In the area of identity verification, the Act establishes the following requirements, among others,  for states seeking compliance:
Documentation: States must require license applicants to provide  documentation of their name, date of birth, SSN, address of principal  residence, and lawful status in the United States;
Verification: Requires states to verify with the issuing agency the  issuance, validity, and completeness of the documents presented as  proof of name, date of birth, SSN (or verify the applicant’s ineligibility  for an SSN), address, and lawful status, with specific requirements to  confirm SSNs with SSA and verify lawful status of non-citizens  through an electronic DHS system;  Image capture: Requires states to capture and store digital images of  all documents presented by license applicants to establish identity,  such as passports and birth certificates, and capture the facial images  of all applicants;
Renewals: Requires states to establish an effective procedure for  confirming or verifying the information provided by individuals seeking  to renew their licenses;
One driver, one license: Requires states to refuse to issue a license  to an applicant who already holds a license from another state,  without confirming that this other license has been or is in the process  of being terminated; and
Staff training: States must establish training programs on  recognizing fraudulent documents for appropriate employees involved  in issuing licenses. All states plus the District of Columbia are now using Social Security  Online Verification (SSOLV) to verify license applicants’ SSNs and other  personal data, consistent with the REAL ID Act’s requirement to confirm  SSNs with SSA. Many states are using facial recognition techniques or fingerprinting  which, while not required by the REAL ID Act, may detect applicants who  attempt to obtain a license under an identity other than their own. Although states are already implementing a number of the identity  verification procedures required by the REAL ID Act, some states may not  comply with certain provisions for various reasons. Indeed, officials in the majority of our 11 selected  states said they have seen a decline in attempts to obtain licenses using  counterfeit documents. Officials in most of the states we  interviewed said SSOLV checks have helped make the use of fraudulent  documents more difficult. State officials also reported successes in using facial recognition  technology to detect license fraud, particularly fraud involving identity  theft. License Fraud across State Lines and the Use of Counterfeit Birth Certificates Remain Challenges

			States Remain Vulnerable to Cross-State License Fraud

States’ vulnerability to license fraud perpetrated by individuals who cross  state lines has been a longstanding issue, and it remains a challenge for  states despite the success officials report in detecting other kinds of   Officials in the majority of states we interviewed told us their  fraud.states bar their license holders from also holding licenses in other states,  and the REAL ID Act also prohibits states from issuing a license to an  applicant who already has one in another state. For example, criminals may try to  get licenses under different identities by using the identity of someone  who resides—and may have a license—in one state to obtain a license  under that identity in a different state, perhaps to commit financial fraud  under their stolen identity. For example, officials in a number of states told us a check against  the problem driver database (Problem Driver Pointer System) will not  detect a license in another state if it is not associated with any driving  violation. States are trying to develop additional mechanisms for addressing cross- state license fraud, but none are fully operational yet. SSA and DHS Have Enhanced Verification Systems but DHS Has Not Provided Adequate Guidance on REAL ID Implementation

		Agencies Have Improved Existing Systems and Helped States Develop New Verification Systems

SSA has taken actions that enhance licensing agencies’ ability to verify  SSNs and other personal data. Specifically, the agency has addressed  two areas of concern that we raised in 2003. DHS has also provided grants to individual states to help them improve  their driver’s license security procedures, including identity verification. DHS Has Not Provided Comprehensive Guidance to Help States Implement the REAL ID Act

Despite the approaching January 2013 deadline for compliance, DHS has  not provided timely, comprehensive, or proactive guidance on how states  seeking REAL ID compliance could meet the identity verification  requirements. For example, DHS did not issue written guidance on how to  meet specific REAL ID Act identity verification requirements for over 4  years after it issued its final regulations in 2008. However, DHS officials said they are now reevaluating that  decision. DHS regulations require states to use electronic  verification systems as they become available, but also authorize states  to use alternative methods approved by DHS.not providing comprehensive guidance specifying what alternative  procedures would be acceptable for compliance with these requirements,  DHS officials also indicated they have no plans to promote certain  strategies they consider potentially useful that might partially help states  meet these requirements, such as: (1) expansion of the AAMVA photo   However, in addition to  sharing program to additional states, and (2) expansion of licensing  agencies’ efforts to verify birth certificates through their own states’ birth  records for applicants born in-state. However, officials in some states we interviewed expressed a need for  direction from DHS to help identify possible alternatives. Similarly, even though EVVE is not yet fully  operational, states can still make it harder for criminals to use forged birth  certificates by, for example, checking their own birth records for license  applicants born in-state. I), DHS did not concur with  either of our recommendations, saying that interim strategies for  addressing cross-state and birth certificate fraud are not needed. And, officials in many of the states we contacted still said they are  confused about how to comply with certain REAL ID provisions, such as  those related to cross-state and birth certificate fraud, despite DHS’  efforts to provide information through conferences and responses to  individual state questions. Social Security Numbers: Federal Actions Could Further Decrease  Availability in Public Records, though Other Vulnerabilities Remain.
Why GAO Did This Study

Obtaining a driver's license under another's identity can enable criminals to commit various crimes. The 9/11 terrorists, for example, possessed fraudulent licenses. The REAL ID Act sets minimum standards for states when verifying license applicants' identity, which go into effect in January 2013. If states do not meet these requirements, their licenses will not be accepted for official purposes such as boarding commercial aircraft. DHS is responsible for establishing how states may certify compliance and for determining compliance. SSA helps states verify SSNs. GAO was asked to examine (1) states' identity verification procedures for license applicants, (2) the procedures' effectiveness in addressing fraud, and (3) how federal agencies have helped states enhance procedures. GAO analyzed DHS and SSA data on states' use of verification systems; interviewed officials from DHS, SSA, and other organizations; and conducted on-site or phone interviews with licensing agency officials in 11 states. GAO tested state procedures in three states that have known vulnerabilities; results from these states are not generalizable.

What GAO Found

To verify license applicants' identity, all 50 states and the District of Columbia have procedures that may detect counterfeit documents. For example, all states are now verifying key personal information, such as Social Security numbers (SSN) through online queries to a Social Security Administration (SSA) database, a significant increase from about a decade ago. This effort helps ensure that the identity information presented belongs to a valid identity and also is not associated with a deceased person. Additionally, most states verify non-citizen applicants' immigration documents with the Department of Homeland Security (DHS) to ensure these individuals have lawful status in the United States. Many states are also using facial recognition techniques to better detect attempts to obtain a license under another's identity. While most states have taken steps required by the REAL ID Act of 2005 (Act), officials in some states indicated that they may not comply with certain provisions--such as re-verifying SSNs for license renewals--because of state laws or concerns that these requirements are unnecessary and burdensome.
State officials interviewed by GAO report that identity verification procedures have been effective at combating certain kinds of fraud, but vulnerabilities remain. Officials in most of the 11 states GAO contacted reported a decline in the use of counterfeit identity documents, and officials in states using facial recognition said they detected a number of identity theft attempts. However, criminals can still steal the identity of someone in one state and use it to get a license in another because states lack the capacity to consistently detect such cross-state fraud. A system for addressing such fraud would enable states to comply with the Act's prohibition against issuing licenses to individuals who already have a license from another state, but may not be fully operational until 2023. Furthermore, officials in many states said they have difficulties detecting forged birth certificates. Verifying date of birth is also required by the Act, and a system exists for doing so, but no licensing agencies are using it because of concerns about incomplete data, among other reasons. Partly because these two systems are not fully operational, GAO investigators were able to use counterfeit out-of-state drivers' licenses and birth certificates to fraudulently obtain licenses in three states.
By improving their respective verification systems, SSA and DHS have helped states enhance their identity verification procedures. For example, SSA has established timeliness goals for responding to state SSN queries and DHS has addressed data accuracy issues. DHS has also provided funding for states to develop new systems. However, DHS has not always provided timely, comprehensive, or proactive guidance to help states implement provisions of the Act related to identity verification. For example, DHS did not issue formal, written guidance in this area for more than 4 years after issuing final regulations, even though officials from most states GAO interviewed said they needed such guidance. Additionally, even though relevant national systems are not yet fully operational, DHS has no plans to promote certain alternatives states can use to comply with the Act's identity verification requirements and combat cross-state and birth certificate fraud. Officials in some states indicated they needed direction from DHS in this area.

What GAO Recommends

GAO recommends that DHS work with partners to take interim actions to help states address cross-state and birth certificate fraud. DHS did not concur with these recommendations, saying its ongoing efforts are sufficient. GAO has demonstrated that vulnerabilities remain as long as national systems are not yet fully operational. Therefore, GAO continues to believe additional DHS actions are needed.