Driver's License Insecurity

A Terrorist's Back Door

By Janice Kephart September 2012

A Terrorist's Back Door

My mission in keynoting the ID Innovate conference was to explain why pursuing better identity technologies remains important to national security. Fraud still exists that needs to be countered, driver's license insecurity still raises national security concerns, and technology can play an important part in pushing identity security policy forward.

I spoke from the perspective as counsel to the 9/11 commission, where I did the investigative work on how the hijackers breached our immigration system and then embedded in the United States, including a key aspect of the embedding tactics: acquisition of state-issued IDs and driver's licenses.

I also spoke as one who has supported the 9/11 commission recommendation that state ID issuance processes need to be shored up, recognizing that terrorists use the same fraud that others do, and thus that securing ID systems against fraud is in itself taking a significant step in countering terrorist acquisition of IDs as well.

ID Acquisition Is a Terrorist Travel Tool

One of the key rules in terrorist travel is to get a government-issued ID. Why? IDs are essential for appearing assimilated, which is important for mission success.

9/11 Terrorist IDs. All four 9/11 pilots had Florida driver's licenses, including, of course, the operational leader and first World Trade Center pilot, Mohamed Atta. This is Florida's record of Atta's driver's license:

Eight other muscle hijackers had Florida IDs as well.

In sum, there were 30 state-issued IDs among the 19 hijackers:

  • 18 driver's licenses/IDs issued from Florida's DMV, five of which were duplicates.

  • Eight IDs issued from Virginia's DMV, all in August 2001.

  • Two driver's licenses issued in California to Hazmi and Mihdhar, both watchlisted.

  • Hanjour, the Pentagon pilot, had four state-issued IDs, including one each from Arizona and Maryland, and was the only hijacker to attempt to take the Virginia driver's license test (he failed).

9/11 DMV Fraud

This is a digital image retained by Virginia of the August 2, 2001, ID application of Ahmed al Ghamdi. He was part of the fraud schemes described below.

Fraud Scheme No. 1. Two Salvadoran immigrants living in Virginia, one illegally and one as a lawful permanent resident, were convicted of providing false residency certificates to two muscle hijackers, Ahmed al Ghamdi and Abdul Aziz al Omari. Both received Virginia IDs on August 2, 2001.

Fraud Scheme No. 2. An illegal Salvadoran was solicited by two hijackers at a 7-Eleven in Falls Church, Va. For a fee, he falsely certified on the DMV residency form that his old Virginia address was the residence of the hijackers.

Hanjour and Mihdhar's residency certificates were then used to support their applications for Virginia identification cards issued by the Department of Motor Vehicles on August 1 and 2, 2001, respectively.

The illegal Salvadoran's address was also recycled by Moqed and Salem al Hazmi to use on their Virginia identification cards issued on August 2, 2001.

Jarrah followed suit on August 29, using a fictitious residency address and a certification of that address by Hanjour, to acquire his Virginia identification card.

In all, these five hijackers based their Virginia identification documents on the residency information of one bribed Salvadoran.

Fake IDs a Last Resort

For the hijackers, having an ID was important enough that the last resort would be to attain a fake ID.

So in sum, option No. 1 was attaining IDs legitimately; option No. 2 was to obtain IDs by fraud; and option No. 3 was to get fake IDs. Which this hijacker did in July of 2001 only to go on and obtain a legitimate ID by fraud in the Virginia scheme on August 2, 2001.

IDs = Mission Accomplished

At airline ticket counters on the morning of 9/11, airline personnel recalled that:

  • At least six hijackers used state-issued IDs, three of which were the fraudulent documents obtained in Virginia and used at Dulles International.

  • FAA regulations required airline screeners to view a government-issued ID.

  • Airline personnel told 9/11 Commission staff that the Virginia IDs enabled the hijackers to appear assimilated and thus avoid the greater scrutiny that likely would have been triggered had Saudi, Lebanese, or UAE passports been shown at time of check-in.

  • Such additional scrutiny, according to airline personnel, likely would have uncovered the knives and pepper spray the hijackers were carrying, potentially foiling the plot's execution.

Document Fraud and National Security

So that was 9/11, but what about more recent times? Fraud in the ID arena remained rampant after 9/11 as well. The Castorena Family of Mexico dominated the U.S. document fraud market for 20 years, until 2006. The "family" was embedded in every major U.S. city. They were purveyors of high-quality ID documents of every kind — "as good as you carry in your wallet" — including birth certificates, driver's licenses, and immigration documents. One Chicago neighborhood alone raked in $2.5 million per year. Cells of six to 12 worked the streets to pull in orders, two shifts a day, seven days a week. Vendors kept a portion and kicked the rest up to the Castorenas.

Suad Leija (below) busted her family's cartel and described their business in a series of self-made YouTube videos: "As a little girl I used to count their money, and I would get $50 in return", she said. "I would put the money in envelopes of $5,000, other envelopes of $2,000, other of $1,000."

She asked if terrorists could use these documents after she learned about the 9/11 terrorists using fake documents to attain their driver's licenses and IDs; and after getting the following explanation from her grandfather, she decided to go public:

We are doing this for business, for money. So it doesn't really count whether you are a Mohamed, or Julio, or someone else, as long as you have the money to pay for it.

Terrorism is the United States' problem, not ours.

Is ID Fraud Still a Threat?

The Castorena family was busted in 2006. What is the current situation? Within our borders, Mexican and South Korean busts and subsequent trials of counterfeit rings in the past six months are some of the biggest busts ever — multi-state and multi-faceted.

Mexico. The Castorena Family was busted only to have another counterfeit cartel take its place and many smaller ones have popped up around the country. The most egregious came to light with the conviction in February of this year of Mexican Israel Cruz Millan, 26, of Raleigh, N.C., who received 25 years in prison for the false document ring he supervised in 19 cells in 11 states. The ring sold over 30,000 high quality fake IDs to illegal aliens and funneled more than $1 million back to Mexico over two years. Three of the cells were in Virginia, where there is a dense illegal alien population; 26 were arrested connected to this conspiracy.

John P. Torres, Special Agent in Charge for U.S. Immigration and Customs Enforcement's (ICE) Investigations for Washington, D.C., and most of Virginia, conducted the investigation and said: "Millan led a dangerous and violent criminal enterprise engaged in the production of fake documents, which posed a serious threat to national security. The fact that this organization also used intimidation and murder to maintain its dominance in this illicit business made this case an even greater priority."

According to evidence presented by a co-conspirator in a different trial, the organization ran similarly to the Castorena Family. In each city where the organization operated, Millan placed a cell manager to supervise a number of "runners", the lower-level members of the organization who distributed business cards advertising the organization's services and helped facilitate transactions with customers. The cost of fraudulent documents varied depending on the location, with counterfeit Resident Alien and Social Security cards typically selling for $150 to $200.

Evidence during a related trial detailed how members of the organization sought to drive competitors from their territory by posing as customers in search of fraudulent documents and then attacking the competitors when they arrived to make a sale. These attacks allegedly included binding the victims' hands, feet, and mouths; repeatedly beating them; and threatening them with death if they continued to sell false identification documents in the area. The victims were left bound at the scenes of the attacks and at least one victim died from one such attack that occurred in Little Rock, Ark., on July 6, 2010.

Members of the organization who violated internal rules imposed by Millan were subject to violence as well. In one wiretapped conversation, Cruz Millan conducted a conference call with other cell leaders around the United States so they could hear the torture as it took place, a warning of what would happen if they were caught stealing from the criminal organization. The testimony and intercepted calls documented that the victim was not only beaten, but also subjected to electric shocks administered by placing the victim's feet in a bucket of water and electrocuting him with jumper cables attached to a car battery.

All of this over fake IDs.

South Korea. I bring this up because it is a little off the radar and unexpected. Nonetheless, Young-Kyu Park's ring involved 22 individuals in six states (New Jersey, New York, California, Nevada, Virginia, and Georgia). Park bribed a federal government employee to supply blank immigration forms, then used the immigration forms to complete state ID requirements to obtain legitimate driver's licenses and visas. Park would even escort clients to DMVs. He would fill out the immigration forms DMVs rely on to verify authenticity of foreign passports and lawful U.S. status, as required under the REAL ID Act. He would create false utility bills and bank statements for residency requirements. He would even resell expired Korean passports to illegals. And while the Mexican ring sold their IDs for about $200, Park's entire suite of services ranged from $3,000-$4,500.

The State Level. States that have not shored up their ID issuance remain vulnerable to fake ID production. New Mexico, for example, is one of a handful of states that does not require proof of U.S. citizenship to obtain a driver's license, so there is a tremendous amount of fake ID production in New Mexico. Counterfeiters even ship illegal aliens to New Mexico to acquire driver's licenses.

DMV Employees. The insider threat remains significant. In the past year alone, DMV clerks have been busted for accepting bribes in California, Hawaii, Maryland, Massachusetts, and Tennessee.

Outside Our Borders. Chinese counterfeiters use affiliates embedded and assimilated in the United States to:

  • Apply for driver's licenses in states where they reside;

  • Send state-issued driver's licenses back to China;

  • Reproduce all physical/security features on cards;

  • Make state-issued IDs available for sale on a website; and

  • Produce high level IDs that pass muster at almost all U.S. checkpoints.

Policy Landscape

Today, the president is minimizing the value of ID security because ID security counters his amnesty policy.

In addition, multiple attempts to repeal/change REAL ID failed. REAL ID is in place, yet there remains no proactive support at the federal level for most states who are trying to comply. Why are states complying? Many states recognize the value of the greater efficiencies, lower costs, minimized fraud, and catching criminals that REAL ID provides. REAL ID helps to secure issuance, but as long as entities like TSA and banks do not verify the issuance of the ID, then the fake ID market will thrive.

What to Do? Technology is the greatest asset to reducing fraud, adding efficiencies, and lowering cost. Without proactive federal guidance, industry must provide the technology to push driver's license security forward. By placing innovative, reliable products in the market, industry — with customer input — drives national security in the ID space where the federal government does not.

Key Recommendation. Push forward with REAL ID compliance. It is in states' best interest to do so and benefits national security as well. More difficult will be to persuade states to permit their state DMV databases to be queried on an interstate yes/no basis to verify whether or not an ID was issued by the issuing authority printed on the ID. Such a query is the only way to stop use of high-quality counterfeits like those being produced by Chinese organized crime.