31 May, 2007
category: Digital ID, Government, Library
By Andy Williams, Contributing Editor
While some of the more costly elements that could have been forced on states to comply with the Real ID Act haven’t materialized – at least in the proposed rules that have come out of Washington. Still, there is anxiety over the act itself, its cost, and whether states can meet the compliance deadline that’s now less than one year away. One person who helped draft the recommendations for establishment of the Real ID Act believes states should stop worrying about complying and work at developing a partnership with the federal government that would make Real ID execution simpler.
The Real ID Act of 2005, passed by Congress last year, prohibits federal agencies (and airlines) from accepting state-issued driver licenses or identification cards unless they meet minimum security requirements – such as including common machine-readable technology and certain anti-fraud features. It also requires verification of information presented by the license applicant, who must also supply evidence that he is a citizen or a legal immigrant. The act requires standardized driver licenses by May 11, 2008, although states will be able to apply for an extension until December 31, 2009, according to proposed Real ID compliance rules that were issued in March.
The Act came about from 9/11 Commission recommendations that the U.S. improve its system for issuing secure identification documents. In the commission’s words: “At many entry points to vulnerable facilities, including gates for boarding aircraft, sources of identification are the last opportunity to ensure that people are who they say they are and to check whether they are terrorists.” That’s particularly evident since many of the 9-11 terrorists had fake driver licenses.
The biggest concern from the states, once Real ID was enacted, was that it would be expensive, costing billions of dollars – some have warned – to implement.
Promoting a state and federal partnership rather than repeal of the Act
Janice Kephart, former counsel to the 9/11 Commission and currently president of 9/11 Security Solutions, believes a partnership between states and the federal government is needed to assure Real ID compliance.
“I feel so strongly that the commission recommendations have tremendous validity. It’s now defunct, and there is no way to drive this forward,” she said of her reasoning for continuing to stay involved in security areas. “I feel I need to keep pushing these recommendations as best as I can. There has been a lot of misinformation on border issues and a misconstruction of 9/11 recommendations. I feel the record has to be kept straight.”
Her latest white paper, Identity and Security: Real ID in the States, is an attempt to provide states that question Real ID with reasons to seek a federal partnership rather than a repeal of the Act, as some 16 states have proposed.
She notes that Real ID is one of the only 9/11 Commission recommendations that rely heavily on the states for implementation, and successful execution of the Act requires a partnership between the federal government and the states.
“Neither the federal government nor the states can implement this important national security measure on their own. They’re going to have to work together,” she added.
She sees the federal government as providing assistance in “procurement in terms of hardware/software and printing machines. For those who want to comply, the federal government can assist them (states) by setting out a menu of compliance options, so the states don’t have to figure things on their own. The federal government is trying to drive down costs so states can buy at cost.”
One of the key ways the feds can help is with the data it has on file. “The federal government holds data that states normally don’t have, such as a determination if an alien is a foreign resident, if he has legal status, his Social Security number data, passport data. These are databases that can be checked when an applicant applies for a new driver license,” said Ms. Kephart. “Sharing information on a real time basis with the states is necessary.”
Real ID, as proposed by the new rules, is certainly capable of being implemented by the states. “All the technology is there,” she adds, “the government is making sure that only technology that’s proven and capable will be required in the rules.”
Debunking myths and addressing funding
In her Real ID missionary status, she has also gone out of her way to debunk so-called “myths” about Real ID. “Real ID does not invade our privacy, it doesn’t create a national ID card, and states can opt in or out if they want to,” she said.
She does agree, partly anyway, with one of the common complaints … that costs will be prohibitive. It will be expensive, she said, but the Department of Homeland Security will enable states to use up to 20% of the state’s Homeland Security Grant Program funds for Real ID. “In the last grant round, roughly $250 million was provided to states, meaning that about $50 million is available for Real ID compliance. DHS has another $34 million in another grant program expressly created for this purpose,” she added.
This helps but will only make a dent. According to Ms. Kephart, “states have estimated they need an initial $1 billion in start-up costs, and the total costs have been estimated at around $11 billion. More funding is absolutely required.”
Implementing Real ID is not just a government responsibility either, she said. “The ability to verify an individual’s true identity is one of the cornerstones of our national and economic security. As such it’s everyone’s responsibility, for our nation is only as strong as its weakest link.”
Establishing minimum standards but encouraging states to do more
“What Real ID really does is set the bar at a certain place that many states are already meeting but some are not,” she added.
The act sets “minimum standards” for both what goes on the card (driver license) and for the security of the card itself. Probably most states already meet some of those requirements as to what’s included in the license (e.g. photo, name, address, and other personal verifying information).
“The piece that’s a little stronger is the anti-counterfeiting section,” she says. “What’s lacking right now is an easy way for the local police officer to determine whether an ID is fake just by looking at it.”
But while such security features haven’t been built into Real ID, there are ways “you can embed something in a card to make it easy to determine if the card is fake,” said Ms. Kephart. Such security features could include tactile (touch and feel), “bumps in the card that are hard to reproduce. There’s also digital watermarking and other kinds of laser technologies that can be used,” she added.
“I’ve talked a lot to folks who do immigration and ID enforcement and they’re the ones telling me about what you can do against a counterfeiter. We can’t do away with it but we can drive up the cost so high (that you effectively) do away with them.” While such thinking may be naive, doing nothing is just as dangerous.
“We need to drive up the cost of recreating a counterfeit card so the counterfeiter’s cost becomes so high that he’s driven out of business,” she added.
Ms. Kephart said, “every state is looking to get on board as fast as possible with a digital image exchange,” another way to verify if the same person holds more than one license. “Some of the states are already requiring that kind of information. A lot of states have stronger requirements than Real ID requires, but they haven’t been able to cross check with other states.”
With one of the requirements – proving who you say you are, such as with a birth certificate – there’s no way to check if that’s valid or not, “but if you can check against other databases, you’ll know if someone else also has that same birth certificate,” she said. That’s one of the purposes of Real ID, she added, “to give states the ability to have this information in front of them so they can verify that information and use it to make good decisions.”
Another issue that has surfaced regards central issuance of driver licenses. It has its pros – more security, more time to check data – and cons – primarily convenience, since applicants must wait a couple of days before they get their licenses.
She points to states like Kansas that have moved from an over-the-counter system to a central issuance system and have actually seen a decrease in applicant processing time from 14 minutes per person to seven minutes per person.
Real ID isn’t going to go away. But, as she points out in her white paper, Real ID “can make a difference … but only if fully implemented and adequately funded.”
Additional resources
Ms. Kephart has created an online Identity Document Security Library, consisting of legal, technical, and policy pieces regarding identity document security. She calls the library a “one-stop-shop information portal for those seeking objective, credible information on the issue of identity document security.” It is available at: 911securitysolutions.com/idsecuritylibrary.