Fixing Immigration - Technically Speaking

Neville Pattinson • August 3, 2010

For several months, the immigration debate has been fueled by the passed and now challenged legislation (SB 1070) in Arizona. Since the anti-illegal immigration bill was signed into law in April, many around the country have reacted with strong sentiments - both for and against. While we could debate the constitutionality of this existing legislation, I believe our efforts would be better served looking for innovative solutions to address the core issue of employment verification.

The heart of the immigration issue is centered on who has the right to legally obtain employment within the U.S. -- and more specifically how do those who are eligible to be employed prove their eligibility? Today's system requires two points of documentation to prove legal eligibility to work. This is typically a Social Security card or resident card, as well as a government-issued picture identification (e.g., state driver's license). While these documents do provide a minimal level of identity verification, the system for obtaining these identity credentials is easily defrauded. This allows for individuals to use fraudulent breeder documents (i.e., birth certificate), which are easy to forge to obtain a government-issued identity. This becomes even more important with the current level of unemployment within the country.

Technically speaking, there is a smarter way.

Since Feb. 2005, the U.S. federal government has been in the process of migrating employees to a more secure identity credential. The personal identity verification (PIV) credential, based on the Federal Information Processing Standard (FIPS 201), is an example of an identity credential that is based on verified data that could be used for the purpose of employment verification. This identity credential is based on smart card technology - a credit card-sized card with an embedded microprocessor. This technology is tamper resistant and impossible to forge or clone. The card can store critical information about the identity of the holder, including verification of the information statistics printed on the card, a picture of the card holder and biometric details (i.e., fingerprint). Because this data is securely stored on the card's microprocessor and potentially protected by a personal identification number (PIN), the holder can be assured that the information would only be used when access is authorized.

The question is: How does this practically get applied to the immigration challenge? While there are many ways to approach the immigration issue with this type of technology, I believe the most practical step forward, and one that has been proposed by Senator Charles Schumer (D-NY) on Capitol Hill, is to enhance the identity credential that is currently issued to eligible workers within the U.S - the Social Security Card. This is the base identity credential used for employment. The nine-digit code becomes the virtual representation of your ability to legally work. Yet, for the critical nature of what this number represents, it continues to be printed on heavy card stock paper with no security features to keep this credential from being forged and used to illegally obtain employment. Even more troubling is the paper published by security researchers at Carnegie Mellon University, who proved that they could crack a person's Social Security number simply by knowing their birth date. It is time to provide better levels of protection for this critical identity credential.

By upgrading the Social Security card to a smart card-based identity credential, the U.S. federal government could address the immigration issue and provide a straight forward way to verify employment eligibility. This would not come at a significant cost to the taxpayers and would leverage much of the existing infrastructure. Thinking beyond the immediate need for a simpler way to conduct employment eligibility, the enhanced Social Security card could be leveraged for identity verification and eligibility for other government based services. This could include online identity verification to protect against identity theft, online age verification, government medical insurance (Medicare/Medicaid) eligibility, unemployment benefits, etc.

Implementing this technology will not solve all of the challenges we face in addressing the issue of immigration, but it is a step in the right direction. Instead of legislating on-the-spot identity checks, we should look to a well known and proven solution (smart card-based identity) applied to an existing identity credential (Social Security card) to verify a person's eligibility to legally obtain work within the U.S.

Neville Pattinson, CISSP CIPP, is the vice president of government affairs and business development at Austin-based Gemalto North America. He is the chairman of the Smart Card Alliance and sits on the Department of Homeland Security Data Privacy and Integrity Advisory Committee. He can be reached at neville.pattinson@gemalto.com. Gemalto, the world leader in digital security, last year supplied more the 1.4 billion secure personal devices for mobile connectivity, identity and data protection, credit card safety, health and transportation services, e-government and national security.