Hearing on Proposals to Improve the Electronic Employment
Verification and Worksite Enforcement System


There are formidable problems with creating a workable andacceptable electronic employment verification system for federalimmigration law enforcement. Creating a nationwide system forchecking identity and eligibility is much more easily saidthan done.

Given the flaws in the current system, it is unsurprising thatthere should be a push to improve it. However, improvements thatprevent eligible citizens from working should not be adopted. It ismore important that American citizens and eligible people should beable to work than it is to exclude illegal aliens from working.

There is probably no way to change the current system so that itprevents more ineligible people from working without alsopreventing more citizens and eligible people from working. Thissuggests that the policy of internal enforcement itself is thesource of the problem.

Beyond its influence on work, expanding electronic verificationwould impose many costs on the country and society. The dollarcosts of a nationwide electronic verification system would be high.Electronic verification would have far greater privacy consequencesthan the current I-9 system - and these consequences would fall onAmerican citizens, not on illegal immigrants. Expanded electronicverification would invert our federal system and explode limitedgovernment.

The policy that will dissipate the need for electronicverification by fostering legality is aligning immigration law withthe economic interests of the American people. Legal immigrationlevels should be increased.


Chairman Lofgren, Ranking Member King, and Members of theCommittee:

It is a pleasure to speak with you today. I am director ofinformation policy studies at the Cato Institute, a non-profitresearch foundation dedicated to preserving the traditionalAmerican principles of limited government, individual liberty, freemarkets, and peace. In that role, I study the unique problems inadapting law and policy to the information age. I also serve as amember of the Department of Homeland Security's Data Privacy andIntegrity Advisory Committee, which advises the DHS Privacy Officeand the Secretary of Homeland Security on privacy issues.

My most recent book is entitled Identity Crisis: HowIdentification Is Overused and Misunderstood. I am also editorof Privacilla.org, a Web-based think tank devoted exclusively toprivacy, and I maintain an online resource about federallegislation and spending called WashingtonWatch.com, which recentlyintroduced a legislative wiki that will increase governmenttransparency - especially once you in Congress realize that you canuse it to communicate directly with the interested public. I speakonly for myself today and not for any organization with which I amaffiliated or for any colleague.

Congratulations and thank you for conducting extensive hearingson so many dimensions of the immigration reform issue. When billspass Congress without hearings, the results can be expensive andthreatening to liberty. The REAL ID Act is one example. While thatlaw has done much for me in terms of frequent flyer miles and booksales, I prefer Congress to legislate with care.

There are formidable problems with creating a workable andacceptable electronic employment verification system for federalimmigration law enforcement. By stating the problem in terms ofidentification and credentialing, perhaps I can help surface someof those problems and help you determine what the best approach isto immigration reform, whether there should be an electronicemployment verification system, and what the concerns are with sucha system.

My analysis leads me to conclude that there are fundamentalproblems with the policy of "internal enforcement" which electronicemployment verification supports. The flaws in internal enforcementshould be fatal to that concept. The solution that will fosterlegality is aligning immigration law with the economic interests ofthe American people.

Immigration Policy, Briefly

One cannot talk about a technology-focused government programwithout examining policy considerations. The human forces that apolicy would channel or counteract are the most important influenceon how the supporting system must be designed, where the challengesto it will come from, and the human and monetary costs of makingthe system work for its intended purpose.

Our nation's immigration policy is at a crossroads. According tomy colleague Dan Griswold and Labor Department projections, oureconomy will continue to create 400,000 or more low-skilled jobsannually in the service sector - tasks like food preparation,cleaning, construction, landscaping, and retail. Yet during theperiod from 1996 to 2004, the number of adult Americans without ahigh school education - the demographic that typically fills thesejobs - fell by 4.6 million.1

These demographic facts create very powerful economic forces.There is demand in the United States for both low- and high-skilledworkers. Workers in many nearby countries desire and, in manycases, very badly need work of the kind offered in the UnitedStates. The economic gradient is steep.

Like water following the laws of gravity, there has beencontinuing movement of workers to the United States. Unlike water,which can be stopped with simple barriers, people on both sides ofthe border dedicate their ingenuity to getting what they want andneed. The self-interest of employers and workers is a powerful (andalmost always beneficial) force that is hard to quell orconquer.

The last major effort to address immigration did not admit thepower of these economic forces, however. In the Immigration Reformand Control Act, Congress chose not to expand legal immigration,but instead interposed a legal eligibility requirement on theemployment relationship. IRCA made it unlawful for employers toknowingly hire workers who are not eligible to work in the UnitedStates. All employers are required to verify employees' workeligibility via the I-9 form, and employers who knowingly hireineligible workers are subject to penalties.

There is logic to this idea: In theory, making it illegal tohire those not legally in the United States could reduce thestrength of this country's economic "magnet." The I-9 process andemployer sanctions undoubtedly have had some effect on curtailingillegal immigration and working, but not very much. The policycannot be called a success - obviously - Congress is revisitingit.

Employment eligibility verification has not changed or defeatedthe underlying economics. It would not be a good idea to do so -Americans benefit from the influx of labor, and the workers whocome here benefit from working here.

Because the I-9 process and employer sanctions seek to defeattheir economic interests, the system has two principle opponents:employers and workers. It relies on them for implementation,though, which is why success has been so elusive and will continueto be. It is important to examine whether a "strengthened,"electronic system such as an expanded Basic Pilot can improve onthe status quo, and whether the costs of implementing such a systemare justified by the benefits.

Eligibility Checks as a Credentialing System

It is useful to look at employer sanctions under the ImmigrationReform and Control Act system through the lens of identity andcredentialing. This helps reveal all the steps in the process,their weaknesses, what it would take to fix them, and what thatwould cost. If nothing else, it shows that a nationwide system forchecking identity and eligibility is much more easily said thandone.

Simply put, IRCA made working legally in the United Statescontingent on presenting a certain credential: proof of legaleligibility. There is a difference, of course, between beingeligible to work and proving that eligibility. The gap betweenactual eligibility and proof of it is routinely exploited by thesystem's opponents - again, employers and workers - as they pursuetheir interests.

False Positives and False Negatives in Screening forIneligibility
It is difficult to prove work eligibility under IRCA on a massscale. Because the credential is a personal one (i.e., attaching tothe individual, non-transferable), there are two steps to thisprocess: 1) identification of the individual and 2) determinationof that individual's eligibility.

Flaws in the processes for proving identity and eligibility(actually, testing for ineligibility) mean that some people who areentitled to work may be denied work ("false positives"), and somewho are not legally entitled to work will be able to work ("falsenegatives").

False positives and false negatives are almost always in tensionwith each other. Seeking lower false positives usually requires theacceptance of higher false negatives, and vice versa. For example,a system that excluded every single ineligible worker withoutexception (zero false negatives) would exclude from working manyeligible workers (high false positives).

Because of our system of values and rights, the IRCA regime musthave very low false positives - and no false positives attributableto government action. It is wrong to deprive those who are legallyeligible to work of a livelihood, and a wrongful deprivation ofwork based on government action would be a denial of Due Process.This requires the acceptance of some false negatives (i.e., theemployment of some ineligible people).

Though the current system appears deeply flawed, it may berelatively well tuned to the requirement that there be the barestminimum of false positives. A system with high false negatives -essentially, a sloppy internal enforcement system - may be the mostappropriate accommodation of the difficult-to-implement policy ofinternal enforcement.

Changing to an electronic system like an expanded Basic Pilotmust happen without raising false positives, which, again, would beincompatible with our system of individual rights and dignity, aswell as with Due Process in many cases. Let us briefly examine thecurrent processes before turning to how an expanded Basic Pilotwould change them and whether the those changes are justified giventhe costs.

Employment Eligibility Verification: theI-9
Currently, employers must collect and examine identity andeligibility information from all employees at the time of hire.This can be done through a single document, such as a passport orcertificate of U.S. citizenship, or through two separate documents,one each for identity and eligibility, such as a driver's licenseand a social security card. The employer must attest, under penaltyof perjury, that it has examined the documents, found that theyappear to be genuine, and that the employee appears eligible towork in the United States.

This conversion of every small business person and humanresources director in the country to an immigration agent assuredlyhides the cost of the enforcement regime, but it does notnecessarily work very well at combating illegal working, for acombination of reasons.

First, like many broad identity and credentialing systems, theI-9 process is highly subject to avoidance. As noted above,employers and workers have strong economic incentives to gettogether on mutually agreeable terms. The IRCA policy is aninterposition on that process. Employers and workers can and docollude to avoid the system entirely. They conduct business "underthe table," avoiding IRCA and various taxes and regulatoryrestrictions, as well.

Assuming they operate within the system, however, employers andworkers still create many false positives and negatives, wronglyexcluding some people from work, and allowing some to work contraryto IRCA.

Checking Identity and Eligibility
In our personal interactions, people use identification constantly.We are very adept at recognizing others with our eyes, ears, andother senses. This enables us to pick up right where we left offwhen we see people a second, third, and fourth time. Our successand familiarity with in-person, familiar identification seems togive us excessive confidence in identification's power in othercontexts.

The employment relationship is not like our relationships withfriends and neighbors. It typically commences among strangers.Particularly in low-skill jobs, the new employee proffers his orher identity for the first time at the beginning of therelationship. The employer takes little time to examine theapplicant's identity bona fides.

At this early point in the relationship, though, the governmentrequires the employer to examine and report on the new employee'sidentity information. It is not a natural, personal interaction ofthe kind that gives us so much confidence in identification. It isidentification by card.

In my book, Identity Crisis: How Identification is Overusedand Misunderstood, I describe the process of identifyingsomeone by card. This is an important and valuable process, whichallows people to be treated as "known," at least to a degree, fromthe first encounter. But the identification-by-card process is alsofraught with weaknesses. The figure on the next page describes thethree steps in the process by which a card transfers identityinformation from the subject (cardholder) to the verifier (relyingparty).

First, the subject applies to a card issuer for a card,typically supplying all the information on the card. Next, the cardissuer creates a card, supplying information to any later verifier.Finally, the verifier compares the card to the subject and, havingverified that the card is about the subject, accepts theinformation on the card.

Each of these three steps is a point of weakness, an opportunityfor false negatives to creep in. In the first step, the subject mayapply to the card issuer with false information (including falsedocuments), or the subject may corrupt employees within the cardissuer, causing them to issue an inaccurate but genuine card. Thiswill almost certainly deceive the employer, who, except underextraordinary circumstances, cannot be expected to second-guessinformation printed on a genuine, un-tampered-with card.

Media Name: jh04262007.gif

At issue in the second step is the security of the card againstforgery or tampering. Though many government-issued ID documentsare quite resistant to forgery and tampering, the broadened use ofthese documents (including for immigration control) has increasedthe value of forging such documents and devising ways to tamperwith them. Employers, who would be acting against their owninterests to discover such things, cannot be expected to discoverforgery or tampering of any decent quality.

The third step, comparing the identifiers on a card to thesubject, is an area where employers are not specially disabled -everyone has the same ability to compare a picture to the face infront of them - but here, again, employers will not be terriblyeager to discover deception, such as someone showing the card of adifferent person similar in appearance.

If the worker has opted to present separate identity andeligibility documents, the process for employer verification ofeligibility follows much the same path - and it carries the samerisks to the system.

The worker may have acquired the eligibility document by fraudor corruption, such as by wrongly acquiring a certified copy of abirth certificate matching the name on the identity document. Thesecurity of this kind of document tends to be low, which At issuein the second step is the security of the card against forgery ortampering. Though many government-issued ID documents are quiteresistant to forgery and tampering, the broadened use of thesedocuments (including for immigration control) has increased thevalue of forging such documents and devising ways to tamper withthem. Employers, who would be acting against their own interests todiscover such things, cannot be expected to discover forgery ortampering of any decent quality.

The third step, comparing the identifiers on a card to thesubject, is an area where employers are not specially disabled -everyone has the same ability to compare a picture to the face infront of them - but here, again, employers will not be terriblyeager to discover deception, such as someone showing the card of adifferent person similar in appearance.

If the worker has opted to present separate identity andeligibility documents, the process for employer verification ofeligibility follows much the same path - and it carries the samerisks to the system.

The worker may have acquired the eligibility document by fraudor corruption, such as by wrongly acquiring a certified copy of abirth certificate matching the name on the identity document. Thesecurity of this kind of document tends to be low, whichcompromises the second step in the process. Social security cards,for example, are relatively commonly forged. Because thesedocuments do not typically have any biometric identifiers, there isno way for the employer to check it against the worker. A merename-match to the identity document is taken as proof that theeligibility document is tied to the identity document which waspreviously tied to the worker.

Considering the many tenuous steps involved in the process, itis little wonder that deputizing employers as immigration agentshas not been an end to the U.S. economic "magnet." There are highfalse negatives in the system today.

This process is also a source of false positives, though. Itprevents people who are legally entitled to do so from working.

The requirement to present documents itself is a barrier toemployment, for example, particularly for homeless, indigent, andmentally ill people. Due to personal failing or not, they may lackeducation and basic coping skills, they may have experiencedviolence, theft of their belongings, and drug and alcoholaddiction. But when the time comes to clean up, pull themselves upby their bootstraps, and take that entry-level janitorial job,federal law requires them to present documents they often do nothave.

If the documents are unavailable, they must be applied forwithin three business days, and produced within 90 days, or the newemployee will be fired. People on the margins are undoubtedlydiscouraged and dissuaded from working by these barriers - low asthey may seem to the elites that populate the committee rooms andwitness tables in Congress.

Discrimination is another source of false positives. The I-9Form itself has prominent anti-discrimination information,undoubtedly because of employers' IRCA-inspired hesitance to employpotentially ineligible workers. Employers who want to hire workerswithout hassles, and who want to steer clear of liability underIRCA, will naturally gravitate away from job candidates whoseeligibility to work appears marginal. Workers with Hispanicsurnames, or who lack proficiency in English, are probably turnedaway by risk-averse employers long before the question ofdocumentation arises.

"Improving" Eligibility Screening with Electronic Checks

Given the flaws in the current system, it is unsurprising thatthere should be a push to improve it. However, improvements thatwould raise false positives should not be adopted. It is moreimportant that American citizens should be able to work than it isto exclude illegal aliens from working. There is probably noimprovement that lowers false negatives without raising falsepositives. This suggests that the policy of internal enforcementitself is the source of the problem. At least two attempts toimprove it have already failed.

The Illegal Immigration Reform and Immigrant Responsibility Actof 1996 required INS to commence three pilot programs to testelectronic verification of employees' eligibility to work: theCitizen Attestation Verification Pilot Program, theMachine-Readable Document Pilot Program, and the Basic PilotProgram. According to the Government Accountability Office, thethree pilot programs were to test whether pilot verificationprocedures could improve the existing Form I-9 process by reducing(1) document fraud and false claims of U.S. citizenship (i.e.,false negatives), (2) discrimination against employees (falsepositives), (3) violations of civil liberties and privacy, and (4)the burden on employers to verify employees' workeligibility.2

The Citizen Attestation Verification Pilot Program allowedworkers to attest to their citizenship status. The status of newlyhired employees attesting to being work-authorized noncitizens waselectronically checked against information in INS databases.Unsurprisingly, ineligible workers attested to being citizens.Employers, who lacked an interest in ferreting out this kind offraud, did not ferret out this kind of fraud. But they diddiscriminate against work-authorized noncitizens, likely because ofthe paperwork and liability risks such workers presented. TheDepartment of Homeland Security terminated the Citizen AttestationVerification Pilot Program in 2003.

The Machine-Readable Document Pilot Program was initiated inIowa because that state issued driver's licenses and identificationcards carrying the information required for the I-9 inmachine-readable form. The program had technical difficulties inreading the driver's licenses and IDs, and it was undermined by thestate's transition away from using Social Security numbers ondriver's licenses in the interest of Iowans privacy and datasecurity. DHS terminated the Machine-Readable Document PilotProgram in 2003 as well.

Basic Pilot is the remaining effort to verify work eligibilityelectronically. After completing the I-9 Forms, employers enter theinformation supplied by the worker into a government Web site. Thedata is then compared with information held by the Social SecurityAdministration and with DHS databases to determine whether theemployee is eligible to work.

Basic Pilot electronically notifies employers whether theiremployees' work authorization is confirmed. Submissions that theautomated check cannot determine are referred to U.S. Citizenshipand Immigration Service staff, who take further steps to verifyeligibility, or who determine the ineligibility of the worker.

When Basic Pilot cannot confirm a worker's eligibility, itissues the employer a "tentative nonconfirmation." The employermust notify the affected worker of the finding, and the worker hasthe right to contest his or her tentative nonconfirmation within 8working days by contacting SSA or USCIS. When a worker does notcontest his or her tentative nonconfirmation within the allottedtime, the Basic Pilot program issues a final nonconfirmation forthe worker and the employer is required to either immediatelyterminate the worker or notify DHS of the continued employment ofthe worker.

False Negatives Lowered, But at a Cost
Basic Pilot undoubtedly does have some controlling influence on therate of false negatives - ineligible workers being able to work.The submission of the worker's proffered name and Social Securitynumber to the Social Security Administration allows for a simplebackground check: comparing whether the name/SSN combinationsubmitted matches a combination in the SSA's files.

By databasing submissions, SSA can position itself to detectmultiple uses of the same name/SSN combination, such as when thesame "identity" is hired in multiple states during the same week.These types of checks increase the challenge for ineligible workersand probably reduce illegal working to some degree.

Given the economic incentives in favor of work, however, workers(and employers) will take a variety of counter-measures. Moreemployment will occur under the table, for example. Ineligibleworkers, or criminal organizations working on their behalf, maycorrupt employees in Social Security offices and the Department ofHomeland Security to obtain confirmations of eligible status. Thiskind of corruption routinely occurs in Departments of MotorVehicles across the country because of the value in having a real(though inaccurate) driver's license or state-issued ID card.

The primary counter-measure ineligible workers will take is toseek documents with genuine, but rarely used, name/SSNcombinations. The source of those identifier combinations, ofcourse, will be work-eligible Americans. Expanding Basic Pilot willincrease illicit trade in Americans' Social Security numbers andother identifiers. Expanding Basic Pilot will increase identityfraud.

False Positives Raised
While lowering false negatives and illegal working some, expandingBasic Pilot will also raise false positives. More work-eligibleAmericans will be denied employment.

The sources of false positives are many, and they will compoundto frustrate American workers and employers alike. For example,simple errors in data entry by employers will create a baselinemistaken "tentative nonconfirmation" rate, sending workers into theunwelcome embrace of federal bureaucratic offices andprocesses.

Last December, the Social Security Administration's Office ofInspector General estimated that the SSA's "Numident" file - thedata against which Basic Pilot checks worker information - has anerror rate of 4.1% . All of the cases it analyzed resulted in BasicPilot providing incorrect results.3 At this rate, one in every 25 new hires wouldreceive a "tentative nonconfirmation" and have to engage with thebureaucracy - most likely during hours they are supposed to be atthose new jobs. False positives would be high and costly under anexpanded Basic Pilot.

The "logic checks" that SSA might run are not as simple to dealwith as one might assume. Looking for the same "identity" hiredmultiple times in short succession, for example, would suggest thatsome workers are submitting fraudulent information, but it wouldnot reveal which ones. A work-eligible person would be just assuspect as the non-work-eligible people using his or herinformation.

The work-eligible person would probably be "tentativelynonconfirmed" like the rest, and have to prove that, among all thepeople using this identity, he or she is the true person. This willnot be easy for people with low levels of education, limitedproficiency in English, and other detriments. They may be pushedout of the legitimate working world, their identity fraudvictimization made worse by what they perceive only as confoundingbureaucratic procedures.

Let there be no illusion that people seeking redress for a"tentative nonconfirmation" from the Social Security Administrationor the Department of Homeland Security will enjoy a pleasant,speedy process. Offices where people seek redress for data errorswould be as friendly, courteous, responsive, and efficient as theDepartments of Motor Vehicles offices that Americans so dread.People will wait in line for hours to access bureaucrats that arenot terribly interested in getting them approved foremployment.

The consequences of scaling up a program like this should not beunderestimated. Basic Pilot has many flaws at its current size, butgrowing the program will create new and different problems. Goingfrom less than 20,000 employers to the entire nation is a change inkind, not degree. The employers in the program now are relativelywell-equipped and motivated compared to the variety of employers anexpanded Basic Pilot would encounter.

Most small businesses have no personnel dedicated to compliance.Many businesspeople are rarely connected or not connected to theInternet, either because of remoteness, cost, or lack of businessnecessity. The compliance, accuracy, and non-discrimination ratesexperienced in an expanded Basic Pilot would likely be lower thanwhat is currently seen.

The Costs of Expanded Electronic Verification

Beyond its influence on working, expanding electronicverification would impose many costs on the country and society.The dollar costs of a nationwide electronic verification systemwould be high. Electronic verification would have far greaterprivacy consequences than the current system - and theseconsequences would fall on American citizens, not on illegalimmigrants. Expanded electronic verification would invert ourfederal system and explode limited government. Final employmentdecisions would no longer be made by employers and workers, but bya federal government bureaucracy - or maybe two of them.

Taxpayer Dollars
In December 2005, the Congressional Budget Office estimated thecosts of the electronic employment verification system in H.R.4437, an immigration reform bill in the 109thCongress.4 Those costs weresubstantial.

Under the Basic Pilot expansion in that bill, CBO found that 50to 55 million new hires would have to be verified each year. Atotal of 145 million currently employed workers would have to havebeen screened using the expanded system by 2012. CBO's estimate wasconservative; it excluded agricultural workers.

Given the massiveness of the undertaking, CBO estimated $100million in short-run costs for upgrading software, hardware,databases, and other technology. To handle queries about "tentativenonconfirmations," the Department of Homeland Security and SocialSecurity Administration would have had to spend about $100 millionper year on new personnel. The federal government, states,localities, and private businesses would all have had to spend morefor screening their workers. Accordingly, CBO found that themandates in the bill would exceed the thresholds set by theUnfunded Mandates Reform Act of 1995.

Ironically (returning to substantive policy briefly again), allof this government spending and expanded bureaucracy would gotoward preventing productive exchanges between employers andworkers. Taxes and spending would rise to help stifle U.S. economicgrowth. Astounding.

American Citizens' Privacy
The American citizen taxpayer would not only incur pocketbook costsand increased bureaucracy, but lost privacy as well. An electronicsystem is not just a faster paper system. It has dramaticallydifferent effects on privacy.

When an employer fills out a form like the I-9 and puts it in afile, the information on the I-9 remains practically obscure. It isnot very easy to access, copy, or use. This protects privacy, andit protects against the data breaches we have heard so much aboutrecently. It is relatively inefficient - but secure in terms of theworker's privacy.

When an organization enters I-9 information into a Web form andsends it to the Social Security Administration and Department ofHomeland Security, that information becomes very easy for thoseentities to access, copy, or use. It is likely combined with"meta-data" - information about when the information was collected,from whom, and so on. The process gives these agencies access to awealth of data about every American's working situation. Andbecause it is tied to the Social Security number it can easily becorrelated with tax records at the IRS, education loan records inthe Department of Education, health records at the Department ofHealth and Human Services, and so on.

Unless a clear, strong, and verifiable data destruction policyis in place, any electronic employment verification system will bea surveillance system, however benign in its inception, thatobserves all American workers. The system will add to the datastores throughout the federal government that continually amassinformation about the lives, livelihoods, activities, and interestsof everyone - especially law-abiding citizens.

Many people believe that they have nothing to hide, and feelwilling to have their employment tracked if it will stop illegalimmigration. Unfortunately, it will not. And most people who makethe "nothing to hide" claim balk when they are actually confrontedwith stark choices about privacy. No one has ever mailed me theirtax forms so I can publish them on the Web.

People have things to hide. That is normal and natural. Indeed,many people object to information about themselves being compiledon principle, no matter who is doing it or what their purpose. Thatis an acceptable way of thinking in this country, where we allowlaw-abiding citizens to protect privacy for any reason or noreason.

Employment Eligibility Data and IdentityFraud
Disclosure to the government is not the only privacy-relatedconcern with an electronic employment verification system. Datasecurity is an issue as well. We have seen massive data breachesfrom government agencies in the recent past, and from privateentities too. Many occur by mistake. In some cases, a particularset of data is the target of a hacker or criminal.

Earlier in my testimony, I noted that a counter-measureineligible workers will use in the face of an electronic employmentverification system is to acquire new name and Social Securitynumber pairs. The very best source of this information will be thesystem itself - the Social Security Administration and DHSdatabases, the offices where "tentative nonconfirmations" areprocessed, the people that process them, and the communicationslinks that connect all these elements.

Any electronic employment verification system will be a targetfor hackers, a data breach waiting to happen, and a threat to theidentity system we rely on today. The best security against databreach is not collecting information in the first place. Electronicemployment verification would put Americans' sensitive personalinformation at risk.

Add-ons to Electronic Employment Verification: ANational ID System
As I discussed above, an expanded electronic employmentverification system would not just stop ineligible workers fromworking and employers from hiring them. It would change behavior,causing work to be done under the table and increasing identityfraud aimed at defeating the 'strengthened' system.

The establishment of such a system would also change thebehavior of governments. An electronic employment system wouldexpand over time and join with other programs. These behaviors arejust as important to consider.

Were an electronic employment verification system in place, itcould easily be extended to other uses. Failing to reduce the"magnet" of work, electronic employment verification could beconverted to housing control. Why not require landlords andhome-sellers to seek federal approval of leases and sales so as notto give shelter to illegal aliens? Electronic employmentverification could create better federal control of financialservices, and health care, to name two more.

It need not be limited to immigration control, of course.Electronic verification could be used to find wanted murderers, andit would move quickly down the chain to enforcement of unpaidparking tickets and "use taxes." Electronic employment verificationcharts a course for expanded federal surveillance and control ofall Americans' lives.

It is well recognized that Basic Pilot does little to detect orsuppress orthodox identity fraud, in which criminals or illegalaliens present false credentials. Employers - deputized asimmigration officials and acting against their interests - can beexpected to remain quite unhelpful at ferreting out this fraud.

Seeking to close this 'loophole,' many immigration reformproposals already include the creation of some form of nationalidentification scheme. With the REAL ID Act near collapse - statesare refusing to implement this unfunded surveillance mandate - thedominant proposal seems to be the idea of having a secure,biometric Social Security card. This has the same characteristicsand flaws as any other national ID system. These problems deservereview.

Costs to Taxpayers
The REAL ID Act has forced some analysis of having a national ID inthe U.S., and there is now cost information to work with. TheDepartment of Homeland Security recently estimated in its Notice ofProposed Rulemaking on the Act that implementing this national IDsystem would cost $17 billion dollars.5 This is a huge expenditure, which actually failscost/benefit analysis.6

REAL ID, of course, contemplates implementation by stateDepartments of Motor Vehicles, which are somewhat equipped for thelogistical problems involved in personal information collection(including biometrics) and card issuance. The Social SecurityAdministration has essentially no similar capacity - issuing a cardis the easy part. SSA would have to construct many more satelliteoffices, gain the capability to collect and store biometrics andother information, and build many other capabilities from scratch,at enormous further cost.

There are serious additional privacy concerns with the creation ofa nationally uniform identity system. Economists know well thatstandards create efficiencies and economies of scale. When all therailroad tracks in the United States were converted to the samegauge, for example, rail became a more efficient method oftransportation. The same train car could travel on tracks anywherein the country, so more goods and people traveled by rail. Anationally uniform "secure, biometric" Social Security card wouldhave the same influence on the uses of ID cards.

If all Americans had the same identification card, there wouldbe economies of scale in producing card readers, software, anddatabases to capture and use the information from the cards.Americans would inevitably be asked more and more often to produceidentification cards, and share the data from them, when theyengaged in various governmental and commercial transactions.

Various institutions would capitalize on the informationcollected in the federal database behind the card and harvestedusing these Social Security cards. Speaking to the Department ofHomeland Security's Data Privacy and Integrity Advisory Committeerecently, Anne Collins, the Registrar of Motor Vehicles for theCommonwealth of Massachusetts said, "If you build it they willcome." Speaking of REAL ID, she was pointing out that massedpersonal information would be an irresistible attraction to theDepartment of Homeland Security and many other governmentalentities, who would dip into data about us for an endless varietyof purposes.

The DHS NPRM on REAL ID cites some other uses that governmentswould make of REAL ID, including controlling unlawful employment,gun ownership, drinking, and smoking. Uniform ID systems are apowerful tool. Just like REAL ID, a secure, biometric SocialSecurity card would be used for many purposes beyond what arecontemplated today, including tracking of law-abiding citizens.

Transfer of Power
The old saw is true: Information is power. Uniform government IDsystems have important consequences in terms of the individual'srelationship to government. A major concern with national IDs isthe power that identification systems give to governments.

We are all well aware of the beneficent motives of mostgovernment employees, but good feelings are not good security.Governments and government officials do stray from the path oflawfulness, peace, and liberty. If the government knows where youare, if it knows where your assets are, if it knows how youcommunicate and with whom, it is in a much better position toaffect your life in ways you may not like.

Governments of the future, making use of national ID systems -and particularly electronic tracking - would not have to go throughthe difficulties they traditionally have when they want to affectthe rights and liberties of an individual. Large databases aboutpeople change the incentive structure that law enforcement andnational security agencies face.

To be simplistic, traditionally, law enforcement agencies haveinvestigated crimes. They have learned of something bad happeningor something bad about to happen, and they have gone after that.More and more, with data available about everybody, they will be ina position to investigate people, instead of crimes.

It is easy to overstate but impossible to deny that uniformnational ID systems are a threat to our freedoms. Places like NaziGermany, the Soviet Union, and apartheid South Africa all had veryrobust identification systems. Identification systems did not causethe tyranny or rank discrimination that overtook those countries,but identification systems were very good administrative systemsthat these oppressive regimes used.

Avoiding a national identification system is a bulwark againsttyranny. If our identity systems are difficult to navigate, thatprovides us security against broken democracy. I am very proud ofour government and our system, but we should take care to protectourselves by avoiding a national identification system.

As discussed above, identity fraud would be exacerbated byexpanding Basic Pilot. A uniform national ID system wouldcontribute further to this problem.

One reason why identity fraud is so easily engaged in today isthat a Social Security number is pretty much the only key that oneneeds to access people's financial lives. Because the system is sosimple and economically efficient, it is also efficient forcriminals. They navigate our identity system easily and use theSSN, plus one or two other identifiers, to break into people'sfinancial lives.

All of us are used to securing our physical assets with six,eight, or ten different keys that we keep on our key chains. It isa terrible security idea, ignoring the lesson we carry around inour pockets, to design a system that uses one key to control accessto our intangible lives: our finances, communications, health care,and so on.

Many technologists, and of course governments, think that asingle key is a great idea. It is true that a single-key systemsuch as a "secure, biometric" Social Security card would work verywell for institutions, but it would not secure the lives andprivacy of individuals. Our identification systems should bediversified, not unified. Bringing all Americans within a nationalID system is a massive undertaking that the rightfully independentand unruly American people will rightly resist.

The expansion of Basic Pilot would reduce illegal working some,at costs to American citizens in terms of suppressed legal working,higher taxes and more bureaucracy, and threats to privacy and datasecurity. It would leave open a rather significant 'loophole,'though, doing almost nothing to connect truly verifiable identityinformation to the eligibility decision. The solution to this - andthe ineluctable direction of an electronic employment verificationpolicy - is to create a national ID system. This is anathema toAmerican values.

Ultimately, the problem is with the policy of internalenforcement itself. For relatively small immigration controlbenefits, the costs of verifying eligibility are very high. Theparties to the employment eligibility system are required to actagainst their interests, meaning they will always slow-walkcompliance. The policy invites attacks on our already too fragileidentity system. And the privacy and dollar costs fall onlaw-abiding citizens, not wrongdoers.

Instead of moving to electronic eligibility verification, thepolicy of internal enforcement should be eliminated, root andbranch. The need for it can be dissipated, and legality fostered,by aligning immigration policy with the economic interests of theAmerican people. Legal immigration levels should be increased.

Ending Limited Government to Save It

Economics isn't everything. There are principles at stake herethat should not be forgotten. Proponents of internal enforcement,electronic employment verification, and national ID systems believestrongly that people who come here in violation of the law shouldnot enjoy this country's benefits. Were that the one foundingprinciple of our nation, they would be right in all that theysupport.

But many other principles are at stake: the individual libertyand personal freedom of American citizens; the constitutionallymandated limits on federal power; low taxes, minimal regulation,and competition; privacy.

I will close by observing a small, but very symbolic change thatelectronic employment verification would make: Up to this point inour nation's history, decisions about who should work for whom havebeen made by employers and workers. Even under the IRCA regime asit stands now, employers make the selection of who they will hire,perhaps accepting some potential liability if they hire someonethat is "ineligible." Letting workers and employers get together ontheir own terms makes eminent sense, just like people deciding forthemselves what food they should eat and how their kids should beschooled.

But with nationwide electronic employment verification, we wouldmove to a regime where the last word on employment decisions wouldnot be with the worker and employer, but with the federalgovernment. This is an extension of federal government power intoan area where it has no business being. The founders of our nationand the Framers of our Constitution would spin in their graves tosee what Congress is considering.

Proponents of internal enforcement and electronic employmentverification surely have a sound principle that they stand on. Butthey have grown willing to sacrifice more important, foundingprinciples for the less important goal of controlling illegalimmigration - and ineffectively at that.

1 Daniel T. Griswold,Immigration Reform Must Include a Temporary WorkerProgram, Orange County Register (Mar. 7, 2007)http://www.freetrade.org/node/600>.

2 See generally,Government Accounting Office, Immigration Enforcement: WeaknessesHinder Employment Verification and Worksite Enforcement Efforts,GAO-05-813 (Aug. 2005) .

3 Office of the InspectorGeneral, Social Security Administration, Accuracy of the SocialSecurity Administration's Numident File, A-08-06-26100 (Dec.2006) .

4Congressional BudgetOffice, Cost Estimate: H.R. 4437, Border Protection, Antiterrorism,and Illegal Immigration Control Act of 2005 (Dec. 13, 2005) .

5Minimum Standards forDriver's Licenses and Identification Cards Acceptable by FederalAgencies for Official Purposes; Proposed Rule 72 Fed. Reg. at10,845 (Mar. 9, 2007).

6Testimony of Jim Harper,Director of Information Policy Studies, The Cato Institute, to theSenate Committee on Homeland Security and Governmental Affairs,Subcommittee on Oversight of Government Management, the FederalWorkforce, and the District of Columbia at a hearing entitled"Understanding the Realities of REAL ID: A Review of Efforts toSecure Drivers' Licenses and Identification Cards" at 6-9 (Mar. 26,2007)

Jim Harper

Subcommittee on Immigration, Citizenship, Refugees, Border Security, and International Law
Committee on the Judiciary
United States House of Representatives