by Jason Kessler, CNN

(CNN) As the Long Island SAT cheating scandal widens, the education community is asking fresh questions about how many students are scamming their way through the most important test they’ll take in high school.

And the two organizations that oversee the SAT, the College Board and ETS, are facing fresh scrutiny over whether their security measures are up to snuff.

The soul-searching and finger-pointing are fiercest in Nassau County, New York, where 20 current and former students have been arrested in the exam scam. Prosecutors say that five test-takers used bogus school IDs to take the SAT or ACT for 15 students, who paid between $500 and $3,600 for the privilege.

The test-takers are charged with scheming to defraud, falsifying business records and criminal impersonation. If convicted, they could serve up to four years in prison.

The College Board and ETS have strongly condemned the attempted corner-cutting. “No one despises cheating more than the College Board and the people who design the SAT,” said its president, Gaston Caperton, at a recent New York Senate hearing on the controversy.

Declaring its determination to root out cheating, the College Board has hired a security firm headed by former FBI chief Louis Freeh to review its SAT security protocols.

ETS, which administers the exam for the College Board, has indicated that it is open to any reforms Freeh’s firm proposes. The organization already has an extensive anti-cheating system in place, spending about 10% of its $225 million annual budget on security, ETS president Karl Landgraf testified at the hearing.

Even as they put their security protocols under the microscope, both the College Board and ETS say they’re confident SAT cheating is exceedingly rare – and that impersonation schemes like the one that allegedly took place on Long Island are even rarer.

Of the 2 million-plus SAT tests taken in any given year, approximately 4,000 scores are canceled because of suspected cheating, according to Landgraf. Of those, 200 to 300 are impersonation cases, he said.

Several hundred additional students – about 700 last year – are turned away at the door each year because of questionable IDs, ETS spokesman Tom Ewing said.

But some question whether the numbers are low because many impersonators escape detection altogether.

“All they can say is they are unaware of a large number of impersonations,” Bernard Kaplan, the principal of Great Neck North High School, the epicenter of the cheating scandal, said at the hearing.

Though nobody knows how many impostor test-takers get away with it, cheating experts say the number is likely modest.

“It’s a small tip of a small iceberg,” said Bob Schaeffer, the public education director of testing watchdog FairTest, referring to the arrests on Long Island and the underlying problem they indicate.

He said SAT cheating cases more often involve copying or prior knowledge –- for instance, schemes in which students in one time zone, who have taken the test, pass answers to students in another time zone who haven’t.

Undetected impersonation cases probably account for less than 0.1% of SAT tests taken, according to John Fremer, a former ETS official who now runs Caveon Test Security.

From a security standpoint, the test’s Achilles’ heel is its acceptance of school IDs as a valid form of identification, say principals and test-site administrators.

“Any fifth-grader with a computer” can crank out a fake school ID, Kaplan said at the hearing.

The SAT-takers arrested on Long Island are accused of doing just that. They accessed test sites by flashing doctored school IDs, which showed pictures of themselves alongside their clients’ personal data, prosecutors say.

At least one suspect on Long Island is accused of taking the test using a school ID that identified him as female.

Those who check the IDs are unsurprised some counterfeits get through. “If it’s a fake ID, it’s hard for us to monitor that,” said Paul Riberio, the former coordinator of SAT tsting at Darien High School in Connecticut.

School IDs in particular are “so easy to forge, whereas if it’s a federal or state-issued ID,” which the College Board also accepts, “that’s a totally different situation,” Riberio said.

Exacerbating the school ID problem, critics say, is a College Board policy that allows students to take the SAT at any test center they choose.

When students take the SAT at their own school, some administrators and proctors may already know them. Administrators are also likely to know exactly what that school’s IDs should look like – and be well prepared to spot any irregularities.

The reverse is true when a student takes the SAT at a school he or she doesn’t attend.

“The more kids you’re having from outside, the harder it is to ensure that the kid is who they say they are,” said Bill Furdon, the principal of Pearl River High School in New York.

Authorities say the suspects in the Long Island case exploited this College Board policy, taking the exam at schools their clients did not attend.

As the College Board and ETS cheating-prevention methods have come under fire, so has their response to test-takers they suspect of cheating, which some call too lax.

ETS offers suspected cheaters three options: Retake the test, cancel your score, or seek judicial review.

When a score is canceled after ETS questions its validity, ETS does not notify the test-taker’s high school that cheating concerns prompted the cancellation.

Only if a cheating case involves the exchange of large sums of money does ETS contact law enforcement, Landgraf testified. It has done so in 10 cases to date, he said. The Long Island case is the first in which a prosecutor has brought criminal charges against alleged cheaters, according to an ETS spokesman.

When asked by legislators why ETS does not punish cheaters more vigorously, Landgraf suggested the organization’s hands were tied by New York’s Education Law.

A section of that law mandates that testing agencies offer due process to cheating suspects. It also requires that suspected cheaters be allowed to cancel disputed test scores and forbids agencies from passing along cheating evidence to the schools of test-takers “under pending investigation.”

But ETS can still notify schools of improprieties it uncovers after cheating investigations conclude, a spokesman for the Nassau County district attorney said.

New York legislators are considering amending the law to permit tougher penalties.

“Cheating on your SAT is wrong and the committee will have to consider whether it is indeed criminal,” state Sen. Kenneth LaValle said at the hearing.

Even before the College Board receives recommendations from Freeh’s security firm, it is weighing several new measures to stamp out impersonations.

The nonprofit is considering adjustments to the number and type of IDs it requires from test-takers, as well the use of digital photography in authenticating test-takers’ identities, Caperton testified.

Other options it is likely to examine include palm-vein identification technology; fingerprinting, which is used on the LSAT exam; and requiring that students take the test at their own schools.

But in addressing the impersonation issue, the College Board may well create other problems.

If new ID requirements are perceived as a hassle, some students might decide not to take the test at all.

And though fee waivers are available to students who qualify, any security enhancement that inflates the SAT’s cost would disproportionately impact low-income test-takers.

ETS is well aware of the tough balancing act required.

“Any sort of requirement that adds additional burdens for students to overcome has to be weighed very carefully,” Ewing said.

Ultimately, the College Board and ETS’ best weapon in the fight against SAT impersonators is probably gossip, the source of so many other problems high schools face.

“Kids are very, very bad secret-keepers,” Fremer said. There would be more impersonation “if they could discipline themselves not to talk about it.”