Driver licenses have become widely accepted identity documents because they generally include features that make them difficult to counterfeit or alter and may contain identifying information such as the licensees’ legal name, photograph, physical description, and signature. Currently, about 188 million drivers are licensed in the United States, and states issue an additional 73 million licenses and identification cards each year. Individuals can apply to obtain licenses at about 3,800 locations across the United States. Authority for designing and administering driver licensing programs, as well as for verifying the identity information of licensees, lies with individual states. Accordingly, driver licensing agencies face the challenge of determining whether the identity documents individuals provide (1) are authentic and contain information that agrees with the issuing agency’s records and (2) actually belong to the person presenting them. To promote uniformity among driver licensing programs, AAMVA provides states with guidance on documents it recommends as acceptable proof of identity, as well as best practices for verifying the documents. Not surprisingly, the SSN is key to any verification process because each SSN is unique to its owner. In February 2002, we reported that 45 states collect SSN information from driver license applicants. Individuals obtain SSNs by applying to SSA and providing evidence of their age, identity, and U.S. citizenship or lawful alien status. As the agency responsible for assigning SSNs and issuing social security cards, SSA provides a service to the states to verify those numbers. SSA provides two methods for driver licensing agencies to verify SSNs: batch and on-line. States use the batch method to submit an aggregate group of SSN requests directly to SSA, and SSA generally responds within 24 to 48 hours. Those states using the on-line method submit individual SSN requests and receive immediate “real time” responses from SSA. On-line users transmit and receive information to and from SSA through a network maintained by AAMVA. SSA charges states a fee to cover its costs (basically system processing and personnel) for providing this service. Batch users pay $0.0015 per transaction while on-line users are charged $0.03 per transaction. For fiscal year 2002, the total billings for batch and on-line users were about $39,000 and $193,000, respectively. SSA collects payments directly from the batch users, while it bills and collects payments from the on-line users through AAMVA. SSA followed Privacy Act requirements in deciding what information it would disclose to driver licensing agencies. Under its current disclosure policy, if the SSN, name, and date of birth submitted to SSA by a driver licensing agency match SSA’s records, SSA will verify the match to the state driver licensing agency. If one or more elements do not match, SSA will inform the agency of the nonmatch but will not disclose further information. match only establishes that the information agrees with SSA’s records and is not proof that the individual using the SSN is the person to whom SSA assigned the number. Beyond SSA’s verification service, the federal government plays a role in several other key areas of states’ driver licensing programs. For example, within the Department of Transportation (DOT), the National Highway Traffic Safety Administration (NHTSA) operates the National Driver Register (NDR), a national database containing identity information on 39 million problem drivers that states are required to use when making licensing decisions. Also, to remove unsafe commercial drivers from the highways, the federal government established the Commercial Drivers License Information System (CDLIS), a nationwide database of 11 million records that states must use to exchange information on applicants who may hold commercial licenses in other states or have driving infractions that make them ineligible for licensing. DOT, the federal agency charged with establishing the CDLIS database, contracts with AAMVA to operate it. The federal government also provides grants to help states improve their highway safety programs. Furthermore, states’ receipt of federal funds for their state child support enforcement programs are contingent on the collection of individuals’ SSNs during the driver licensing process. This provision enables licensing agencies to assist states in locating and obtaining child support payments from noncustodial parents. Twenty-five states have used either the batch or on-line verification method and the extent to which they regularly use the on-line service varies. States that used the batch method generally use it for a short period then switch to the on-line process exclusively. Although states’ use of SSA’s on-line service has increased steadily over the last several years, 5 states submitted over 70 percent of all on-line verification requests. Factors such as cost, system performance, and individual state priorities play a role in determining whether states opt to use SSA’s verification service and the frequency in which it is used. As of March 2003, driver licensing agencies in 25 states have used the batch or on-line method to verify SSNs with SSA. States generally use the batch method for a short-term period, but states are more likely to use the on-line service on a continuous basis. About three-fourths of the states that rely on SSA’s verification service used the on-line method or a combination of the on-line and batch method, while the remaining states used the batch method exclusively. (See fig. 1.) Over the last several years, states estimated submitting over 84 million requests to SSA using the batch method. Similarly, states submitted a total of 13 million requests using the on-line method. Two-thirds of these on-line requests were submitted in the last 2 fiscal years. SSA officials told us that the batch method offers advantages in circumstances where a real-time verification response is unnecessary. For example, some states have used the batch method to “clean-up” SSNs in their existing records and address any discrepancies prior to the license coming due for renewal at a later date. A number of states that have used the batch method in this manner subsequently used the on-line method exclusively. For example, one state that used the batch method in 2001 to verify over 8.3 million existing records has since used the on-line method exclusively. SSA officials noted that only one state currently uses the batch method on a continuous basis to verify SSNs for all of its customers. For states that issue permanent licenses on the spot, the on-line service also offers an advantage, namely, the ability to instantly verify the SSN and other key information submitted by individuals seeking initial licenses, as well as those converting out-of-state licenses. Between fiscal years 1998 and 2002, the number of states participating in SSA’s on-line service grew by about 3 states each year. As shown in figure 2, the volume of on- line verification requests processed by SSA has also increased significantly from 300,000 in fiscal year 1998 to 5.5 million in fiscal year 2002. Although the volume of on-line requests grew between 1998 and 2002, usage varied significantly among states and within individual states from year to year. As shown in figure 3, 5 states accounted for over 70 percent of the total transactions over a 5-year period, and a single state was responsible for submitting about one-third of the total transactions. In addition, in some states, the use of the on-line service varied from year to year. For example, one state sent in about 250,000 requests in 1 year and about half that number the following year. Various factors—such as costs, performance problems, and state priorities—may affect states’ decisions about whether or not to use SSA’s verification service. The nonverifying states we contacted frequently cited cost as a reason why they did not use SSA’s verification service. In addition to the per-transaction fees that SSA charges, states may incur additional costs to set up and use SSA’s service, including the cost for computer programming, equipment, staffing, training, and so forth. State estimates associated with establishing an on-line SSN verification process with SSA varied considerably based on factors such as the system modifications they planned to make. For example, one state we contacted estimated that it would cost approximately $770,000 to implement the on- line service. Another state estimated that using the on-line service would have a start-up cost of about $230,000. Many nonverifying states we contacted expressed a reluctance to use SSA’s verification service based on performance problems they had heard were encountered by other states. Some states cited concerns about frequent outages and slowness of the on-line system. Other states mentioned that the extra time to verify and resolve SSN problems could increase customer waiting times because a driver license would not be issued until verification was complete. States’ decisions about whether to use SSA’s service, or the extent to which to use it, are also driven by internal policies, priorities, and other concerns. For example, some of the states we visited have policies requiring their driving licensing agencies to verify all customers’ SSNs. Officials in one of these states acknowledged that the growing prevalence of identity theft and the events of September 11, 2001, directly affected their decision to begin using SSA’s service. Conversely, another state we visited that had submitted only 51 transactions over a 3-year period told us that it was delaying full use of SSA’s service until spring 2003 to coincide with the roll-out of its new driver-license issuance system. Finally, we found that states may limit their use of the on-line method to certain targeted populations. For example, one state reported that its policy was to use the on-line method only if fraud was suspected, while another used the service only for initial licenses and out-of-state conversions, but not for renewals of in-state licenses. Weaknesses in the design and management of SSA’s on-line verification service have contributed to capacity and performance problems and ultimately limited its usefulness. SSA recently took steps to increase systems capacity and to give more management attention to the service; however, problems remain. In designing the system, SSA used an available infrastructure and encountered capacity problems early on. Although the problems worsened after the pilot phase, SSA did not monitor or modify the system to improve its performance. Beyond system design problems, SSA’s day-to-day management of the service has also been problematic. This lack of management attention to the service is evidenced by the fact that SSA has failed to bill and collect in a timely fashion more than $370,000 from AAMVA over the last several years. SSA officials have taken some steps to address system capacity problems, but the agency still lacks key performance goals for the on-line service. Despite an increased focus on daily management and oversight of the service, SSA still has not addressed other problem areas such as a high nonmatch rate or states’ vulnerability to fraud associated with individuals who use the SSNs of deceased individuals to obtain licenses. These issues may affect states’ willingness to use the service and expose them to a higher risk of fraud. Weaknesses in the design and management of SSA’s on-line system have contributed to capacity and performance problems. In designing the system, SSA connected its server to AAMVA’s network, to which driver licensing agencies across the country were linked. SSA connected the two systems using a low-speed data communication line. In 1997, SSA piloted the on-line service with three states participating. A joint SSA and AAMVA evaluation of the pilot estimated that the on-line service could verify 43,200 requests in a 12-hour period or 12.5 million per year. It was also estimated that states would submit 7.7 million requests in 1998. While the system experienced some problems during the pilot—such as slow response times and outages—SSA expressed confidence that its system would be sufficient to handle all requests. SSA acknowledged that only limited capacity testing was done. However, SSA planned to monitor the system’s performance as needed to ensure it could meet states’ needs. Following the pilot phase, problems worsened as more states began using SSA’s service. AAMVA’s data show that in 1999 the system experienced an average of three major outages per month, increasing to an average of five per month in 2000. More recent AAMVA data showed that from August 2002 through March 2003, outages continued to occur frequently and lasted from about 30 minutes to as long as 1 day. Such outages can affect customer service because employees in one state told us that when the service is down, they cannot process customers’ transactions. However, because SSA did not collect or monitor performance data on response times and outages, SSA did not know the magnitude or specifics of the problem. The capacity problems inherent in the design of the on-line system have affected states’ use of SSA’s verification service. Officials in one state told us that they have been forced to scale back their use of the system because they were told by SSA that the volume of transactions was overloading the system. In addition, AAMVA representatives told us that because of concerns about performance and reliability, they have not allowed new states to use the service since the summer of 2002. At the time of our review, 10 states had signed agreements with SSA and were waiting to use the on-line system, and 17 states had received funds from DOT for the purpose of verifying SSNs with SSA. It is uncertain how many of the 17 states will ultimately opt to use SSA’s on-line service. However, even if they signed agreements with SSA today, they may not be able to use the service until the backlog of waiting states is addressed. In addition to design weaknesses, SSA did not sufficiently focus on the management of its service. In particular, SSA previously lacked a designated person to oversee the day-to-day operations of the service and to coordinate with AAMVA on various management issues. As a result, AAMVA lacked a focal point within SSA to resolve persistent performance problems that arose with the system. AAMVA officials told us they would start by calling SSA’s general help desk, as directed by SSA, but would end up calling several different components within the agency. This situation impeded the timely and effective resolution of problems necessary to meet states’ verification needs. SSA’s lack of management attention to the service is also evidenced by the fact that the agency failed to timely bill and collect fees from AAMVA over the last several years. Each year SSA is required to reach agreement with AAMVA on the per transaction cost of its service. However, for several years SSA and AAMVA have not done this. Under the agreement, SSA is also required to send AAMVA a final billing each year based on the number of transactions processed. SSA billed and collected payments from AAMVA for the first 2 fiscal years—1997 and 1998. However, between fiscal years 1999 and 2002, SSA failed to bill and collect more than $370,000 it calculated as being due from AAMVA. SSA and AAMVA officials have acknowledged problems stemming from the design and management of the on-line service and have made some necessary improvements. For example, according to SSA, in April 2003 the service began using software that AAMVA recently revised to increase the volume of transactions states could submit and receive through AAMVA’s network. About the same time, SSA completed an upgrade of its data communication line and server to enhance its system capacity and response time. SSA officials told us these upgrades should reduce outages and enhance performance. SSA provided us with information showing that in May 2003, 2 states had increased their volume of transmissions and an additional 3 states had begun using the service. SSA plans to add 4 new states that are currently testing the on-line system. AAMVA estimates that 2003 verification requests may increase to 28 million, more than five times the number received in 2002. Despite this projection, however, at the time of our review, SSA still had not established key goals for the level of service it will provide driver licensing agencies. SSA officials told us they are currently monitoring the volume of transactions and response times as new states are added. However, until SSA establishes key goals, the quality and effectiveness of SSA’s on-line service cannot be fully assessed. More recently, SSA also designated a project manager responsible for overseeing the day-to-day operation of its service, as well as an individual responsible for the billing and collection of AAMVA payments. At the time of our review, SSA had collected $330,000 from AAMVA for fiscal years 1999-2002. SSA officials told us that they are in the process of updating the cost estimates and payments for fiscal year 2003. Despite SSA’s recent efforts to focus more management attention on its verification service, problems regarding the high nonmatch rate and states’ continued vulnerability to fraud associated with the use of SSNs of deceased individuals by driver license applicants remain. These problems pose a concern for states because of the additional workloads associated with resolving discrepancies between SSA and states’ driver records as well as the potential for identity theft. SSA’s data over the last 5 years show that an average of 11 percent of all transactions submitted by states failed to verify with SSA’s records. Some states have experienced nonmatch rates as high as 30 percent. In fiscal year 2002, about 800,000 records failed verification. Generally, about one-half of these failed because the name submitted with the SSN did not match the name in SSA’s records. Such mismatches may occur, for example, if a person’s SSN record lists a maiden name, but the person is applying for a license under a married name. The states and AAMVA have voiced their concerns to SSA about the need for additional disclosure of information. In a May 2001 letter to one state, SSA’s Acting Deputy Commissioner specified the agency’s disclosure policy for driver licensing agencies and stated that SSA closely scrutinizes requests involving SSN use for purposes not related to the Social Security program. In doing so, SSA has decided to provide its verification service in a limited manner by informing driver licensing agencies which data elements match or do not match. State concerns about the potential workloads associated with resolving nonmatch issues may affect their willingness to fully use SSA’s service. Officials in one state told us that a planned start up of the on-line service may be delayed due to concerns about the high nonmatch rate they have experienced using SSA’s batch service. Officials in another state indicated that they have not done a batch clean up of their existing databases because they are unable to devote the additional funding and staff resources to address nonverification issues. SSA officials told us that they are aware of states’ concerns and have recently begun discussions to address disclosure issues with the states. In reviewing SSA’s verification service, we also identified a key weakness in the batch method that exposes states to a higher risk of fraud by allowing them to inadvertently issue licenses to individuals using the SSNs of deceased individuals. Unlike the on-line service, SSA does not match batch requests against its death records. As a result, the batch method will not identify and prevent the issuance of a license in cases where an SSN of a deceased individual is being used. SSA officials told us that they initially developed the batch method several years ago, and they did not design the system to match SSNs against its death files. However, a death match was built into the on-line system. At the time of our review, SSA acknowledged that it had not explicitly informed states about the limitation of the batch service. Our own analysis of 1 month of SSN transactions submitted to SSA by one state using the batch method identified at least 44 cases in which individuals used the SSN, name, and date of birth of persons listed as deceased in SSA’s records to obtain a license or an identification card. We forwarded this information to state investigators who quickly confirmed that licenses or identification cards had been issued in 41 cases and were continuing to investigate the others. To further assess states’ vulnerability in this area, our own investigators, working in an undercover capacity, were able to obtain licenses in two batch states using a counterfeit out-of-state license and other fraudulent documents and the SSNs of deceased persons. In both states, driver licensing employees accepted the documents we submitted as valid. Our investigators completed the transactions in one state and left with the new valid license. In the second state, the new permanent license arrived by mail within weeks. The ease in which they were able to obtain these licenses confirmed states’ vulnerability to accepting fraudulent documents, and for those states that use SSA’s batch process, to issuing licenses to individuals using SSNs of deceased individuals. SSA officials have told us that the agency has not made a decision about whether the current batch system will be modified to include a death match. Our field work shows that licensing officials in states that use or have used the batch process were often unaware that SSA did not match SSNs against its death records. As a result, these states lacked information that they could have used to make more informed decisions in choosing either the batch or on-line method or to seek alternative strategies to avoid issuing licenses to individuals using SSNs of deceased persons. Moreover, states that have used the batch method in prior years to clean up their records and to verify the SSNs of millions of driver license holders, may have also unwittingly left themselves open to identity theft and fraud. States may use tools beyond visual inspection to verify documents, but lack the ability to systematically exchange identity information on all drivers with other states. Although driver licensing agencies rely primarily on visual inspection of documents to verify applicants’ identity information, states may employ more extensive measures such as using independent sources to corroborate applicants’ identity information. Despite the extra measures, states remain vulnerable to identity fraud because they lack a systematic means to exchange information on all drivers. As a result, states may unknowingly accept false out-of-state licenses as valid identity documents or license individuals who use the identity information of others. In the states we visited, driver-licensing agencies rely primarily on visual inspection to determine the authenticity of documents provided by applicants. As proof of identity, applicants must present one or more state- approved documents that are generally inspected by staff. Applicants may present a variety of documents, such as a social security card, a U.S. birth certificate, a driver license from another state, or passport. For noncitizen applicants, staff also review a myriad of passports and U.S. immigration documents. In reviewing identity documents, staff look for security features such as watermarks and raised seals that are difficult to counterfeit and are designed to reveal evidence of tampering. They also inspect documents for other indications of authenticity such as signs of appropriate aging. If employees are unsure if a particular document is authentic or if it actually belongs to the applicant, they may use interviewing techniques to ensure that the individual can corroborate key information. In the states we visited, staff responsible for processing driver license applications generally received some training and basic assistance to support the visual inspection. For example, all of the states provided training to help employees distinguish between authentic and fraudulent documents. This generally occurred once or twice a year and was sometimes presented as part of a larger training module covering other policies and procedures of the agencies. In addition to training, office managers and supervisors with more experience in detecting false documents were available on site to help with the visual inspection if needed. In several states, supervisors and office managers told us that they have directly contacted issuing agencies to determine whether documents, such as birth certificates, were valid. However, this was not routinely done because it can be a time-consuming and labor-intensive process. Nearly every state we visited provided staff with some basic tools to help with the visual inspection, such as reference manuals describing the security features included in various state and federal government issued identity documents. Other tools such as black lights and magnifying glasses were also commonly available to help staff view the security features embedded in certain documents. However, we found that the extent to which staff actually used these tools varied. Despite the training and other measures to aid visual inspection, these approaches are often not enough for employees to make a definitive determination of a document’s authenticity. Staff and managers we interviewed frequently expressed concern that the variety of valid state birth certificates, social security cards, out-of-state licenses and immigration documents, made it extremely difficult to catch those that are forged, short of them being obvious fakes. They also frequently expressed a need for better access to automated means of verifying these documents. Because of the vulnerabilities associated with the visual inspection of documents, states employ more extensive safeguards to better deter and detect identity theft and fraud. These include seeking out independent third-party data sources to corroborate identity information and documents provided by driver license applicants, utilizing computer systems to strengthen the integrity of their licensing process, and using other innovative tools to better verify applicants’ identity information and deter fraud. At the time of our review, a number of states we visited were either using or pursuing the use of other tools to electronically verify identity information with issuing agencies and other independent third parties. Officials in several states we visited told us that they wanted access to the Department of Homeland Security (DHS) immigration information to verify the identity documents of noncitizen applicants. Further, a state with a large immigrant and noncitizen population had contracted with DHS to routinely authenticate immigration documents and other information relevant to a person’s citizenship and immigration status. A second state was in the process of negotiating access to these records. Statewide birth and death information was also viewed by state administrators as key to the identity verification process. Accordingly, several of the states we visited have periodically used electronic queries or data matches to access birth or death records. Three of the nine states we visited were pilot-testing or considering the use of private vendors to strengthen their identity verification and fraud detection procedures. These private vendors typically access various information sources, including civil and criminal records, credit information, address information, state driver records, and state birth and death data to help driver licensing agencies corroborate information provided by applicants and correctly issue licenses. At the time of our review, one state was pilot-testing on-line access to a private vendor in a limited number of sites. AAMVA officials did not have national data on the extent to which other states are using innovative third-party verification tools to strengthen the integrity of their licensing procedures. However, they generally noted that such practices are not routinely used to supplement states’ primary practice of visually inspecting documents. Several states we visited made extensive use of computer systems to prevent identity theft and fraud. Several states have computer systems capable of screening for multiple individuals in their state with the same or similar identity information. For example, one state’s computer system automatically cross-matches first-time applicants’ personal information against existing driver records in the database to search for such situations. When states do not have the capability to routinely perform such cross-matches, employees may inadvertently issue licenses to individuals who may be using the identity information of someone the state has previously licensed. Some states’ computer systems are designed to prevent the issuance of a license in certain high-risk situations. For example, one state’s system terminates the processing of a transaction if identity information does not verify with SSA, or if staff attempt to by-pass this verification step. Staff are also prevented from overriding the system and issuing the license unless an authorized person—generally a higher-level official—intervenes. Similarly, some states had systems that could prevent issuance of a license if an individual’s personal information already existed in the states’ driver records, or DHS information failed to verify. Further, in cases where fraud is suspected, most states’ systems—although not all—are capable of flagging the transaction and automatically transmitting this information to other offices within the state to prevent persons from “shopping” sites once they were denied at the first location. Officials in one state that lacked this protection told us that in cases of suspected fraud, staff relied on manual processes such as telephone calls and e-mails to alert other offices about suspicious individuals and false documents. Finally, to varying degrees, the states we visited have instituted additional controls to better address identity theft and fraud issues. Due to concerns about the quality and integrity of other state licensing systems, three states prohibit or limit the acceptance of out-of-state licenses as a sole or primary identity document. Officials from another state told us that they would not accept such documents from 20 states that they have determined to have less stringent verification processes. A few other states have also instituted policies requiring that two employees review or sign-off on the authenticity of documents provided by applicants before a license can be issued. This separation of responsibilities provides for additional scrutiny of documents and may act as a further check against employee fraud. Another common practice among several states was to copy all identity documents if during the application process, fraud was suspected. This provides the licensing agency with key information for investigating the individual’s alleged identity. An official in one state told us that staff are trained to collect and copy identity documents upfront regardless of whether fraud is suspected at the time. All nine states we visited also store and transmit information such as digital photographs and signatures for verification purposes. Two states also captured fingerprints at the time of application, but only one of them used biometric technology to electronically verify this identity information for individuals renewing licenses. Another safeguard used by two states is the issuance of temporary licenses when identity information has not been corroborated at the time of application. Such licenses lack photographs and security features common to permanent licenses or clearly state that they are not valid for identity verification purposes. However, a third state’s temporary license looks the same and includes identical information as its permanent license. As a result, this license could continue to be presented as an identity document by individuals even if the circumstances under which it was issued are ultimately determined to be fraudulent. Despite the additional safeguards taken by some states, licensing agencies lack a systematic means to exchange information on all drivers nationwide, limiting their ability to deter identity theft and fraud. Currently, states have automated access and are required to use the NDR, which is a DOT database of 39 million problem drivers. With this system, licensing agencies have the ability to simultaneously query all 50 states to determine whether an applicant’s name appears in the database. For commercial drivers, states obtain information on their licensing, identification, and disqualification from the CDLIS database of 11 million records. States are required to input driver information into CDLIS and to use the system to verify commercial driver record information during the licensing process. Because the NDR and CDLIS target specific driver populations and do not include the records and identity information of the approximately 188 million drivers operating in the United States, state driver licensing agencies lack a single inquiry process to determine whether or not a person has ever been issued a license. Numerous officials in the states we visited told us that having a more efficient means of electronic interstate communications, that included the electronic transfer of identity information such as digital photographs and signatures, would improve the integrity of their licensing process. Officials in the states we visited were particularly concerned about individuals using licenses issued by other states as identity documents and their inability to quickly query all states’ databases to corroborate key information. As a result, states are limited in their ability to determine whether other states’ identity documents are authentic or to identify multiple individuals using the same personal identifying information in other states. Our analysis of one state’s data demonstrates the potential vulnerabilities driver licensing agencies currently face when accepting out-of-state licenses as proof of identity. We examined data from one state’s internal state cross-match of its existing driving records and identified numerous instances where the same out-of-state license number had been used by multiple individuals with different names and dates of birth to apply for and obtain a new license. We forwarded about 100 of these license numbers to the alleged issuing state and asked them to provide us with key information on the owner of record. We found 96 cases of potential identity fraud involving 52 of the driver licenses numbers. For example, states reported some license numbers as invalid or as being issued to someone other than the persons that had used them. One state reported back that the license number we submitted to them was actually a zip code, rather than a genuine state-issued license number. Another license was reported by the issuing state to be a valid number that had been counterfeited and used in several states. A July 2001 report to the Congress prepared by DOT in cooperation with AAMVA, identified alternatives to improving state data exchanges and discussed various options for change. The specialized nature of NDR and CDLIS does not allow states to verify licenses for all drivers—a means to identify potential identity fraud. However, the report concluded that an alternative system encompassing all driver records could operate efficiently using existing programs developed for CDLIS and on hardware that is currently in use. However, the report also concluded that before such a system could be developed, several potential obstacles should be addressed. These include agreeing on the use of a unique identifier by which to query all state driving records, ensuring that all states participate, defining the role of the federal government, and funding the costs of developing and converting to an all-driver system. The report also acknowledged that state resources for development and implementation would be necessary to cover projected costs, which AAMVA has estimated to be about $78 million over 3 years. However, the report concluded that, once operational, user fees similar to those imposed for CDLIS could be levied by states to cover operational expenses. The driver license is a key identity document that can be used by individuals to obtain a range of public and private services nationwide. Accordingly, state driver license agencies face a daunting task in ensuring that the identity information of those to whom they issue licenses is verified. However, states’ effectiveness in this area is often dependent on several factors, including the receipt of timely and accurate identity information from SSA, the extent to which they implement additional identity verification and fraud detection tools, and their ability to quickly and systematically share key driving record information with other state licensing systems. Deficiencies in any of these areas may weaken states’ efforts to ensure the integrity of their licensing decisions. Unfortunately, design and management weaknesses associated with SSA’s verification service have limited its effectiveness. States that are unable to take full advantage of the service and others that are waiting for the opportunity to use it remain vulnerable to identity theft and fraud. SSA’s recent efforts to refocus management attention on improving its service represents a positive step and may be key to moving more state licensing agencies away from processes that rely heavily on fraud-prone visual inspections of identity documents, to one in which information such as an individual’s SSN, name, and date of birth can be quickly and independently corroborated. However, sustained attention to improving its service is needed. Furthermore, states that continue to rely primarily or partly on SSA’s batch verification service still risk issuing licenses to individuals using the SSNs and other identity information of deceased individuals. This remains a critical flaw in SSA’s service and states’ efforts to strengthen the integrity of the driver license. Since September 11th, more state driver licensing agencies have begun to reassess their prior view that driver licenses are simply an authorization to operate a motor vehicle and have taken aggressive actions to strengthen the integrity of this important identity document. However, licensing programs remain state-administered and may vary considerably in the tools provided to front-line staff to verify identity information, such as access to automated independent third-party data sources. This has potentially serious consequences for the numerous public and private sector service providers who rely on the driver license as an identity document, but may be unaware that not all states’ licenses are equal in terms of the integrity of the identifying information included on them. Beyond the actions taken by individual states, coordination and data sharing is key to addressing many of the factors that allow identity theft and fraud to continue in the driver licensing process. No single state has overarching authority to require information sharing nationwide, define minimum standards for proof of identity, or mandate the development of a systematic means for interstate communication. However, cooperative efforts between the federal government, the states, and AAMVA have identified and facilitated technological options for improving the exchange of driver record data among all states. We recognize that potential barriers related to system’s design, funding, privacy rights, and states’ willingness to use such a tool have yet to be fully resolved. However, given the potential economic and national security implications associated with identity theft at the point of driver licensing, sustained leadership at the federal level could be the catalyst for needed change. In light of the homeland security implications associated with states’ inability to systematically exchange driver license identity information and the need for sustained leadership in this area, the Congress, in partnership with the states, should consider authorizing the development of a national data sharing system for driver records. Considering the significant increase in the number of on-line requests that SSA anticipates receiving from states, as well as the weaknesses that we identified in SSA’s service that may increase states’ vulnerability to identity fraud, we recommend that the Commissioner of Social Security take the following actions: Develop performance measures essential to assessing the quality of the service provided. Develop a strategy for improving the nonmatch rate for SSA’s verification service. This should include identifying additional information it can reasonably and legally disclose to state driver-licensing agencies as well as actions states can take to prevent nonmatches. Modify SSA’s batch verification method to include a match against its nationwide death records. We obtained written comments on a draft of this report from the Commissioner of SSA. SSA’s comments are reproduced in appendix II. SSA also provided additional technical comments, which we incorporated in the report as appropriate. We also requested that AAMVA officials review the technical accuracy of our discussion of AAMVA’s role in the SSN verification process, as well as our characterization of states’ identity verification and fraud prevention activities. We incorporated AAMVA’s comments in the report as appropriate. SSA generally agreed with our findings regarding its SSN verification service and said that recent improvements have increased states’ use of the service. The agency noted that it is continuing to investigate the sequence of events surrounding our ability to obtain driver licenses with counterfeit documents and the SSNs of deceased individuals. SSA also said that its service only offers confirmation that SSNs and other identity information provided by driver license applicants are consistent with its records and should not be perceived as a means for verifying identity. Also, SSA said that any attempts to reduce the nonmatch rate for its service by relaxing the match criteria would be inconsistent with the need for “tighter match requirements” and increased security in the post 9/11 era. We agree that SSA’s service does not allow states to definitively determine the identity of driver license applicants and have made small changes to ensure that our report will not be misinterpreted. However, we continue to believe that the verification service, in combination with other verification tools used by the states, is key to corroborating the identity information presented by driver license applicants. We also are not suggesting that SSA compromise the integrity of its verification service in order to reduce the nonmatch rate. However, our report shows that about half of all verification failures are for name mismatches. Such mismatches are thought to commonly occur due to changes in marital status. We continue to believe that opportunities exist for SSA to work with the states to explore options for addressing this issue and to ultimately improve the overall quality of its service. In response to our specific recommendations, SSA disagreed that it should develop measures for assessing the quality of its SSN on-line verification service. Instead, SSA said that it plans to develop a performance baseline for enumeration accuracy to measure whether applicants were entitled to receive an SSN based on supporting documentation. SSA did not believe that developing performance measures specifically for its verification service would result in improved identity authentication. However, we continue to believe that the verification service, in combination with other tools used by the states, is key to corroborating driver license applicants’ identity information. As our report notes, performance concerns and issues often affected the extent to which states used SSA’s verification service, or whether they opted to use the service at all. Thus, some states lacked a key tool for corroborating the identity information of driver license applicants. We continue to believe that SSA should develop measures for its service to monitor and assess systems availability, outages, response times and other key aspects of performance. Without such measures, SSA lacks a means to identify performance problems and take corrective actions when needed. SSA agreed with our recommendations that it develop a strategy for improving the nonmatch rate for its service and that it modify the batch process to include a match against its death records. However, the agency said that factors such as legal restrictions on the information it may disclose to states and limited systems resources could restrict the actions it can take. Indeed, we encourage SSA to work within the existing law to develop policies to reduce nonmatches and to better assist states when they occur. Also, in view of states’ vulnerability to licensing individuals using deceased persons’ SSN information and the volume of batch verification requests submitted to SSA by the states, we believe immediate action is needed. We are sending copies of this report to the Commissioner of SSA and other interested parties. Copies will also be made available to others upon request. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you have any questions concerning this report, please call me on (202) 512-7215. The major contributors to this report are listed in appendix III. This appendix provides additional details about our analysis of the Social Security Administration’s (SSA) verification services and states’ practices for verifying the identity of driver license applicants. To attain our objectives, we obtained and reviewed various reports related to the issue of identity verification from state auditors, SSA’s Office of Inspector General, and the American Association of Motor Vehicle Administrators (AAMVA). We reviewed federal requirements governing social security number (SSN) use in the driver licensing process, SSA’s policies for disclosing identity information to licensing agencies, and numerous verification agreements between SSA and the states. We analyzed nationwide data on states’ use of SSA’s verification service, including the volume of records submitted, trends in usage, and the rate at which SSNs failed to verify between October 1997 through May 2003. We interviewed SSA officials responsible for the SSN verification data with regard to the reliability of the data, and determined the data to be sufficiently reliable for our reporting purposes. We telephoned or visited states that were not using SSA’s service to obtain general information about their identity verification practices, as well as their plans for using SSA’s service in the future. To obtain more specific information on the design and management of SSA’s batch and on-line verification service, we interviewed key SSA line and management officials as well as AAMVA officials responsible for co- managing the on-line service. We also reviewed an SSA/AAMVA evaluation of a pilot of the on-line method. To determine batch service states’ vulnerability to individuals who may use deceased persons’ SSNs to obtain a license, we matched approximately 500,000 batch verification requests submitted by one state for the month of December 2002 against SSA’s Master Death file. We identified 44 instances in which SSA verified an SSN submitted by the state that matched an SSN in the death record where the death occurred before December 2002. In order to determine whether these individuals actually received a license or identity card, we submitted the 44 cases to the state licensing agency for its review. The state officials confirmed that licenses or identification cards had been issued in 41 cases and are currently reviewing the remaining cases. Because we selected a judgmental sample of cases to review, our findings are not generalizable to the entire state over time or to any other state. To gain more in-depth information on specific challenges states may encounter in their efforts to verify applicant identity documents, as well as their policies and procedures for doing so, we conducted field work in California, Florida, Georgia, Maine, Maryland, Massachusetts, Ohio, Pennsylvania, and Tennessee. At these locations we interviewed key management and line staff and obtained data and documents relative to their verification processes and tools. We selected states that were geographically dispersed to obtain a mix that (1) did, and did not, issue temporary licenses before issuing permanent licenses, and (2) have, and have not, used one or both of SSA’s verification services. We also chose some states that had large immigrant populations or were identified as using innovative practices to verify identity. We also interviewed and obtained information from representatives of private businesses that offer commercial services to assist driver licensing agencies in verifying identity information. Finally, to assess states’ vulnerability to accepting fraudulent out-of-state driving licenses as an identity document, we used one state’s listing representing numerous instances where the same out-of-state license number was used multiple times to obtain a license in another state. We selected about 100 cases where the name and date of birth of the individual were clearly different from one record to the next and submitted about 100 of them to the original issuing states. We obtained information from the states identifying the name and date of birth of the owner of the driver license to determine whether there was possible identification fraud. We conducted internal reliability checks for data received from state driver licensing agencies. Because we selected a judgmental sample of cases to review, our findings are not generalizable. We conducted our work from July 2002 through May 2003 in accordance with generally accepted government auditing standards. In addition to those named above, the following team members contributed to this report throughout all aspects of its development: Raun Lazier, Caterina Pisciotta, and Dorothy Yee. In addition, Daniel Schwimer, Mary Dorsey, Shana Wallace, Raymond Wessmiller, and Corrina Nicolaou made contributions. Social Security Numbers: Ensuring the Integrity of the SSN. GAO-03- 941T. Washington, D.C.: July 10, 2003. Social Security Numbers: Government Benefits from SSN Use but Could Provide Better Safeguards. GAO-02-352. Washington, D.C.: May 31, 2002. Social Security Numbers: SSNs Are Widely Used by Government and Could Be Better Protected. GAO-02-691T. Washington, D.C.: April 29, 2002. Child Support Enforcement: Most States Collect Drivers’ SSNs and Use Them to Enforce Child Support. GAO-02-239. Washington, D.C.: February 15, 2002. Responses to Questions From May 18th Hearing on Uses of Social Security Numbers. HEHS/AIMD-00-289R. Washington, D.C.: August 21, 2000. Social Security Numbers: Subcommittee Questions Concerning the Use of the Number for Purposes Not Related to Social Security. HEHS/AIMD-00-253R. Washington, D.C.: July 7, 2000. Social Security: Government and Other Uses of the Social Security Number are Widespread. GAO/T-HEHS-00-120. Washington, D.C.: May 18, 2000. Social Security: Use of the Social Security Number is Widespread. GAO/T-HEHS-00-111. Washington, D.C.: May 9, 2000. Social Security: Government and Commercial Use of the Social Security Number Is Widespread. GAO/HEHS-99-28. Washington, D.C.: February 16, 1999.

Summary: Since September 11, 2001, more attention has been focused on the importance of identifying people who use false identity information or documents to obtain a driver license. The Social Security Administration (SSA) offers states a service to verify social security numbers (SSNs) collected during the driver licensing process. This report examines states' use of SSA's verification service, factors that may affect the usefulness of the service, and other tools states use or need to verify identity. GAO found that 25 states have used either one or both of the methods SSA offers for requesting SSN verification. Over the last several years, states used the batch and on-line method to submit over 84 million and 13 million requests, respectively. Although on-line use has been increasing, usage varied significantly among states, with 5 out of 18 states submitting over 70 percent of all requests. States decide to use SSA's service based on various factors, such as costs and state priorities. Weaknesses in SSA's design and management of its SSN verification service have contributed to capacity and performance problems and limited its usefulness. While SSA recently increased systems capacity and reduced outages, problems remain. For example, the level of service cannot be assessed because SSA has not established key performance measures. States are concerned that the high verification failure rate adds to their workloads. Several states noted that some of the failures could be prevented if SSA disclosed more information to states. States using the batch method are vulnerable to licensing individuals using SSNs of deceased persons because SSA does not match requests against its death files. In fact, GAO obtained licenses using fraudulent documents and deceased persons' SSNs in 2 states. Driver licensing agencies rely primarily on visual inspection of documents such as birth certificates, driver licenses, and U.S. immigration documents to verify applicants' identity. While states may use safeguards beyond visual inspection to verify documents, they lack the ability to systematically exchange identity information on all drivers with other states. Without a means to readily share all driver records, states face a greater risk for identity theft and fraud in the driver licensing process. A recent Department of Transportation report to Congress identified options that would provide states a system for exchanging records on all drivers and could help mitigate identity fraud.