For anyone looking, it wouldn't have been too hard to uncover Talal Chammout's sordid past.
A simple internet search would have turned up news accounts of his criminal history, such as his assault conviction or the time a federal judge sentenced him to 6½ years in prison for being a felon in possession of firearms.
The judge in that case ticked off a string of allegations against Chammout at his sentencing: He had been accused of shooting a juvenile in the leg, seeking to smuggle rocket launchers into the Middle East, attacking his wife with a crowbar and plotting to hire a hit man.
Three years after he was released from prison, Chammout wanted to be an Uber driver. The company did not run a background check on him and he was allowed to drive in 2015. Three months later, he followed one of his passengers into her home and sexually assaulted her. He is now serving a 25-year prison sentence.
It wasn't the only time Uber welcomed a driver who should have been barred under the company's policy that excludes people with convictions of serious crimes or major driving offenses from shuttling passengers, a CNN investigation into rideshare background checks found.
Among the shady drivers who cleared Uber's screening process: A man convicted of attempted murder who is now accused of raping a passenger in Kansas City; a murderer on parole in Brazos County, Texas; a previously deported undocumented immigrant who is now facing trial for sexually assaulting three passengers and attacking another in San Luis Obispo, California. They no longer drive for Uber.
Rideshare companies Uber and Lyft have approved thousands of people who should have been disqualified because of criminal records, according to state agencies and lawsuits examined by CNN.
In statements to CNN, Uber and Lyft said their background checks are robust and fair. Uber acknowledged past mistakes in its screening process, but said, "More than 200,000 people failed our background check process in 2017 alone. While no background check is perfect, this is a process we take seriously and are committed to constantly improving."
Though both companies say they support thorough vetting, they have pushed back on government efforts to add other layers of scrutiny to the screening process. CNN found a massive lobbying effort from rideshare companies led by Uber has successfully fought off additional backgrounding requirements for drivers, such as fingerprint scans or government screening, that some state and local officials say would help protect passengers.
Uber has played a key role in shaping the language of many state laws governing rideshare companies, giving the company authority to conduct its own background checks in most states with little or no oversight, unlike many taxi operations. The company has been particularly forceful in its opposition to requirements that would force it to check criminal records through an applicant's fingerprint.
Of the 43 states that have passed laws or rules regulating rideshare driver background checks and eligibility, none require fingerprint-based checks, CNN found. In 31 states, the laws largely mirror Uber's recommended screening policies, in some cases nearly word-for-word.
Legislative sources from 25 states told CNN Uber directly influenced the writing of their laws.
"Uber has essentially regulated itself," said a former Uber employee and in-house lobbyist, who requested anonymity citing concern over possible backlash from a current employer. The former employee added that in most states, lawmakers just inserted Uber's language.
An email between an Uber lobbyist and a lawmaker underscores the point.
As Wyoming State Rep. Dan Zwonitzer prepared to introduce a bill to regulate rideshare companies in his state in December 2016, an Uber lobbyist emailed him, pushing for a change in the proposed legislation.
"The draft includes a government-run background check. We need to change it back to the model language," wrote the lobbyist, Erin Taylor, protesting a proposal in the bill that would require fingerprint checks.
She also asked, "Do you have any idea why they keep straying from the model bill language?" according to the email Zwonitzer shared with CNN.
The bill became Wyoming law in 2017 and left background checks up to Uber, as the lobbyist had requested. Zwonitzer said the final bill was the result of back-and-forth discussions with Uber and other stakeholders, but he said Uber "drew a line in the sand" about background-check requirements.
Taylor did not respond to CNN's request for comment.
A CNN investigation in April revealed more than 100 Uber drivers had been accused of sexually assaulting or abusing passengers in the past four years. After questions from CNN for that report, Uber announced a policy change to rerun background checks annually and said the company would invest in technology to identify new criminal offenses.
But some state regulators and attorneys suing Uber say those updates do not go far enough. Critics of the rideshare companies' background checks say drivers should submit to additional scrutiny, such as in-person interviews, government screening or fingerprint checks, which use biometric information to search for criminal records in an FBI database. Most US taxi and limousine drivers are required to obtain special licenses and undergo fingerprint checks.
Uber and Lyft's background checks are mostly conducted by a third-party startup company called Checkr, which uses individuals' names and Social Security numbers to find applicable information. It checks a national sex offender database, federal and local court records and databases used to flag suspected terrorists.
Three former Uber employees who worked on policy told CNN Uber seeks to approve new drivers as quickly as possible to maintain a large workforce and therefore opposes requirements to fingerprint applicants, which can add weeks to the onboarding process.
Uber and Lyft say fingerprint-checks reference historical arrest records, which can have discriminatory effects on some minority communities that face disproportionately high arrest rates. An Uber spokesperson told CNN arrest records are incomplete and often lack information about whether a person has been convicted of a crime.
Some states, according to Checkr, limit the records background check companies can report, which can create discrepancies between private background checks and those run by governments. For example, Massachusetts prohibits the reporting of convictions that are older than seven years.
Lobbying on steroids
In city after city across the United States, Uber has used the same overarching strategy to expand its business.
After launching in 2010, Uber began entering cities without coordinating with city governments or local taxi and limousine regulators. The Uber app then would become so popular with riders and drivers that any attempts by city officials to create regulations were met with fierce resistance, both by users of the app and by Uber's lobbyists, multiple city and state officials told CNN.
Uber, along with its competitor Lyft, would then turn to state capitals to lobby for broader legislation that benefited the rideshare industry, undercutting local regulations or proposals.
Uber has hired at least 415 lobbyists throughout the country since 2012, lobbying disclosures show. Lyft has hired at least 147 lobbyists in 34 states. This count does not include lobbyists hired for work at the city and federal level.
When the city of Boise, Idaho, advocated for fingerprinting all Uber drivers in 2015, records show Uber retained a lobbyist who worked on getting a bill passed at the state level. The lobbyist said he personally drafted Idaho's legislation, according to a recording of his presentation to state lawmakers. That bill became state law, overriding Boise's proposal.
"Lobbying is nothing new but this is lobbying on steroids," said Miya Saika Chen, an attorney who has studied rideshare laws at the nonprofit Partnership for Working Families. "The speed with which Uber and Lyft got these bills passed is unique," she added, noting that most became law between 2014 and 2017.
In Ohio, State Rep. Mike Duffey used language shared by an Uber lobbyist in his testimony introducing a bill to regulate rideshare companies, according to emails obtained by the National Employment Law Project shared with CNN. When another legislator's aide emailed Duffey reports that questioned Uber and Lyft's screening processes, Duffey emailed an Uber lobbyist and said, "Let's discuss."
Duffey's bill became law and went into effect in 2016, overturning Columbus' ordinance that mandated rideshare drivers be fingerprinted. In a statement to CNN, Duffey said it "is exceedingly normal" for stakeholders to suggest language for bills and added that his bill received unanimous support in the Ohio House of Representatives.
In Texas, Austin and Houston also previously required rideshare drivers to undergo fingerprint background checks, but in 2017 Texas Gov. Greg Abbott signed into law legislation that specifically voided all local rideshare regulations. That same year, Uber and Lyft together spent up to $2.3 million on 40 lobbyists in the state, records show.
A Texas legislative aide told CNN Uber and Lyft "contributed" to the formation of the bill. The aide, who asked for anonymity because he was not authorized to speak on the record, said, "Uber had one of the bigger lobby teams we've seen ... but there was no pressure," he said.
Out of 43 states with laws or rules on screening requirements, all except one give rideshare companies (or third-party companies they choose to hire) the sole responsibility of conducting criminal background checks on potential drivers. Massachusetts has a two-tiered system, where the company runs a background check and then the state's public utilities department runs another.
The city of New York is the only jurisdiction in the United States where rideshare drivers must undergo fingerprint checks.
Seven other states have not passed laws regulating rideshare companies' background checks.
Some laws give authority to state agencies to impose additional regulations on rideshare companies' screening processes or audit their records, and some of those reviews have found drivers who should have been disqualified because of criminal convictions.
For example, Maryland's Public Service Commission reviews the applications of drivers approved by rideshare companies. The commission has rejected about 1,653 rideshare driver applications with disqualifying criminal records since December 2015, even though those drivers passed the rideshare companies' background checks.
Massachusetts began running its own background checks on Uber and Lyft drivers through a deal reached with the companies in 2017. Out of 170,000 rideshare applications that had been approved by the companies, the state rejected about 20,000 under its regulations, the bulk of which related to licensing, driving or non-felony issues. However, the state denied 3,471 prospective drivers for violent crimes and 109 for sex offenses. About 1,500 drivers have successfully appealed denials, but most of those involved driver's license issues.
The taxi industry, which fiercely competes with rideshare companies, has also lobbied at the state level to have rideshare drivers undergo similar screening processes as taxi and limousine drivers, which mostly comply with fingerprint background checks.
"Expediency is overriding safety," said Matthew Daus, a former commissioner of the New York City Taxi and Limousine Commission. "Taxis and limos are still required to abide by the old, more stringent rules, but Uber and Lyft have a free for all. It's become the Wild West."
But others point out that fingerprinting and accessing the FBI's data has limitations as well.
"The FBI background-check system was designed for investigations, not employment vetting, and many of its records are incomplete," said Arthur Rizer, who has studied the rideshare industry and justice at the R Street Institute, a free-market research organization.
Uber says the rideshare industry, like others, has relied on business and legislative experts to work with government officials to develop regulations that protect consumers while enabling technological growth.
While some city officials argue transportation should be regulated at the local level and that passenger safety concerns should matter more than ease of travel, Uber says it advocates for state regulations as opposed to local ordinances because rides often cross between jurisdictions.
A Lyft spokesperson said in a statement that Lyft has worked with policymakers in nearly every state to standardize and strengthen background checks.
The sufficiency of Uber and Lyft's background checks have been challenged by dozens of civil lawsuits.
A proposed federal class-action containing allegations of sexual assault by Uber drivers says the company should pay damages for "failing to warn passengers about the inadequacy of its background screening."
In a lawsuit filed in 2015, the woman sexually assaulted by Talal Chammout accused Uber of overlooking his criminal convictions for assault and possessing firearms as a felon as well as other allegations. Authorities had also investigated Chammout for alleged offenses that he was never convicted of, including shooting a 15-year-old, assaulting and threatening to kill his wife, negotiating to purchase anti-aircraft missiles, and discussions with an undercover FBI agent who posed as a hit man.
According to the lawsuit, Chammout used a fake commercial driving permit to apply to Uber.
The civil lawsuit was dismissed in 2015, though the parties declined to say how the case was resolved. CNN reported in April that Uber, like many large companies, requires all parties to sign confidentially agreements when cases are settled.
Uber sent a letter to the city of Dallas stating that when Chammout first signed up with Uber in 2014, his account was marked "Will Not Be Driving." But in 2015, an Uber representative mistakenly allowed him to drive even though he never underwent a background check.
In May, a jury found Chammout guilty of sexually assaulting the woman.
Some authorities have fined rideshare companies for issues related to driver vetting.
Uber agreed to pay up to $25 million in 2016 to settle a lawsuit brought by the district attorneys in San Francisco and Los Angeles, who accused the company of misleading customers about the quality of their background checks, which they argued suffered "systemic failures." Lyft settled a lawsuit with similar claims brought by the same district attorneys for $500,000 in 2014.
Colorado's Public Utilities Commission is seeking to fine Uber more than $4 million for approving dozens of drivers with disqualifying records based on state law. Uber has challenged the fine, which remains pending before an administrative judge.
As part of its investigation, the commission did not find any disqualifying records that warranted a fine against Lyft, according to the commission's director, Doug Dean.
Dean said he and other state officials have pressed for additional screening of rideshare drivers that includes fingerprinting, which he said would enable his commission to receive notification in-real time if a rideshare driver is arrested.
Dean said Uber's lobbyists swayed state lawmakers to not include that mandate in legislation that passed in 2014.
"They sold it to the legislature as this is innovation and its jobs and it works everywhere else so let's just do it," Dean said. "They didn't stop to really think long and hard about public safety I'm afraid."
