Debate on whether it increases or decreases security

By Zack Martin, Editor, Avisian Publications

Some believe that new proposed driver license legislation would help states better secure IDs while also protecting citizen privacy. Others say it “guts” an existing law and takes states back to pre-9/11 identity vetting for IDs.

A hearing held in the U.S. Senate Committee on Homeland Security and Governmental Affairs on the proposed bill called the Providing Additional Security in States’ Identification (PASS) Act of 2009. Testimony revealed very different takes on the bill that would basically roll back, REAL ID. It’s not clear how the proposed change would impact states already complying with REAL ID and rolling out new documents. Even with this new bill looming, some states are still moving ahead to comply with REAL ID.

“The major problem with REAL ID is that it is producing very little progress in terms of securing driver’s licenses, and it is not getting us to where we need to be,” said Janet Napolitano, secretary of the U.S. Department of Homeland Security. “Simply put, REAL ID is unrealistic.”

Citing the almost $4 billion estimated price tags for states to switch to REAL ID and unfeasible deadlines, Napolitano offers up PASS as an alternative. Napolitano, when she was governor of Arizona, had signed a law against REAL ID.

“PASS ID is a critical piece of national security legislation that will fix the REAL ID Act of 2005 and institute strong security standards for government-issued identification,” she said. “PASS ID will fulfill a key recommendation of the 9/11 Commission, that the federal government set standards for identification such as driver’s licenses and non-driver identification cards–and this bill will do so in a way that states will implement, rather than disregard. PASS ID will enact the same strong security standards set out by REAL ID as quickly as REAL ID but, critically, this bill provides a workable way to get there.”

Napolitano said that PASS ID keeps document verification and authenticating of source documents, advocates the physical security of ID production, requires that photos of applicants be taken and still has the requirement to show compliant IDs. “All in all, PASS ID would match the security provided in REAL ID, while providing the states with more flexibility to innovate and meet the standards,” she said.

How does it differ from REAL ID?

The major difference is that PASS ID gives states different options to meet the criteria. “While REAL ID mandates electronic verification for all source document information, PASS ID would maintain a focus on ensuring the authenticity of identity source documents that applicants present, allowing states to adopt cost-effective ways to achieve or exceed that threshold,” Napolitano said.

Since states would be able to choose how to verify identity there would be some cost savings, Napolitano said. The bill would also codify state grants for driver licenses and speed up implementation.

“States would have one year after the issuance of final DHS regulations to begin issuing compliant documents, and would have five years from that date to enroll driver’s license holders as they see fit,” she said. “The REAL ID deadline for completing issuance of compliant driver’s licenses is December 2017. If Congress enacts the PASS ID Act as it is currently written by October 2009, states could complete enrollment by July 2016, a full one year and five months ahead of the REAL ID timetable.”

PASS ID potentially rolls back one key requirement of REAL ID, checking other states to see if an individual has multiple licenses. Napolitano and others say this was cause for privacy concerns. “PASS ID would not require states to provide direct access to each other’s driver’s license databases; in fact, the bill contains protections against creating any national identity database containing all driver’s license information and requires states to adopt adequate procedures to prevent unauthorized access to or sharing of personally identifiable information,” she said.

Opponents see PASS ID as a weak substitute for REAL ID

But what Napolitano sees as privacy protection others see as a security issue. The proposed legislation would basically take driver licenses to where they were before 9/11, says Janice Kephart, a member of the 9/11 Commission and director of national security policy at the Center for Immigration Studies. “It guts the key element of the 9/11 Commission in regards to driver licenses, which is ID verification,” she says. “PASS ID pulls the plug on people proving who they are.”

Cutting out identity verification isn’t the only aspect of PASS ID. Kephart says the bill was put together by the National Governors Association and Napolitano.

The bill creates a new grant process for states to get funding for driver licenses, Kephart says. The new grant process doesn’t require states to account for the funds doled out. Also, if states decided to hook into federal databases to check Social Security numbers or passport information the states wouldn’t have to pay for the access. “The way it’s written it’s a windfall for the states,” she adds.

The bill would also freeze minimum driver license security and ID standards for states to where they are now, Kephart says. “It’s about creating an appearance of security without any real security.”

But the biggest issue is still the lack of identity verification, Kephart says. The bill would not require states to store a photo, check birth records, Social Security numbers or passport numbers. “There’s no cross checks to make sure people don’t have multiple licenses in different states,” she says. “The bill pulls back on all significant areas of identity verification.”

Kephart contends that the bill would also remove the REAL ID stipulation that individuals could not board airplanes without compliant identification. “You still have to take your shoes off at the airport but the bill says no person shall be denied solely by not showing an ID or driver license,” she says.

There are some questions as to whether the bill will get anywhere in Congress. It has been shopped around since Barack Obama was elected, but it took some time before it was submitted in the Senate, suggesting there may be questions as to whether it can pass. “As much as the Senate has not liked REAL ID I don’t think any senator wants to be pinned with rolling back a 9/11 Commission recommendation,” Kephart says.

The bill has received White House attention from Rahm Emmanuel, Obama’s chief of staff, but the administration has its concerns. “The bill doesn’t have the support the administration wants,” Kephart says. “It took so long for submission because they were trying to get members signed on.”

For this and other reasons it’s more likely that REAL ID will get amended, Kephart suggests. The extent of any amendments, however, aren’t clear.

---

How do EDLs fit in with new bill?

Unlike REAL ID, The PASS ID bill would recognize the enhanced driver licenses as being compliant with any federal law regarding driver licenses and state-issued IDs, says Vermont Gov. Jim Douglas, who testified at the U.S. Senate Committee on Homeland Security and Governmental Affairs.

Vermont started issuing EDLs earlier this year and believes they should be compliant with any future requirements. “The importance of Vermont’s EDL being recognized as compliant with federal driver’s license standards cannot be understated as Vermont’s economic, environmental and cultural relationship with Quebec is of paramount importance,” Douglas said. “The EDL cost Vermont about $1 million to implement, but more importantly the ease of border travel it creates is key to our economy and our relationship with Canada, Vermont’s largest trading partner.”

Not including the EDL would create a tough choice for Vermont’s citizens. “If the Vermont EDL were not recognized as REAL ID compliant, citizens would be faced with a difficult choice–either carry an EDL for land border crossings to Quebec or carry a REAL ID compliant card for flying and/or accessing federal buildings,” Douglas said. “If Vermont’s EDL is not compliant, it would become essentially useless as most customers would be better off obtaining a regular license and also maintaining a passport or passport card for border travel.”

But Ari Schwartz, vice president of the Center for Democracy and Technology, testified that Homeland Security should rethink the technology used in EDLs and also find a better way to secure any type of machine-readable code on the IDs. “When used for human identification, long range or vicinity-read RFID poses serious threats to personal privacy and security: it reduces user notice and control over when information is collected from the card and enables location tracking of the cardholder because the unique identifier stored on the chip can be easily skimmed (if unencrypted),” he said. “These serious risks make such long range RFID technology inappropriate for human identification and far outweigh the justifications asserted for its use in the EDL and passport card initiatives.”

EDLs and the Passport Card use radio frequency identification technology that can be read from 15 to 20 feet and is designed to expedite travel over land border crossings. The chip doesn’t contain information other than a unique number that acts as a pointer to a record on a secure database containing the cardholder’s photo and other biographic information.

Schwartz would like the PASS ID act to reject the use of RFID and have any machine-readable technology on the card be encrypted to protect the privacy of the cardholder. Also, he believes the data stored on the card should be limited to what’s necessary for law enforcement of other officials.

“While PASS ID is a major improvement over current law, the bill should be strengthened to further protect privacy and civil liberties while still achieving security objectives,” Schwartz said. “PASS ID provides the opportunity to establish privacy guidance and protections for features of the state driver’s license system that will exist regardless of REAL ID.”

---

Some states on the way to REAL ID compliance

Despite potential changes to legislation impacting state driver licenses and IDs, Nevada is moving forward to comply with REAL ID. The Silver State, however, is giving its residents a choice of whether or not they want a document that complies with the law.

If the individual doesn’t want the new document he can receive one that does not meet the terms of the law, says Tom Jacobs, a spokesman with the Nevada Department of Motor Vehicles. Nevada will start issuing the documents in the fall and will be materially compliant by the first of the year.

The primary difference between the REAL ID documents and the others are the documents used to prove an individual’s identity. Under REAL ID residents can only use seven different documents but Nevada will allow 14 to be used to get a basic license.

The other license won’t be REAL ID-compliant and can’t be used to enter federal buildings or airports, Jacobs says. The conforming driver licenses and state IDs will have security features that identify it as being such.

There will be no difference in cost between the REAL ID documents and the others, Jacobs says. The state will conduct a marketing campaign to let residents know the difference between the documents and educate them on what they may not be able to do with the non-compliant licenses.

The campaign will also educate residents on REAL ID, Jacobs says. “There’s a lot of misinformation out there. It’s not as insidious as everyone thinks.”

There is no national database of driver licenses, as many say, Jacobs stresses. If a resident wants a REAL ID-compliant document the breeder documents will be authenticated, scanned and stored. States will be able to share access to databases to make sure duplicate licenses aren’t being issued but the information is only stored with the state that issues the document.