Our investigator was easily able to obtain four genuine U.S. passports using counterfeit or fraudulently obtained documents. In the most egregious case, our investigator obtained a U.S. passport using counterfeit documents and the SSN of a man who died in 1965. In another case, our undercover investigator obtained a U.S. passport using counterfeit documents and the genuine SSN of a fictitious 5-year-old child—even though his counterfeit documents and application indicated he was 53 years old. State and USPS employees did not identify our documents as counterfeit in any of our four tests. Although we do not know what checks, if any, State performed when approving our fraudulent applications, it issued a genuine U.S. passport in each case. All four passports were issued to the same GAO investigator, under four different names. Our tests show a variety of ways that malicious individuals with even minimal counterfeiting capabilities and access to another person’s identity could obtain genuine U.S. passports using counterfeit or fraudulently obtained documents. Table 1 below shows the month of passport application, type of counterfeit or fraudulently obtained documents used, and the number of days that passed between passport application and passport issuance for each of our four tests. Our investigator used a genuine U.S. passport obtained by using counterfeit or fraudulently obtained documents to pass through airport security. In January 2009, our investigator purchased an airline ticket for a domestic flight using the fictitious name from one of our test scenarios. He then used the fraudulently obtained passport from that test as proof of identity to check in to his flight, get a boarding pass, and pass through the security checkpoint at a major metropolitan-area airport. Figure 1 below shows the boarding pass. After our investigator successfully passed through the checkpoint, he left the airport and cancelled his airline ticket. Our first test found that USPS did not detect the counterfeit West Virginia driver’s license our undercover investigator presented as proof of his identity during the passport application process. Further, State issued our investigator a genuine U.S. passport despite the counterfeit New York birth certificate he used as proof of his U.S. citizenship. In July 2008, our investigator entered a USPS office in Virginia and approached a USPS employee to apply for a passport. The USPS employee greeted the investigator and took his application form, counterfeit New York birth certificate, and counterfeit West Virginia driver’s license. On these documents, we used a fictitious identity and a SSN that we had previously obtained from SSA for the purpose of conducting undercover tests. The USPS employee reviewed the application materials line by line to make sure that the information on the application form matched the information on the birth certificate and driver’s license. After she completed her review of the application materials, the USPS employee took the investigator’s birth certificate and funds to pay for the application fee. She administered an oath, and then told the investigator that he should receive the passport within 1 to 4 weeks. State issued a genuine U.S. passport to our undercover investigator 8 days after he submitted his application. About a week after State issued the passport, it arrived at the mailing address indicated on the application materials. Our second test found that State did not detect a counterfeit New York birth certificate our undercover investigator presented to prove his U.S. citizenship in support of a passport application. In July 2008, our investigator—the same investigator as in the first test above—obtained a genuine identification card from the Washington, D.C., Department of Motor Vehicles using counterfeit documents, which he then used to apply for a U.S. passport. In August 2008, the same investigator entered State’s regional Washington, D.C., passport-issuing office with a completed passport application form, a counterfeit New York birth certificate, the genuine D.C. identification card, two passport photographs, sufficient funds to pay for the application fee, and an electronic ticket (e-ticket) confirming that he had a flight to Germany. For this test, we used a fictitious identity and SSN that we had previously obtained from SSA for the purpose of conducting undercover investigations. The investigator presented his application form and materials to a State employee, who went line by line through the application form matching the information to the accompanying documents. The State employee provided the investigator with a number and instructed him to wait until his number was called. After his number was called, the investigator proceeded to a window to speak with another State employee. The second employee looked over his materials to make sure that he had all of the necessary documentation, took his birth certificate and money, and administered an oath. A few days later, the investigator returned to the same passport facility and picked up his passport. State issued the passport on the same day that the investigator submitted his application, in the fictitious name presented on the fraudulently obtained and counterfeit documents. As with our first test, our third test found that USPS did not detect the counterfeit West Virginia driver’s license our undercover investigator presented as proof of his identity during the passport application process. Further, State issued our investigator a genuine U.S. passport based on a counterfeit New York birth certificate as proof of U.S. citizenship. In October 2008, our investigator—the same investigator as in the first two tests mentioned above—entered a USPS office in Maryland to apply for a U.S. passport. A USPS employee greeted the investigator and took his application form, as well as his counterfeit New York birth certificate and counterfeit West Virginia driver’s license. The application materials used the name and genuine SSN of a fictitious 5-year-old child, which we obtained from a previous investigation. However, our investigator listed his age as 53 on the application materials, which clearly did not match the date of birth associated with the SSN used in this test. The USPS employee reviewed the application materials, including meticulously matching the information on the application form to the birth certificate and driver’s license. After she completed her review of the application materials, the USPS employee took the investigator’s birth certificate and payment for the application fee, administered an oath, and told the investigator that he should receive the passport within 2 to 4 weeks. State issued a genuine U.S. passport to our investigator, in the fictitious name based on the counterfeit documents, 7 days after he submitted his application. The passport arrived at the mailing address indicated by our investigator on the application materials a few days after its issuance. As with our first and third tests, our fourth test found that USPS did not detect the counterfeit identification document—a bogus Florida driver’s license—our undercover investigator presented to support his passport application. Further, State issued our investigator a genuine U.S. passport based on a counterfeit New York birth certificate as proof of U.S. citizenship. In December 2008, our investigator—the same investigator as in the three tests mentioned above—entered a USPS office in Maryland to apply for a U.S. passport. A USPS employee greeted the investigator and took his application form, as well as his counterfeit New York birth certificate and counterfeit Florida driver’s license. His application materials used a name and SSN that was issued to a person who died in 1965, and who would have been 59 years old at the time of our test had he still been alive. The USPS employee reviewed the application materials, matching the information on the application form to the birth certificate and driver’s license. After completing the review of application materials, the USPS employee took the investigator’s birth certificate and funds to pay for the application fee. The USPS employee administered an oath then told the investigator that he should receive the passport within 4 to 6 weeks. Four days after our investigator submitted his application, State issued a genuine U.S. passport in the fictitious name presented on the counterfeit documents. The passport arrived at the mailing address indicated by our investigator on the application materials. We briefed State officials on the results of our investigation. They agreed that our findings expose a major vulnerability in State’s passport issuance process. According to State officials, the department’s ability to verify the information submitted as part of a passport application is hampered by limitations to its information sharing and data access with other agencies at the federal and state levels. They said that some federal agencies limit State’s access to their records due to privacy concerns or the fact that State is not a law enforcement agency. In addition, they said that State does not currently have the ability to conduct real-time verification of the authenticity of birth certificates presented by passport applicants. They added that birth certificates present an exceptional challenge to fraud detection efforts, as there are currently thousands of different acceptable formats for birth certificates. Further, they indicated that there are difficulties with verifying the authenticity of drivers’ licenses. Moreover, they said that although State attempts to verify SSN information submitted on passport applications on a daily basis with SSA, the results of this data- sharing process are imperfect. For example, State officials said that many of the mismatches identified through this verification process are actually due to typos or other common errors. However, they said that while these data checks may not identify all cases in which an applicant’s data do not match the information in SSA’s records, in some instances—such as cases in which an SSN is tied to a deceased individual—investigators from the Passport Fraud Branch of State’s Bureau of Diplomatic Security will attempt to check publicly available databases to resolve the mismatch. State officials acknowledged that they have issued other fraudulently obtained passports but did not offer an estimate of the magnitude of the problem. In order to improve State’s current passport fraud detection capabilities, officials said that State would need greater cooperation from other agencies at both the federal and state levels, and the ability to access other agencies’ records in real time. Subsequent to our briefing, State officials informed us that they identified and revoked our four fraudulently obtained U.S. passports, and that they would study the matter further to determine what steps would be appropriate to improve passport issuance procedures. We did not verify the accuracy of these State officials’ statements. We also briefed a representative of USPS on the results of our investigation, who did not offer any comments at the time of our briefing. We are sending copies of this report to the Secretary of State and other interested parties. The report will also be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report.

Summary: A genuine U.S. passport is a vital document, permitting its owner to travel freely in and out of the United States, prove U.S. citizenship, obtain further identification documents, and set up bank accounts, among other things. Unfortunately, a terrorist or other criminal could take advantage of these benefits by fraudulently obtaining a genuine U.S. passport from the Department of State (State). There are many ways that malicious individuals could fraudulently obtain a genuine U.S. passport, including stealing an American citizen's identity and counterfeiting or fraudulently obtaining identification or citizenship documents to meet State requirements. GAO was asked to proactively test the effectiveness of State's passport issuance process to determine whether the process is vulnerable to fraud. To do so, GAO designed four test scenarios that simulated the actions of a malicious individual who had access to an American citizen's personal identity information. GAO created counterfeit documents for four fictitious or deceased individuals using off-the-shelf, commercially available hardware, software, and materials. An undercover GAO investigator then applied for passports at three United States Postal Service (USPS) locations and a State-run passport office. GAO's investigation shows that terrorists or criminals could steal an American citizen's identity, use basic counterfeiting skills to create fraudulent documentation for that identity, and obtain a genuine U.S. passport from State. GAO conducted four tests simulating this approach and was successful in obtaining a genuine U.S. passport in each case. In the most egregious case, an undercover GAO investigator obtained a passport using counterfeit documents and the Social Security Number (SSN) of a man who died in 1965. In another case, the investigator obtained a passport using counterfeit documents and the genuine SSN of a fictitious 5-year-old child GAO created for a previous investigation--even though the investigator's counterfeit documents and application indicated he was 53 years old. All four passports were issued to the same GAO investigator, under four different names. In all four tests, GAO used counterfeit and/or fraudulently obtained documents. State and USPS employees did not identify GAO's documents as counterfeit. GAO's investigator later purchased an airline ticket under the name used on one of the four fraudulently obtained U.S. passports, and then used that passport as proof of identity to check in to his flight, get a boarding pass, and pass through the security checkpoint at a major metropolitan-area airport. At a briefing on the results of GAO's investigation, State officials agreed with GAO that the investigation exposes a major vulnerability in State's passport issuance process. According to State officials, State's fraud detection efforts are hampered by limitations to its information sharing and data access with other federal and state agencies. After GAO's briefing, State officials notified GAO that they identified and revoked GAO's four fraudulently obtained U.S. passports, and were studying the matter to determine the appropriate steps for improving State's passport issuance process.