As identity theft becomes more widespread, state governments are focusing on the original paperwork that enables many of these crimes: Birth and death certificates.
“We improve the end Holy Grail documents, passports and drivers’ licenses, while we’re not improving standards for the source documents like birth certificates that are used to get them,” said Rick Outland of Gemalto, a company that makes digital security products.
Outland spoke this month at ID360, a conference presented by the Center for Identity at the University of Texas, along with officials responsible for managing birth and death records.
“All vital registration in the United States is local,” said Steven Schwartz, registrar at the New York City Bureau of Vital Statistics. “There’s no federal system. There are no federal standards or regulations for how we issue birth certificates.”
With documents being issued by state, county and city agencies, the speakers said, there are thousands of different formats across the United States. When someone presents a birth certificate to get a driver’s license or passport, or register for government services or school, it’s often difficult to verify that the document isn’t forged.
Even within a state, birth certificates vary widely.
“We have over 400 registrars in the State of Texas, and each prints its certificates separately," said Lonzo Kerr, deputy state registrar at the Texas Department of State Health Services. The state is just now trying to standardize the kind of paper used by those 400 agencies.
Even when the document is issued by an official agency, it may not be authentic. In 2000, Kerr said, a rogue employee in a registrar’s office created more than 300 “official” birth certificates that were fraudulent and sold them to identity thieves for as much as $10,000 each.
Day-to-day uses of a birth certificate can also expose it to fraud. The office staff at a school, a summer camp director or the volunteer coach of a Little League team will have copies of birth certificates, often stored in haphazard ways, said Greg Sirko of VitalChek, a company that helps states distribute vital records. "We sort of created a system that lends itself in some ways to identity theft," Sirko said.
So what can be done? The speakers offered solutions that fall into three categories:
1. Restricting access
“We have pushed nationally for limiting eligibility for obtaining a birth record,” said Sue Bordeaux, an Oklahoma official who leads the security committee for NAPHSIS, an association of public-records registrars. While it used to be easy for anyone to see a birth certificate, agencies across the country are now requiring that you prove you're that person or a relative before you can see the records.
While that helps, Bordeaux said, it still doesn't prevent misuse by people who have legitimate access to a birth certificate. “A lot of the fraud that we see in vital records is a family member who does it to the other person,” she said.
2. States talking to each other
Sirko says fraud involving death records is becoming more difficult because states are sharing information. In the past, if you saw an obituary of a person born in another state, that obituary gave you enough personal information – like the name of the mother – to get the original birth certificate from the state of birth. Today, in many cases, the state where a person died notifies the state of birth, which can then protect the person's records.
State officials are working to build a national system for sharing death information, because the process is still too slow. “Fraudsters can move faster than government.” Schwartz said. They can grab a record before we can mark it deceased.”
Another agency that needs to be involved is the Department of Defense, Schwartz said. When a soldier is killed in action, the name is often broadcast widely through the media. That makes their identities a target for fraud because the military doesn't report those deaths directly to the states.
3. Verifying data, not documents
Outland specializes in document forgeries and joked that, if he was working at the department of motor vehicles or an airport security checkpoint, he would be able to catch fake documents —but people would hate him, because he would spend a long time evaluating each one and cause lines to be even longer than they are today.
As digital systems replace old paper-based ones, the focus will move away from checking the authenticity of a document and more toward checking the information that's on the document. In other words, instead of just looking at a piece of paper, officials will be able to check on whether the data written on the paper is correct and whether the person presenting the document is posing as someone else.
Government agencies are now able to check some states' databases electronically, and that ability will grow.
“The future of birth and death certificates is electronic, and we shouldn’t be relying on paper,” Schwartz said. “Don’t try to make paper more secure. It’s the information people need."