Real ID: Coming to a State Near You?
Growing up in the Midwest, I'd never met an adult that didn't have a driver's license. As a teenager, a driver's license was a rite of passage that opened access to a whole new world. It seemed almost un-American to my adolescent mind not to get one as soon after your sixteenth birthday as humanly possible. A few years later as a college student I discovered a downside--that slip of paper (yes, it really was printed on a slip of paper) contained information, my birthdate. And every bar near campus wanted to see it.
We forget is that a drivers' license is a recent phenomenon. Missouri and Massachusetts were the first when they passed laws in 1903 requiring all drivers to have a license. In Missouri the cost was 25 cents, and a test wasn't required until 1952.
In the United States, a driver's license has become a de facto identification card. We use it to cash checks at the grocery store and board airplanes. When I moved to Montana a few years ago the only person ahead of me in line at the Division of Motor Vehicles was an elderly gentleman. He was seeking to get a drivers license after a lapse of many years. Not to drive, which he had stopped doing years before, but because he got tired of the hassle involved not having one for identification.
What's Real ID?Following 9/11 there was a push to change procedures for issuing identification documents, particularly when they were used to board airplanes. While the original motivating factor behind Real ID was terrorism, the objectives have grown to include addressing problems associated with identity theft and illegal immigration.
Congress, however, has ducked the politically contentious issue of creating a national identity card and instead decided to require states to comply with federal standards for driver's licenses, effectively transforming them into a de facto national identity card.
The Real ID Act of 2005 basically states that beginning May 11 of this year state driver's licenses and identification cards will not be accepted for federal purposes unless Department of Homeland Security (DHS) determines that a state is compliant with the Real ID regulations or the state has been approved for an extension. In practical terms we're talking about getting on an airplane or entering a federal building such as a courthouse. The deadline for a state requesting an extension was March 31 of this year.
What's Required?This January DHS
released the regulations establishing minimum standards for state-issued drivers' licenses and identification cards. Basically states will be required to have proof of an individual's identity and U.S. citizenship or legal status through documents such as a birth certificate or green card before issuing a drivers' license or identity card. The states must also build security features into the card itself to make them harder to forge and implement a mechanism to share data with other states and the federal government through a common architectural framework.
The final DHS requirements are much less stringent than earlier proposals. For example, requirements for biometric identification and Radio Frequency Identification (RFID) technologies on each card as well as a centralized database were in early versions of the DHS regulations.
State ResistanceThe main reason for the dilution of the regulations was state resistance. Twenty-one states have passed some kind of legislation opposed to Real ID--some such as Montana and Maine going as far as opting out entirely. The reasons for opposition were both practical and philosophical.
Practical ConcernsCost: The DHS estimates that the cost to states to comply with the Real ID Act will not exceed $3.9 billion. A joint study by the National Governors Association and the American Association of Motor Vehicle Administrators
estimates the costs at more than $11 billion over the next five years and points to impacts on services to the public. So far Congress has appropriated $90 million to assist states. The
DHS counters that the final regulations reduce the cost to states by 73 percent from earlier proposals and would only increase the cost of an individual license by $8.
Time and Difficulty of Implementation: State motor vehicle administrators
report that reissuing 242 million licenses and identification cards, which requires verifying each individual's Social Security number, vital records (birth certificates, etc.), and legal resident status, could take eight years. Verifying identity is notoriously difficult. Exceptions, such as not having a birth certificate, having changed names, or a history of using a nickname on documents, render a simple set of procedures useless. A
survey by the American Association of Motor Vehicle Administrators found that 76 percent of the responding jurisdictions anticipated that verifying the validity of source documents would have significant impact on their operation.
Security: While the current regulations no longer include a centralized database of information, concerns remain that a distributed database (one for each state) with a centralized access hub would be an attractive target for hackers. The DHS argues that the regulations provide an adequate level of security. Critics cite the recent discovery that private contractors had accessed the passport data of the current presidential candidates as evidence that federated security procedures need some work.
Scope of Information: Real ID advocates argue that the amount of information that can be remotely accessed is limited. The counter argument is that what seems to be innocuous to one person, say an address, is critical to someone else, say the victim of a stalker.
Non-official Uses: The Real ID Act does not give the DHS authority to restrict who may or may not use Real ID cards. In other words, the local convenience store will be using the Real ID card to control the sale of cigarettes to minors. Remember that Social Security numbers were never meant to be an identifier, but for decades that's what they were.
Third Party Skimming: Real ID cards will include unencrypted personal information in machine-readable format. The decision to not encrypt was driven by state and local law enforcement groups concerned about key management and accessing the information on the card quickly. Non-official users may well find it irresistible to collect the information on a Real ID card. There have been
reports that some businesses are already collecting personal data from driver's licenses using commonly available readers without patrons' consent. While some States, such as California, Nebraska, New Hampshire, and Texas have passed laws that prohibit the collection of information on a driver's license or identification card, most have not.
Adequacy: Although they draw different conclusions, both those supporting and those opposing the Real ID Act are concerned about the adequacy of the regulations. Critics point out that ID documents don't reveal anything about evil intent and that determined terrorists will be able to obtain forged documents. That being the case, they argue that Real ID isn't worth the attendant loss of civil liberties.
Philosophical ConcernThe philosophical objection to the Real ID Act is that it puts the country on a slippery slope to creating a national identity card and a "surveillance society." Thus we find some politically conservative "red" states such as South Carolina aligning with liberal "blue" states such as Maine in opposition to Real ID. This philosophical concern has led to strange bedfellows, including the
John Birch Society and the
American Civil Liberties Union.
What Does This Mean for Higher Education?While analysis of the impact of Real ID lies with a campus' legal staff, it is inevitable that the IT unit will become involved because of the work we do with information security. We need to be prepared to help:
Determine the impact of Real ID on faculty, staff, and students. For example, an opinion by Michigan's attorney led the state to stop issuing new licenses to undocumented and temporary residents. That group included people on student visas and would have seriously impacted foreign graduate students who lived off campus. A change in state law was required.
Analyze the data security requirements needed to protect information stored on state databases. While higher education is not in a position to set state policies, it should be prepared to outline how those policies impact research and instruction. This means that IT and security staff must become familiar with the technology being used and being proposed. For example, regardless of whether the data is stored centrally as originally proposed or in 50 state databases with a common portal, a fundamental question is who can access the data. Higher education is familiar with that problem and can provide valuable recommendations to the state agencies charged with implementing Real ID.
Where Are We Now?One key element of the final regulations issued by DHS was the extension clause, which allowed states to request an extension. Otherwise states were required to be in compliance by May 11, 2008--an almost impossible task. The DNS agreed to grant an extension if a state was making substantial progress to compliance with the regulations and requested an extension by March 31 of this year.
Earlier this month the DNS decided to avoid a showdown over extensions with recalcitrant states. For example, my home state of Montana sent DHS a letter outlining the security features in Montana's Drivers' Licenses (quite good in fact) and stating that the state could not by statute implement the Real ID Act or request an extension. DHS responded that they were granting the state an extension until 2010 anyway. As of this writing, all 50 states have been granted an extension until 2010.
But the issues and concerns haven't gone away. This is an important and highly complex initiative with intelligent and well meaning people on all sides. The April 4, 2008 Christian Science Monitor summed things up nicely: "In any case, the federal government is deluding itself if it thinks that the extensions have solved this issue. It's far from settled."
