The DHS claims the final Real ID regulations resolve states' complaints about privacy and cost.After months of waiting for the Real ID Act regulations to be spelled out,
the U.S. Department of Homeland Security announced Jan. 11 the final rule
establishing minimum security standards for state-issued driver's license and
identification cards.
The bottom line for security and privacy advocates: RFID technology will not
be required as the mandated machine-readable technology. But the DHS is
sticking with the proposed two-dimensional bar code. The states, which have
been impatiently waiting to learn the requirements, won't be directed to
collect any biometric identifiers like fingerprints or iris images.
With these requirements, the burden and cost of implementation will not be
quite as onerous as had been predicted. The DHS said in a statement that actual
implementation costs have been cut by about 73 percent, mainly by giving states
more time to issue the new Real ID-compliant license to older Americans.
For citizens, the picture is not so rosy if their states choose not to
comply with Real ID—and at least 38 states have banned together to
legislatively impede the Act. As of May 11, citizens of states that do not
minimally comply with the requirements of Real ID may not use their driver's
licenses or state IDs to pass through security at airports.
"Citizens in this category will likely encounter significant travel
delays," the Real ID Act ruling said.
Click here to read more about why security advocates are fighting a plan to use "vicinity RFID" in U.S. passports.
During the 60-day open comment period for Real ID that ended May 8, 2007, the DHS received over
21,000 comments. In its final rules documentation, the DHS said it had received
"several" comments expressing support for the proposed rule.
"One commenter wrote that Real ID correctly specified a set of
performance standards rather than listing static prescriptive standards, and
that enhanced document security is essential to combat terrorists, can help
improve transportation safety, and can combat identity theft or other criminal
acts," the documentation said. "DHS agrees with these commenters and
believes that States that fully implement these rules will improve national
security by improving the security and reliability of a key document carried by
many Americans."
However, according to the rules documentation, "many" people
opposed the Real ID program. "Many commenters wrote that the rule fails to
provide appropriate security, utility or privacy, according to the rule,"
the DHS wrote, and added in response that while it "appreciates the many
comments received…DHS respectfully disagrees. … DHS strongly disagrees with the
proposition that the rules will lead to an increase in identity theft, harm
privacy or enable the government to track individuals in their daily lives.
"To the contrary, the rules create an environment where it is far less
likely that an individual can fraudulently obtain a State-issued identity
document using another person's identity and identity documents and minimizes
the possibility that one individual can obtain identification documents in
multiple names and identities.
"The privacy interests of driver's license and identification card
applicants are strengthened, rather than weakened, since this rule requires all
States to protect the personally identifiable information that DMVs collect
from applicants."
The finalized Real ID ruling requires that compliant licenses and ID cards
include much of the same information that is on a standard driver's license: a
person's full legal name, date of birth and gender, the driver's license
number, a digital photograph, and address and signature.
But is also requires "physical security features designed to prevent
tampering, counterfeiting, or duplication of the drivers' licenses and
identification cards for fraudulent purposes; and a common machine-readable
technology, with defined minimum elements."
Other technology mandates such as the database specifications to maintain
the documentation required by citizens to obtain a Real ID are not yet clear,
nor are the rules about how states will share data with one another and with
the Federal government, as required by the Act.
The first deadline for compliance with Real ID is Dec. 31, 2009. By then, states must upgrade
the security of their license systems "to include a check for lawful
status of all applicants to ensure that illegal aliens cannot obtain Real ID
licenses. Some states are expected to be compliant well before that time. Compliance
will be needed for access into a federal facility, boarding commercial aircraft
and entering nuclear power plants."
One big complaint from states has been the estimated costs to implement the
mandatory systems and procedures needed to comply with Real ID—a cost, it was
feared, that would not be supplemented or reimbursed by the federal government.
But the DHS said in its Jan. 11 ruling that it is making approximately $360
million available to assist states with Real ID implementation—$80 million in
dedicated Real ID grants and another $280 million in general funding as part of
the Homeland Security Grant Program.
Whether $360 million split among the states will be more than a drop in the
bucket remains to be seen.
"The American public's desire for greater
identity protection is undeniable," Homeland Security Secretary Michael
Chertoff said in a statement. "Americans understand today that the 9/11
hijackers obtained 30 drivers licenses and IDs, and used 364 aliases. For an
extra $8 per license, Real ID will give law enforcement and security officials
a powerful advantage against falsified documents, and it will bring some peace
of mind to citizens wanting to protect their identity from theft by a criminal
or illegal alien."
