Through a state website, the group obtained the licenses with Asian names to sell to undocumented immigrants, predominantly from China, aiming to impersonate the victims.
Asian Americans in Texas are angered after officials revealed this week that thousands of Asians statewide may be impacted by identity theft orchestrated through a website that involved using personal information to answer security questions.
The state’s Department of Public Safety had unknowingly sent an estimated 3,000 driver’s licenses to an organized crime group that targeted Asians in the state, DPS director Steve McCraw told a Texas House committee on Monday. The incident, which is currently under investigation, was discovered in December, McCraw said, and the department has begun to notify victims by mail this week.
With no warning about the incident for months, Asian Americans say they’re disappointed in the DPS’s response and feel they’ve been kept in the dark.
“It really goes to show that our state government does not see us and does not care about us and does not prioritize our welfare,” Lily Trieu, executive director of Asian Texans for Justice, told NBC News.
DPS did not respond to NBC News’ request for comment.
McCraw did not reveal the name of the organization, but told the Texas House Appropriations Committee that a New York-based Chinese organized crime group had obtained the licenses with Asian names to sell to undocumented immigrants, predominantly from China, in hopes of impersonating the victims. He added that with the licenses, impersonators could go on to obtain additional supporting identification documents featuring their own photos.
Using personal information of the victims obtained from “the dark web,” or websites hidden by traditional surface browsers, the group was able to answer security questions on the state’s Texas.gov website, McCraw said. The questions have since been removed from the website.
“The identity questions could be something you may have shared with a credit card company or something like your mother’s maiden name, your first vehicle that you ever had, your favorite sport,” McCraw said. “[They] use those questions to be able to get into and purchase a replacement driver’s license on Asian-sounding names. And from that, get a replacement driver’s license sent to an address of their choosing.”
Prompted by questioning from State Rep. Mary Gonzalez, vice chair of the committee, McCraw said that victims’ identifications could have been used during the months in which they had not been notified. He said that DPS did not alert victims right away because the department “opted to conduct a thorough investigation” before making the information public.
McCraw also said he didn’t see it as a “breach,” saying the criminal organization did not hack into the website. Rather, the group discovered a “vulnerability” and exploited it, he said.
Brittney Booth Paylor, director of media and government relations at the Texas Department of Information Resources, echoed McCraw’s language in a statement provided to NBC News.
“This is fraudulent criminal activity based on identity theft unrelated to state systems, not a cybersecurity incident. No state systems, including the state’s portal, were hacked or breached,” Paylor wrote in the statement.
Paylor declined to comment further on whether any personal information was taken during the identity theft.
Jeoff Williams, deputy director of law enforcement services at DPS, told the committee that the identity theft was discovered after a credit card company was notified about a fraudulent charge made through Texas.gov. Following the discovery, changes were made to the website’s credit card transaction process, he said.
One of those changes, he said, is to “include the billing zip code, and the CVV or the three digit code on the back of the card at the time of transaction. That feature was not turned on,” Williams said.
Debbie Chen, civic engagement programs director for Asian American civil rights organization OCA Greater Houston, said that the many in the Asian community are now questioning their safety and security in Texas.
“Three years into the pandemic, people have really experienced anti-Asian hate. People have felt scapegoated. And then you have a government agency who knew about this months in advance and did nothing,” Chen said. “That contributes to this fear of, ‘Do you consider us as equal citizens compared to everyone else?'”
Both Trieu and Chen called the state government’s lag in notifying victims unacceptable, regardless of a criminal investigation.
“Your identity can impact literally everything in your life. It could have caused people to have had their wages garnished, it could have caused them to be under criminal investigations for somebody using their identity to do criminal activities,” Chen said. “You would think some kinds of resources would have been spent, even if it came down to calling people individually.”
Trieu said her organization is demanding DPS contact all victims and provide language assistance as well. An estimated one-third of Texans of Asian descent have limited English proficiency, defined as having difficulty communicating effectively in English, according to civic engagement and data nonprofit AAPI Data.
Advocates also demanded an explanation and specific information on the size and scope of the issue. So far, information is scarce and some organizations and activists learned about the ordeal only because they had tuned into the committee session, Trieu said. Additionally, Trieu said that the victims be provided a credit monitoring tool.
“Now that their personal information is jeopardized, there could be long term financial repercussions for it,” Trieu said. “The state was negligent, the state should be responsible for ensuring that people are being protected in the monitoring of their credit report.”
McCraw told the committee that the department will be issuing replacement licenses free of charge. And a spokesperson for DPS told the Dallas Morning News that information will be translated into more languages, but did not provide a timeline.