Department of State: Undercover Tests Reveal Significant Vulnerabilities in State's Passport Issuance Process
Published: 2009-03-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: A genuine U.S. passport is a vital document, permitting its owner to travel freely in and out of the United States, prove U.S. citizenship, obtain further identification documents, and set up bank accounts, among other things. Unfortunately, a terrorist or other criminal could take advantage of these benefits by fraudulently obtaining a genuine U.S. passport from the Department of State (State). There are many ways that malicious individuals could fraudulently obtain a genuine U.S. passport, including stealing an American citizen's identity and counterfeiting or fraudulently obtaining identification or citizenship documents to meet State requirements. GAO was asked to proactively test the effectiveness of State's passport issuance process to determine whether the process is vulnerable to fraud. To do so, GAO designed four test scenarios that simulated the actions of a malicious individual who had access to an American citizen's personal identity information. GAO created counterfeit documents for four fictitious or deceased individuals using off-the-shelf, commercially available hardware, software, and materials. An undercover GAO investigator then applied for passports at three United States Postal Service (USPS) locations and a State-run passport office.
section_title: What GAO Found
paragraphs: GAO's investigation shows that terrorists or criminals could steal an American citizen's identity, use basic counterfeiting skills to create fraudulent documentation for that identity, and obtain a genuine U.S. passport from State. GAO conducted four tests simulating this approach and was successful in obtaining a genuine U.S. passport in each case. In the most egregious case, an undercover GAO investigator obtained a passport using counterfeit documents and the Social Security Number (SSN) of a man who died in 1965. In another case, the investigator obtained a passport using counterfeit documents and the genuine SSN of a fictitious 5-year-old child GAO created for a previous investigation--even though the investigator's counterfeit documents and application indicated he was 53 years old. All four passports were issued to the same GAO investigator, under four different names. In all four tests, GAO used counterfeit and/or fraudulently obtained documents. State and USPS employees did not identify GAO's documents as counterfeit. GAO's investigator later purchased an airline ticket under the name used on one of the four fraudulently obtained U.S. passports, and then used that passport as proof of identity to check in to his flight, get a boarding pass, and pass through the security checkpoint at a major metropolitan-area airport. At a briefing on the results of GAO's investigation, State officials agreed with GAO that the investigation exposes a major vulnerability in State's passport issuance process. According to State officials, State's fraud detection efforts are hampered by limitations to its information sharing and data access with other federal and state agencies. After GAO's briefing, State officials notified GAO that they identified and revoked GAO's four fraudulently obtained U.S. passports, and were studying the matter to determine the appropriate steps for improving State's passport issuance process.

section_title: Letter
paragraphs: A U.S. passport not only allows an individual to travel freely in and out of  the United States, but also can be used to obtain further identification  documents, prove U.S. citizenship, and set up bank accounts, among other  things. Because passports issued under a false identity help enable  individuals to conceal their movements and activities, there is great  concern that passport fraud could facilitate acts of terrorism. In fact, the  9/11 Commission stated that “for terrorists, travel documents are as  important as weapons,” and further noted that terrorists need to travel “to  meet, train, plan, case targets, and gain access to attack.” Further,  passport fraud facilitates other crimes such as illegal immigration, money  laundering, drug trafficking, tax evasion, and alien smuggling.
Malicious individuals may seek to exploit vulnerabilities in the Department  of State’s (State) current passport issuance process, such as a lack of due  diligence on the part of examiners who screen applications, by using  counterfeit or fraudulently obtained documents as proof of identity and  U.S. citizenship to obtain genuine U.S. passports. For example, between  July 2005 and August 2008, State and the Federal Bureau of Investigation  (FBI) identified 112 individuals who had fraudulently obtained U.S.  passports by using the birth certificates of deceased Americans.  Individuals who fraudulently obtained passports included fugitives, sex  offenders, and delinquent taxpayers, all of whom wanted to use a U.S.  passport to conceal themselves from law enforcement authorities. State  and the FBI identified these 112 individuals by matching State passport  records against state-level death records.
In 2005, we reported that using the stolen identities and documentation of  U.S. citizens is the primary tactic of those fraudulently applying for U.S.  passports, and that passport fraud is often linked to other crimes. Our  report mentioned a number of ways in which a person might fraudulently  obtain a U.S. passport, including using an assumed identity that is  supported by genuine but fraudulently obtained identification documents;  submitting false claims of lost, stolen, or mutilated passports; using  counterfeit citizenship documents; and using the identity of a deceased  person. We also reported weaknesses in State’s information sharing with  other federal agencies. For example, we stated that the information that  State received and used from the Social Security Administration (SSA)  was limited and outdated. In the report, we stated that although State and  SSA signed a memorandum in April 2004 that gave State access to SSA’s  main database to help verify passport applicants’ identity, the  memorandum had not been implemented as of March 2005. Moreover, we  reported that the memorandum did not include access to SSA’s death  records, but that State officials said they were exploring the possibility of  obtaining these records in the future.
In 2007 we reported on the risk of fraud that exists in the lack of State’s  oversight of the more than 8,000 passport acceptance facilities nationwide  that it designates to provide passport application services to the American  public. Passport acceptance facilities are located at certain United States  Postal Service (USPS) locations, courthouses, and other institutions, and  do not employ State personnel. The passport acceptance agents at these  facilities are responsible for, among other things, verifying whether an  applicant’s identification document (such as a driver’s license) actually  matches the applicant, and sending each applicant’s proof of citizenship  and passport application to State. Although we found that State had taken  some steps to address weaknesses identified in the training of acceptance  agents, we found that additional measures were needed to ensure  adequate controls over the application acceptance process.
This report responds to your request that we proactively test the  effectiveness of the current passport issuance process to determine  whether malicious individuals could use counterfeit or fraudulently  obtained documents to obtain a genuine U.S. passport. To perform this  work, we designed four test scenarios that would simulate the actions of a  malicious individual who had access to another person’s identity  information (a practice commonly known as identity theft). We then  attempted to obtain four genuine U.S. passports by using counterfeit or  fraudulently obtained documents, such as birth certificates and drivers’  licenses, and the Social Security Numbers (SSN) of fictitious or deceased  individuals. We created all of these counterfeit documents with off-the- shelf, commercially available hardware, software, and materials. In  addition, we used some of these counterfeit documents to obtain a  genuine District of Columbia (D.C.) identification card, which we  subsequently used to obtain a U.S. passport in one test.
The fictitious identities we used in our first two tests were based on  information and SSNs we had previously obtained from SSA for the  purpose of conducting undercover tests. These tests were meant to  simulate a malicious individual stealing another person’s identity and  using it to obtain a passport. On our third test, we used the genuine SSN of  a fictitious 5-year-old child we created for a previous investigation to  simulate a malicious individual stealing the identity of a real child to get a  passport. Finally, on our fourth test, we used the SSN of an individual who  died in 1965 to simulate a malicious individual using a deceased person’s  identity to obtain a passport. For three of our four tests, we submitted our  passport applications and supporting materials at USPS locations that  accept passport applications. For one of our four tests, we submitted our  application and materials at State’s regional Washington, D.C., passport- issuing office.
We conducted the work for this investigation from May 2008 through  March 2009 in accordance with quality standards for investigations as set  forth by the President’s Council on Integrity and Efficiency.
subsections: section_title: Undercover Investigator Obtained Four Genuine U.S. Passports Using Counterfeit or Fraudulently Obtained Documents
paragraphs: Our investigator was easily able to obtain four genuine U.S. passports  using counterfeit or fraudulently obtained documents. In the most  egregious case, our investigator obtained a U.S. passport using counterfeit  documents and the SSN of a man who died in 1965. In another case, our  undercover investigator obtained a U.S. passport using counterfeit  documents and the genuine SSN of a fictitious 5-year-old child—even  though his counterfeit documents and application indicated he was 53  years old. State and USPS employees did not identify our documents as  counterfeit in any of our four tests. Although we do not know what  checks, if any, State performed when approving our fraudulent  applications, it issued a genuine U.S. passport in each case. All four  passports were issued to the same GAO investigator, under four different  names.
Our tests show a variety of ways that malicious individuals with even  minimal counterfeiting capabilities and access to another person’s identity  could obtain genuine U.S. passports using counterfeit or fraudulently  obtained documents. Table 1 below shows the month of passport  application, type of counterfeit or fraudulently obtained documents used,  and the number of days that passed between passport application and  passport issuance for each of our four tests.
Our investigator used a genuine U.S. passport obtained by using  counterfeit or fraudulently obtained documents to pass through airport  security. In January 2009, our investigator purchased an airline ticket for a  domestic flight using the fictitious name from one of our test scenarios. He  then used the fraudulently obtained passport from that test as proof of  identity to check in to his flight, get a boarding pass, and pass through the  security checkpoint at a major metropolitan-area airport. Figure 1 below  shows the boarding pass. After our investigator successfully passed  through the checkpoint, he left the airport and cancelled his airline ticket.
subsections: section_title: Test One: Investigator Obtained Passport Using Counterfeit Identification Documents
paragraphs: Our first test found that USPS did not detect the counterfeit West Virginia  driver’s license our undercover investigator presented as proof of his  identity during the passport application process. Further, State issued our  investigator a genuine U.S. passport despite the counterfeit New York  birth certificate he used as proof of his U.S. citizenship. In July 2008, our  investigator entered a USPS office in Virginia and approached a USPS  employee to apply for a passport. The USPS employee greeted the  investigator and took his application form, counterfeit New York birth  certificate, and counterfeit West Virginia driver’s license. On these  documents, we used a fictitious identity and a SSN that we had previously  obtained from SSA for the purpose of conducting undercover tests. The  USPS employee reviewed the application materials line by line to make  sure that the information on the application form matched the information  on the birth certificate and driver’s license. After she completed her review  of the application materials, the USPS employee took the investigator’s  birth certificate and funds to pay for the application fee. She administered  an oath, and then told the investigator that he should receive the passport  within 1 to 4 weeks.
State issued a genuine U.S. passport to our undercover investigator 8 days  after he submitted his application. About a week after State issued the  passport, it arrived at the mailing address indicated on the application  materials.
section_title: Test Two: Investigator Obtained Passport Using a Genuine but Fraudulently Obtained State Identification Card
paragraphs: Our second test found that State did not detect a counterfeit New York  birth certificate our undercover investigator presented to prove his U.S.  citizenship in support of a passport application. In July 2008, our  investigator—the same investigator as in the first test above—obtained a  genuine identification card from the Washington, D.C., Department of  Motor Vehicles using counterfeit documents, which he then used to apply  for a U.S. passport.
In August 2008, the same investigator entered State’s regional Washington,  D.C., passport-issuing office with a completed passport application form, a  counterfeit New York birth certificate, the genuine D.C. identification  card, two passport photographs, sufficient funds to pay for the application  fee, and an electronic ticket (e-ticket) confirming that he had a flight to  Germany. For this test, we used a fictitious identity and SSN that we had  previously obtained from SSA for the purpose of conducting undercover  investigations. The investigator presented his application form and  materials to a State employee, who went line by line through the  application form matching the information to the accompanying  documents. The State employee provided the investigator with a number  and instructed him to wait until his number was called. After his number  was called, the investigator proceeded to a window to speak with another  State employee. The second employee looked over his materials to make  sure that he had all of the necessary documentation, took his birth  certificate and money, and administered an oath.
A few days later, the investigator returned to the same passport facility  and picked up his passport. State issued the passport on the same day that  the investigator submitted his application, in the fictitious name presented  on the fraudulently obtained and counterfeit documents.
section_title: Test Three: Investigator Obtained Passport Using Social Security Number for a Fictitious 5-Year-Old Child
paragraphs: As with our first test, our third test found that USPS did not detect the  counterfeit West Virginia driver’s license our undercover investigator  presented as proof of his identity during the passport application process.  Further, State issued our investigator a genuine U.S. passport based on a  counterfeit New York birth certificate as proof of U.S. citizenship. In  October 2008, our investigator—the same investigator as in the first two  tests mentioned above—entered a USPS office in Maryland to apply for a  U.S. passport. A USPS employee greeted the investigator and took his  application form, as well as his counterfeit New York birth certificate and  counterfeit West Virginia driver’s license. The application materials used  the name and genuine SSN of a fictitious 5-year-old child, which we  obtained from a previous investigation. However, our investigator listed  his age as 53 on the application materials, which clearly did not match the  date of birth associated with the SSN used in this test. The USPS employee  reviewed the application materials, including meticulously matching the  information on the application form to the birth certificate and driver’s  license. After she completed her review of the application materials, the  USPS employee took the investigator’s birth certificate and payment for  the application fee, administered an oath, and told the investigator that he  should receive the passport within 2 to 4 weeks.
State issued a genuine U.S. passport to our investigator, in the fictitious  name based on the counterfeit documents, 7 days after he submitted his  application. The passport arrived at the mailing address indicated by our  investigator on the application materials a few days after its issuance.
section_title: Test Four: Investigator Obtained Passport Using Social Security Number of a Deceased Individual
paragraphs: As with our first and third tests, our fourth test found that USPS did not  detect the counterfeit identification document—a bogus Florida driver’s  license—our undercover investigator presented to support his passport  application. Further, State issued our investigator a genuine U.S. passport  based on a counterfeit New York birth certificate as proof of U.S.  citizenship. In December 2008, our investigator—the same investigator as  in the three tests mentioned above—entered a USPS office in Maryland to  apply for a U.S. passport. A USPS employee greeted the investigator and  took his application form, as well as his counterfeit New York birth  certificate and counterfeit Florida driver’s license. His application  materials used a name and SSN that was issued to a person who died in  1965, and who would have been 59 years old at the time of our test had he  still been alive. The USPS employee reviewed the application materials,  matching the information on the application form to the birth certificate  and driver’s license. After completing the review of application materials,  the USPS employee took the investigator’s birth certificate and funds to  pay for the application fee. The USPS employee administered an oath then  told the investigator that he should receive the passport within 4 to 6  weeks.
Four days after our investigator submitted his application, State issued a  genuine U.S. passport in the fictitious name presented on the counterfeit  documents. The passport arrived at the mailing address indicated by our  investigator on the application materials.
section_title: Corrective Action Briefing
paragraphs: We briefed State officials on the results of our investigation. They agreed  that our findings expose a major vulnerability in State’s passport issuance  process. According to State officials, the department’s ability to verify the  information submitted as part of a passport application is hampered by  limitations to its information sharing and data access with other agencies  at the federal and state levels. They said that some federal agencies limit  State’s access to their records due to privacy concerns or the fact that  State is not a law enforcement agency. In addition, they said that State  does not currently have the ability to conduct real-time verification of the  authenticity of birth certificates presented by passport applicants. They  added that birth certificates present an exceptional challenge to fraud  detection efforts, as there are currently thousands of different acceptable  formats for birth certificates. Further, they indicated that there are  difficulties with verifying the authenticity of drivers’ licenses. Moreover,  they said that although State attempts to verify SSN information submitted  on passport applications on a daily basis with SSA, the results of this data- sharing process are imperfect. For example, State officials said that many  of the mismatches identified through this verification process are actually  due to typos or other common errors. However, they said that while these  data checks may not identify all cases in which an applicant’s data do not  match the information in SSA’s records, in some instances—such as cases  in which an SSN is tied to a deceased individual—investigators from the  Passport Fraud Branch of State’s Bureau of Diplomatic Security will  attempt to check publicly available databases to resolve the mismatch.
State officials acknowledged that they have issued other fraudulently  obtained passports but did not offer an estimate of the magnitude of the  problem. In order to improve State’s current passport fraud detection  capabilities, officials said that State would need greater cooperation from  other agencies at both the federal and state levels, and the ability to access  other agencies’ records in real time. Subsequent to our briefing, State  officials informed us that they identified and revoked our four fraudulently  obtained U.S. passports, and that they would study the matter further to  determine what steps would be appropriate to improve passport issuance  procedures. We did not verify the accuracy of these State officials’  statements. We also briefed a representative of USPS on the results of our  investigation, who did not offer any comments at the time of our briefing.
We are sending copies of this report to the Secretary of State and other  interested parties. The report will also be available at no charge on the  GAO Web site at http://www.gao.gov. If you or your staff have any  questions concerning this report, please contact me at (202) 512-6722 or  kutzg@gao.gov. Contact points for our Offices of Congressional Relations  and Public Affairs may be found on the last page of this report.