Passports Using Counterfeit or Fraudulently Obtained Documents

Our investigator was easily able to obtain four genuine U.S. passports  using counterfeit or fraudulently obtained documents. In the most  egregious case, our investigator obtained a U.S. passport using counterfeit  documents and the SSN of a man who died in 1965. In another case, our  undercover investigator obtained a U.S. passport using counterfeit  documents and the genuine SSN of a fictitious 5-year-old child—even  though his counterfeit documents and application indicated he was 53  years old. State and USPS employees did not identify our documents as  counterfeit in any of our four tests. All four  passports were issued to the same GAO investigator, under four different  names. Our tests show a variety of ways that malicious individuals with even  minimal counterfeiting capabilities and access to another person’s identity  could obtain genuine U.S. passports using counterfeit or fraudulently  obtained documents. Our investigator used a genuine U.S. passport obtained by using  counterfeit or fraudulently obtained documents to pass through airport  security. In January 2009, our investigator purchased an airline ticket for a  domestic flight using the fictitious name from one of our test scenarios. He  then used the fraudulently obtained passport from that test as proof of  identity to check in to his flight, get a boarding pass, and pass through the  security checkpoint at a major metropolitan-area airport. On these  documents, we used a fictitious identity and a SSN that we had previously  obtained from SSA for the purpose of conducting undercover tests. Test Two: Investigator Obtained Passport Using a Genuine but Fraudulently Obtained State Identification Card

Our second test found that State did not detect a counterfeit New York  birth certificate our undercover investigator presented to prove his U.S.  citizenship in support of a passport application. Four days after our investigator submitted his application, State issued a  genuine U.S. passport in the fictitious name presented on the counterfeit  documents. Corrective Action Briefing

We briefed State officials on the results of our investigation. They agreed  that our findings expose a major vulnerability in State’s passport issuance  process. According to State officials, the department’s ability to verify the  information submitted as part of a passport application is hampered by  limitations to its information sharing and data access with other agencies  at the federal and state levels. Subsequent to our briefing, State  officials informed us that they identified and revoked our four fraudulently  obtained U.S. passports, and that they would study the matter further to  determine what steps would be appropriate to improve passport issuance  procedures.
Why GAO Did This Study

A genuine U.S. passport is a vital document, permitting its owner to travel freely in and out of the United States, prove U.S. citizenship, obtain further identification documents, and set up bank accounts, among other things. Unfortunately, a terrorist or other criminal could take advantage of these benefits by fraudulently obtaining a genuine U.S. passport from the Department of State (State). There are many ways that malicious individuals could fraudulently obtain a genuine U.S. passport, including stealing an American citizen's identity and counterfeiting or fraudulently obtaining identification or citizenship documents to meet State requirements. GAO was asked to proactively test the effectiveness of State's passport issuance process to determine whether the process is vulnerable to fraud. To do so, GAO designed four test scenarios that simulated the actions of a malicious individual who had access to an American citizen's personal identity information. GAO created counterfeit documents for four fictitious or deceased individuals using off-the-shelf, commercially available hardware, software, and materials. An undercover GAO investigator then applied for passports at three United States Postal Service (USPS) locations and a State-run passport office.

What GAO Found

GAO's investigation shows that terrorists or criminals could steal an American citizen's identity, use basic counterfeiting skills to create fraudulent documentation for that identity, and obtain a genuine U.S. passport from State. GAO conducted four tests simulating this approach and was successful in obtaining a genuine U.S. passport in each case. In the most egregious case, an undercover GAO investigator obtained a passport using counterfeit documents and the Social Security Number (SSN) of a man who died in 1965. In another case, the investigator obtained a passport using counterfeit documents and the genuine SSN of a fictitious 5-year-old child GAO created for a previous investigation--even though the investigator's counterfeit documents and application indicated he was 53 years old. All four passports were issued to the same GAO investigator, under four different names. In all four tests, GAO used counterfeit and/or fraudulently obtained documents. State and USPS employees did not identify GAO's documents as counterfeit. GAO's investigator later purchased an airline ticket under the name used on one of the four fraudulently obtained U.S. passports, and then used that passport as proof of identity to check in to his flight, get a boarding pass, and pass through the security checkpoint at a major metropolitan-area airport. At a briefing on the results of GAO's investigation, State officials agreed with GAO that the investigation exposes a major vulnerability in State's passport issuance process. According to State officials, State's fraud detection efforts are hampered by limitations to its information sharing and data access with other federal and state agencies. After GAO's briefing, State officials notified GAO that they identified and revoked GAO's four fraudulently obtained U.S. passports, and were studying the matter to determine the appropriate steps for improving State's passport issuance process.