How California Driver’s License Records Are Shared with the Department of Homeland Security

How California Driver’s License Records Are Shared with the Department of Homeland Security

Documents Obtained under Public Records Act Requests to the California Department of Justice and the California Department of Motor Vehicles

DECEMBER 2018

Prepared by ACLU of Northern California and National Immigration Law Center

CALIFORNIA DRIVER’S LICENSES IN 2018

In 2013, the California legislature passed AB 60,[1] the Safe and Responsible Driver’s Act. AB 60 created a landmark driver’s license program for immigrants. Giving immigrants are given the opportunity to obtain a California driver’s license yields significant benefits to the state’s communities and drivers. Trained, tested, and insured drivers improve public safety. Drivers who have licenses can go about their daily lives with the ability to identify themselves to law enforcement and to businesses with the knowledge that they won’t be ticketed or have their cars impounded based on their lack of a license.

AB 60, which became effective in 2015, allows individuals to apply for driver’s licenses in California regardless of their immigration status and without proving that they are lawfully present in the United States. To obtain a driver’s license under AB 60, an individual must submit proof of identity[2] and proof of residency in California. In addition, applicants must provide either a Social Security number or certify in their driver’s license application (known as a DL 44 form) that they are not eligible for a Social Security number. To date, over a million drivers in California have obtained an AB 60 license.

Under the federal REAL ID Act, states must meet certain requirements in order for state driver’s licenses to be acceptable as identification for certain federal purposes (referred to in this report as a “Real ID license”). The Real ID Act also authorizes the issuance of specially-marked licenses that do not meet those requirements (referred to as “non-Real ID license”). In order to comply with the Real ID Act, California now issues two licenses: a Real ID license that can be accepted by federal agencies for official purposes and a non-REAL ID license that cannot be accepted by federal agencies.[3] Individuals who are eligible for a Real ID license can choose either to obtain a Real ID license or instead obtain a non-Real ID license. Applicants for driver’s licenses under AB 60 receive non-Real ID licenses.

The non-REAL ID license has markings to distinguish it from a REAL ID driver’s license. The front of a California non-Real ID license is marked “Federal Limits Apply” and the back is marked “This card is not acceptable for official federal purposes. This license is issued only as a license to drive a motor vehicle . . . ”

CONFIDENTIALITY PROTECTIONS FOR CALIFORNIA DRIVER’S PERSONAL INFORMATION

California law protects the confidentiality of information about California drivers and prohibits discrimination against drivers based on the type of license they present.[4] Nonetheless, many immigrants have expressed concerns that the information provided for a non-REAL ID license will be used against them by immigration agents or rogue police officers.

As described below, the California Department of Motor Vehicles (“DMV”) makes certain information from its driver’s license and vehicle registration databases available to law enforcement agencies, including the Department of Homeland Security (“DHS”) and immigration agents in DHS agencies such as the Enforcement and Removal Operations component of U.S. Immigration and Customs Enforcement. This was the case long before AB 60 was enacted. However, DMV stated that it does not inform DHS agencies whether an individual possesses an AB60 license or provide DHS agencies with the identity or residency documents an individual provided to DMV as part of their driver’s license application. DMV also stated that it does not provide DHS agencies with a copy of an individual’s physical driver’s license.

Our purpose in this paper is to provide as much information as possible about how and what information is shared with the Department of Homeland Security and its agencies, so that California residents can effectively weigh the risks and benefits[5] of obtaining a driver’s license. We make recommendations at the close of the paper about steps the California Department of Justice (“CADOJ”) and DMV can take to further protect the confidentiality of DMV information and limit its use for civil immigration enforcement.

THE CALIFORNIA PUBLIC RECORDS ACT REQUESTS TO DMV AND CALIFORNIA DOJ

In order to understand how driver’s license information might be used for federal immigration enforcement, the ACLU of Northern California (ACLU-NC) and the National Immigration Law Center (NILC) filed Public Records Act (PRA) requests to CADOJ and the California DMV in 2018. In general, these requests sought to understand how DHS and its component agencies, Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) obtain information from California driver’s license and vehicle registration databases. These PRA requests served to update the requests submitted by the ACLU-NC and NILC in 2015.

The ACLU-NC and NILC received hundreds of pages of documents[6] in response to the PRA requests and spoke with CADOJ and DMV officials to clarify information about the documents. We also reviewed documents obtained by other organizations in records requests[7] as well as publicly available documents. And we reviewed many documents[8] that we received from DHS in response to a Freedom of Information Act (FOIA) request filed by NILC in 2014 and subsequent litigation.

SUMMARY OF DHS ACCESS TO DMV INFORMATION

DHS agencies may obtain access to California DMV records through several mechanisms described in detail below:

  • A California Government Requester Account, which authorizes access by electronic means, telephone requests, and requests using a paper form,
  • The California Law Enforcement Telecommunications System (CLETS), and
  • Nlets, an information exchange network owned by the states.

To obtain access using these methods, DHS agencies must first apply for and be approved for the appropriate account or access to CLETS. In applications for a Government Requester Account, DHS agencies claim that the purpose of their inquiries for DMV record information is for criminal investigations. Yet it is well-known that immigration agents frequently use DMV information, such as addresses, to locate individuals for civil immigration enforcement. The California DMV and CADOJ do not assess whether a DHS agency applying for a Government Requester Account or CLETS access will use DMV information for immigration enforcement purposes when DMV and CADOJ determine whether to approve that agency’s application.

Once DHS agencies are approved for access to these systems, they can submit individualized inquiries in order to obtain driver’s license or vehicle registration information collected by DMV and maintained in standardized fields, such as name, address, physical characteristics, license plate information, and other categories of information that appear on the face of the driver’s license. The systems may also be used to obtain driver history such as accidents or tickets. DHS agencies are not required to explain the purpose for each inquiry that they make.

DHS agencies with Government Requester Accounts may also use a DMV form called INF Form 252 to obtain an individual’s driver’s license photograph, thumbprint, and their driver’s license application (the California form DL 44).

Driver’s license photographs are available to law enforcement agencies, including DHS agencies that have been approved for access, through a separate system called Cal-Photo.

Government Requester Accounts, CLETS and Nlets cannot be used to obtain bulk information about driver’s license holders (e.g., information on every driver that possesses a non-REAL ID license). Further, DMV stated that it does not keep a copy of the physical driver’s license issued to an individual, or a copy of the face of that license, and so DHS agencies cannot access images of an AB 60 or non-Real ID license that display the “Federal Limits Apply” marking. Finally, DMV stated that DHS agencies cannot access information about whether an individual received an AB 60 license or information about the identity or residency documents submitted as part of the driver’s license application.

CADOJ and DMV do not keep copies of the subjects of the individual requests by DHS agencies for DMV information by any of the methods listed above, or information transmitted in response to the requests. And they do not conduct meaningful audits of how DHS agencies justify the need for and the subsequent use of this information.

DHS agencies have also used administrative subpoenas to obtain copies of driver’s license applications (the DL 44 form), issuing six subpoenas to DMV in 2017. Administrative subpoenas are not issued by a judge but instead are issued by DHS agents. While the DMV responded to the agencies’ administrative subpoenas by providing driver’s license applications in which social security information was redacted, those redactions may have indicated that the applicant lacked a Social Security number. DMV stated that it did not provide copies of documents submitted by the applicant to prove identity or residency to the DHS agencies in response to the administrative subpoenas. Under the newly-enacted California law SB 244, documents submitted by a driver’s license applicant to DMV to show identity, residency, or immigration status may be disclosed only if response to a criminal proceeding, a court order, or if a requesting agency certifies in writing that it must address an urgent health or safety need and it cannot first obtain a court order.

California plans to participate in the state-to-state DMV information sharing system mandated by the REAL ID Act, described below, but it is not clear what information regarding non-REAL ID licenses will be shared through the system.

THE SPECIFICS

DHS agencies have access to information collected by DMV

  • Almost 40 offices of DHS agencies currently have access to California DMV records. They are mainly ICE Homeland Security Investigations (HSI) offices,[9] but the total also includes ICE Enforcement and Removal Operations (ERO) and CBP offices.
  • The majority of DHS offices that have applied for Government Requester accounts claim that obtaining DMV records is for “criminal investigation,” with no mention of civil immigration enforcement. For example, in October 2017, ICE’s National Criminal Analysis and Targeting Center submitted a Government Requester Application for access to DMV information. Its application described the purpose of its inquiries as “identify[ing] and locat[ing] fugitives and absconders who pose a danger to the community in coordination with federal, state, and international law enforcement agencies.” The agency, however, did not specify that its primary mission is assist ICE officers in finding and arresting individuals for purpose of civil removal proceedings.[10]
  • Some approved users include communication departments of federal agencies.
  • DHS agencies have made hundreds of inquiries every year to driver’s license and vehicle registration databases using telephone and online methods of access. Between January 1, 2017 and April 10, 2018, DHS agencies made 594 inquiries to the DMV driver’s license database and 1,085 inquiries to the DMV vehicle registration database by telephone. In 2017, DHS agencies made 113 inquiries to the driver’s license database and 1,149 inquiries to the vehicle registration database through online access, and in the first three months of 2018, those agencies made 80 inquiries to the driver’s license database and 341 inquiries to the vehicle registration database.
  • According to DMV and CADOJ, none of the methods of access to DMV databases described below provide information on whether an individual is a non-REAL ID license holder.
  • Nor do any of the methods provide a copy of the face of the driver’s license because, as DMV stated, it does not keep a copy.

Absence of information about how applications for access to DMV databases are assessed

  • DMV and CADOJ did not provide information showing how they assess a federal agency’s application for access to the DMV databases.
  • DMV and CADOJ do not have guidance or training materials for assessing whether a law enforcement agency should be provided with access to DMV information. For example, DMV and CADOJ do not appear to assess whether an agency is asking for access in order to find individuals for arrest and deportation for violations of civil immigration laws.

How DHS agencies obtain access to DMV information through networks or other systems

  • DHS agencies can obtain access to California driver’s license, vehicle registration, and address information by submitting individualized inquiries through the following methods, networks, or systems. The responses to these inquiries provide standard fields of information:
    • With a Government Requester Account approved by DMV:
      • Government Requester Accounts are available to federal, state, and local agencies, courts, and certain California special districts.[11]
      • Online access: the type of information provided in response to an individualized inquiry includes address, physical description of license holder, vehicle registration number, and license plate.
      • FTP [File Transfer Protocol] or batch requests: DMV can respond to many individualized requests at once, generate the responses overnight, and transfer the information by FTP. The information available through this method is the same information that is available through online access.
      • Approved government requesters may use an INF Form 252 to obtain an individual’s driver’s license photograph, thumbprint, and the DL 44 driver’s license application. If DL 44 form is provided in response to an inquiry, the only item provided is the application form itself, not any underlying identity or residency documents. DMV could not find any INF 252 forms submitted by DHS agencies.
    • Through the California Law Enforcement Telecommunications System (CLETS), using a law enforcement agency account granted by CADOJ:
      • CLETS is a “law enforcement communications network available to all public agencies of law enforcement within the state.”[12] It “connects public safety agencies across the state to criminal histories, driver records, and other databases.”[13]
      • CLETS provides the same driver’s license information in response to individualized inquiries as government requester “online access” (e.g., standard fields such as address, physical description, vehicle registration number, license plate).
      • However, the vehicle registration information available through CLETS in response to individualized inquiries is slightly less than what is available through government requester “online access.”
      • CADOJ refused to disclose the number of queries made by DHS agencies through CLETS for driver’s license or vehicle registration information in response to our PRA request. However, a CADOJ employee stated in a declaration submitted in a court proceeding that, between October 1, 2017 and December 31, 2017, DHS agencies collectively conducted 69,189 queries in CLETS. Between January 1, 2018 and March 31, 2018, DHS agencies collectively conducted 89,223 queries in CLETS.[14]
    • Through Nlets:
      • “Nlets, is a private not for profit corporation owned by the States that was created more than 50 years ago by the 50 state law enforcement agencies. The user population is made up of all of the United States and its territories, all Federal agencies with a justice component, selected international agencies, and a variety of strategic partners that serve the law enforcement community-cooperatively exchanging data….The types of data being exchanged varies from motor vehicle and drivers’ data, to Canadian and Interpol database located in Lyon France, to state criminal history records and driver license and corrections images.” [15]
      • According to Nlets manuals, agencies requesting DMV information must provide specific information such as name or driver’s license numbers, and responses to these individualized inquiries include standard fields such as address and physical description.
      • It is not clear how and when DHS agencies use Nlets to obtain CA DMV information, or whether CLETS is simply a conduit to NLETS.
      • CADOJ claims to have no information regarding DHS agencies’ use of Nlets to obtain CA DMV information. CA does not participate in the Nlets photo sharing system.
  • DHS agencies must obtain approval to use these systems but are not required to explain the purpose of each inquiry made through these methods, such as providing a reason codes or justification.

DHS agencies may obtain DMV information through telephone access

  • DHS agencies with Government Requester Accounts may obtain DMV record information by placing telephone inquiries to the DMV Law Enforcement Desk.
  • But, according to DMV, DHS cannot learn through these telephone inquiries whether an individual holds an AB 60 or non-REAL ID license and cannot gain access to any underlying identity or state residency documents because the Law Enforcement Desk does not have access to this information.

DHS agencies may obtain access to information provided in driver’s license applications

  • DHS agencies have used administrative subpoenas to obtain copies of driver’s licenses applications. Administrative subpoenas are issued by immigration agents and do not require authorization by a judge.[16]
    • DMV provided us with a handful of administrative subpoenas from DHS agencies asking for Vehicle Registration and Drivers License information.
    • A few subpoenas ask for the DL 44 driver’s license application form and the identity documents submitted along with the application. Identity documents can show an individual’s immigration status. DMV reported that it did not provide underlying identity documents in response to these subpoenas, but it did provide copies of the DL 44 form to the DHS agencies.
    • The versions of the DL 44 form that DMV provided to the DHS agencies in response to the administrative subpoenas contained redactions of the fields related to an individual’s social security number. However, those redactions may have indicated that the applicant lacked a Social Security number: for example, one area that was redacted were the signatures of individuals certifying that they were not eligible for a Social Security Number.

DHS agencies may obtain driver’s license photographs

  • Driver’s license photographs are available to DHS agencies with Government Requester Accounts through Cal-Photo, a statewide database.
  • To obtain driver’s license photographs, the DHS agencies must make an individualized inquiry and provide a reason for access or “purpose” code.
  • Neither DMV or CADOJ has conducted an audit of the DHS agencies’ use of Cal-Photo such as an inspection of the “purpose” codes.
  • California does not participate in the Nlets photo sharing system, and so California driver’s license photographs are not available through Nlets.[17]

There is an absence of meaningful audits or accountability regarding DHS agencies’ access to DMV information

  • CADOJ and DMV have not provided us with any meaningful audits of DHS agencies’ queries. While CADOJ and DMV log the number of queries made by an agency, CADOJ and DMV have no audit reports assessing the scope or purposes of DHS’s use of information about California drivers, whether DHS has followed applicable rules and guidelines, and whether DHS has obtained information for appropriate purposes. CADOJ and DMV have not audited the justifications provided by DHS agencies when using Cal-Photo, to ensure that the DHS agencies are providing appropriate justifications for their inquiries.
  • CADOJ and DMV do not keep copies of the substance of the requests made by DHS agencies through Government Requester Accounts, CLETS, or Nlets, nor what was provided in response to those requests.

California plans to participate in the Real ID Act state-to-state driver license verification exchange

  • Background:
    • The REAL ID Act Section 202(d)(12) requires states to “[p]rovide electronic access to all other States to information contained in the motor vehicle database of the State.”
    • No provision of the federal regulations implementing the REAL ID Act[18] governs the establishment or operation of the state-to-state DMV database access system, since no such system existed when the regulations were issued.
    • DHS has outsourced the development of the state-to-state DMV information sharing system to the American Association of Motor Vehicle Administrators (AAMVA)[19] and other known and unknown non-profit and for-profit (including CLERUS Solutions) entities.
    • Electronic verification of whether an individual has a non-commercial driver’s license or identification card in another state is through the State-to-State (S2S) Verification Service (S2S).[20] The platform that supports S2S is called the State Pointer Exchange Services (SPEXS).[21]
  • As part of the Real ID Act implementation process, DMV announced plans to start using the state-to-state verification system in September 2018.
  • DMV stated that a decision has not yet been made on whether information about non-REAL ID license holders will be made available through that exchange, nor do they yet know the timeline for making that decision.
  • The State-to-State (S2S) Governance Committee has taken the position that information regarding all licenses, not just REAL ID licenses, must be entered into the system.[22]
  • If information about non-REAL ID licenses will be shared through the S2S system, it is not clear exactly what information will be shared and whether federal agencies will have access to it, whether through the system or from a state that receives the information.

RECOMMENDATIONS

Based on the information we obtained from the PRA requests, we recommend that CADOJ and DMV:

Be transparent

  • Clearly disclose the various mechanisms for DHS and component agencies to obtain driver’s license and vehicle registration information and what information is provided through each mechanism.
  • Notify individuals when DHS and component agencies obtain driver’s license and vehicle registration information through any mechanism about the individual.

Increase accountability

  • Maintain records of the substance of requests for information and records of the actual records provided in response to requests made through Government Requester Accounts, CLETS, Nlets, the INF 252 Form, or any other means.
  • Maintain records of the substance of telephone or email requests for DMV records and responses to the requests.
  • On an annual basis, audit access to the DMV databases through Government Requester Accounts, CLETS, Nlets, the INF 252 form, or any other means, including telephone or email requests.
  • Include in audits the actual queries, the responses to the queries (with names redacted), the number of queries, the basis provided by the requesting agency for queries, and any violations of conditions of access or the rules governing use of information obtained through these systems.
  • Make audits public.

Limit access to DMV databases for noncriminal justice purposes

  • Terminate any approvals or memoranda of agreement between the state and DHS agencies that allow the agencies to obtain information from DMV databases for enforcement of civil immigration law.
  • Limit Government Requester Account or CLETS approval to agencies engaged in investigations of violations of criminal law. “Criminal investigations” are investigations intended for prosecutions for violations of criminal law and not for investigations related to civil removal purposes, even where criminal convictions are involved.
  • Require DHS agencies to certify in any applications for Government Requester Accounts or CLETS approval that they will not use DMV information for civil immigration enforcement purposes.
  • Establish standards and procedures for assessing an agency’s application for access to information in DMV databases through CLETS, the Government Requester Account, or any other means, that reviews the purpose of the agency’s need to access DMV information and ensures that agencies engaged in civil immigration enforcement are not granted access.
  • Require an individualized showing, including reason or purpose codes that demonstrate the basis for the inquiry, for approved government requesters or CLETS users to obtain information in DMV databases. Merely providing a case number or docket number is insufficient.
  • Restrict DMV personnel from providing driver’s license or vehicle registration information to DHS agencies through telephone calls.
  • Do not include country of origin, Social Security Number, and fact that license is a non-REAL ID license in any information provided through Government Requester Accounts, CLETS, Nlets, or any other mechanism.
  • Withdraw the INF 252 form.
  • CADOJ, DMV and the other relevant agencies should disclose information about how Nlets is interoperable with CLETS and the DMV databases—i.e., exactly what information is provided when a Nlets user submits an inquiry through Nlets for information from the DMV databases.
    • Disclose information regarding how California assesses a federal agency’s application for access to information in the DMV databases through Nlets.
    • Nlets users should not be provided access to DMV information beyond what is available to Government Requester Accounts and CLETS users.
    • Limit access through Nlets to DMV information only when the information is requested for the purposes of a criminal investigation.
    • Limit CLETS interoperability or connection with Nlets, so that if Nlets is used to gain access to DMV information through CLETS, such information is available only pursuant to a criminal investigation.

Require judicial warrant or court order

  • For access to documents or records provided as part of an application for a driver’s license or vehicle registration, including any records currently available through an INF 252 form, CADOJ and DMV should comply with SB 244 and require a subpoena for individual records in a criminal proceeding or a court order, or a written certification from a law enforcement agency that requires the information to address an urgent health or safety that the specific circumstances do not permit authorities time to obtain a court order.
  • Require a court order enforcing an administrative subpoena before turning over any DMV records.

Limit sharing of information about California drivers through a state-to-state verification system pursuant to the Real ID Act or otherwise

  • Disclose plans to participate in a state-to-state verification system or other information-sharing system, and what information about California drivers will be shared.
  • Involve stakeholders in any discussion related to California participation.
  • Impose limits regarding the kind of information about California drivers that will be shared.
  • Protect the confidentiality of information or documents provided by California driver’s license applicants, including documents used to establish identity, or documents or information that could reveal a person’s country of birth, SSN or lack of SSN, citizenship or immigration status, or other sensitive information.
  • Explain whether any information about non-REAL ID license holders will be available through the Real ID Act state-to-state verification system. This could include even minimal information, such as “pointers” to records.
  • Explain how and what information about non-REAL ID license holders will be made available through the state-to-state verification system, and whether federal agencies will have access to the information, whether directly through the system or from a state that has obtained the information.

Provide training to DMV employees

  • Provide training on limits regarding disclosure of whether individual has a non-REAL ID license to DHS agencies and others.
  • Provide training on limits on disclosure of DMV information through telephone inquiries or emails to DHS agencies and others.

NOTES

[1] https://leginfo.legislature.ca.gov/faces/billVersionsCompareClient.xhtml?bill_id=201320140AB60.

[2] Drivers may use foreign documents to prove identity. See https://www.dmv.ca.gov/portal/dmv/detail/online/ab60_checklist.

[3] The Department of Homeland Security has extended the deadline by which California must be in compliance with the Real ID Act to January 10, 2019.

[4] See, e.g. CA Vehicle Code Section 1653.5; and CA Vehicle Code Sections 12800.7(b) and 12801.9(k) as revised or added by SB 244 (2018).

[5] See https://www.aclunc.org/our-work/know-your-rights/before-you-apply-for-ab-60-drivers-license.

[6] A complete set of the documents obtained from CADOJ and DMV are available at ___.

[7] See, e.g., https://papersplease.org/wp/2018/06/08/governance-of-the-real-id-database/.

[8] For a summary of those documents, see How U.S. Immigration & Customs Enforcement and State Motor Vehicle Departments Share Information (NILC, May 2015), available at https://www.nilc.org/issues/drivers-licenses/ice-dmvs-share-information/.

[9] HSI is a division of ICE that, according to its website, investigates criminal activity and combats “criminal organizations illegally exploiting America’s travel, trade, financial and immigration systems.” https://www.ice.gov/hsi. ERO is responsible for identifying, apprehending, detaining and removing non-citizens deemed to be in violation of immigration laws from the U.S. https://www.ice.gov/ero.

[10] https://www.dhs.gov/publication/dhsicepia-048-data-analysis-system-das.

[11] https://www.dmv.ca.gov/portal/dmv/?1dmy&urile=wcm:path:/dmv_content_en/dmv/otherser/gra/govreq#faq.

[12] http://10ba4283a7fbcc3461c6-31fb5188b09660555a4c2fcc1bea63d9.r13.cf1.rackcdn.com/05/1ca4d641b3c87e9cf0589970d4e3c7d5.pdf?id=228661, p. 5.

[13] https://www.eff.org/cases/california-law-enforcement-telecommunications-system.

[14] Declaration of Joe Dominic in support of Defendants’ Opposition to Plaintiff’s Motion for Preliminary Injunction, April 30, 2018, United States v. California, Case No. 18-cv-00490-JAM-KJN, available at https://cases.justia.com/federal/district-courts/california/caedce/2:2018cv00490/331791/75/0.pdf?ts=1525598004.

[15] http://www.nlets.org/about/who-we-are.

[16] Immigration and Nationality Act, Sec. 235(d)(4)(A), available at https://www.uscis.gov/ilink/docView/SLB/HTML/SLB/0-0-0-1/0-0-0-29/0-0-0-5389.html.

[17] http://www.nlets.org/our-members/grantmaps?mapid=d26b4e70-934e-11e3-9a61-00155d003202.

[18] 6 C.F.R Part 37, https://www.law.cornell.edu/cfr/text/6/part-37.

[19] AAMVA is a tax-exempt, nonprofit organization that claims to develop “model programs in motor vehicle administration, law enforcement and highway safety.” According to its website, “AAMVA represents the state and provincial officials in the United States and Canada who administer and enforce motor vehicle laws.” https://www.aamva.org/about-aamva/.

[20] https://www.aamva.org/state-to-state/.

[21] https://www.aamva.org/state-to-state/.

[22] Minutes of January 25, 2018 monthly meeting of the S2S Governance Committee, available at https://papersplease.org/wp/wp-content/uploads/2018/06/180522-AK-docs.pdf.