Does TSA know who is sitting next to you on the plane?

Brian Zimmer, August 3, 2016

Over the past five years, millions of fake IDs have been sold into the United States by overseas vendors through internet sites. College students and other underage youth are the primary customers for high quality, cheap fake IDs that can be used to enter age restricted events and clubs, and to purchase alcohol and tobacco products. More than two dozen websites offer counterfeit driver's licenses from nearly every state. Many liquor stores and bars use bar code scanning equipment to verify IDs and the ages of their patrons. However, nearly all of the fake ID vendors include encoded machine readable bar codes that scan the same data that is carried on valid driver’s licenses. Unless the liquor vendor uses sophisticated electronic scanners with software that can validate specialized security features that differentiate valid driver’s licenses, the fake IDs are virtually undetectable.

These fake IDs are widely available on the internet, ranging in price from $85 to $150 for a single order, however bulk pricing is available if you are purchasing with friends, enemies, or random people responding to your craigslist ad. Vendors accept all kinds of anonymous payment, ranging from Bitcoin to PayPal to cash cards. Most fake ID vendors send along duplicates in case one is confiscated. Customers can provide any biographic data and photo they choose and the IDs arrive expediently at their chosen mailbox, usually hidden in packages with cheap toys or games.

The fake ID issue is not limited to underage drinking. Many criminals avail themselves of this marketplace, and some of the recent ISIS attacks in Europe employed fake driver’s licenses and passports. Like other businesses, the fake ID market comes with user reviews. Many satisfied customers post about the quality of the IDs on  individual vendor sites. Several such testimonials have boasted of  using fake IDs to pass through security check points at the airport.

We at Keeping IDentities Safe have been talking about the law enforcement and homeland security risks attendant to the fake ID market, but not seen a coherent response from federal authorities or from Congress.

In 2012, USA Today  featured a front page story ​on the issue:

Overseas forgers from as far away as China are shipping fake driver's license and other IDs to the United States that can bypass even the newest electronic digital security systems, according to document security experts... Brian Zimmer, president of the Coalition for a Secure Driver's License, said the ease with which people can get fake documents is alarming. "If the ID buyers are terrorists, the list of protected targets they can now access is a Homeland Security nightmare," he said.

Last year, we wrote about the danger these IDs pose to identity theft and fraud:

They are sought after by identity thieves, habitual drunk drivers, convicted felons seeking guns and even terrorists. To make matters worse, these Chinese companies also victimize the customers, harvesting their pictures and personal data and selling it to identity thieves.

And, we wrote about the danger that these fake IDs pose to aviation security:

Over the last several years, a new Chinese export has found a thriving market in United States: high quality, machine readable, counterfeit driver’s licenses. For prices    between $50 and $300, under-aged youngsters have been purchasing counterfeit licenses from vendors based in China via the web... However, TSA has not significantly upgraded in technology to physically authenticate the security features of identity and travel documents used to board an airplane. Given the number of types of state driver’s licenses, and the time spent reviewing these IDs when submitted with a boarding pass, it is obvious how these fake IDs pose a serious risk to aviation security. 

We even argued for a national strategy for fake IDs because so much of how the federal government conducts its business relies on the integrity of identity documents, such as driver's licenses:

With false documents so easy to obtain and so highly coveted by terrorists, it’s crucial that this country has a national strategy to combat fake IDs. That strategy should include a method of shutting down fake ID vendors outside of U.S. law enforcement jurisdiction, particularly in China.

I recently attended the 2016 Aspen Security Forum and posed a question to TSA Administrator Peter Neffenger:


monitoring the dark net in regard to counterfeit IDs. If so, does it concern you that more and

more counterfeit ID vendors are featuring testimonials of people who have successfully gone
through TSA using counterfeit IDs?

Actually that is a good point. One of the challenges that we face
in aviation security... is ensuring that the individual who presents themselves is in fact
the person they claim to be. That's a lot more challenging than one might think, at times.
So an ID is one component of that. Another component of that is other verifications that
happen as your name gets... So when you make a reservation for a flight now, you go
into something called the Secure Flight system and that is a system that bounces your
name against databases of interest. So that's one way in which we begin to look to see
if this is a name of some concern. Ideally then when you present yourself, you present
an ID that we try to validate as a real ID, as a valid ID and we try to connect that to the

individual. The challenge right now is that we currently do not have all the systems in place to
​verify the validity of that ID. We've been working very closely with the FBI, with
​begin to think about how you, how do you actually ensure yourself that this ID is not a counterfeit and the like. We're getting much better at that and we've got some pilot systems out there that do that. But it has to be part of a larger system. It doesn't stand by itself. As you know, many of you are used to walking up to the guy who scribbles all over your boarding pass, and he holds your ID underneath an ultraviolet light. That is not the most effective way of determining whether or not somebody's ID is valid. So we have to-- we are working on additional things. We are actually working very closely with some of the airlines themselves because if you think about it they have got those kiosks everywhere that read IDs, CBP does that, and I think that, what I hope to see over the coming months is a dramatic improvement in our ability to validate, because you point up a very real concern. It's the number one issue. You want to find out that the person who presents them self is in fact that person so you can determine whether or not they are somebody of interest or concern.

In our view, it’s of small comfort that Mr. Neffenger agrees with us that: "It's the number one issue." However, as we noted, fake IDs and the ability to discern which IDs are valid and which are counterfeit is not a new issue. To be fair, this was an issue that Mr. Neffenger inherited from previous administrations. Nonetheless, TSA needs a defined strategy to authenticate identity documents submitted at the security checkpoints, even if the process will require more than one pilot effort. The sooner the better.

The issue is not going to go away. The number of vendors and available types of fake IDs is only growing. Without a proactive approach, TSA really doesn't know who is sitting next to you on your next flight.

Louisiana Joins REAL ID

Andrew Meehan, June 20, 2016​

Last week, Governor John Bel Edwards signed legislation, that gives Louisiana residents the option of obtaining a REAL ID compliant driver's license. The bill signing ends an eight year debate on REAL ID in Louisiana.

The bill establishes two tiers of driver’s licenses and identification cards: ones that meet the REAL ID standards and ones that do not. The REAL ID license will cost the same as a traditional license, results in no significant increase in state spending, and are expected to be made available by September 1, 2016. The traditional driver’s license will state on the face that “the driver’s license is not in compliance with REAL ID.”

Keeping IDentities Safe supported the legislation in an op-ed in the Times Picayune.

History of REAL ID in Louisiana

This is not the first time that Louisiana has passed a REAL ID bill. In 2008, Louisiana passed a bill prohibiting the state from enacting the REAL ID standards. Several organizations, such as the American Civil Liberties Union of Louisiana (ACLU), perpetuated myths about REAL ID, such as that REAL ID would “turn [Louisiana driver’s licenses] into a national ID system, and force [holders] to give up sensitive information for storage in a national database.” Though REAL ID does not establish a database, the arguments used by the ACLU and others made for effective political messaging, thus resulting in the passage of the 2008 bill.

However in December 2013, the Department of Homeland Security (DHS) announced how the REAL ID Act would be enforced; initially at federal buildings and finally at airports. Following DHS’s announcement in December 2013, the Louisiana legislature passed House Bill 907. The bill even had support from then-Governor Bobby Jindal’s own cabinet. However,  Jindal vetoed the legislation, due to concerns brought to the Governor’s attention by the Eagle Forum, the Louisiana Family Forum, and the Tea Party of Louisiana. Governor Jindal was concerned that REAL ID would “compromise Louisiana’s sovereignty over what is fundamentally a state method of identification.”

Following Governor Jindal’s veto, the Louisiana Department of Public Safety started to adopt what REAL ID standards it could without legislation. According to a Freedom of Information Act request, the Louisiana Department of Public Safety a Freedom took a number of steps to meet the requirements of the REAL ID Act since Governor Jindal had vetoed the legislation.

Governor Edwards made REAL ID legislation a priority upon taking office. He appointed Karen St. Germaine to head the Office of Motor Vehicles. Ms. St. Germaine had previously served in the state legislature as the Chairwoman of the House Transportation Committee and was a chief supporter of the 2014 effort to move the state into REAL ID compliance.

Fake IDs: The Vulnerability DHS isn’t Watching

Max Bluestein, June 4, 2016

Amid national controversy over long lines at airports, Department of Homeland Security (DHS) Deputy Secretary Alejandro Mayorkas testified before the Senate last week that aviation security will continue to be a priority. Following successful ISIS attacks in France, Belgium, and on international airliners, Mayorkas declared that the agency has “strengthened our screening protocols at domestic airports to ensure that operatives or threatening objects do not enter the secure area of the airports.” Secretary Jeh Johnson reiterated that point on CBS, saying that despite the lines, “we are not going to compromise airport security,” However, DHS continues to neglect a major vulnerability to airports and air travel: fake IDs.

The integrity of driver’s licenses is of paramount importance to aviation security. Driver’s licenses are the document of choice for millions of Americans every day to board airplanes as they pass through TSA. As such, fake IDs represent a very real risk to our air safety and one that continues to go unaddressed by DHS.

Just like the 9/11 Commission concluded in its 2004 report, terrorists continue to use fake IDs as weapons. ISIS used fake IDs to attack nightclubs, cafes, a metro station, and an airport in Belgium and France, taking over 160 lives. Supplied by a high quality fake ID “factory” in Brussels, the terrorists used counterfeit Belgium ID cards to cross European borders, rent a safe house, wire money between co-conspirators, and possibly more. When Belgian police raided the “factory”, they found computers, scanners, printers, heat presses, and over 1,300 unfinished documents. While the investigations into the attacks are still ongoing, it remains uncertain how many undercover ISIS terrorists escaped using those high-quality fake IDs.

Salah Abdeslam, the logistics chief of the Paris attacks, provided himself and jihadists 
disguised as Syrian refugees with fake Belgian ID cards as he transported them 
through checkpoints between Belgium and several European countries. Accompanying 
him were Mohamed Belkaid, another major architect of the Paris attacks, and Najim 
Laachraoui, bomb maker for both the Paris and Brussels attacks. All were believed to 
be using fake IDs from the same “factory”. These fake IDs were also used to rent a 
safe house used by the Paris attackers and to wire money between co-conspirators. 
Khalid el-Bakraoui, the suicide bomber who attacked the Maelbeek metro station in 
Brussels, also used a fake ID in the name of a professional Belgian soccer player.

This is not new. Using fake IDs was explicitly instructed in the al-Qaeda handbook. 
ISIS’s training manual, “How to Survive in the West,” states that, “identity change is 
so important…This makes it extremely difficult for intelligence agencies to know 
who you really are...find people who can fake ID cards”. It goes on to advise terrorists 
​to rent cars and houses with fake IDs before launching attacks. The Paris and Belgium 
​attackers clearly did their reading.

How does this apply to the United States? Belgian ID cards can be used to cross borders in Europe without a passport, like the counterfeit ones the terrorists used. We use our driver’s licenses similarly to fly between the states. This places a huge burden on a TSA officer who must verify our driver’s licenses, which are issued by 56 different jurisdictions and come in hundreds of variations. Ideally, the TSA officer is familiar enough with each and every document to make a determination in seconds as to whether or not the document is genuine and it represents the person presenting it. The necessary encyclopedic knowledge, however, makes this almost impossible.

The issue is exacerbated by the fact that hundreds of thousands of high quality counterfeit state driver’s licenses and ID cards are being sold over the internet to anyone with an address and fifty bucks. Many of these are coming from overseas, flooding our borders from similar “factories”  based in China, hidden in toys and trinkets to evade customs inspection. The counterfeiters are copying almost any of our state IDs and many are good enough to fool even the experts. On anonymous fake ID internet forums, users even brag about fooling TSA agents with fake IDs to board airplanes - just for fun.

TSA (and for that matter, DHS) needs a proactive approach to deal with fake IDs. There must be a coordinated effort to collect and analyze counterfeit IDs to better defend against them. Existing technology must be deployed at airports that can instantly verify driver’s licenses and IDs, increasing both security and convenience. And our government and law enforcement agencies must work with foreign governments to shut down these “factories” abroad.

Fake IDs aren’t just used by kids to get into bars anymore; they’re used by terrorists to attack them. With a national strategy, we can effectively mitigate the risk of impostors using fake IDs to travel anonymously, enter secure facilities, and board our airplanes. We can take away the crucial weapon that was used by both the 9/11 hijackers and the ISIS attackers. We need to act now because we won’t get many more tragic warnings like the attacks in Europe.

The REAL ID Rebellion Started and Ended in New Hampshire

Andrew Meehan, May 5, 2016

Jim Harper of the Cato Institute, a REAL ID critic, has called New Hampshire the state where “the first volley in the REAL ID rebellion was thrown.” In 2006, New Hampshire became the first state to pass legislation prohibiting the state from implementing the REAL ID standards, arguing that it is an unfunded mandate and would create a national ID card with a federally accessible database of driver’s license data. Nine years later, none of myths have come to pass and 51 states and territories are moving forward in meeting the REAL ID standards. More than $220 million in federal grants has gone directly to the states and neither REAL ID nor its final rule established or required the establishment of a national ID or database.

The federal REAL ID Act of 2005 is a anti-terrorism law is aimed at making it more difficult for terrorists and generally any criminal seeking to hide his or identity from fraudulently obtaining a driver’s license. REAL ID prohibits federal agencies from accepting driver’s licenses that do not meet certain standards set by the Department of Homeland Security (DHS). In January, DHS announced that REAL ID would be enforced at the airports in 2018. Since then, several states have considered legislation that would move them forward on the REAL ID standards. 

This month, Governor Maggie Hassan (R-NH) signed New Hampshire House Bill 1616. In a press release, Governor Hassan stated:

"This bill is a common-sense step forward that gives Granite Staters the option of obtaining a federally compliant identification that will be accepted for travel at airports and for entry into other secure federal facilities. I thank legislators from both parties for working together to find a New Hampshire-specific solution that balances that option while retaining control of our data to protect the private information of our citizens. I am glad to sign this bipartisan bill into law so that Granite Staters do not have to obtain a federal passport in order to enter secure facilities or to travel on airplanes. Granite Staters should understand that House Bill 1616 will require them to affirmatively choose the federally compliant license and the Division of Motor Vehicles will institute education efforts to inform the public about steps necessary to obtain their desired license."

This bill does several things. Under the new legislation, House bill 1616 creates three different licenses, all of which will be available by July 1, 2017:

Traditional noncompliant driver’s license. The bill provides Granite Staters with the option of obtaining a traditional New Hampshire driver’s license. The only difference is that this license will state on its face, “not acceptable for federal identification purposes.”

REAL ID compliant driver’s license. For those New Hampshire residents who want to use their driver’s license to board airplanes after enforcement, the bill gives them the choice of obtaining a REAL ID compliant driver’s license that will be physically different from a traditional driver’s license and be marked with a gold star.

Enhanced driver’s license. Not a REAL ID requirement, the enhanced driver’s license allows the holder to cross the land border into Canada or Mexico in lieu of a passport. However, it can also be used to board airplanes after enforcement. 

The National ID Myth

A longstanding criticism of the REAL ID Act is that it creates a federal identification database. In testimony before the New Hampshire Senate Transportation Committee, Jim Harper of the Cato Institute stated that:

"REAL ID is a national ID system. First, it is national in scope. Real ID seeks to knit together diverse state-controlled systems into a federally controlled system that is uniform with respect to its data elements and behind-the-scenes information sharing."

Devon Chaffee, Executive Director, American Civil Liberties Union of New Hampshire delivered similar testimony:

​"The standardized national driver’s licenses created by REAL ID would become a key part of a system of identity papers, databases, status and identity checks and access control points – an “internal passport” that will increasingly be used to track and control individuals’ movements and activities. The standardized machine-readable interface of REAL IDs make it easy for an ever-growing network of identity checks and access control points which will create new data trails."

​According to Mr. Harper and Ms. Chaffee, if a state goes REAL ID compliant, then the state must participate in a federal identification database. Here’s where that argument goes off the rails. New Hampshire is going REAL ID compliant, but not participating in a federal identification database. The New Hampshire legislation states, “[a]ny records received pursuant to this paragraph shall not be used, further transferred, or otherwise made available to any other person or entity for the purpose of creating or enhancing a federal identification database.” It begs the question, how can New Hampshire offer a REAL ID option and not participate in a national identification database. That’s because REAL ID does not create that federal identification database. Neither REAL ID nor the regulation requires the establishment of a national identification database. Simply put, REAL ID is a collection of standards designed to reduce identity theft and fraud. 

Teenager Bought a Fake Ohio ID to Buy a Gun and Murder Cops  

Max Bluestein, 6/13/16

Last week, an 18 year-old in New York ordered a fake Ohio driver’s license that said he was 21, but he didn’t use it to get into bars or nightclubs.
Ranbir Singh Shergil used the counterfeit license to buy a Glock 17 handgun he intended to use to murder NYPD police officers in a Dunkin’ Donuts.

A note found on his phone read:

“Do it during a snowstorm . . . Go from dunkin donuts on van wyck after shooting and killing officers they will be wearing coats. And one will be male other female. Then try to kill other nypd officers . . .”

Shergil purchased the Ohio ID over the internet using a tor browser and paid with $230 in bitcoins, according to the criminal complaint. "Tor" stands for "the onion router" and is used to surf the dark web, meaning websites inaccessible without special methods. This indicates that the Ohio ID likely came from dark web vendor TedDanzig, who only makes Ohio IDs that cost around $230, only accepts bitcoins, and only operates on a tor browser restricted website. TedDanzig claims to be the longest running online counterfeit ID vendor, outdating IDgod and even IDChief.  TedDanzig's Ohio IDs are very high quality, with holograms, OVIs, and bendable material.

​According to TedDanzig’s own website, the IDs even have mag stripe coding based on AAMVA standards.

In monitoring anonymous forums where vendors like TedDanzig communicate directly with customers,
someone posted: 

“Ted is that you?” with a link to the New York Post’s article on this arrest. The vendor did, in fact,
​address the question, replying:

“The price + OH + tor use does imply he bought from us. I almost don't want to check my order history to see if he is there.”

Further worrying about fake IDs being used for purchasing firearms and ammo is this post from 8 months ago:

"I live in Ohio, which doesn't require background checks when buying from a private seller. There's a gun show coming to my city next weekend. Will I be able to purchase an AK47 with my fake? On a separate note, how rigorous is Walmart on ammunition? Would I be able to get through with an idgod ct? I'm buying 5.56"

Many counterfeit ID vendors, especially those operating over the internet, will sell fake IDs to anyone, anywhere, as long as they pay. Fake IDs are incredibly dangerous. They are used for so much more than underage drinking, from identity theft to buying guns to terrorism. With yet another mass shooting over the weekend, it’s time to close this vulnerability to our national security and public safety. We must take this weapon out of the hands of serious criminals and shut down these document mills.​​