Editor’s Note: This is a great article about the upsides of the WHTI, and why it was put in place. It doesn’t discuss the privacy issues in regards to the implementation of the WHTI, but rather focuses on how the anti-fraud measures will make it harder for fraudsters to enter the U.S. This article is reprinted with permission of www.stratfor.com.

Fred Burton was formerly the Deputy Chief of the Counter-Terrorism division of the U.S. State Department’s Diplomatic Security Service (DSS), and is currently STRATFOR‘s VP of Counterterrorism and Corporate Security.

By Scott Stewart and Fred Burton

On June 1, 2009, the land and sea portion of the Western Hemisphere Travel Initiative (WHTI) will go into effect. The WHTI is a program launched as a result of the Intelligence Reform and Terrorism Prevention Act of 2004 and intended to standardize the documents required to enter the United States. The stated goal of WHTI is to facilitate entry for U.S. citizens and legitimate foreign visitors while reducing the possibility of people entering the country using fraudulent documents.

Prior to the WHTI, American travelers to Mexico, Canada and several countries in the Caribbean needed only a driver’s license and birth certificate to re-enter the United States, while American travelers to other regions of the world required U.S. passports to return. This meant that immigration officials had to examine driver’s licenses and birth certificates from every state, and since the driver’s licenses and birth certificates of all the states change over time, there were literally hundreds of different types of documents that could be used by travelers at points of entry. In practical terms, this meant there was no way immigration officers could be familiar with the security features of each identification document, thereby making it easier for foreigners to use counterfeit or fraudulently altered documents to enter the country by claiming to be returning U.S. citizens.

The air portion of the WHTI went into effect in January 2007 and required that all international air travelers use passports to enter the United States. However, the land and sea implementation of WHTI will be a little different from the air portion. In addition to passports, travelers can also use U.S. passport cards (a driver’s license-sized identification document), an enhanced driver’s license (which are currently being issued by Michigan, New York, Vermont and Washington) or “special trusted” traveler identification cards such as Nexus and Sentri to enter the country by land or sea.

The WHTI will greatly simplify the number of travel documents that immigration officials have to scrutinize. It will also mean that the documents needed to enter the United States will be far harder to counterfeit, alter or obtain by fraud than the documents previously required for entry. This will make it more difficult for criminals, illegal aliens and militants to enter the United States, but it will by no means make it impossible.

An Evolutionary Process

Identity document fraud has existed for as long as identity documents have. Like much sophisticated crime, document fraud has been an evolutionary process. Advancements in document security have been followed by advancements in fraud techniques, which in turn have forced governments to continue to advance their security efforts. In recent years, the advent of color copiers, powerful desktop computers with sophisticated graphics programs and laser printers has propelled this document-fraud arms race into overdrive.

In addition to sophisticated physical security features such as ultraviolet markings and holograms, perhaps the most significant security features of newer identification documents such as passports and visas are that they are machine-readable and linked to a database that can be cross-checked when the document is swiped through a reader at a point of entry. Since 2007, U.S. passports have also incorporated small contactless integrated circuits embedded in the back cover to securely store the information contained on the passport’s photo page. These added security measures have limited the utility of completely counterfeit U.S. passports, which (for the most part) cannot be used to pass through a point of entry equipped with a reader connected to the central database. Such documents are used mostly for traveling abroad rather than for entering the United States.

Likewise, advancements in security features have also made it far more difficult to alter genuine documents by doing things like changing the photo affixed to it (referred to as a photo substitution or “photo sub”). Certainly, there are some very high-end document forgers who can still accomplish this — such as those employed by intelligence agencies — but such operations are very difficult and the documents produced are very expensive.

One of the benefits of the WHTI is that it will now force those wishing to obtain genuine documents by fraud to travel to a higher level — it has, in effect, upped the ante. As STRATFOR has long noted, driver’s licenses pose serious national security vulnerability. Driver’s licenses are, in fact, the closest thing to a U.S. national identity card. However, driver’s licenses are issued by each state, and the process of getting one differs greatly from state to state. Criminals clearly have figured out how to work the system to get fraudulent driver’s licenses. Some states make it easier to get licenses than others and people looking for fraudulent identification flock to those states. Within the states, there are also some department of motor vehicles (DMV) offices — and specific workers — known to be more lenient, and those seeking fraudulent licenses will intentionally visit those offices. In addition to corrupt DMV employees and states that issue driver’s licenses to illegal immigrants, an illegal industry has arisen devoted entirely to producing counterfeit identification documents, compounding the problem.

Birth certificates are also relatively easy to obtain illegally. The relative ease of fraudulently obtaining birth certificates as well as driver’s licenses is seen in federal document-fraud cases (both documents are required to apply for a U.S. passport). In a large majority of the passport-fraud cases worked by Diplomatic Security Service (DSS) special agents, the suspects have successfully obtained fraudulent driver’s licenses and birth certificates, which are submitted in support of a passport application. It is not uncommon for DSS special agents to arrest suspects who possess multiple driver’s licenses in different identities from the same state or even from different states. Such documents could have been used to travel across the U.S. border via land prior to the implementation of the WHTI.

Countermoves

For those able to afford the fees of high-end alien smugglers, who can charge up to $30,000 for a package of identification documents that contains a genuine U.S. passport with genuine supporting documents (birth certificate, social security card and driver’s license), or $10,000 to $15,000 for a genuine U.S. visa (tied to a database, the newer machine-readable visas are very difficult to counterfeit), the WHTI will not make much difference. These high-end document vendors obtain legitimate identification documents by paying corrupt officials who have been carefully cultivated.

That said, the WHTI should succeed in causing the vast majority of criminal aliens, illegal economic immigrants and even militants — people who have not traditionally patronized high-end document vendors — to change the way they enter the United States. Of course, perhaps the simplest way is to take the low road. That is, get to Canada or Mexico and then simply sneak across the border as an undocumented alien — something that hundreds of thousands of people do every year. Once inside the country, such aliens can link up with lower-level document vendors to obtain the driver’s licenses, social security cards and other identity documents they need in order to live, work and travel around the country.

But there are other ways that the WHTI measures can be circumvented. For example, the crush of passport applications the WHTI is now causing will create a distinct vulnerability in the short term. Although the U.S. Department of State has hired a large number of new examiners to process the flood of passport applications it is receiving (and also a number of new DSS special agents to investigate fraud cases), the system is currently overwhelmed by the volume of passport applications.

Historically, passport examiners have had their performance evaluations based on the number of passport applications they process rather than on the number of fraudulent applications they catch (which has long been a source of friction between the DSS and the Bureau of Consular Affairs). This emphasis on numerical quotas has been documented in U.S. Government Accountability Office reports that have noted that the quotas essentially force examiners to take shortcuts in their fraud-detection efforts. As a result, many genuine passports have been issued to people who did not have a legitimate right to them. The current overwhelming flood of passport applications as a result of WHTI, when combined with a batch of new examiners who are rated on numerical quotas, will further enhance this vulnerability. Unless a passport application has an obvious fraud indicator, it will likely slip through the cracks and a fraudulent applicant will receive a genuine U.S. passport.

Stolen passports are another area to consider. In addition to being photo-subbed, which has become more difficult, stolen passports can also be used as travel documents by people who resemble the owner of the document. All the holograms, microprinting and other security features that have been placed on the laminates of passport photo pages tend to make it difficult to clearly see the photo of the passport holder. Also, people change over time, so a person who was issued a passport eight years ago can look substantially different from their passport photo today. The passport process and the laminate can also make it especially difficult to see the facial features of dark-skinned people. This means it is not at all uncommon for a person to be able to impersonate someone and use his or her passport without altering it. This problem persists, even with digital photos being included with the information embedded electronically in the memory chips of newer electronic passports.

Because of these possibilities, stolen passports are worth a tidy sum on the black market. Indeed, shortly after U.S. passports with green covers were issued, they were found to be extremely easy to photo-sub and were soon fetching $7,000 apiece on the black market in places like Jamaica and Haiti. In fact, criminal gangs quickly began offering tourists cash or drugs in exchange for the documents, and the criminal gangs would then turn around and sell them for a profit to document vendors. The problem of U.S. citizens selling their passports also persists today.

On the flip side, many Americans are unaware of the monetary value of their passport — which is several times the $100 they paid to have it issued. They do not realize that when they carry their passport it is like toting around a wad of $100 bills. Tour guides who collect the passports of all the people in their tour group and then keep them in a bag or backpack can end up carrying around tens of thousands of dollars in identification documents — which would make a really nice haul for a petty criminal in the Third World.

But U.S. passports are not the only ones at risk of being stolen. The changes in travel documents required to enter the United States will also place a premium on passports from countries that are included in the U.S. “visa waiver” program — that is, those countries whose citizens can travel to and remain in the United States for up to 90 days without a visa. There are currently 35 countries in the visa waiver program, including EU member states, Australia, Japan and a few others. The risk of theft is especially acute for those countries on the visa waiver list that issue passports that are easier to photo-sub than a U.S. passport. In some visa waiver countries, it is also cheaper and easier to obtain a genuine passport from a corrupt government official than it is in the United States.

While there are efforts currently under way to create an international database to rapidly share data about lost and stolen blank and issued passports, there is generally a time lag before lost and stolen foreign passports are entered into U.S. lookout systems. This lag provides ample time for someone to enter the United States on a photo-subbed passport, and it is not clear if retroactive searches are made once the United States is notified of a stolen passport in order to determine if that passport was used to enter the United States during the lag period. Of course, once a person is inside the United States, it is fairly easy to obtain identification documents in another identity and simply disappear.

There have also been cases of jihadist groups using the passports of militants from visa waiver countries who have died in order to move other operatives into the United States. On Sept. 1, 1992, Ahmed Ajaj and Abdul Basit (also known as Ramzi Yousef) arrived at New York’s Kennedy Airport. The two men had boarded a flight in Karachi, Pakistan, using photo-subbed passports that had been acquired from deceased jihadists. Ajaj used a Swedish passport in the name Khurram Khan and Basit used a British passport in the name Mohamed Azan.

Ultimately, the WHTI will help close some significant loopholes — especially regarding the use of fraud-prone driver’s licenses and birth certificates for international travel — but the program will not end all document fraud. Document vendors will continue to shift and adjust their efforts to adapt to the WHTI and exploit other vulnerabilities in the system.

Permission to reprint was granted on the original STRATFOR article page.

As the FARK.com headline for the article notes: “This just in: Canada is not part of the United States. Who knew?”

Needless to say, the line-ups to apply for a NEXUS card is likely quite long at this point, as well as the line-ups for passports on both sides of the border.

The NEXUS card is listed as a “WHTI-Compliant Travel Document” on the US Department of State website. Although it was accepted at the Customs agent, when I presented it to the airline employee and the security officials insisted on seeing a passport. This might be standard due to airline policy/security policy/etc. that have not been updated to include NEXUS and other WHTI-compliant, Trusted Traveler cards.

Traveler beware: a trusted traveler card is all you are required to carry, at least by customs agents; however, it seems airlines and security officials aren’t quite on the same page. Don’t forget to take your passport with you when you travel.

SSS.gov explicitly states:

Dual nationals of the U.S. and another country are required to register, regardless of where they live, because they are U.S. nationals.
See also Aliens and Dual Nationals – Liability for Service

If you are living IN the USA, you can register here.
If you are living OUTSIDE the USA, you can complete a foreign registration here.

I was asked if I had registered with the Selective Service System, and if I had my card with me when I applied for a US passport. In other words, if I wasn’t registered, I probably wouldn’t have received a passport.After registering for the SSS, they will send you your registration card in the mail, and I believe you get your registration number immediately.

More information: “Selective Service and You: 18? Time to Register!”

US Department of State has this to say about entering and leaving the USA:

Most U.S. citizens, including dual nationals, must use a U.S. passport to enter and leave the United States. Dual nationals may also be required by the foreign country to use its passport to enter and leave that country. Use of the foreign passport does not endanger U.S. citizenship.

Foreign Affairs and International Trade Canada says:

The Canadian government strongly encourages you to use your Canadian passport when travelling abroad, especially when entering the country of your second citizenship.   … Using your Canadian passport may provide the basis under which Canada can provide you with consular assistance if you run into difficulties. You should also obtain a visa, if that is required for entry by Canadian citizens, and always present yourself as a Canadian when dealing with local authorities.

As far as ease of travel goes, it’s most definitely easier to present your US passport to US officials and Canadian passport to Canadian officials… Less confusion that way. (Of course, the NEXUS card alleviates all the hassle, since you declare both citizenships in the NEXUS application)

In regards to showing customs officials both passports, Foreign Affairs and International Trade Canada says this:

Travel: If you travel with two passports, you could be subject to increased scrutiny by immigration and security officials. You could be questioned about missing entry or exit stamps, as well as your reason for having two travel documents.

Personally, having used my passport, I’ve found that at least by entering and exiting via airlines, the stamping of entry and exit dates are rarely consistent, and between 3 round trips, I have all of 2 stamps, instead of the suggested 6, so I surmise that Canada/US relations rely more on (shared?) databases than on passport stamps.

To apply for a Canadian Passport, download the appropriate PDF file from the Passport Canada website, and fill in the information in Adobe Acrobat Reader or similar PDF-reading programs. When finished, print it out, and bring the form along with your photos to a Guarantor to have signed. Then take the photos, application form, and proof of citizenship  to your local Passport Canada office. (See the application form for documentation requirements)

In my opinion, it’s best to visit the submission locations in person as opposed to mailing your application: If you go in person, you can show them the your citizenship documents, and leave with them in your hands. If you mail your application, you will have to include these documents with your application and wait for them to be mailed back. I’d much rather know where my vital documents are at all times than to send them off in the mail (if at all possible).

As a Dual Citizen by birth, I had no problems with any questions on either application regarding declaring of allegiance to another country, since I never have. When filling out these forms, pay careful attention to the questions they ask, especially regarding citizenships. Be sure to read the accompanying text thoroughly for exemptions and exclusions from citizenship. If in doubt, call up the local Embassy or Passport Canada office and ask.

(Please note: Always obey all written statements and directives on application forms. Don’t think that something doesn’t apply to you because you’re a dual citizen. In most cases, you can follow the rule of thumb: To Canada, you’re a Canadian. To the USA, you’re American. If in doubt, ASK someone, either from the US Citizens section of your local US Embassy, or from your local Passport Canada office.)

A sample of the new NEXUS card from the Canada Border Services Agency.

The domain they send you to activate it in the accompanying letter is a secure website: https://goes-app… (note the ‘S’ after http). Force of habit led me to look right past the S, and type in http://goes-app… I sat there wondering why the page wasn’t loading.  With a quick check later, I realized my mistake. Once on the site, the card can be activated without even logging in; All you are required to do is enter two numbers that are found on the back of the card.

New security features:

1. Black and white picture, interleaved with color background
2. Color-changing “North America” foil seal on the top right
3. Multicolor “Plane, Car, Boat” reflective overlay
4. RFID-blocking cover (see below)

Even more fun? It came with a copper-lined shield (packaged along side it) to keep it in when not in use. This is the kind of thing that I hope the new RFID credit cards come with. That, or I guess I could always make an RFID-blocking wallet.

This raises some interesting questions: (Yes, it’s tin-foil hat time…)

1. Since the cards were mailed without being first inserted into the protective covers, how many people could have snooped its contents? Are the card’s contents openly readable like Electronic Drivers’ License (EDLs) or Passport Cards [1,2,3], or encrypted like the US Passport [4]?
   1. An article from SecurityInfoWatch.com about the Security of EDLs and Passport Cards
   2. Watch Chris Paget’s YouTube video, the source of all this controversy around EDL and Passport Cards
   3. Watch Chris Paget’s Schmoocon lecture regarding the technology of his Youtube video [2]. It’s long, but worth the watch; it’s startling.
   4. An article from RFIDUpdate.com about the new Security included in US Passports
2. Since no login is required to activate a new card, and since an old card would be deactivated immediately, how long would it take someone to notice if one of these mailed packets were lost or stolen? I wasn’t expecting my new card, I’d assume neither were others. If someone were to steal it, they could activate it. This is offset, however, by the comforting fact that customs agents actually LOOK at the picture on the card.

All in all, as far as RFID ID cards go, with the copper-foil-lined holder, it seems secure enough to carry around in my wallet.

Sample NEXUS card from the Canada Border Services Agency used with permission for non-commercial purposes.

Unfortunately, in Canada, obtaining a US-sized Passport Photo isn’t as easy as going to the nearest photo shop and paying the man/woman.

To take my photo, I set up my DSLR and took a bunch of different, well-lit photos, and picked the one that turned out the best. I loaded the photo into MS Publisher workspace measuring 4″x6″, and resized until my face was the proper size as indicated on the application form, and cropped around my head at 2″x2″. I then created a .JPG file with two copies of the 2″x2″ photo on it. (Two copies of the photo are required in an application.) I also made a version that was 5% larger, and one that was 5% smaller, to account for shrinkage/growth in the printing process. I sent all three copies to Costco for photofinishing via Costco’s online photo lab website. (I used Costco because each 4×6 cost roughly $0.17 after tax, so three copies came out to a whopping $0.51. This is much less than the ink cost required to print this on a photo printer at home, besides the fact that we don’t have any 4×6 photo stock lying around, nor a decent photo printer…)

I picked up my photos later that day and measured the photo size on each, and I used the one closest to 2″x2″. I stopped at Staples to use their large paper cutter to  slice the photos to the required dimensions. Stapling one photograph to the completed application I printed from sealed the deal, while the other photograph sat loosely in the envelope I took along to carry my documents in. (The second photo is for the passport folks to scan to create the ID page of the passport booklet)

Later that day at the embassy while submitting my passport application, I noted to the clerk that I took the photographs myself. She was surprised, and told me she never would have known had I not told her. She took a second look at the photographs, and told me that they seemed to meet all the requirements, so she didn’t have a problem with it.

6 weeks later, I went back to pick up my brand new RFID-encrusted passport, brandishing my digitized self portrait on the ID page. Boy, did that feel good

For those wishing to take their own photos, see the Guidelines for Producing High Quality Photographs for U.S. Travel Documents.

There’s also a tutorial on DPChallenge for making US Passport Photos in Photoshop.

Here is my recollection of the events on the day I got my NEXUS card:

After being pre-cleared for my NEXUS card, I scheduled an interview, and went to the local NEXUS office to finish my application. The two men manning the office: one CBSA (Canada) and one CBP (US). They were both great guys, and I can say that the experience was almost enjoyable.

As I went in, the CBP agent dealt with me first; he asked me for my passport. In a moment of sheer brilliance, I replied, “Which one?” Biting my tongue after realizing what I’d said, he just chuckled and asked, “Why, how many do you have?” Juding from his positive response to my first witty remark, and tempting fate, I responded with, “How many do you NEED?” After a laugh from both of the officers, I admitted I was joking. Just in case it wasn’t clear.

I handed over my US and Canadian passports. He looked at them both, handed the Canadian passport to the CBSA officer, and said ‘I don’t deal with THESE funny things. You have it.’ They both entered my information into their respective computers, and then I was asked which country I would like to issue the card.

Alarm bells ringing in my head, I asked him what the repercussions of having Canadian vs American on my card were. He told me that the only real difference was that the expiry date of your NEXUS card is related to the expiry date of your passport. (US passports expire in 10 years, and Canadian passports in 5.)

They asked me some questions, took my fingerprints on a scanner, and took pictures of my eyeballs. I would like to look up under the Privacy Act where in Canada those iris scans are stored.

They issued me my blue and red NEXUS card, hot off the card printer, and showed me how to use the self-serve customs kiosk.

I’ve used my NEXUS card a few times since then, and it’s been a blessing to be able to skip the giant line-ups during airport “rush hour”. I had always wondered whether or not I should shield the thing… (See my next post about the new NEXUS cards)