Disclaimer: This article demonstrates potential flaws in the governmental verification process for work authorization checks and is written for educational purposes only. Do not use this knowledge to attempt anything unlawful. Chances are you will get caught eventually and get yourself in trouble, for which I bear no responsibility. Working without authorization is a serious offense and can lead to long bars from the U.S.
Clarification: A few users pointed out how USCIS E-Verify may prompt the employer to key in the foreign national’s passport number, I-94 number, or Alien Number when the employer selects the “Alien authorized to work in the US” option, thereby rendering this technique useless. Please note, this isn’t applicable to the scenario I’m describing. In this specific case, selecting “Noncitizen national of the United States” followed by the employer keying in the prospective employee’s valid SSN, and selecting a List B+C document combination leads to an approval.
Great efforts have been put on to Make America Great Again and to enforce a lawful workforce when it comes to hiring employees, although this hasn’t worked for purely undocumented immigrants — simply because anyone who is knowingly hiring illegal immigrants and willfully breaking the law, is not having them fill out I-9s or running them through E-Verify. At the end of the day, laws keep honest people honest.
While the focus of political debates is almost always on illegal immigrants and their rights, or lack thereof, I want to point out how semi-legal workers could take advantage of the extensive documentation list provided under the I-9 provisions so as to evade employment authorization checks.
Those of you who have ever been hired or contracted at a company, would be familiar with a certain Form I-9 that asks for one of the documents from either list A or two documents — one each from Lists B and C. The idea is to prove your identity and employment authorization for the employer to ensure a legal workforce, as required by law.
However, because of cries about Voter IDs we hear all the time, people’s opposition to making the government or ID infrastructure centralized, what we are left with is a subpar identity and work authorization verification process. We tradeoff the certainty for increased privacy and the decentralized identity infrastructure enjoyed by us — most of whom are honest people.
Another challenge that comes with enforcing work authorization laws is the sheer separation; a disconnection between governmental departments.
In other words, USCIS, SSA, IRS, State Department and your state’s DMV typically keep their records separate and have little to no reason to cross-reference them on an average day. Although, REAL ID law may change that soon for the worse — worse for your privacy, better for law enforcement.
The efforts surely strive to strike a balance between establishing a legal workforce and ensuring a worker’s privacy while creating a system — namely E-Verify, which remains exploitable in the following scenarios.
Example Scenarios
Prerequisites: You do need a valid SSN for any of these scenarios to work. Therefore the most likely abusers of the system could be those who once came to the U.S. legally and have had their “status” run out or visa expire.
Case 1
Grace came to the U.S. on an F-1 (Student) visa. Her visa conditions allow her to work on-campus for up to 20 hours a week, making her eligible to apply for an SSN. She received her SS card legally by presenting the proper documents to the SSA. The card is “restricted” — it comes with a DHS endorsement.
Grace is, however able to obtain a Photoshop (PSD) template. She creates a forged SS card with her real number but without the DHS restriction printed on it. She now has enough proof to satisfy List C requirements. Moreover, her name and SSN remain verifiable in the SSA (and therefore E-Verify) database.
This is proof of work authorization. To establish her identity, she can continue to use one of the List B documents including her Driver’s License or State ID. And, when and if her student status does run out — making her ineligible to renew her driver’s license, her student ID is the easiest ID to obtain or forge.
Typically, student IDs do not have an expiration date printed on them. Universities that do print expiration dates, simply use paper “stickers” with the new dates to extend a card’s validity. Other schools have an issuance date printed on the cards rather than an expiration date. Either way, a student ID is the easiest ‘ID’ to obtain, forge and practically hard to verify as legitimate. According to the USCIS guidelines, “If the school ID contains no expiration date other than the school year, it expires at the end of the school year printed on it.”
With an “unexpired” School ID and an “unrestricted” SS card in her possession, Grace now has undeniably satisfied List B and C requirements making her appear to be fully authorized to work — even when she runs out of student status. Her I-9 (E-Verify) case will likely be instantly approved.
Case 2
John is a Canadian citizen who came to the U.S. on a TN (NAFTA) work visa. The terms of his visa tie him to a specific employer. John, at the time he came to the U.S., was able to legally obtain an SSN, a U.S. Driver’s License and other form of IDs. Due to budget cuts at his company, however, his employment was terminated and he was unable to find a new job in the 60-day grace period applicable to a TN visa. He is now officially “out of status” and must depart the U.S. Instead, John is contemplating consulting part-time under the radar for one of the companies, and has been asked to fill out Form I-9.
With his Canadian Driver’s License — to which U.S. laws do not apply when it comes to renewals due to John’s citizenship, and a forged SS card (as shown in Case 1), he now appears to be fully authorized to work in the U.S. and his case is instantly approved by E-Verify. This is especially advantageous if John works remotely — from Canada or from within the U.S., for example, as a consultant for a U.S. employer.
There are many more cases similar to these that make the exploitation of the system possible. The basic premise is to “satisfy” the requirements from one of the lists and to do so in a manner which can be reasonably verified in the E-Verify database. Most of the List A documents, especially EADs, Green Cards and Passports are often the hardest to forge and easiest to electronically check within both E-Verify and other DHS systems, including the I-94 website.
It’s the other two lists that remain largely prone to these loopholes.
My primary criticism remains why are certain forms of documentation electronically verifiable in E-Verify, and not others? A nationwide mission-critical system which has literally cost Americans billions, must work objectively at the very least for all types of documents.
FAQ
- Could any illegal alien take advantage of this flaw?
No. The alien, resident or non-resident, does need a valid Social Security Number (SSN). Those coming to the U.S. on a Tourist (B-1/B-2) or temporary visas would likely not be able to get an SSN. However, what is hard to verify is, whether the actual SS card issued itself is “restricted” — especially if the card was digitally forged and submitted as a digital copy, which is not uncommon. Employers ask for copies of the documents over email all the time, rather than checking originals in person. - Is this mere speculation or has this been tested?
It has indeed been tested. I am unable to disclose the exact process for privacy reasons but the E-Verify workflow was thoroughly evaluated and investigated with different test scenarios, with both real and staged data, prior to writing this post — especially how it works on an employer’s end; what can they see and click. - Why is the process designed this way?
The government likely designed the document list to be split into “categories A and B+C” so as to make it harder for undocumented immigrants to take on work, but also to make the process least intrusive for honest citizens and residents. Another reason could be the convenience and to reduce false-negative rates. For example, a non-resident alien who eventually underwent Adjustment of Status and is now a Lawful Permanent Resident (LPR) or a naturalized citizen should no longer be inconvenienced by a DHS-restricted SS card, regardless of what the card says. The restriction, in practice, does not apply to U.S. permanent residents and citizens. SSA’s APIs — which is what E-Verify possibly uses, offer no further information other than whether a provided combination of Name, SSN, and Date of Birth is a match. The lack of absolute certainty in the process is a tradeoff for the greater privacy and convenience enjoyed by the homeland’s people. - What can I do to ensure my workforce remains legal?
There is not much you can do without putting yourself in a legal gray area. In fact, Form I-9 provisions make it illegal for employers to explicitly ask for a certain document or to refuse someone employment due to the worker’s failure to present a document. Your best effort can be ensuring one or more documents from Lists A or B+C appear legitimate and then let E-Verify decide the eligibility. - Has the Responsible Disclosure process been followed?
No, not in this case. It is my opinion that the flaw is in the law made by the U.S. Congress and the implementation of the legal process, not the E-Verify system itself. In this case, a Responsible Disclosure would have only lead to delays and should I have written first to the lawmakers — who have more pressing matters to attend to, my letters would likely have been ignored. I’m making the knowledge public as a criticism of the law; its weaknesses, and the law is public knowledge to begin with.
© 2019. Akshay ‘Ax’ Sharma. All Rights Reserved.
