Foiling I.D. thieves: identity theft is on the rise, and states are looking for ways to secure their citizens' vital records.

Every day in Des Moines, contract workers in the state Department of Public Health's Bureau of Health Statistics are involved in what seems to be an endless task: transferring more than 5 million birth, marriage and death records from old bound ledgers and microfilm into one computer file.

"We've done birth certificates going back to 1930 and death and marriage records going back to 1954," says Bureau Chief Jill France. "The initial data capture is now done, but we also have a good many issues still to resolve from handwritten records where the writing may have not been legible."

The extensive transfer has so far cost Iowa some $2 million. But it will allow law enforcement officials to go to one easy file to find information that had previously been scattered. "Only authorized personnel will have access to these records," says France. "They, in turn, are authorized to cooperate with law enforcement agencies in the conduct of their official duties."

PROTECTING CITIZENS' STATISTICS

In a different time, Iowa's move to centralize its vital records might have seemed like nothing more than an interesting, if unconventional, stab at bureaucratic streamlining.

But since the explosion in identity theft--reported incidents jumped 33 percent between 2002 and 2003--how state governments organize, archive and protect the vital records of their citizens has become a matter of abiding, if chilling, concern.

"It is a deadly serious problem," says Ken Beam, executive director of the National Association of Public Health Statistics and Information Systems. " In the world of identity theft, both birth and death records can be the breeder documents for so many other documents.

"But in state after state," he says, "personal identification information is very often spread out across many agencies. One agency handles voting records, another does the driver's licenses and still some other agency collects death certificates. And of course, there is no telling how often a person's Social Security number appears on some of these documents and is seen by the wrong people."

The diffused result, contend many experts, has unintentionally provided an opening for a wide variety of identity theft. "All you have to do is just get a little bit of information about someone from any one of these different agencies, and you would be amazed by how much trouble you can cause," says Jason King, a spokesman for the American Association of Motor Vehicles Administrators (AAMVA).

"Access to someone's driver's license, for example, leads to an amazing number of other opportunities in our society," he says, "such as obtaining financial and health services, and everything else from renting a car to cashing a check and boarding an airplane."

There are currently laws relating to the criminal enforcement of identity theft in all 50 states. But how each state compiles and permits access to the vital records that are so often used to fake an ID varies widely. At least 10 states, for example, are called "open records states," allowing access to birth and death records to anyone who asks for it.

"We are an open record state here in California. From an identification theft perspective that is both a good and bad thing," says Senator Debra Bowen, the author of several ID theft prevention hills and one of the nation's experts on how states can combat such theft.

"The good thing is that it makes it much easier for law enforcement to find out if a person was actually born on a certain date," says Bowen. "It you can get access to those kinds of certificates only if you are a relative, then that makes it difficult for officials to find out if someone is masquerading as a person who has actually passed away."

But the bad side is that such vital records are open to someone who wants to create mischief, "although identity theft in California has mostly come from other sources, such as copies of statements, stealing credit cards or making copies of credit card numbers," Bowen says.

GROWING PROBLEM

There's no doubt that identity theft is widespread, growing and varied. Credit card fraud accounted for 42 percent of all consumer complaints in 2003, according to statistics compiled by the Federal Trade Commission. Twenty-two percent of all complaints were for phone and utilities fraud and 17 percent were for bank fraud over the same period.

And it is a crime that knows no one region of the country. Thirty-seven percent of the credit card fraud complaints came from California and Texas, while 40 percent were in New York in 2003.

Altogether, in all of the 50 states, more than 150,000 people complained of identity theft in 2002, and more than 200,000 people filed complaints in 2003.

What most frustrates law enforcement agencies, as well as systems experts, is how easily ID theft can be accomplished: "You can walk through a cemetery, see a marker that shows a child was born in 1971 and died in 1972, and just become that person," says Lynette Millett, study director for the computer science and telecommunications board of the National Academies of Science.

"It doesn't take a technology hack to do it," she says. "This is why it is so important to be able to link a birth record to a death record or any other kind of vital record, such as a driver's license or marriage certificate, and, hopefully, to have all of that kind of information in one system."

In a more perfect world, law enforcement officials would also like to be able to share such information on a state-by-state basis.

"As it now stands, if someone dies in one state that information may not get to the state of their residence for weeks and months," says Beam. "This means, in turn, that that person's birth certificate may not be cancelled in a timely fashion."

End result: Thieves who casually scan the daily obituaries on the prowl for just such information can visit the dead person's state, obtain a copy of his or her birth certificate, and simply assume the identity.

"It happens all of the time," Beam says. He supports the use of interjurisdictional agreements between the states that would allow sharing information on who died, where and when.

WHAT ABOUT PRIVACY?

But having any one governmental agency amass so much information on its own citizens troubles some people, particularly if that same agency has collected the information from a variety of government sources.

"People give data to state agencies for particular purposes," says Daniel Solove, a professor of law at George Washington University Law School. "The information is stored for that particular purpose. When it gets transferred and used for a wholly different purpose, explanatory details that a person might have given are missing."

The end result is what Solove calls the "aggregation effect." Stray pieces of information about any one individual collected from disparate agencies combine to reveal far more about an individual's private life than most people would be comfortable with.

"Innocuous data here and there can add up to tell a lot about a person," he says.

Lawmakers who see the need for centralizing their state's vital records are similarly concerned about the potential of any one agency knowing too much about a state's citizens. "It is a very delicate balance that we have to try and achieve," says Minnesota Senator Steve Kelley. "You want a secure and reliable system of determining somebody's identity. At the same time, you have to absolutely protect the privacy of the person you now have so much information on. I am not sure that any of us have an easy solution."

Of equal concern to Kelley is whether or not the states, by centralizing information, could actually be making life easier for would-be thieves: "What would stop a criminal perpetrator from working with someone who has access to all of these vital records and either tapping into an existing identity or creating an entirely new one based on what they find out?"

Such questions travel to the heart of what security experts say is the most troublesome aspect of their business: the impossibility of creating an ID or vital records process that cannot eventually be infiltrated by someone who is up to no good.

"A 100 percent foolproof system is impossible," contends Millett.

Reed Stager, vice president for public policy with the Digimarc Corporation, a leading supplier of what is called "secure media solutions," agrees.

"You will never be able to put together a system that cannot be somehow exploited," Stager says. "But what you can very much do is effectively raise the bar on security and make it more and more difficult to counterfeit or infiltrate a system in process."

To that end, Digimarc has embraced digital watermarking technology, which tracks and identifies unauthorized uses of digital photos, audio, video and other documents.

To date, Digimarc has signed agreements with 32 states to apply its technology on driver's licenses and other forms of personal identification.

In every case, the emphasis is on prevention. "Right now there are 240 different versions of state-issued IDs," says Stager. "And each of these IDs might have a little bit different design."

The only way that state agencies can possibly maintain control of so many official IDs, adds Stager, is to adopt technology such as digital watermarking that can spot a forged one.

"It doesn't mean we can fix every card to look like the next card or even verify at that moment that the documents you are presenting to us at the counter are real," says the AAMVA's King. "But it does mean that you can work to make your individual systems more secure and, by doing so, reduce the chances of ID theft."

PREVENTION IS KEY

Just as important as preserving and protecting certain records in the battle against ID theft, is destroying other kinds of records. In California, for example, state law requires that all businesses shred any and all paper records that contain credit card, banking and Social Security number information.

The reason is simple: Thieves have been known to go through garbage cans in search of such information. "I have gotten to the point where I no longer put anything in the garbage or for recycling without shredding it first," says Senator Bowen.

"Even if I get a preapproved credit card application, I shred it before putting it in the recycling bin," she says. "Otherwise I am giving someone an invitation to open their own credit card in my name and then to watch my mail until it comes."

For victims whose names have been fraudulently used by a thief, California also has passed legislation making it easier to clear their records after a theft has been determined.

"Our emphasis primarily has been on the prevention side, trying to stop the free flow of credit cards and Social Security numbers, helping businesses maintain their records, and even making it easier for victims to file identity theft charges," explains Bowen, who says that states must recognize that the war against ID theft will always include battles fought on many fronts.

Private industry also needs to get involved, says Maureen B. Riehl, vice president for the government and industry relations council with the National Retail Federation Counsel.

"Identity theft is a big problem for retailers," she say's, noting that it affects "employment practices, credit granting practices, customer relationships and other business interests that rely on a combination of trust, relationships and verification."

HOW MUCH CAN WE SPEND?

But before any state embraces the new, if daunting, world of making identification records more secure, say experts, tough questions should be asked first. The most important may we be, how much are you willing to spend?

"This type of technology can be expensive," admits Stager, whose company earlier this year signed a $9.5 million contract with the Alabama Department of Public Safety to overhaul its driver's licensing process.

And then there are the expenditures beyond what Millett calls the "initial procurement."

"You are going to need people to maintain those new systems, understand them and upgrade them as the months and years go by," Millet says. "All of this calls for a significant investment in state resources."

For systems experts, such investments in the battle to reduce ID theft is money well spent: "I would just like people to understand the importance of vital records," says Beam.

"They are easily overlooked, they are not sexy. But the citizens of every state just naturally expect that their most private records are secured and in safe hands. And I think we owe it to them to make that so."

THE 10 WORST STATES WITH IDENTITY THEFT

ARIZONA

NEVADA

CALIFORNIA

TEXAS

FLORIDA

NEW YORK

OREGON

COLORADO

ILLINOIS

WASHINGTON

RELATED ARTICLE: Using technology to thwart ID piracy.

Biometric technologies, which authenticate individuals based on their physical characteristics, provide a new line of defense in the battle against ID fraud. But according to a report just released by the Burton Group, an IT service firm, America has been slow to embrace them.

"Over the next two to three years, biometrics will remain a niche solution in enterprises rather than a technology that is deployed to the masses," the Burton Group report said, noting that private industry made up only a third of the biometric industry's $720 million in revenue for 2003, far less than many experts had predicted.

Those same experts believe that the up-front investment in a comprehensive biometrics system, which can cost more than $150,000, may have scared off businesses that expressed an interest in the immediate weeks following the 2001 attacks. But others say that many businesses and consumers in the United States have yet to find a comfort level with a technology that uses fingers, faces and eyes--identifying a person by their iris or by the pattern of blood vessels in their retinas--for ID purposes.

There are signs, however, that such reluctance may be diminishing. This summer, Electronic Data Systems Corporation (EDS), which specializes in information technology as well as business process services, is participating in a series of demonstration projects in conjunction with the federal Transportation Security Administration that will employ biometric technology in an extremely public setting: a major metropolitan airport.

"The idea is to show the effectiveness of biometric technologies for frequent travelers," says Bill Ritz, manager of public relations for government affairs at EDS, who adds that people who use a particular airline at least once a week "are being invited to be part of the program. They sign up for a brief background check, and also offer a fingerprint and retinal picture."

The biometrics demonstration program will be launched at the Logan Airport in Boston, with a second program set for the Washington Reagan National Airport later this fall. Travelers who agree to participate in the demonstration will realize one immediate benefit: They don't have to wait in one of those long security lines that increasingly characterizes the airport experience today.

"Instead they go up to a kiosk and basically sign in with their fingerprint and a retinal scan," explains Ritz. "It verifies who they are, and from there they go directly to the head of the security line."

Retailers also are beginning to use biometric systems as a fraud and theft-fighting tool. Customers who provide initial identification and have a fingerprint scanned can later bypass showing identification when cashing checks and making purchases. And some large employers use biometrics in employee IDs and for controlling access to secure areas.

For some individuals, giving up control over the use of a fingerprint or retinal scan to businesses raises the specter of a "Big Brother" society. For others, the convenience and security that biometrics can offer may seem worth the risks.

RELATED ARTICLE: How they work.

Biometrics and digital watermarks are highly complex and sophisticated technologies that make it very difficult to counterfeit IDs or documents.

Biometrics measures physical characteristics to identify a person. The technology includes facial or voice recognition, fingerprinting and measurement of eye features.

Fingerprint scanning measures the unique swirls and ridges in the fingertip. Iris scans analyze the patterns of the iris, the colored portion around the pupil of the eye. Retinal scans measure the features and patterns of the blood vessels in the retina of the eye.

Biometric data are stored in a computer where they can be compared against the person presenting the document or ID. Advanced biometrics are not stored as a single image to be matched; they are converted into a digital representation (or template) of, for example, the points of the fingerprint.

Digital watermarks are invisible electronic codes, embedded within a document or file, to protect authenticity. The codes in a digital watermark can be interpreted only by a computer or computerized reader equipped with specialized software. For example, the digital watermark on a birth certificate could contain a document number, a birth date or a code identifying the agency that issued the document.

Although biometrics and digital watermarking are very difficult to Counterfeit, they are not foolproof. The extra security of biometrics makes counterfeit or stolen documents or IDs with these identifiers more valuable to those who are able to duplicate or steal them. The consequences, if they are stolen, are more disastrous to the owner. They also are only as secure as the underlying systems and people who operate them--the individuals who are responsible for designing, maintaining and securing the databases that hold the information and the employees who are charged with checking the document or card.--Pam Greenberg, NCSL 

FACTS AND FIGURES OF ID THEFT

10,000,000 The number of ID theft victims last year.

$5 billion Loss to consumers last year.

$48 billion Loss to businesses last year.

607 Average number of hours spent by ID theft victims resolving their case.

$1,495 Average out-of-pocket expenses for ID theft victim to resolve case.

4 Number of 9/11 hijackers who obtained driver's licenses by fraudulent means.

240 Number of different versions of state issued identifications.

6,422 Number of different entities that issue U.S. birth certificates.

14,000 Number of different versions of birth certificates in circulation.

7 Number of states that require facial recognition software to prevent the false issuance of driver licenses.--Blake Harrison, NCSL

Sources: Federal Trade Commission; the Identity Theft Resource Center; California Department of Motor Vehicles; U.S. Department of Health and Human Services 

Garry Boulard, a frequent contributor to State Legislatures, is a free-lance writer from Albuquerque, N. M.