in price from $85 to $150 for a single order, however bulk pricing is available if you are purchasing with friends, enemies, or random people responding to your craigslist ad. Vendors accept all kinds of anonymous payment, ranging from Bitcoin to PayPal to cash cards. Most fake ID vendors send along duplicates in case one is confiscated. Customers can provide any biographic data and photo they choose and the IDs arrive expediently at their chosen mailbox, usually hidden in packages with cheap toys or games.
The fake ID issue is not limited to underage drinking. Many criminals avail themselves of this marketplace, and some of the recent ISIS attacks in Europe employed fake driver’s licenses and passports. Like other businesses, the fake ID market comes with user reviews. Many satisfied customers post about the quality of the IDs on individual vendor sites. Several such testimonials have boasted of using fake IDs to pass through security check points at the airport.
We at Keeping IDentities Safe have been talking about the law enforcement and homeland security risks attendant to the fake ID market, but not seen a coherent response from federal authorities or from Congress.
In 2012, USA Today featured a front page story on the issue:
Overseas forgers from as far away as China are shipping fake driver's license and other IDs to the United States that can bypass even the newest electronic digital security systems, according to document security experts... Brian Zimmer, president of the Coalition for a Secure Driver's License, said the ease with which people can get fake documents is alarming. "If the ID buyers are terrorists, the list of protected targets they can now access is a Homeland Security nightmare," he said.
Last year, we wrote about the danger these IDs pose to identity theft and fraud:
They are sought after by identity thieves, habitual drunk drivers, convicted felons seeking guns and even terrorists. To make matters worse, these Chinese companies also victimize the customers, harvesting their pictures and personal data and selling it to identity thieves.
And, we wrote about the danger that these fake IDs pose to aviation security:
Over the last several years, a new Chinese export has found a thriving market in United States: high quality, machine readable, counterfeit driver’s licenses. For prices between $50 and $300, under-aged youngsters have been purchasing counterfeit licenses from vendors based in China via the web... However, TSA has not significantly upgraded in technology to physically authenticate the security features of identity and travel documents used to board an airplane. Given the number of types of state driver’s licenses, and the time spent reviewing these IDs when submitted with a boarding pass, it is obvious how these fake IDs pose a serious risk to aviation security.
We even argued for a national strategy for fake IDs because so much of how the federal government conducts its business relies on the integrity of identity documents, such as driver's licenses:
With false documents so easy to obtain and so highly coveted by terrorists, it’s crucial that this country has a national strategy to combat fake IDs. That strategy should include a method of shutting down fake ID vendors outside of U.S. law enforcement jurisdiction, particularly in China.
I recently attended the 2016 Aspen Security Forum and posed a question to TSA Administrator Peter Neffenger:
BRIAN ZIMMER, PRESIDENT of KEEPING IDENTITIES SAFE: I presume that you are
monitoring the dark net in regard to counterfeit IDs. If so, does it concern you that more and
more counterfeit ID vendors are featuring testimonials of people who have successfully gone
through TSA using counterfeit IDs?
PETER NEFFENGER, ADMINISTRATOR of the TRANSPORTATION SECURITY
ADMINISTRATION: Actually that is a good point. One of the challenges that we face
in aviation security... is ensuring that the individual who presents themselves is in fact
the person they claim to be. That's a lot more challenging than one might think, at times.
So an ID is one component of that. Another component of that is other verifications that
happen as your name gets... So when you make a reservation for a flight now, you go
into something called the Secure Flight system and that is a system that bounces your
name against databases of interest. So that's one way in which we begin to look to see
if this is a name of some concern. Ideally then when you present yourself, you present
an ID that we try to validate as a real ID, as a valid ID and we try to connect that to the
individual. The challenge right now is that we currently do not have all the systems in place to
verify the validity of that ID. We've been working very closely with the FBI, with vendors...to
begin to think about how you, how do you actually ensure yourself that this ID is not a counterfeit and the like. We're getting much better at that and we've got some pilot systems out there that do that. But it has to be part of a larger system. It doesn't stand by itself. As you know, many of you are used to walking up to the guy who scribbles all over your boarding pass, and he holds your ID underneath an ultraviolet light. That is not the most effective way of determining whether or not somebody's ID is valid. So we have to-- we are working on additional things. We are actually working very closely with some of the airlines themselves because if you think about it they have got those kiosks everywhere that read IDs, CBP does that, and I think that, what I hope to see over the coming months is a dramatic improvement in our ability to validate, because you point up a very real concern. It's the number one issue. You want to find out that the person who presents them self is in fact that person so you can determine whether or not they are somebody of interest or concern.
In our view, it’s of small comfort that Mr. Neffenger agrees with us that: "It's the number one issue." However, as we noted, fake IDs and the ability to discern which IDs are valid and which are counterfeit is not a new issue. To be fair, this was an issue that Mr. Neffenger inherited from previous administrations. Nonetheless, TSA needs a defined strategy to authenticate identity documents submitted at the security checkpoints, even if the process will require more than one pilot effort. The sooner the better.
The issue is not going to go away. The number of vendors and available types of fake IDs is only growing. Without a proactive approach, TSA really doesn't know who is sitting next to you on your next flight.
TSA Hints at What REAL ID Airport Enforcement Will Look Like in January, 2018
Andrew Meehan, November 29, 2016
A Federal Register announcement on November 11th provides insight into how the Transportation Security Administration (TSA) will treat travelers who present driver’s licenses from non-REAL ID states beginning in January, 2018.
The 2005 REAL ID Act prohibits federal agencies from accepting driver’s licenses for identification purposes that do not meet standards set by the Department of Homeland Security (DHS). The REAL ID standards, published in 2008, aim to prevent terrorists and criminals from fraudulently obtaining a driver’s license under an assumed or fictitious identity. For more information about the REAL ID Act and standards please click here.
Today, REAL ID enforcement is occurring at all secure federal facilities and military installations that require identification for entry. Military bases across the country have announce when each would stop accepting driver’s licenses from states that do not meet the REAL ID standards. DHS provided early notice when it published an enforcement schedule in December 2013 outlining when enforcement would begin. Federal facility and military base announcements regarding enforcement have been consistent with that schedule. Since the federal government started enforcing the REAL ID Act, many states have moved forward with commitments to comply and actual implementation. This year, Louisiana, New Hampshire, Illinois, Idaho, New Mexico and Massachusetts all enacted legislation that allowed their respective states to implement the REAL ID standards.
Enforcement at the airports
However, one of the biggest questions regarding REAL ID enforcement at the airports is how the process would work for travelers who present non-compliant driver’s licenses. How will TSA confirm the identity of the traveler and allow that person to continue to travel? Will TSA segregate those travelers from the general population of travelers?
TSA’s announcement provies some insight into one of those questions: how TSA will confirm the identity of travelers who present noncompliant IDs. Travelers who present driver’s licenses from noncompliant states will be treated as presenting no IDs at all.
How would the process work? We don’t have all the details yet, however, it’s likely the following would occur.
A traveler presents a driver’s license from a state that is not compliant or does not have an extension to meet the REAL ID standards to a TSA officer at the screening checkpoint before entering the gate.
The TSA officer refers the traveler to a separate area of the screening area to complete the Certification of Identity form (Form 415) that requires the traveler’s name and address and the affirmative declaration that the form is a true description of identity.
After completing the form, the traveler is connected with TSA’s Identity Verification Call Center, which, using commercial and government databases, generates a series of questions to verify the individual’s identity, a process known as knowledge based authentication.
Once the traveler’s identity is confirmed and matched to the boarding pass presented, the traveler will be able to pass through the screening checkpoint. TSA estimates that it will take three minutes to complete the form.
Impact on the noncompliant states
The impact on the states that have not complied with the REAL ID standards nor received an extension to do so will likely be significant. TSA may be able to ameliorate some of these issues with dedicated space at the airport to complete the ID verification process, signage and messaging to prepare confused travelers. However, it’s much more likely that space constraints at the airport and confusion by the traveling public will result in long lines and delays in air travel in non-compliant states. Airline hub terminals in non-compliant states like St. Louis, Missouri and Philadelphia, Pennsylvania are likely to face major passenger congestion if their states continue to be non-compliant.
How Fake IDs Relate to National Security
Max Bluestein, April 7, 2017
A brief history of fake IDs and national security:
Counterfeit driver’s licenses have been a national security threat since Timothy McVeigh hand-made a South Dakota license with a heated iron and typewriter and used it to rent the Ryder truck he detonated in Oklahoma City in 1995. Foreign terrorist organizations have been using them since at least 2000, when the al-Qaeda training manual proscribing their use was first uncovered, Under the chapter, Counterfeit Currency and Forged Documents, the manual advises that, “all documents of the undercover brother, such as identity cards and passport, should be falsified.”
This advice was followed by the 9/11 hijackers, who used over 30 different fraudulent IDs between 18 terrorists to open bank accounts, obtain credit cards, hide from law enforcement, enroll in flight schools, and board the aircraft that took 3,000 lives. The ensuing investigation led the 9/11 Commission to write that, "for terrorists, travel documents are as important as weapons."
Almost 20 years later, little has been done to close that vulnerability. A slew of recent al-Qaeda, lone wolf, and Hezbollah terror attacks and plots have also relied on fake IDs. Hosam Smadi was operating with a fraudulent ID when he was arrested for his plot to blow up a tower in Dallas, Texas in 2009. In 2011, Khalid Ali-M Aldawsari wrote that obtaining fake IDs were “important steps” in his plot to detonate weapons of mass destruction across the U.S. and raise his own al-Qaeda cells. The 2012 Burgas bus bombers used counterfeit Michigan driver’s licenses made in a Hezbollah factory for at least five years while renting cars and hotels in Bulgaria to prepare their attack. The 2013 Boston Marathon bombers had a reading list full of ID counterfeiting guides.
Today's terror threat has somewhat shifted toward Islamic State, or ISIS, which has orchestrated bombings and violent attacks all over the world in just the few short years it has been active. Their successful attacks in Europe that claimed hundreds of lives have not satisfied their desire to "raise black flag over White House" and, after attacking Texas in 2015, the terror group specifically pointed to California, Virginia, Maryland, Illinois, and Michigan as next targets. Omar Mateen, the terrorist responsible for the mass murder of 49 nightclub goers in Orlando in 2016, pledged his allegiance to ISIS shortly before his attack.
Though their ideologies slightly diverge, ISIS has picked up al-Qaeda's tactics. In ISIS's 2015 handbook, How to Survive in the West, ISIS essentially reissued the al-Qaeda fake ID guidance:
“Changing your identity is important because you will come across different people in this struggle; you want to hide your true identity from people who don’t know you so no-one in your Secret Agent life can ever describe you accurately if they ever got caught. Identity change is so important that everything about you – your: (Alias name, Physical look, Voice, Meeting places, and even phone number.) Are different to your real ones.
This makes it extremely difficult for intelligence agencies to know who you really are if you always take security precautions before every meeting.
If you can find people who can fake ID cards, that would be even better (and this may be possible if you can have contact with people in the dark underworld)... Rent cars under fake identity papers and install bombs in them and set off the car bombs near Synagogues, near governmental or police buildings, near gas pipelines or near those who are harming the Muslims.”
The 2015 Paris and 2016 Brussels attackers that claimed over 160 lives followed the ISIS guidance exactly. The logistics chief for the Paris attacks provided fake Belgium ID cards for the bombmaker and architect. The ensuing investigation found the fake IDs sourced from a “factory” based in Belgium. They were used to rent houses, cross borders, and wire money under false identities to evade detection by authorities. The Brussels metro station bomber also had an ID from the same factory, his in the name of a famous soccer player.
In the past, fake IDs were of extremely low quality, made in small batches in dorm rooms or Kinko's copy shops and sold on street corners. IDChief changed all of that. Operating in China, far out of reach from U.S. law enforcement jurisdictions and under its own laws, IDChief set a new model for high quality fake IDs produced in mass quantities. It operated a website, displaying all of its prices and 22 different state ID options publicly. It had Facebook, Twitter, and YouTube pages pushing out its products and its "customer service reps" on campuses furthered that outreach. Online ordering was made incredibly easy and efficient as customers only needed the internet and an address. They would fill in any biographic information they chose, attach a picture, wire money, and within two weeks, the customer had a fake ID at his or her doorstep, hidden inside a package of cheap trinkets or toys to evade customs detection. The prices ranged from $75 to $150 dollars, including a duplicate. They were even cheaper if the customer was a “middle-man”, ordering in bulk and distributing to others. Perhaps most alarmingly, IDChief counterfeits were of higher quality than many ID checkers across the country had ever seen, containing near-perfect emulations of all the security features and the ability to provide corresponding information if scanned. IDChief achieved a meteoric rise and by 2012, according to one law enforcement source, its products made up 75% of fake IDs in California.
IDChief's popularity may have been its downfall. Later that year, four U.S. Senators sent a letter to the Chinese ambassador citing the website as a threat to our national security and demanded it be shut down. Days later, it was no longer operating.
But the absence of IDChief and its new market left a huge vacuum for fake ID vendors. Dozens of new sellers have since taken its place over the last few years, many also operating in China. Most notably is IDgod, a China-based document mill that likely has some of the same operators from IDChief. Its model, its pricing, and its website are almost exact copies. IDChief specialized in the Pennsylvania license, whereas IDGod's most popular product is a Connecticut counterfeit with a near-prefect copy of the Charter Oak watermark. These Connecticut counterfeits became so popular that Giant grocery stores in Maryland stopped accepting any IDs from Connecticut. Other popular vendors also arose, including Ted Danzig, which operates exclusively on the darknet and only produces high quality Ohio IDs. King of Fakes, King Forge, New-ids, are among the many, many others. One can also find more vendors on Craigs List, Youtube, and Instagram with cursory searches. The quality of these IDs has gotten only increased since IDChief, some vendors effectively emulating high-end security features such as laser engraving and perforation. For example, Maryland unveiled its new license on May 9, 2016 displaying a slew of new security features. Within the week, counterfeiters were already claiming they could copy it. The most commonly counterfeited states are Maryland, Illinois, Pennsylvania, Connecticut, and California – Pennsylvania probably being the most common. Fifteen of the 44 biggest fake ID makers worldwide are actively selling high quality counterfeit Pennsylvania documents. Those vendors, both domestic and foreign, sell Pennsylvania driver's licenses and IDs at prices ranging from $60 to $135 through websites both on the clearnet and darknet or via secure email servers. Almost all are "scannable" and many include an emulation of the latest raised keystone tactile security feature embedded in the PA license, making them indistinguishable from genuine documents to anyone but the expertly trained eye. Due to weak security features and local printing variances in genuine documents, Pennsylvania IDs are currently among the most counterfeited U.S. identity documents in the world.
Fake ID customer:
The vast majority of the fake ID market is made up of underage kids trying to buy alcohol until they turn 21. However, my research has shown many other customers seeking IDs for more nefarious purposes. Below are just a few select excerpts of anonymous internet testimonials on fake ID use:
To purchase marijuana.
“Idgods Mississippi worked at all 7 weed dispensaries in Colorado! The age to buy recreational marijuana in Colorado is 21. Idgods Mississippi worked flawlessly at every dispensary we visited, even passed 3 different scanners that they used. Props to idgod!”
To rent guns.
“Using a fake at a shooting range?...you have to be at least 21 to rent a gun and since I don't have one, I'd have to rent. Does anyone know anything about how strict these places are or have any recommendations?
To ride Amtrak.
“The two times I went (on Amtrak) with a fake, they just glanced it over to confirm info. You should be fine as long as it didn’t look obviously fake.”
“For reasons I’d rather not get into, i’ve used one for an Amtrak train trip for both ways. The tellers seem to just glance it over to confirm names.”
To book hotels.
“I’m in my 30s and need an ID with a name other than my own to be used in virtually any circumstance. I would use it for hotels, clubs, casinos, shows, when using a credit card, etc. Would be nice to use for rental car too”
“I work for a hotel and can confidently say as long as the name on the id matches the name on the credit card - you’re in.”
To rent houses.
"Going to attempt to rent a house in WI in a couple months and was wondering if anybody has had any luck with renting anything, houses, cabins, hotels, etc… I am going to be using a Mr. Rep IL btw."
To rent cars.
“Rented a car with a fake ID, drove it like 1000 miles, dumped it in a parking lot.”
To rent Trucks. (This use of fake IDs is particularly troubling, given the rise of trucks as a predominant terrorist weapon. 2010 al-Qaeda guidance advised operatives to use a “truck as a mowing machine, not to mow grass but mow down the enemies of Allah". The 2016 Nice, France attack involved a terrorist plowing a rented truck through a Bastille Day celebration, taking 86 lives. There was another truck attack in Berlin later that year and one in Stockholm already in 2017, not counting the SUV attack in London. Here in the U.S., we face an extreme vulnerability to this as anyone can rent a 26 foot truck with a 20,000 pound capacity using a fake ID.)
“i work at Uhaul in Georgia, when someone hands me the ID , all we do is put in the license number, make sure its not expired.”
To pass through TSA checkpoints.
“LOL @ TSA: Just saw the worst IL i’ve ever seen pass at the checkpoint. Didn’t even scan or UV my drivers license. God bless America.”
“There’s a story on here once every couple months that someone [used a fake ID at TSA] and it worked fine. As long as you have UV.”
“Captain Krunk ID Review: My Colorado [fake] id got me thru Colorado Springs TSA airport security, and I don’t mean in my wallet, as my main form of id.”
“I accidentally gave TSA my fake WA instead of my real one.... It was ok”
For other nefarious purposes.
“can anyone travel with high quality fake EU ID within Europe? Anybody tried it before and what are the risks?”
“Unfamiliar with USA drivers licenses and have some questions… I was looking at a Connecticut ID. Thanks and sorry for my extreme lack of knowledge, I know nothing about real US IDs”
“Hello Friends..! I need USA National ID card or Lisence card or Utility bill for the verification of my account. Anyone help me..”
Atlantis Fakes: How much are you offering?”
Idgod: “have been getting some orders from Iraq and Kuwait we will NOT ship there your order will be deleted and money if paid with bitcoins refunded if paid with western union untouched!”
We need a national strategy to combat fake IDs and thwart the epidemic. This strategy must involve shutting down document mills, cooperating with foreign governments when necessary, to reduce the global supply. Upgrading the physical security features of driver’s licenses to make sure our documents are always at least one step ahead of the counterfeiters. Enforcing the REAL ID Act to mitigate against fraud at the DMVs and keep weaker licenses from being used to board our airplanes. Attacking the market for fake IDs by educating youth, the vast majority of customers, on the dangers and penalties of fake IDs. And finally, by stronger enforcement of fake ID laws already on the books. Too often, fake ID related crimes are treated with a slap on the wrist, which blunts any potential deterrent effect. Without a clear line of attack on fake IDs, we’ll never know who is on our planes, trains, highways, banks, and secure buildings.
It’s Way Too Easy for Terrorists to Trick TSA
By Max Bluestein, August 6, 2016
It is absolutely essential to our homeland security that authorities know who is getting on our airplanes. However, thanks to the flood of high quality fake IDs coming in from China, that task has become harder than ever. For as cheap as $50, anybody from anywhere with internet and an address can order a nearly undetectable fake ID from dozens of states delivered to their doorstep from overseas. These IDs are being used by kids to fool TSA just for fun. What happens when they fall into the wrong hands?
Fake IDs have been in the wrong hands before. The 9/11 hijackers had over 30 different IDs between 18 terrorists and, according to the 9/11 Commission, used these IDs as weapons. Khalid ali-M Aldawsari, convicted of a plot to use WMDs in New York during rush hour, listed obtaining fake IDs as his “next important steps” before he was arrested by the FBI. Hezbollah operatives used counterfeit Michigan driver’s licenses to rent cars, hotels, and hide from police before detonating bombs on a tour bus in Bulgaria. The Boston Marathon Bomber mastermind had a reading list full of guides on ID counterfeiting. Most recently, the ISIS terrorists who attacked both Paris and Brussels used fake IDs to cross borders, wire money, and rent hotel rooms, including a safe house where the bombs were made.
It is far too easy for terrorists to use fake IDs as weapons again. The vast online counterfeit ID market, both on the public internet and the darkweb, has made frighteningly good fake IDs expediently available to criminals and terrorists worldwide. Most of these are being sold by counterfeiters based in China, who constantly ship massive quantities of our state IDs hidden in packages full of cheap trinkets and toys.
How are these IDs being used? According to my research, the vast majority of counterfeits are being used by underage minors looking to get into bars and drink, which presents significant public safety risks, and some use them to buy marijuana. Some are using fake IDs to buy fireworks. But others are using them for far more nefarious purposes. Some are using them to rent cars, hotel rooms, and board trains, like the al-Qaeda and ISIS training manuals advise. One Brooklyn man used a fake ID to buy a gun he planned to murder NYPD officers with. Many are using fake IDs to board airplanes, just like the 9/11 hijackers did.
Following are recent quotes posted on anonymous internet forums:
“I'm flying home from school after finals, and my genius self forgets both my real ID as well as my passport in my room. Of course, I don't realize this until I've checked my bags, and I'm boarding in half an hour. However, I still have my God CT (this is by no means an advertisement, and meant simply as an "I'm a #$%# joke" story). Weighing my options of missing my flight or possible prison time/felony record, I wisely chose the latter. Turns out, it worked, and I am currently standing on the other side of airport security.”
“LOL @ TSA: Just saw the worst IL I’ve ever seen pass at the checkpoint. Didn’t even scan or UV my drivers license. God bless America.”
“Captain Krunk ID Review: My Colorado [fake] id got me thru Colorado Springs TSA airport security, and I don’t mean in my wallet, as my main form of id.”
“I accidentally gave TSA my fake WA instead of my real one.... it was ok”
These posts seem like they are from harmless kids experimenting with their high quality fake IDs, but there is absolutely nothing stopping terrorists from doing the same thing. Furthermore, my research shows that fake ID vendors are constantly getting orders from countries in the Middle East known to be hotbeds for terrorist activity. Some won’t sell to these customers, but others will. It is far too easy for a terrorist to simply order a fake ID from China and use it to sit next to you on your next flight. It’s time we close that dangerous vulnerability. It's time we shut down these dangerous counterfeit document mills.
NY DMV Leading the Way on Combating Fake IDs
Andrew Meehan, August 25, 2016
Over the past several years, there has been a precipitous rise in the availability and sophistication of fake IDs. At Keeping IDentities Safe, we have consistently maintained that this newer brand of fake IDs present challenges to our homeland and national security. Our research is increasingly showing a broad range of crimes associated with fake IDs. Millions of fake IDs have been sold into the United States by overseas vendors through internet sites, some based in China. College students and other underage youth are the primary customers for high quality, cheap fake IDs that can be used to enter bars and clubs, and to purchase alcohol and tobacco products. While many liquor stores and bars use scanners to verify the ages of their patrons, nearly all fake ID vendors encode the machine readable zone to pass the garden variety scanner.
In spite of the lack of a national strategy to address the obvious homeland and national security issues associated with these IDs, several state agencies have developed their own strategies for dealing with this influx of fake IDs. The New York State Department of Motor Vehicles (DMV) has developed an excellent strategy for combating this epidemic of fake IDs that tackles the issue on multiple fronts through enforcement and education.
When dealing with fake IDs, any strategy must include enforcement. Generally, there is a perception that fake IDs are a rite of passage and that there are very few consequences for using a fake ID. Over the past several years in partnership with local authorities, DMV investigators targeted large scale concerts and events where there would be a high incidence of under aged drinking. The challenge with large scale events is that local authorities often do not have the manpower to ensure the safety of everyone attending as well as maintain the safety of the community at large. Additionally, many local enforcement officers do not have the necessary training or experience to recognize out of state IDs. By partnering with local sheriffs and police departments, DMV investigators are able to complement existing local law enforcement resources and provide the necessary expertise to recognize fake IDs when they are presented. The results speak for themselves. Over the course of 2015, these partnerships have resulted in 760 arrests and the seizure of more than 750 fake IDs. Over the course of 2015, DMV investigators worked with a number of local law enforcement ranging from the Cortland County Sheriff’s Department to the Ontario County Sheriff’s Department by targeting those large scale events such as the Dave Matthews and Kenny Chesney concerts and Cortaca, the annual Cortland-Ithaca football game. Seized fake IDs help train DMV investigators on what features are being counterfeited and what state IDs to look for.
While enforcement is important, it’s only half of the solution. Because the sophistication of overseas IDs continues to improve, it is likely that the majority of fake IDs used to enter bars gets through without being detected. Through education and outreach, it is important to discourage the use of fake IDs. Keeping IDentities Safe has a program to deter the use of fake IDs through education. Through our poster program, Keeping IDentities Safe seeks to educate students and underage youths regarding what penalties they may incur from getting caught using a fake ID. The idea behind the program is to provide disincentive regarding the use of fake IDs through education and outreach. Similarly, last August, prior to the school year, Governor Andrew Cuomo’s office launched a similar information campaign, warning students that, “The ripple effects of identity theft can last for years and more and more college students are opening themselves up to fraudsters by attempting to purchase a fake ID from the internet. Our message is simple: It’s just not worth it -- both for the immediate consequences of getting caught with a fake ID and for putting their financial future at risk.”
Officials warn against fake I.D.'s as college starts, August 31, 2015,
Cuomo to college students: fake IDs pose identity theft risks, September 28, 2015,
A year before, the Illinois Secretary of State’s office launched a similar public awareness campaign warning youngsters about the dangers of using fake IDs.
Fake IDs the Real Truth, October 2, 2014
Education efforts aim to inform on two key points. First, there are penalties for using a fake ID. In Illinois, an individual’s license can be suspended for one year, and potentially face one to three years in prison and a mandatory minimum fine of $500 up to $25,000 or 50 hours of community service. Many youngsters do not make the association between a fake IDs and penalties. By providing this information, the DMVs are giving under aged youngsters a reason to think twice before using a fake ID. Second, many overseas vendors that provide these fake IDs have been stealing the identity of their unsuspecting patrons. Because of the damage that identity theft can have on an individual’s credit, the Illinois Secretary of State’s office and Governor Cuomo include information on that risk in their outreach.
Additionally, bar owners, bouncers and others who accept IDs need to be empowered with the right information. Last summer, Governor Cuomo announced an initiative to educate bar owners about the new design of the New York Driver’s license [https://www.governor.ny.gov/news/governor-cuomo-announces-initiative-educate-bar-owners-about-revamped-id-cards]. The state developed an electronic brochure that provided restaurant owners, staff and any others who may be required to check IDs with a brief overview of how to validate if the ID is an authentic New York credential. For example, the new New York Driver’s License is made from a polycarbonate material which produces a unique metallic sound when dropped on a hard surface. That kind of information empowers those checking IDs with useful information that provides substantial guards against identity theft and fraud.
NY’s Fake ID Strategy is good for national security
At Keeping IDentities Safe, we are concerned with risks to homeland and national security that fake IDs pose. Driver’s licenses provide access to many sensitive areas, ranging from federal buildings to airports. Just as the 9/11 Commission noted in its report in 2004, “At many entry points to vulnerable facilities, sources of identification are the last opportunity to ensure that people are who they say they are and to check whether they are terrorists.”
Unfortunately, the underage drinking crowd has provided a strong and growing market for cheap, high quality fake IDs in the United States. It doesn’t take a stretch of the imagination to see how these IDs would be used to board an airplane, commit check and wire fraud, or steal another’s identity. As we have previously written, individuals with these fake IDs have used them to board airplanes.
Aside from foreign governments taking action against these vendors, the only recourse is the reduce the demand in the United States. That’s why New York’s strategy for combating fake ID use in New York is so important. The goal of these initiatives is to discourage the use and more importantly, the value of these fake IDs. If more states employ strategies similar to New York’s, it may reduce the market to a point where it no longer exists. New York’s approach to combating fake IDs is an excellent example, a model that other states should follow.
My second warning to Pennsylvania on REAL ID
Max Bluestein, October 25, 2016
The Pennsylvania Department of Transportation announced that on January 30, 2017, Pennsylvania residents “will need an alternative, secure form of identification to gain admittance to all federal facilities, military bases and nuclear power plants” because their driver’s licenses and ID cards didn’t meet federal security standards before the REAL ID deadline. The Department of Homeland Security did grant several states extensions to comply with the REAL ID Act, but Pennsylvania was not among them due to its total lack of progress in securing its documents. If the state continues to lag, Pennsylvanians won’t even be able to use their licenses to board airplanes in 2018.
The impending calamity is due to a 2012 Pennsylvania state law, Act 38, that prohibited the Governor and Department of Transportation from participating in the REAL ID Act or any of its regulations. The bill was championed by State Senator Mike Folmer, who incorrectly called REAL ID a national ID and was joined by a chorus of his colleagues who said the law would never be enforced.
Way back in May 2011, I testified in the state Senate against Act 38 (then SB354), trying to help Pennsylvania avoid this exact crisis. Battling a hostile panel of Senators in the Communications and Technology Committee, I argued that the REAL ID Act is not a national ID but a set of best practices to prevent thieves, impostors, and foreign terrorists from using our driver’s licenses as weapons. I testified that if this bill passed, it would “remove the flexibility of the Governor and the state executive branch to keep Pennsylvania current with the security improvements now underway in a majority of driver’s license agencies across the country”.
I informed the Committee that the bill must be struck down so that “Pennsylvania driver’s license will continue to be accepted by the federal government and in all other states as the proof of the bearer’s identity”. In my testimony, I also predicted that most of the country will move forward on complying with the law in the coming years and, if this bill passes, the other states will leave Pennsylvania behind, along with Montana, Washington, and Oklahoma (all of which are also noncompliant).
However, the Committee didn’t listen. No one listened. SB354 moved through the Communications and Technology Committee unanimously, then through the Senate floor unanimously, and finally through the House 189 – 5 until it became Act 38, “REAL ID Nonparticipation”.
Now, because of that bill, not only are Pennsylvania’s driver’s licenses highly vulnerable to fraud and impostors, but they can’t be used to enter federal buildings and military bases. But in 2018, it will get worse. Unless the legislature overturns Act 38, Pennsylvanians’ driver’s licenses will be treated as no identification at all by TSA at airports across the country. That means residents will be forced to get passports in order to fly (tragically, the actual national ID that Senator Folmer warned against). If the Act is repealed, the process to meet the requirements can begin and hopefully Pennsylvania can avoid a travel nightmare.
I warned in 2011 that the federal government won’t flinch and will enforce the REAL ID Act on Pennsylvania. I hate to say it, but I was right. I’m warning the state again that unless action is taken soon, I will be right again.