Identity crisis

A federal requirement to standardize driver’s licenses across all 50 states has motor-vehicles departments—including California’s DMV—sweating, and privacy and civil-rights advocates sounding alarms.

The Real ID Act was born from the recommendations of the 9/11 Commission.

It passed Congress without much debate in 2005 (attached to an appropriations bill for Afghanistan and Iraq) and is supposed to be implemented by 2008. Backers say Real ID will keep Americans safe from terrorism and allow them to have the confidence of knowing that license holders are indeed who they say they are.

“The Real ID is vital to preventing foreign terrorists from hiding in plain sight while conducting their operations and planning attacks,” said Representative F. James Sensenbrenner Jr., a Wisconsin Republican and author of the Real ID law last year. “Giving driver’s licenses that can be used as identification to anyone, regardless of whether they are here legally or whether we know who they really are, is an open invitation for terrorists and criminals to exploit.”

With Real ID, licenses from all 50 states must employ standard security measures, including a common machine-readable technology to encode information so that agents at airports, at federal buildings and in other places and situations can easily verify a license holder’s identity using an electronic reader.

Department of Homeland Security spokesman Jarrod Agen told SN&R that the act “addresses critical terrorist threats by reducing the chance that anyone entering the United States illegally could use a state-issued driver’s license to board a plane as some of the 9/11 hijackers did or to enter a federal facility, such as a nuclear power plant.”

But critics of the Real ID Act say the program’s estimated $9 billion to $13 billion price tag is wasted money, because it won’t keep driver’s licenses out of the hands of terrorists as intended. What’s more, they say, its requirements actually increase risks to Americans through potential new invasions of their privacy.

“There’s every reason to believe it won’t stop terrorism,” said Jay Stanley, spokesman for the American Civil Liberties Union’s (ACLU’s) Technology & Liberty Project. “ID cards don’t signal evil intent.”

Some of the 9/11 hijackers obtained driver’s licenses and state identity cards legally with proper documentation. And the ACLU argues that bribes to state employees and hefty payments to counterfeiters will result in driver’s licenses finding their way into the hands of the wrong people regardless of new protections.

“There is no silver bullet against counterfeiting, despite what the agencies say,” Stanley said.

Meanwhile, agencies like the California DMV argue that their licenses are already secure. DMV spokesman Steve Haskins said the agency already builds stringent protections—some put in place post-9/11—and intends to introduce still more unrelated to Real ID in 2008. The hologram, shadow photograph, color-shifting type, fine-line color design background and more all aim to foil counterfeiters. Information from the front of a driver’s license—name, address, gender, age and more—also is embedded in a magnetic stripe on the flip side of the card.

The Real ID law doesn’t define the information to be included or the technology to be used. Motor-vehicles agencies have been working with the departments of Transportation and Homeland Security to define how to implement Real ID, but the rules defining what will be required won’t be known until sometime this fall when they’re posted on the federal register.

The most controversial technology for embedding identity information on licenses: Radio Frequency Identification (RFID) chips that could be scanned from up to 20 feet away through the use of easily obtainable readers. The final rules, however, may favor two-dimensional barcodes or magnetic stripes similar to what California licenses use.

Regardless of which technology is eventually mandated, the ACLU believes it will allow thieves to easily harvest ID data from driver’s licenses. Privacy advocates also forecast that it won’t take long before abuse spreads to the private sector, with businesses from banks to convenience stores soon demanding to scan driver’s licenses and then storing that information in their own databases or selling it to commercial data brokers.

Another concern is the law’s requirements that motor-vehicles departments add to the information contained in their own databases and then devise methods to link them together.

“We live in a computer era where enormous databases are being developed and linked,” the ACLU’s Stanley said. “When you put all that information together in one place, it provides a thick, rich way to move into ‘Big Brother’ territory.”

The irony of Real ID is that the massive databases it spawns actually compromise security, said Senator Joe Simitian, D-Palo Alto, whose bill to place a three-year moratorium to study the issue before putting RFIDs in government IDs awaits a vote by the Assembly after being approved by the Senate last year.

“One of the bedrock principles of privacy is compartmentalization of information,” Simitian said. “Anyone in any state DMV will have access to information from every other state, creating an even greater threat to compromise data.”

In the future, databases will store everything from names and addresses of driver’s-license holders in federally mandated formats to scanned copies of identity source documents, such as birth certificates and immigration documents.

Linking the states’ motor-vehicles databases together also poses significant technical challenges. Even for California’s DMV, which claims to be ahead of the game compared with many other states, readying the department to comply with Real ID is a massive undertaking. An aging computer infrastructure must be retooled, new software designed, equipment installed, and staff hired and trained. A spokesman even hinted that the DMV’s existing 168 field offices might be insufficient to handle the extra 2 million Californians a year who, instead of being able to renew by mail or online, will have to make personal visits to be issued one of the new licenses.

Last month, California’s DMV told a Senate budget and fiscal subcommittee that it’ll need up to a half-billion dollars to implement Real ID. Anthony Bhe, an aide to Senator Michael Machado, D-Linden, the subcommittee’s chairman, isn’t alone in speculating that costs could soar closer to $1 billion.

California doesn’t have to implement Real ID. But if it doesn’t, its citizens won’t be able to use their driver’s licenses as identification to gain entry to a variety of activities, from boarding airplanes to entering federal buildings. The DMV’s Haskins acknowledges the weight of the federal mandate: “I don’t think there’s anybody who doubts we have to do this.”

Paying for the federally required enhancements falls largely to the states. Only $100 million in federal funding has been earmarked to implement Real ID, and California has already applied for its share of the money.

Real ID will have a personal cost for California’s 23 million drivers. It’s likely to result in a doubling of the $26 fee they pay for their licenses. And the requirements to present certified birth certificates and documents to prove they live where they say they do may make it difficult or impossible for some to obtain licenses or state identification cards. For example, Bhe suggested, a roommate not listed on a rental lease or utility bill may have trouble being certified for the new license.

Pressed to begin a five-year process to recertify and issue new licenses and state ID cards to 24 million Californians in May 2008, the DMV is struggling to divine the requirements Homeland Security will announce this fall so it can take proactive measures to help ready the department to implement the program.

Although Department of Homeland Security spokesman Agen said he couldn’t discuss specifics at this point in the process, he noted that the government is considering everything—including the use of RFIDs and concerns raised about threats to privacy—in developing the regulations for Real ID to be released later this year. Following a 60-day public-comment period, final rules may be issued by the end of the year.

Whatever the nuts-and-bolts outcome of the rule-making process, the ACLU’s Stanley laments the “double tragedy” of Real ID: “It’s very offensive to civil liberties and to the age-old idea that our government leaves you alone if you’re not committing a crime, and it’s a wasteful and ineffective way to fight terrorism.”