E-Verify’s SSN Drag Net – Has DHS/USCIS Crossed a Bridge Too Far?
[Editor’s Note: today’s blog is courtesy of Anthony (“Tony”) Weigel of Weigel Law Office, LLC] On November 18, 2013, the U.S. Citizenship and Immigration Services (“USCIS”) announced the roll-out of a new feature to provide “a critical safeguard to the E-Verify system by detecting and preventing potential fraudulent use of Social Security Numbers (“SSNs”) to gain work authorization.” Specifically, USCIS will use a combination of algorithms, detection reports and analysis to identify patterns of fraudulent SSN use and then lock the number in E-Verify.
This appears to be the next step in broadening the reach of the E-Verify program. As E-Verify followers may recall, in June of 2011, USCIS announced the creation of Records and Information from DMVs for E-Verify (RIDE), which began allowing E-Verify to validate the authenticity of a participating state’s driver’s licenses used by employees as Form I-9 documents. Regardless of the merits of either effort, the lawyerly side of my brain couldn’t help but wonder, can USCIS really do all of this?
My analysis began with one of the most basic of law school lessons: the U.S. Constitution trumps statutes, statutes trump regulations, and regulations (when and where they exist) trump policy guidance and lesser legal authority, such as the murky phenomena of Memoranda of Understanding and Agreement. Fortunately, E-Verify’s originating statute sets forth clear statements of the program’s purpose, scope and limitations.
E-Verify’s Purpose & Scope of Operation
Congress established the ‘pilot’ confirmation system charging the government agency with the duty to respond to inquiries made by program participants concerning an individual’s identity and work authorization, and to maintain records of the inquiries, confirmations, and responses.  Congress mandated that E-Verify be designed and operated to: (1) to maximize its reliability and ease of use consistent with insulating and protecting the privacy and security of the underlying information; (2) to respond to all inquiries made and to register all times when such inquiries are not received; (3) prevent unauthorized disclosure of personal information; and (4) to have reasonable safeguards against the system’s resulting in unlawful discriminatory practices based on national origin or citizenship status, including: (a) the selective or unauthorized use of the system to verify eligibility; (b) the use of the system prior to an offer of employment; or (c) the exclusion of certain individuals from consideration for employment as a result of a perceived likelihood that additional verification will be required, beyond what is required for most job applicants.
The authorizing statute directs E-Verify to access only two sources of data, the Social Security Administration (“SSA”) and the USCIS. Each is solely assigned with the duties of confirming information and updating inaccurate information arising from the employer’s inquiry and subsequent non-confirmation.
E-Verify’s Explicit Limitations
The text of Sec. 404(h) reads as follows:
(h) Limitation on Use of the Confirmation System and Any Related Systems.
(1) In general.–Notwithstanding any other provision of law, nothing in this subtitle shall be construed to permit or allow any department, bureau, or other agency of the United States Government to utilize any information, data base, or other records assembled under this subtitle for any other purpose other than as provided for under a pilot program.
(2) No national identification card.–Nothing in this subtitle shall be construed to authorize, directly or indirectly, the issuance or use of national identification cards or the establishment of a national identification card.
Section 404(h)(2) repeats the prohibition on direct or indirect national identification cards found in INA 274A(c), 8 U.S.C. Sec. 1324a(c). However, Sec. 404(h)(1)’s prohibition on the use of E-Verify information, data and records stands in stark contrast to INA 274A(b)(5), 8 U.S.C. Sec. 1324a(b)(5), which permits use of I-9 forms and information for certain law enforcement purposes. Clearly, Congress was aware of the permitted uses of the I-9 system and records when drafting Sec. 404(h)(2) of IIRAIRA, yet it explicitly chose to ‘lock down’ the use of E-Verify data. What else could they have meant by the words: notwithstanding any other provision of law, any agency, or any information, data base or other record?
What Has Congress Authorized E-Verify to Do?
The program is responsible for registering all times when such inquiries are not received and maintaining reasonable safeguards against the unlawful discriminatory practices based on national origin or citizenship status, such as using the system selectively or pre-screening applicants. Therefore, E-Verify is permitted to utilize monitoring and compliance tools to identify these types of deficiencies. If a program user is found to have used the system in a substantially non-compliant manner, the program is authorized to terminate the user’s use of E-Verify. No other sanction for non-compliant use is included in the statute.
RIDE, the SSN Drag Net, and the National ID Prohibition
E-Verify collects and verifies the following RIDE-generated state identification data: first and last name; state of issuance; document type and number; date of birth; and expiration date. If this information does not check out, it triggers an additional basis for non-confirmation of work authorization. E-Verify’s new SSN drag net, without probable cause, will mine its data for potential illegal activities and ‘lock’ the use of the SSN for verification purposes if illicit activity is suspected.
Has the USCIS impermissibly created, directly or indirectly, the issuance or use of national identification cards in either instance? Probably not, because every employer is not yet mandated to use the program. If all employers are one day mandated to use E-Verify, Congress should amend the statute and admit the obvious – E-Verify will officially be a national identity system.
Sec. 404(h)(1)’s Prohibition on Unauthorized Use of E-Verify Data
USCIS claimed an expansive scope of authority under the E-Verify program when it rolled out RIDE in 2011. It claimed that E-Verify information “may also be used for law enforcement (to prevent fraud and misuse of E-Verify, and to prevent discrimination and identity theft), program analysis, monitoring and compliance, program outreach, customer service, and prevention of fraud or discrimination.” USCIS also stated it may give law enforcement agencies extracts of information indicating potential fraud, discrimination, or other illegal activities.
There are two problems with this position. First, although the statutes give E-Verify the authority to detect and safeguard against unlawful discriminatory practices based on national origin or citizenship status, detect non-compliant use, and to engage in program outreach, it does not support proactive anti-fraud activities. In fact, there is no mention of the word ‘fraud’ in Section 404 of IIRAIRA and the only fraud-specific requirement placed upon the program was for the agency to present two reports in year three and four of operation to assess the degree of fraudulent claims of U.S. citizenship. Second, USCIS is charged with protecting and safeguarding use of E-Verify data and is also restricted from unauthorized use of it, as is any other government agency.
It is difficult to read the totality of USCIS’ rationale for expansive efforts, like RIDE and the SSN drag net, in a manner consistent with Section 404(h)(1).
Does It Matter?
There is an ever-growing employment verification industrial complex. Admittedly, I am a willing participant. The more USCIS exercises its creative license with the law, the more opportunities it creates for others. Although legal purists, civil libertarians, and other relatively benign actors may believe the agency should comply with its authorizing statute, DHS/USCIS will likely stay the course. At some point, defense counsel for an employer or an individual may creatively assert that the government improperly picked the ‘fruit’ of poisonous trees from E-Verify data and records along the way. If and when that happens, the resulting legal decision will be an interesting read. A judge may decide that, in the absence of statutory authority, E-Verify’s travels should have ended at the edge of the DHS/USCIS parking lot.
Bio: Note: The opinions expressed in this blog are solely the author’s, Anthony (“Tony”) Weigel is the principal of Weigel Law Office, LLC, who concentrates his practice in the areas of business-immigration law and employer compliance with immigration laws. He has advised clients in a variety of industries, to include construction, retail, service and manufacturing industries, on matters relating to immigration compliance, including compliance planning, records reviews, and administrative audits. He has also assisted employers subjected to criminal prosecutions. His background includes human resources experience and responsibility for I-9 employment eligibility verification and document retention, and general employment law compliance duties. www.weigellawllc.com
 E-Verify was created in 1996 as ‘Basic Pilot’ by the Illegal Immigration Reform and Immigrant Responsibility Act of 1996, PL 104-208, div. C; 110 Stat. 3009, 3009-46 to 724 (Sept. 30, 1996) (“IIRAIRA”). For purposes of the article, all references are to Title IV, Enforcement of Restrictions against Employers, Subtitle A, Sections 401-405 of IIRAIRA. It was one of three ‘pilot’ programs created to provide a secondary means for employers to verify identity and work authorization of newly-hired employees. E-Verify has been extended over the years and is now authorized through September 30, 2015, yet at no point has Congress modified the purpose, scope or limitations on the program. See: Basic Pilot Program Extension and Expansion Act of 2003, PL 108-156, 117 Stat. 1944 (Dec. 3, 2003); DHS Appropriations Act of 2009, PL 111-83, DHS Appropriations Act, 2010, PL 111-83 Title V, Sec. 547 (Oct. 28, 2009), and A bill to extend by 3 years the authorization of the EB-5 Regional Center Program, the E-Verify Program, the Special Immigrant Nonminister Religious Worker Program, and the Conrad State 30 J-1 Visa Waiver Program PL 112-176, Sec. 2 (Sept. 28, 2012).
 Sec. 404(a). Emphasis added.
 Sec. 404(d).
 IIRAIRA designated the legacy Immigration and Naturalization Service in Sec. 404(f), but those duties were transferred to the USCIS with the creation of the Department of Homeland Security in 2003.
 Sec. 404(e)-(g). SSA was solely charged with responding to inquiries, confirming or not confirming data, and was prohibited from disclosing or releasing social security information, other than confirmation or non-confirmation of data. The USCIS was solely charged with comparing the name, identity information, or authorizing numbers, and to either confirm or not confirm the validity of the information and correspondence of name, numbers and work authorization.
 INA 274A(b)(5) [8 U.S.C. Sec. 1324a(b)(5)] Limitation on use of attestation form.–A form designated or established by the Attorney General under this subsection and any information contained in or appended to such form, may not be used for purposes other than for enforcement of this Act and sections 1001, 1028, 1546, and 1621 of title 18, United States Code.
 Sec. 404(c)(4).
 Privacy Act of 1974; Department of Homeland Security/United States Citizenship and Immigration Services – DHS/USCIS-011 E-Verify Program System of Records, 76 FR 26738, 26743 (May 9, 2011).
 76 FR at 26741.
 Sec. 405.
 Sec. 404(d).
 Sec. 404(h)(1).