E-Verify and the Invasion of the Identity Snatchers

Summary

• The Immigration Reform and Control Act of 1986’s employer sanctions make it unlawful for an employer to hire (or continue to employ) an alien knowing the alien to be unauthorized to work. IRCA also established the “I-9” process in which employers are required to examine the identity and employment authorization documents of new hires.
• Unfortunately, the easy availability of counterfeit documents has made a mockery of IRCA’s employer sanctions. E-Verify, the generally voluntary electronic employment eligibility verification system created by Congress in 1996, was designed to heal IRCA’s Achilles’ heel. Based on the U.S. Commission on Immigration Reform’s 1994 recommendation, it compares the Social Security numbers provided by new employees against Social Security Administration records in order to weed out persons presenting fictitious Social Security numbers.
• News reports have periodically latched onto instances in which workers verified through E-Verify have turned out to be unauthorized to work. E-Verify is indeed neither impervious to identity theft, nor designed to be so. In fact, short of instituting a biometric national ID card, Congress and the administration can only constrain — not eliminate — the scourge of identity theft. This is as true in our tax system and in our banking system as it is regarding employment eligibility verification. And a “national ID card” is a political third rail in American politics. It is not going to happen.
• E-Verify’s defenses against identity theft are getting better all the time. One of the most important advances is “photo-matching”, in which employers check the photographs on the documents provided by new hires to demonstrate their identities against the photos maintained by the issuers of those documents, in order to weed out documents altered for the purpose of creating fictitious identities.
• Photo-matching is done when new hires show either a DHS employment authorization document, a green card, or a U.S. passport. But the majority of new hires provide a driver’s license to demonstrate identity. Thus, photo-matching needs to be expanded to include driver’s licenses. But not all states will cooperate in giving DHS access to their departments of motor vehicles driver’s license photos. Indeed, New York has enacted a law generally forbidding its DMV from sharing DMV records, including photos, with immigration enforcement agencies. The Trump administration sued New York over this law earlier this year, seeking a permanent injunction against its enforcement.
• The single most impactful step that Congress can take to curtail the impact of identity theft on E-Verify is to require states to grant DHS access to their DMV driver’s license photos for use with E-Verify. This would dramatically limit the ability of unauthorized aliens to use borrowed or stolen SSNs to defeat E-Verify, as even with such valid SSNs, they would not be able to provide employers with photo IDs whose photographs match those provided to the employers by USCIS.
• Would such a requirement be constitutional under the Supreme Court’s Tenth Amendment “commandeering” doctrine, which bars the federal government from forcing states to enact or administer federal regulatory programs? Very likely, yes, it would be constitutional:
  • The Supreme Court by its own admission has not yet ruled as to whether federal requirements that states simply provide it with information — “purely ministerial reporting requirements” such as requiring law enforcement agencies to report cases of missing children to the Department of Justice — should be considered unconstitutional commandeering.
  • A Supreme Court decision written by Chief Justice William Rehnquist found to be constitutional a federal law restricting the states’ ability to disclose/sell drivers’ personal information retained by their DMVs without the drivers’ consent. The Court concluded that the law “did not run afoul of the federalism principles enunciated” in the commandeering cases, explaining that the law “does not require the States in their sovereign capacity to regulate their own citizens” but, rather, “regulates the States as the owners of data bases”.

---

IRCA’s Achilles’ Heel

The Immigration Reform and Control Act of 1986’s (IRCA) employer sanctions provided that:

It is unlawful for a[n employer] … to hire … for employment in the United States an alien knowing the alien is an unauthorized alien … with respect to such employment … [or] to continue to employ the alien … knowing the alien is (or has become) an unauthorized alien with respect to such employment.

IRCA also established the associated “I-9” verification process in which employers are required to examine the identity and employment authorization documents of new hires. In 1995, Barbara Jordan, then chairwoman of the U.S. Commission on Immigration Reform (Jordan Commission), explained the failings of this process to the House Judiciary Committee:

The current process of employment verification has not functioned as [IRCA] intended to deter the hiring of undocumented aliens. The system may be thwarted easily by fraud. Widespread counterfeiting of documents that can be used for verification of identity and employment authorization has been reported since IRCA’s implementation.

In 1997, U.S. Rep. Lamar Smith (R-Texas) (and Edward Grant, who then served with me as counsel to the House Judiciary Committee’s Subcommittee on Immigration and Claims) similarly explained that:

• The enforcement centerpiece of the IRCA — sanctions against employers who hire illegal aliens — failed to include any system whereby employers could reasonably verify the status of their new employees. A booming market in fraudulent documents soon developed.

• Unfortunately, the easy availability of counterfeit documents … made a mockery of the law. Fake documents were produced in mass quantities. … As a result, even the vast majority of employers who wanted to obey the law had no reliable means of identifying illegal aliens. … At the other extreme, rogue employers could easily collude with illegal alien employees to avoid the provisions of IRCA … comfortable in the knowledge that they were presented with “genuine” documents.

E-Verify

E-Verify was designed to heal IRCA’s Achilles’ heel, in the words of Smith and Grant to “make fraudulent documents useless … [and] give employers the tools they need to hire legal workers”.

Congress created E-Verify through the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA). Smith first included what is now known as E-Verify in H.R. 2202, the House of Representative’s foundation for IIRIRA. He based it on the Jordan Commission’s 1994 recommendation to Congress that “[a] better system for verifying work authorization is central to the effective enforcement of employer sanctions”, involving, in the words of Chairwoman Jordan, a “computerized registry” allowing “an employer [to] check that [a new hire’s] social security number [SSN] is valid and has been issued to someone authorized to work in the United States”.

For those who are interested, I have written here about how E-Verify came to be. In any event, the House Judiciary Committee’s report on H.R. 2202 explained that:

[T]here must be an authoritative check of the veracity of the documents provided by new employees. … If a verification mechanism could compare the [SSN] (and, for a noncitizen, alien number) provided by new employees against the existing databases, individuals presenting fictitious numbers and counterfeit documents, or who are not authorized to be employed, would be identified.

According to U.S. Citizenship and Immigration Services (USCIS), which administers E-Verify, the number of participating employers in the generally voluntary program has increased from 265,453 in fiscal year 2011 to 1,392,898 currently, and in fiscal year 2024 E-Verify verified 43,495,876 employees. USCIS reports that Alabama, Arizona, Florida, Georgia, Idaho, Indiana, Louisiana, Michigan, Minnesota, Mississippi, Missouri, Nebraska, North Carolina, Oklahoma, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, and West Virginia “have contracting or business licensing laws with E-Verify enrollment as a condition for some or all employers”.

E-Verify has been highly successful. Just over the years 2021-2024, it denied employment to 849,914 illegal or otherwise unauthorized-to-worker aliens (133,436 in 2021, 213,814 in 2022, 260,681 in 2023, and 241,983 in 2024).

Further, economists Pia Orrenius and Madeline Zavodny concluded in a 2016 paper evaluating state mandatory E-Verify laws that:

• E-Verify laws reduce the number of unauthorized immigrants in a state. This effect tends to be concentrated among recent arrivals and is particularly large for newly arriving immigrants … . [T]he evidence suggests that E-Verify laws divert some newly arriving unauthorized immigrants to other states. The number of new likely unauthorized immigrants rises in a state as more nearby states begin requiring employers to use E-Verify.

• [However,] the results … suggest that most of the drop in the number of already-present unauthorized immigrants in states that adopt universal E-Verify laws is due to them leaving the USA entirely.

The following year, Orrenius and Zavodny wrote a report issued by the Federal Reserve Bank of Dallas concluding that:

[C]ompared with what would probably have otherwise occurred, states with universal E-Verify policies typically experienced large reductions in the number of likely unauthorized immigrants and even greater declines in the number of unauthorized workers. The impact on the number of employed likely unauthorized immigrants outweighed the effect on the likely unauthorized population in all five states with statistically significant results, suggesting that though some unauthorized immigrants may choose to avoid or leave a state with a mandate, job opportunities for those who do reside there decrease.

Orrenius stated that the report’s “key takeaways” were that “E-Verify, when it’s mandatory … can have very large deterrent effects on the employment of undocumented immigrants and possibly also on … illegal immigration”.

E-Verify and Identity Theft

News reports have periodically focused instances in which workers verified through E-Verify have turned out to be unauthorized to work in the U.S. For instance, in 2019, Cindy Carcamo and Jenny Jarvie reported in the Los Angeles Times that:

• [M]assive [U.S. Immigration and Customs Enforcement (ICE)] raids at poultry plants across Mississippi … exposed the poultry industry’s widespread use of unauthorized workers despite … E-Verify.

• [E-Verify] has a major weakness well known to those who work in the chicken factories: It does not detect when a job applicant is using somebody else’s identity.

• Some workers without legal status borrow the identities of friends. Others pay for the stolen identification of unknowing or dead citizens. Meanwhile, some companies use E-Verify improperly, and unscrupulous ones can accept shady documents while maintaining that they use the system.

And, more recently, Nicole Acevedo reported for NBC News that:

• In Nebraska … federal immigration authorities arrested 76 employees of a meatpacking plant.

• Federal authorities accuse the workers of using stolen identities from U.S. citizens to unlawfully gain employment.

• “They were stealing the identities of over a hundred U.S. citizens,” [Elhrick] Cerdan [the assistant special agent in charge of [ICE’s] Homeland Security Investigations in Nebraska, who led the enforcement operation] said.

  Every employee at Glenn Valley Foods, including those who were detained, was approved through E-Verify, the company’s president … told NBC News.

E-Verify is indeed neither impervious to identity theft, nor designed to so be. As the House Judiciary Committee noted, it was designed to identify “individuals presenting fictitious numbers and counterfeit documents, or who are not authorized to be employed”.

In 1995, Dr. Shirley Charter, commissioner of the Social Security Administration (SSA), explained to the House Governmental Reform and Oversight Committee’s Subcommittee on Government Management in reference to E-Verify-like proposals that “there is no way to be sure that the job applicant presenting a valid Social Security card is the person to whom it was issued”. More recently, in 2005, the U.S. Government Accountability Office (GAO) explained:

[E-Verify] … cannot currently help employers detect identity fraud. … If an unauthorized worker presents valid documentation that belongs to another person authorized to work, [E-Verify] may find the worker to be work-authorized. Similarly, if an employee presents counterfeit documentation that contains valid information and appears authentic, [E-Verify] may verify the employee as work authorized.

And Westat pointed out in a 2009 report to DHS that:

Another way for unauthorized workers to obtain employment is to use valid documents belonging to another person. For example, individuals may borrow documents belonging to relatives or friends, use stolen documents, or purchase valid documents that have been sold by the owner. … E-Verify cannot identify these documents as fraudulent since they are, in fact, genuine.

But it is imperative to keep in mind that, short of instituting a biometric national identification card, Congress and the administration can only constrain — not eliminate — the scourge of identity theft. This is as true in our tax system and in our banking system as it is regarding employment eligibility verification. Dan Cadman has observed that:

The United States, by virtue of its openness and its robust market economy, is a nation awash in a sea of fraud. There’s mortgage loan fraud, student loan fraud, Social Security fraud, Medicare fraud, bank fraud, ad infinitum. You name it, fraud will be there, and that’s true no matter what safeguards are put into place. For every security regimen one human crafts, there will be another human seeking to cheat it or defeat it. Does that mean we should scrap such systems? Put that way, it sounds foolish, doesn’t it?

And Westat speculated in its 2009 report that:

As it becomes harder to obtain fraudulent documents that will not be detected by E-Verify, the cost of such documents will presumably increase. Therefore, an important deterrent value … ultimately may be to increase the cost of obtaining unauthorized employment, which, in turn, would cause some reduction in unauthorized employment.

Let’s not let the perfect be the enemy of the great.

Further, let me further make two important points:

O Big Brother, Where Art Thou?

First, a “national ID card” is a political third rail in American politics. It is not going to happen.

It is not that such national ID cards have not been proposed. In 2010, now Senate Democratic Leader Charles Schumer (D-N.Y.) and Sen. Lindsey Graham (R-S.C.) proposed “requiring biometric Social Security cards to ensure that illegal workers cannot get jobs”, explaining that:

We would require all U.S. citizens and legal immigrants who want jobs to obtain a high-tech, fraud-proof Social Security card. Each card’s unique biometric identifier would be stored only on the card; no government database would house everyone’s information. The cards would not contain any private information, medical information or tracking devices. The card would be a high-tech version of the Social Security card that citizens already have.

Stuart Anderson, executive director of the National Foundation for American Policy, concluded that the Schumer/Graham proposal “means [DHS] will be overseeing the taking of fingerprints and/or other biometric data from Americans who will be required to march down to a federal office and obtain a National ID card if they wish to work in the United States”.

And there’s the rub, that a national ID card is a third rail.

In 1996, accusations that E-Verify constituted, or would be a catalyst for, a national ID card, nearly derailed E-Verify. During the House Judiciary Committee’s markup of H.R. 2202, an amendment to strike E-Verify entirely was barely defeated by a vote of 15-17 (Republicans 7-13, Democrats, 8-4). House Judiciary Committee ranking member John Conyers, Jr. (D-Mich.) and seven other Democrats stated in the Committee’s report on H.R. 2202 that:

• H.R. 2202 will truly usher in the era of a “Big Brother[]”.

• [O]minously, since [E-Verify] will inevitably be subject to government errors and discrepancies, it may well be a mere prelude to a full-fledged national ID card, complete with voice, retina and fingerprint identifiers.

The assault continued on the House floor (where an amendment to strike E-Verify was defeated by a vote of 159-260 (with 79 Republicans and 79 Democrats voting in favor):

• U.S. Rep. Esteban Torres (D-Calif.) stated “[D]o not be deluded. This employment verification is only the first step. … [T]his is the nose under the tent towards a national identification card, a first step towards the loss of our freedom.”
• U.S. Rep. Bill Richardson (D-N.M.) stated that “We do not need big brother to keep track of our citizens, and this is what we are doing with a national ID system.”
• U.S. Rep. Sheila Jackson Lee (D-Texas) warned that E-Verify “would lead to an intrusive national ID card”.
• U.S. Rep. José Serrano (D-N.Y.) stated that the system “ultimately can’t work without … a national ID card to tie a person to the name and number he or she present to a potential employer”.

It was not just Democrats warning that E-Verify would usher in a national ID card. Judiciary Committee Republican member Steve Chabot (R-Ohio) — who had offered both the committee and the floor amendment to kill E-Verify — stated during House floor debate that:

• [Some House Members] argued that without a national ID, anyone could buy fake documents with corresponding numbers and cheat the system. So we know what is coming next, a national ID card in all likelihood.

• Every American citizen at the end of this road will have to carry a national ID card around with their picture, perhaps retina scans, and God knows what is going to be on this card.

Dire warnings have also come since 1996 whenever Congress has attempted to expand E-Verify (most significantly by making it mandatory for all employers). In 2011, John Whitehead, president of the Rutherford Institute, wrote in apocalyptic terms in the Huffington Post:

• Because the E-Verify system would apply to everyone eligible to work in the United States and will grow to include biometrics such as fingerprints, DNA and iris scans, it will be used for a host of other purposes by the intelligence community, law enforcement and corporate America.

• Despite assurances to the contrary, E-Verify will become a de facto National ID system. Such a database with vast pools of personal information directly tied to individuals shared across a multitude of government agencies would give the government an alarming amount of control over the average citizen. If government officials so chose, they could easily track any person who had registered in the E-Verify system for whatever reason.

• The E-Verify system … will allow government and corporate officials to repress dissidents and suspects simply by restricting their access to basic services. Once all of your information is tied together and placed in one grand database, any government or corporate agency can wreak havoc on your life. … Make no mistake, these are the tactics of a totalitarian society.

• National identity cards … carry with them a historic risk of oppression and persecution, as they have been used to identify and track ethnic, racial and religious groups and have facilitated oppression and persecution against these groups. And as recently as the 1990s, identity cards played an instrumental role in one of the worst genocides of the twentieth century, second only perhaps to the Holocaust.

  With the introduction of an identity card that contains information such as ethnic origin, government agencies will be able to identify people on the basis of race or religion with considerable ease.

• Rest assured that were Congress to approve [Lamar Smith’s H.R. 2885 (112th Congress), making E-Verify mandatory for all employers], it would … open the door to a National ID. Thus, we have reached a crossroads. Either we limit the reach and power of the government (often in collusion with corporate power) or privacy as we have known it will become extinct.

No wonder that IIRIRA, in an attempt to escape these Hitlerian allusions, itself emphasized that E-Verify entailed “NO NATIONAL IDENTIFICATION CARD”, providing that “[n]othing in this subtitle shall be construed to authorize, directly or indirectly, the issuance or use of national identification cards or the establishment of a national identification card”! (I should note in full disclosure that I drafted the text of IIRIRA’s E-Verify provision to Rep. Smith’s specifications.)

E-Verify’s Getting Better All the Time

Second, as the Beatles might say, you have to admit that E-Verify’s defenses against identity theft are getting better all the time (within the constraints of current law). One of the most important advances is “photo-matching”, in which employers check the photographs on the documents provided by new hires to demonstrate their identities against the photos maintained by the issuers of those documents, in order to weed out documents altered for the purpose of creating fictitious identities.

In 2005, GAO noted that:

DHS officials told us that the department is currently considering possible ways to enhance [E-Verify] to help it detect cases of identity fraud, for example, by modifying the program to provide a digitized photograph associated with employment authorization information presented by an employee.

Such “photo-matching” happened soon after. Andorra Bruno, specialist in immigration policy at the Congressional Research Service, has written that:

In September 2007, [USCIS] launched a Photo Screening Tool … [which] comes into play if a new hire presents an Employment Authorization Document (EAD), a Permanent Resident Card (green card) … or a U.S. Passport to establish employment authorization. In such cases, the employer checks the photo on the document provided by the new hire against the image stored in USCIS databases. This tool enables detection of legitimately issued documents that have been altered by photo-substitution.

Thus, as the House Judiciary Committee put it, “Employers can now match the photo in E-Verify to the photo on the identity document presented by the employee.”

USCIS’s “E-Verify Users Manual” instructs employers that:

E-Verify photo matching will prompt the E-Verify user to compare the employee’s photo document with a photo displayed during creation of the E-Verify case. This helps ensure that the document the employee provided matches records available to DHS.

The four … documents that will trigger photo matching are the U.S. passport, passport card, Permanent Resident Card … and Employment Authorization Document [EAD]…. When the employee presents one of these documents, employers must copy … the document … and retain the copies with Form I-9. If the employee’s Form I-9 information matches records available to DHS, E-Verify displays the employee’s photo from the document presented.

To match photos, compare the photo displayed by E-Verify to the photo on the employee’s actual document or a copy of the employee’s document and determine if the photos are reasonably identical.

Bruno explained that in addition to photo matching, DHS has developed RIDE:

Another feature to reduce inaccurate findings for unauthorized workers is known as Records and Information from DMVs [Departments of Motor Vehicles] for E-Verify (RIDE). Launched in June 2011, RIDE seeks to detect document fraud in cases in which a new hire presents a driver’s license or state-issued identification card to establish identity as part of the I-9 process. When a new hire presents a driver’s license or state-issued identification card from a participating state, RIDE enables E-Verify to compare the information on the document against state records. Mississippi became DHS’s first partner in this effort in June 2011. Since then, nine other states have joined the RIDE program.

And Bruno explained that DHS has developed Social Security number “locking” features:

A November 2013 enhancement to E-Verify enables the system to lock [SSNs] that appear to have been used fraudulently. According to USCIS, it “will use a combination of algorithms, detection reports and analysis to identify patterns of fraudulent SSN use and then lock the number in E-Verify.” A more recent enhancement, known as my E-Verify, builds on this lock feature and the Self Check initiative [which allows person to “E-Verify themselves” to ensure that they would be correctly found to be work authorized]. … By creating a my E-Verify account, individuals … have the ability to lock their own Social Security numbers to prevent unauthorized use in E-Verify and to track where their identities have been used in E-Verify and Self Check.

Congress can certainly give DHS additional tools. Lamar Smith proposed in H.R. 1772 in the 114th Congress (making E-Verify mandatory for employers) that:

• [DHS], in consultation with [SSA], shall establish a program in which [SSNs] that have been identified to be subject to unusual multiple use in [E-Verify] … or that are otherwise suspected or determined to have been compromised by identity fraud or other misuse, shall be blocked from use for such system purposes unless the individual using such number is able to establish, through secure and fair additional security procedures, that the individual is the legitimate holder of the number.

• [DHS], in consultation with [SSA], shall establish a program which shall provide a reliable, secure method by which parents or legal guardians may suspend or limit the use of the [SSN] or other identifying information of a minor under their care for the purposes of [E-Verify].

The legislation was reintroduced this January (H.R. 251) by U.S. Reps. Ken Calvert (R-Calif.) and Tom McClintock (R-Calif.). And this March, U.S. Sen. Chuck Grassley (R-Iowa) introduced S. 1151, which provides that “E-Verify shall be designed and operated”:

to preserve the security of the information in all of the system by—

(A) developing and using algorithms to detect potential identity theft, such as multiple uses of the same identifying information or documents;

(B) developing and using algorithms to detect misuse of the system by employers and employees;

(C) developing capabilities to detect anomalies in the use of the system that may indicate potential fraud or misuse of the system; and

(D) auditing documents and information submitted by potential employees to employers, including authority to conduct interviews with employers and employees.

The Department of Justice can also more vigorously prosecute persons who commit identity theft crimes impacting E-Verify. As my colleague Andrew Arthur has written:

• [W]hether it is the worker or the employer or both who skirts the law, there is a significant amount of criminal exposure for all those involved. Strict enforcement of the laws that either or both violate, particularly in high-profile cases, will likely stem attempts to subvert E-Verify.

• Any system can be subverted, but employers and employees are rational actors. If they know the punishment they could face is sure and severe enough … they will not attempt to engage in the fraud necessary to subvert E-Verify. A loss of a significant amount of money, and one’s freedom for years, simply would not be worth the risk.

Enhancing the Effectiveness of Photo-Matching and Requiring States to Provide DHS with Driver’s License Photos and Participate in RIDE

Enhancing the Effectiveness of Photo-Matching

First, photo-matching should require an employer to compare a document photo to a new employee’s face. The House Judiciary Committee’s report on H.R 1772 explained that “USCIS procedures only allow the employer to match the photo matching tool photograph to the photograph on the document submitted to the employee, not to the actual face of the employee.” In fact, USCIS directs employers to “compare the photo displayed in E-Verify with the photo on the employee’s document, not with the actual employee” The Judiciary Committee concluded that “This is nonsensical if the goal is to actually prevent identity theft.” H.R. 1772 would have “require[d] … an employer who utilizes the photo matching tool that is part of E-Verify, to match the photo tool photograph to both the photograph on the identity or employment eligibility document provided by the employee and to the face of the employee submitting the document for employment verification purposes”.

Second, in 2021, DHS’s Office of the Inspector General (IG) issued a report finding that:

In FY 2019, E-Verify bypassed the photo-matching requirement for hundreds of thousands of individuals. Specifically, when E-Verify could not locate necessary documents in its initial search, the system bypassed the photo comparison step. For example, if an employer incorrectly entered a Permanent Resident Card or EAD number, the system would not be able to locate the document in system records and retrieve the photo for employer matching. … [D]uring FY 2019, approximately 280,000 non-U.S. citizens (or 9 percent of all non-U.S. citizens processed by E-Verify) were approved for employment without their cases being referred for manual review and without employer photo matching.

The IG recommended that “In these cases, the system should trigger a manual review requiring the employee to submit the document for a USCIS examiner to confirm identity.”

Requiring States to Provide DHS with Driver’s License Photos and Participate in RIDE

Bruno concluded that “The effectiveness of the Photo Tool … is greatly limited by the fact that a new hire does not have to show either an EAD, a green card, or a U.S. Passport; a new hire can opt to show other documents to evidence his or her identity and employment eligibility.” DHS’s IG report noted that “the majority of individuals submit a driver’s license to prove identity” and E-Verify “does not use photos to ensure that individuals match the license submitted”.

Why not? The IG report explained that “USCIS does not have access to driver’s license photos in NLETS [the National Law Enforcement Telecommunications System] records to allow employers to compare the photos from system records to the photos on submitted licenses. Without such access, E-Verify confirms only whether a driver’s license exists and is valid.”

But, to be fair, USCIS officials told the IG that “NLETS and states may have concerns about DHS’ use of the photos and may not be willing to share them without a Federal mandate.” The IG “acknowledge[d] USCIS’ position that it cannot mandate states to provide driver’s license data/photos” and “encourage[d] USCIS to engage with states to explore the possibility”.

Engage with states to explore the possibility? The only way that DHS can engage with states like New York is to bring them to federal court. In 2019, New York State enacted its “Driver’s License Access and Privacy Act” (the “Green Light Law”). The Trump administration sued New York earlier this year, seeking a permanent injunction against the law’s enforcement. The U.S. alleges in its Complaint in United States v. New York that:

The Green Light Law generally bars the sharing of New York State [DMV] records or information (e.g., addresses, vehicle registrations, identification photos) with federal immigration agencies. … And it requires [the] DMV … to promptly tip off any illegal alien when a federal immigration agency has requested his or her information. … As its supporters and sponsors made clear, the Green Light Law was passed to directly impair the enforcement of the federal immigration laws in New York. And those lawmakers have achieved their objective.

The law, as amended, provides that:

• Any portion of any record retained by the [DMV] in relation to a non-commercial driver’s license … application or renewal application that contains the photo image or identifies the [SSN], telephone number, place of birth, country of origin, place of employment, school or educational institution attended, source of income, status as a recipient of public benefits, the customer identification number associated with a public utilities account, medical information or disability information of the holder of, or applicant for, such license … is not a public record and shall not be disclosed in response to any request for records except: (a) to the person who is the subject of such records; or (b) where expressly required pursuant to chapter three hundred three of part A of subtitle vi of title forty-nine of the United States code [relating to the National Driver Register that “assist[s] chief driver licensing officials of participating States in exchanging information about the motor vehicle driving records of individuals”]; or (c) where necessary to comply with a lawful court order, judicial warrant signed by a judge appointed pursuant to article III of the United States constitution, or subpoena for individual records issued pursuant to the criminal procedure law or the civil practice law and rules. [Emphasis added throughout.]

• Except as required for the [DMV] to issue or renew a driver’s license … that meets federal standards for identification … the [DMV] shall not disclose or make accessible in any manner records or information that he or she maintains, to any agency that primarily enforces immigration law or to any employee or agent of such agency, unless … presented with a lawful court order or judicial warrant signed by a judge appointed pursuant to article III of the United States constitution.

• The [DMV] shall require any person or entity that receives or has access to records or information from the [DMV] to certify … before such receipt or access, that such person or entity shall not (i) use such records or information for civil immigration purposes or (ii) disclose such records or information to any agency that primarily enforces immigration law or to any employee or agent of any such agency unless such disclosure is pursuant to a cooperative arrangement between city, state and federal agencies which arrangement does not enforce immigration law and which disclosure is limited to the specific records or information being sought pursuant to such arrangement.

As to the “tip-off provision”, the law states that:

Upon receiving a request for such records or information from an agency that primarily enforces immigration law, the commissioner shall, no later than three days after such request, notify the individual about whom such information was requested, informing such individual of the request and the identity of the agency that made such request.

The single most impactful step that Congress can take to curtail the impact of identity theft on E-Verify is to require states to grant DHS access to their DMV driver’s license photos for use with E-Verify. This would dramatically limit the ability of unauthorized aliens to use borrowed or stolen SSNs to defeat E-Verify, as even with such valid SSNs, they would not be able to provide employes with photo IDs whose photographs match those provided to the employers by USCIS. It would also be valuable for Congress to require states to participate in RIDE or to otherwise grant DHS access to their driver’s license files.

Of course, it is always possible for aliens to procure official driver’s licenses with their photographs but with the names of the persons whose SSNs they have borrowed or stolen — through corrupt DMV officials or by submitting fake documentation that defeats DMV security protocols. But, again, without a national ID card, some level of risk is inevitable. In addition, for driver’s licenses to meet federal REAL ID Act requirements:

Before issuing a driver’s license or identification card to a person, the State shall verify, with the issuing agency, the issuance, validity, and completeness of each document required to be presented by the person [including]…

(A) A photo identity document, except that a non-photo identity document is acceptable if it includes both the person’s full legal name and date of birth.

(B) Documentation showing the person’s date of birth.

(C) Proof of the person’s [SSN] or verification that the person is not eligible for a [SSN].

(D) Documentation showing the person’s name and address of principal residence.

Pursuant to IRCA, the only documents that new hires can provide to employers in the I-9 verification process for purposes of establishing both identity and work authorization are:

• a United States passport, or

• a resident alien card, alien registration card, or other document designated by DHS, that:

  (I) contains a photograph of the individual and such other personal identifying information relating to the individual as [DHS] finds, by regulation, sufficient for purposes of this subsection,

  (II) is evidence of authorization of employment in the United States, and

  (III) contains security features to make it resistant to tampering, counterfeiting, and fraudulent use.

And the only documents that new hires can provide to employers in the I-9 verification process for purposes of establishing identity (but not work authorization) are:

driver’s license or similar document issued for the purpose of identification by a State, if it contains a photograph of the individual or such other personal identifying information relating to the individual as [DHS] finds, by regulation, sufficient for purposes of this section; or

… in the case of individuals under 16 years of age or in a State which does not provide for issuance of an identification document (other than a driver’s license) … documentation of personal identity of such other type as [DHS] finds, by regulation, provides a reliable means of identification.

It is true that DHS regulations now deem acceptable for purposes of establishing identity a dizzying array of documents, but Congress can specify (or DHS can itself modify its regulations to ensure) that such documents must contain a photograph, and that the issuers grant DHS access to the photos in their records.

This all brings up the question:

Is It Constitutional to Require States to Provide DHS with Driver’s License Photos and Participate in RIDE?

The Trump administration’s Memorandum of Law in United States v. New York contends that:

The[ “Green Light Act”’s contested provisions] are facially invalid under the [U.S. Constitution’s] Supremacy Clause for at least four reasons. First, the information-sharing restriction and certification requirement are expressly preempted because they foreclose activity that is authorized under 8 U.S.C. § 1373(a). Second, all the challenged provisions are conflict preempted by the Immigration and Nationality Act because they have the purpose and effect of thwarting federal immigration operations. Third, all the challenged provisions unconstitutionally regulate federal officials in the performance of their duties, thereby violating intergovernmental immunity principles. And fourth, those provisions alternatively violate intergovernmental immunity principles by discriminating against the Federal Government.

For those who are interested, I have previously analyzed in detail these sort of Supremacy Clause claims here.

Let me focus now on the question as to whether a federal law requiring states to grant the federal government access to their DMV driver’s license photos (and other DMV records) would violate the Tenth Amendment by “commandeering” state agencies and officials into enacting or administering a federal regulatory program. (For those who are interested, I have more comprehensively analyzed the commandeering doctrine here.)

The Supreme Court ruled in 1992 in New York v. United States, with Justice Sandra Day O’Connor writing the majority opinion, that “The Federal Government may not compel the States to enact or administer a federal regulatory program” and that “even where Congress has the authority under the Constitution to pass laws requiring or prohibiting certain acts, it lacks the power directly to compel the States to require or prohibit those acts.”

Justice Samuel Alito explained why in his majority opinion in the Supreme Court’s 2018 decision in Murphy v. Nat’l Collegiate Athletic Ass’n:

• The Constitution confers on Congress … only certain enumerated powers. … And conspicuously absent from the list of powers given to Congress is the power to issue direct orders to the governments of the States. The anticommandeering doctrine simply represents the recognition of this limit on congressional authority.

• The anticommandeering doctrine may sound arcane, but it is simply the expression of a fundamental structural decision incorporated into the Constitution, i.e., the decision to withhold from Congress the power to issue orders directly to the States.

As Justice Antonin Scalia, explained in his majority opinion in the Supreme Court’s 1997 decision in Printz v. United States:

Although the States surrendered many of their powers to the new Federal Government, they retained “a residuary and inviolable sovereignty,” The Federalist No. 39 … (J. Madison). … Residual state sovereignty was … implicit … in the Constitution’s conferral upon Congress of not all governmental powers, but only discrete, enumerated ones, Art. I, § 8, which implication was rendered express by the Tenth Amendment’s assertion that “[t]he powers not delegated to the [U.S.] by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.”

However, and of extreme importance for the constitutionality of a federal law requiring states to grant the federal government access to their DMV driver’s license photos, Justice Scalia noted in Printz that:

The Government points to a number of federal statutes enacted within the past few decades … which require only the provision of information to the Federal Government, [but] do not involve the precise issue before us here, which is the forced participation of the States’ executive in the actual administration of a federal program. We of course do not address these or other currently operative enactments that are not before us; it will be time enough to do so if and when their validity is challenged in a proper case.

Thus, the Court in Printz left as an open question whether federal requirements for the provision of information should be considered unconstitutional commandeering, as Justice O’Connor emphasized in her concurring opinion:

[T]he Court appropriately refrains from deciding whether other purely ministerial reporting requirements imposed by Congress on state and local authorities pursuant to its Commerce Clause powers are similarly invalid. See, e. g., 42 U. S.C. § 5779(a) (requiring state and local law enforcement agencies to report cases of missing children to [DOJ].¹

The Supreme Court’s eventual answer to this question will also decide whether Congress can pass a law requiring states to grant the federal government access to their DMV driver’s license photos.

It is true that Justice Scalia wrote in Printz

The Government … maintains that requiring state officers to perform discrete, ministerial tasks specified by Congress does not violate the principle of New York because it does not diminish the accountability of state or federal officials. This argument fails even on its own terms. By forcing state governments to absorb the financial burden of implementing a federal regulatory program, Members of Congress can take credit for “solving” problems without having to ask their constituents to pay for the solutions with higher federal taxes. And even when the States are not forced to absorb the costs of implementing a federal program, they are still put in the position of taking the blame for its burdensomeness and for its defects.

However, as opposed to requiring local officials to conduct required gun purchase background checks (the challenged federal mandate in Printz), requiring states to grant the federal government access to DMV driver’s license photos and other records neither carries with it a financial burden nor makes the states take the blame for anything.

In 2019, the 9^th Circuit in U.S. v. California² went so far as to read Printz to “impl[y] the existence of a Tenth Amendment exception for reporting requirements”. And the Trump administration’s Memorandum of Law in United States v. New York goes so far as to contend that New York “ignore[s] the Supreme Court’s recognition that information-reporting regulations do not have the same attendant Tenth Amendment concerns even though typically applicable to state and local governments”. Well, not to jump the gun regarding Printz, it does still remain to be seen whether the Supreme Court will explicitly carve out ministerial reporting requirements from the commandeering ban. However, I believe that the Supreme Court’s commandeering decisions provide a strong basis for believing that the Court will eventually do so — not only green-lighting Congress being able to require states to grant the federal government access to DMV records but also turning the light red on New York’s “Green Light Law”.

There is a Supreme Court case from 2000 that sits uneasily amidst New York and Printz and Murphy — Reno v. Condon, whose majority opinion was authored by Chief Justice William Rehnquist — but that bolsters the constitutionality of ministerial requirements imposed on states, especially requirements involving DMV records.

Condon involved the “Driver’s Privacy Protection Act of 1994” (DPPA):

• DPPA … regulates the disclosure and resale of personal information contained in the records of state DMVs. State DMVs require drivers and automobile owners to provide personal information … as a condition of obtaining a driver’s license or registering an automobile. Congress found that many States, in turn, sell this personal information to individuals and businesses.

• The DPPA establishes a regulatory scheme that restricts the States’ ability to disclose a driver’s personal information without the driver’s consent.

• The DPPA’s provisions do not apply solely to States. The Act also regulates the resale and redisclosure of drivers’ personal information by private persons who have obtained that information from a state.

South Carolina challenged the DPPA, “contend[ing] that [it] violates the Tenth Amendment because it ‘thrusts upon the States all of the day-to-day responsibility for administering its complex provisions[]’ … and thereby makes ‘state officials the unwilling implementors of federal policy[]’”. But the Supreme Court ruled that “We hold that in enacting this statute Congress did not run afoul of the federalism principles enunciated in New York … and Printz.” Chief Justice Rehnquist explained that:

We think, instead, that this case is governed by our decision in South Carolina v. Baker [1988]. In Baker, we upheld a statute that prohibited States from issuing unregistered bonds because the law “regulate[d] state activities,” rather than “seek[ing] to control or influence the manner in which States regulate private parties.” … We … noted:

“The [National Governor’s Association] … contends that … [the statute] has commandeered the state legislative and administrative process because many state legislatures had to amend a substantial number of statutes in order to issue bonds in registered form and because state officials had to devote substantial effort to determine how best to implement a registered bond system. Such ‘commandeering’ is, however, an inevitable consequence of regulating a state activity. Any federal regulation demands compliance. That a State wishing to engage in certain activity must take administrative and sometimes legislative action to comply with federal standards regulating that activity is a commonplace that presents no constitutional defect.”

Rehnquist then concluded that:

Like the statute at issue in Baker, the DPPA does not require the States in their sovereign capacity to regulate their own citizens. The DPPA regulates the States as the owners of data bases. It does not require the South Carolina Legislature to enact any laws or regulations, and it does not require state officials to assist in the enforcement of federal statutes regulating private individuals. We accordingly conclude that the DPPA is consistent with the constitutional principles enunciated in New York and Printz.

Rehnquist then discussed whether the Court’s ruling was premised upon the DPPA regulating both the states and private parties:

As a final matter, we turn to South Carolina’s argument that the DPPA is unconstitutional because it regulates the States exclusively. The essence of South Carolina’s argument is that Congress may only regulate the States by means of “generally applicable” laws, or laws that apply to individuals as well as States. But we need not address the question whether general applicability is a constitutional requirement for federal regulation of the States, because the DPPA is generally applicable. The DPPA regulates the universe of entities that participate as suppliers to the market for motor vehicle information — the States as initial suppliers of the information in interstate commerce and private resellers or redisclosers of that information in commerce.

Justice Alito in Murphy tried to play down the implications of Condon, writing that:

The anticommandeering doctrine does not apply when Congress evenhandedly regulates an activity in which both States and private actors engage.

That principle formed the basis for the Court’s [2000] decision in Reno v. Condon … which concerned a federal law restricting the disclosure and dissemination of personal information provided in applications for driver’s licenses. The law applied equally to state and private actors.

It did not regulate the States’ sovereign authority to “regulate their own citizens.”

But Justice Rehnquist had specifically stated in Condon that the decision was not based on the DPPA being “evenhanded”, but on the basis that “[T]he DPPA does not require the States in their sovereign capacity to regulate their own citizens [in Baker’s words, ‘seek[ing] to control or influence the manner in which States regulate private parties’]. … The DPPA regulates the States as the owners of data bases.” In fact, he made clear that the decision did not even “address the question whether general applicability is a constitutional requirement for federal regulation of the States”.

Requiring states to grant the federal government access to DMV driver’s license photos and other records regulates states “as the owners of data bases” — indeed, data bases of driver’s license information. Additionally, such a requirement “does not require” states or localities “to enact any laws or regulations”, and it “does not require state officials to assist in the enforcement of federal statutes regulating private individuals”.

I believe it to be very likely that the Supreme Court would find to be constitutional a federal law requiring states to grant the federal government access to DMV records. It would be merely a ministerial requirement, and a requirement regarding the states as the owners of their DMV databases.

---

End Notes

¹ Section 5779(a), which can now be found at § 41307 of Title 34 in slightly modified form, provided that “Each Federal, State, and local law enforcement agency shall report each case of a missing child under the age of 18 reported to such agency to the [Department of Justice’s] National Crime Information Center”.

² 921 F.3d 865 (9th Cir. 2019).