N.Y. License Plan Sparks Debate

New York Gov. Eliot Spitzer wants his state to implement what hes calling the most secure drivers license in history.

The initiative would enable the state to comply with the federal governments controversial identification mandates and document the million or so illegal immigrants currently living in New York. However, it may be technology rather than politics that derails the proposal.

The plan is running into strong opposition from groups worried in part that the proposed use of RFID (radio-frequency identification) and other technology could endanger the privacy rights of citizens while still not delivering the level of security that the governor is promising. Theyre also concerned that New Yorks proposed license overhaul could pave a path for other states to follow to meet federal mandates.

Working in concert with Department of Homeland Security Secretary Michael Chertoff, an old friend from his law school days, Spitzer developed the license system that would both comply with the federal mandates—the Real ID Act and WHTI (Western Hemisphere Travel Initiative)—and address concerns about the numbers of immigrants in New York.

However, in his zeal to create a secure system, Spitzer is proposing the use of technology—RFID and facial biometric scans—that not only goes beyond DHS recommendations for complying with the mandates but also employs the very technology that has privacy and security advocates up in arms and has state legislators across the country mutinying against Real ID.

Resource Library:

Spitzers plan calls for three separate licenses for New York residents, based almost entirely on their level of travel outside New York: one state license for all citizens—immigrants or not; one that would comply with Real ID and grant access to federal buildings, nuclear power plants and commercial aircraft; and a third that would comply with WHTI and is aimed at allowing Canadian and other contiguous border crossings.

Here is where it gets tricky. Immigrants are eligible for the state (or basic) license but not for the Real ID or WHTI license. However, should immigrants want to travel on a domestic commercial airline—a likelihood for at least a good percentage of people—they will need to have the Real ID, which in New Yorks case means the use of RFID technology.

"If youre going to use a wireless technology [such as RFID], its not what you use if you want security," said Melissa Ngo, director of the Identification and Surveillance Project at the Electronic Privacy Information Center, in Washington.

"[New York] says they want more secure, harder-to-access, harder-to-duplicate licenses, but when it really comes down to it, no ID card is going to be unforgeable; people are going to figure it out," Ngo said. "Thats our main argument against Real ID. If you create one ID card for all these things—crossing the border, opening a bank account, driving—will it turn into a card to get health care or other services?"

Ngo noted that Chertoff has said he wants the Real ID to do double and triple duty, and thats precisely the fear of many opponents—that the Real ID would turn into a national identification card.

The Real ID Act, passed in 2005 as a rider to a military spending bill, is designed to flush out suspected terrorists who apply for a drivers license by mandating more stringent documentation requirements and more sharing of information between states. The act has two technology requirements, both controversial.

The first requires that states digitize six points of drivers license documentation, such as passport, birth certificate and proof of home address. States are also required to store citizen documentation in a database that is in turn linked to all other states databases.

DHS initially tried to mandate that states link their databases to other countries as well, but that measure was shot down. States are required to share not only drivers ID documentation, but also drivers histories, such as past motor vehicle violations and license suspensions. States that dont link their databases to all the other states will lose some federal funding.

The second major component of Real ID is the requirement that each state add to drivers licenses machine-readable technology that carries data and, when activated with a reader, transmits the data. In March, the DHS released proposed regulations—the actual regulations are expected in the next month or two—that implied the law would require two-dimensional bar-code technology.

The DHS had been leaning toward mandating RFID as the necessary machine-readable technology that states would need to implement to comply, but a major backlash led to a pullback and the recommendation for 2-D technology, which many states currently have. That said, the DHS is encouraging states to go beyond the use of 2-D technology with, presumably, RFID.

"We were happy that DHS ended up recommending 2-D and not RFID—2-D is a lot more safe than RFID," said Lee Tien, senior staff attorney at the Electronic Frontier Foundation, which advocates against Real ID. "Then Spitzers plan turns out to be [bringing] in an enhanced setup, and thats the worst kind of RFID you can use. EPC [Electronic Product Code] technology used in enhanced drivers licenses was never intended for people; it was intended for goods" because of low-frequency, long-read ranges.

"At the end of the day, [Spitzers actions] could have some effect on other states. It makes [Real ID] look better. On the other hand, it doesnt put millions of dollars in their coffers; it doesnt make other states ability to comply any easier."

Thirty-eight states have banded together to fight against Real ID, 17 of which have opted out through legislative action. Rep. Jim Guest, R-Mo., who formed the coalition of states, told eWEEK in a previous interview that the Real ID Act "is a direct frontal assault on the freedom of citizens when [the federal government] wants us to carry a national ID."

Guest objects to the privacy and security threats inherent in the readable technology and associated databases and said there is no judicial or congressional oversight over the DHS mandate. "My concern is that even if they water [the Real ID Act] down a bit, DHS will try and accomplish what they want to with some other legislation," Guest said. "Homeland Security has total control; there is no judicial or legislative control over this. Once they issue [the act], there is no way of stopping them."

WHTI, the second mandate with which Spitzer is trying to comply, is the result of the Intelligence Reform and Terrorism Prevention Act of 2004. It requires citizens traveling between the United States, Canada, Mexico, Central and South America, and the Caribbean or Bermuda by land or sea to present a valid U.S. passport. By calling the WHTI license an "enhanced license," Spitzer is trying to offer New Yorkers who frequently cross into Canada an alternative to the passport requirement.

And while Spitzer is calling the WHTI license the only enhanced license in his plan, the fact is that when DHS releases the Real ID regulations—and New York moves quickly to implement them—it, too, will fall under the designation of an enhanced license. That comes with its own issues.

Under Spitzers plan, New Yorkers seeking an enhanced license would be subject to the scrutiny of an Enhanced Identification Verification Unit. As Spitzer described it in a speech at the New York University School of Law Oct. 19, any identity documents that cant be verified at a Department of Motor Vehicle office will be sent to the EIV Unit—the first of its kind in the nation.

"The EIV Unit will be staffed by investigators working with specially trained clerks, who will be certified by the very same training program used to train federal agents who review breeder documents [such as birth certificates and passports] at agencies like the Department of Defense and the State Department," Spitzer said at the school.

"These forensic-level machines are the same ones currently used by the FBI, Immigration and Customs Enforcement, and the Secret Service. The EIV Unit will also have access to a variety of databases … to make sure people are who they say they are."

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.