HERITAGE FOUNDATION REAL ID

As Acting Executive Director of the Utica Colleges Center for Identity Management and Information Protection and on behalf of the faculty of the Center for Economic Crime and Justice Studies at Utica College, I would like to express my great appreciation to the Heritage Foundation for being invited to participate in this panel on Real ID. I come here not as an advocate for Real ID, but, really, as an advocate for victims of identity theft and identity fraud. I am here to lend my perspective as a criminologist, one who has studied identity theft, how it is committed, who commits it and the effectiveness of law enforcement efforts to control it. In his press conference last week, Homeland Security Secretary Chertoff, explained that the introduction of REAL ID is dedicated to addressing 3 major societal concerns in the U.S. the use of falsified drivers licenses as a means toward committing acts of terrorism, illegal immigration and identity theft. I will limit my comments to that last concern ID theft. It is a critical concern because of what criminological researchers, like me, now know about how ID thefts are committed and the role that fake drivers licenses play in many of these acts. In 2007, Utica College and CIMIP received a grant from the U.S. Bureau of Justice Assistance to conduct the very first empirical study of ID theft criminal cases in the U.S. (p) The U.S. Secret Service permitted Utica College researchers to examine and analyze 517 closed ID theft case files stretching from the year 2000 through 2006 to synthesize information on offender, offense and case process variables. The primary objective of this study was to use this information to facilitate a better understanding of ID theft patterns and trends, and to apply that information to the enhancement of ID theft control efforts, nationwide. Our report on the research was released a little over 2 months ago and afforded some fresh insights into the world of ID thieves. Some of the study findings raised some eyebrows at the time For example: Most of the victims (close to 60%) did not know the offenders; the Internet and other technological devices were used in the commission of half of the cases; Over 1/3 of the cases originated at the place of employment of the offender in which the offender stole personal ID information of others; While most of the ID thefts were committed by individuals acting alone, 42% involved organized crime activity that ranged from 2 to 45 individuals working in ID rings; and the median actual dollar loss for these cases was $31,356 with the loss amount rising in tandem with the number of offenders involved in the rings. The largest single loss for one case was over $13 million. For the Centers original report, we focused on a limited number of variables. In investigative cases notes, the use of fake drivers licenses along with the use of other falsified identification cards was noted but we had not set these means to committing ID

theft as a specific variable. That was until I received a request from Mike Kangior of DHS to take a second look at the data to pin down the exact role of fake drivers lic. and the importance of that role to successful ID theft. So we isolated instances of use of drivers lic. and, I have to say, it was now my eyebrows that raised a bit, for the data revealed that the creation, use, and sale of falsified drivers lic. figured prominently in the commission of ID theft in 35% of the ID theft cases. A preliminary analysis of the entire population of case notes for the 517 closed cases revealed that in 181 of the cases (35%), counterfeit drivers licenses were used in the commission of identity theft. In each of these cases, offenders were found to be in possession of counterfeit drivers licenses that they had either 1) created themselves, 2) had other offenders create or 3) had purchased from other offenders. These drivers licenses were generated through the theft of personal information from private citizens and were then, in turn, used as the source information for fake drivers license creation to perpetrate the commission of fraudulent acts.

A more detailed qualitative analysis of a sample of the 517 cases (all closed cases from the years 2000, 2001 and 2002 71 cases) provided some further insight into these cases. The common identity theft case in which counterfeit drivers licenses were used to commit fraud had the following characteristics 1) involvement of 2 or more offenders acting in concert, 2) the creation and use of multiple counterfeit drivers licenses (often from different states, 3) the use of the counterfeit drivers licenses to purchase business credit cards, open new bank accounts and/or to write counterfeit checks, and finally 4) the involvement of at least one insider from an organization/agency who provided the seed personal information needed as a source for the creation of the counterfeit licenses. While most of these cases should not be characterized as sophisticated organized crime cases, they can be said to be examples of organizational crime in that the cases usually involved several co-conspirators who developed a system in which personal information was stolen in order to produce counterfeit drivers licenses. The counterfeit drivers licenses would serve as a catalyst to a chain of events in which offenders would use the fake licenses as authentication for the opening of bank accounts and the purchase of credit cards used to commit fraud. While the original methods of personal identification theft could be quite primitive (e.g., dumpster diving, mailbox theft), a reoccurring characteristic in drivers license identity theft cases involved an insider with access to personal identification through employment. In some cases, the insider was an employee of an organization with direct access to personal information of customers/clients/patients (e.g., banks, hospitals, telecommunication firms) who participated in the actual acts of identity fraud as part of a conspiracy or ring. In other cases, the insider did not participate in the identity fraud acts directly, but sold the information to facilitate the creation of the fake drivers licenses (e.g., employees of automobile dealerships). In either scenario, the

personal information stolen was converted, directly, into the manufacturing of counterfeit drivers licenses to be used for identity fraud. Now who exactly are these people who commit ID theft and why do they rely on the falsification of drivers lic. to ply their criminal trade. Although their methods of getting access to personal information may vary, they all are criminal opportunists looking for the opportunity that is easiest to convert that information to profits. Some created drivers lic. themselves with software and materials like paper and ink purchased from office supply stores. Others knew individuals who specialized in creating fake drivers lic. and sold their specialized services. Although efforts to make it more difficult to falsify drivers lic. make it more time-consuming to override those improvements, offenders seem to be able to develop the technical skills needed to be successful in using fake drivers lic. to commit ID theft. Law enforcement efforts to control identity theft have been sustained and impressive on local, state and federal levels. However, these efforts tend to focus on the identity theft act after it has occurred through strong investigative techniques, prosecution and punishment. Clearly, there is a need to aggressively address the problem from a wide-scale prevention mode. As a society, we need to do more to limit the sheer anguish of ID theft victimization experienced by private citizens and the effect it can have on businesses and on entire economy. We need to be actively searching for the answer to preventing these crimes. Is Real ID that answer? I am a criminologist not a policymaker. I can tell you that, conceptually, it has all the markings of being a step in right direction. It is a bold step, and it has stirred some heated debates. But, sometimes dire societal problems like the prevalence of ID theft call for such bold steps. If effectively implemented, this may be the right step at the right time. Only time will tell.